@open-mercato/shared 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6824.1.21fff90682

package/src/lib/di/__tests__/container-app-di.test.ts

@@ -0,0 +1,173 @@
+// Tests for the app-level DI override hook (`src/di.ts` → `@/di`) in
+// `createRequestContainer()`. The hook used to swallow EVERY failure with
+// bare `catch {}` blocks, so a src/di.ts whose register() threw — or a @/di
+// module that failed to load for any reason other than being absent — was
+// skipped without a trace and the documented override point silently did
+// nothing. Absence of the optional module must stay quiet; real failures
+// must be logged.
+
+import { asValue } from 'awilix'
+
+jest.mock(
+  '@open-mercato/shared/lib/db/mikro',
+  () => {
+    const baseEm: any = {
+      fork: () => baseEm,
+      getRepository: () => ({ find: async () => [], findOne: async () => null }),
+    }
+    return {
+      __esModule: true,
+      getOrm: async () => ({ em: baseEm }),
+      getOrmEntities: () => [],
+      registerOrmEntities: () => {},
+    }
+  },
+  { virtual: false },
+)
+
+jest.mock(
+  '@mikro-orm/core',
+  () => ({
+    __esModule: true,
+    RequestContext: { getEntityManager: () => null },
+  }),
+  { virtual: true },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/query/engine',
+  () => ({ __esModule: true, BasicQueryEngine: class {} }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/data/engine',
+  () => ({ __esModule: true, DefaultDataEngine: class {} }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/commands',
+  () => ({
+    __esModule: true,
+    commandRegistry: {},
+    CommandBus: class { constructor() {} },
+  }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/modules/overrides',
+  () => ({
+    __esModule: true,
+    applyDiOverridesToContainer: () => {},
+  }),
+  { virtual: false },
+)
+
+// Keep this suite hermetic: without this mock the REAL core bootstrap module
+// loads (and runs its module-level side effects) whenever generated files
+// exist on disk, polluting globalThis state shared with sibling test files.
+jest.mock(
+  '@open-mercato/core/bootstrap',
+  () => ({
+    __esModule: true,
+    bootstrap: async () => {},
+  }),
+  { virtual: true },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/encryption/subscriber',
+  () => ({
+    __esModule: true,
+    registerTenantEncryptionSubscriber: () => {},
+  }),
+  { virtual: true },
+)
+
+const mockWarn = jest.fn()
+jest.mock('../../logger', () => ({
+  createLogger: () => ({
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn: (...args: unknown[]) => mockWarn(...args),
+    error: jest.fn(),
+    child() { return this },
+  }),
+}))
+
+const mockAppDiRegister = jest.fn()
+jest.mock(
+  '@/di',
+  () => ({
+    __esModule: true,
+    register: (...args: unknown[]) => mockAppDiRegister(...args),
+  }),
+  { virtual: true },
+)
+
+const {
+  createRequestContainer,
+  registerAppDiRegistrar,
+  registerDiRegistrars,
+  resetBootstrapCache,
+} = require('@open-mercato/shared/lib/di/container')
+
+describe('app-level DI override hook (@/di)', () => {
+  beforeEach(() => {
+    resetBootstrapCache()
+    registerAppDiRegistrar(null)
+    registerDiRegistrars([])
+    mockWarn.mockClear()
+    mockAppDiRegister.mockReset()
+  })
+
+  it('calls register() with the request container and applies its registrations', async () => {
+    mockAppDiRegister.mockImplementation((container: any) => {
+      container.register({ appOverrideProbe: asValue('from-app-di') })
+    })
+    const container = await createRequestContainer()
+    expect(mockAppDiRegister).toHaveBeenCalledTimes(1)
+    expect(mockAppDiRegister).toHaveBeenCalledWith(container)
+    expect(container.resolve('appOverrideProbe')).toBe('from-app-di')
+    expect(mockWarn).not.toHaveBeenCalled()
+  })
+
+  it('awaits an async register()', async () => {
+    mockAppDiRegister.mockImplementation(async (container: any) => {
+      await Promise.resolve()
+      container.register({ appOverrideProbe: asValue('async-app-di') })
+    })
+    const container = await createRequestContainer()
+    expect(container.resolve('appOverrideProbe')).toBe('async-app-di')
+    expect(mockWarn).not.toHaveBeenCalled()
+  })
+
+  it('warns instead of silently swallowing when register() throws', async () => {
+    mockAppDiRegister.mockImplementation(() => {
+      throw new Error('boom from app di')
+    })
+    const firstContainer = await createRequestContainer()
+    const secondContainer = await createRequestContainer()
+    expect(firstContainer).toBeDefined()
+    expect(secondContainer).toBeDefined()
+    expect(mockAppDiRegister).toHaveBeenCalledTimes(2)
+    expect(mockWarn).toHaveBeenCalledTimes(1)
+    const [message, fields] = mockWarn.mock.calls[0]
+    expect(String(message)).toContain('register()')
+    expect((fields as { err: Error }).err.message).toBe('boom from app di')
+  })
+
+  it('warns when an async register() rejects', async () => {
+    mockAppDiRegister.mockImplementation(async () => {
+      throw new Error('async boom from app di')
+    })
+    const firstContainer = await createRequestContainer()
+    const secondContainer = await createRequestContainer()
+    expect(firstContainer).toBeDefined()
+    expect(secondContainer).toBeDefined()
+    expect(mockAppDiRegister).toHaveBeenCalledTimes(2)
+    expect(mockWarn).toHaveBeenCalledTimes(1)
+  })
+})

package/src/lib/di/container.ts

@@ -24,6 +24,8 @@ export type AppDiRegistrar = (container: AppContainer) => void | Promise<void>
 // file can be loaded as multiple module instances when mixing dynamic and static imports
 const GLOBAL_KEY = '__openMercatoDiRegistrars__'
 const APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'
+const APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'
+const APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'
 // Phase 5 — process-scoped bootstrap cache. The cache/event-bus/encryption
 // services bootstrap() creates are inherently process-scoped (they hold
 // state across requests). Caching them on globalThis after the first
@@ -137,10 +139,35 @@ export function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {
   ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar
 }
 
-/** Test-only helper to drop the process-scoped bootstrap cache. */
+/** Test-only helper to drop process-scoped request-container state. */
 export function resetBootstrapCache(): void {
   (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null
   ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined
+  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined
+  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined
+}
+
+function isAppDiModuleNotFound(error: unknown): boolean {
+  if (!error || typeof error !== 'object') return false
+  const { code, message } = error as { code?: unknown; message?: unknown }
+  const text = typeof message === 'string' ? message : ''
+  const moduleNotFound =
+    code === 'MODULE_NOT_FOUND'
+    || code === 'ERR_MODULE_NOT_FOUND'
+    || text.startsWith('Cannot find module')
+    || text.startsWith('Cannot find package')
+  return moduleNotFound && /(?:module|package) ['"]@\/di['"]/.test(text)
+}
+
+function warnAppDiFailureOnce(
+  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,
+  message: string,
+  error: unknown,
+): void {
+  const globalScope = globalThis as Record<string, unknown>
+  if (globalScope[key] === true) return
+  globalScope[key] = true
+  logger.warn(message, { err: error })
 }
 
 function isAwilixResolver(value: unknown): value is Resolver<unknown> {
@@ -249,11 +276,25 @@ export async function createRequestContainer(): Promise<AppContainer> {
         try {
           const maybe = appDi.register(container)
           if (maybe && typeof maybe.then === 'function') await maybe
-        } catch (error) {
-          logger.error('App-level DI registrar failed', { err: error })
+        } catch (err) {
+          warnAppDiFailureOnce(
+            APP_DI_REGISTER_WARNING_KEY,
+            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',
+            err,
+          )
         }
       }
-    } catch {}
+    } catch (err) {
+      if (isAppDiModuleNotFound(err)) {
+        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })
+      } else {
+        warnAppDiFailureOnce(
+          APP_DI_LOAD_WARNING_KEY,
+          'App-level DI override module (@/di) failed to load; its registrations are skipped',
+          err,
+        )
+      }
+    }
   }
   applyDiOverridesToContainer({
     register: (registrations) => container.register(toAwilixRegistrations(registrations)),

package/src/lib/email/__tests__/send.test.ts

@@ -1,4 +1,7 @@
 import React from 'react'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
 import { sendEmail } from '../send'
 
 var sendMock: jest.Mock
@@ -15,6 +18,7 @@ jest.mock('resend', () => {
 
 describe('sendEmail', () => {
   const originalEnv = process.env
+  let tempDir: string | null = null
 
   beforeEach(() => {
     process.env = {
@@ -26,7 +30,11 @@ describe('sendEmail', () => {
     ResendMock.mockClear()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    if (tempDir) {
+      await rm(tempDir, { recursive: true, force: true })
+      tempDir = null
+    }
     process.env = originalEnv
   })
 
@@ -158,4 +166,32 @@ describe('sendEmail', () => {
     expect(ResendMock).not.toHaveBeenCalled()
     expect(sendMock).not.toHaveBeenCalled()
   })
+
+  it('captures email links in OM_TEST_MODE without external delivery', async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'om-email-capture-'))
+    const capturePath = join(tempDir, 'emails.jsonl')
+    process.env.OM_TEST_MODE = '1'
+    process.env.OM_TEST_EMAIL_CAPTURE_PATH = capturePath
+    delete process.env.RESEND_API_KEY
+
+    await sendEmail({
+      to: 'user@example.com',
+      subject: 'Invite',
+      react: React.createElement('div', null, [
+        React.createElement('p', { key: 'text' }, 'Accept your invite'),
+        React.createElement('a', { key: 'link', href: 'https://example.com/portal/invite?token=raw' }, 'Accept'),
+      ]),
+    })
+
+    const rows = (await readFile(capturePath, 'utf8')).trim().split('\n')
+    expect(rows).toHaveLength(1)
+    expect(JSON.parse(rows[0])).toEqual(expect.objectContaining({
+      to: 'user@example.com',
+      subject: 'Invite',
+      links: ['https://example.com/portal/invite?token=raw'],
+      text: 'Accept your invite Accept',
+    }))
+    expect(ResendMock).not.toHaveBeenCalled()
+    expect(sendMock).not.toHaveBeenCalled()
+  })
 })

package/src/lib/email/send.ts

@@ -1,5 +1,8 @@
 import { Resend } from 'resend'
 import React from 'react'
+import { appendFile, mkdir } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
 import { parseBooleanWithDefault } from '../boolean'
 import { resolveDefaultEmailFromAddress } from './config'
 
@@ -16,10 +19,86 @@ export type SendEmailOptions = {
   }>
 }
 
+type CapturedEmail = {
+  to: string
+  subject: string
+  from: string | null
+  replyTo: string | null
+  links: string[]
+  text: string
+  capturedAt: string
+}
+
+type ReactElementProps = {
+  href?: unknown
+  children?: unknown
+}
+
+const DEFAULT_TEST_EMAIL_CAPTURE_PATH = join(tmpdir(), 'open-mercato-email-capture.jsonl')
+
+function resolveTestEmailCapturePath(): string {
+  return process.env.OM_TEST_EMAIL_CAPTURE_PATH?.trim() || DEFAULT_TEST_EMAIL_CAPTURE_PATH
+}
+
+function readElementProps(node: React.ReactElement): ReactElementProps {
+  return node.props as ReactElementProps
+}
+
+function collectEmailLinks(node: unknown, links: string[] = []): string[] {
+  if (node == null || typeof node === 'boolean') return links
+  if (Array.isArray(node)) {
+    for (const child of node) collectEmailLinks(child, links)
+    return links
+  }
+  if (React.isValidElement(node)) {
+    const props = readElementProps(node)
+    if (typeof props.href === 'string' && props.href.length > 0) links.push(props.href)
+    collectEmailLinks(props.children, links)
+  }
+  return links
+}
+
+function collectEmailText(node: unknown, parts: string[] = []): string[] {
+  if (node == null || typeof node === 'boolean') return parts
+  if (typeof node === 'string' || typeof node === 'number') {
+    parts.push(String(node))
+    return parts
+  }
+  if (Array.isArray(node)) {
+    for (const child of node) collectEmailText(child, parts)
+    return parts
+  }
+  if (React.isValidElement(node)) {
+    collectEmailText(readElementProps(node).children, parts)
+  }
+  return parts
+}
+
+async function captureEmailForTests(options: SendEmailOptions): Promise<void> {
+  if (!parseBooleanWithDefault(process.env.OM_TEST_MODE, false)) return
+
+  const capturePath = resolveTestEmailCapturePath()
+  const record: CapturedEmail = {
+    to: options.to,
+    subject: options.subject,
+    from: options.from ?? resolveDefaultEmailFromAddress() ?? null,
+    replyTo: options.replyTo ?? null,
+    links: collectEmailLinks(options.react),
+    text: collectEmailText(options.react).join(' ').replace(/\s+/g, ' ').trim(),
+    capturedAt: new Date().toISOString(),
+  }
+
+  await mkdir(dirname(capturePath), { recursive: true })
+  await appendFile(capturePath, `${JSON.stringify(record)}\n`, 'utf8')
+}
+
 export async function sendEmail({ to, subject, react, from, replyTo, attachments }: SendEmailOptions) {
   const emailDisabled =
     parseBooleanWithDefault(process.env.OM_DISABLE_EMAIL_DELIVERY, false) ||
     parseBooleanWithDefault(process.env.OM_TEST_MODE, false)
+
+  await captureEmailForTests({ to, subject, react, from, replyTo, attachments })
+
   if (emailDisabled) return
 
   const apiKey = process.env.RESEND_API_KEY

package/src/lib/query/types.ts

@@ -108,11 +108,10 @@ export type QueryOptions = {
    * and MUST fail closed when the authenticated principal lacks a resolvable tenant/org, otherwise
    * queries return cross-tenant rows.
    *
-   * When this flag is set, the hybrid query engine delegates to the basic engine, which means
-   * custom-field (`cf:*`) filters/sorts, `search_tokens` fulltext filtering, and vector-search
-   * branches are BYPASSED. Only use this on entities whose scoping does not match the standard
-   * `organization_id = X AND tenant_id = Y` shape and which do not rely on custom-field/search
-   * features.
+   * When this flag is set, the hybrid query engine delegates to the basic engine. The basic engine
+   * still applies `cf:*` filters/sorts, but `search_tokens` fulltext filtering, the JSONB index read
+   * path, and the vector-search branch are BYPASSED. Only use this on entities whose scoping does
+   * not match the standard `organization_id = X AND tenant_id = Y` shape.
    */
   omitAutomaticTenantOrgScope?: boolean
   // Soft-delete behavior: when false (default), rows with non-null deleted_at

package/src/lib/search/__tests__/config.test.ts

@@ -1,8 +1,12 @@
 import {
+  DEFAULT_SEARCH_MAX_FIELD_CHARS,
+  DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD,
+  DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD,
   DEFAULT_SEARCH_MIN_TOKEN_LENGTH,
   isSearchFieldBlocklisted,
   resolveSearchConfig,
   resolveSearchMinTokenLength,
+  resolveSearchTokenLimits,
 } from '../config'
 
 describe('resolveSearchMinTokenLength', () => {
@@ -109,6 +113,61 @@ describe('OM_SEARCH_FIELD_BLOCKLIST parsing', () => {
   })
 })
 
+describe('search token limits', () => {
+  const variableNames = [
+    'OM_SEARCH_MAX_FIELD_CHARS',
+    'OM_SEARCH_MAX_TOKENS_PER_FIELD',
+    'OM_SEARCH_MAX_TOKENS_PER_RECORD',
+  ] as const
+  const originalValues = Object.fromEntries(variableNames.map((name) => [name, process.env[name]]))
+
+  afterEach(() => {
+    for (const name of variableNames) {
+      const original = originalValues[name]
+      if (original === undefined) delete process.env[name]
+      else process.env[name] = original
+    }
+  })
+
+  it('uses safe defaults when limits are unset', () => {
+    for (const name of variableNames) delete process.env[name]
+
+    expect(resolveSearchTokenLimits(resolveSearchConfig())).toEqual({
+      maxFieldChars: DEFAULT_SEARCH_MAX_FIELD_CHARS,
+      maxTokensPerField: DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD,
+      maxTokensPerRecord: DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD,
+    })
+  })
+
+  it('accepts zero to disable individual limits', () => {
+    for (const name of variableNames) process.env[name] = '0'
+
+    expect(resolveSearchTokenLimits(resolveSearchConfig())).toEqual({
+      maxFieldChars: 0,
+      maxTokensPerField: 0,
+      maxTokensPerRecord: 0,
+    })
+  })
+
+  it('normalizes invalid custom config values to defaults', () => {
+    expect(resolveSearchTokenLimits({
+      enabled: true,
+      minTokenLength: 3,
+      enablePartials: true,
+      hashAlgorithm: 'sha256',
+      storeRawTokens: false,
+      blocklistedFields: [],
+      maxFieldChars: Number.NaN,
+      maxTokensPerField: -1,
+      maxTokensPerRecord: 4.8,
+    })).toEqual({
+      maxFieldChars: DEFAULT_SEARCH_MAX_FIELD_CHARS,
+      maxTokensPerField: DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD,
+      maxTokensPerRecord: 4,
+    })
+  })
+})
+
 describe('isSearchFieldBlocklisted', () => {
   const baseConfig = {
     enabled: true,

package/src/lib/search/__tests__/tokenize.test.ts

@@ -0,0 +1,49 @@
+import type { SearchConfig } from '../config'
+import { tokenizeText } from '../tokenize'
+
+const baseConfig: SearchConfig = {
+  enabled: true,
+  minTokenLength: 3,
+  enablePartials: true,
+  hashAlgorithm: 'sha256',
+  storeRawTokens: false,
+  blocklistedFields: [],
+}
+
+describe('tokenizeText limits', () => {
+  test('truncates oversized field text before tokenizing', () => {
+    const config = { ...baseConfig, enablePartials: false, maxFieldChars: 10 }
+
+    const { tokens } = tokenizeText('aaaa bbbb cccc', config)
+
+    expect(tokens).toEqual(['aaaa', 'bbbb'])
+  })
+
+  test('bounds prefix expansion while collecting tokens', () => {
+    const config = { ...baseConfig, maxFieldChars: 100, maxTokensPerField: 5 }
+
+    const { tokens, hashes } = tokenizeText('a'.repeat(100), config)
+
+    expect(tokens).toEqual(['aaa', 'aaaa', 'aaaaa', 'aaaaaa', 'aaaaaaa'])
+    expect(hashes).toHaveLength(5)
+  })
+
+  test('applies safe defaults to legacy configs without limit fields', () => {
+    const { tokens } = tokenizeText('a'.repeat(50_000), baseConfig)
+
+    expect(tokens).toHaveLength(5_000)
+  })
+
+  test('allows a limit to be disabled explicitly', () => {
+    const config = {
+      ...baseConfig,
+      enablePartials: false,
+      maxFieldChars: 0,
+      maxTokensPerField: 0,
+    }
+
+    const { tokens } = tokenizeText('alpha beta gamma delta', config)
+
+    expect(tokens).toEqual(['alpha', 'beta', 'gamma', 'delta'])
+  })
+})

package/src/lib/search/config.ts

@@ -10,9 +10,21 @@ export type SearchConfig = {
   storeRawTokens: boolean
   blocklistedFields: string[]
   entityBlocklistedFields?: Record<string, string[]>
+  maxFieldChars?: number
+  maxTokensPerField?: number
+  maxTokensPerRecord?: number
 }
 
 export const DEFAULT_SEARCH_MIN_TOKEN_LENGTH = 3
+export const DEFAULT_SEARCH_MAX_FIELD_CHARS = 20_000
+export const DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD = 5_000
+export const DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD = 20_000
+
+export type SearchTokenLimits = {
+  maxFieldChars: number
+  maxTokensPerField: number
+  maxTokensPerRecord: number
+}
 
 const DEFAULT_BLOCKLIST = ['password', 'token', 'secret', 'hash']
 
@@ -26,6 +38,19 @@ function parseNumber(raw: string | undefined, fallback: number, min = 1): number
   return parseNumberWithDefault(raw, fallback, { integer: true, min })
 }
 
+export function resolveSearchTokenLimits(config: SearchConfig): SearchTokenLimits {
+  const resolveLimit = (value: number | undefined, fallback: number): number => {
+    if (value === undefined) return fallback
+    if (!Number.isFinite(value) || value < 0) return fallback
+    return Math.trunc(value)
+  }
+  return {
+    maxFieldChars: resolveLimit(config.maxFieldChars, DEFAULT_SEARCH_MAX_FIELD_CHARS),
+    maxTokensPerField: resolveLimit(config.maxTokensPerField, DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD),
+    maxTokensPerRecord: resolveLimit(config.maxTokensPerRecord, DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD),
+  }
+}
+
 function parseHashAlgorithm(raw: string | undefined): 'sha256' | 'sha1' | 'md5' {
   const value = (raw ?? '').trim().toLowerCase()
   if (value === 'sha1') return 'sha1'
@@ -89,6 +114,9 @@ export function resolveSearchConfig(): SearchConfig {
     storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),
     blocklistedFields: blocklist.global,
     entityBlocklistedFields: blocklist.byEntity,
+    maxFieldChars: parseNumber(process.env.OM_SEARCH_MAX_FIELD_CHARS, DEFAULT_SEARCH_MAX_FIELD_CHARS, 0),
+    maxTokensPerField: parseNumber(process.env.OM_SEARCH_MAX_TOKENS_PER_FIELD, DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD, 0),
+    maxTokensPerRecord: parseNumber(process.env.OM_SEARCH_MAX_TOKENS_PER_RECORD, DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD, 0),
   }
 }
 

package/src/lib/search/tokenize.ts

@@ -1,5 +1,5 @@
 import crypto from 'crypto'
-import { resolveSearchConfig, type SearchConfig } from './config'
+import { resolveSearchConfig, resolveSearchTokenLimits, type SearchConfig } from './config'
 
 export type TokenizationResult = {
   tokens: string[]
@@ -20,13 +20,28 @@ function splitTokens(text: string, minLength: number): string[] {
     .filter((token) => token.length >= minLength)
 }
 
-function expandToken(token: string, config: SearchConfig): string[] {
-  if (!config.enablePartials) return [token]
-  const results: string[] = []
-  for (let i = config.minTokenLength; i <= token.length; i += 1) {
-    results.push(token.slice(0, i))
+function appendExpandedToken(
+  token: string,
+  config: SearchConfig,
+  seen: Set<string>,
+  tokens: string[],
+  limit: number,
+): void {
+  const append = (candidate: string): boolean => {
+    if (seen.has(candidate)) return tokens.length < limit
+    seen.add(candidate)
+    tokens.push(candidate)
+    return tokens.length < limit
+  }
+
+  if (!config.enablePartials) {
+    append(token)
+    return
+  }
+
+  for (let length = config.minTokenLength; length <= token.length; length += 1) {
+    if (!append(token.slice(0, length))) return
   }
-  return results
 }
 
 export function hashToken(token: string, config?: SearchConfig): string {
@@ -36,10 +51,17 @@ export function hashToken(token: string, config?: SearchConfig): string {
 
 export function tokenizeText(text: string, config?: SearchConfig): TokenizationResult {
   const cfg = config ?? resolveSearchConfig()
-  const baseTokens = splitTokens(text, cfg.minTokenLength)
-  const expanded = baseTokens.flatMap((token) => expandToken(token, cfg))
-  const unique = Array.from(new Set(expanded))
-  const tokens = unique.filter((token) => token.length >= cfg.minTokenLength)
+  const limits = resolveSearchTokenLimits(cfg)
+  const boundedText = limits.maxFieldChars > 0 ? text.slice(0, limits.maxFieldChars) : text
+  const tokenLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY
+  const seen = new Set<string>()
+  const tokens: string[] = []
+
+  for (const token of splitTokens(boundedText, cfg.minTokenLength)) {
+    if (tokens.length >= tokenLimit) break
+    appendExpandedToken(token, cfg, seen, tokens, tokenLimit)
+  }
+
   const hashes = tokens.map((token) => hashToken(token, cfg))
   return { tokens, hashes }
 }