feat/one-api

services/ CFE Lambda still hardcodes cjb prefix

services/utility/bills/cfe/src/domain/constants.ts:205

PUBLIC_ID_PREFIXES.CFE_JOB = 'cjb' disagrees with the now-canonical 'cfj' in PublicIdPrefix.CfeJob. This is a second source of truth that wasn't updated. Any future Lambda code using it will produce the wrong prefix without a type error. Should import from @batu/shared-kernel instead.

Seed file inserts rows with stale cjb_ prefix

packages/database/src/seed-utility-demo.ts:1352

Three demo job rows use hardcoded publicIds with the cjb_ prefix. These are unreachable by the now-generated cfj_ regex in PublicJobIdSchema. Update seed values to cfj_.

publicIdRegex i-flag accepts uppercase prefixes

packages/shared-kernel/src/types/ids.ts:94

The 'i' flag is intended to tolerate lowercase ULID body chars, but also makes the prefix match case-insensitive (e.g. 'BIL_...' would pass). No production code generates uppercase-prefix IDs today, but the contract is looser than stated.

classify-routes.ts misclassifies org-scoped creates as 'intent' (inventory data quality)

scripts/one-api/classify-routes.ts:215

Same root cause as the high finding above — the route-inventory.json W1 snapshot shows incorrect op counts as a result. Since this is 'ratify before W2', the inventory should be regenerated after the fix before wave planning.

REVOKE wording: listing 'authenticated, anon, public' is redundant

.claude/rules/rls-checklist.md

Revoking from 'public' already covers all roles. The explicit enumeration is safe but could mislead a developer into thinking omitting 'public' is OK if authenticated+anon are listed.

publicIdRegex uses unescaped prefix in RegExp constructor

packages/shared-kernel/src/types/ids.ts:95

TypeScript type constrains prefix to [a-z]{3} registry values, so no real injection risk. A defensive escapeRegExp call would future-proof against misuse.

route-inventory.json reveals full internal route surface

scripts/one-api/route-inventory.json:1

Contains proposed auth classifications and all route paths. No secrets; paths are already in TypeScript contracts. Acceptable as a dev-tooling artifact.

isValidPublicId accepts any 3-char prefix (pre-existing)

packages/shared-kernel/src/types/ids.ts:124

Generic validator allows any 3-char prefix; entity-specific validation should use publicIdRegex(). Pre-existing behavior, not introduced here.

ontology.md and utility/CLAUDE.md still document cfe-job prefix as cjb_

.claude/rules/ontology.md:87

The entity table documents CfeJob prefix as `cjb_` — contradicts the new registry and will cause any developer/agent reading these auto-loaded rules to use the wrong prefix. Update both to `cfj_`.

services/.../event-schemas.ts JSDoc still references cjb_

services/utility/bills/cfe/src/domain/event-schemas.ts:48

JSDoc `/** Job public ID (cjb_...) */` documents the retired prefix. Update to `cfj_`.

Handler/validation files still use hardcoded prefix regex literals

apps/platform/src/api/utils/asset-management-validation.ts:24

Multiple handler and validation files (asset-management-validation.ts, public-v1-validation.ts, bills.handler.ts, files.handler.ts, etc.) still use hardcoded regex literals instead of publicIdRegex(). The new one-api.md rule prohibits this. W1 scope is classification-only; these should be follow-up items.

cfe-job decision test fixtures use stale cjb_ prefix

domains/utility/src/cfe-job/__tests__/cfe-job.decisions.test.ts:56

Test fixtures use publicId: 'cjb_01HXYZ...' — decisions don't validate prefix format so no test failures, but teaches the wrong prefix to readers. Update to cfj_.

one-api.md Wave-1 single-mount statement could be misread as current state

.claude/rules/one-api.md:104

Wave-2 point #2 says 'one mount (/api/v1)' in present tense but this is a W4 target. Adding '(target: W4)' would prevent misreading.

publicIdRegex: no test for invalid Crockford Base32 characters

packages/api/src/__tests__/schemas/public-id-prefix-registry.test.ts:55

No assertion that characters outside the Crockford alphabet (I, L, O, U) are rejected. Low risk since generated ULIDs are always valid, but a rejection test would pin the character class exclusion.

publicIdRegex: no anchor smoke test

packages/api/src/__tests__/schemas/public-id-prefix-registry.test.ts:55

No test asserting that a padded string like 'prefix_bil_<ULID>suffix' is rejected. Anchors are present in the implementation; a test would guard against a future refactor removing them.

Re-export shims have no dedicated import smoke test — covered by type system

domains/utility/src/schema/base.ts

A wrong re-export would break at compile time. TypeScript coverage is sufficient.

classifyOp misclassifies org-scoped POSTs as 'intent'

scripts/one-api/classify-routes.ts:1275

The condition `segments.some((s) => s.startsWith(':'))` treats any POST to a path containing ANY param as 'intent', even when the param is the org context (e.g. POST /api/organizations/:orgId/sites). True intent verbs live at the LAST segment. This misclassifies ~25 plain create routes as intent ops, distorting the W2/W3 wave scoping that depends on these counts. Fix: check only the last segment for intent-verb matching.

route-inventory.json checked in with no staleness guard

scripts/one-api/route-inventory.json:1

Tracked generated file with a 'do not hand-edit' comment but no CI check that fails on drift and no gitignore rule. Will go stale with every contract change. Options: (a) gitignore + document run command in one-api.md, or (b) CI diff check.

one-api.md rule active before W0 ratification checkpoint

.claude/rules/one-api.md:10

The rule encodes 'ratify with tech leads before Wave-2 work' but is already auto-loading for all api/** work. Agents/developers have no signal whether it's enforced or advisory. Add a one-liner: 'Enforcement: advisory until W0 ratification; Don't items are warnings until then'.

one-api.md 'Don't' rule deferred by 'once it exists' qualifier

.claude/rules/one-api.md:109

'Don't add a route outside the metadata registry (once it exists)' — the metadata registry lands in W2. Until then, agents don't know the interim behavior. Rephrase: 'Until W2, add every new route to route-inventory.json manually'.

HANDLER_SEGMENT_CAPABILITY allocated inside inner loop

scripts/one-api/classify-routes.ts:324

Two-key object literal re-allocated on every method iteration. Should be hoisted to module scope alongside APP_KEY_CAPABILITY and PUBLIC_SEGMENT_CAPABILITY for consistency and clarity.

classify-routes.ts has no tests; op classification logic is non-trivial

scripts/one-api/classify-routes.ts:1264

A few unit tests for classifyOp covering the intent-verb vs org-context-param cases would have caught the POST misclassification. Accepted as a script today, but worth adding if the classifier becomes the SSOT for W2+ tooling.

publicIdRegex creates new RegExp on every call — no memoization

packages/shared-kernel/src/types/ids.ts:94

Allocates a new RegExp per call. Called at module eval time across 6 schema files. Not a hot path, but a module-level Map cache would make repeated calls free and signal that these are stable, reusable patterns.