refactor: purge dead code and duplication, enforce quality guardrails

.github/workflows/quality-audit.yml

@@ -1,4 +1,4 @@
-name: Quality Audit Reports
+name: Quality Audit
 
 on:
   pull_request:
@@ -22,7 +22,7 @@ concurrency:
 
 jobs:
   quality-audit:
-    name: Quality Audit (report only)
+    name: Quality Audit Guardrails
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -52,14 +52,17 @@ jobs:
       - name: Install dependencies without lifecycle scripts
         run: mise exec -- pnpm install --frozen-lockfile --ignore-scripts
 
-      - name: Verify audit runner behavior
+      - name: Verify audit runner and gate behavior
         run: mise exec -- pnpm quality:audit:test
 
       # Findings succeed; invalid or incomplete analysis fails visibly.
       - name: Audit unused code, duplication, and complexity
         id: audit
         run: mise exec -- pnpm quality:audit --output .codex/reports/quality-audit
 
+      - name: Enforce calibrated quality guardrails
+        run: mise exec -- pnpm quality:audit:gate --summary .codex/reports/quality-audit/summary.json
+
       - name: Publish job summary
         if: ${{ always() && steps.prepare.outcome == 'success' }}
         run: |

app/apps/shell-super-app/api/auth/api-key-service.ts

@@ -39,7 +39,7 @@ const ApiKeyCredentialInvalidErrorSchema = Schema.TaggedStruct(
   'ApiKeyCredentialInvalidError',
   apiKeyCredentialInvalidFields,
 );
-export const ApiKeyCredentialInvalidError = Schema.TaggedError<
+const ApiKeyCredentialInvalidError = Schema.TaggedError<
   Schema.Schema.Type<typeof ApiKeyCredentialInvalidErrorSchema>
 >()('ApiKeyCredentialInvalidError', apiKeyCredentialInvalidFields);
 const apiKeyRateLimitedFields = {
@@ -51,7 +51,7 @@ const ApiKeyRateLimitedErrorSchema = Schema.TaggedStruct(
   'ApiKeyRateLimitedError',
   apiKeyRateLimitedFields,
 );
-export const ApiKeyRateLimitedError = Schema.TaggedError<
+const ApiKeyRateLimitedError = Schema.TaggedError<
   Schema.Schema.Type<typeof ApiKeyRateLimitedErrorSchema>
 >()('ApiKeyRateLimitedError', apiKeyRateLimitedFields);
 const apiKeyProviderUnavailableFields = {
@@ -101,7 +101,7 @@ export interface IssuedApiKey extends ProviderApiKeyMetadata {
 export interface VerifiedApiKey {
   readonly providerKeyId: string;
 }
-export interface PendingApiKeyCleanupBatch {
+interface PendingApiKeyCleanupBatch {
   readonly hasMore: boolean;
   readonly providerKeyIds: readonly string[];
 }

app/apps/shell-super-app/api/auth/config.ts

@@ -1,23 +1,12 @@
-import { APP_ENV_PATH } from '@app/core-runtime/workspace-environment';
-import { NodeFileSystem } from '@effect/platform-node';
-import {
-  Config,
-  ConfigProvider,
-  Context,
-  Effect,
-  FileSystem,
-  Layer,
-  Predicate,
-  Redacted,
-  Schema,
-} from 'effect';
-
-export const AuthConfigError = Schema.TaggedError<unknown>()('AuthConfigError', {
+import { loadConfigurationProvider } from './configuration-provider.ts';
+import { Config, ConfigProvider, Context, Effect, Layer, Redacted, Schema } from 'effect';
+
+const AuthConfigError = Schema.TaggedError<unknown>()('AuthConfigError', {
   reason: Schema.String,
 });
 type AuthConfigFailure = InstanceType<typeof AuthConfigError>;
 
-export const ROOT_ENV_PATH = APP_ENV_PATH;
+export { APP_ENV_PATH as ROOT_ENV_PATH } from '@app/core-runtime/workspace-environment';
 
 const EnvironmentKeySchema = Schema.Literals([
   'BETTER_AUTH_SECRET',
@@ -132,54 +121,21 @@ const parseAuthConfigFromProvider = Effect.fn('AuthConfig.parseAuthConfigFromPro
   },
 );
 
-const environmentProvider = (environment: Environment): ConfigProvider.ConfigProvider =>
-  ConfigProvider.fromEnvRecord({
-    BETTER_AUTH_SECRET: environment.BETTER_AUTH_SECRET,
-    BETTER_AUTH_SUPPORT_USER_IDS: environment.BETTER_AUTH_SUPPORT_USER_IDS,
-    BETTER_AUTH_TRUSTED_ORIGINS: environment.BETTER_AUTH_TRUSTED_ORIGINS,
-    BETTER_AUTH_URL: environment.BETTER_AUTH_URL,
-    DATABASE_URL: environment.DATABASE_URL,
-    NODE_ENV: environment.NODE_ENV,
-  });
-
 export const parseAuthConfig = (
   environment: Environment,
 ): Effect.Effect<AuthConfigValue, AuthConfigFailure> =>
-  parseAuthConfigFromProvider(environmentProvider(environment));
+  parseAuthConfigFromProvider(ConfigProvider.fromEnvRecord(environment));
 
 export interface LoadAuthConfigOptions {
   readonly environment?: Environment;
   readonly envPath?: string;
 }
 
-const loadFileProvider = (
-  envPath: string,
-): Effect.Effect<ConfigProvider.ConfigProvider, AuthConfigFailure> =>
-  Effect.scoped(
-    Layer.build(NodeFileSystem.layer).pipe(
-      Effect.map((services) => Context.get(services, FileSystem.FileSystem)),
-      Effect.flatMap((fileSystem) => fileSystem.readFileString(envPath)),
-      Effect.catchIf(
-        (error) => Predicate.isTagged(error.reason, 'NotFound'),
-        () => Effect.succeed(''),
-      ),
-      Effect.catchTag('PlatformError', () => Effect.fail(unableToLoadEnvironment())),
-      Effect.map((contents) => ConfigProvider.fromDotEnvContents(contents)),
-    ),
-  );
-
 export const loadAuthConfig = (
   options: LoadAuthConfigOptions = {},
 ): Effect.Effect<AuthConfigValue, AuthConfigFailure> =>
-  loadFileProvider(options.envPath ?? ROOT_ENV_PATH).pipe(
-    Effect.flatMap((fileProvider) =>
-      parseAuthConfigFromProvider(
-        (options.environment === undefined
-          ? ConfigProvider.fromEnv()
-          : environmentProvider(options.environment)
-        ).pipe(ConfigProvider.orElse(fileProvider)),
-      ),
-    ),
+  loadConfigurationProvider(options, unableToLoadEnvironment).pipe(
+    Effect.flatMap(parseAuthConfigFromProvider),
   );
 
 export const AuthConfigLive = Layer.effect(AuthConfig, loadAuthConfig());

app/apps/shell-super-app/api/auth/configuration-provider.ts

@@ -0,0 +1,21 @@
+import { APP_ENV_PATH } from '@app/core-runtime/workspace-environment';
+import { ConfigProvider, Effect } from 'effect';
+import { loadEnvironmentFileProvider } from './environment-file-provider.ts';
+
+interface LoadConfigurationOptions<Key extends string> {
+  readonly environment?: Readonly<Partial<Record<Key, string>>>;
+  readonly envPath?: string;
+}
+
+export const loadConfigurationProvider = <Key extends string, Failure>(
+  options: LoadConfigurationOptions<Key>,
+  unableToLoadEnvironment: () => Failure,
+): Effect.Effect<ConfigProvider.ConfigProvider, Failure> =>
+  loadEnvironmentFileProvider(options.envPath ?? APP_ENV_PATH, unableToLoadEnvironment).pipe(
+    Effect.map((fileProvider) =>
+      (options.environment === undefined
+        ? ConfigProvider.fromEnv()
+        : ConfigProvider.fromEnvRecord(options.environment)
+      ).pipe(ConfigProvider.orElse(fileProvider)),
+    ),
+  );

app/apps/shell-super-app/api/auth/db/catalog.ts

@@ -4,9 +4,9 @@ export const expectedAuthTableCatalog = AUTH_TABLE_INVENTORY.map(
   (tableName) => `${AUTH_SCHEMA_NAME}.${tableName}`,
 );
 
-export interface AuthCatalogDifference {
-  readonly missing: readonly string[];
-  readonly unexpected: readonly string[];
+interface AuthCatalogDifference {
+  readonly missing: string[];
+  readonly unexpected: string[];
 }
 
 export const compareAuthCatalog = (
@@ -16,7 +16,7 @@ export const compareAuthCatalog = (
   const expected = new Set(expectedAuthTableCatalog);
 
   return {
-    missing: [...expected].filter((name) => !actual.has(name)).toSorted(),
-    unexpected: [...actual].filter((name) => !expected.has(name)).toSorted(),
+    missing: [...expected.difference(actual)].toSorted(),
+    unexpected: [...actual.difference(expected)].toSorted(),
   };
 };

app/apps/shell-super-app/api/auth/db/client.ts

@@ -32,12 +32,7 @@ const connectionFailure = (cause: unknown) =>
       reason: 'Unable to initialize the authentication PostgreSQL pool',
     }),
     'cause',
-    {
-      configurable: false,
-      enumerable: false,
-      value: cause,
-      writable: false,
-    },
+    { value: cause },
   );
 
 export const acquirePoolResource = <Resource extends PoolResource>(

app/apps/shell-super-app/api/auth/environment-file-provider.ts

@@ -0,0 +1,19 @@
+import { NodeFileSystem } from '@effect/platform-node';
+import { ConfigProvider, Context, Effect, FileSystem, Layer, Predicate } from 'effect';
+
+export const loadEnvironmentFileProvider = <Failure>(
+  envPath: string,
+  unableToLoadEnvironment: () => Failure,
+): Effect.Effect<ConfigProvider.ConfigProvider, Failure> =>
+  Effect.scoped(
+    Layer.build(NodeFileSystem.layer).pipe(
+      Effect.map((services) => Context.get(services, FileSystem.FileSystem)),
+      Effect.flatMap((fileSystem) => fileSystem.readFileString(envPath)),
+      Effect.catchIf(
+        (error) => Predicate.isTagged(error.reason, 'NotFound'),
+        () => Effect.succeed(''),
+      ),
+      Effect.catchTag('PlatformError', () => Effect.fail(unableToLoadEnvironment())),
+      Effect.map((contents) => ConfigProvider.fromDotEnvContents(contents)),
+    ),
+  );

app/apps/shell-super-app/api/auth/gateway-issuer-config.ts

@@ -1,16 +1,5 @@
-import { NodeFileSystem } from '@effect/platform-node';
-import {
-  Config,
-  ConfigProvider,
-  Context,
-  Effect,
-  FileSystem,
-  Layer,
-  Predicate,
-  Redacted,
-  Schema,
-} from 'effect';
-import { ROOT_ENV_PATH } from './config.ts';
+import { loadConfigurationProvider } from './configuration-provider.ts';
+import { Config, ConfigProvider, Effect, Redacted, Schema } from 'effect';
 
 const withOptionalProperty = <
   Base extends object,
@@ -34,7 +23,7 @@ const EnvironmentKeySchema = Schema.Literals(['ONTOS_GATEWAY_ISSUER', 'ONTOS_GAT
 type EnvironmentKey = typeof EnvironmentKeySchema.Type;
 type Environment = Readonly<Partial<Record<EnvironmentKey, string>>>;
 
-export interface Ed25519PrivateJwk {
+interface Ed25519PrivateJwk {
   readonly alg: 'EdDSA';
   readonly crv: 'Ed25519';
   readonly d: string;
@@ -117,48 +106,19 @@ const parseGatewayIssuerConfigFromProvider = Effect.fn(
   return { issuer: source.issuer, privateJwk };
 });
 
-const environmentProvider = (environment: Environment): ConfigProvider.ConfigProvider =>
-  ConfigProvider.fromEnvRecord({
-    ONTOS_GATEWAY_ISSUER: environment.ONTOS_GATEWAY_ISSUER,
-    ONTOS_GATEWAY_PRIVATE_JWK: environment.ONTOS_GATEWAY_PRIVATE_JWK,
-  });
-
 export const parseGatewayIssuerConfig = (
   environment: Environment,
 ): Effect.Effect<GatewayIssuerConfigValue, GatewayIssuerConfigError> =>
-  parseGatewayIssuerConfigFromProvider(environmentProvider(environment));
+  parseGatewayIssuerConfigFromProvider(ConfigProvider.fromEnvRecord(environment));
 
 export interface LoadGatewayIssuerConfigOptions {
   readonly environment?: Environment;
   readonly envPath?: string;
 }
 
-const loadFileProvider = (
-  envPath: string,
-): Effect.Effect<ConfigProvider.ConfigProvider, GatewayIssuerConfigError> =>
-  Effect.scoped(
-    Layer.build(NodeFileSystem.layer).pipe(
-      Effect.map((services) => Context.get(services, FileSystem.FileSystem)),
-      Effect.flatMap((fileSystem) => fileSystem.readFileString(envPath)),
-      Effect.catchIf(
-        (error) => Predicate.isTagged(error.reason, 'NotFound'),
-        () => Effect.succeed(''),
-      ),
-      Effect.catchTag('PlatformError', () => Effect.fail(unableToLoadEnvironment())),
-      Effect.map((contents) => ConfigProvider.fromDotEnvContents(contents)),
-    ),
-  );
-
 export const loadGatewayIssuerConfig = (
   options: LoadGatewayIssuerConfigOptions = {},
 ): Effect.Effect<GatewayIssuerConfigValue, GatewayIssuerConfigError> =>
-  loadFileProvider(options.envPath ?? ROOT_ENV_PATH).pipe(
-    Effect.flatMap((fileProvider) =>
-      parseGatewayIssuerConfigFromProvider(
-        (options.environment === undefined
-          ? ConfigProvider.fromEnv()
-          : environmentProvider(options.environment)
-        ).pipe(ConfigProvider.orElse(fileProvider)),
-      ),
-    ),
+  loadConfigurationProvider(options, unableToLoadEnvironment).pipe(
+    Effect.flatMap(parseGatewayIssuerConfigFromProvider),
   );

app/apps/shell-super-app/api/auth/identity-lifecycle.ts

@@ -48,7 +48,7 @@ const IdentityLifecycleOperationErrorSchema = Schema.TaggedStruct(
   'IdentityLifecycleOperationError',
   identityLifecycleOperationErrorFields,
 );
-export const IdentityLifecycleOperationError = Schema.TaggedError<
+const IdentityLifecycleOperationError = Schema.TaggedError<
   Schema.Schema.Type<typeof IdentityLifecycleOperationErrorSchema>
 >()('IdentityLifecycleOperationError', identityLifecycleOperationErrorFields);
 export type IdentityLifecycleError =