@open-mercato/shared 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/src/lib/auth/__tests__/principalServiceExport.test.ts

@@ -1,67 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
-
-const PACKAGE_ROOT = join(__dirname, '..', '..', '..', '..')
-const SUBPATH = './lib/auth/principal-service'
-
-type ExportTarget = { types?: string | string[]; default?: string }
-
-function readExports(): Record<string, ExportTarget | string> {
-  const packageJson = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')) as {
-    exports?: Record<string, ExportTarget | string>
-  }
-  return packageJson.exports ?? {}
-}
-
-/**
- * Node's subpath resolution: an exact key wins outright, and only when none
- * matches do the `*` patterns compete on the longest static prefix. Mirroring
- * it here is the point of the test — a subpath that resolves only through a
- * wildcard is at the mercy of whichever resolver a consumer happens to run
- * (packed tarball, bundler, Jest), and those do not agree on wildcard handling.
- */
-function resolveSubpath(exports: Record<string, ExportTarget | string>, subpath: string): string | null {
-  if (Object.prototype.hasOwnProperty.call(exports, subpath)) return subpath
-  let best: string | null = null
-  for (const key of Object.keys(exports)) {
-    const star = key.indexOf('*')
-    if (star < 0) continue
-    const prefix = key.slice(0, star)
-    const suffix = key.slice(star + 1)
-    if (!subpath.startsWith(prefix) || !subpath.endsWith(suffix)) continue
-    if (subpath.length < prefix.length + suffix.length) continue
-    if (!best || prefix.length > best.slice(0, best.indexOf('*')).length) best = key
-  }
-  return best
-}
-
-describe('@open-mercato/shared principal-service export map', () => {
-  const exports = readExports()
-
-  it('resolves through an explicit entry rather than a wildcard pattern', () => {
-    expect(resolveSubpath(exports, SUBPATH)).toBe(SUBPATH)
-  })
-
-  it('maps types to the source module and default to the built module', () => {
-    const target = exports[SUBPATH]
-    expect(typeof target).toBe('object')
-    expect(target).toEqual({
-      types: './src/lib/auth/principal-service.ts',
-      default: './dist/lib/auth/principal-service.js',
-    })
-  })
-
-  // Both halves of the mapping must exist in a packed package. `default` is
-  // produced by `yarn build:packages`, which the validation gate runs before
-  // `yarn test`.
-  it('ships both mapped files', () => {
-    const target = exports[SUBPATH] as ExportTarget
-    expect(existsSync(join(PACKAGE_ROOT, target.types as string))).toBe(true)
-    expect(existsSync(join(PACKAGE_ROOT, target.default as string))).toBe(true)
-  })
-
-  it('keeps the module importable under the mapped default condition', async () => {
-    const target = exports[SUBPATH] as ExportTarget
-    await expect(import(join(PACKAGE_ROOT, target.default as string))).resolves.toBeDefined()
-  })
-})

package/src/lib/auth/mfaPendingAccess.ts

@@ -1,70 +0,0 @@
-export type MfaPendingAccessRoute = {
-  path: string
-  methods: string[]
-}
-
-const registeredMethodsByPath = new Map<string, Set<string>>()
-
-function normalizePath(path: string): string | null {
-  if (typeof path !== 'string') return null
-  const trimmed = path.trim()
-  if (!trimmed || !trimmed.startsWith('/')) return null
-  return (trimmed.length > 1 ? trimmed.replace(/\/+$/, '') : trimmed).toLowerCase() || '/'
-}
-
-function normalizeMethods(methods: unknown): string[] {
-  if (!Array.isArray(methods)) return []
-  const normalized = methods
-    .filter((method): method is string => typeof method === 'string' && method.trim().length > 0)
-    .map((method) => method.trim().toUpperCase())
-  return Array.from(new Set(normalized)).sort((first, second) => (first < second ? -1 : first > second ? 1 : 0))
-}
-
-/**
- * Register routes that may accept an MFA-pending staff token. The registry starts empty and
- * stays generic: every module that completes an MFA challenge on its own endpoints registers
- * them here during its bootstrap — the canonical `/api/security/mfa/*` completion routes are
- * registered by the enterprise `security` module (`lib/mfaCompletionRoutes.ts`), third-party
- * MFA implementations register theirs the same way. Registration is additive: methods merge
- * into any existing entry for the same path and are never removed.
- *
- * Contract defined in `.ai/specs/enterprise/implemented/SPEC-ENT-007-2026-03-06-auth-login-interceptors-extension.md`
- * (§ Amendment 2026-08-21 — central MFA-pending token gate).
- */
-export function registerMfaPendingAccessRoutes(routes: MfaPendingAccessRoute[]): void {
-  for (const route of Array.isArray(routes) ? routes : []) {
-    const path = normalizePath(route?.path ?? '')
-    const methods = normalizeMethods(route?.methods)
-    if (!path || !methods.length) continue
-    const existing = registeredMethodsByPath.get(path)
-    if (!existing) {
-      registeredMethodsByPath.set(path, new Set(methods))
-      continue
-    }
-    for (const method of methods) existing.add(method)
-  }
-}
-
-/**
- * Fail-closed check deciding whether an MFA-pending staff token may be resolved for this exact
- * method + path pair. Only explicitly registered completion routes pass; every unregistered
- * request is denied.
- */
-export function isMfaPendingAccessAllowed(
-  method: string | null | undefined,
-  pathname: string | null | undefined,
-): boolean {
-  const path = normalizePath(typeof pathname === 'string' ? pathname : '')
-  if (!path) return false
-  if (typeof method !== 'string' || method.trim().length === 0) return false
-  const methods = registeredMethodsByPath.get(path)
-  if (!methods) return false
-  return methods.has(method.trim().toUpperCase())
-}
-
-/** Test/ops helper: current snapshot of the pending-access registry. */
-export function listMfaPendingAccessRoutes(): ReadonlyArray<Readonly<MfaPendingAccessRoute>> {
-  return Array.from(registeredMethodsByPath.entries())
-    .map(([path, methods]) => ({ path, methods: Array.from(methods).sort((first, second) => (first < second ? -1 : first > second ? 1 : 0)) }))
-    .sort((first, second) => (first.path < second.path ? -1 : first.path > second.path ? 1 : 0))
-}

package/src/lib/auth/principal-service.ts

@@ -1,110 +0,0 @@
-import type { AuthContext } from './server'
-
-export type PrincipalScope = {
-  tenantId: string
-  organizationId: string
-}
-
-export type AuthPrincipalType = 'user' | 'role'
-
-export type AuthPrincipalLabel = {
-  id: string
-  label: string
-  secondary: string | null
-}
-
-export type AuthPrincipalRolePage = {
-  items: AuthPrincipalLabel[]
-  page: number
-  pageSize: number
-  total: number
-}
-
-/** Public, request-scoped read boundary owned by the Auth module. */
-export interface AuthPrincipalService {
-  principalExists(input: {
-    type: AuthPrincipalType
-    id: string
-    scope: PrincipalScope
-  }): Promise<boolean>
-  resolveActiveUserRoleIds(userId: string, scope: PrincipalScope): Promise<string[]>
-  filterActiveRoleIds(roleIds: string[], scope: PrincipalScope): Promise<string[]>
-  resolveLabels(input: {
-    type: AuthPrincipalType
-    ids: string[]
-    scope: PrincipalScope
-  }): Promise<AuthPrincipalLabel[]>
-  /**
-   * Optional additive capability for organization-eligible role pickers.
-   * Implementations must apply eligibility before pagination and bound the
-   * advertised result window so sparse ACL matches cannot amplify requests.
-   */
-  queryActiveRolePage?(input: {
-    scope: PrincipalScope
-    search?: string
-    excludedIds?: string[]
-    page: number
-    pageSize: number
-  }): Promise<AuthPrincipalRolePage>
-  listSuperAdminUserIds(tenantId: string): Promise<string[]>
-}
-
-/** Public, request-scoped read boundary owned by the API Keys module. */
-export interface ApiKeyPrincipalService {
-  resolveAssignedRoleIds(apiKeyId: string, scope: PrincipalScope): Promise<string[]>
-}
-
-export type OrganizationScope = {
-  selectedId: string | null
-  filterIds: string[] | null
-  allowedIds: string[] | null
-  tenantId: string | null
-  // True when an explicit organization selection could not be honored. Reads
-  // fall back to the caller's accessible organizations; writes must fail.
-  selectionRejected?: boolean
-}
-
-export type OrganizationScopeAcl = {
-  isSuperAdmin: boolean
-  features: string[]
-  organizations: string[] | null
-}
-
-export type OrganizationScopeRequest = Request | {
-  cookies?: { get: (name: string) => { value: string } | undefined }
-  headers?: { get(name: string): string | null }
-}
-
-/**
- * Narrow, request-scoped hierarchy boundary owned by Directory.
- *
- * `null` means the selected organization does not exist in the requested
- * tenant. An empty array means it exists but has no ancestors.
- */
-export interface OrganizationHierarchyService {
-  resolveAncestorIds(input: {
-    tenantId: string
-    organizationId: string
-  }): Promise<string[] | null>
-}
-
-/** Public, request-scoped organization expansion boundary owned by Directory. */
-export interface OrganizationScopeService {
-  resolve(input: {
-    auth: AuthContext | null | undefined
-    selectedId?: string | null
-    tenantId?: string | null
-    freshAcl?: boolean
-  }): Promise<OrganizationScope>
-  resolveFresh(input: {
-    auth: NonNullable<AuthContext>
-    selectedId?: string | null
-    tenantId?: string | null
-  }): Promise<{ scope: OrganizationScope; acl: OrganizationScopeAcl }>
-  resolveForRequest(input: {
-    auth: AuthContext | null | undefined
-    request?: OrganizationScopeRequest
-    selectedId?: string | null
-    tenantId?: string | null
-  }): Promise<OrganizationScope>
-}

package/src/lib/html/__tests__/htmlToPlainText.test.ts

@@ -1,59 +0,0 @@
-import { htmlToPlainText } from '../htmlToPlainText'
-
-describe('htmlToPlainText', () => {
-  it('returns an empty string for empty input without invoking the parser', () => {
-    expect(htmlToPlainText('')).toBe('')
-  })
-
-  it('renders block-level markup as readable prose', () => {
-    const html = '<html><body><p>Hello,</p><p>second paragraph.</p></body></html>'
-
-    const text = htmlToPlainText(html)
-
-    expect(text).toContain('Hello,')
-    expect(text).toContain('second paragraph.')
-    expect(text).not.toContain('<p>')
-    expect(text).not.toContain('</body>')
-  })
-
-  it('drops script and style content instead of inlining it as text', () => {
-    // Email HTML routinely carries a <style> block and a tracking <script>.
-    // Rendering either as text is what made ingested bodies unreadable.
-    const html = [
-      '<!DOCTYPE html><html><head>',
-      '<style>body { margin: 0; font-family: Helvetica; }</style>',
-      '<script>trackOpen("beacon")</script>',
-      '</head><body><p>Visible copy</p></body></html>',
-    ].join('')
-
-    const text = htmlToPlainText(html)
-
-    expect(text).toBe('Visible copy')
-    expect(text).not.toContain('font-family')
-    expect(text).not.toContain('trackOpen')
-    expect(text).not.toContain('<!DOCTYPE')
-  })
-
-  it('normalizes CRLF and lone CR line endings to LF', () => {
-    const text = htmlToPlainText('<pre>first\r\nsecond\rthird</pre>')
-
-    expect(text).not.toContain('\r')
-    expect(text).toBe('first\nsecond\nthird')
-  })
-
-  it('collapses runs of three or more blank lines down to one', () => {
-    const text = htmlToPlainText('<pre>top\n\n\n\n\nbottom</pre>')
-
-    expect(text).toBe('top\n\nbottom')
-  })
-
-  it('preserves a single blank line between paragraphs', () => {
-    const text = htmlToPlainText('<pre>top\n\nbottom</pre>')
-
-    expect(text).toBe('top\n\nbottom')
-  })
-
-  it('trims surrounding whitespace', () => {
-    expect(htmlToPlainText('<pre>\n\n  padded  \n\n</pre>')).toBe('padded')
-  })
-})

package/src/lib/html/htmlToPlainText.ts

@@ -1,17 +0,0 @@
-import { convert } from 'html-to-text'
-
-export function htmlToPlainText(html: string): string {
-  if (!html) return ''
-  return convert(html, {
-    wordwrap: false,
-    preserveNewlines: true,
-    selectors: [
-      { selector: 'script', format: 'skip' },
-      { selector: 'style', format: 'skip' },
-    ],
-  })
-    .replace(/\r\n/g, '\n')
-    .replace(/\r/g, '\n')
-    .replace(/\n{3,}/g, '\n\n')
-    .trim()
-}

package/src/lib/query/__tests__/count-cap-plan.test.ts

@@ -1,240 +0,0 @@
-/**
- * Plan-level guard for the capped list COUNT (#4552 Phase 2), run against a real
- * PostgreSQL. This is the only test that fails if a future refactor reintroduces
- * a blocking node (Aggregate/Sort/Unique) between the probe `Limit` and the base
- * scan — a mocked total cannot catch a bound that does not bind. It doubles as
- * the count-parity check: with the cap disabled, the rebuilt count must equal
- * ground truth across the cf-filter / or-group / plain matrices.
- *
- * Gated on OM_COUNT_CAP_PG_URL (a throwaway database — the suite creates and
- * drops its own tables). Example:
- *   docker run --rm -d -p 54329:5432 -e POSTGRES_PASSWORD=t postgres:16
- *   OM_COUNT_CAP_PG_URL=postgres://postgres:t@localhost:54329/postgres yarn jest count-cap-plan
- */
-import { Kysely, PostgresDialect, sql } from 'kysely'
-import { BasicQueryEngine } from '../engine'
-
-const PG_URL = process.env.OM_COUNT_CAP_PG_URL
-const maybe = PG_URL ? describe : describe.skip
-
-const TENANT = '11111111-1111-4111-8111-111111111111'
-const ORG = '22222222-2222-4222-8222-222222222222'
-const ENTITY = 'capcheck:om_capcheck_order'
-const TABLE = 'om_capcheck_orders'
-const ROWS = 120
-const RED_ROWS = 30
-
-maybe('capped list COUNT against PostgreSQL', () => {
-  jest.setTimeout(60_000)
-  let db: Kysely<any>
-  let sqlLog: string[] = []
-  let paramLog: unknown[][] = []
-  const originalCap = process.env.OM_LIST_COUNT_CAP
-
-  beforeAll(async () => {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const { Pool } = require('pg')
-    db = new Kysely<any>({
-      dialect: new PostgresDialect({ pool: new Pool({ connectionString: PG_URL }) }),
-      log(event) {
-        if (event.level === 'query' || event.level === 'error') {
-          sqlLog.push(event.query.sql)
-          paramLog.push([...event.query.parameters])
-        }
-      },
-    })
-    await sql`drop table if exists om_capcheck_orders`.execute(db)
-    await sql`create table om_capcheck_orders (
-      id uuid primary key,
-      tenant_id uuid not null,
-      organization_id uuid not null,
-      deleted_at timestamptz,
-      status text not null
-    )`.execute(db)
-    await sql`create table if not exists custom_field_defs (
-      id serial primary key,
-      key text not null,
-      entity_id text not null,
-      kind text,
-      config_json jsonb,
-      is_active boolean not null default true,
-      organization_id uuid,
-      tenant_id uuid,
-      updated_at timestamptz,
-      deleted_at timestamptz
-    )`.execute(db)
-    await sql`create table if not exists custom_field_values (
-      id serial primary key,
-      entity_id text not null,
-      field_key text not null,
-      record_id text not null,
-      value_text text,
-      value_multiline text,
-      value_int int,
-      value_float float,
-      value_bool boolean,
-      organization_id uuid,
-      tenant_id uuid
-    )`.execute(db)
-    await sql`delete from custom_field_defs where entity_id = ${ENTITY}`.execute(db)
-    await sql`delete from custom_field_values where entity_id = ${ENTITY}`.execute(db)
-    await sql`insert into custom_field_defs (key, entity_id, kind, is_active, tenant_id)
-      values ('color', ${ENTITY}, 'text', true, null)`.execute(db)
-    for (let i = 0; i < ROWS; i++) {
-      const id = `33333333-3333-4333-8333-${String(i).padStart(12, '0')}`
-      await sql`insert into om_capcheck_orders (id, tenant_id, organization_id, deleted_at, status)
-        values (${id}::uuid, ${TENANT}::uuid, ${ORG}::uuid, null, ${i % 2 === 0 ? 'open' : 'closed'})`.execute(db)
-      if (i < RED_ROWS) {
-        await sql`insert into custom_field_values (entity_id, field_key, record_id, value_text, tenant_id)
-          values (${ENTITY}, 'color', ${id}, 'red', ${TENANT}::uuid)`.execute(db)
-      }
-    }
-  })
-
-  afterAll(async () => {
-    await sql`drop table if exists om_capcheck_orders`.execute(db)
-    await sql`delete from custom_field_defs where entity_id = ${ENTITY}`.execute(db)
-    await sql`delete from custom_field_values where entity_id = ${ENTITY}`.execute(db)
-    await db.destroy()
-  })
-
-  afterEach(() => {
-    if (originalCap === undefined) delete process.env.OM_LIST_COUNT_CAP
-    else process.env.OM_LIST_COUNT_CAP = originalCap
-  })
-
-  const makeEngine = () => new BasicQueryEngine({} as any, () => db as any)
-  const baseOpts = {
-    tenantId: TENANT,
-    organizationId: ORG,
-    fields: ['id'],
-    page: { page: 1, pageSize: 10 },
-  }
-
-  function lastCountSql(): { text: string; params: unknown[] } {
-    for (let i = sqlLog.length - 1; i >= 0; i--) {
-      if (/count\(\*\)/i.test(sqlLog[i])) return { text: sqlLog[i], params: paramLog[i] }
-    }
-    throw new Error('no count SQL captured')
-  }
-
-  function collectNodes(node: any, out: any[] = []): any[] {
-    if (!node) return out
-    out.push(node)
-    for (const child of node.Plans ?? []) collectNodes(child, out)
-    return out
-  }
-
-  test('probe plan: no blocking node between the Limit and the base scan (cf-filtered)', async () => {
-    process.env.OM_LIST_COUNT_CAP = '50'
-    sqlLog = []; paramLog = []
-    const result = await makeEngine().query(ENTITY, {
-      ...baseOpts,
-      filters: { status: { $eq: 'open' } },
-    })
-    expect(result.total).toBe(50)
-    expect(result.meta?.listCountCapWarning).toEqual({ entity: ENTITY, cap: 50 })
-
-    const { text, params } = lastCountSql()
-    expect(text.toLowerCase()).toContain('limit')
-    const explained = await sql
-      .raw(`explain (format json) ${text.replace(/\$(\d+)/g, (_, n) => {
-        const value = params[Number(n) - 1]
-        return typeof value === 'number' ? String(value) : `'${String(value).replace(/'/g, "''")}'`
-      })}`)
-      .execute(db)
-    const plan = (explained.rows[0] as any)['QUERY PLAN'][0].Plan
-    const all = collectNodes(plan)
-    const limitNode = all.find((n) => n['Node Type'] === 'Limit')
-    expect(limitNode).toBeTruthy()
-    // Below the Limit: only row-producing nodes down to the scan. An Aggregate,
-    // Sort, or Unique here means the bound does not bind.
-    const belowLimit = collectNodes(limitNode).slice(1)
-    const blocking = belowLimit.filter((n) => /Aggregate|Sort|Unique/.test(String(n['Node Type'])))
-    expect(blocking).toEqual([])
-    // The base scan is inside the Limit subtree.
-    expect(belowLimit.some((n) => n['Relation Name'] === TABLE)).toBe(true)
-  })
-
-  test('cf filter compiles to EXISTS and stays cappable', async () => {
-    process.env.OM_LIST_COUNT_CAP = '10'
-    sqlLog = []; paramLog = []
-    const result = await makeEngine().query(ENTITY, {
-      ...baseOpts,
-      filters: { cf_color: { $eq: 'red' } },
-    })
-    expect(result.total).toBe(10)
-    expect(result.meta?.listCountCapWarning).toEqual({ entity: ENTITY, cap: 10 })
-    const { text } = lastCountSql()
-    expect(text.toLowerCase()).toContain('exists')
-    expect(text.toLowerCase()).not.toContain('group by')
-  })
-
-  test('parity with the cap disabled: rebuilt count matches the display query across the filter matrix', async () => {
-    process.env.OM_LIST_COUNT_CAP = '0'
-    const engine = makeEngine()
-    const wide = { page: { page: 1, pageSize: 1000 } }
-
-    // Each case asserts the rebuilt count against ground truth where the filter
-    // semantics are well-defined, and always against the display query's own
-    // row set — the regression guard for "count rebuild changing a total".
-    const expectParity = async (filters: any, expectedTotal?: number) => {
-      const result = await engine.query(ENTITY, { ...baseOpts, ...wide, filters })
-      expect(result.total).toBe(result.items.length)
-      if (expectedTotal !== undefined) expect(result.total).toBe(expectedTotal)
-      expect(result.meta?.listCountCapWarning).toBeUndefined()
-      return result
-    }
-
-    await expectParity(undefined, ROWS)
-    await expectParity({ status: { $eq: 'open' } }, ROWS / 2)
-    await expectParity({ cf_color: { $eq: 'red' } }, RED_ROWS)
-    await expectParity({ $and: [{ status: { $eq: 'open' } }, { cf_color: { $eq: 'red' } }] }, RED_ROWS / 2)
-    // Base-column-only $or exercises the or-group path in the count shape.
-    await expectParity({ $or: [{ status: { $eq: 'open' } }, { status: { $eq: 'closed' } }] }, ROWS)
-    // Mixed base + cf disjunction (#5039): the count shape must compile the cf
-    // leaf to an EXISTS rather than dropping it — a dropped leaf narrows the OR
-    // and undercounts. closed (60) ∪ red (30, half of which are closed) = 75.
-    await expectParity({ $or: [{ status: { $eq: 'closed' } }, { cf_color: { $eq: 'red' } }] }, ROWS / 2 + RED_ROWS / 2)
-    // cf-only disjunction: red (30) ∪ blue (0) = 30.
-    await expectParity({ $or: [{ cf_color: { $eq: 'red' } }, { cf_color: { $eq: 'blue' } }] }, RED_ROWS)
-    await expectParity({ cf_color: { $eq: 'blue' } }, 0)
-    await expectParity({ cf_color: { $eq: null } }, ROWS - RED_ROWS)
-    await expectParity({ cf_color: { $ne: 'red' } }, 0)
-    await expectParity({ cf_color: { $in: ['red', 'blue'] } }, RED_ROWS)
-  })
-
-  test('kill switch (cap=0): the cf-filtered count still plans set-oriented, not per-row', async () => {
-    // OM_LIST_COUNT_CAP=0 restores exact totals but runs them through the
-    // rebuilt shape. The documented escape hatch must not be slower than the
-    // problem: the uncapped EXISTS should plan as a semi-join or a hashed
-    // subplan, never an un-hashed per-row subplan re-executed for every row.
-    process.env.OM_LIST_COUNT_CAP = '0'
-    sqlLog = []; paramLog = []
-    const result = await makeEngine().query(ENTITY, {
-      ...baseOpts,
-      filters: { cf_color: { $eq: 'red' } },
-    })
-    expect(result.total).toBe(RED_ROWS)
-
-    const { text, params } = lastCountSql()
-    const explained = await sql
-      .raw(`explain (format json) ${text.replace(/\$(\d+)/g, (_, n) => {
-        const value = params[Number(n) - 1]
-        return typeof value === 'number' ? String(value) : `'${String(value).replace(/'/g, "''")}'`
-      })}`)
-      .execute(db)
-    const plan = (explained.rows[0] as any)['QUERY PLAN'][0].Plan
-    const all = collectNodes(plan)
-    const semiJoin = all.some((n) => /Semi/.test(String(n['Join Type'] ?? '')))
-    const hashedSubplan = all.some((n) => /hashed/i.test(String(n['Subplan Name'] ?? '')))
-    expect(semiJoin || hashedSubplan).toBe(true)
-  })
-
-  test('sub-cap totals stay exact with the cap active', async () => {
-    process.env.OM_LIST_COUNT_CAP = '1000'
-    const result = await makeEngine().query(ENTITY, { ...baseOpts, filters: { cf_color: { $eq: 'red' } } })
-    expect(result.total).toBe(RED_ROWS)
-    expect(result.meta?.listCountCapWarning).toBeUndefined()
-  })
-})

package/src/lib/query/__tests__/count-cap.test.ts

@@ -1,41 +0,0 @@
-import { resolveListCountCap, DEFAULT_LIST_COUNT_CAP } from '../count-cap'
-
-describe('resolveListCountCap', () => {
-  const original = process.env.OM_LIST_COUNT_CAP
-  afterEach(() => {
-    if (original === undefined) delete process.env.OM_LIST_COUNT_CAP
-    else process.env.OM_LIST_COUNT_CAP = original
-  })
-
-  test('unset: the default cap — the cap is on by default', () => {
-    delete process.env.OM_LIST_COUNT_CAP
-    expect(resolveListCountCap()).toBe(DEFAULT_LIST_COUNT_CAP)
-  })
-
-  test('blank: the default cap', () => {
-    process.env.OM_LIST_COUNT_CAP = '  '
-    expect(resolveListCountCap()).toBe(DEFAULT_LIST_COUNT_CAP)
-  })
-
-  test('0 disables capping', () => {
-    process.env.OM_LIST_COUNT_CAP = '0'
-    expect(resolveListCountCap()).toBeNull()
-  })
-
-  test('negative values disable capping like 0', () => {
-    process.env.OM_LIST_COUNT_CAP = '-5'
-    expect(resolveListCountCap()).toBeNull()
-  })
-
-  test('a positive integer is used as-is; floats floor', () => {
-    process.env.OM_LIST_COUNT_CAP = '500'
-    expect(resolveListCountCap()).toBe(500)
-    process.env.OM_LIST_COUNT_CAP = '500.9'
-    expect(resolveListCountCap()).toBe(500)
-  })
-
-  test('unparseable input falls back to the default — bad input must not silently disable the cap', () => {
-    process.env.OM_LIST_COUNT_CAP = 'unbounded'
-    expect(resolveListCountCap()).toBe(DEFAULT_LIST_COUNT_CAP)
-  })
-})

package/src/lib/query/count-cap.ts

@@ -1,19 +0,0 @@
-import { parseNumberWithDefault } from '../number'
-
-export const DEFAULT_LIST_COUNT_CAP = 10_000
-
-/**
- * Cap on how many matching rows a list COUNT may visit before reporting
- * `total: cap` with `meta.listCountCapWarning` (surfaced to clients as
- * `totalIsCapped`). Returns the cap as a number, or `null` when capping is
- * disabled.
- *
- * Resolution of `OM_LIST_COUNT_CAP`:
- * - unset / blank / unparseable → `DEFAULT_LIST_COUNT_CAP` (the cap is on by
- *   default, and bad input must not silently disable it)
- * - `0` (or negative) → `null` — capping disabled, exact counts everywhere
- */
-export function resolveListCountCap(): number | null {
-  const parsed = parseNumberWithDefault(process.env.OM_LIST_COUNT_CAP, DEFAULT_LIST_COUNT_CAP, { integer: true })
-  return parsed <= 0 ? null : parsed
-}

package/src/lib/queue/dispatchOrigin.ts

@@ -1,35 +0,0 @@
-/**
- * Trusted dispatch-origin markers for queue jobs.
- *
- * Jobs that drive privileged side effects (payment webhook processors and
- * similar sinks) MUST only execute payloads enqueued by trusted infrastructure
- * code paths. The scheduler dispatch layer and inbound webhook routes mark the
- * payloads they enqueue; sensitive workers verify the marker before doing work.
- *
- * The scheduler payload sanitizer strips every caller-supplied `_`-prefixed
- * key from scheduled target payloads, so a marker cannot be forged through the
- * scheduler job API. Direct queue/Redis write access is operator-level access
- * and outside this threat model.
- */
-
-export const QUEUE_JOB_ORIGIN_KEY = '_jobOrigin'
-
-export type QueueJobOrigin = 'inbound-webhook' | 'scheduler'
-
-export function markQueueJobOrigin<T extends Record<string, unknown>>(
-  payload: T,
-  origin: QueueJobOrigin,
-): T {
-  return { ...payload, [QUEUE_JOB_ORIGIN_KEY]: origin }
-}
-
-export function readQueueJobOrigin(payload: unknown): QueueJobOrigin | null {
-  if (!payload || typeof payload !== 'object') return null
-  const value = (payload as Record<string, unknown>)[QUEUE_JOB_ORIGIN_KEY]
-  if (value === 'inbound-webhook' || value === 'scheduler') return value
-  return null
-}
-
-export function isTrustedWebhookDispatch(payload: unknown): boolean {
-  return readQueueJobOrigin(payload) === 'inbound-webhook'
-}