@open-mercato/shared 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/src/lib/query/types.ts

@@ -151,27 +151,12 @@ export type EncryptedSortRowCapWarning = {
   entity: EntityId
   sortFields: string[]
   maxRows: number
-  /**
-   * Exact when `meta.listCountCapWarning` is absent; a floor when it is
-   * present (the list total itself was bounded at the cap).
-   */
   totalMatched: number
 }
 
-/**
- * Present when the list COUNT was bounded at `cap` matching rows
- * (`OM_LIST_COUNT_CAP`): `total` is a floor, not an exact value. Surfaced on
- * CRUD list payloads as `totalIsCapped: true`.
- */
-export type ListCountCapWarning = {
-  entity: EntityId
-  cap: number
-}
-
 export type QueryResultMeta = {
   partialIndexWarning?: PartialIndexWarning
   encryptedSortRowCapWarning?: EncryptedSortRowCapWarning
-  listCountCapWarning?: ListCountCapWarning
 }
 
 export type QueryResult<T = any> = {

package/src/lib/search/config.ts

@@ -8,15 +8,6 @@ export type SearchConfig = {
   enablePartials: boolean
   hashAlgorithm: 'sha256' | 'sha1' | 'md5'
   storeRawTokens: boolean
-  /**
-   * When true, a like/ilike on a PLAINTEXT base column runs as exact SQL ILIKE instead of being
-   * rewritten into an approximate search-token match; encrypted columns always keep the token
-   * path (ILIKE against ciphertext cannot match). Off by default: token matching can be faster
-   * than an unanchored ILIKE, which may need a full scan without a trigram index — but it is
-   * approximate (fragments under minTokenLength vanish, so `ZK 1/2026` degrades to its year and
-   * an all-short term drops the predicate). Flip it on when list search must be exact.
-   */
-  useIlikeForNonEncryptedFields?: boolean
   blocklistedFields: string[]
   entityBlocklistedFields?: Record<string, string[]>
   maxFieldChars?: number
@@ -121,7 +112,6 @@ export function resolveSearchConfig(): SearchConfig {
     enablePartials: parseBoolean(process.env.OM_SEARCH_ENABLE_PARTIAL, true),
     hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),
     storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),
-    useIlikeForNonEncryptedFields: parseBoolean(process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS, false),
     blocklistedFields: blocklist.global,
     entityBlocklistedFields: blocklist.byEntity,
     maxFieldChars: parseNumber(process.env.OM_SEARCH_MAX_FIELD_CHARS, DEFAULT_SEARCH_MAX_FIELD_CHARS, 0),

package/src/modules/events/factory.ts

@@ -65,54 +65,17 @@ export function getGlobalEventBus(): GlobalEventBus | null {
 // Event Registry for Validation
 // =============================================================================
 
-type EventRegistryState = {
-  declaredEventIds: Set<string>
-  declaredEvents: EventDefinition[]
-  registeredEventConfigs: EventModuleConfig[] | null
-}
-
-const GLOBAL_EVENT_REGISTRY_KEY = '__openMercatoEventDefinitionRegistry__'
-
-const fallbackEventRegistryState: EventRegistryState = {
-  declaredEventIds: new Set<string>(),
-  declaredEvents: [],
-  registeredEventConfigs: null,
-}
-
-function isEventRegistryState(value: unknown): value is EventRegistryState {
-  if (!value || typeof value !== 'object') return false
-  const candidate = value as Partial<EventRegistryState>
-  return candidate.declaredEventIds instanceof Set
-    && Array.isArray(candidate.declaredEvents)
-    && (candidate.registeredEventConfigs === null || Array.isArray(candidate.registeredEventConfigs))
-}
+// Global set of all declared event IDs for runtime validation
+const allDeclaredEventIds = new Set<string>()
 
-function getEventRegistryState(): EventRegistryState {
-  try {
-    const globalScope = globalThis as Record<string, unknown>
-    const existing = globalScope[GLOBAL_EVENT_REGISTRY_KEY]
-    if (isEventRegistryState(existing)) return existing
-    globalScope[GLOBAL_EVENT_REGISTRY_KEY] = fallbackEventRegistryState
-    return fallbackEventRegistryState
-  } catch {
-    // Restricted runtimes may deny global access. Keep the previous
-    // module-local behavior as a safe fallback.
-    return fallbackEventRegistryState
-  }
-}
+// Global registry of all declared events with their full definitions
+const allDeclaredEvents: EventDefinition[] = []
 
 function addDeclaredEvent(event: EventDefinition): void {
-  const state = getEventRegistryState()
-  state.declaredEventIds.add(event.id)
-  const existingIndex = state.declaredEvents.findIndex((candidate) => candidate.id === event.id)
-  if (existingIndex < 0) {
-    state.declaredEvents.push(event)
-    return
-  }
-  // Refresh a module's own definition in place during HMR without allowing a
-  // duplicate declaration from another module to take over the event id.
-  if (state.declaredEvents[existingIndex]?.module === event.module) {
-    state.declaredEvents[existingIndex] = event
+  allDeclaredEventIds.add(event.id)
+  // Avoid duplicates if createModuleEvents/registerEventModuleConfigs is called multiple times (e.g., HMR)
+  if (!allDeclaredEvents.find(e => e.id === event.id)) {
+    allDeclaredEvents.push(event)
   }
 }
 
@@ -121,7 +84,7 @@ function addDeclaredEvent(event: EventDefinition): void {
  * Used for runtime validation to ensure only declared events are emitted.
  */
 export function isEventDeclared(eventId: string): boolean {
-  return getEventRegistryState().declaredEventIds.has(eventId)
+  return allDeclaredEventIds.has(eventId)
 }
 
 /**
@@ -129,7 +92,7 @@ export function isEventDeclared(eventId: string): boolean {
  * Useful for debugging and introspection.
  */
 export function getAllDeclaredEventIds(): string[] {
-  return Array.from(getEventRegistryState().declaredEventIds)
+  return Array.from(allDeclaredEventIds)
 }
 
 /**
@@ -137,7 +100,7 @@ export function getAllDeclaredEventIds(): string[] {
  * Used by the API to return available events for workflow triggers.
  */
 export function getDeclaredEvents(): EventDefinition[] {
-  return [...getEventRegistryState().declaredEvents]
+  return [...allDeclaredEvents]
 }
 
 /**
@@ -145,52 +108,16 @@ export function getDeclaredEvents(): EventDefinition[] {
  * Used by the SSE endpoint to filter events for the DOM Event Bridge.
  */
 export function isBroadcastEvent(eventId: string): boolean {
-  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
+  const event = allDeclaredEvents.find(e => e.id === eventId)
   return event?.clientBroadcast === true
 }
 
-/**
- * Check if an event should be published over the server-to-server event bridge.
- * Browser-broadcast events remain eligible for backward compatibility, while
- * crossProcessBroadcast supports private process coordination without SSE.
- */
-export function isCrossProcessBroadcastEvent(eventId: string): boolean {
-  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
-  return event?.clientBroadcast === true || event?.crossProcessBroadcast === true
-}
-
-/**
- * Check whether an event is reserved for private server-to-server
- * coordination. Workflow-authored EMIT_EVENT activities must not emit these
- * events because their payload and event id are tenant-managed input.
- */
-export function isPrivateCrossProcessBroadcastEvent(eventId: string): boolean {
-  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
-  return event?.crossProcessBroadcast === true && event?.clientBroadcast !== true
-}
-
-/**
- * Verify provenance for a private cross-process event. The module id is
- * stamped by a declared module emitter or another trusted server-side seam;
- * tenant-managed event payloads never participate in this decision.
- */
-export function isPrivateCrossProcessEventEmitter(
-  eventId: string,
-  emitterModuleId: string | undefined,
-): boolean {
-  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
-  if (event?.crossProcessBroadcast !== true) return true
-  return typeof event.module === 'string'
-    && event.module.length > 0
-    && event.module === emitterModuleId
-}
-
 /**
  * Check if an event has portalBroadcast enabled.
  * Used by the portal SSE endpoint to filter events for the Portal Event Bridge.
  */
 export function isPortalBroadcastEvent(eventId: string): boolean {
-  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
+  const event = allDeclaredEvents.find(e => e.id === eventId)
   return event?.portalBroadcast === true
 }
 
@@ -198,16 +125,17 @@ export function isPortalBroadcastEvent(eventId: string): boolean {
 // Bootstrap Registration (similar to searchModuleConfigs pattern)
 // =============================================================================
 
+let _registeredEventConfigs: EventModuleConfig[] | null = null
+
 /**
  * Register event module configurations globally.
  * Called during app bootstrap with configs from events.generated.ts.
  */
 export function registerEventModuleConfigs(configs: EventModuleConfig[]): void {
-  const state = getEventRegistryState()
-  if (state.registeredEventConfigs !== null && process.env.NODE_ENV === 'development') {
+  if (_registeredEventConfigs !== null && process.env.NODE_ENV === 'development') {
     logger.debug('Event module configs re-registered (this may occur during HMR)')
   }
-  state.registeredEventConfigs = configs
+  _registeredEventConfigs = configs
   for (const config of configs) {
     for (const event of config.events) {
       addDeclaredEvent(event)
@@ -220,7 +148,7 @@ export function registerEventModuleConfigs(configs: EventModuleConfig[]): void {
  * Returns empty array if not registered.
  */
 export function getEventModuleConfigs(): EventModuleConfig[] {
-  return getEventRegistryState().registeredEventConfigs ?? []
+  return _registeredEventConfigs ?? []
 }
 
 // =============================================================================
@@ -311,27 +239,7 @@ export function createModuleEvents<
       return
     }
 
-    const eventDefinition = fullEvents.find((event) => event.id === eventId)
-    const isClientBroadcast = eventDefinition?.clientBroadcast === true
-    const trustedOptions = eventDefinition?.crossProcessBroadcast === true || isClientBroadcast
-      ? {
-          ...emitOptions,
-          // Browser-broadcast module emitters historically accepted scope in
-          // their typed payload. Preserve that contract at the trusted module
-          // boundary while the event bus itself relies only on options.
-          ...(isClientBroadcast && emitOptions?.tenantId === undefined
-            ? { tenantId: payload.tenantId ?? null }
-            : {}),
-          ...(isClientBroadcast && emitOptions?.organizationId === undefined
-            ? { organizationId: payload.organizationId ?? null }
-            : {}),
-          ...(isClientBroadcast && emitOptions?.organizationIds === undefined && Array.isArray(payload.organizationIds)
-            ? { organizationIds: payload.organizationIds.filter((value): value is string => typeof value === 'string') }
-            : {}),
-          emitterModuleId: moduleId,
-        }
-      : emitOptions
-    await eventBus.emit(eventId, payload, trustedOptions)
+    await eventBus.emit(eventId, payload, emitOptions)
   }
 
   return {

package/src/modules/events/types.ts

@@ -34,8 +34,6 @@ export interface EventDefinition {
   excludeFromTriggers?: boolean
   /** When true, this event is bridged to the browser via SSE (DOM Event Bridge). Default: false */
   clientBroadcast?: boolean
-  /** When true, this event is bridged between server processes without enabling browser delivery. Default: false */
-  crossProcessBroadcast?: boolean
   /** When true, this event is bridged to the customer portal via SSE (Portal Event Bridge). Default: false */
   portalBroadcast?: boolean
 }
@@ -68,21 +66,6 @@ export interface EmitOptions {
   tenantId?: string | null
   /** Trusted organization scope forwarded to subscribers separately from the payload */
   organizationId?: string | null
-  /**
-   * Trusted multi-organization audience forwarded to subscribers separately
-   * from the payload. Mirrors the documented SSE audience contract, where a
-   * clientBroadcast event may target several organizations at once; carried in
-   * trusted options so the receiver never falls back to payload scope.
-   */
-  organizationIds?: string[] | null
-  /**
-   * Module that emitted a private cross-process coordination event.
-   *
-   * This is stamped by `createModuleEvents`; application inputs must not set or
-   * derive it from event payloads.
-   * @internal
-   */
-  emitterModuleId?: string
 }
 
 // =============================================================================

package/src/modules/registry.ts

@@ -196,19 +196,7 @@ export type ModuleWorker = {
   concurrency: number
   lockDuration?: number
   maxStalledCount?: number
-  /**
-   * Reports a job the queue abandoned without running the handler.
-   *
-   * Present only for workers whose metadata declares it; the generator emits it as a lazy import
-   * beside the handler, because the registry serializes metadata as literals and a function cannot
-   * survive that.
-   */
-  onJobAbandoned?: (payload: unknown, info: { jobId: string | null; reason: string }) => void | Promise<void>
   handler: ModuleWorkerHandler
-  /** Opt-in flag exposing this queue as a user-facing scheduler target (issue #5213). */
-  schedulerSafe?: boolean
-  /** Creator features required beyond scheduler.jobs.manage when schedulerSafe is set. */
-  schedulerRequiredFeatures?: string[]
 }
 
 export type ModuleInfo = {
@@ -566,31 +554,3 @@ export function createLazyModuleWorker(
     return handler(job, ctx)
   }
 }
-
-/**
- * Resolves a worker's `metadata.onJobAbandoned` on first use.
- *
- * The generator serializes worker metadata as literals, so a function declared there cannot be
- * emitted inline the way `concurrency` or `lockDuration` are. It is emitted as this thunk instead —
- * the same lazy-import treatment the handler already gets — and only for workers whose metadata
- * declares the callback, so no other queue acquires one (and with it, a sweep) by accident.
- */
-export function createLazyModuleWorkerAbandonHook(
-  loadModule: () => Promise<unknown>,
-  id: string
-): (payload: unknown, info: { jobId: string | null; reason: string }) => Promise<void> {
-  let hookPromise: Promise<((payload: unknown, info: { jobId: string | null; reason: string }) => unknown) | null> | null = null
-  return async (payload, info) => {
-    hookPromise ??= loadModule().then((loaded) => {
-      const metadata = (loaded as { metadata?: { onJobAbandoned?: unknown } } | null)?.metadata
-      return typeof metadata?.onJobAbandoned === 'function'
-        ? (metadata.onJobAbandoned as (payload: unknown, info: { jobId: string | null; reason: string }) => unknown)
-        : null
-    })
-    const hook = await hookPromise
-    if (!hook) {
-      throw new Error(`[registry] Worker "${id}" was registered with an abandoned-job hook but its metadata no longer declares one`)
-    }
-    await hook(payload, info)
-  }
-}

package/src/modules/widgets/component-registry.ts

@@ -26,20 +26,6 @@ export type ComponentOverride<TProps = unknown> = {
       propsSchema: ZodType<TProps>
     }
   | {
-      /**
-       * Higher-order component composed around the resolved component.
-       *
-       * The platform invokes it **at most once per `(wrapper, wrapped component)` pair**
-       * and caches the composed component for the lifetime of the registry, so that a
-       * wrapped subtree keeps a stable React identity instead of remounting on every
-       * override resolution.
-       *
-       * A wrapper MUST therefore be a pure function of `Original`: it may only read
-       * dynamic values — feature flags, locale, tenant configuration, the clock, request
-       * state — inside the render body of the component it returns, never at composition
-       * time. On the server the registry outlives a single request, so a value captured
-       * at composition time would be frozen across requests and tenants.
-       */
       wrapper: (Original: ComponentType<TProps>) => ComponentType<TProps>
     }
   | {

package/dist/lib/auth/mfaPendingAccess.js

@@ -1,42 +0,0 @@
-const registeredMethodsByPath = /* @__PURE__ */ new Map();
-function normalizePath(path) {
-  if (typeof path !== "string") return null;
-  const trimmed = path.trim();
-  if (!trimmed || !trimmed.startsWith("/")) return null;
-  return (trimmed.length > 1 ? trimmed.replace(/\/+$/, "") : trimmed).toLowerCase() || "/";
-}
-function normalizeMethods(methods) {
-  if (!Array.isArray(methods)) return [];
-  const normalized = methods.filter((method) => typeof method === "string" && method.trim().length > 0).map((method) => method.trim().toUpperCase());
-  return Array.from(new Set(normalized)).sort((first, second) => first < second ? -1 : first > second ? 1 : 0);
-}
-function registerMfaPendingAccessRoutes(routes) {
-  for (const route of Array.isArray(routes) ? routes : []) {
-    const path = normalizePath(route?.path ?? "");
-    const methods = normalizeMethods(route?.methods);
-    if (!path || !methods.length) continue;
-    const existing = registeredMethodsByPath.get(path);
-    if (!existing) {
-      registeredMethodsByPath.set(path, new Set(methods));
-      continue;
-    }
-    for (const method of methods) existing.add(method);
-  }
-}
-function isMfaPendingAccessAllowed(method, pathname) {
-  const path = normalizePath(typeof pathname === "string" ? pathname : "");
-  if (!path) return false;
-  if (typeof method !== "string" || method.trim().length === 0) return false;
-  const methods = registeredMethodsByPath.get(path);
-  if (!methods) return false;
-  return methods.has(method.trim().toUpperCase());
-}
-function listMfaPendingAccessRoutes() {
-  return Array.from(registeredMethodsByPath.entries()).map(([path, methods]) => ({ path, methods: Array.from(methods).sort((first, second) => first < second ? -1 : first > second ? 1 : 0) })).sort((first, second) => first.path < second.path ? -1 : first.path > second.path ? 1 : 0);
-}
-export {
-  isMfaPendingAccessAllowed,
-  listMfaPendingAccessRoutes,
-  registerMfaPendingAccessRoutes
-};
-//# sourceMappingURL=mfaPendingAccess.js.map

package/dist/lib/auth/mfaPendingAccess.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/auth/mfaPendingAccess.ts"],
-  "sourcesContent": ["export type MfaPendingAccessRoute = {\n  path: string\n  methods: string[]\n}\n\nconst registeredMethodsByPath = new Map<string, Set<string>>()\n\nfunction normalizePath(path: string): string | null {\n  if (typeof path !== 'string') return null\n  const trimmed = path.trim()\n  if (!trimmed || !trimmed.startsWith('/')) return null\n  return (trimmed.length > 1 ? trimmed.replace(/\\/+$/, '') : trimmed).toLowerCase() || '/'\n}\n\nfunction normalizeMethods(methods: unknown): string[] {\n  if (!Array.isArray(methods)) return []\n  const normalized = methods\n    .filter((method): method is string => typeof method === 'string' && method.trim().length > 0)\n    .map((method) => method.trim().toUpperCase())\n  return Array.from(new Set(normalized)).sort((first, second) => (first < second ? -1 : first > second ? 1 : 0))\n}\n\n/**\n * Register routes that may accept an MFA-pending staff token. The registry starts empty and\n * stays generic: every module that completes an MFA challenge on its own endpoints registers\n * them here during its bootstrap \u2014 the canonical `/api/security/mfa/*` completion routes are\n * registered by the enterprise `security` module (`lib/mfaCompletionRoutes.ts`), third-party\n * MFA implementations register theirs the same way. Registration is additive: methods merge\n * into any existing entry for the same path and are never removed.\n *\n * Contract defined in `.ai/specs/enterprise/implemented/SPEC-ENT-007-2026-03-06-auth-login-interceptors-extension.md`\n * (\u00A7 Amendment 2026-08-21 \u2014 central MFA-pending token gate).\n */\nexport function registerMfaPendingAccessRoutes(routes: MfaPendingAccessRoute[]): void {\n  for (const route of Array.isArray(routes) ? routes : []) {\n    const path = normalizePath(route?.path ?? '')\n    const methods = normalizeMethods(route?.methods)\n    if (!path || !methods.length) continue\n    const existing = registeredMethodsByPath.get(path)\n    if (!existing) {\n      registeredMethodsByPath.set(path, new Set(methods))\n      continue\n    }\n    for (const method of methods) existing.add(method)\n  }\n}\n\n/**\n * Fail-closed check deciding whether an MFA-pending staff token may be resolved for this exact\n * method + path pair. Only explicitly registered completion routes pass; every unregistered\n * request is denied.\n */\nexport function isMfaPendingAccessAllowed(\n  method: string | null | undefined,\n  pathname: string | null | undefined,\n): boolean {\n  const path = normalizePath(typeof pathname === 'string' ? pathname : '')\n  if (!path) return false\n  if (typeof method !== 'string' || method.trim().length === 0) return false\n  const methods = registeredMethodsByPath.get(path)\n  if (!methods) return false\n  return methods.has(method.trim().toUpperCase())\n}\n\n/** Test/ops helper: current snapshot of the pending-access registry. */\nexport function listMfaPendingAccessRoutes(): ReadonlyArray<Readonly<MfaPendingAccessRoute>> {\n  return Array.from(registeredMethodsByPath.entries())\n    .map(([path, methods]) => ({ path, methods: Array.from(methods).sort((first, second) => (first < second ? -1 : first > second ? 1 : 0)) }))\n    .sort((first, second) => (first.path < second.path ? -1 : first.path > second.path ? 1 : 0))\n}\n"],
-  "mappings": "AAKA,MAAM,0BAA0B,oBAAI,IAAyB;AAE7D,SAAS,cAAc,MAA6B;AAClD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,WAAW,CAAC,QAAQ,WAAW,GAAG,EAAG,QAAO;AACjD,UAAQ,QAAQ,SAAS,IAAI,QAAQ,QAAQ,QAAQ,EAAE,IAAI,SAAS,YAAY,KAAK;AACvF;AAEA,SAAS,iBAAiB,SAA4B;AACpD,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO,CAAC;AACrC,QAAM,aAAa,QAChB,OAAO,CAAC,WAA6B,OAAO,WAAW,YAAY,OAAO,KAAK,EAAE,SAAS,CAAC,EAC3F,IAAI,CAAC,WAAW,OAAO,KAAK,EAAE,YAAY,CAAC;AAC9C,SAAO,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,WAAY,QAAQ,SAAS,KAAK,QAAQ,SAAS,IAAI,CAAE;AAC/G;AAaO,SAAS,+BAA+B,QAAuC;AACpF,aAAW,SAAS,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,GAAG;AACvD,UAAM,OAAO,cAAc,OAAO,QAAQ,EAAE;AAC5C,UAAM,UAAU,iBAAiB,OAAO,OAAO;AAC/C,QAAI,CAAC,QAAQ,CAAC,QAAQ,OAAQ;AAC9B,UAAM,WAAW,wBAAwB,IAAI,IAAI;AACjD,QAAI,CAAC,UAAU;AACb,8BAAwB,IAAI,MAAM,IAAI,IAAI,OAAO,CAAC;AAClD;AAAA,IACF;AACA,eAAW,UAAU,QAAS,UAAS,IAAI,MAAM;AAAA,EACnD;AACF;AAOO,SAAS,0BACd,QACA,UACS;AACT,QAAM,OAAO,cAAc,OAAO,aAAa,WAAW,WAAW,EAAE;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAE,WAAW,EAAG,QAAO;AACrE,QAAM,UAAU,wBAAwB,IAAI,IAAI;AAChD,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,IAAI,OAAO,KAAK,EAAE,YAAY,CAAC;AAChD;AAGO,SAAS,6BAA6E;AAC3F,SAAO,MAAM,KAAK,wBAAwB,QAAQ,CAAC,EAChD,IAAI,CAAC,CAAC,MAAM,OAAO,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK,OAAO,EAAE,KAAK,CAAC,OAAO,WAAY,QAAQ,SAAS,KAAK,QAAQ,SAAS,IAAI,CAAE,EAAE,EAAE,EACzI,KAAK,CAAC,OAAO,WAAY,MAAM,OAAO,OAAO,OAAO,KAAK,MAAM,OAAO,OAAO,OAAO,IAAI,CAAE;AAC/F;",
-  "names": []
-}

package/dist/lib/auth/principal-service.js

@@ -1 +0,0 @@
-//# sourceMappingURL=principal-service.js.map

package/dist/lib/auth/principal-service.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": [],
-  "sourcesContent": [],
-  "mappings": "",
-  "names": []
-}

package/dist/lib/html/htmlToPlainText.js

@@ -1,16 +0,0 @@
-import { convert } from "html-to-text";
-function htmlToPlainText(html) {
-  if (!html) return "";
-  return convert(html, {
-    wordwrap: false,
-    preserveNewlines: true,
-    selectors: [
-      { selector: "script", format: "skip" },
-      { selector: "style", format: "skip" }
-    ]
-  }).replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
-}
-export {
-  htmlToPlainText
-};
-//# sourceMappingURL=htmlToPlainText.js.map

package/dist/lib/html/htmlToPlainText.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/html/htmlToPlainText.ts"],
-  "sourcesContent": ["import { convert } from 'html-to-text'\n\nexport function htmlToPlainText(html: string): string {\n  if (!html) return ''\n  return convert(html, {\n    wordwrap: false,\n    preserveNewlines: true,\n    selectors: [\n      { selector: 'script', format: 'skip' },\n      { selector: 'style', format: 'skip' },\n    ],\n  })\n    .replace(/\\r\\n/g, '\\n')\n    .replace(/\\r/g, '\\n')\n    .replace(/\\n{3,}/g, '\\n\\n')\n    .trim()\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAEjB,SAAS,gBAAgB,MAAsB;AACpD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,QAAQ,MAAM;AAAA,IACnB,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,WAAW;AAAA,MACT,EAAE,UAAU,UAAU,QAAQ,OAAO;AAAA,MACrC,EAAE,UAAU,SAAS,QAAQ,OAAO;AAAA,IACtC;AAAA,EACF,CAAC,EACE,QAAQ,SAAS,IAAI,EACrB,QAAQ,OAAO,IAAI,EACnB,QAAQ,WAAW,MAAM,EACzB,KAAK;AACV;",
-  "names": []
-}

package/dist/lib/query/count-cap.js

@@ -1,11 +0,0 @@
-import { parseNumberWithDefault } from "../number.js";
-const DEFAULT_LIST_COUNT_CAP = 1e4;
-function resolveListCountCap() {
-  const parsed = parseNumberWithDefault(process.env.OM_LIST_COUNT_CAP, DEFAULT_LIST_COUNT_CAP, { integer: true });
-  return parsed <= 0 ? null : parsed;
-}
-export {
-  DEFAULT_LIST_COUNT_CAP,
-  resolveListCountCap
-};
-//# sourceMappingURL=count-cap.js.map

package/dist/lib/query/count-cap.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/query/count-cap.ts"],
-  "sourcesContent": ["import { parseNumberWithDefault } from '../number'\n\nexport const DEFAULT_LIST_COUNT_CAP = 10_000\n\n/**\n * Cap on how many matching rows a list COUNT may visit before reporting\n * `total: cap` with `meta.listCountCapWarning` (surfaced to clients as\n * `totalIsCapped`). Returns the cap as a number, or `null` when capping is\n * disabled.\n *\n * Resolution of `OM_LIST_COUNT_CAP`:\n * - unset / blank / unparseable \u2192 `DEFAULT_LIST_COUNT_CAP` (the cap is on by\n *   default, and bad input must not silently disable it)\n * - `0` (or negative) \u2192 `null` \u2014 capping disabled, exact counts everywhere\n */\nexport function resolveListCountCap(): number | null {\n  const parsed = parseNumberWithDefault(process.env.OM_LIST_COUNT_CAP, DEFAULT_LIST_COUNT_CAP, { integer: true })\n  return parsed <= 0 ? null : parsed\n}\n"],
-  "mappings": "AAAA,SAAS,8BAA8B;AAEhC,MAAM,yBAAyB;AAa/B,SAAS,sBAAqC;AACnD,QAAM,SAAS,uBAAuB,QAAQ,IAAI,mBAAmB,wBAAwB,EAAE,SAAS,KAAK,CAAC;AAC9G,SAAO,UAAU,IAAI,OAAO;AAC9B;",
-  "names": []
-}

package/dist/lib/queue/dispatchOrigin.js

@@ -1,20 +0,0 @@
-const QUEUE_JOB_ORIGIN_KEY = "_jobOrigin";
-function markQueueJobOrigin(payload, origin) {
-  return { ...payload, [QUEUE_JOB_ORIGIN_KEY]: origin };
-}
-function readQueueJobOrigin(payload) {
-  if (!payload || typeof payload !== "object") return null;
-  const value = payload[QUEUE_JOB_ORIGIN_KEY];
-  if (value === "inbound-webhook" || value === "scheduler") return value;
-  return null;
-}
-function isTrustedWebhookDispatch(payload) {
-  return readQueueJobOrigin(payload) === "inbound-webhook";
-}
-export {
-  QUEUE_JOB_ORIGIN_KEY,
-  isTrustedWebhookDispatch,
-  markQueueJobOrigin,
-  readQueueJobOrigin
-};
-//# sourceMappingURL=dispatchOrigin.js.map

package/dist/lib/queue/dispatchOrigin.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/queue/dispatchOrigin.ts"],
-  "sourcesContent": ["/**\n * Trusted dispatch-origin markers for queue jobs.\n *\n * Jobs that drive privileged side effects (payment webhook processors and\n * similar sinks) MUST only execute payloads enqueued by trusted infrastructure\n * code paths. The scheduler dispatch layer and inbound webhook routes mark the\n * payloads they enqueue; sensitive workers verify the marker before doing work.\n *\n * The scheduler payload sanitizer strips every caller-supplied `_`-prefixed\n * key from scheduled target payloads, so a marker cannot be forged through the\n * scheduler job API. Direct queue/Redis write access is operator-level access\n * and outside this threat model.\n */\n\nexport const QUEUE_JOB_ORIGIN_KEY = '_jobOrigin'\n\nexport type QueueJobOrigin = 'inbound-webhook' | 'scheduler'\n\nexport function markQueueJobOrigin<T extends Record<string, unknown>>(\n  payload: T,\n  origin: QueueJobOrigin,\n): T {\n  return { ...payload, [QUEUE_JOB_ORIGIN_KEY]: origin }\n}\n\nexport function readQueueJobOrigin(payload: unknown): QueueJobOrigin | null {\n  if (!payload || typeof payload !== 'object') return null\n  const value = (payload as Record<string, unknown>)[QUEUE_JOB_ORIGIN_KEY]\n  if (value === 'inbound-webhook' || value === 'scheduler') return value\n  return null\n}\n\nexport function isTrustedWebhookDispatch(payload: unknown): boolean {\n  return readQueueJobOrigin(payload) === 'inbound-webhook'\n}\n"],
-  "mappings": "AAcO,MAAM,uBAAuB;AAI7B,SAAS,mBACd,SACA,QACG;AACH,SAAO,EAAE,GAAG,SAAS,CAAC,oBAAoB,GAAG,OAAO;AACtD;AAEO,SAAS,mBAAmB,SAAyC;AAC1E,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,QAAS,QAAoC,oBAAoB;AACvE,MAAI,UAAU,qBAAqB,UAAU,YAAa,QAAO;AACjE,SAAO;AACT;AAEO,SAAS,yBAAyB,SAA2B;AAClE,SAAO,mBAAmB,OAAO,MAAM;AACzC;",
-  "names": []
-}

package/dist/lib/search/entityAccess.js

@@ -1,44 +0,0 @@
-import { authorizeFeatures } from "../../security/featurePolicy.js";
-function canReadSearchEntity(entityId, lookup, subject, options = {}) {
-  if (subject.isSuperAdmin) return true;
-  const config = lookup.getEntityConfig(entityId);
-  if (!config) {
-    options.onDeny?.(entityId, "unconfigured");
-    return false;
-  }
-  const required = config.aclFeatures;
-  if (!required || required.length === 0) {
-    options.onDeny?.(entityId, "no-acl-features");
-    return false;
-  }
-  const allowed = authorizeFeatures(required, {
-    grantedFeatures: subject.grantedFeatures,
-    unrestricted: false
-  });
-  if (!allowed) options.onDeny?.(entityId, "insufficient-features");
-  return allowed;
-}
-function resolveReadableEntityTypes(lookup, subject, requestedEntityTypes) {
-  if (subject.isSuperAdmin) return requestedEntityTypes;
-  const readable = lookup.getAllEntityConfigs().filter((config) => config.enabled !== false).map((config) => config.entityId).filter((entityId) => canReadSearchEntity(entityId, lookup, subject));
-  if (!requestedEntityTypes) return readable;
-  const requested = new Set(requestedEntityTypes);
-  return readable.filter((entityId) => requested.has(entityId));
-}
-function filterSearchResultsByEntityAccess(results, lookup, subject, options = {}) {
-  if (subject.isSuperAdmin) return [...results];
-  const decisions = /* @__PURE__ */ new Map();
-  return results.filter((result) => {
-    const cached = decisions.get(result.entityId);
-    if (cached !== void 0) return cached;
-    const allowed = canReadSearchEntity(result.entityId, lookup, subject, options);
-    decisions.set(result.entityId, allowed);
-    return allowed;
-  });
-}
-export {
-  canReadSearchEntity,
-  filterSearchResultsByEntityAccess,
-  resolveReadableEntityTypes
-};
-//# sourceMappingURL=entityAccess.js.map

package/dist/lib/search/entityAccess.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/search/entityAccess.ts"],
-  "sourcesContent": ["import type { SearchEntityConfig } from '../../modules/search'\nimport { authorizeFeatures } from '../../security/featurePolicy'\n\n/**\n * Minimal shape of the `searchIndexer` DI service consumed by per-entity ACL\n * resolution. Kept structural so callers and tests can pass a plain object\n * instead of constructing a full `SearchIndexer`.\n */\nexport type SearchEntityConfigLookup = {\n  getEntityConfig: (entityId: string) => SearchEntityConfig | undefined\n  getAllEntityConfigs: () => SearchEntityConfig[]\n}\n\nexport type SearchEntityAccessSubject = {\n  grantedFeatures: readonly string[]\n  isSuperAdmin?: boolean\n}\n\nexport type SearchEntityDenyReason =\n  /** No module declares this entity in a `search.ts` config. */\n  | 'unconfigured'\n  /** The entity is configured for search but declares no `aclFeatures`. */\n  | 'no-acl-features'\n  /** The caller does not hold the entity's declared view feature(s). */\n  | 'insufficient-features'\n\nexport type SearchEntityAccessOptions = {\n  /**\n   * Called once per denied entity type. Exists so a silent drop is diagnosable:\n   * results disappearing because a module forgot to declare `aclFeatures` looks\n   * identical, from the palette, to results that simply did not match.\n   */\n  onDeny?: (entityId: string, reason: SearchEntityDenyReason) => void\n}\n\n/**\n * Decide whether a caller may see results for one entity type.\n *\n * The single `search.global` gate on the palette only says \"this user may use\n * global search\"; it says nothing about which records they may read. Each entity\n * declares the owning module's view feature(s) in `aclFeatures`, and those are\n * what actually authorize the read \u2014 the same rule the `search_get` /\n * `search_aggregate` AI tools already apply.\n *\n * Fails closed: an entity that is not registered for search, or that declares no\n * `aclFeatures`, is never exposed to a non-superadmin caller.\n */\nexport function canReadSearchEntity(\n  entityId: string,\n  lookup: SearchEntityConfigLookup,\n  subject: SearchEntityAccessSubject,\n  options: SearchEntityAccessOptions = {},\n): boolean {\n  if (subject.isSuperAdmin) return true\n\n  const config = lookup.getEntityConfig(entityId)\n  if (!config) {\n    options.onDeny?.(entityId, 'unconfigured')\n    return false\n  }\n\n  const required = config.aclFeatures\n  if (!required || required.length === 0) {\n    options.onDeny?.(entityId, 'no-acl-features')\n    return false\n  }\n\n  const allowed = authorizeFeatures(required, {\n    grantedFeatures: subject.grantedFeatures,\n    unrestricted: false,\n  })\n  if (!allowed) options.onDeny?.(entityId, 'insufficient-features')\n  return allowed\n}\n\n/**\n * The entity types this caller may read, narrowed to `requestedEntityTypes` when\n * the caller asked for specific ones.\n *\n * Restricting the query up front is what keeps `limit` meaningful. Filtering only\n * after the search would spend the whole result budget on records the caller\n * cannot see: an employee granted just `customers.people.view` would get the top\n * 50 hits across every entity type, then watch most of them be dropped, and the\n * palette would look empty even with hundreds of matching people behind it.\n *\n * Returns `undefined` when no restriction applies (superadmin with no explicit\n * request), and an empty array when nothing is readable \u2014 callers should\n * short-circuit on that rather than pass it down as \"no filter\".\n */\nexport function resolveReadableEntityTypes(\n  lookup: SearchEntityConfigLookup,\n  subject: SearchEntityAccessSubject,\n  requestedEntityTypes?: string[],\n): string[] | undefined {\n  if (subject.isSuperAdmin) return requestedEntityTypes\n\n  const readable = lookup\n    .getAllEntityConfigs()\n    .filter((config) => config.enabled !== false)\n    .map((config) => config.entityId)\n    .filter((entityId) => canReadSearchEntity(entityId, lookup, subject))\n\n  if (!requestedEntityTypes) return readable\n  const requested = new Set(requestedEntityTypes)\n  return readable.filter((entityId) => requested.has(entityId))\n}\n\n/**\n * Drop the results whose entity type the caller is not allowed to read.\n *\n * Filtering happens server-side so an under-privileged caller never receives the\n * presenter title, subtitle or deep link of a record they cannot open. Decisions\n * are memoized per entity type because a single response commonly mixes dozens of\n * results across a handful of types.\n */\nexport function filterSearchResultsByEntityAccess<T extends { entityId: string }>(\n  results: readonly T[],\n  lookup: SearchEntityConfigLookup,\n  subject: SearchEntityAccessSubject,\n  options: SearchEntityAccessOptions = {},\n): T[] {\n  if (subject.isSuperAdmin) return [...results]\n\n  const decisions = new Map<string, boolean>()\n  return results.filter((result) => {\n    const cached = decisions.get(result.entityId)\n    if (cached !== undefined) return cached\n    const allowed = canReadSearchEntity(result.entityId, lookup, subject, options)\n    decisions.set(result.entityId, allowed)\n    return allowed\n  })\n}\n"],
-  "mappings": "AACA,SAAS,yBAAyB;AA8C3B,SAAS,oBACd,UACA,QACA,SACA,UAAqC,CAAC,GAC7B;AACT,MAAI,QAAQ,aAAc,QAAO;AAEjC,QAAM,SAAS,OAAO,gBAAgB,QAAQ;AAC9C,MAAI,CAAC,QAAQ;AACX,YAAQ,SAAS,UAAU,cAAc;AACzC,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,OAAO;AACxB,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,YAAQ,SAAS,UAAU,iBAAiB;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,kBAAkB,UAAU;AAAA,IAC1C,iBAAiB,QAAQ;AAAA,IACzB,cAAc;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,QAAS,SAAQ,SAAS,UAAU,uBAAuB;AAChE,SAAO;AACT;AAgBO,SAAS,2BACd,QACA,SACA,sBACsB;AACtB,MAAI,QAAQ,aAAc,QAAO;AAEjC,QAAM,WAAW,OACd,oBAAoB,EACpB,OAAO,CAAC,WAAW,OAAO,YAAY,KAAK,EAC3C,IAAI,CAAC,WAAW,OAAO,QAAQ,EAC/B,OAAO,CAAC,aAAa,oBAAoB,UAAU,QAAQ,OAAO,CAAC;AAEtE,MAAI,CAAC,qBAAsB,QAAO;AAClC,QAAM,YAAY,IAAI,IAAI,oBAAoB;AAC9C,SAAO,SAAS,OAAO,CAAC,aAAa,UAAU,IAAI,QAAQ,CAAC;AAC9D;AAUO,SAAS,kCACd,SACA,QACA,SACA,UAAqC,CAAC,GACjC;AACL,MAAI,QAAQ,aAAc,QAAO,CAAC,GAAG,OAAO;AAE5C,QAAM,YAAY,oBAAI,IAAqB;AAC3C,SAAO,QAAQ,OAAO,CAAC,WAAW;AAChC,UAAM,SAAS,UAAU,IAAI,OAAO,QAAQ;AAC5C,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,UAAU,oBAAoB,OAAO,UAAU,QAAQ,SAAS,OAAO;AAC7E,cAAU,IAAI,OAAO,UAAU,OAAO;AACtC,WAAO;AAAA,EACT,CAAC;AACH;",
-  "names": []
-}

package/src/lib/auth/__tests__/mfaPendingAccess.test.ts

@@ -1,69 +0,0 @@
-import {
-  isMfaPendingAccessAllowed,
-  listMfaPendingAccessRoutes,
-  registerMfaPendingAccessRoutes,
-} from '../mfaPendingAccess'
-
-describe('mfaPendingAccess', () => {
-  it('ships an empty generic registry and denies unknown routes by default', () => {
-    const registeredPaths = listMfaPendingAccessRoutes().map((route) => route.path)
-    expect(registeredPaths).not.toContain('/api/acme-mfa/complete')
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/complete')).toBe(false)
-    expect(isMfaPendingAccessAllowed('GET', '/api/customers/people')).toBe(false)
-  })
-
-  it('allows registered completion routes for their exact methods only', () => {
-    registerMfaPendingAccessRoutes([{ path: '/api/acme-mfa/t2/verify', methods: ['POST'] }])
-
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/t2/verify')).toBe(true)
-    expect(isMfaPendingAccessAllowed('post', '/api/acme-mfa/t2/verify')).toBe(true)
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/t2/verify/')).toBe(true)
-    expect(isMfaPendingAccessAllowed('GET', '/api/acme-mfa/t2/verify')).toBe(false)
-    expect(isMfaPendingAccessAllowed('PUT', '/api/acme-mfa/t2/verify')).toBe(false)
-  })
-
-  it('rejects unregistered paths and near-misses', () => {
-    registerMfaPendingAccessRoutes([{ path: '/api/acme-mfa/t3/recovery', methods: ['POST'] }])
-
-    expect(isMfaPendingAccessAllowed('POST', '/api/customers/people')).toBe(false)
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/t3/unrelated')).toBe(false)
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/t3/recovery/impersonate')).toBe(false)
-    expect(isMfaPendingAccessAllowed('POST', '/api/auth/login')).toBe(false)
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/t3/recovery-codes')).toBe(false)
-  })
-
-  it('is fail-closed on missing or malformed input', () => {
-    registerMfaPendingAccessRoutes([{ path: '/api/acme-mfa/t4/complete', methods: ['POST'] }])
-
-    expect(isMfaPendingAccessAllowed(undefined, '/api/acme-mfa/t4/complete')).toBe(false)
-    expect(isMfaPendingAccessAllowed(null, '/api/acme-mfa/t4/complete')).toBe(false)
-    expect(isMfaPendingAccessAllowed('', '')).toBe(false)
-    expect(isMfaPendingAccessAllowed('POST', undefined)).toBe(false)
-    expect(isMfaPendingAccessAllowed('POST', 'not-a-path')).toBe(false)
-  })
-
-  it('registers additional routes additively and idempotently', () => {
-    const routeCountBefore = listMfaPendingAccessRoutes().length
-
-    registerMfaPendingAccessRoutes([
-      { path: '/api/acme-mfa/t5/complete', methods: ['post', 'POST'] },
-    ])
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/t5/complete')).toBe(true)
-
-    registerMfaPendingAccessRoutes([
-      { path: '/api/acme-mfa/t5/complete/', methods: ['POST'] },
-      { path: '/api/acme-mfa/t5/complete', methods: ['GET'] },
-    ])
-    const merged = listMfaPendingAccessRoutes().find((route) => route.path === '/api/acme-mfa/t5/complete')
-    expect(merged).toBeDefined()
-    expect(merged?.methods).toEqual(['GET', 'POST'])
-    expect(listMfaPendingAccessRoutes()).toHaveLength(routeCountBefore + 1)
-
-    registerMfaPendingAccessRoutes([
-      { path: 'no-leading-slash', methods: [] },
-      { path: '/api/acme-mfa/t5/broken', methods: [] },
-    ] as never)
-    expect(listMfaPendingAccessRoutes()).toHaveLength(routeCountBefore + 1)
-    expect(isMfaPendingAccessAllowed('POST', '/api/acme-mfa/t5/broken')).toBe(false)
-  })
-})