@open-mercato/shared 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/src/lib/data/engine.ts

@@ -6,12 +6,11 @@ import { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/h
 import { validateCustomFieldValuesServer } from '@open-mercato/core/modules/entities/lib/validation'
 import { sanitizeCustomFieldHtmlRichTextValuesServer } from '@open-mercato/core/modules/entities/lib/htmlRichTextSanitizer'
 import type { EventBus } from '@open-mercato/events/types'
-import {
-  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
-  type CrudEventAction,
-  type CrudEventsConfig,
-  type CrudIndexerConfig,
-  type CrudEntityIdentifiers,
+import type {
+  CrudEventAction,
+  CrudEventsConfig,
+  CrudIndexerConfig,
+  CrudEntityIdentifiers,
 } from '../crud/types'
 import type { BulkImportSuppression } from '../commands/types'
 import { CrudHttpError } from '../crud/errors'
@@ -19,7 +18,6 @@ import { resolveRegisteredEntityTableName } from '../query/engine'
 import { getEntityIds } from '../encryption/entityIds'
 import { normalizeCustomFieldValues } from '../custom-fields/normalize'
 import { parseBooleanToken } from '../boolean'
-import { isReadProjectionAlwaysConsistent } from './consistency'
 import { isEventDeclared } from '../../modules/events'
 import { createLogger } from '../logger'
 
@@ -600,7 +598,7 @@ export class DefaultDataEngine implements DataEngine {
     if (events && !suppress?.skipEvents) {
       const eventName = `${events.module}.${events.entity}.${action}`
       warnIfUndeclaredEvent(eventName, 'emitOrmEntityEvent')
-      const builtPayload = events.buildPayload
+      const payload = events.buildPayload
         ? events.buildPayload(ctx)
         : {
             id: ctx.identifiers.id,
@@ -608,20 +606,6 @@ export class DefaultDataEngine implements DataEngine {
             tenantId: ctx.identifiers.tenantId,
             ...(ctx.syncOrigin ? { syncOrigin: ctx.syncOrigin } : {}),
           }
-      // A configured indexer means this data-engine call owns the query-index
-      // decision, including an explicit skipReindex suppression. Mark object
-      // payloads so the legacy domain-event bridge does not enqueue the same
-      // record a second time. Keep the marker non-enumerable so client broadcasts
-      // and persisted domain payloads retain their existing public shape.
-      // Primitive custom payloads cannot be bridged in any case because they do
-      // not expose the record id.
-      const payload = indexer && builtPayload && typeof builtPayload === 'object' && !Array.isArray(builtPayload)
-        ? Object.defineProperty(
-            { ...(builtPayload as Record<string, unknown>) },
-            CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
-            { value: true, enumerable: false },
-          )
-        : builtPayload
       try {
         await bus.emitEvent(eventName, payload, {
           persistent: !!events.persistent,
@@ -634,7 +618,6 @@ export class DefaultDataEngine implements DataEngine {
     }
 
     if (indexer && !suppress?.skipReindex) {
-      const alwaysConsistent = isReadProjectionAlwaysConsistent()
       const resolveCoverageBaseDelta = (): number | undefined => {
         if (action === 'created') return 1
         if (action === 'deleted') return -1
@@ -660,14 +643,9 @@ export class DefaultDataEngine implements DataEngine {
         // returns. The subscriber removes the projection row + tokens synchronously and
         // defers the coverage recompute + fulltext delete, so this stays bounded.
         // Errors are logged, not thrown — index drift never fails the originating write.
-        // Always-consistent mode rethrows so drift is loud and retryable.
-        if (alwaysConsistent) {
-          await bus.emitEvent('query_index.delete_one', enrichedPayload, { rethrowHandlerErrors: true })
-        } else {
-          await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {
-            logger.error('query_index.delete_one emit failed', { err })
-          })
-        }
+        await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {
+          logger.error('query_index.delete_one emit failed', { err })
+        })
       } else {
         const payload = indexer.buildUpsertPayload
           ? indexer.buildUpsertPayload(ctx)
@@ -685,27 +663,18 @@ export class DefaultDataEngine implements DataEngine {
         // (see delete_one above). The subscriber updates `entity_indexes` synchronously
         // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +
         // tokenize + DELETE + chunked INSERT) so write latency stays bounded.
-        if (alwaysConsistent) {
-          await bus.emitEvent('query_index.upsert_one', enrichedPayload, { rethrowHandlerErrors: true })
-        } else {
-          await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {
-            logger.error('query_index.upsert_one emit failed', { err })
-          })
-        }
+        await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {
+          logger.error('query_index.upsert_one emit failed', { err })
+        })
       }
 
-      if (alwaysConsistent || shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {
-        const coveragePayload = {
+      if (shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {
+        void bus.emitEvent('query_index.coverage.refresh', {
           entityType: indexer.entityType,
           tenantId: ctx.identifiers.tenantId ?? null,
           organizationId: null,
           delayMs: 0,
-        }
-        if (alwaysConsistent) {
-          await bus.emitEvent('query_index.coverage.refresh', coveragePayload, { rethrowHandlerErrors: true })
-        } else {
-          void bus.emitEvent('query_index.coverage.refresh', coveragePayload).catch(() => undefined)
-        }
+        }).catch(() => undefined)
       }
     }
   }
@@ -770,10 +739,7 @@ export class DefaultDataEngine implements DataEngine {
           indexer: entry.indexer as CrudIndexerConfig<unknown>,
           suppress,
         })
-      } catch (error) {
-        if (isReadProjectionAlwaysConsistent()) {
-          throw error
-        }
+      } catch {
         // best-effort; continue with remaining side effects
       }
     }

package/src/lib/db/__tests__/mikro.test.ts

@@ -24,6 +24,31 @@ describe('ORM entity registry', () => {
   })
 })
 
+describe('attachPoolErrorHandlers', () => {
+  it('swallows errors from idle pooled clients (pool-level emit)', async () => {
+    const { EventEmitter } = await import('node:events')
+    const { attachPoolErrorHandlers } = await import('../mikro')
+    const pool = new EventEmitter()
+
+    attachPoolErrorHandlers(pool as any)
+
+    expect(() => pool.emit('error', new Error('terminating connection due to idle-in-transaction timeout'))).not.toThrow()
+  })
+
+  it('swallows errors from checked-out clients (client-level emit)', async () => {
+    const { EventEmitter } = await import('node:events')
+    const { attachPoolErrorHandlers } = await import('../mikro')
+    const pool = new EventEmitter()
+    const client = new EventEmitter()
+
+    attachPoolErrorHandlers(pool as any)
+    pool.emit('connect', client)
+
+    expect(client.listenerCount('error')).toBe(1)
+    expect(() => client.emit('error', new Error('terminating connection due to idle-in-transaction timeout'))).not.toThrow()
+  })
+})
+
 describe('resolvePoolConfig', () => {
   const baseEnv = (extra: Record<string, string | undefined> = {}): NodeJS.ProcessEnv =>
     ({ ...extra }) as NodeJS.ProcessEnv

package/src/lib/db/mikro.ts

@@ -79,6 +79,42 @@ export function resolvePoolConfig(env: NodeJS.ProcessEnv = process.env): Resolve
   }
 }
 
+type PoolLike = {
+  on(event: 'error', listener: (err: unknown) => void): unknown
+  on(event: 'connect', listener: (client: { on(event: 'error', listener: (err: unknown) => void): unknown }) => void): unknown
+  options?: Record<string, unknown>
+}
+
+// Postgres can terminate a connection at any moment (admin termination, network
+// drop, and — most relevantly for long-running daemons — the
+// `idle_in_transaction_session_timeout` configured above, FATAL 25P03). Where
+// node-postgres surfaces that depends on the client's state:
+// - IDLE (checked into the pool): pg-pool re-emits on the pool's 'error' event.
+// - CHECKED OUT (e.g. a connection pinned by an open transaction while the app
+//   awaits non-DB work): pg-pool removes its idle listener, so the FATAL emits
+//   on the Client itself.
+// Either way an unlistened 'error' event crashes the whole process ("Scheduler
+// polling engine exited unexpectedly with exit code 1"). Swallow both: the pool
+// discards the dead client, and any in-flight transaction still fails normally
+// on its next query/commit against the dead connection.
+// The per-client listener is deliberately attached once on 'connect' and never
+// removed: it is a last-resort sink whose only job is to guarantee the 'error'
+// event always has a listener, in every client state. It is not error handling
+// and must not be "cleaned up" — removing it reintroduces the process crash.
+// A reaped IDLE client therefore logs twice (once here, once via the pool-level
+// handler that pg-pool's own idle listener re-emits); the pool-level line is the
+// one that identifies the client as idle.
+export function attachPoolErrorHandlers(pool: PoolLike): void {
+  pool.on('error', (err: unknown) => {
+    logger.warn('Idle pg pool client error (connection reaped/terminated)', { err })
+  })
+  pool.on('connect', (client) => {
+    client.on('error', (err: unknown) => {
+      logger.warn('pg client error (connection reaped/terminated)', { err })
+    })
+  })
+}
+
 export async function getOrm() {
   if (ormInstance) {
     return ormInstance
@@ -151,19 +187,8 @@ export async function getOrm() {
       lock_timeout: lockTimeoutMs,
       options: connectionOptions,
       ssl: sslConfig,
-      onPoolCreated: (pool: any) => {
-        // node-postgres re-emits errors from IDLE pooled clients on the pool's
-        // 'error' event. Postgres terminates idle sessions on its own (admin
-        // termination, network drop, and — most relevantly for long-running
-        // daemons like the scheduler — `idle_in_transaction_session_timeout`,
-        // which defaults to 120s above). Without a listener here, such a
-        // termination surfaces as an unhandled 'error' event and crashes the
-        // whole process (e.g. "Scheduler polling engine exited unexpectedly
-        // with exit code 1"). Swallow it: the pool discards the dead client and
-        // opens a fresh connection on the next acquire.
-        pool.on('error', (err: unknown) => {
-          logger.warn('Idle pg pool client error (connection reaped/terminated)', { err })
-        })
+      onPoolCreated: (pool: PoolLike) => {
+        attachPoolErrorHandlers(pool)
         if (process.env.OM_DB_POOL_DEBUG === '1' || process.env.OM_INTEGRATION_TEST === 'true') {
           logger.info('pg pool created with options', {
             max: pool.options?.max,

package/src/lib/db/pg-errors.ts

@@ -10,61 +10,3 @@ export function isUniqueViolation(err: unknown): boolean {
   const message = (err as { message?: string }).message
   return typeof message === 'string' && /duplicate key value|unique constraint/i.test(message)
 }
-
-/**
- * Postgres SQLSTATEs for transient connection / availability failures — the
- * database (or its connection pool) is temporarily unreachable and the request
- * can succeed on retry. Deliberately scoped to connection/availability codes;
- * query-level conflicts (deadlock 40P01, serialization 40001, lock_not_available
- * 55P03) are NOT included because they do not mean "service unavailable".
- */
-const TRANSIENT_CONNECTION_SQLSTATES = new Set([
-  '53300', // too_many_connections
-  '53400', // configuration_limit_exceeded
-  '57P01', // admin_shutdown
-  '57P02', // crash_shutdown
-  '57P03', // cannot_connect_now (db starting up)
-  '08000', // connection_exception
-  '08001', // sqlclient_unable_to_establish_sqlconnection
-  '08003', // connection_does_not_exist
-  '08006', // connection_failure
-])
-
-/**
- * Postgres-driver / connection-pool messages that describe a transient DB
- * connection failure when the SQLSTATE is dropped by the ORM wrapper. These are
- * intentionally DB-specific phrases only. Bare socket codes (ECONNREFUSED,
- * ETIMEDOUT, …) are deliberately NOT matched: they can originate from any
- * outbound socket (HTTP, cache, queue), so keying off them would falsely
- * attribute unrelated failures to the database.
- */
-const TRANSIENT_DB_MESSAGE_PATTERNS = [
-  /too many clients already/i,
-  /unable to acquire a connection/i,
-  /timeout acquiring a connection/i,
-  /connection terminated/i,
-  /the database system is (starting up|shutting down|in recovery)/i,
-]
-
-/**
- * Detect a transient Postgres connection / availability failure (pool exhaustion,
- * `max_connections` reached, DB restarting) via its SQLSTATE or a DB-specific
- * driver message. Gates retryable 503 responses so callers do not report a
- * temporary infrastructure blip as an auth failure (401) or an unexpected server
- * error (500). Scoped to unambiguous DB signals so generic socket errors from
- * non-DB calls are never misclassified.
- */
-export function isTransientDbError(err: unknown): boolean {
-  if (!err || typeof err !== 'object') {
-    return false
-  }
-  const code = (err as { code?: string }).code
-  if (typeof code === 'string' && TRANSIENT_CONNECTION_SQLSTATES.has(code)) {
-    return true
-  }
-  const message = (err as { message?: string }).message
-  if (typeof message === 'string' && TRANSIENT_DB_MESSAGE_PATTERNS.some((pattern) => pattern.test(message))) {
-    return true
-  }
-  return false
-}

package/src/lib/di/container.ts

@@ -24,13 +24,6 @@ export type AppDiRegistrar = (container: AppContainer) => void | Promise<void>
 // file can be loaded as multiple module instances when mixing dynamic and static imports
 const GLOBAL_KEY = '__openMercatoDiRegistrars__'
 const APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'
-const APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'
-const APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'
-// Set once the legacy `@/di` fallback proves the specifier is unresolvable in this process.
-// Worker/CLI processes run against built package output where the app's `@/` alias does not
-// exist, so retrying the import per request container only repeats a failed module resolution
-// (and its log line) once per job.
-const APP_DI_MODULE_UNRESOLVABLE_KEY = '__openMercatoAppDiModuleUnresolvable__'
 // Phase 5 — process-scoped bootstrap cache. The cache/event-bus/encryption
 // services bootstrap() creates are inherently process-scoped (they hold
 // state across requests). Caching them on globalThis after the first
@@ -125,9 +118,6 @@ export function registerDiRegistrars(registrars: DiRegistrar[]) {
   // Force re-bootstrap on HMR — module subscribers may have changed.
   ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null
   ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined
-  // An app that gains a src/di.ts mid-session reloads through here, so the negative
-  // resolution result must not outlive the reload.
-  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined
 }
 
 export function getDiRegistrars(): DiRegistrar[] {
@@ -147,44 +137,10 @@ export function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {
   ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar
 }
 
-/** Test-only helper to drop process-scoped request-container state. */
+/** Test-only helper to drop the process-scoped bootstrap cache. */
 export function resetBootstrapCache(): void {
   (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null
   ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined
-  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined
-  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined
-  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined
-}
-
-function isAppDiModuleUnresolvable(): boolean {
-  return (globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] === true
-}
-
-function markAppDiModuleUnresolvable(): void {
-  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = true
-}
-
-function isAppDiModuleNotFound(error: unknown): boolean {
-  if (!error || typeof error !== 'object') return false
-  const { code, message } = error as { code?: unknown; message?: unknown }
-  const text = typeof message === 'string' ? message : ''
-  const moduleNotFound =
-    code === 'MODULE_NOT_FOUND'
-    || code === 'ERR_MODULE_NOT_FOUND'
-    || text.startsWith('Cannot find module')
-    || text.startsWith('Cannot find package')
-  return moduleNotFound && /(?:module|package) ['"]@\/di['"]/.test(text)
-}
-
-function warnAppDiFailureOnce(
-  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,
-  message: string,
-  error: unknown,
-): void {
-  const globalScope = globalThis as Record<string, unknown>
-  if (globalScope[key] === true) return
-  globalScope[key] = true
-  logger.warn(message, { err: error })
 }
 
 function isAwilixResolver(value: unknown): value is Resolver<unknown> {
@@ -241,14 +197,9 @@ export async function createRequestContainer(): Promise<AppContainer> {
       createCommandOptimisticLockGuardService(),
     ).scoped(),
   })
-  // Allow modules to override/extend. Fail-open by design (one broken module's
-  // di.ts must not take down every request container), but never silently: the
-  // module's services would otherwise vanish with no trace until an unrelated
-  // Awilix resolution error surfaces much later.
-  for (const [registrarIndex, reg] of diRegistrars.entries()) {
-    try { reg?.(container) } catch (error) {
-      logger.error('Module DI registrar failed', { registrarIndex, err: error })
-    }
+  // Allow modules to override/extend
+  for (const reg of diRegistrars) {
+    try { reg?.(container) } catch {}
   }
   // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)
   // Phase 5 — process-scoped once-guard. The first request runs the full
@@ -284,7 +235,7 @@ export async function createRequestContainer(): Promise<AppContainer> {
     } catch (error) {
       logger.error('App-level DI registrar failed', { err: error })
     }
-  } else if (!isAppDiModuleUnresolvable()) {
+  } else {
     // Backward-compatible fallback for apps that have not adopted explicit wiring.
     try {
       // @ts-ignore - @/di only exists in app context, not in packages
@@ -293,26 +244,11 @@ export async function createRequestContainer(): Promise<AppContainer> {
         try {
           const maybe = appDi.register(container)
           if (maybe && typeof maybe.then === 'function') await maybe
-        } catch (err) {
-          warnAppDiFailureOnce(
-            APP_DI_REGISTER_WARNING_KEY,
-            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',
-            err,
-          )
+        } catch (error) {
+          logger.error('App-level DI registrar failed', { err: error })
         }
       }
-    } catch (err) {
-      if (isAppDiModuleNotFound(err)) {
-        markAppDiModuleUnresolvable()
-        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })
-      } else {
-        warnAppDiFailureOnce(
-          APP_DI_LOAD_WARNING_KEY,
-          'App-level DI override module (@/di) failed to load; its registrations are skipped',
-          err,
-        )
-      }
-    }
+    } catch {}
   }
   applyDiOverridesToContainer({
     register: (registrations) => container.register(toAwilixRegistrations(registrations)),

package/src/lib/email/__tests__/send.test.ts

@@ -1,7 +1,4 @@
 import React from 'react'
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
 import { sendEmail } from '../send'
 
 var sendMock: jest.Mock
@@ -18,7 +15,6 @@ jest.mock('resend', () => {
 
 describe('sendEmail', () => {
   const originalEnv = process.env
-  let tempDir: string | null = null
 
   beforeEach(() => {
     process.env = {
@@ -30,11 +26,7 @@ describe('sendEmail', () => {
     ResendMock.mockClear()
   })
 
-  afterEach(async () => {
-    if (tempDir) {
-      await rm(tempDir, { recursive: true, force: true })
-      tempDir = null
-    }
+  afterEach(() => {
     process.env = originalEnv
   })
 
@@ -166,32 +158,4 @@ describe('sendEmail', () => {
     expect(ResendMock).not.toHaveBeenCalled()
     expect(sendMock).not.toHaveBeenCalled()
   })
-
-  it('captures email links in OM_TEST_MODE without external delivery', async () => {
-    tempDir = await mkdtemp(join(tmpdir(), 'om-email-capture-'))
-    const capturePath = join(tempDir, 'emails.jsonl')
-    process.env.OM_TEST_MODE = '1'
-    process.env.OM_TEST_EMAIL_CAPTURE_PATH = capturePath
-    delete process.env.RESEND_API_KEY
-
-    await sendEmail({
-      to: 'user@example.com',
-      subject: 'Invite',
-      react: React.createElement('div', null, [
-        React.createElement('p', { key: 'text' }, 'Accept your invite'),
-        React.createElement('a', { key: 'link', href: 'https://example.com/portal/invite?token=raw' }, 'Accept'),
-      ]),
-    })
-
-    const rows = (await readFile(capturePath, 'utf8')).trim().split('\n')
-    expect(rows).toHaveLength(1)
-    expect(JSON.parse(rows[0])).toEqual(expect.objectContaining({
-      to: 'user@example.com',
-      subject: 'Invite',
-      links: ['https://example.com/portal/invite?token=raw'],
-      text: 'Accept your invite Accept',
-    }))
-    expect(ResendMock).not.toHaveBeenCalled()
-    expect(sendMock).not.toHaveBeenCalled()
-  })
 })

package/src/lib/email/send.ts

@@ -1,8 +1,5 @@
 import { Resend } from 'resend'
 import React from 'react'
-import { appendFile, mkdir } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
-import { tmpdir } from 'node:os'
 import { parseBooleanWithDefault } from '../boolean'
 import { resolveDefaultEmailFromAddress } from './config'
 
@@ -19,86 +16,10 @@ export type SendEmailOptions = {
   }>
 }
 
-type CapturedEmail = {
-  to: string
-  subject: string
-  from: string | null
-  replyTo: string | null
-  links: string[]
-  text: string
-  capturedAt: string
-}
-
-type ReactElementProps = {
-  href?: unknown
-  children?: unknown
-}
-
-const DEFAULT_TEST_EMAIL_CAPTURE_PATH = join(tmpdir(), 'open-mercato-email-capture.jsonl')
-
-function resolveTestEmailCapturePath(): string {
-  return process.env.OM_TEST_EMAIL_CAPTURE_PATH?.trim() || DEFAULT_TEST_EMAIL_CAPTURE_PATH
-}
-
-function readElementProps(node: React.ReactElement): ReactElementProps {
-  return node.props as ReactElementProps
-}
-
-function collectEmailLinks(node: unknown, links: string[] = []): string[] {
-  if (node == null || typeof node === 'boolean') return links
-  if (Array.isArray(node)) {
-    for (const child of node) collectEmailLinks(child, links)
-    return links
-  }
-  if (React.isValidElement(node)) {
-    const props = readElementProps(node)
-    if (typeof props.href === 'string' && props.href.length > 0) links.push(props.href)
-    collectEmailLinks(props.children, links)
-  }
-  return links
-}
-
-function collectEmailText(node: unknown, parts: string[] = []): string[] {
-  if (node == null || typeof node === 'boolean') return parts
-  if (typeof node === 'string' || typeof node === 'number') {
-    parts.push(String(node))
-    return parts
-  }
-  if (Array.isArray(node)) {
-    for (const child of node) collectEmailText(child, parts)
-    return parts
-  }
-  if (React.isValidElement(node)) {
-    collectEmailText(readElementProps(node).children, parts)
-  }
-  return parts
-}
-
-async function captureEmailForTests(options: SendEmailOptions): Promise<void> {
-  if (!parseBooleanWithDefault(process.env.OM_TEST_MODE, false)) return
-
-  const capturePath = resolveTestEmailCapturePath()
-  const record: CapturedEmail = {
-    to: options.to,
-    subject: options.subject,
-    from: options.from ?? resolveDefaultEmailFromAddress() ?? null,
-    replyTo: options.replyTo ?? null,
-    links: collectEmailLinks(options.react),
-    text: collectEmailText(options.react).join(' ').replace(/\s+/g, ' ').trim(),
-    capturedAt: new Date().toISOString(),
-  }
-
-  await mkdir(dirname(capturePath), { recursive: true })
-  await appendFile(capturePath, `${JSON.stringify(record)}\n`, 'utf8')
-}
-
 export async function sendEmail({ to, subject, react, from, replyTo, attachments }: SendEmailOptions) {
   const emailDisabled =
     parseBooleanWithDefault(process.env.OM_DISABLE_EMAIL_DELIVERY, false) ||
     parseBooleanWithDefault(process.env.OM_TEST_MODE, false)
-
-  await captureEmailForTests({ to, subject, react, from, replyTo, attachments })
-
   if (emailDisabled) return
 
   const apiKey = process.env.RESEND_API_KEY

package/src/lib/encryption/__tests__/subscriber.test.ts

@@ -4,11 +4,9 @@ import {
 } from '../subscriber'
 import type { TenantDataEncryptionService } from '../tenantDataEncryptionService'
 
-// Give every entity a resolvable id so the real decrypt() path proceeds to decryptEntityPayload,
-// keying off the class name so a test's fixture and its assertion describe the same entity.
+// Give every entity a resolvable id so the real decrypt() path proceeds to decryptEntityPayload.
 jest.mock('../entityIds', () => ({
-  resolveEntityIdFromMetadata: jest.fn((meta?: { className?: string }) =>
-    meta?.className === 'OnboardingRequest' ? 'onboarding:onboarding_request' : 'customers:customer_address'),
+  resolveEntityIdFromMetadata: jest.fn(() => 'customers:customer_address'),
 }))
 
 describe('decryptEntitiesWithFallbackScope subscriber memoization (issue #2235)', () => {
@@ -152,53 +150,3 @@ describe('decryptEntitiesWithFallbackScope per-row scope (multi-org safety)', ()
     expect(calls).toHaveLength(3)
   })
 })
-
-describe('tenant-less entity encryption delegation', () => {
-  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
-
-  beforeEach(() => {
-    process.env.TENANT_DATA_ENCRYPTION = 'yes'
-  })
-
-  afterEach(() => {
-    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
-    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
-  })
-
-  it('lets the encryption service resolve an explicit system-scoped map', async () => {
-    const encryptEntityPayload = jest.fn(async (
-      _entityId: string,
-      target: Record<string, unknown>,
-    ) => ({ ...target, secret: 'encrypted' }))
-    const service = {
-      isEnabled: () => true,
-      encryptEntityPayload,
-    } as unknown as TenantDataEncryptionService
-    const subscriber = new TenantEncryptionSubscriber(service)
-    const entity = { secret: 'plaintext' }
-    const meta = {
-      className: 'OnboardingRequest',
-      tableName: 'onboarding_requests',
-      properties: {
-        secret: { name: 'secret', fieldName: 'secret' },
-      },
-    }
-    const changeSet = { payload: { secret: 'plaintext' } }
-
-    await subscriber.beforeCreate({
-      entity,
-      meta,
-      em: {},
-      changeSet,
-    } as never)
-
-    expect(encryptEntityPayload).toHaveBeenCalledWith(
-      'onboarding:onboarding_request',
-      expect.any(Object),
-      null,
-      null,
-    )
-    expect(entity.secret).toBe('encrypted')
-    expect(changeSet.payload.secret).toBe('encrypted')
-  })
-})