@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/src/shared/identity-v3-hash.test.ts

@@ -1,174 +0,0 @@
-// Tests for the ASP.NET Core Identity V3 password-hash verifier.
-//
-// Strategy:
-//   - "Round-trip" tests build a V3-format blob from scratch using the
-//     documented byte-layout, then verify it. The Buffer.concat + readUInt32BE
-//     in `buildV3Hash` are independent of the verifier's parser, so a bug in
-//     either side surfaces as a mismatch.
-//   - The hardcoded "BMC-shaped" hash bytes (0x01, PRF=1, iter=10000, salt=16
-//     bytes) lock the format the BMC dump actually carries. If the parser
-//     drifted to e.g. little-endian or a wrong header offset, the iter+saltLen
-//     read would mis-align and verification would fail.
-//   - Negative tests cover wrong password, format-marker mismatch, truncated
-//     blobs, unsupported PRF — all the ways a verifier could leak a 500
-//     instead of returning false.
-
-import { describe, expect, test } from "bun:test";
-import { pbkdf2Sync } from "node:crypto";
-import { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
-import { verifyPassword } from "./password-hashing";
-
-// --- Test helpers ---
-
-const BMC_ITERATIONS = 10_000;
-const BMC_SUBKEY_LENGTH = 32;
-
-const PRF_HMAC_SHA256 = 1;
-const PRF_HMAC_SHA512 = 2;
-
-function buildV3Hash(args: {
-  readonly password: string;
-  readonly salt: Buffer;
-  readonly iterations: number;
-  readonly prf: number;
-  readonly subkeyLength?: number;
-}): string {
-  const algorithm =
-    args.prf === PRF_HMAC_SHA256 ? "sha256" : args.prf === PRF_HMAC_SHA512 ? "sha512" : null;
-  if (algorithm === null) throw new Error(`unsupported test PRF: ${args.prf}`);
-
-  const subkeyLength = args.subkeyLength ?? BMC_SUBKEY_LENGTH;
-  const subkey = pbkdf2Sync(args.password, args.salt, args.iterations, subkeyLength, algorithm);
-
-  const header = Buffer.alloc(13);
-  header.writeUInt8(0x01, 0); // V3 format marker
-  header.writeUInt32BE(args.prf, 1);
-  header.writeUInt32BE(args.iterations, 5);
-  header.writeUInt32BE(args.salt.length, 9);
-
-  return Buffer.concat([header, args.salt, subkey]).toString("base64");
-}
-
-// Reproducible salt via static seed — using random salts in tests muddies
-// the failure mode (was it the verifier or RNG flakiness?).
-const FIXED_SALT_16 = Buffer.from("0123456789abcdef", "ascii");
-
-describe("isIdentityV3Hash", () => {
-  test("recognizes a real-shape BMC V3 hash by format marker", () => {
-    const hash = buildV3Hash({
-      password: "irrelevant",
-      salt: FIXED_SALT_16,
-      iterations: BMC_ITERATIONS,
-      prf: PRF_HMAC_SHA256,
-    });
-    expect(isIdentityV3Hash(hash)).toBe(true);
-    // Sanity: real BMC hashes start with this fixed prefix because the first
-    // 9 header bytes are deterministic for HMAC-SHA256/10000-iter hashes.
-    expect(hash.startsWith("AQAAAAEAACcQ")).toBe(true);
-  });
-
-  test("rejects argon2 hashes (different format prefix)", () => {
-    expect(isIdentityV3Hash("$argon2id$v=19$m=19456,t=2,p=1$abc$def")).toBe(false);
-  });
-
-  test("rejects empty strings and garbage", () => {
-    expect(isIdentityV3Hash("")).toBe(false);
-    expect(isIdentityV3Hash("not-base64-!!!")).toBe(false);
-  });
-});
-
-describe("verifyIdentityV3Hash — BMC-shaped (HMACSHA256, 10k iter, 16-byte salt)", () => {
-  const password = "Test-Pa$$word-1!";
-  const hash = buildV3Hash({
-    password,
-    salt: FIXED_SALT_16,
-    iterations: BMC_ITERATIONS,
-    prf: PRF_HMAC_SHA256,
-  });
-
-  test("accepts the correct password", () => {
-    expect(verifyIdentityV3Hash(password, hash)).toBe(true);
-  });
-
-  test("rejects an incorrect password (no exception, just false)", () => {
-    expect(verifyIdentityV3Hash("Wrong-Password!", hash)).toBe(false);
-  });
-
-  test("rejects empty password against a real hash", () => {
-    expect(verifyIdentityV3Hash("", hash)).toBe(false);
-  });
-});
-
-describe("verifyIdentityV3Hash — HMACSHA512 variant", () => {
-  // ASP.NET also writes V3 hashes with PRF=2 (HMACSHA512). BMC doesn't use it
-  // but we shouldn't break a future migration that does.
-  const password = "another-secret";
-  const hash = buildV3Hash({
-    password,
-    salt: FIXED_SALT_16,
-    iterations: 50_000,
-    prf: PRF_HMAC_SHA512,
-  });
-
-  test("verifies SHA512 hashes correctly", () => {
-    expect(verifyIdentityV3Hash(password, hash)).toBe(true);
-    expect(verifyIdentityV3Hash("not-it", hash)).toBe(false);
-  });
-});
-
-describe("verifyIdentityV3Hash — malformed input", () => {
-  test("returns false on truncated header", () => {
-    // 5 bytes: format + half-PRF — not enough for the 13-byte header.
-    const truncated = Buffer.from([0x01, 0x00, 0x00, 0x00, 0x01]).toString("base64");
-    expect(verifyIdentityV3Hash("anything", truncated)).toBe(false);
-  });
-
-  test("returns false on unsupported PRF (e.g. 99)", () => {
-    const password = "secret";
-    const subkey = pbkdf2Sync(password, FIXED_SALT_16, 1000, 32, "sha256");
-    const header = Buffer.alloc(13);
-    header.writeUInt8(0x01, 0);
-    header.writeUInt32BE(99, 1); // bogus PRF
-    header.writeUInt32BE(1000, 5);
-    header.writeUInt32BE(FIXED_SALT_16.length, 9);
-    const hash = Buffer.concat([header, FIXED_SALT_16, subkey]).toString("base64");
-    expect(verifyIdentityV3Hash(password, hash)).toBe(false);
-  });
-
-  test("returns false when subkey is missing", () => {
-    // Header announces 16-byte salt and supplies it, but no subkey bytes.
-    const header = Buffer.alloc(13);
-    header.writeUInt8(0x01, 0);
-    header.writeUInt32BE(1, 1);
-    header.writeUInt32BE(10_000, 5);
-    header.writeUInt32BE(16, 9);
-    const hash = Buffer.concat([header, FIXED_SALT_16]).toString("base64");
-    expect(verifyIdentityV3Hash("anything", hash)).toBe(false);
-  });
-
-  test("returns false on wrong format marker (e.g. 0x00 = legacy V2)", () => {
-    const subkey = pbkdf2Sync("x", FIXED_SALT_16, 1000, 32, "sha256");
-    const header = Buffer.alloc(13);
-    header.writeUInt8(0x00, 0); // V2 marker, not supported here
-    header.writeUInt32BE(1, 1);
-    header.writeUInt32BE(1000, 5);
-    header.writeUInt32BE(16, 9);
-    const hash = Buffer.concat([header, FIXED_SALT_16, subkey]).toString("base64");
-    expect(verifyIdentityV3Hash("x", hash)).toBe(false);
-  });
-});
-
-describe("verifyPassword — routes between argon2 and Identity-V3", () => {
-  test("accepts a V3 hash via the unified verifyPassword entry point", async () => {
-    const password = "legacy-user-password";
-    const hash = buildV3Hash({
-      password,
-      salt: FIXED_SALT_16,
-      iterations: BMC_ITERATIONS,
-      prf: PRF_HMAC_SHA256,
-    });
-
-    expect(await verifyPassword(hash, password)).toBe(true);
-    expect(await verifyPassword(hash, "wrong")).toBe(false);
-  });
-});

package/src/shared/identity-v3-hash.ts

@@ -1,97 +0,0 @@
-// ASP.NET Core Identity V3 password-hash verifier.
-//
-// Why this lives in Kumiko: legacy migrations from .NET stacks (BMC: 22k
-// users with Identity-V3 passwordHash) need login to keep working without
-// forcing every user through a password-reset flow. New hashes are still
-// argon2 — Identity-V3 is verify-only.
-//
-// Format specification (from ASP.NET Core Identity source —
-// `Microsoft.AspNetCore.Identity.PasswordHasher`, `IdentityV3` mode):
-//
-//   Byte 0:        format marker (0x01 = V3)
-//   Bytes 1..4:    PRF as uint32 big-endian
-//                    1 = HMACSHA256
-//                    2 = HMACSHA512
-//                    (BMC uses 1; we accept both since the format does)
-//   Bytes 5..8:    iteration count as uint32 big-endian
-//   Bytes 9..12:   salt length in bytes as uint32 big-endian
-//   Bytes 13..:    salt + derived subkey, concatenated
-//
-//   The whole blob is base64-encoded. Typical BMC hash starts with
-//   "AQAAAAEAACcQ..." which decodes to:
-//     0x01 (V3) | 0x00000001 (HMACSHA256) | 0x00002710 (10000 iter) | …
-//
-// We never produce these — `hashPassword()` (argon2id) is the canonical
-// path. After a successful Identity-V3 login the application can re-hash
-// the password into argon2 on the next change-password event; that's
-// out-of-scope here.
-
-import { pbkdf2Sync, timingSafeEqual } from "node:crypto";
-
-const FORMAT_MARKER_V3 = 0x01;
-const HEADER_LENGTH = 13; // 1 (format) + 4 (PRF) + 4 (iter) + 4 (saltLen)
-
-const PRF_HMAC_SHA256 = 1;
-const PRF_HMAC_SHA512 = 2;
-
-// Quick sniff so the caller can route between argon2 and Identity-V3 without
-// throwing parse errors on every login. Only checks the format marker; the
-// full structural validation happens in `verifyIdentityV3Hash`.
-export function isIdentityV3Hash(hashB64: string): boolean {
-  const bytes = decodeBase64(hashB64);
-  if (bytes === null) return false;
-  return bytes.length >= HEADER_LENGTH && bytes[0] === FORMAT_MARKER_V3;
-}
-
-// Returns true on match. False on any mismatch — wrong password, malformed
-// hash, unsupported PRF, garbled length fields. Never throws (mirrors
-// `verifyPassword`'s contract — auth handlers don't want exceptions on
-// pathological stored data, just a clean "no").
-export function verifyIdentityV3Hash(password: string, hashB64: string): boolean {
-  const bytes = decodeBase64(hashB64);
-  if (bytes === null) return false;
-  if (bytes.length < HEADER_LENGTH) return false;
-  if (bytes[0] !== FORMAT_MARKER_V3) return false;
-
-  const prf = bytes.readUInt32BE(1);
-  const iterations = bytes.readUInt32BE(5);
-  const saltLength = bytes.readUInt32BE(9);
-
-  // Defensive: ASP.NET writes 16-byte salts, but the format technically
-  // allows any length. We accept what's encoded but bail if the blob is
-  // truncated mid-salt.
-  if (saltLength === 0) return false;
-  if (bytes.length <= HEADER_LENGTH + saltLength) return false; // need ≥1 subkey byte
-
-  const salt = bytes.subarray(HEADER_LENGTH, HEADER_LENGTH + saltLength);
-  const subkey = bytes.subarray(HEADER_LENGTH + saltLength);
-
-  const algorithm = prfToNodeAlgorithm(prf);
-  if (algorithm === null) return false;
-
-  let derived: Buffer;
-  try {
-    derived = pbkdf2Sync(password, salt, iterations, subkey.length, algorithm);
-  } catch {
-    return false;
-  }
-
-  if (derived.length !== subkey.length) return false;
-  return timingSafeEqual(derived, subkey);
-}
-
-function prfToNodeAlgorithm(prf: number): "sha256" | "sha512" | null {
-  if (prf === PRF_HMAC_SHA256) return "sha256";
-  if (prf === PRF_HMAC_SHA512) return "sha512";
-  return null;
-}
-
-function decodeBase64(b64: string): Buffer | null {
-  // Lenient decode: Buffer.from strips whitespace and ignores trailing garbage,
-  // which is what we want for hashes pulled out of CSV exports / legacy DBs
-  // that might carry stray CR/LF.
-  if (typeof b64 !== "string" || b64.length === 0) return null;
-  const buf = Buffer.from(b64, "base64");
-  if (buf.length === 0) return null;
-  return buf;
-}

package/src/shared/index.ts

@@ -1,50 +0,0 @@
-export { assertErased } from "./assert-erased";
-export {
-  type ChunkedMigrationOptions,
-  type ChunkedMigrationResult,
-  type ChunkedMigrationStopReason,
-  type MigrationRowOutcome,
-  runChunkedMigration,
-} from "./chunked-entity-migration";
-export {
-  classifyStoredEnvelope,
-  type StoredEnvelopeClassification,
-} from "./classify-stored-envelope";
-export { decryptStoredPii } from "./decrypt-stored-pii";
-export { encryptForDirectWrite } from "./encrypt-for-direct-write";
-export { entitiesOf } from "./entities-of";
-export { isWithinGracePeriod } from "./grace-period";
-export { hasWhereRule } from "./has-where-rule";
-export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
-export { isTenantDb } from "./is-tenant-db";
-export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter";
-export { mapWithConcurrency } from "./map-with-concurrency";
-export { joinRowParentIsVisible, parentRowIsVisible } from "./parent-visibility";
-export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
-export {
-  type RowBoundGrantResult,
-  redeemRowBoundGrant,
-  signRowBoundGrant,
-} from "./row-bound-grant";
-export { runInSubTransaction } from "./run-in-sub-transaction";
-export { sessionField } from "./session-field";
-export { sessionLocaleField } from "./session-locale-field";
-export { sessionTimezoneField } from "./session-timezone-field";
-export {
-  peekTokenSubject,
-  signToken,
-  TokenPurpose,
-  type VerifyResult,
-  verifyToken,
-} from "./signed-token";
-export {
-  EXT_SIGNUP_HANDOVER,
-  findSignupHandoverProvider,
-  isSignupHandoverProvider,
-  SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE,
-  type SignupHandoverBinding,
-  type SignupHandoverProvider,
-} from "./signup-handover";
-export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store";
-export type { SystemQueryFn } from "./system-query";
-export { type BurnResult, burnToken, unburnToken } from "./token-burn-store";

package/src/shared/is-tenant-db.ts

@@ -1,9 +0,0 @@
-import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
-
-// Structural probe: a TenantDb and a raw DbRunner both expose fetchOne/selectMany,
-// so the shape alone can't tell them apart — `unsafeRaw` only exists on TenantDb.
-// Shared so retention/compliance-profile resolvers that accept either (bulk cron
-// vs. per-hook TenantDb) branch through one predicate instead of duplicating it.
-export function isTenantDb(db: DbRunner | TenantDb): db is TenantDb {
-  return typeof (db as Partial<TenantDb>).unsafeRaw === "function";
-}

package/src/shared/lockout-counter.test.ts

@@ -1,91 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { createLockoutCounter } from "./lockout-counter";
-
-// Production Redis has active lockout/mfa-verify entries under these exact
-// keys — only asserting the generated Redis key strings (not just behavior
-// through a mocked client) catches a prefix typo that would silently make
-// existing entries unreachable. The two prefix pairs below are byte-copies
-// of the ones lockout-store.ts and mfa-verify-attempts.ts wire onto this
-// factory; only integration tests exercised this logic before (which never
-// assert on the raw key string), so this is new coverage.
-// countKey/untilKey are not exported by the factory (only the bound
-// operations are) — verify the key shape indirectly through a fake Redis
-// client that records the keys it's called with.
-function fakeRedis() {
-  const calls: { method: string; args: unknown[] }[] = [];
-  const redis = {
-    mget: async (...args: unknown[]) => {
-      calls.push({ method: "mget", args });
-      return [null, null];
-    },
-    incr: async (...args: unknown[]) => {
-      calls.push({ method: "incr", args });
-      return 1;
-    },
-    expire: async (...args: unknown[]) => {
-      calls.push({ method: "expire", args });
-      return 1;
-    },
-    set: async (...args: unknown[]) => {
-      calls.push({ method: "set", args });
-      return "OK";
-    },
-    get: async (...args: unknown[]) => {
-      calls.push({ method: "get", args });
-      return null;
-    },
-    del: async (...args: unknown[]) => {
-      calls.push({ method: "del", args });
-      return 1;
-    },
-    // biome-ignore lint/suspicious/noExplicitAny: minimal ioredis stand-in for key-string assertions
-  } as any;
-  return { redis, calls };
-}
-
-describe("account-lockout Redis key strings", () => {
-  const counter = createLockoutCounter("kumiko:auth:lockout:count:", "kumiko:auth:lockout:until:");
-
-  test("getState reads the byte-identical count/until keys", async () => {
-    const { redis, calls } = fakeRedis();
-    await counter.getState(redis, "u1");
-    expect(calls[0]).toEqual({
-      method: "mget",
-      args: ["kumiko:auth:lockout:count:u1", "kumiko:auth:lockout:until:u1"],
-    });
-  });
-
-  test("clearState deletes the byte-identical count/until keys", async () => {
-    const { redis, calls } = fakeRedis();
-    await counter.clearState(redis, "u1");
-    expect(calls[0]).toEqual({
-      method: "del",
-      args: ["kumiko:auth:lockout:count:u1", "kumiko:auth:lockout:until:u1"],
-    });
-  });
-});
-
-describe("mfa-verify Redis key strings", () => {
-  const counter = createLockoutCounter(
-    "kumiko:auth:mfa-verify:count:",
-    "kumiko:auth:mfa-verify:until:",
-  );
-
-  test("getState reads the byte-identical count/until keys", async () => {
-    const { redis, calls } = fakeRedis();
-    await counter.getState(redis, "u1");
-    expect(calls[0]).toEqual({
-      method: "mget",
-      args: ["kumiko:auth:mfa-verify:count:u1", "kumiko:auth:mfa-verify:until:u1"],
-    });
-  });
-
-  test("clearState deletes the byte-identical count/until keys", async () => {
-    const { redis, calls } = fakeRedis();
-    await counter.clearState(redis, "u1");
-    expect(calls[0]).toEqual({
-      method: "del",
-      args: ["kumiko:auth:mfa-verify:count:u1", "kumiko:auth:mfa-verify:until:u1"],
-    });
-  });
-});

package/src/shared/lockout-counter.ts

@@ -1,108 +0,0 @@
-// Generic Redis-backed failed-attempt counter with auto-expiring lockout.
-// Extracted from auth-email-password/lockout-store.ts and
-// auth-mfa/mfa-verify-attempts.ts (infra#446) — both were byte-identical
-// INCR/NX logic, differing only in their Redis key prefixes.
-
-import type Redis from "ioredis";
-
-export type LockoutCounterState = {
-  readonly failureCount: number;
-  // Epoch milliseconds when the account/attempt auto-unlocks. null while the
-  // counter is still below threshold.
-  readonly lockedUntil: number | null;
-};
-
-// Two keys per subject so each can carry its own TTL:
-//   - count-key: 24h, carries the streak. Monotonic — once threshold is
-//     crossed it STAYS crossed until the caller explicitly clears it.
-//   - until-key: exactly the lockout duration, auto-expires when the lock
-//     ends (Redis TTL replaces a "timer" that would otherwise need a job).
-//
-// Consequence of the monotonic counter: once a subject has been locked, the
-// NEXT failure after the lock expires re-locks immediately — the INCR still
-// returns a value ≥ threshold, so the SET NX re-arms the lock. Clearing the
-// streak is the caller's responsibility (e.g. a successful login, or a
-// dedicated unlock flow) — intentional: brute-force resistance favours
-// strictness over UX for anonymous attempts.
-export function createLockoutCounter(countKeyPrefix: string, untilKeyPrefix: string) {
-  function countKey(subjectId: string): string {
-    return `${countKeyPrefix}${subjectId}`;
-  }
-  function untilKey(subjectId: string): string {
-    return `${untilKeyPrefix}${subjectId}`;
-  }
-
-  async function getState(redis: Redis, subjectId: string): Promise<LockoutCounterState | null> {
-    const [countRaw, untilRaw] = await redis.mget(countKey(subjectId), untilKey(subjectId));
-    if (countRaw === null) return null;
-    const failureCount = Number(countRaw);
-    if (!Number.isFinite(failureCount)) return null;
-    const lockedUntil = untilRaw !== null ? Number(untilRaw) : null;
-    return {
-      failureCount,
-      lockedUntil: lockedUntil !== null && Number.isFinite(lockedUntil) ? lockedUntil : null,
-    };
-  }
-
-  // Race-free: INCR is atomic at the Redis level, so N concurrent failed
-  // attempts produce exactly N increments — no GET-SET window to lose an
-  // increment through. The NX on the until-key likewise guarantees only one
-  // attempt out of a concurrent batch sets the lock timestamp; subsequent
-  // concurrent attempts find the key already set and leave it alone, so the
-  // lock window stays anchored to the first-to-cross, not the last.
-  async function recordFailedAttempt(
-    redis: Redis,
-    subjectId: string,
-    maxFailedAttempts: number,
-    lockoutDurationMinutes: number,
-  ): Promise<LockoutCounterState> {
-    const lockDurationMs = lockoutDurationMinutes * 60 * 1000;
-    // TTL on the count-key: 24h covers "I fat-fingered yesterday". The
-    // lockout duration is on the until-key; the count-key outlives it so an
-    // expired lock leaves a counter ≥ threshold — that's what makes the next
-    // miss immediately re-lock (strict-semantic; see the type-comment above).
-    const ttlSec = Math.max(lockoutDurationMinutes * 60, 24 * 3600);
-
-    const count = await redis.incr(countKey(subjectId));
-    if (count === 1) {
-      // First failure → set the TTL. INCR doesn't set one; a counter without
-      // TTL would leak forever for subjects that never return.
-      await redis.expire(countKey(subjectId), ttlSec);
-    }
-
-    let lockedUntil: number | null = null;
-    if (count >= maxFailedAttempts) {
-      const computedUntil = Date.now() + lockDurationMs;
-      // NX: only set if no lock is currently armed. A second concurrent attempt
-      // arriving after the first crossed the threshold must NOT reset the
-      // timer — the lock window should align with the attempt that crossed,
-      // not the one that happened a millisecond later.
-      const setOk = await redis.set(
-        untilKey(subjectId),
-        String(computedUntil),
-        "PX",
-        lockDurationMs,
-        "NX",
-      );
-      if (setOk === "OK") {
-        lockedUntil = computedUntil;
-      } else {
-        // Another concurrent attempt already locked — read the authoritative
-        // timestamp so the returned state matches what a follow-up
-        // getState would see.
-        const existing = await redis.get(untilKey(subjectId));
-        lockedUntil = existing !== null ? Number(existing) : null;
-      }
-    }
-
-    return { failureCount: count, lockedUntil };
-  }
-
-  // Idempotent — deleting missing keys is a no-op, so a replayed clear just
-  // re-clears harmlessly.
-  async function clearState(redis: Redis, subjectId: string): Promise<void> {
-    await redis.del(countKey(subjectId), untilKey(subjectId));
-  }
-
-  return { getState, recordFailedAttempt, clearState };
-}

package/src/shared/map-with-concurrency.test.ts

@@ -1,104 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { mapWithConcurrency } from "./map-with-concurrency";
-
-describe("mapWithConcurrency", () => {
-  test("preserves result order regardless of completion order", async () => {
-    const delays = [30, 10, 20, 0];
-    const results = await mapWithConcurrency(delays, 4, async (delay, index) => {
-      await new Promise((resolve) => setTimeout(resolve, delay));
-      return index;
-    });
-    expect(results).toEqual([0, 1, 2, 3]);
-  });
-
-  test("never runs more than `limit` calls concurrently", async () => {
-    let active = 0;
-    let maxActive = 0;
-    const items = Array.from({ length: 12 }, (_, i) => i);
-    await mapWithConcurrency(items, 4, async (item) => {
-      active++;
-      maxActive = Math.max(maxActive, active);
-      await new Promise((resolve) => setTimeout(resolve, 5));
-      active--;
-      return item;
-    });
-    expect(maxActive).toBeLessThanOrEqual(4);
-    expect(maxActive).toBeGreaterThan(1);
-  });
-
-  test("propagates the first rejection", async () => {
-    const items = [1, 2, 3];
-    await expect(
-      mapWithConcurrency(items, 4, async (item) => {
-        if (item === 2) throw new Error("boom");
-        return item;
-      }),
-    ).rejects.toThrow("boom");
-  });
-
-  // Two workers rejecting at different times, under 4-way concurrency —
-  // regression guard for the #1398 hazard (an eagerly-fired, never-awaited
-  // Promise surfacing as an unattributed unhandled rejection). Every
-  // worker promise here is an element of the internal `Promise.all` array,
-  // so both rejections are always handled even though the aggregate
-  // `mapWithConcurrency` call already settled on the first one.
-  test("a second rejection after the first doesn't surface as an unhandled rejection", async () => {
-    const unhandled: unknown[] = [];
-    const onUnhandledRejection = (reason: unknown, _promise: Promise<unknown>): void => {
-      unhandled.push(reason);
-    };
-    process.on("unhandledRejection", onUnhandledRejection);
-    try {
-      const items = [1, 2, 3, 4, 5, 6, 7, 8];
-      await expect(
-        mapWithConcurrency(items, 4, async (item) => {
-          if (item === 2) {
-            await new Promise((resolve) => setTimeout(resolve, 5));
-            throw new Error("boom-early");
-          }
-          if (item === 5) {
-            await new Promise((resolve) => setTimeout(resolve, 20));
-            throw new Error("boom-late");
-          }
-          await new Promise((resolve) => setTimeout(resolve, 10));
-          return item;
-        }),
-      ).rejects.toThrow("boom-early");
-      // Give the later-rejecting worker's promise a chance to settle and
-      // for a real unhandled rejection (if any) to fire.
-      await new Promise((resolve) => setTimeout(resolve, 50));
-    } finally {
-      process.off("unhandledRejection", onUnhandledRejection);
-    }
-    expect(unhandled).toEqual([]);
-  });
-
-  test("does not claim new items after the first rejection", async () => {
-    const started: number[] = [];
-    const items = Array.from({ length: 20 }, (_, i) => i);
-    await expect(
-      mapWithConcurrency(items, 2, async (item) => {
-        started.push(item);
-        if (item === 0) throw new Error("boom");
-        // Slow enough that without fail-fast, more workers would drain the list.
-        await new Promise((resolve) => setTimeout(resolve, 30));
-        return item;
-      }),
-    ).rejects.toThrow("boom");
-    // At most `limit` in-flight when the first throw sets `failed`; without
-    // the flag the other worker would keep claiming the rest of the 20.
-    expect(started.length).toBeLessThan(items.length);
-    expect(started.length).toBeLessThanOrEqual(3);
-  });
-
-  test("empty input resolves to an empty array without running the worker", async () => {
-    const results = await mapWithConcurrency<number, number>([], 4, async (item) => item);
-    expect(results).toEqual([]);
-  });
-
-  test("limit larger than item count doesn't over-spawn workers", async () => {
-    const items = [1, 2];
-    const results = await mapWithConcurrency(items, 10, async (item) => item * 2);
-    expect(results).toEqual([2, 4]);
-  });
-});

package/src/shared/map-with-concurrency.ts

@@ -1,38 +0,0 @@
-// Bounded-concurrency map — runs `fn` over `items` with at most `limit`
-// calls in flight. `Promise.all(items.map(fn))` is unbounded (as many
-// calls as rows); a plain sequential loop caps concurrency at 1, which
-// under-uses a resource pool that allows more (e.g. PgKmsAdapter's
-// default `max: 4` — sequential decrypt-per-row leaves 3 pool slots idle
-// and turns each query into 2N serial round-trips instead of ~2N/4).
-// Order of `results` matches `items`, independent of completion order.
-// On rejection: the returned promise rejects with the first error, and
-// remaining workers stop claiming new items (`failed` flag). In-flight
-// calls already past the claim still run to completion (their promises
-// stay in the `Promise.all` array, so a later rejection can't surface as
-// an unhandled rejection — verified in `mapWithConcurrency.test.ts`).
-export async function mapWithConcurrency<T, R>(
-  items: readonly T[],
-  limit: number,
-  fn: (item: T, index: number) => Promise<R>,
-): Promise<R[]> {
-  const results: R[] = new Array(items.length);
-  let nextIndex = 0;
-  let failed = false;
-  async function worker(): Promise<void> {
-    for (;;) {
-      // skip: another worker already failed — stop claiming new items.
-      if (failed) return;
-      const index = nextIndex++;
-      // skip: cursor exhausted, normal worker-loop exit
-      if (index >= items.length) return;
-      try {
-        results[index] = await fn(items[index] as T, index);
-      } catch (err) {
-        failed = true;
-        throw err;
-      }
-    }
-  }
-  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
-  return results;
-}