create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/lib/auth-email-budget.ts

@@ -1,161 +0,0 @@
-/**
- * Per-recipient hourly send budget for the auth transactional-email relay
- * (#5962 § D8c).
- *
- * WHY IT IS PER RECIPIENT AND NOT PER SITE. The first draft of #5962's spec
- * carried a second, site-wide cap. It was removed, and its removal is the
- * point of this module's shape: Better Auth writes the `Verification` row
- * BEFORE it invokes `sendResetPassword`, so every attacker request both feeds
- * a site-wide counter and refreshes its window — roughly one request per 72
- * seconds would hold a site permanently at its cap and silence reset mail for
- * EVERY user, indefinitely. A site-wide cap an attacker can hold open is a
- * denial of the control it implements. `siteVolumeAlert()` below replaces it
- * with an operator SIGNAL that never refuses a send.
- *
- * The per-recipient budget IS a lockout weapon, narrowly: an attacker who
- * requests three resets for one address in an hour denies that person a reset
- * for the rest of it. Accepted for the reason
- * `services/project-listing-resume-email.ts` gives and this module can
- * honestly claim — the window is an hour rather than forever, it clears
- * itself, and it is bounded to ONE victim rather than to the whole site.
- *
- * SINGLE-REPLICA CAVEAT, stated rather than hidden: the store is an in-process
- * Map, so on an N-instance deployment the effective ceiling is N × the cap.
- * Identical to the caveat `middleware/rate-limit.ts` documents for itself. The
- * durable alternative needs a table `database/auth/schema.prisma` does not
- * have, and #5962 adds no migration (Q16).
- *
- * PII: the key is `sha256(lowercased recipient + ":" + kind)`. This module is
- * memory an operator can dump, and a plaintext address in it would be a
- * recipient list.
- */
-
-import { createHash } from "node:crypto";
-
-import { getClock } from "@working-theory/common";
-
-/** The four fixed message kinds the relay will send. */
-export type AuthEmailKind =
-  | "password-reset"
-  | "email-verification"
-  | "password-changed"
-  | "magic-link";
-
-/** Sends allowed per (recipient, kind) per hour. */
-export const RECIPIENT_HOURLY_MAX = 3;
-
-/**
- * Sends per hour, site-wide, past which ONE operator warning is logged. Never
- * a refusal — see the module comment.
- */
-export const SITE_HOURLY_ALERT_THRESHOLD = 50;
-
-const WINDOW_MS = 60 * 60 * 1000;
-
-/**
- * Cap on distinct entries, independent of the time-based window. The key is
- * derived from a caller-supplied address, so a caller minting a fresh address
- * per request would otherwise grow the map without bound for the lifetime of
- * one isolate. Same reasoning, same shape, as `rate-limit.ts`'s MAX_BUCKETS.
- */
-export const MAX_BUCKETS = 10_000;
-
-type Bucket = { count: number; windowStartMs: number };
-
-const buckets = new Map<string, Bucket>();
-
-let siteWindowStartMs = 0;
-let siteCount = 0;
-let siteAlertedThisWindow = false;
-
-export interface BudgetOptions {
-  /** Explicit clock reading. Defaults to `getClock().now()`. Tests inject it. */
-  nowMs?: number;
-  /** Entry cap. Exposed for tests only — no production caller overrides it. */
-  maxBuckets?: number;
-}
-
-function bucketKey(recipient: string, kind: AuthEmailKind): string {
-  const normalized = recipient.trim().toLowerCase();
-  return createHash("sha256").update(`${normalized}:${kind}`).digest("hex");
-}
-
-/**
- * Counts one send against `(recipient, kind)` and reports whether it may
- * proceed.
- *
- * `false` means SUPPRESS THE SEND — it never means "tell the caller". The
- * relay answers 202 either way, because an observable suppression is the same
- * account-enumeration oracle the rest of this flow is built to close.
- */
-export function consumeRecipientBudget(
-  recipient: string,
-  kind: AuthEmailKind,
-  options: BudgetOptions = {},
-): boolean {
-  const now = options.nowMs ?? getClock().now();
-  const maxBuckets = options.maxBuckets ?? MAX_BUCKETS;
-  const key = bucketKey(recipient, kind);
-
-  let bucket = buckets.get(key);
-
-  if (!bucket || now - bucket.windowStartMs >= WINDOW_MS) {
-    // A genuinely new identity at capacity evicts the single oldest-inserted
-    // entry (`Map` iteration order is insertion order) before inserting
-    // itself — O(1) amortized, and no behaviour change under the cap.
-    if (!buckets.has(key) && buckets.size >= maxBuckets) {
-      const oldestKey = buckets.keys().next().value;
-      if (oldestKey !== undefined) buckets.delete(oldestKey);
-    }
-    bucket = { count: 0, windowStartMs: now };
-    buckets.set(key, bucket);
-  }
-
-  if (bucket.count >= RECIPIENT_HOURLY_MAX) return false;
-
-  bucket.count += 1;
-  return true;
-}
-
-/**
- * Counts one send site-wide and reports whether THIS call is the one that
- * should emit the hourly operator warning.
- *
- * It is a signal, not a gate: nothing in this module consults its return value
- * to deny a send, and nothing may be added that does.
- */
-export function siteVolumeAlert(options: BudgetOptions = {}): boolean {
-  const now = options.nowMs ?? getClock().now();
-
-  if (now - siteWindowStartMs >= WINDOW_MS) {
-    siteWindowStartMs = now;
-    siteCount = 0;
-    siteAlertedThisWindow = false;
-  }
-
-  siteCount += 1;
-
-  if (siteCount >= SITE_HOURLY_ALERT_THRESHOLD && !siteAlertedThisWindow) {
-    siteAlertedThisWindow = true;
-    return true;
-  }
-  return false;
-}
-
-/** Test-only reset. Not intended for production use. */
-export function __resetAuthEmailBudget(): void {
-  buckets.clear();
-  siteWindowStartMs = 0;
-  siteCount = 0;
-  siteAlertedThisWindow = false;
-}
-
-/** Test-only accessor for the distinct-bucket count. */
-export function __authEmailBucketCount(): number {
-  return buckets.size;
-}
-
-/** Test-only accessor proving the stored keys carry no plaintext address. */
-export function __authEmailBudgetKeys(): string[] {
-  return [...buckets.keys()];
-}

package/templates/apps/api/src/lib/consent-store.ts

@@ -1,363 +0,0 @@
-/**
- * The consent ledger's read boundary (#8438, spec
- * docs/specs/8438-consent-registry-and-ledger-step-spec.md D4).
- *
- * `consent_grants` is append-only and a Person's current state is the newest
- * row per purpose, so every reader here asks the database for exactly that.
- * Nothing is read through a window: `DISTINCT ON (purpose_id) … ORDER BY
- * purpose_id, created_at DESC, id DESC` is one indexed pass over ALL the
- * matching rows, so no number of other rows can push an answer out
- * (SEC-8438-2).
- *
- * TWO READINGS of a Person's rows (SEC-8438-1). A Person is keyed on an email
- * anyone can type into a form, so a row an anonymous writer attached to it
- * proves nothing about what the person themself chose:
- *
- *   - OWN rows: `person_id = P` and a source only a verified caller or a
- *     signed link sent to the person can write — `sign_up`,
- *     `account_settings`, `email_unsubscribe` (`OWN_CONSENT_SOURCES`). The
- *     member's screens, the sign-up prompt, and every future send read only
- *     these.
- *   - ANY-SOURCE rows: every row with `person_id = P`, plus the cookie rows
- *     of every visitor linked to P. The operator's Person page reads these,
- *     marked `unverified` when the source proves nothing.
- *
- * Every query takes an explicit `workspaceId`, and a join to a linked
- * visitor's rows matches `workspace_id` on both tables (SEC-8438-11) — a
- * visitor id is client-chosen and not namespaced, so another tenant's rows
- * under the same id must never join.
- *
- * This file is the ONLY non-test reader of `consent_grants` and
- * `consent_visitor_links` (`architecture.yaml` names it as a data-access
- * boundary, the kind `member-store.ts` is). The writes are
- * `services/consent.ts`. Logs carry nothing: no email, visitor id, token or
- * statement.
- */
-import type { Prisma } from "@working-theory/database";
-import {
-  consentPurposeKind,
-  type ConsentPurposeKind,
-  type ConsentSource,
-  type SiteConsentConfig,
-} from "@working-theory/validation";
-
-import { prisma } from "./prisma.js";
-
-/** What every reader needs of a client: raw reads only. */
-export type ConsentReadClient = Pick<Prisma.TransactionClient, "$queryRaw">;
-
-/**
- * The sources only a verified caller or a signed link can write (D4,
- * SEC-8438-1). The SQL below names the same three literals; the store's test
- * asserts the two agree.
- */
-export const OWN_CONSENT_SOURCES = [
-  "sign_up",
-  "account_settings",
-  "email_unsubscribe",
-] as const satisfies readonly ConsentSource[];
-
-/** The sources whose rows prove nothing the client confirmed themself. */
-const UNVERIFIED_SOURCES: ReadonlySet<ConsentSource> = new Set([
-  "magnet",
-  "api",
-  "cookie_banner",
-  "legacy",
-  // #8765 D13, C10: the payer at a Stripe Checkout is not a signed-in user.
-  "checkout",
-]);
-
-/** Whether a row from `source` is unconfirmed by the client (D4). */
-export function isUnverifiedSource(source: ConsentSource): boolean {
-  return UNVERIFIED_SOURCES.has(source);
-}
-
-/** A history page's size (D7). */
-export const CONSENT_HISTORY_PAGE_SIZE = 500;
-
-/** The most platform rows one user can have in view (D4). */
-const PLATFORM_ROWS_MAX = 100;
-
-/** The newest ledger row for one purpose, as the readers serve it. */
-export interface ConsentStateRow {
-  id: string;
-  purposeId: string;
-  granted: boolean;
-  at: Date;
-  source: ConsentSource;
-  sourceRef: string | null;
-  policyVersion: number | null;
-}
-
-export interface ConsentHistoryRow extends ConsentStateRow {
-  locale: string;
-  statement: string;
-  subjectType: string;
-}
-
-/** A registry purpose with the newest row read for it and what that means now. */
-export interface PurposeConsentState {
-  purposeId: string;
-  kind: ConsentPurposeKind;
-  row: ConsentStateRow | null;
-  /** Granted now: the row's answer, else on for a preference and off otherwise. */
-  effective: boolean;
-}
-
-/** The effective answer for a purpose given its newest row (D4). */
-export function effectiveConsent(
-  kind: ConsentPurposeKind,
-  row: { granted: boolean } | null,
-): boolean {
-  if (row !== null) return row.granted;
-  return kind === "preference";
-}
-
-/** Fold the newest row per purpose id into the registry's purposes. */
-export function foldRowsIntoPurposes(
-  config: SiteConsentConfig,
-  rows: readonly ConsentStateRow[],
-): PurposeConsentState[] {
-  const byPurpose = new Map(rows.map((row) => [row.purposeId, row]));
-  return config.purposes.map((purpose) => {
-    const kind = consentPurposeKind(purpose);
-    const row = byPurpose.get(purpose.id) ?? null;
-    return {
-      purposeId: purpose.id,
-      kind,
-      row,
-      effective: effectiveConsent(kind, row),
-    };
-  });
-}
-
-/**
- * The newest OWN row per purpose id for a Person, unfolded (D4): one indexed
- * `DISTINCT ON` pass over all own rows, never a window.
- */
-export async function ownConsentRows(
-  workspaceId: string,
-  personId: string,
-  db: ConsentReadClient = prisma,
-): Promise<ConsentStateRow[]> {
-  return db.$queryRaw<ConsentStateRow[]>`
-    SELECT DISTINCT ON (g."purpose_id")
-      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
-      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
-    FROM "consent_grants" g
-    WHERE g."workspace_id" = ${workspaceId}
-      AND g."person_id" = ${personId}
-      AND g."source" IN ('sign_up', 'account_settings', 'email_unsubscribe')
-    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC`;
-}
-
-/**
- * The newest ANY-SOURCE row per purpose id for a Person: `person_id = P` or a
- * cookie row of a visitor linked to P, in this workspace on both tables.
- * Includes purposes the registry no longer declares — the operator still sees
- * what was recorded.
- */
-export async function anySourceConsentRows(
-  workspaceId: string,
-  personId: string,
-  db: ConsentReadClient = prisma,
-): Promise<ConsentStateRow[]> {
-  return db.$queryRaw<ConsentStateRow[]>`
-    SELECT DISTINCT ON (g."purpose_id")
-      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
-      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
-    FROM "consent_grants" g
-    WHERE g."workspace_id" = ${workspaceId}
-      AND (
-        g."person_id" = ${personId}
-        OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
-          SELECT l."visitor_id" FROM "consent_visitor_links" l
-          WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
-        ))
-      )
-    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC`;
-}
-
-/**
- * Whether this Person already holds the `checkout` row of one Checkout
- * Session for one purpose (#8765 D14, NFR7) — the webhook's replay check.
- * Filters on `(workspace_id, person_id, purpose_id)` first, so the existing
- * `(workspace_id, person_id, purpose_id, created_at)` index serves it
- * (SEC-8765-N).
- */
-export async function personHasCheckoutGrant(
-  workspaceId: string,
-  personId: string,
-  purposeId: string,
-  sessionId: string,
-  db: ConsentReadClient = prisma,
-): Promise<boolean> {
-  const rows = await db.$queryRaw<Array<{ found: number }>>`
-    SELECT 1 AS "found"
-    FROM "consent_grants" g
-    WHERE g."workspace_id" = ${workspaceId}
-      AND g."person_id" = ${personId}
-      AND g."purpose_id" = ${purposeId}
-      AND g."source" = 'checkout'
-      AND g."source_ref" = ${sessionId}
-    LIMIT 1`;
-  return rows.length > 0;
-}
-
-/**
- * A Person's OWN reading, per registry purpose (D4). The member's screens and
- * the sign-up prompt read only this.
- */
-export async function ownConsentState(
-  workspaceId: string,
-  personId: string,
-  config: SiteConsentConfig,
-  db: ConsentReadClient = prisma,
-): Promise<PurposeConsentState[]> {
-  return foldRowsIntoPurposes(
-    config,
-    await ownConsentRows(workspaceId, personId, db),
-  );
-}
-
-/**
- * A Person's ANY-SOURCE reading, per registry purpose. The operator's Person
- * page and the unsubscribe dedupe read it; a row here is never a member's own
- * answer (D4).
- */
-export async function anySourceConsentState(
-  workspaceId: string,
-  personId: string,
-  config: SiteConsentConfig,
-  db: ConsentReadClient = prisma,
-): Promise<PurposeConsentState[]> {
-  return foldRowsIntoPurposes(
-    config,
-    await anySourceConsentRows(workspaceId, personId, db),
-  );
-}
-
-/** One page of a Person's any-source history, newest first. */
-export interface ConsentHistoryPage {
-  rows: ConsentHistoryRow[];
-  /** The id of the page's last row when another page follows, else `null`. */
-  nextCursor: string | null;
-}
-
-/**
- * A Person's any-source history, 500 rows a page, newest first, keyed by
- * `(created_at, id)`. Every page is complete: nothing is truncated (D7).
- * Returns `"invalid_cursor"` for a cursor that is not one of this Person's
- * rows — checked inside the Person's own scope, so a row id of another
- * Person or workspace reads exactly like an unknown one.
- */
-export async function personConsentHistory(
-  workspaceId: string,
-  personId: string,
-  cursor: string | undefined,
-  db: ConsentReadClient = prisma,
-): Promise<ConsentHistoryPage | "invalid_cursor"> {
-  if (cursor !== undefined) {
-    const found = await db.$queryRaw<Array<{ id: string }>>`
-      SELECT g."id" FROM "consent_grants" g
-      WHERE g."workspace_id" = ${workspaceId}
-        AND g."id" = ${cursor}
-        AND (
-          g."person_id" = ${personId}
-          OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
-            SELECT l."visitor_id" FROM "consent_visitor_links" l
-            WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
-          ))
-        )
-      LIMIT 1`;
-    if (found.length === 0) return "invalid_cursor";
-  }
-  const cursorId = cursor ?? null;
-  const rows = await db.$queryRaw<ConsentHistoryRow[]>`
-    SELECT g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
-      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion",
-      g."locale", g."statement", g."subject_type" AS "subjectType"
-    FROM "consent_grants" g
-    WHERE g."workspace_id" = ${workspaceId}
-      AND (
-        g."person_id" = ${personId}
-        OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
-          SELECT l."visitor_id" FROM "consent_visitor_links" l
-          WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
-        ))
-      )
-      AND (${cursorId}::text IS NULL OR (g."created_at", g."id") < (
-        SELECT c."created_at", c."id" FROM "consent_grants" c WHERE c."id" = ${cursorId}::text
-      ))
-    ORDER BY g."created_at" DESC, g."id" DESC
-    LIMIT ${CONSENT_HISTORY_PAGE_SIZE + 1}`;
-  const page = rows.slice(0, CONSENT_HISTORY_PAGE_SIZE);
-  const last = page[page.length - 1];
-  return {
-    rows: page,
-    nextCursor:
-      rows.length > CONSENT_HISTORY_PAGE_SIZE && last ? last.id : null,
-  };
-}
-
-/**
- * The newest row recording a visitor's choice for one purpose — the cookie
- * writer's dedupe: each CHANGE of choice is logged, a replay adds nothing
- * (D3, SEC-8438-2).
- */
-export async function latestVisitorChoice(
-  workspaceId: string,
-  visitorId: string,
-  purposeId: string,
-  db: ConsentReadClient = prisma,
-): Promise<{ granted: boolean; policyVersion: number | null } | null> {
-  const rows = await db.$queryRaw<
-    Array<{ granted: boolean; policyVersion: number | null }>
-  >`
-    SELECT g."granted", g."policy_version" AS "policyVersion"
-    FROM "consent_grants" g
-    WHERE g."workspace_id" = ${workspaceId}
-      AND g."subject_type" = 'visitor'
-      AND g."subject_id" = ${visitorId}
-      AND g."purpose_id" = ${purposeId}
-    ORDER BY g."created_at" DESC, g."id" DESC
-    LIMIT 1`;
-  return rows[0] ?? null;
-}
-
-/**
- * When the caller's own `User` row was created — the sign-up window's only
- * input (SEC-8438-5: `via: "sign_up"` is honored for a user created within
- * the last 24 hours). `null` when no such user exists.
- */
-export async function userCreatedAt(
-  userId: string,
-  db: Pick<Prisma.TransactionClient, "user"> = prisma,
-): Promise<Date | null> {
-  const user = await db.user.findUnique({
-    where: { id: userId },
-    select: { createdAt: true },
-  });
-  return user?.createdAt ?? null;
-}
-
-/**
- * The owner's rows for the Working Theory platform purposes (C8): subject
- * `user` / `userId`, newest per purpose, at most 100.
- */
-export async function userPlatformRows(
-  workspaceId: string,
-  userId: string,
-  db: ConsentReadClient = prisma,
-): Promise<ConsentStateRow[]> {
-  return db.$queryRaw<ConsentStateRow[]>`
-    SELECT DISTINCT ON (g."purpose_id")
-      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
-      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
-    FROM "consent_grants" g
-    WHERE g."workspace_id" = ${workspaceId}
-      AND g."subject_type" = 'user'
-      AND g."subject_id" = ${userId}
-    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC
-    LIMIT ${PLATFORM_ROWS_MAX}`;
-}

package/templates/apps/api/src/lib/content-adapter.ts

@@ -1,112 +0,0 @@
-/**
- * Shared content adapter singleton for apps/api.
- *
- * Adapter selection is NOT decided here — it is `resolveContentAdapter()`'s job
- * (#5804, roadmap D3: one resolver, one env var). This module supplies the
- * app's own inputs (content root, default locale, manifest path, the projection
- * factory) and memoises the result for the process.
- *
- * `CONTENT_ADAPTER` selects: `mdx` (default) | `projection` | `database`.
- * `CONTENT_BACKEND` is read for one more release by the resolver's shim.
- *
- * Content-root resolution order:
- *   1. `CONTENT_ROOT` env var (explicit override — recommended for production)
- *   2. `<cwd>/content` (works when the server is started from the repo root)
- *   3. `<cwd>/../../content` (works when started from `apps/api/` via pnpm)
- *
- * Manifest-path resolution (projection only):
- *   1. `MANIFEST_PATH` env var (explicit override)
- *   2. `<content-root>/.compiled/manifest.json` (the resolver's default)
- *
- * `workspaceId` is supplied by the CALLER, never read here (#5852). A public
- * read resolves its workspace through `services/public-site-resolver.ts` and
- * passes the result in; a caller that passes none still raises the resolver's
- * "workspaceId required" error under `CONTENT_ADAPTER=database`, rather than
- * silently reading some other workspace's pages. There is no local ADAPTER memo
- * slot: `resolveContentAdapter()` already memoises on the full key
- * (kind + workspaceId + root + locale + manifest), and a second cache keyed on
- * less than that is how one workspace's adapter reaches the next request. This
- * module's own INPUTS — the content root and the default locale, both
- * workspace-independent and both fixed for the process — stay memoised, so a
- * public read costs no more filesystem work than it did before the seam widened.
- */
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-
-import {
-  resetResolvedContentAdapter,
-  resolveContentAdapter,
-  type ArtifactPrismaClient,
-  type ContentAdapter,
-  type MdxContentAdapter,
-} from "@working-theory/content-adapters";
-import { createProjectionAdapter } from "@working-theory/content-projection";
-import { loadManifestFromDisk } from "@working-theory/content-projection/node";
-
-import { readDefaultLocale } from "./locales.js";
-
-/** Process-fixed inputs, resolved once: neither depends on the workspace. */
-let memoisedContentRoot: string | undefined;
-let memoisedDefaultLocale: string | undefined;
-
-/** Caller-supplied inputs; everything else is this module's own (#5852 D5). */
-export interface GetContentAdapterOptions {
-  /** The resolved tenant. Required by `CONTENT_ADAPTER=database`, ignored otherwise. */
-  workspaceId?: string | undefined;
-  /** apps/api's client. The database adapter never constructs one. */
-  prisma?: ArtifactPrismaClient | undefined;
-}
-
-/**
- * Resolve the content root. Honours `CONTENT_ROOT` env first, then probes the
- * cwd-relative candidates above.
- */
-export function getContentRoot(): string {
-  if (process.env.CONTENT_ROOT) return process.env.CONTENT_ROOT;
-
-  const cwd = process.cwd();
-  const cwdContent = resolve(cwd, "content");
-  const repoContent = resolve(cwd, "../../content");
-  if (existsSync(cwdContent)) return cwdContent;
-  if (existsSync(repoContent)) return repoContent;
-  // Last resort — cwd-relative, even if missing. The adapter will return
-  // null/empty for missing pages; routes will surface 404s.
-  return cwdContent;
-}
-
-/**
- * Returns the content adapter for the given tenant, memoised by the resolver.
- * Safe to call repeatedly. Adapter type is determined by `CONTENT_ADAPTER` env,
- * read by the resolver.
- */
-export function getContentAdapter(
-  options: GetContentAdapterOptions = {},
-): ContentAdapter {
-  memoisedContentRoot ??= getContentRoot();
-  memoisedDefaultLocale ??= readDefaultLocale();
-
-  return resolveContentAdapter({
-    workspaceId: options.workspaceId,
-    prisma: options.prisma,
-    contentRoot: memoisedContentRoot,
-    defaultLocale: memoisedDefaultLocale,
-    manifestPath: process.env.MANIFEST_PATH,
-    // The projection adapter lives in a package that depends on
-    // content-adapters, so the resolver cannot import it without closing a
-    // cycle. apps/api depends on both, and injects it.
-    createProjectionAdapter: (manifestPath) =>
-      createProjectionAdapter({ manifest: loadManifestFromDisk(manifestPath) }),
-  });
-}
-
-/**
- * Test/utility helper — drop the memoised adapter so the next call rebuilds
- * with current env. Not used in production.
- */
-export function resetContentAdapter(): void {
-  memoisedContentRoot = undefined;
-  memoisedDefaultLocale = undefined;
-  resetResolvedContentAdapter();
-}
-
-export type { MdxContentAdapter };