@open-mercato/shared 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

package/src/lib/encryption/__tests__/tenantDataEncryptionService.test.ts

@@ -196,64 +196,6 @@ describe('TenantDataEncryptionService.encryptFields (issue #2720)', () => {
   })
 })
 
-describe('TenantDataEncryptionService system-scoped maps', () => {
-  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
-
-  beforeEach(() => {
-    process.env.TENANT_DATA_ENCRYPTION = 'yes'
-  })
-
-  afterEach(() => {
-    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
-    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
-  })
-
-  it('encrypts tenant-less payloads with a stable entity-scoped KMS key', async () => {
-    const entityId = 'onboarding:onboarding_request'
-    const systemKeyId = `system:${entityId}`
-    const getTenantDek = jest.fn(async (keyId: string) => (
-      keyId === systemKeyId
-        ? { tenantId: keyId, key: fixedKey, fetchedAt: new Date() }
-        : null
-    ))
-    const service = new TenantDataEncryptionService(
-      {
-        getConnection: () => ({ execute: jest.fn(async () => []) }),
-      } as never,
-      {
-        kms: {
-          getTenantDek,
-          createTenantDek: jest.fn(async () => null),
-          isHealthy: () => true,
-        },
-        defaultEncryptionMaps: [
-          {
-            entityId,
-            keyScope: 'system',
-            fields: [
-              { field: 'email', hashField: 'email_hash' },
-              { field: 'password_hash' },
-            ],
-          },
-        ],
-      } as never,
-    )
-
-    const encrypted = await service.encryptEntityPayload(entityId, {
-      email: 'person@example.com',
-      email_hash: null,
-      password_hash: 'bcrypt-value',
-    }, null, null)
-
-    expect(getTenantDek).toHaveBeenCalledWith(systemKeyId)
-    expect(encrypted.email).not.toBe('person@example.com')
-    expect(encrypted.password_hash).not.toBe('bcrypt-value')
-    expect(encrypted.email_hash).toBe(hashForLookup('person@example.com'))
-    expect(decryptWithAesGcm(encrypted.email as string, fixedKey)).toBe('person@example.com')
-    expect(decryptWithAesGcm(encrypted.password_hash as string, fixedKey)).toBe('bcrypt-value')
-  })
-})
-
 describe('TenantDataEncryptionService.getEncryptedFieldNames', () => {
   it('returns active encryption-map field names for query planning', async () => {
     const service = new TenantDataEncryptionService({} as never)

package/src/lib/encryption/subscriber.ts

@@ -6,7 +6,6 @@ import { isTenantDataEncryptionEnabled } from './toggles'
 import { isEncryptionDebugEnabled } from './toggles'
 import { resolveTenantEncryptionService } from './customFieldValues'
 import { createLogger } from '../logger'
-import { listEntityMetadataFromRegistry } from '../db/entityMetadata'
 
 const logger = createLogger('shared').child({ component: 'encryption' })
 
@@ -86,8 +85,13 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     try { return registry.find?.(ctor) } catch {}
     try { return registry.get?.(name) } catch {}
     try { return registry.get?.(ctor) } catch {}
+    const all =
+      (typeof registry.getAll === 'function' && registry.getAll()) ||
+      (Array.isArray((registry as any).metadata) ? (registry as any).metadata : undefined) ||
+      (registry as any).metadata ||
+      {}
     try {
-      const entries = listEntityMetadataFromRegistry(registry)
+      const entries = Array.isArray(all) ? all : Object.values<any>(all)
       const match = entries.find(
         (m: any) =>
           m?.className === name ||
@@ -220,6 +224,10 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
       return
     }
     const { tenantId, organizationId } = resolveScope(target)
+    if (!tenantId) {
+      debug('⚪️ subscriber.skip', { reason: 'no-tenant', entityId })
+      return
+    }
     const encrypted = await this.service.encryptEntityPayload(entityId, target, tenantId, organizationId)
     const metaProps: Record<string, unknown> = resolvedMeta?.properties && typeof resolvedMeta.properties === 'object'
       ? resolvedMeta.properties
@@ -317,6 +325,10 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     const { tenantId, organizationId } = resolveScope(target)
     const scopedTenantId = tenantId ?? fallbackScope?.tenantId ?? null
     const scopedOrgId = organizationId ?? fallbackScope?.organizationId ?? null
+    if (!scopedTenantId) {
+      debug('⚪️ subscriber.skip', { reason: 'no-tenant', entityId })
+      return
+    }
     // Capture pending (un-flushed) changes BEFORE decrypt mutates the target. Re-baselining a
     // managed entity that a command already mutated would clear its dirty changeset and silently
     // drop the pending write (e.g. an undo handler that mutates an entity, then loads a related

package/src/lib/encryption/tenantDataEncryptionService.ts

@@ -4,7 +4,6 @@ import { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'
 import { createKmsService, type KmsService, type TenantDek } from './kms'
 import { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'
 import { createLogger } from '../logger'
-import type { EncryptionKeyScope, ModuleEncryptionMap } from '../../modules/encryption'
 
 const logger = createLogger('shared').child({ component: 'tenant-encryption' })
 
@@ -15,7 +14,6 @@ export type EncryptedFieldRule = {
 
 export type EncryptionMapRecord = {
   entityId: string
-  keyScope?: EncryptionKeyScope
   fields: EncryptedFieldRule[]
 }
 
@@ -156,23 +154,13 @@ export class TenantDataEncryptionService {
   private readonly inflightDeks = TenantDataEncryptionService.globalInflightDeks
   private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps
   private readonly missCache = TenantDataEncryptionService.globalMissCache
-  private readonly systemDefaultMaps: Map<string, ModuleEncryptionMap>
 
   constructor(
     private em: EntityManager,
-    opts?: {
-      cache?: CacheStrategy
-      kms?: KmsService
-      defaultEncryptionMaps?: readonly ModuleEncryptionMap[]
-    }
+    opts?: { cache?: CacheStrategy; kms?: KmsService }
   ) {
     this.cache = opts?.cache
     this.kms = opts?.kms ?? createKmsService()
-    this.systemDefaultMaps = new Map(
-      (opts?.defaultEncryptionMaps ?? [])
-        .filter((map) => map.keyScope === 'system')
-        .map((map) => [map.entityId, map]),
-    )
   }
 
   isEnabled(): boolean {
@@ -251,24 +239,6 @@ export class TenantDataEncryptionService {
     }
   }
 
-  private applySystemDefault(record: EncryptionMapRecord | null, entityId: string): EncryptionMapRecord | null {
-    const declared = this.systemDefaultMaps.get(entityId)
-    if (!declared) return record
-    const fields: EncryptedFieldRule[] = declared.fields.map((field) => ({
-      field: field.field,
-      hashField: field.hashField ?? null,
-    }))
-    const declaredFields = new Set(fields.map((field) => field.field))
-    for (const field of record?.fields ?? []) {
-      if (!declaredFields.has(field.field)) fields.push(field)
-    }
-    return {
-      entityId,
-      keyScope: 'system',
-      fields,
-    }
-  }
-
   private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {
     const shouldSkipLookup = (tag: string) => {
       const expiresAt = this.missCache.get(tag)
@@ -292,13 +262,13 @@ export class TenantDataEncryptionService {
       if (this.inflightMaps.has(tag)) {
         const pending = this.inflightMaps.get(tag)!
         const resolved = await pending
-        if (resolved) return this.applySystemDefault(resolved, key.entityId)
+        if (resolved) return resolved
       }
       const mem = this.memoryCache.get(tag)
-      if (mem) return this.applySystemDefault(mem, key.entityId)
+      if (mem) return mem
       if (this.cache && typeof this.cache.get === 'function') {
         const cached = await this.cache.get(tag)
-        if (cached) return this.applySystemDefault(cached as EncryptionMapRecord, key.entityId)
+        if (cached) return cached as EncryptionMapRecord
       }
       const pending = this.fetchMap(candidate)
       this.inflightMaps.set(tag, pending)
@@ -318,9 +288,9 @@ export class TenantDataEncryptionService {
       if (this.cache && typeof this.cache.set === 'function') {
         await this.cache.set(tag, loaded, { ttl: 300 })
       }
-      return this.applySystemDefault(loaded, key.entityId)
+      return loaded
     }
-    return this.applySystemDefault(null, key.entityId)
+    return null
   }
 
   private async fetchAllOrganizationFieldNames(entityId: string, tenantId: string | null): Promise<string[]> {
@@ -366,26 +336,12 @@ export class TenantDataEncryptionService {
     this.kms.invalidateDek?.(tenantId)
   }
 
-  /**
-   * Lists the fields an encryption map marks as encrypted at rest.
-   *
-   * `isEnabled()` folds the environment toggle together with KMS health, so by default an
-   * unhealthy KMS reports "nothing is encrypted" — which is safe for write paths but wrong for
-   * readers that must decide whether a stored column holds ciphertext. `ignoreRuntimeHealth`
-   * answers the on-disk question instead: it consults the map even when the KMS cannot currently
-   * resolve a DEK, so callers can fail closed rather than treat ciphertext as plaintext (#4622).
-   */
   async getEncryptedFieldNames(
     entityId: string,
     tenantId: string | null | undefined,
-    organizationId?: string | null,
-    options?: { ignoreRuntimeHealth?: boolean }
+    organizationId?: string | null
   ): Promise<string[]> {
-    if (options?.ignoreRuntimeHealth) {
-      if (!isTenantDataEncryptionEnabled()) return []
-    } else if (!this.isEnabled()) {
-      return []
-    }
+    if (!this.isEnabled()) return []
     const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
     const fields = new Set(normalizeEncryptedFieldNames(map?.fields))
     if (organizationId == null) {
@@ -465,17 +421,16 @@ export class TenantDataEncryptionService {
       debug('⚪️ encrypt.skip.disabled', { entityId, tenantId })
       return payload
     }
+    const dek = await this.resolveDekForEncrypt(tenantId ?? null)
+    if (!dek) {
+      debug('⚠️ encrypt.skip.no-dek', { entityId, tenantId })
+      return payload
+    }
     const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
     if (!map || !map.fields?.length) {
       debug('⚪️ encrypt.skip.no-map', { entityId, tenantId })
       return payload
     }
-    const keyId = map.keyScope === 'system' ? `system:${entityId}` : tenantId ?? null
-    const dek = await this.resolveDekForEncrypt(keyId)
-    if (!dek) {
-      debug('⚠️ encrypt.skip.no-dek', { entityId, tenantId, keyScope: map.keyScope ?? 'tenant' })
-      return payload
-    }
     debug('🔒 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })
     return this.encryptFields(payload, map.fields, dek)
   }
@@ -490,17 +445,16 @@ export class TenantDataEncryptionService {
       debug('⚪️ decrypt.skip.disabled', { entityId, tenantId })
       return payload
     }
+    const dek = await this.getDek(tenantId ?? null)
+    if (!dek) {
+      debug('⚠️ decrypt.skip.no-dek', { entityId, tenantId })
+      return payload
+    }
     const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
     if (!map || !map.fields?.length) {
       debug('⚪️ decrypt.skip.no-map', { entityId, tenantId })
       return payload
     }
-    const keyId = map.keyScope === 'system' ? `system:${entityId}` : tenantId ?? null
-    const dek = await this.getDek(keyId)
-    if (!dek) {
-      debug('⚠️ decrypt.skip.no-dek', { entityId, tenantId, keyScope: map.keyScope ?? 'tenant' })
-      return payload
-    }
     debug('🔓 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })
     return this.decryptFields(payload, map.fields, dek)
   }

package/src/lib/i18n/config.ts

@@ -1,4 +1,4 @@
-export type Locale = 'en' | 'pl' | 'es' | 'de' | 'ko'
+export type Locale = 'en' | 'pl' | 'es' | 'de'
 
-export const locales: Locale[] = ['en', 'pl', 'es', 'de', 'ko']
+export const locales: Locale[] = ['en', 'pl', 'es', 'de']
 export const defaultLocale: Locale = 'en'

package/src/lib/i18n/server.ts

@@ -2,7 +2,7 @@ import { defaultLocale, locales, type Locale } from './config'
 import type { Dict } from './context'
 import { resolveForcedLocale, resolveLocaleFromAcceptLanguage } from './locale'
 import { createFallbackTranslator, createTranslator } from './translate'
-import { tryGetModules } from '../modules/registry'
+import { getModules } from '../modules/registry'
 import { loadAppDictionary } from './app-dictionaries'
 import { getCachedDictionary, setCachedDictionary } from './dictionary-cache'
 
@@ -61,11 +61,7 @@ export async function loadDictionary(locale: Locale): Promise<Dict> {
   // Load from registry instead of @/ import (works in standalone packages)
   const baseRaw = await loadAppDictionary(locale)
   const merged: Dict = { ...flattenDictionary(baseRaw) }
-  // Route handlers translate their responses, so they resolve a dictionary even
-  // when they are exercised in isolation without a bootstrapped registry. The
-  // app dictionary alone is the right degraded answer there — `registerModules`
-  // invalidates this cache, so a later bootstrap still gets the merged result.
-  const modules = tryGetModules() ?? []
+  const modules = getModules()
   for (const m of modules) {
     const dict = m.translations?.[locale]
     if (dict) Object.assign(merged, flattenDictionary(dict))

package/src/lib/logger/__tests__/logger.test.ts

@@ -3,9 +3,7 @@ import {
   createLogger,
   getLogLevel,
   isLevelEnabled,
-  registerLoggerExtension,
   resetLogLevelCache,
-  resetLoggerExtension,
   resetLoggerRegistry,
 } from '../index'
 import { resolveLevel, type LogLevel } from '../level'
@@ -67,7 +65,6 @@ function resetLoggerState(): void {
   resetLoggerRegistry()
   resetServerLoggerCache()
   resetLogPrettyCache()
-  resetLoggerExtension()
 }
 
 function forcePinoTransport(): void {
@@ -244,80 +241,6 @@ describe('structured logging facade', () => {
     })
   })
 
-  describe('process-wide logger extension', () => {
-    beforeEach(() => {
-      forcePinoTransport()
-    })
-
-    it('keeps one local line and observes one correlated record with child bindings', () => {
-      const fake = createFakePinoHarness()
-      mockPinoLoader(fake.factory)
-      const records: unknown[] = []
-      registerLoggerExtension({
-        enrich: () => ({ trace_id: 'trace-1', span_id: 'span-1' }),
-        emit: (record) => records.push(record),
-      })
-
-      createLogger('orders')
-        .child({ module: 'sales' })
-        .info('Order placed', { orderId: 'o-1' })
-
-      expect(fake.calls).toEqual([{
-        level: 'info',
-        args: [{
-          orderId: 'o-1',
-          trace_id: 'trace-1',
-          span_id: 'span-1',
-        }, 'Order placed'],
-      }])
-      expect(records).toHaveLength(1)
-      expect(records[0]).toMatchObject({
-        level: 'info',
-        namespace: 'orders',
-        message: 'Order placed',
-        fields: {
-          module: 'sales',
-          orderId: 'o-1',
-          trace_id: 'trace-1',
-          span_id: 'span-1',
-        },
-      })
-    })
-
-    it('applies the shared level gate to local and remote output', () => {
-      process.env.OM_LOG_LEVEL = 'warn'
-      resetLogLevelCache()
-      const fake = createFakePinoHarness()
-      mockPinoLoader(fake.factory)
-      const emit = jest.fn()
-      registerLoggerExtension({ emit })
-      const logger = createLogger('gated-extension')
-
-      logger.info('quiet')
-      logger.warn('visible')
-
-      expect(fake.calls.map((call) => call.level)).toEqual(['warn'])
-      expect(emit).toHaveBeenCalledTimes(1)
-      expect(emit.mock.calls[0][0]).toMatchObject({ level: 'warn', message: 'visible' })
-    })
-
-    it('isolates extension failures from application logging', () => {
-      const fake = createFakePinoHarness()
-      mockPinoLoader(fake.factory)
-      registerLoggerExtension({
-        enrich: () => {
-          throw new Error('context failed')
-        },
-        emit: () => {
-          throw new Error('sink failed')
-        },
-      })
-
-      expect(() => createLogger('resilient-extension').error('Still local')).not.toThrow()
-      expect(fake.calls).toEqual([{ level: 'error', args: [{}, 'Still local'] }])
-    })
-  })
-
   describe('isomorphism', () => {
     beforeEach(() => {
       forcePinoTransport()

package/src/lib/logger/index.ts

@@ -1,17 +1,9 @@
 import { selectTransport } from './transport'
-import { getLoggerExtension } from './extension'
-import { isLevelEnabled, type LogLevel } from './level'
 
 export type { LogLevel } from './level'
 export { getLogLevel, isLevelEnabled, resetLogLevelCache, OM_LOG_LEVEL_ENV } from './level'
 export { resetServerLoggerCache, OM_LOG_DESTINATION_ENV } from './transport.server'
 export { resetLogPrettyCache, OM_LOG_PRETTY_ENV } from './transport.pretty'
-export {
-  getLoggerExtension,
-  registerLoggerExtension,
-  resetLoggerExtension,
-} from './extension'
-export type { LoggerExtension, LoggerExtensionRecord } from './extension'
 
 export type LogBindings = Record<string, unknown>
 
@@ -26,61 +18,11 @@ export interface Logger {
 
 const loggerRegistry = new Map<string, Logger>()
 
-function createExtendedLogger(
-  namespace: string,
-  transport: Logger,
-  bindings: LogBindings = {},
-): Logger {
-  const emit = (
-    level: LogLevel,
-    msg: string,
-    fields?: LogBindings,
-  ): void => {
-    if (!isLevelEnabled(level)) return
-
-    const extension = getLoggerExtension()
-    let context: LogBindings = {}
-    try {
-      context = extension?.enrich?.() ?? {}
-    } catch {
-      // Observability must never alter application behavior.
-    }
-
-    const mergedFields = { ...fields, ...context }
-    transport[level](msg, mergedFields)
-
-    try {
-      extension?.emit?.({
-        level,
-        namespace,
-        message: msg,
-        fields: { ...bindings, ...mergedFields },
-        time: Date.now(),
-      })
-    } catch {
-      // Remote logging is best-effort; the local line has already been written.
-    }
-  }
-
-  return {
-    debug: (msg, fields) => emit('debug', msg, fields),
-    info: (msg, fields) => emit('info', msg, fields),
-    warn: (msg, fields) => emit('warn', msg, fields),
-    error: (msg, fields) => emit('error', msg, fields),
-    child: (childBindings) =>
-      createExtendedLogger(
-        namespace,
-        transport.child(childBindings),
-        { ...bindings, ...childBindings },
-      ),
-  }
-}
-
 /** Create (or reuse) a namespaced logger. `namespace` is attached as `name`. */
 export function createLogger(namespace: string): Logger {
   const existing = loggerRegistry.get(namespace)
   if (existing) return existing
-  const created = createExtendedLogger(namespace, selectTransport(namespace))
+  const created = selectTransport(namespace)
   loggerRegistry.set(namespace, created)
   return created
 }

package/src/lib/modules/registry.ts

@@ -69,13 +69,3 @@ export function getModules(): Module[] {
   }
   return modules
 }
-
-/**
- * Non-throwing counterpart of `getModules()` for call sites that have a
- * meaningful degraded behavior when bootstrap has not run — route unit tests
- * exercise a single handler without `registerModules()`, and a hard throw there
- * turns an unrelated assertion into a bootstrap error.
- */
-export function tryGetModules(): Module[] | null {
-  return getGlobalModules()
-}

package/src/lib/query/__tests__/engine.test.ts

@@ -1,13 +1,6 @@
 import { BasicQueryEngine } from '../engine'
 import { SortDir } from '../types'
 import { registerModules } from '../../i18n/server'
-import { clearSearchTokenPresenceCache } from '../../search/availability'
-
-// The token-presence answer is cached process-wide (TTL); without clearing it,
-// probe-count assertions would observe hits from earlier tests in this file.
-beforeEach(() => {
-  clearSearchTokenPresenceCache()
-})
 
 // Mock modules with one entity extension
 const mockModules = [
@@ -362,8 +355,6 @@ describe('BasicQueryEngine (Kysely)', () => {
     const fakeDb = createFakeKysely({
       customer_entities: [],
       customer_people: [],
-      search_tokens: [{ one: 1 }],
-      'information_schema.tables': [{ table_name: 'search_tokens' }],
       'information_schema.columns': [
         { table_name: 'customer_entities', column_name: 'tenant_id' },
         { table_name: 'customer_people', column_name: 'id' },
@@ -371,6 +362,8 @@ describe('BasicQueryEngine (Kysely)', () => {
       ],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
+    jest.spyOn(engine as any, 'tableExists').mockResolvedValue(true)
+    jest.spyOn(engine as any, 'hasSearchTokens').mockResolvedValue(true)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('customers:customer_entity', {
@@ -416,6 +409,7 @@ describe('BasicQueryEngine (Kysely)', () => {
       ],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
+    jest.spyOn(engine as any, 'tableExists').mockResolvedValue(false)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('customers:customer_entity', {
@@ -451,10 +445,10 @@ describe('BasicQueryEngine (Kysely)', () => {
   test('uses search tokens for index document fields on base entities', async () => {
     const fakeDb = createFakeKysely({
       todos: [],
-      search_tokens: [{ one: 1 }],
-      'information_schema.tables': [{ table_name: 'search_tokens' }],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
+    const tableExistsSpy = jest.spyOn(engine as any, 'tableExists').mockResolvedValue(true)
+    const hasSearchTokensSpy = jest.spyOn(engine as any, 'hasSearchTokens').mockResolvedValue(true)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('example:todo', {
@@ -467,15 +461,12 @@ describe('BasicQueryEngine (Kysely)', () => {
       page: { page: 1, pageSize: 10 },
     })
 
-    const calls = fakeDb._calls as Array<{ _ops: { table: string; wheres: unknown[][] } }>
-    const tableProbe = calls.find((call) =>
-      call._ops.table === 'information_schema.tables' &&
-      call._ops.wheres.some((where) => where[0] === 'table_name' && where[2] === 'search_tokens'))
-    expect(tableProbe).toBeTruthy()
-    const tokenProbe = calls.find((call) =>
-      call._ops.table === 'search_tokens' &&
-      call._ops.wheres.some((where) => where[0] === 'entity_type' && where[2] === 'example:todo'))
-    expect(tokenProbe).toBeTruthy()
+    expect(tableExistsSpy).toHaveBeenCalledWith('search_tokens')
+    expect(hasSearchTokensSpy).toHaveBeenCalledWith(
+      'example:todo',
+      't1',
+      expect.objectContaining({ ids: ['org1'] }),
+    )
     expect(applySearchTokensSpy).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({
@@ -497,6 +488,7 @@ describe('BasicQueryEngine (Kysely)', () => {
       ],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
+    const hasSearchTokensSpy = jest.spyOn(engine as any, 'hasSearchTokens').mockResolvedValue(true)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('example:todo', {
@@ -509,8 +501,7 @@ describe('BasicQueryEngine (Kysely)', () => {
       page: { page: 1, pageSize: 10 },
     })
 
-    const calls = fakeDb._calls as Array<{ _ops: { table: string } }>
-    expect(calls.some((call) => call._ops.table === 'search_tokens')).toBe(false)
+    expect(hasSearchTokensSpy).not.toHaveBeenCalled()
     expect(applySearchTokensSpy).not.toHaveBeenCalled()
     const baseCall = fakeDb._calls.find((builder: any) => builder._ops.table === 'todos')
     expect(baseCall?._ops.wheres).toContainEqual(['todos.search_text', 'ilike', '%avision%'])
@@ -942,47 +933,4 @@ describe('BasicQueryEngine (Kysely)', () => {
     expect(baseCall._ops.limits).toBe(10)
     expect(baseCall._ops.offsets).toBe(10)
   })
-
-  describe('search_tokens coverage probe (#4723 parity)', () => {
-    type ProbeDbLog = { _calls: Array<{ _ops: { table: string } }> }
-
-    const countProbes = (fakeDb: ProbeDbLog): number =>
-      fakeDb._calls.filter((call) => call._ops.table === 'search_tokens').length
-
-    const buildEngine = (fakeDb: unknown): BasicQueryEngine => new BasicQueryEngine(
-      {} as ConstructorParameters<typeof BasicQueryEngine>[0],
-      (() => fakeDb) as unknown as NonNullable<ConstructorParameters<typeof BasicQueryEngine>[1]>,
-    )
-
-    const buildDb = () => createFakeKysely({
-      users: [],
-      'information_schema.tables': [{ table_name: 'search_tokens' }],
-    })
-
-    test('is skipped when the query carries no like/ilike filter', async () => {
-      const fakeDb = buildDb()
-      const engine = buildEngine(fakeDb)
-
-      await engine.query('auth:user', {
-        tenantId: 't1',
-        organizationId: 'org1',
-        filters: { is_active: { $eq: true } },
-      })
-
-      expect(countProbes(fakeDb)).toBe(0)
-    })
-
-    test('still runs when the query actually searches', async () => {
-      const fakeDb = buildDb()
-      const engine = buildEngine(fakeDb)
-
-      await engine.query('auth:user', {
-        tenantId: 't1',
-        organizationId: 'org1',
-        filters: { email: { $ilike: '%abc%' } },
-      })
-
-      expect(countProbes(fakeDb)).toBeGreaterThan(0)
-    })
-  })
 })