@open-mercato/shared 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/src/lib/search/tokenize.ts

@@ -1,5 +1,5 @@
 import crypto from 'crypto'
-import { resolveSearchConfig, resolveSearchTokenLimits, type SearchConfig } from './config'
+import { resolveSearchConfig, type SearchConfig } from './config'
 
 export type TokenizationResult = {
   tokens: string[]
@@ -20,28 +20,13 @@ function splitTokens(text: string, minLength: number): string[] {
     .filter((token) => token.length >= minLength)
 }
 
-function appendExpandedToken(
-  token: string,
-  config: SearchConfig,
-  seen: Set<string>,
-  tokens: string[],
-  limit: number,
-): void {
-  const append = (candidate: string): boolean => {
-    if (seen.has(candidate)) return tokens.length < limit
-    seen.add(candidate)
-    tokens.push(candidate)
-    return tokens.length < limit
-  }
-
-  if (!config.enablePartials) {
-    append(token)
-    return
-  }
-
-  for (let length = config.minTokenLength; length <= token.length; length += 1) {
-    if (!append(token.slice(0, length))) return
+function expandToken(token: string, config: SearchConfig): string[] {
+  if (!config.enablePartials) return [token]
+  const results: string[] = []
+  for (let i = config.minTokenLength; i <= token.length; i += 1) {
+    results.push(token.slice(0, i))
   }
+  return results
 }
 
 export function hashToken(token: string, config?: SearchConfig): string {
@@ -51,17 +36,10 @@ export function hashToken(token: string, config?: SearchConfig): string {
 
 export function tokenizeText(text: string, config?: SearchConfig): TokenizationResult {
   const cfg = config ?? resolveSearchConfig()
-  const limits = resolveSearchTokenLimits(cfg)
-  const boundedText = limits.maxFieldChars > 0 ? text.slice(0, limits.maxFieldChars) : text
-  const tokenLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY
-  const seen = new Set<string>()
-  const tokens: string[] = []
-
-  for (const token of splitTokens(boundedText, cfg.minTokenLength)) {
-    if (tokens.length >= tokenLimit) break
-    appendExpandedToken(token, cfg, seen, tokens, tokenLimit)
-  }
-
+  const baseTokens = splitTokens(text, cfg.minTokenLength)
+  const expanded = baseTokens.flatMap((token) => expandToken(token, cfg))
+  const unique = Array.from(new Set(expanded))
+  const tokens = unique.filter((token) => token.length >= cfg.minTokenLength)
   const hashes = tokens.map((token) => hashToken(token, cfg))
   return { tokens, hashes }
 }

package/src/lib/webhooks/__tests__/verify.test.ts

@@ -1,26 +1,7 @@
 import { signWebhookPayload } from '../sign'
-import { isWebhookTimestampWithinTolerance, verifyWebhookSignature } from '../verify'
+import { verifyWebhookSignature } from '../verify'
 import { generateWebhookSecret } from '../secrets'
 
-describe('isWebhookTimestampWithinTolerance', () => {
-  it('accepts timestamps inside the configured tolerance', () => {
-    expect(isWebhookTimestampWithinTolerance('1700000000', 300, 1700000299)).toBe(true)
-  })
-
-  it('rejects stale timestamps outside the configured tolerance', () => {
-    expect(isWebhookTimestampWithinTolerance('1700000000', 300, 1700000301)).toBe(false)
-  })
-
-  it('rejects timestamps too far in the future', () => {
-    expect(isWebhookTimestampWithinTolerance('1700000601', 300, 1700000000)).toBe(false)
-  })
-
-  it('rejects malformed timestamps', () => {
-    expect(isWebhookTimestampWithinTolerance('not-a-timestamp', 300, 1700000000)).toBe(false)
-    expect(isWebhookTimestampWithinTolerance('1700000000abc', 300, 1700000000)).toBe(false)
-  })
-})
-
 describe('verifyWebhookSignature', () => {
   const msgId = 'msg_test123'
   const body = '{"type":"test.event","data":{}}'

package/src/lib/webhooks/index.ts

@@ -1,22 +1,4 @@
 export { signWebhookPayload, buildWebhookHeaders, generateMessageId } from './sign'
-export { WEBHOOK_SIGNATURE_TOLERANCE_SECONDS, isWebhookTimestampWithinTolerance, verifyWebhookSignature } from './verify'
+export { verifyWebhookSignature } from './verify'
 export { generateWebhookSecret, parseWebhookSecret, isValidWebhookSecret } from './secrets'
-export {
-  DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,
-  readBoundedRequestBody,
-  resolveWebhookBodyLimitBytes,
-  WebhookBodyTooLargeError,
-} from './body'
 export type { StandardWebhookHeaders, WebhookSigningKey, WebhookVerificationResult, StandardWebhookPayload } from './types'
-export type {
-  InboundWebhookRequest,
-  WebhookSourceCredentialField,
-  WebhookSourceConfig,
-  WebhookHandlerMeta,
-  WebhookHandlerPayload,
-  WebhookHandlerContext,
-  WebhookHandler,
-  WebhookHandlerRegistryEntry,
-  WebhookHandlerResult,
-  WebhookIngestionStatus,
-} from './inbound-types'

package/src/lib/webhooks/verify.ts

@@ -2,21 +2,7 @@ import { timingSafeEqual, createHmac } from 'node:crypto'
 import { parseWebhookSecret } from './secrets'
 import type { WebhookVerificationResult } from './types'
 
-export const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 5 * 60 // 5 minutes
-
-export function isWebhookTimestampWithinTolerance(
-  timestamp: string,
-  toleranceSeconds: number = WEBHOOK_SIGNATURE_TOLERANCE_SECONDS,
-  nowSeconds: number = Math.floor(Date.now() / 1000),
-): boolean {
-  const normalizedTimestamp = timestamp.trim()
-  if (!/^\d+$/.test(normalizedTimestamp)) {
-    return false
-  }
-
-  const timestampNum = Number.parseInt(normalizedTimestamp, 10)
-  return Math.abs(nowSeconds - timestampNum) <= toleranceSeconds
-}
+const TOLERANCE_SECONDS = 5 * 60 // 5 minutes
 
 /**
  * Verify a Standard Webhooks signature against one or more secrets.
@@ -28,9 +14,15 @@ export function verifyWebhookSignature(
   body: string,
   signatureHeader: string,
   secrets: string[],
-  toleranceSeconds: number = WEBHOOK_SIGNATURE_TOLERANCE_SECONDS,
+  toleranceSeconds: number = TOLERANCE_SECONDS,
 ): WebhookVerificationResult {
-  if (!isWebhookTimestampWithinTolerance(timestamp, toleranceSeconds)) {
+  const timestampNum = parseInt(timestamp, 10)
+  if (isNaN(timestampNum)) {
+    return { valid: false }
+  }
+
+  const now = Math.floor(Date.now() / 1000)
+  if (Math.abs(now - timestampNum) > toleranceSeconds) {
     return { valid: false }
   }
 

package/src/modules/__tests__/registry.test.ts

@@ -94,11 +94,7 @@ describe('CLI Modules Registry', () => {
         {
           id: 'auth',
           defaultEncryptionMaps: [
-            {
-              entityId: 'auth:user',
-              keyScope: 'system',
-              fields: [{ field: 'email', hashField: 'email_hash' }],
-            },
+            { entityId: 'auth:user', fields: [{ field: 'email', hashField: 'email_hash' }] },
           ],
         },
         {
@@ -110,11 +106,7 @@ describe('CLI Modules Registry', () => {
       ])
 
       expect(maps).toEqual([
-        {
-          entityId: 'auth:user',
-          keyScope: 'system',
-          fields: [{ field: 'email', hashField: 'email_hash' }],
-        },
+        { entityId: 'auth:user', fields: [{ field: 'email', hashField: 'email_hash' }] },
         { entityId: 'customers:customer_comment', fields: [{ field: 'body', hashField: null }] },
       ])
     })

package/src/modules/analytics.ts

@@ -13,13 +13,6 @@ export type AnalyticsEntityTypeConfig = {
   schema?: string
   dateField: string
   defaultScopeFields: string[]
-  /**
-   * Field name (a key of `fieldMappings`) holding the per-row currency of monetary
-   * columns. Declaring it lets analytics consumers verify that the rows they aggregate
-   * all carry one currency before labelling the result with it (#4676). Omit it for
-   * entities whose amounts are not per-row denominated.
-   */
-  currencyField?: string
 }
 
 export type AnalyticsFieldMapping = {

package/src/modules/customer-auth.ts

@@ -20,7 +20,6 @@ export interface CustomerAuthContext {
   customerEntityId?: string | null
   personEntityId?: string | null
   resolvedFeatures: string[]
-  isPortalAdmin?: boolean
 }
 
 export type CustomerUser = {

package/src/modules/encryption.ts

@@ -3,10 +3,7 @@ export type ModuleEncryptionFieldRule = {
   hashField?: string | null
 }
 
-export type EncryptionKeyScope = 'tenant' | 'system'
-
 export type ModuleEncryptionMap = {
   entityId: string
-  keyScope?: EncryptionKeyScope
   fields: ModuleEncryptionFieldRule[]
 }

package/src/modules/navigation/backendChrome.ts

@@ -44,23 +44,9 @@ export type BackendChromeBrand = {
   logo?: {
     src: string
     alt?: string
-    preserveAspectRatio?: boolean
   } | null
 }
 
-/**
- * The organization the current request is scoped to, resolved server-side.
- *
- * Distinct from `brand`, which is a *branding* channel and only populates when the organization has a
- * logo configured. This is always present when a single organization is in scope, so UI can label
- * "you are viewing: <name>" without a second round trip. `null` under an all-organizations selection,
- * when no organization is in scope, or when the lookup fails.
- */
-export type BackendChromeCurrentOrganization = {
-  id: string
-  name: string
-}
-
 export type BackendChromePayload = {
   groups: BackendChromeNavGroup[]
   settingsSections: BackendChromeSectionGroup[]
@@ -70,5 +56,4 @@ export type BackendChromePayload = {
   grantedFeatures: string[]
   roles: string[]
   brand?: BackendChromeBrand | null
-  currentOrganization?: BackendChromeCurrentOrganization | null
 }

package/src/modules/overrides.ts

@@ -116,21 +116,6 @@ export interface EncryptionOverridesShape {
   maps?: EncryptionMapOverridesMap | LooseOverrideMap
 }
 
-/**
- * Backend navigation ordering.
- *
- * `groupOrder` **prepends** sidebar nav group ids: the ids listed here rank ahead of every other
- * group, in the order given, and any group not named keeps the ordering it has today. Prepending
- * rather than replacing means an app that only cares about its own group lists that one id, instead of
- * having to enumerate every shipped group and accidentally demoting the ones it forgot.
- *
- * This is a *default*, applied beneath both role and user sidebar preferences — an operator's own
- * arrangement still wins.
- */
-export interface NavOverridesShape {
-  groupOrder?: string[]
-}
-
 /**
  * Umbrella shape for `entry.overrides`. Every key is optional; a
  * downstream app sets only the domains it cares about.
@@ -151,7 +136,6 @@ export interface ModuleOverrides {
   acl?: AclOverridesShape
   di?: DiOverridesMap | LooseOverrideMap
   encryption?: EncryptionOverridesShape
-  nav?: NavOverridesShape
 }
 
 /**
@@ -191,7 +175,6 @@ export type ModuleOverrideDomain =
   | 'acl'
   | 'di'
   | 'encryption'
-  | 'nav'
 
 export interface ModuleOverrideEntry<TShape> {
   moduleId: string
@@ -244,7 +227,6 @@ const DOMAIN_KEYS: ModuleOverrideDomain[] = [
   'acl',
   'di',
   'encryption',
-  'nav',
 ]
 
 const TRACKING_ISSUE_HINT =
@@ -459,71 +441,6 @@ const encryptionMapOverrideStore: OverrideStore<ModuleEncryptionMap> = { modules
 const diOverrideStore: OverrideStore<Exclude<DiBindingOverride, null>> = { modules: {}, programmatic: {} }
 const setupOverridesByModule: Record<string, SetupOverridesShape> = {}
 
-/**
- * Sidebar nav ordering state.
- *
- * Persisted on `globalThis` rather than in a module-local variable. This is the one override domain
- * whose consumer lives in a *different package* (`@open-mercato/core`'s backend chrome reads what the
- * app's bootstrap wrote), and standalone builds can evaluate `@open-mercato/shared` through more than
- * one server chunk — bootstrap would store the value in one instance while the reader saw `null` from
- * another. See `.ai/lessons.md`, "Global registries in publishable packages must use `globalThis`".
- *
- * Two tiers, matching every other override domain and the documented resolution order: programmatic
- * calls win over `modules.ts` inline declarations.
- */
-const GLOBAL_NAV_OVERRIDE_STATE_KEY = '__openMercatoNavOverrideState__'
-
-type NavOverrideState = {
-  /** From `modules.ts` inline `overrides.nav`, with the module entry that supplied it. */
-  modules: { moduleId: string; groupOrder: string[] } | null
-  /** From `applyNavGroupOrderOverrides`. Takes precedence over `modules`. */
-  programmatic: string[] | null
-}
-
-function getNavOverrideState(): NavOverrideState {
-  const existing = (globalThis as Record<string, unknown>)[GLOBAL_NAV_OVERRIDE_STATE_KEY]
-  if (existing && typeof existing === 'object') {
-    const typed = existing as NavOverrideState
-    if ('modules' in typed && 'programmatic' in typed) return typed
-  }
-  const initial: NavOverrideState = { modules: null, programmatic: null }
-  ;(globalThis as Record<string, unknown>)[GLOBAL_NAV_OVERRIDE_STATE_KEY] = initial
-  return initial
-}
-
-/** Drops blank/duplicate ids and returns `null` when nothing usable remains. */
-function normalizeNavGroupOrder(value: unknown): string[] | null {
-  if (!Array.isArray(value)) return null
-  const ids = Array.from(
-    new Set(
-      value
-        .filter((id): id is string => typeof id === 'string' && id.trim().length > 0)
-        .map((id) => id.trim()),
-    ),
-  )
-  return ids.length > 0 ? ids : null
-}
-
-/**
- * Programmatic nav ordering, for env-driven boot decisions and tests. Takes precedence over
- * `modules.ts` inline `overrides.nav`, consistent with the other domains' programmatic tier. Pass
- * `null` to clear it and fall back to the inline declaration.
- */
-export function applyNavGroupOrderOverrides(groupOrder: string[] | null): void {
-  getNavOverrideState().programmatic = groupOrder === null ? null : normalizeNavGroupOrder(groupOrder)
-}
-
-/**
- * Nav group ids an app wants ranked ahead of the built-in order, or `null` when none is configured.
- *
- * Consumers MUST treat `null` as "use the shipped ordering unchanged" — this is a default, applied
- * beneath role and user sidebar preferences.
- */
-export function getNavGroupOrderOverride(): readonly string[] | null {
-  const state = getNavOverrideState()
-  return state.programmatic ?? state.modules?.groupOrder ?? null
-}
-
 function normalizeIdOverrideKey(key: string, label: string): string | null {
   if (typeof key !== 'string') return null
   const trimmed = key.trim()
@@ -804,9 +721,6 @@ export function resetModuleContractOverridesForTests(): void {
   clearStore(encryptionMapOverrideStore)
   clearStore(diOverrideStore)
   for (const key of Object.keys(setupOverridesByModule)) delete setupOverridesByModule[key]
-  const navState = getNavOverrideState()
-  navState.modules = null
-  navState.programmatic = null
 }
 
 /**
@@ -1586,24 +1500,7 @@ function encryptionOverridesApplier(entries: ReadonlyArray<ModuleOverrideEntry<E
   }
 }
 
-function navOverridesApplier(entries: ReadonlyArray<ModuleOverrideEntry<NavOverridesShape>>): void {
-  const state = getNavOverrideState()
-  for (const entry of entries) {
-    const groupOrder = normalizeNavGroupOrder(entry.overrides?.groupOrder)
-    if (!groupOrder) continue
-    if (state.modules && state.modules.moduleId !== entry.moduleId) {
-      logger.warn('nav.groupOrder declared by more than one module — the later one wins', {
-        previousModuleId: state.modules.moduleId,
-        moduleId: entry.moduleId,
-        hint: 'Sidebar group ordering is a single app-wide decision; declare it on one module entry.',
-      })
-    }
-    state.modules = { moduleId: entry.moduleId, groupOrder }
-  }
-}
-
 function registerBuiltInModuleOverrideAppliers(): void {
-  registerModuleOverrideApplier<NavOverridesShape>('nav', navOverridesApplier)
   registerModuleOverrideApplier<RoutesOverridesShape>('routes', routesOverridesApplier)
   registerModuleOverrideApplier<EventsOverridesShape>('events', eventsOverridesApplier)
   registerModuleOverrideApplier<WorkerOverridesMap>('workers', workersOverridesApplier)

package/src/modules/payment_gateways/types.ts

@@ -1,5 +1,3 @@
-import { DEFAULT_WEBHOOK_BODY_LIMIT_BYTES } from '../../lib/webhooks/body'
-
 // ── Unified Payment Status ──────────────────────────────────────────────────
 
 export type UnifiedPaymentStatus =
@@ -114,32 +112,6 @@ export type PaymentGatewayClientSession =
   | EmbeddedPaymentGatewayClientSession
   | RedirectPaymentGatewayClientSession
 
-// ── Order Amount Reconciliation ─────────────────────────────────────────────
-
-export interface PaymentGatewayScope {
-  organizationId: string
-  tenantId: string
-}
-
-export interface PaymentOrderTotal {
-  orderId: string
-  currencyCode: string
-  amountDue: number
-}
-
-/**
- * Contract a module that owns orders implements so `payment_gateways` can
- * reconcile a caller-supplied session amount against the authoritative amount
- * due, without depending on that module. Implementations MUST scope the lookup
- * by tenant and organization and MUST return `null` for anything outside the
- * caller's scope, so an out-of-scope order is indistinguishable from a missing
- * one. The `sales` module registers the default implementation under the
- * `paymentOrderTotalResolver` DI name.
- */
-export interface PaymentOrderTotalResolver {
-  resolveOrderTotal(orderId: string, scope: PaymentGatewayScope): Promise<PaymentOrderTotal | null>
-}
-
 // ── Input / Output Types ────────────────────────────────────────────────────
 
 export interface CreateSessionInput {
@@ -253,7 +225,6 @@ export interface WebhookHandlerRegistration {
   handler: (input: VerifyWebhookInput) => Promise<WebhookEvent>
   queue?: string
   readSessionIdHint?: (payload: Record<string, unknown> | null) => string | null
-  maxBodyBytes?: number
 }
 
 // ── Adapter Registry Options ────────────────────────────────────────────────
@@ -348,25 +319,13 @@ export function registerWebhookHandler(
   options?: {
     queue?: string
     readSessionIdHint?: (payload: Record<string, unknown> | null) => string | null
-    maxBodyBytes?: number
   },
 ): () => void {
-  if (
-    options?.maxBodyBytes !== undefined
-    && (!Number.isSafeInteger(options.maxBodyBytes)
-      || options.maxBodyBytes <= 0
-      || options.maxBodyBytes > DEFAULT_WEBHOOK_BODY_LIMIT_BYTES)
-  ) {
-    throw new Error(
-      `[internal] Payment gateway webhook maxBodyBytes must be a positive safe integer no greater than ${DEFAULT_WEBHOOK_BODY_LIMIT_BYTES}`,
-    )
-  }
   const webhookHandlerRegistry = getWebhookHandlerRegistry()
   webhookHandlerRegistry.set(providerKey, {
     handler,
     queue: options?.queue,
     readSessionIdHint: options?.readSessionIdHint,
-    maxBodyBytes: options?.maxBodyBytes,
   })
   return () => {
     webhookHandlerRegistry.delete(providerKey)

package/src/modules/registry.ts

@@ -194,8 +194,6 @@ export type ModuleWorker = {
   moduleId?: string
   queue: string
   concurrency: number
-  lockDuration?: number
-  maxStalledCount?: number
   handler: ModuleWorkerHandler
 }
 
@@ -515,7 +513,6 @@ export function getDefaultEncryptionMaps(modules: Module[]): import('./encryptio
         moduleId: mod.id,
         map: {
           entityId: entry.entityId,
-          ...(entry.keyScope ? { keyScope: entry.keyScope } : {}),
           fields: entry.fields.map((field) => ({
             field: field.field,
             hashField: field.hashField ?? null,

package/src/security/enabledModulesRegistry.ts

@@ -31,7 +31,6 @@ type FeatureRegistry = {
   enabledModuleSet: Set<string>
   featureToModule: Map<string, string>
   prefixToModule: Map<string, string>
-  concreteFeatureIds: string[]
 }
 
 let cachedRegistry: FeatureRegistry | null = null
@@ -42,63 +41,23 @@ function buildRegistry(modules: readonly Module[]): FeatureRegistry {
   const enabledModuleSet = new Set(enabledModuleIds)
   const featureToModule = new Map<string, string>()
   const prefixToModule = new Map<string, string>()
-  const concreteFeatureIds: string[] = []
-  const concreteFeatureSet = new Set<string>()
-
-  const addConcreteFeature = (featureId: string, owningModule: string, authoritative: boolean) => {
-    if (!featureId || featureId === '*' || featureId.endsWith('.*')) return
-    if (!concreteFeatureSet.has(featureId)) {
-      concreteFeatureSet.add(featureId)
-      concreteFeatureIds.push(featureId)
-    }
-    if (authoritative || !featureToModule.has(featureId)) {
-      featureToModule.set(featureId, owningModule)
-    }
-    const dot = featureId.indexOf('.')
-    if (dot > 0) {
-      const prefix = featureId.slice(0, dot)
-      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule)
-    }
-  }
-
   for (const mod of modules) {
     const features = mod.features
-    if (Array.isArray(features)) {
-      for (const feature of features) {
-        if (!feature || typeof feature.id !== 'string' || !feature.id) continue
-        const declared = typeof feature.module === 'string' && feature.module.length > 0
-          ? feature.module
-          : mod.id
-        addConcreteFeature(feature.id, declared, true)
-      }
-    }
-
-    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures
-    if (customerDefaults) {
-      for (const roleFeatures of Object.values(customerDefaults)) {
-        if (!Array.isArray(roleFeatures)) continue
-        for (const featureId of roleFeatures) {
-          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
-        }
+    if (!Array.isArray(features)) continue
+    for (const feature of features) {
+      if (!feature || typeof feature.id !== 'string' || !feature.id) continue
+      const declared = typeof feature.module === 'string' && feature.module.length > 0
+        ? feature.module
+        : mod.id
+      featureToModule.set(feature.id, declared)
+      const dot = feature.id.indexOf('.')
+      if (dot > 0) {
+        const prefix = feature.id.slice(0, dot)
+        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared)
       }
     }
-
-    if (Array.isArray(mod.frontendRoutes)) {
-      for (const route of mod.frontendRoutes) {
-        if (!Array.isArray(route.requireCustomerFeatures)) continue
-        for (const featureId of route.requireCustomerFeatures) {
-          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
-        }
-      }
-    }
-  }
-  return {
-    enabledModuleIds,
-    enabledModuleSet,
-    featureToModule,
-    prefixToModule,
-    concreteFeatureIds,
   }
+  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule }
 }
 
 function getRegistry(): FeatureRegistry | null {
@@ -134,17 +93,6 @@ export function getEnabledModuleIds(): string[] {
   return registry ? [...registry.enabledModuleIds] : []
 }
 
-/** @internal Infrastructure input for concrete feature-policy projection. */
-export function getConcreteFeatureIds(): string[] {
-  const registry = getRegistry()
-  return registry ? [...registry.concreteFeatureIds] : []
-}
-
-/** @internal Distinguishes an empty registry from an unavailable bootstrap registry. */
-export function hasEnabledModulesRegistry(): boolean {
-  return getRegistry() !== null
-}
-
 /**
  * Filters a raw granted-features list down to the grants whose owning
  * module is currently enabled. Expands `*` (superadmin) into one wildcard

package/dist/lib/ai/safety-identifier.js

@@ -1,32 +0,0 @@
-import crypto from "node:crypto";
-const SAFETY_IDENTIFIER_SECRET_LABEL = "open-mercato:ai-safety-identifier:v1";
-const derivedSecretCache = /* @__PURE__ */ new Map();
-function readBaseSecret(explicit) {
-  const secret = explicit ?? process.env.JWT_SECRET;
-  if (!secret) {
-    throw new Error("[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret");
-  }
-  return secret;
-}
-function deriveAiSafetyIdentifierSecret(baseSecret) {
-  const base = readBaseSecret(baseSecret);
-  const cached = derivedSecretCache.get(base);
-  if (cached !== void 0) return cached;
-  const derived = crypto.createHmac("sha256", base).update(SAFETY_IDENTIFIER_SECRET_LABEL).digest("hex");
-  derivedSecretCache.set(base, derived);
-  return derived;
-}
-function computeEndUserIdentifier(tenantId, userId, options) {
-  const normalizedUser = (userId ?? "").trim();
-  if (!normalizedUser) {
-    throw new Error("[internal] computeEndUserIdentifier requires a non-empty userId");
-  }
-  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret);
-  const salt = (tenantId ?? "").trim();
-  return crypto.createHmac("sha256", key).update(`${salt}:${normalizedUser}`).digest("hex");
-}
-export {
-  computeEndUserIdentifier,
-  deriveAiSafetyIdentifierSecret
-};
-//# sourceMappingURL=safety-identifier.js.map

package/dist/lib/ai/safety-identifier.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/ai/safety-identifier.ts"],
-  "sourcesContent": ["/**\n * End-user safety identifiers for AI provider calls.\n *\n * Providers such as OpenAI let developers attach an opaque per-end-user\n * identifier to each request so abuse enforcement can target one user instead\n * of suspending the whole API-key organization. We never send a reversible id:\n * the value is a tenant-salted HMAC computed from the platform's existing auth\n * secret, so no PII or internal id leaves the platform and the same end user in\n * two tenants produces two unrelated hashes.\n *\n * The per-process secret derivation mirrors `deriveJwtAudienceSecret`\n * (`@open-mercato/shared/lib/auth/jwt`): one HMAC from the base `JWT_SECRET`\n * under a versioned purpose label, memoized for the process lifetime. No new\n * secret to provision.\n *\n * @see .ai/specs/2026-06-04-ai-input-moderation-and-safety-identifiers.md\n */\n\nimport crypto from 'node:crypto'\n\nconst SAFETY_IDENTIFIER_SECRET_LABEL = 'open-mercato:ai-safety-identifier:v1'\n\nconst derivedSecretCache = new Map<string, string>()\n\nfunction readBaseSecret(explicit?: string): string {\n  const secret = explicit ?? process.env.JWT_SECRET\n  if (!secret) {\n    throw new Error('[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret')\n  }\n  return secret\n}\n\n/**\n * Derive the per-process safety-identifier HMAC key from the base auth secret.\n *\n * Deterministic HMAC-SHA256 of a versioned purpose label keyed by the base\n * secret, memoized per base secret. Rotating the base secret rotates every\n * derived identifier \u2014 documented as accepted (identifiers are advisory\n * provider-side metadata, not an in-platform security control).\n */\nexport function deriveAiSafetyIdentifierSecret(baseSecret?: string): string {\n  const base = readBaseSecret(baseSecret)\n  const cached = derivedSecretCache.get(base)\n  if (cached !== undefined) return cached\n  const derived = crypto\n    .createHmac('sha256', base)\n    .update(SAFETY_IDENTIFIER_SECRET_LABEL)\n    .digest('hex')\n  derivedSecretCache.set(base, derived)\n  return derived\n}\n\n/**\n * Compute the opaque end-user safety identifier for a (tenant, user) pair.\n *\n * Returns a 64-char lowercase hex HMAC-SHA256 of `${tenantId}:${userId}` keyed\n * by the derived secret. Throws (with an `[internal]` message) when the base\n * secret is missing or `userId` is empty \u2014 callers in the runtime wrap this in\n * a best-effort try/catch so identifier-derivation failures never break chat.\n */\nexport function computeEndUserIdentifier(\n  tenantId: string | null | undefined,\n  userId: string,\n  options?: { baseSecret?: string },\n): string {\n  const normalizedUser = (userId ?? '').trim()\n  if (!normalizedUser) {\n    throw new Error('[internal] computeEndUserIdentifier requires a non-empty userId')\n  }\n  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret)\n  const salt = (tenantId ?? '').trim()\n  return crypto.createHmac('sha256', key).update(`${salt}:${normalizedUser}`).digest('hex')\n}\n"],
-  "mappings": "AAkBA,OAAO,YAAY;AAEnB,MAAM,iCAAiC;AAEvC,MAAM,qBAAqB,oBAAI,IAAoB;AAEnD,SAAS,eAAe,UAA2B;AACjD,QAAM,SAAS,YAAY,QAAQ,IAAI;AACvC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,SAAO;AACT;AAUO,SAAS,+BAA+B,YAA6B;AAC1E,QAAM,OAAO,eAAe,UAAU;AACtC,QAAM,SAAS,mBAAmB,IAAI,IAAI;AAC1C,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,UAAU,OACb,WAAW,UAAU,IAAI,EACzB,OAAO,8BAA8B,EACrC,OAAO,KAAK;AACf,qBAAmB,IAAI,MAAM,OAAO;AACpC,SAAO;AACT;AAUO,SAAS,yBACd,UACA,QACA,SACQ;AACR,QAAM,kBAAkB,UAAU,IAAI,KAAK;AAC3C,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,QAAM,MAAM,+BAA+B,SAAS,UAAU;AAC9D,QAAM,QAAQ,YAAY,IAAI,KAAK;AACnC,SAAO,OAAO,WAAW,UAAU,GAAG,EAAE,OAAO,GAAG,IAAI,IAAI,cAAc,EAAE,EAAE,OAAO,KAAK;AAC1F;",
-  "names": []
-}