@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/data_sync/lib/abandoned-run.ts

@@ -1,56 +0,0 @@
-import type { AbandonedJobInfo } from '@open-mercato/queue'
-
-/**
- * Fail the run behind a job the queue gave up on.
- *
- * A resumable data_sync job is ONE long-lived job for a whole run — `runImport` is entered once and
- * stays there for the duration, which for a full backfill is days. Every worker death (a deploy, an
- * OOM) therefore stalls that job, and BullMQ's stalled counter is cumulative for the job's life:
- * past `DATA_SYNC_MAX_STALLED_COUNT` it writes a deferred failure and the next worker fails the job
- * BEFORE calling the processor.
- *
- * So `runImport` never runs, never throws, and never finalizes — and `sync_runs` is left saying
- * `running` for a run nothing is running, forever. That is the residual state `queue-policy.ts`
- * describes as what remains after a job exhausts its stall budget; this repairs it.
- *
- * It only ever moves a non-terminal run: `markStatus` refuses to overwrite `completed` / `failed` /
- * `cancelled`, so a job abandoned after its run has ended is a no-op. `onJobAbandoned` may deliver
- * the same job more than once, which for the same reason is also a no-op.
- *
- * The run's progress job is failed alongside it, the way the worker's own catch path does in
- * `workers/sync-import.ts`. Without that the two halves disagree — the run reads `failed` while the
- * operation still shows as in flight in the top bar — until the progress staleness sweep eventually
- * fails it with a generic no-heartbeat message instead of the reason the queue recorded.
- */
-export async function failAbandonedRun(payload: unknown, info: AbandonedJobInfo): Promise<void> {
-  const data = payload as { payload?: { runId?: unknown; scope?: { organizationId?: unknown; tenantId?: unknown } } } | undefined
-  const runId = data?.payload?.runId
-  const scope = data?.payload?.scope
-  // Nothing to repair without both: the run row is keyed by id AND tenant scope.
-  if (typeof runId !== 'string' || typeof scope?.organizationId !== 'string' || typeof scope?.tenantId !== 'string') return
-
-  const runScope = { organizationId: scope.organizationId, tenantId: scope.tenantId }
-  const errorMessage = `the queue abandoned this run's job without running it: ${info.reason}`
-
-  const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
-  const container = await createRequestContainer()
-  const runService = container.resolve('dataSyncRunService') as {
-    markStatus(
-      runId: string,
-      status: string,
-      scope: { organizationId: string; tenantId: string },
-      error?: string,
-    ): Promise<{ progressJobId?: string | null } | null>
-  }
-  const run = await runService.markStatus(runId, 'failed', runScope, errorMessage)
-  if (!run?.progressJobId) return
-
-  const progressService = container.resolve('progressService') as {
-    failJob(
-      jobId: string,
-      input: { errorMessage: string },
-      ctx: { organizationId: string; tenantId: string },
-    ): Promise<unknown>
-  }
-  await progressService.failJob(run.progressJobId, { errorMessage }, runScope)
-}

package/src/modules/devices/api/deviceSerialization.ts

@@ -1,50 +0,0 @@
-import { z } from 'zod'
-import type { UserDevice } from '../data/entities'
-import { toDeprecatedSnakeCaseAliases, toIso } from './deviceList'
-
-// Detail contract for `GET /api/devices/admin/devices/:id`. Keys are camelCase like every other
-// module's responses (#5513); the snake_case keys stay alongside as deprecated aliases for one minor
-// version, per the deprecation protocol in BACKWARD_COMPATIBILITY.md § 7.
-// push_token is a secret and is never returned.
-export function serializeDeviceDetail(device: UserDevice): Record<string, unknown> {
-  const camel = {
-    id: device.id,
-    userId: device.userId,
-    deviceId: device.deviceId,
-    platform: device.platform,
-    clientAppVersion: device.clientAppVersion ?? null,
-    osVersion: device.osVersion ?? null,
-    pushProvider: device.pushProvider ?? null,
-    pushTokenUpdatedAt: toIso(device.pushTokenUpdatedAt),
-    lastSeenAt: toIso(device.lastSeenAt),
-    createdAt: toIso(device.createdAt),
-    updatedAt: toIso(device.updatedAt),
-  }
-  return { ...camel, ...toDeprecatedSnakeCaseAliases(camel) }
-}
-
-// See the note in ./deviceList — the rendered deprecation notice lives on the endpoint description.
-const deprecatedAlias = (of: string) => `Deprecated alias for \`${of}\`; removed in the next minor release.`
-
-export const deviceDetailItemSchema = z.object({
-  id: z.string().uuid(),
-  userId: z.string().uuid(),
-  deviceId: z.string(),
-  platform: z.enum(['ios', 'android', 'web']),
-  clientAppVersion: z.string().nullable(),
-  osVersion: z.string().nullable(),
-  pushProvider: z.string().nullable(),
-  pushTokenUpdatedAt: z.string().nullable(),
-  lastSeenAt: z.string().nullable(),
-  createdAt: z.string().nullable(),
-  updatedAt: z.string().nullable(),
-  user_id: z.string().uuid().describe(deprecatedAlias('userId')),
-  device_id: z.string().describe(deprecatedAlias('deviceId')),
-  client_app_version: z.string().nullable().describe(deprecatedAlias('clientAppVersion')),
-  os_version: z.string().nullable().describe(deprecatedAlias('osVersion')),
-  push_provider: z.string().nullable().describe(deprecatedAlias('pushProvider')),
-  push_token_updated_at: z.string().nullable().describe(deprecatedAlias('pushTokenUpdatedAt')),
-  last_seen_at: z.string().nullable().describe(deprecatedAlias('lastSeenAt')),
-  created_at: z.string().nullable().describe(deprecatedAlias('createdAt')),
-  updated_at: z.string().nullable().describe(deprecatedAlias('updatedAt')),
-})

package/src/modules/devices/backend/devices/useDeviceUserLabels.ts

@@ -1,45 +0,0 @@
-'use client'
-
-import * as React from 'react'
-import { resolveDeviceUserOptions } from './userOptions'
-
-// Resolves owner ids that are on screen into display labels. Modelled on
-// warranty_claims/backend/components/useUserDisplayNames, but every failure degrades to an empty
-// map instead of throwing: a devices admin without `auth.users.list` must still see the page.
-export function useDeviceUserLabels(userIds: readonly (string | null | undefined)[]): Record<string, string> {
-  const [labels, setLabels] = React.useState<Record<string, string>>({})
-  const resolvedIdsRef = React.useRef<Set<string>>(new Set())
-
-  const idsKey = React.useMemo(() => {
-    const normalized = new Set<string>()
-    for (const userId of userIds) {
-      if (typeof userId === 'string' && userId.trim()) normalized.add(userId.trim())
-    }
-    return Array.from(normalized)
-      .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0))
-      .join(',')
-  }, [userIds])
-
-  React.useEffect(() => {
-    if (!idsKey) return
-    const unresolved = idsKey.split(',').filter((userId) => !resolvedIdsRef.current.has(userId))
-    if (unresolved.length === 0) return
-
-    const controller = new AbortController()
-    void resolveDeviceUserOptions(unresolved, controller.signal)
-      .then(({ options, resolvedIds }) => {
-        if (controller.signal.aborted) return
-        // Only ids the server actually answered for are remembered. Marking an id whose request
-        // failed would keep its row showing a bare UUID for the life of the component, even though
-        // the next attempt would have worked.
-        for (const userId of resolvedIds) resolvedIdsRef.current.add(userId)
-        const next: Record<string, string> = {}
-        for (const option of options) next[option.value] = option.label
-        if (Object.keys(next).length) setLabels((current) => ({ ...current, ...next }))
-      })
-      .catch(() => {})
-    return () => controller.abort()
-  }, [idsKey])
-
-  return labels
-}

package/src/modules/devices/backend/devices/userOptions.ts

@@ -1,99 +0,0 @@
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
-import { MAX_USER_LOOKUP_IDS } from '@open-mercato/core/modules/auth/lib/userIdFilter'
-
-export type DeviceUserOption = {
-  value: string
-  label: string
-}
-
-type AuthUserItem = {
-  id?: unknown
-  name?: unknown
-  email?: unknown
-}
-
-const SEARCH_PAGE_SIZE = 20
-// Imported rather than restated: `parseIdsParam` slices past the route's cap without complaining,
-// so a client batch larger than the server accepts loses the overflow ids silently.
-const MAX_IDS_PER_LOOKUP = MAX_USER_LOOKUP_IDS
-
-/**
- * Two label styles on purpose. A picker suggestion has to disambiguate two people with the same
- * display name, and neither `CrudForm`'s combobox nor `FilterBar` renders anything but the label —
- * so the email has to live in the label there. A resolved column label is read next to a device,
- * where the email is noise.
- */
-type LabelStyle = 'search' | 'compact'
-
-function toOption(item: AuthUserItem | null | undefined, style: LabelStyle): DeviceUserOption[] {
-  if (!item || typeof item.id !== 'string' || !item.id.trim()) return []
-  const id = item.id.trim()
-  const name = typeof item.name === 'string' && item.name.trim() ? item.name.trim() : null
-  const email = typeof item.email === 'string' && item.email.trim() ? item.email.trim() : null
-  const label = style === 'search' && name && email ? `${name} — ${email}` : name ?? email ?? id
-  return [{ value: id, label }]
-}
-
-// `devices.admin` declares `dependsOn: ['auth.users.list']`, but dependsOn only diagnoses — a
-// hand-built role can still reach these screens without it until the ACL editor or
-// `sync-role-acls` fixes it. `x-om-forbidden-redirect: 0` keeps that 403 from bouncing the whole
-// page to /login. `null` means the call itself failed, which callers must not
-// confuse with a successful call that matched nobody — a caller caching "already resolved" would
-// otherwise remember a transient network error forever.
-async function fetchUsers(
-  params: URLSearchParams,
-  style: LabelStyle,
-  signal?: AbortSignal,
-): Promise<DeviceUserOption[] | null> {
-  const call = await apiCall<{ items?: AuthUserItem[] }>(
-    `/api/auth/users?${params.toString()}`,
-    { headers: { 'x-om-forbidden-redirect': '0' }, signal },
-    { fallback: null },
-  ).catch(() => null)
-  if (!call || !call.ok) return null
-  return (call.result?.items ?? []).flatMap((item) => toOption(item, style))
-}
-
-export async function loadDeviceUserOptions(query?: string): Promise<DeviceUserOption[]> {
-  const params = new URLSearchParams()
-  params.set('page', '1')
-  params.set('pageSize', String(SEARCH_PAGE_SIZE))
-  const trimmed = query?.trim()
-  if (trimmed) params.set('search', trimmed)
-  // A picker has nothing to cache, so a failed lookup is just an empty suggestion list.
-  return (await fetchUsers(params, 'search')) ?? []
-}
-
-/**
- * The outcome of a batch lookup. `resolvedIds` lists the ids the server actually answered for —
- * an id that came back without a row (deleted user) still counts as resolved, an id whose request
- * failed does not. Callers cache on `resolvedIds`, so a transient failure is retried rather than
- * remembered as a permanent blank.
- */
-export type DeviceUserLookup = {
-  options: DeviceUserOption[]
-  resolvedIds: string[]
-}
-
-// Batch id → label resolution for rows already on screen, so a device whose owner never appeared in
-// a search result still renders a name instead of a bare UUID.
-export async function resolveDeviceUserOptions(ids: string[], signal?: AbortSignal): Promise<DeviceUserLookup> {
-  const unique = Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)))
-  if (unique.length === 0) return { options: [], resolvedIds: [] }
-  const options: DeviceUserOption[] = []
-  const resolvedIds: string[] = []
-  for (let offset = 0; offset < unique.length; offset += MAX_IDS_PER_LOOKUP) {
-    const batch = unique.slice(offset, offset + MAX_IDS_PER_LOOKUP)
-    const params = new URLSearchParams()
-    params.set('page', '1')
-    params.set('pageSize', String(batch.length))
-    // URLSearchParams encodes on toString(); pre-encoding here would double-escape the commas.
-    params.set('ids', batch.join(','))
-    const batchOptions = await fetchUsers(params, 'compact', signal)
-    // One failed batch must not cost the batches that did answer.
-    if (batchOptions === null) continue
-    options.push(...batchOptions)
-    resolvedIds.push(...batch)
-  }
-  return { options, resolvedIds }
-}

package/src/modules/directory/services/organizationHierarchyService.ts

@@ -1,34 +0,0 @@
-import type { FilterQuery } from '@mikro-orm/core'
-import type { EntityManager } from '@mikro-orm/postgresql'
-import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { Organization } from '../data/entities'
-
-function normalizeIds(values: unknown): string[] {
-  if (!Array.isArray(values)) return []
-  return Array.from(new Set(values
-    .map((value) => typeof value === 'string' ? value.trim() : '')
-    .filter(Boolean)))
-}
-
-export class DefaultOrganizationHierarchyService implements OrganizationHierarchyService {
-  constructor(private readonly em: EntityManager) {}
-
-  async resolveAncestorIds(input: {
-    tenantId: string
-    organizationId: string
-  }): Promise<string[] | null> {
-    const organization = await findOneWithDecryption(
-      this.em,
-      Organization,
-      {
-        id: input.organizationId,
-        tenant: input.tenantId,
-        deletedAt: null,
-      } as FilterQuery<Organization>,
-      { fields: ['id', 'ancestorIds'] },
-      { tenantId: input.tenantId, organizationId: input.organizationId },
-    )
-    return organization ? normalizeIds(organization.ancestorIds) : null
-  }
-}

package/src/modules/directory/services/organizationScopeService.ts

@@ -1,85 +0,0 @@
-import type { EntityManager } from '@mikro-orm/postgresql'
-import type { AwilixContainer } from 'awilix'
-import type {
-  OrganizationScopeService,
-  OrganizationScopeRequest,
-} from '@open-mercato/shared/lib/auth/principal-service'
-import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
-import { resolveOrganizationScope, resolveOrganizationScopeForRequest } from '../utils/organizationScope'
-
-type OrganizationScopeRbac = {
-  invalidateUserCache(userId: string): Promise<void>
-  loadAcl(
-    userId: string,
-    scope: { tenantId: string | null; organizationId: string | null },
-  ): Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>
-}
-
-export class DefaultOrganizationScopeService implements OrganizationScopeService {
-  constructor(
-    private readonly em: EntityManager,
-    private readonly rbac: OrganizationScopeRbac,
-    private readonly container: AwilixContainer,
-  ) {}
-
-  resolve(input: {
-    auth: AuthContext | null | undefined
-    selectedId?: string | null
-    tenantId?: string | null
-    freshAcl?: boolean
-  }) {
-    const auth = input.auth
-    if (input.freshAcl && auth?.sub) {
-      return this.resolveFresh({
-        auth,
-        selectedId: input.selectedId,
-        tenantId: input.tenantId,
-      }).then((result) => result.scope)
-    }
-    return resolveOrganizationScope({
-      em: this.em,
-      rbac: this.rbac as Parameters<typeof resolveOrganizationScope>[0]['rbac'],
-      auth: input.auth,
-      selectedId: input.selectedId,
-      tenantId: input.tenantId,
-    })
-  }
-
-  async resolveFresh(input: {
-    auth: NonNullable<AuthContext>
-    selectedId?: string | null
-    tenantId?: string | null
-  }) {
-    await this.rbac.invalidateUserCache(input.auth.sub)
-    const acl = await this.rbac.loadAcl(input.auth.sub, {
-      tenantId: input.tenantId ?? input.auth.tenantId ?? null,
-      organizationId: input.selectedId ?? input.auth.orgId ?? null,
-    })
-    const freshRbac: Parameters<typeof resolveOrganizationScope>[0]['rbac'] = {
-      loadAcl: async () => acl,
-    }
-    const scope = await resolveOrganizationScope({
-      em: this.em,
-      rbac: freshRbac,
-      auth: input.auth,
-      selectedId: input.selectedId,
-      tenantId: input.tenantId,
-    })
-    return { scope, acl }
-  }
-
-  resolveForRequest(input: {
-    auth: AuthContext | null | undefined
-    request?: OrganizationScopeRequest
-    selectedId?: string | null
-    tenantId?: string | null
-  }) {
-    return resolveOrganizationScopeForRequest({
-      container: this.container,
-      auth: input.auth,
-      request: input.request,
-      selectedId: input.selectedId,
-      tenantId: input.tenantId,
-    })
-  }
-}

package/src/modules/integrations/backend/integrations/credential-secret-fields.ts

@@ -1,84 +0,0 @@
-import type { IntegrationCredentialField } from '@open-mercato/shared/modules/integrations/types'
-import { SECRET_CREDENTIAL_FIELD_TYPES } from '../../lib/credentials-masking'
-
-export type SecretFieldsConfigured = Record<string, boolean>
-
-export type CredentialSavePayload = {
-  credentials: Record<string, unknown>
-  unchangedSecretFields?: string[]
-}
-
-export function buildCredentialEditValues(
-  credentials: Record<string, unknown>,
-  secretFieldsConfigured: SecretFieldsConfigured,
-): Record<string, unknown> {
-  const editValues = { ...credentials }
-
-  for (const [fieldKey, configured] of Object.entries(secretFieldsConfigured)) {
-    if (configured) delete editValues[fieldKey]
-  }
-
-  return editValues
-}
-
-export function buildCredentialSavePayload(
-  values: Record<string, unknown>,
-  fields: readonly IntegrationCredentialField[],
-  secretFieldsConfigured: SecretFieldsConfigured,
-  deliberatelyClearedSecretFields: ReadonlySet<string> = new Set(),
-): CredentialSavePayload {
-  const credentials = { ...values }
-  const unchangedSecretFields = new Set<string>()
-
-  for (const field of fields) {
-    if (!SECRET_CREDENTIAL_FIELD_TYPES.has(field.type)) continue
-
-    if (deliberatelyClearedSecretFields.has(field.key)) {
-      delete credentials[field.key]
-      continue
-    }
-
-    if (!secretFieldsConfigured[field.key]) continue
-    const value = credentials[field.key]
-    if (value !== undefined && value !== '') continue
-
-    delete credentials[field.key]
-    unchangedSecretFields.add(field.key)
-  }
-
-  return unchangedSecretFields.size > 0
-    ? { credentials, unchangedSecretFields: [...unchangedSecretFields] }
-    : { credentials }
-}
-
-export function buildIntegrationCredentialSavePayload(
-  integrationId: string,
-  values: Record<string, unknown>,
-  fields: readonly IntegrationCredentialField[],
-  secretFieldsConfigured: SecretFieldsConfigured,
-): CredentialSavePayload {
-  const normalizedValues = { ...values }
-  const deliberatelyClearedSecretFields = new Set<string>()
-
-  if (integrationId === 'storage_s3') {
-    const authMode = normalizedValues.authMode
-    if (authMode !== 'access_keys' && authMode !== 'ambient') {
-      const hasKeys = Boolean(normalizedValues.accessKeyId || normalizedValues.secretAccessKey)
-      normalizedValues.authMode = hasKeys ? 'access_keys' : 'ambient'
-    }
-    if (normalizedValues.authMode === 'ambient') {
-      delete normalizedValues.accessKeyId
-      delete normalizedValues.secretAccessKey
-      delete normalizedValues.sessionToken
-      deliberatelyClearedSecretFields.add('secretAccessKey')
-      deliberatelyClearedSecretFields.add('sessionToken')
-    }
-  }
-
-  return buildCredentialSavePayload(
-    normalizedValues,
-    fields,
-    secretFieldsConfigured,
-    deliberatelyClearedSecretFields,
-  )
-}

package/src/modules/messages/lib/channel-sender-identity.ts

@@ -1,55 +0,0 @@
-/**
- * How the hub decides whether an external correspondent must be identified by an
- * email address.
- *
- * Background (#4975): `composeMessageSchema` used to require `externalEmail` for
- * every non-draft message with `visibility: 'public'` — which is every message
- * from an external sender. That assumption holds only for email-typed channels.
- * A Discord sender is a snowflake and has no address at all, so inbound Discord
- * failed validation deterministically and the ingest job died in the queue while
- * the channel still reported `Connected`.
- *
- * Variant A of the spec's § Open decision — hub sender-identity contract makes
- * the requirement conditional on the originating channel type, and **fails
- * closed**: only a channel type this list positively recognizes as non-email
- * waives the requirement. An unrecognized, empty or absent channel type keeps
- * the pre-existing behaviour, so no current caller changes and a typo'd or
- * caller-asserted type cannot quietly switch a validation rule off.
- *
- * For these channels the sender identity is not lost — it is carried by
- * `ExternalMessage.sender_identifier` and joined 1:1 to the platform message
- * through `MessageChannelLink`.
- *
- * Adding a channel type here is additive and non-breaking: it only widens the
- * set of inputs the hub accepts.
- */
-const NON_EMAIL_SENDER_CHANNEL_TYPES = new Set([
-  'discord',
-  'slack',
-  'teams',
-  'telegram',
-  'signal',
-  'whatsapp',
-  'messenger',
-  'instagram',
-  'sms',
-  'push',
-])
-
-/**
- * True when a message originating from `channelType` must carry an
- * `externalEmail` to be composed with `visibility: 'public'`.
- *
- * Fail-closed by design — see the note above.
- */
-export function channelTypeRequiresExternalEmail(channelType?: string | null): boolean {
-  if (typeof channelType !== 'string') return true
-  const normalized = channelType.trim().toLowerCase()
-  if (!normalized) return true
-  return !NON_EMAIL_SENDER_CHANNEL_TYPES.has(normalized)
-}
-
-/** The recognized non-email channel types, for tests and diagnostics. */
-export function listNonEmailSenderChannelTypes(): string[] {
-  return Array.from(NON_EMAIL_SENDER_CHANNEL_TYPES).sort((left, right) => left.localeCompare(right))
-}

package/src/modules/messages/lib/composeSourceChannelType.ts

@@ -1,95 +0,0 @@
-import { z } from 'zod'
-
-/**
- * Entity type a channel-backed conversation is exposed under on a message's
- * `sourceEntityType`. Written by `communication_channels`' inbound ingest.
- */
-const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = 'communication_channels.external_conversation'
-
-/**
- * The only parts of a compose body this resolution needs. Read defensively from
- * the raw request body, before the body is validated, because the validation
- * outcome itself depends on the answer (#4975).
- */
-export const composeSourceHintSchema = z.object({
-  sourceEntityType: z.string().optional(),
-  sourceEntityId: z.string().uuid().optional(),
-  parentMessageId: z.string().uuid().optional(),
-})
-
-export type ComposeSourceHint = z.infer<typeof composeSourceHintSchema>
-
-/**
- * Whether the compose validator can consult a resolved channel type at all.
- *
- * `sourceChannelType` is read in exactly one branch — a non-draft, public
- * message that carries no address. Every internal reply, every draft and every
- * public message that already supplies an address ignores it, so resolving it
- * for them is a DI resolve plus a database round-trip whose answer is
- * discarded. Mirrors `refineComposeMessage` and reads the raw body defensively,
- * because this runs before validation. Skipping resolution yields `undefined`,
- * which is already the fail-closed value.
- */
-export function composeRequiresChannelTypeResolution(body: unknown): boolean {
-  if (!body || typeof body !== 'object') return false
-  const raw = body as Record<string, unknown>
-  if (raw.visibility !== 'public') return false
-  if (raw.isDraft === true) return false
-  const externalEmail = raw.externalEmail
-  return !(typeof externalEmail === 'string' && externalEmail.trim().length > 0)
-}
-
-type ResolveChannelTypeService = (
-  container: ContainerLike,
-  scope: { tenantId: string; organizationId: string | null },
-  reference: { externalConversationId?: string | null; messageId?: string | null },
-) => Promise<string | null>
-
-type ContainerLike = { resolve: <T = unknown>(name: string) => T }
-
-function tryResolveChannelTypeService(
-  container: ContainerLike,
-): ResolveChannelTypeService | undefined {
-  try {
-    return container.resolve<ResolveChannelTypeService>('communicationChannelsResolveChannelType')
-  } catch {
-    // `communication_channels` is optional: without it no message can originate
-    // from a channel, so "unknown" is both correct and fail-closed.
-    return undefined
-  }
-}
-
-/**
- * Resolve the channel type a compose request originates from, server-side.
- *
- * Never derived from the request body's own `sourceChannelType` — that would let
- * any caller waive the `externalEmail` requirement by asserting a channel type.
- * It is looked up from the conversation the message is being composed on, or
- * from the parent message it replies to.
- *
- * Returns `undefined` when nothing can be established, which the compose
- * validator treats as "unknown" and therefore keeps the pre-#4975 rule.
- */
-export async function resolveComposeSourceChannelType(
-  container: ContainerLike,
-  scope: { tenantId: string; organizationId: string | null },
-  hint: ComposeSourceHint,
-): Promise<string | undefined> {
-  const externalConversationId =
-    hint.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE
-      ? hint.sourceEntityId ?? null
-      : null
-  const messageId = hint.parentMessageId ?? null
-  if (!externalConversationId && !messageId) return undefined
-
-  const resolveChannelType = tryResolveChannelTypeService(container)
-  if (!resolveChannelType) return undefined
-
-  const channelType = await resolveChannelType(container, scope, {
-    externalConversationId,
-    messageId,
-  })
-  return channelType ?? undefined
-}
-
-export { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE }

package/src/modules/query_index/lib/search-entity-policy.ts

@@ -1,46 +0,0 @@
-import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
-
-/**
- * The canonical customer record. Every customer also has a person or company profile indexed under
- * its own entity type, and it is the profile — not the base row — that carries the detail-page
- * navigation.
- */
-export const CUSTOMERS_BASE_ENTITY_TYPE = 'customers:customer_entity'
-
-/**
- * Whether base customer rows are offered as search results.
- *
- * Why the knob exists: `search_tokens` is written by the query index for **every** entity a CRUD
- * route indexes, independently of any module's `search.ts` config. `customers:customer_entity` is
- * indexed but no module registers it for search, so its rows only ever surface a second,
- * navigation-less copy of a customer who is already represented by their person or company
- * profile — the duplicate reported in #5046. Worse, the duplicate was visible to superadmins only:
- * `resolveReadableEntityTypes` narrows every other caller to entity types a module registered for
- * search, so the same query returned different shapes for different users.
- *
- * Default `false`: the token strategy never returns base customer rows, so a customer appears
- * exactly once, as their profile. `OM_SEARCH_CUSTOMERS_INDEX_BASE_ENTITY=true` restores the
- * previous behavior, where both rows are returned and the presenter enricher's linked-result merge
- * collapses the pair into the canonical entity result.
- *
- * Deliberately a **read-side** filter. `search_tokens` is not only the token-search index: the
- * People and Companies list routes resolve their search box through
- * `findEntityIdsBySearchTokens` on this exact entity type, and both query engines rewrite
- * `like`/`ilike` on encrypted customer columns into the same table. Dropping the rows would
- * silently break list search on `display_name`, `primary_email`, `description` and friends, so the
- * rows stay and only the search strategy stops offering them.
- */
-export function indexesCustomerBaseEntity(): boolean {
-  return parseBooleanWithDefault(process.env.OM_SEARCH_CUSTOMERS_INDEX_BASE_ENTITY, false)
-}
-
-/**
- * Entity types the token search strategy must not return.
- *
- * Exposed as a list so the strategy can express the exclusion as a single `NOT IN` predicate
- * instead of post-filtering rows it already paid to fetch — a post-filter would silently shrink
- * the caller's `limit`.
- */
-export function listSearchTokenExcludedEntityTypes(): string[] {
-  return indexesCustomerBaseEntity() ? [] : [CUSTOMERS_BASE_ENTITY_TYPE]
-}