@open-mercato/shared 0.9.1-develop.7574.1.837288eec1 → 0.10.1-develop.7576.1.21d5b50435

package/src/lib/__tests__/number.test.ts

@@ -1,4 +1,4 @@
-import { formatLocaleNumberInput, parseLocaleNumber, parseNumberWithDefault, resolveLocaleNumberSeparators } from '../number'
+import { parseLocaleNumber, parseNumberWithDefault, resolveLocaleNumberSeparators } from '../number'
 
 describe('parseNumberWithDefault', () => {
   it('returns the fallback when raw is missing or blank', () => {
@@ -121,26 +121,3 @@ describe('parseLocaleNumber', () => {
     expect(parseLocaleNumber('110.70', undefined)).toBe(110.7)
   })
 })
-
-describe('formatLocaleNumberInput (issue #6309)', () => {
-  it('uses the locale decimal separator instead of the dot String() always emits', () => {
-    expect(formatLocaleNumberInput(2.5, 'pl-PL')).toBe('2,5')
-    expect(formatLocaleNumberInput(-2.5, 'pl-PL')).toBe('-2,5')
-    expect(formatLocaleNumberInput(1234.56, 'pl-PL')).toBe('1234,56')
-    expect(formatLocaleNumberInput(2.5, 'en-US')).toBe('2.5')
-  })
-
-  it('leaves integers untouched and applies no grouping', () => {
-    expect(formatLocaleNumberInput(1500, 'pl-PL')).toBe('1500')
-    expect(formatLocaleNumberInput(1500, 'en-US')).toBe('1500')
-    expect(formatLocaleNumberInput(0, 'pl-PL')).toBe('0')
-  })
-
-  it('round-trips through parseLocaleNumber', () => {
-    for (const value of [2.5, -0.125, 1234.56, 0.1 + 0.2, 7]) {
-      for (const locale of ['pl-PL', 'de-DE', 'en-US', 'fr-FR']) {
-        expect(parseLocaleNumber(formatLocaleNumberInput(value, locale), locale)).toBe(value)
-      }
-    }
-  })
-})

package/src/lib/auth/__tests__/server.test.ts

@@ -122,20 +122,6 @@ describe('auth server integrity checks', () => {
     await expect(resolveAuthFromRequestDetailed(request)).resolves.toEqual({ auth: null, status: 'invalid' })
   })
 
-  it('treats a malformed %-escape auth_token as an invalid token instead of 500ing (issue #7382)', async () => {
-    const { resolveAuthFromRequestDetailed } = await import('@open-mercato/shared/lib/auth/server')
-    verifyJwt.mockImplementation(() => {
-      throw new Error('malformed token')
-    })
-
-    const request = new Request('https://example.test/api/test', {
-      headers: { cookie: 'auth_token=%zz' },
-    })
-
-    await expect(resolveAuthFromRequestDetailed(request)).resolves.toEqual({ auth: null, status: 'invalid' })
-    expect(verifyJwt).toHaveBeenCalledWith('%zz')
-  })
-
   it('replaces stale JWT roles with canonical roles from the database', async () => {
     const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
     const jwtAuth = {

package/src/lib/auth/server.ts

@@ -413,7 +413,7 @@ export async function resolveAuthFromRequestDetailed(req: Request): Promise<Auth
   if (authHeader.toLowerCase().startsWith('bearer ')) token = authHeader.slice(7).trim()
   if (!token) {
     const match = cookieHeader.match(/(?:^|;\s*)auth_token=([^;]+)/)
-    if (match) token = decodeCookieValue(match[1]) ?? undefined
+    if (match) token = decodeURIComponent(match[1])
   }
   if (token) {
     try {

package/src/lib/bootstrap/__tests__/dynamicLoader.appDi.test.ts

@@ -91,9 +91,9 @@ function writeCompiledPair(
   fs.writeFileSync(compiledPath, source.compiled)
   const sourceRelativePath = path.relative(appRoot, sourcePath).split(path.sep).join('/')
   fs.writeFileSync(`${compiledPath}.cache.json`, JSON.stringify({
-    version: 5,
+    version: 4,
     inputHash: hash(JSON.stringify({
-      version: 5,
+      version: 4,
       sourceHash: hash(source.ts),
       tsconfigHashes: {
         'tsconfig.json': hash(APP_TSCONFIG),

package/src/lib/bootstrap/__tests__/dynamicLoader.appModuleOverrides.test.ts

@@ -132,9 +132,9 @@ function writeCompiledPair(
   fs.writeFileSync(compiledPath, source.compiled)
   const sourceRelativePath = path.relative(appRoot, sourcePath).split(path.sep).join('/')
   fs.writeFileSync(`${compiledPath}.cache.json`, JSON.stringify({
-    version: 5,
+    version: 4,
     inputHash: hash(JSON.stringify({
-      version: 5,
+      version: 4,
       sourceHash: hash(source.ts),
       tsconfigHashes: {
         'tsconfig.json': hash(APP_TSCONFIG),

package/src/lib/bootstrap/__tests__/dynamicLoader.cacheRecovery.test.ts

@@ -77,7 +77,7 @@ function writeGeneratedModule(generatedDir: string, baseName: string, source: {
 function writeCompiledSibling(generatedDir: string, baseName: string, compiled: string) {
   const source = fs.readFileSync(path.join(generatedDir, `${baseName}.ts`), 'utf8')
   const inputHash = hash(JSON.stringify({
-    version: 5,
+    version: 4,
     sourceHash: hash(source),
     tsconfigHashes: {
       'tsconfig.json': hash(APP_TSCONFIG),
@@ -90,7 +90,7 @@ function writeCompiledSibling(generatedDir: string, baseName: string, compiled:
   const compiledPath = path.join(generatedDir, `${baseName}.mjs`)
   fs.writeFileSync(compiledPath, compiled)
   fs.writeFileSync(`${compiledPath}.cache.json`, JSON.stringify({
-    version: 5,
+    version: 4,
     inputHash,
     outputHash: hash(compiled),
     dependencies: {

package/src/lib/bootstrap/__tests__/dynamicLoader.commandInterceptors.test.ts

@@ -77,9 +77,9 @@ function writeGeneratedModule(generatedDir: string, baseName: string, source: {
   fs.writeFileSync(sourcePath, source.ts)
   fs.writeFileSync(compiledPath, source.compiled)
   fs.writeFileSync(`${compiledPath}.cache.json`, JSON.stringify({
-    version: 5,
+    version: 4,
     inputHash: hash(JSON.stringify({
-      version: 5,
+      version: 4,
       sourceHash: hash(source.ts),
       tsconfigHashes: {
         'tsconfig.json': hash(APP_TSCONFIG),

package/src/lib/bootstrap/__tests__/dynamicLoader.tsconfig.test.ts

@@ -133,7 +133,7 @@ describe('dynamic loader app tsconfig and content-addressed cache', () => {
     loadBootstrapDataInNode(appRoot)
     const after = readCacheMetadata(appRoot, 'entities')
 
-    expect(after.version).toBe(5)
+    expect(after.version).toBe(4)
     expect(after.inputHash).not.toBe(before.inputHash)
   })
 
@@ -287,6 +287,6 @@ describe('dynamic loader app tsconfig and content-addressed cache', () => {
 
     loadBootstrapDataInNode(appRoot)
 
-    expect(readCacheMetadata(appRoot, 'entities').version).toBe(5)
+    expect(readCacheMetadata(appRoot, 'entities').version).toBe(4)
   })
 })

package/src/lib/bootstrap/__tests__/factory.test.ts

@@ -62,8 +62,7 @@ describe('partitioned bootstrap registration', () => {
   })
 
   it('keeps API-only bootstrap from replacing core injection widgets', async () => {
-    const entry = { moduleId: 'example', key: 'example:widget', source: 'app' as const, loader: async () => ({}) as never }
-    const apiBootstrap = createBootstrap({ ...emptyBootstrapData, injectionWidgetEntries: [entry] }, {
+    const apiBootstrap = createBootstrap(emptyBootstrapData, {
       registrationKey: 'api-only',
       skipUiRegistries: true,
       skipCoreInjectionWidgets: true,
@@ -72,22 +71,11 @@ describe('partitioned bootstrap registration', () => {
     apiBootstrap()
     await waitForAsyncRegistration()
 
-    // The API partition still contributes its entries — module API routes resolve widget
-    // contributions on the request path — but in `merge` mode, so it can never shrink a
-    // registry the full page bootstrap already published in the same process.
-    expect(registerCoreInjectionWidgetsMock).toHaveBeenCalledWith([entry], { mode: 'merge' })
-    // The raw widget entries also travel with the tables so a `key`-spelled injection
-    // override resolves to the `widgetId` the slots reference (#5152).
-    expect(registerCoreInjectionTablesMock).toHaveBeenCalledWith([], [entry])
+    expect(registerCoreInjectionWidgetsMock).not.toHaveBeenCalled()
+    // The raw widget entries still travel with the tables so a `key`-spelled injection
+    // override resolves to the `widgetId` the slots reference (#5152), even though this
+    // bootstrap deliberately skips registering the widgets themselves.
+    expect(registerCoreInjectionTablesMock).toHaveBeenCalledWith([], [])
     expect(registerEnabledModuleIdsMock).toHaveBeenCalledTimes(1)
   })
-
-  it('lets the full bootstrap replace the registry outright', async () => {
-    const fullBootstrap = createBootstrap(emptyBootstrapData, { registrationKey: 'full-only' })
-
-    fullBootstrap()
-    await waitForAsyncRegistration()
-
-    expect(registerCoreInjectionWidgetsMock).toHaveBeenCalledWith([], undefined)
-  })
 })

package/src/lib/bootstrap/dynamicLoader.ts

@@ -16,7 +16,7 @@ import { CLIENT_ONLY_STUB_NAMESPACE, createClientOnlyStubPlugin } from './client
 import path from 'node:path'
 import fs from 'node:fs'
 import crypto from 'node:crypto'
-import { createRequire, isBuiltin } from 'node:module'
+import { createRequire } from 'node:module'
 import { pathToFileURL } from 'node:url'
 
 let activeBootstrapLoads = 0
@@ -77,44 +77,6 @@ class GeneratedFileNotFoundError extends Error {
   }
 }
 
-function splitBareSpecifier(specifier: string): { packageName: string; subpath: string } | null {
-  const segments = specifier.split('/')
-  const nameLength = specifier.startsWith('@') ? 2 : 1
-  if (segments.length <= nameLength || segments.slice(0, nameLength).some((segment) => !segment)) return null
-  return {
-    packageName: segments.slice(0, nameLength).join('/'),
-    subpath: segments.slice(nameLength).join('/'),
-  }
-}
-
-/**
- * Rewrites an externalized `pkg/subpath` specifier to the file Node's ESM resolver can load
- * when `pkg` publishes no `exports` map (#6993). Builtins, packages with `exports`, subpaths
- * that already carry an extension and anything that fails to resolve keep the original
- * specifier, so the bundle never gets worse than before.
- */
-function rewriteLegacySubpathSpecifier(
-  specifier: string,
-  appRequire: NodeRequire,
-  onRewrite: (manifestPath: string) => void,
-): string {
-  if (isBuiltin(specifier)) return specifier
-  const parts = splitBareSpecifier(specifier)
-  if (!parts || path.posix.extname(parts.subpath)) return specifier
-  try {
-    const manifestPath = appRequire.resolve(`${parts.packageName}/package.json`)
-    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) as { exports?: unknown }
-    if (manifest.exports != null) return specifier
-    const resolvedFile = appRequire.resolve(specifier)
-    const relativeFile = path.relative(path.dirname(manifestPath), resolvedFile)
-    if (!relativeFile || relativeFile.startsWith('..') || path.isAbsolute(relativeFile)) return specifier
-    onRewrite(manifestPath)
-    return `${parts.packageName}/${relativeFile.split(path.sep).join('/')}`
-  } catch {
-    return specifier
-  }
-}
-
 /**
  * esbuild plugins for the CLI bundle, in resolution order. The client-only stub must come
  * first so it wins over the alias and external plugins for `*.client` dynamic imports.
@@ -123,10 +85,7 @@ function rewriteLegacySubpathSpecifier(
  * `createClientOnlyStubPlugin` in isolation stays green if the plugin is dropped from this
  * list, which would silently reintroduce #4623.
  */
-export function createCliBundlePlugins(
-  appRoot: string,
-  options: { onLegacySubpathRewrite?: (manifestPath: string) => void } = {},
-): import('esbuild').Plugin[] {
+export function createCliBundlePlugins(appRoot: string): import('esbuild').Plugin[] {
   // Plugin to resolve the @/ alias the way the app tsconfig maps it:
   // `@/.mercato/*` to the app root, every other `@/*` to the app's src/ directory.
   const aliasPlugin: import('esbuild').Plugin = {
@@ -154,19 +113,6 @@ export function createCliBundlePlugins(
     },
   }
 
-  // Node's ESM resolver only maps an extensionless package subpath (`next/link`) when the
-  // package publishes an `exports` map; legacy packages need the real file path instead.
-  const appRequire = createRequire(path.join(appRoot, 'package.json'))
-  const externalSpecifierCache = new Map<string, string>()
-  const onLegacySubpathRewrite = options.onLegacySubpathRewrite ?? (() => undefined)
-  const resolveExternalSpecifier = (specifier: string): string => {
-    const cached = externalSpecifierCache.get(specifier)
-    if (cached !== undefined) return cached
-    const resolved = rewriteLegacySubpathSpecifier(specifier, appRequire, onLegacySubpathRewrite)
-    externalSpecifierCache.set(specifier, resolved)
-    return resolved
-  }
-
   // Plugin to mark non-JSON package imports as external
   const externalNonJsonPlugin: import('esbuild').Plugin = {
     name: 'external-non-json',
@@ -183,7 +129,7 @@ export function createCliBundlePlugins(
           return null // Let esbuild handle it
         }
         // Otherwise mark as external
-        return { path: resolveExternalSpecifier(args.path), external: true }
+        return { path: args.path, external: true }
       })
     },
   }
@@ -191,7 +137,7 @@ export function createCliBundlePlugins(
   return [createClientOnlyStubPlugin(), aliasPlugin, externalNonJsonPlugin]
 }
 
-const DYNAMIC_LOADER_CACHE_VERSION = 5
+const DYNAMIC_LOADER_CACHE_VERSION = 4
 
 type DynamicLoaderCacheMetadata = {
   version: number
@@ -487,7 +433,6 @@ async function compileAppSourceFileWithActiveEsbuild(
   // Dynamically import esbuild only when needed
   const esbuild = await getEsbuildRuntime()
 
-  const rewrittenPackageManifests = new Set<string>()
   // Use esbuild.build with bundling to handle JSON imports
   const result = await esbuild.build({
     entryPoints: [tsPath],
@@ -499,9 +444,7 @@ async function compileAppSourceFileWithActiveEsbuild(
     platform: 'node',
     target: 'node18',
     tsconfig: appTsconfig,
-    plugins: createCliBundlePlugins(appRoot, {
-      onLegacySubpathRewrite: (manifestPath) => rewrittenPackageManifests.add(manifestPath),
-    }),
+    plugins: createCliBundlePlugins(appRoot),
     // Allow JSON imports
     loader: { '.json': 'json' },
   })
@@ -512,7 +455,6 @@ async function compileAppSourceFileWithActiveEsbuild(
     dependencies: {
       ...collectDependencyHashes(appRoot, result.metafile.inputs),
       ...hashFilesRelativeTo(appRoot, tsconfigPaths),
-      ...hashFilesRelativeTo(appRoot, [...rewrittenPackageManifests]),
     },
   }
   fs.writeFileSync(metadataPath, JSON.stringify(metadata))

package/src/lib/bootstrap/factory.ts

@@ -143,14 +143,9 @@ async function registerWidgetsAndOptionalPackages(data: BootstrapData, options:
   // browser-facing UI registries. API-only bootstraps avoid loading @open-mercato/ui.
   try {
     const coreInjection = await import('@open-mercato/core/modules/widgets/lib/injection')
-    // A partitioned runtime still needs its own entries — server-side resolvers read this
-    // registry on request paths — it just must not shrink what a fuller partition already
-    // published in the same process. Merge does both; skipping registration altogether left
-    // API-only processes with an unregistered registry that throws on first read.
-    coreInjection.registerCoreInjectionWidgets(
-      data.injectionWidgetEntries,
-      options.skipCoreInjectionWidgets ? { mode: 'merge' } : undefined,
-    )
+    if (!options.skipCoreInjectionWidgets) {
+      coreInjection.registerCoreInjectionWidgets(data.injectionWidgetEntries)
+    }
     coreInjection.registerCoreInjectionTables(data.injectionTables, data.injectionWidgetEntries)
     coreInjection.registerEnabledModuleIds(
       data.modules.map((module) => module.id).filter((id): id is string => typeof id === 'string' && id.length > 0),

package/src/lib/bootstrap/types.ts

@@ -73,11 +73,7 @@ export interface BootstrapOptions {
   registrationKey?: string
   /** Skip browser-facing dashboard/injection registries in API-only runtimes. */
   skipUiRegistries?: boolean
-  /**
-   * Keep an existing core injection-widget registry intact in partitioned runtimes: this
-   * bootstrap's entries are merged in rather than published as the whole registry, so a
-   * partition that registers second never shrinks what the first one already exposed.
-   */
+  /** Keep an existing core injection-widget registry intact in partitioned runtimes. */
   skipCoreInjectionWidgets?: boolean
   onRegistrationComplete?: () => void
   appDiRegistrar?: AppDiRegistrar

package/src/lib/catalog-visibility/index.ts

@@ -3,5 +3,3 @@ export { matchesOne } from './matchesOne'
 export { matchesScope } from './matchesScope'
 export { unionScopes } from './unionScopes'
 export { intersectScopes } from './intersectScopes'
-export { canonicalizeEffectiveScope } from './canonicalizeEffectiveScope'
-export { hashEffectiveScope } from './hashEffectiveScope'

package/src/lib/commands/__tests__/command-bus.test.ts

@@ -7,7 +7,7 @@ import {
   isCommandInterceptorError,
 } from '@open-mercato/shared/lib/commands'
 import { registerCommandInterceptors } from '@open-mercato/shared/lib/commands/command-interceptor-store'
-import type { CommandInterceptor, CommandInterceptorContext } from '@open-mercato/shared/lib/commands/command-interceptor'
+import type { CommandInterceptor } from '@open-mercato/shared/lib/commands/command-interceptor'
 
 describe('CommandBus', () => {
   afterEach(() => {
@@ -296,57 +296,6 @@ describe('CommandBus', () => {
     )
   })
 
-  it('defers opted-in before snapshots until after the transactional write guard', async () => {
-    const calls: string[] = []
-    const transactionalEm = { id: 'transaction-em' }
-    const buildLogMock = jest.fn(() => ({
-      actionLabel: 'Transaction snapshot',
-      resourceKind: 'test',
-      resourceId: 'transactional',
-    }))
-    const prepare = jest.fn(async (_input, ctx) => {
-      calls.push('prepare')
-      expect(ctx.transactionalEm).toBe(transactionalEm)
-      return { before: { state: 'locked-before' } }
-    })
-
-    registerCommand({
-      id: 'test.command.transactional-snapshot',
-      prepare,
-      prepareSnapshotInsideTransaction: true,
-      execute: jest.fn(async (_input, ctx) => {
-        calls.push('execute')
-        await ctx.beforeTransactionalWrite?.(transactionalEm as never)
-        calls.push('mutate')
-        return { ok: true }
-      }),
-      buildLog: buildLogMock,
-    })
-
-    const logMock = jest.fn(async () => ({ id: 'transaction-log' }))
-    const container = createContainer({ injectionMode: InjectionMode.CLASSIC })
-    container.register({ actionLogService: asValue({ log: logMock }) })
-    const bus = new CommandBus()
-    const ctx = {
-      container,
-      auth: { sub: 'user-transaction', tenantId: 'tenant-transaction', orgId: null },
-      organizationScope: null,
-      selectedOrganizationId: null,
-      organizationIds: null,
-      beforeTransactionalWrite: jest.fn(async () => {
-        calls.push('lock')
-      }),
-    }
-
-    await bus.execute('test.command.transactional-snapshot', { input: {}, ctx })
-
-    expect(calls).toEqual(['execute', 'lock', 'prepare', 'mutate'])
-    expect(prepare).toHaveBeenCalledTimes(1)
-    expect(buildLogMock).toHaveBeenCalledWith(expect.objectContaining({
-      snapshots: { before: { state: 'locked-before' }, after: undefined },
-    }))
-  })
-
   it('loads a command file lazily before execution', async () => {
     const execute = jest.fn(async () => ({ ok: true }))
     registerCommandLoaders([
@@ -589,54 +538,6 @@ describe('CommandBus', () => {
   })
 
   describe('interceptor rejections', () => {
-    it('passes the original request to beforeExecute for preflight version checks', async () => {
-      registerCommand({ id: 'test.request-context', execute: jest.fn(async () => ({ ok: true })) })
-      const beforeExecute = jest.fn(async (_input: unknown, context: { request?: Request | null }) => {
-        expect(context.request?.headers.get('x-om-ext-optimistic-lock-expected-updated-at')).toBe('2026-09-29T11:00:00.000Z')
-        return { ok: false, status: 422 }
-      })
-      registerCommandInterceptors([{ moduleId: 'test', interceptors: [{
-        id: 'test.request-context-interceptor', targetCommand: 'test.request-context', beforeExecute,
-      }] }])
-      const request = new Request('http://localhost/test', { headers: { 'x-om-ext-optimistic-lock-expected-updated-at': '2026-09-29T11:00:00.000Z' } })
-      const container = createContainer({ injectionMode: InjectionMode.CLASSIC })
-      const bus = new CommandBus()
-      await expect(bus.execute('test.request-context', { input: {}, ctx: {
-        container,
-        auth: { sub: 'user-1', tenantId: 'tenant-1', orgId: null },
-        organizationScope: null,
-        selectedOrganizationId: null,
-        organizationIds: null,
-        request,
-      } })).rejects.toMatchObject({ status: 422 })
-      expect(beforeExecute).toHaveBeenCalledTimes(1)
-    })
-
-    it('passes request and organization scope to both execution lifecycle hooks', async () => {
-      registerCommand({ id: 'test.lifecycle-context', execute: async () => ({ ok: true }) })
-      const request = new Request('http://localhost/test')
-      const organizationScope = { selectedId: 'parent', filterIds: ['parent', 'child'], allowedIds: ['parent', 'child'], tenantId: 'tenant-1' }
-      const beforeExecute = jest.fn(async (_input: unknown, context: CommandInterceptorContext) => {
-        expect(context.request).toBe(request)
-        expect(context.organizationScope).toBe(organizationScope)
-        return { ok: true }
-      })
-      const afterExecute = jest.fn(async (_input: unknown, _result: unknown, context: CommandInterceptorContext) => {
-        expect(context.request).toBe(request)
-        expect(context.organizationScope).toBe(organizationScope)
-      })
-      registerCommandInterceptors([{ moduleId: 'test', interceptors: [{
-        id: 'test.lifecycle-context-interceptor', targetCommand: 'test.lifecycle-context', beforeExecute, afterExecute,
-      }] }])
-      await new CommandBus().execute('test.lifecycle-context', { input: {}, ctx: {
-        container: createContainer({ injectionMode: InjectionMode.CLASSIC }),
-        auth: { sub: 'user-1', tenantId: 'tenant-1', orgId: 'parent' },
-        organizationScope, selectedOrganizationId: 'parent', organizationIds: ['parent', 'child'], request,
-      } })
-      expect(beforeExecute).toHaveBeenCalledTimes(1)
-      expect(afterExecute).toHaveBeenCalledTimes(1)
-    })
-
     const blockingInterceptor = (result: Record<string, unknown>): CommandInterceptor => ({
       id: 'test.block',
       targetCommand: 'test.*',

package/src/lib/commands/command-bus.ts

@@ -297,8 +297,6 @@ export class CommandBus {
         auth: baseOptions.ctx.auth ?? null,
         selectedOrganizationId: baseOptions.ctx.selectedOrganizationId ?? baseOptions.ctx.auth?.orgId ?? null,
         container: baseOptions.ctx.container,
-        organizationScope: baseOptions.ctx.organizationScope ?? null,
-        request: baseOptions.ctx.request ?? null,
       }
       const beforeResult = await runCommandInterceptorsBefore(
         allInterceptors, commandId, baseOptions.input, interceptorCtx, resolvedUserFeatures,
@@ -340,40 +338,16 @@ export class CommandBus {
     }
 
     const executeCore = async (coreOptions: CommandExecutionOptions<TInput>) => {
-      const snapshots: { before?: unknown } = {}
-      let executionOptions = coreOptions
-      if (handler.prepareSnapshotInsideTransaction && handler.prepare) {
-        const prepare = handler.prepare
-        const originalCtx = coreOptions.ctx
-        const originalBeforeTransactionalWrite = originalCtx.beforeTransactionalWrite
-        let prepared = false
-        let transactionalCtx: CommandRuntimeContext
-        transactionalCtx = {
-          ...originalCtx,
-          beforeTransactionalWrite: async (em, input) => {
-            await originalBeforeTransactionalWrite?.(em, input)
-            if (prepared) return
-            Object.assign(
-              snapshots,
-              (await prepare(coreOptions.input, { ...transactionalCtx, transactionalEm: em })) ?? {},
-            )
-            prepared = true
-          },
-        }
-        executionOptions = { ...coreOptions, ctx: transactionalCtx }
-      } else {
-        Object.assign(snapshots, await this.prepareSnapshots(handler, coreOptions))
-      }
-      effectiveOptions = executionOptions
-      const sourceLog = executionOptions.redoLogEntry ?? null
+      const sourceLog = coreOptions.redoLogEntry ?? null
+      const snapshots = await this.prepareSnapshots(handler, coreOptions)
       const result =
         sourceLog && typeof handler.redo === 'function'
-          ? await handler.redo({ input: executionOptions.input, ctx: executionOptions.ctx, logEntry: sourceLog })
-          : await handler.execute(executionOptions.input, executionOptions.ctx)
-      const afterSnapshot = await this.captureAfter(handler, executionOptions, result)
+          ? await handler.redo({ input: coreOptions.input, ctx: coreOptions.ctx, logEntry: sourceLog })
+          : await handler.execute(coreOptions.input, coreOptions.ctx)
+      const afterSnapshot = await this.captureAfter(handler, coreOptions, result)
       const snapshotsWithAfter = { ...snapshots, after: afterSnapshot }
-      const logMeta = await this.buildLog(handler, executionOptions, result, snapshotsWithAfter)
-      let mergedMeta = this.mergeMetadata(executionOptions.metadata, logMeta)
+      const logMeta = await this.buildLog(handler, coreOptions, result, snapshotsWithAfter)
+      let mergedMeta = this.mergeMetadata(coreOptions.metadata, logMeta)
       // Interceptors opt into audit-log enrichment with a reserved `logContext` key rather
       // than the generic `context` one, so the metadata an interceptor already passes to its
       // own afterExecute hook is never silently promoted into audit storage.
@@ -388,7 +362,7 @@ export class CommandBus {
           ...logContextRecord,
         }
       }
-      const baseContext = asRecord(executionOptions.metadata?.context) ?? {}
+      const baseContext = asRecord(coreOptions.metadata?.context) ?? {}
       const logMetaContext = asRecord(logMeta?.context) ?? {}
       if (Object.keys(interceptorContextMerged).length > 0 || Object.keys(baseContext).length > 0 || Object.keys(logMetaContext).length > 0) {
         mergedMeta = mergedMeta ?? {}
@@ -402,7 +376,7 @@ export class CommandBus {
       if (undoable && mergedMeta?.replayable !== false) {
         mergedMeta = mergedMeta ?? {}
         if (!mergedMeta.undoToken) mergedMeta.undoToken = defaultUndoToken()
-        if (mergedMeta.actorUserId === undefined) mergedMeta.actorUserId = executionOptions.ctx.auth?.sub ?? null
+        if (mergedMeta.actorUserId === undefined) mergedMeta.actorUserId = coreOptions.ctx.auth?.sub ?? null
       } else if (mergedMeta?.replayable === false) {
         mergedMeta.undoToken = null
       }
@@ -431,7 +405,7 @@ export class CommandBus {
           if (inferred) mergedMeta.changes = inferred
         }
       }
-      const logEntry = await this.persistLog(commandId, executionOptions, mergedMeta)
+      const logEntry = await this.persistLog(commandId, coreOptions, mergedMeta)
       return { result, mergedMeta, logEntry }
     }
 
@@ -500,8 +474,6 @@ export class CommandBus {
           auth: effectiveOptions.ctx.auth ?? null,
           selectedOrganizationId: effectiveOptions.ctx.selectedOrganizationId ?? effectiveOptions.ctx.auth?.orgId ?? null,
           container: effectiveOptions.ctx.container,
-          organizationScope: effectiveOptions.ctx.organizationScope ?? null,
-          request: effectiveOptions.ctx.request ?? null,
         }
         const afterResult = await runCommandInterceptorsAfter(
           allInterceptors, commandId, effectiveOptions.input, result, interceptorCtx,
@@ -573,8 +545,6 @@ export class CommandBus {
         auth: replayCtx.auth ?? null,
         selectedOrganizationId: replayCtx.selectedOrganizationId ?? replayCtx.auth?.orgId ?? null,
         container: replayCtx.container,
-        organizationScope: replayCtx.organizationScope ?? null,
-        request: replayCtx.request ?? null,
       }
       const beforeResult = await runCommandInterceptorsBeforeUndo(
         allInterceptors, log.commandId, undoCtx, interceptorCtx, resolvedUserFeatures,
@@ -689,8 +659,6 @@ export class CommandBus {
           auth: ctx.auth ?? null,
           selectedOrganizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
           container: ctx.container,
-          organizationScope: ctx.organizationScope ?? null,
-          request: ctx.request ?? null,
         }
         await runCommandInterceptorsAfterUndo(
           allInterceptors, log.commandId, undoCtx, interceptorCtx,

package/src/lib/commands/command-interceptor.ts

@@ -1,5 +1,4 @@
 import type { AwilixContainer } from 'awilix'
-import type { OrganizationScope } from '@open-mercato/shared/lib/auth/principal-service'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 
 export interface CommandInterceptor {
@@ -48,11 +47,8 @@ export interface CommandInterceptorContext {
   auth: AuthContext | null
   /** Selected organization ID */
   selectedOrganizationId: string | null
-  organizationScope?: OrganizationScope | null
   /** DI container (read-only usage recommended) */
   container: AwilixContainer
-  /** Original request, when the command was called through HTTP. */
-  request?: Request | null
   /** Metadata passthrough from beforeExecute to afterExecute (or beforeUndo to afterUndo) */
   metadata?: Record<string, unknown>
 }

package/src/lib/commands/types.ts

@@ -67,14 +67,6 @@ export type CommandRuntimeContext = {
    * surrounding work as a single atomic, single-locked operation.
    */
   transactionalEm?: EntityManager
-  /**
-   * Optional server-side guard that supported command handlers invoke after
-   * opening their write transaction and before reading or mutating records.
-   * The guard receives that same transaction-bound EntityManager and, when the
-   * handler provides it, the final input after command interceptors. The input
-   * stays optional so existing handlers and callers remain source-compatible.
-   */
-  beforeTransactionalWrite?: (em: EntityManager, input?: unknown) => Promise<void>
   /**
    * Identifies the owner of an already-active {@link transactionalEm} lifetime.
    * Atomic replay accepts an ambient EntityManager only when this is the exact
@@ -251,12 +243,6 @@ export interface CommandHandler<TInput = unknown, TResult = unknown> {
    */
   readonly outputSchema?: ZodTypeAny
   prepare?(input: TInput, ctx: CommandRuntimeContext): Promise<{ before?: unknown } | null> | { before?: unknown } | null
-  /**
-   * Opt in to taking the undo snapshot inside the write transaction. The bus
-   * defers `prepare()` into `ctx.beforeTransactionalWrite`, after the handler's
-   * transaction guard and before its first read or mutation.
-   */
-  readonly prepareSnapshotInsideTransaction?: boolean
   execute(input: TInput, ctx: CommandRuntimeContext): Promise<TResult> | TResult
   buildLog?(args: CommandLogBuilderArgs<TInput, TResult>): Promise<CommandLogMetadata | null | undefined> | CommandLogMetadata | null | undefined
   captureAfter?(input: TInput, result: TResult, ctx: CommandRuntimeContext): Promise<unknown> | unknown

package/src/lib/crud/__tests__/exporters.test.ts

@@ -28,22 +28,4 @@ describe('CRUD export serializers', () => {
       '"\'\t=HYPERLINK(""https://example.invalid"")","\'\r+1+1",\'-7',
     ])
   })
-
-  it('escapes and neutralizes CSV header cells the same way as data cells', () => {
-    const serialized = serializeExport({
-      columns: [
-        { field: 'company', header: 'Name, Inc.' },
-        { field: 'formula', header: '=HEADER' },
-        { field: 'plain', header: 'Balance' },
-      ],
-      rows: [
-        { company: 'Acme', formula: 'ok', plain: 1 },
-      ],
-    }, 'csv')
-
-    expect(serialized.body.split('\n')).toEqual([
-      '"Name, Inc.",\'=HEADER,Balance',
-      'Acme,ok,1',
-    ])
-  })
 })