Remove import-boundary compatibility re-export shims

[kentcdodds]

What

The boundary-extraction work (#1014, #1017) moved shared primitives into neutral #worker/* modules but left six pure re-export shims under packages/worker/src/app/ to keep those diffs small:

• app-base-url.ts (23 importers)
• permissions.ts (4)
• user-lookup.ts, account-deletion-state.ts, audit-log.ts (1 each)
• username.ts (1 importer via a relative path in e2e/playwright-utils.ts)

This repoints every importer at the canonical #worker/* module and deletes the shims. Four vi.mock('#app/app-base-url.ts', ...) specifiers in handler tests are repointed too — after the import repoint they would have silently stopped intercepting the real module.

It also fixes two stale tsconfig include entries: tsconfig-tools.json still listed app/username.ts and app/reserved-usernames.ts (the latter already deleted by #1014 — silently ignored since explicit include paths behave like globs), and tsconfig-client.json still listed app/permissions.ts.

Why now

Ten of the shim importers were shared-primitive-layer files (webhooks/, email/, run-records/, mcp-auth.ts, package-runtime/, ...) importing #app/* — the exact upward-coupling pattern the July architecture audit flagged and #1014 set out to eliminate. With the shims gone, those edges no longer exist, and no new importer can quietly re-adopt the app-layer path.

Notes for review

• Every shim was a doc-comment plus export * from '#worker/...'; no behavior moved.
• tools/oxlint/import-boundaries.node.test.ts still asserts the #app/app-base-url.ts specifier is forbidden from #mcp/*; that assertion checks rule behavior for the specifier and does not require the file to exist.
• Net diff: 41 files, +42/−77.

Validation

Full npm run validate on the VM: format, lint, typecheck, structure checks (primitives, migrations), backup:build, 1507/1507 unit tests, and all 20 Playwright E2E tests pass. The MCP-E2E lane timed out once under the parallel gate (a different test each attempt, both on the 45s startDevServer timeout) and passes cleanly when run in isolation via npm run test:mcp — Nx flagged worker:test-mcp as a flaky task. Known VM contention between the two dev-server-spawning suites, unrelated to this diff.

  

Summary by CodeRabbit

• Refactor
  • Switched internal role/permission, username, and user-lookup resolution to worker-scoped modules.
  • Standardized base-URL, audit-log, and account-deletion related wiring on worker-level implementations.
  • Removed legacy compatibility exports from app-layer entry points (including identity, permissions, username, user lookup, base URL, and audit-log).
  • Updated TypeScript compilation and tooling paths to match the new module locations.
• Tests
  • Updated end-to-end and handler test mocks to reference the worker-scoped modules.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: cc1d185e-3c72-4470-a8ca-c91a9d6061e5

📥 Commits

Reviewing files that changed from the base of the PR and between 0a6b145 and 62e133c.

📒 Files selected for processing (1)

• packages/worker/tsconfig-client.json

💤 Files with no reviewable changes (1)

• packages/worker/tsconfig-client.json

---

📝 Walkthrough

Walkthrough

The pull request replaces app-layer compatibility imports with direct worker identity, permission, base-URL, audit-log, user-lookup, and account-deletion-state imports, and updates related TypeScript inputs and test mocks.

Changes

Worker import boundary consolidation

Layer / File(s)	Summary
Identity and permission imports e2e/playwright-utils.ts, packages/worker/client/*, packages/worker/src/app/loader-data.ts, packages/worker/tsconfig-client.json, tsconfig-tools.json	Identity and permission consumers and tooling now reference worker-owned modules directly.
Base URL dependency migration packages/worker/src/app/..., packages/worker/src/community/*, packages/worker/src/email/*, packages/worker/src/execute-maintenance.ts, packages/worker/src/mcp-auth.ts, packages/worker/src/oauth-handlers.ts, packages/worker/src/package-*/*, packages/worker/src/platform-feedback/*, packages/worker/src/run-records/*, packages/worker/src/webhooks/*	Runtime modules import getAppBaseUrl from #worker/app-base-url.ts; corresponding tests mock that worker path.
App-layer compatibility export removal packages/worker/src/app/account-deletion-state.ts, packages/worker/src/app/app-base-url.ts, packages/worker/src/app/audit-log.ts, packages/worker/src/app/permissions.ts, packages/worker/src/app/user-lookup.ts, packages/worker/src/app/username.ts	App-layer re-exports for worker capabilities were removed.
Direct worker service imports packages/worker/src/index.ts, packages/worker/src/jobs/service.ts	Worker entrypoint and job service imports now use worker audit, identity lookup, and account deletion-state modules.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• kentcdodds/kody#1013: Related changes to worker base-URL imports and app-layer re-exports.
• kentcdodds/kody#1015: Related hosted package-app base-URL handling.
• kentcdodds/kody#1017: Related worker base-URL and package-app origin changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: removing compatibility re-export shims and repointing imports to canonical worker modules.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/remove-boundary-compat-shims-0385

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-1018.kody-a99.workers.dev

Worker: kody-pr-1018
D1: kody-pr-1018-db
KV: kody-pr-1018-oauth-kv

Mocks:

• cloudflare: https://kody-pr-1018-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1018-mock-cloudflare)

[coderabbitai]

🧹 Nitpick comments (1)

packages/worker/tsconfig-client.json (1)

23-23: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the duplicate identity-permissions include.

./src/identity/permissions.ts is already included at Line 39, so this replacement leaves the same file listed twice. Keep one canonical entry to avoid configuration drift.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/tsconfig-client.json` at line 23, Remove the duplicate
"./src/identity/permissions.ts" entry from the tsconfig include list, retaining
the existing canonical entry referenced elsewhere. Ensure the file remains
included exactly once.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/worker/tsconfig-client.json`:
- Line 23: Remove the duplicate "./src/identity/permissions.ts" entry from the
tsconfig include list, retaining the existing canonical entry referenced
elsewhere. Ensure the file remains included exactly once.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 25d9bcaa-e1cc-4c68-8d03-a186e50af895

📥 Commits

Reviewing files that changed from the base of the PR and between 60edb3d and 0a6b145.

📒 Files selected for processing (42)

• e2e/playwright-utils.ts
• packages/worker/client/app.tsx
• packages/worker/client/routes/admin-users.tsx
• packages/worker/client/session.ts
• packages/worker/src/app/account-deletion-state.ts
• packages/worker/src/app/account-package-invocation-tokens-data.ts
• packages/worker/src/app/app-base-url.ts
• packages/worker/src/app/audit-log.ts
• packages/worker/src/app/handlers/account-jobs.node.test.ts
• packages/worker/src/app/handlers/account-jobs.ts
• packages/worker/src/app/handlers/account-mcp-servers.ts
• packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts
• packages/worker/src/app/handlers/account-profile.ts
• packages/worker/src/app/handlers/account-secrets.node.test.ts
• packages/worker/src/app/handlers/account-secrets.ts
• packages/worker/src/app/handlers/blog.tsx
• packages/worker/src/app/handlers/community-install.ts
• packages/worker/src/app/handlers/og-page-image.ts
• packages/worker/src/app/handlers/package-app.node.test.ts
• packages/worker/src/app/handlers/package-app.ts
• packages/worker/src/app/loader-data.ts
• packages/worker/src/app/onboarding-data.ts
• packages/worker/src/app/package-app-origin.ts
• packages/worker/src/app/permissions.ts
• packages/worker/src/app/ssr-render.tsx
• packages/worker/src/app/user-lookup.ts
• packages/worker/src/app/username.ts
• packages/worker/src/community/activity-package-subscriptions.ts
• packages/worker/src/email/package-subscriptions.ts
• packages/worker/src/execute-maintenance.ts
• packages/worker/src/index.ts
• packages/worker/src/jobs/service.ts
• packages/worker/src/mcp-auth.ts
• packages/worker/src/oauth-handlers.ts
• packages/worker/src/package-invocations/http.ts
• packages/worker/src/package-runtime/package-workflows.ts
• packages/worker/src/platform-feedback/package-subscriptions.ts
• packages/worker/src/run-records/package-subscriptions.ts
• packages/worker/src/webhooks/http.ts
• packages/worker/src/webhooks/service.ts
• packages/worker/tsconfig-client.json
• tsconfig-tools.json

💤 Files with no reviewable changes (6)

• packages/worker/src/app/permissions.ts
• packages/worker/src/app/audit-log.ts
• packages/worker/src/app/account-deletion-state.ts
• packages/worker/src/app/user-lookup.ts
• packages/worker/src/app/username.ts
• packages/worker/src/app/app-base-url.ts