chore: repo-wide bloat sweep, remove dead code and fold duplicate helpers (#2150)

* chore: repo-wide bloat sweep, remove dead code and fold duplicate helpers

Remove 33 dead files, ~270 unreferenced exports/types, 13 dead i18n
namespaces and 4 unused dependencies; fold byte-identical helper copies
into one canonical home each (lib/utils chunk/sleep/utcDateStamp,
lib/dates/iso, lib/invariants/uuid, lib/xml/escape, lib/reports/sru/format,
lib/pdf/number-text, lib/browser/panel-request, lib/api/v1/body +
v1ValidationError rolled out to ~55 v1 routes, booking-template schemas).

No behaviour change: v1 bodies and status codes, MCP tool schemas, DB
writes and money math are untouched. Naive ore rounding was deliberately
not swapped for roundOre; see DECISIONS.md 2026-09-02 for the full list
of things left alone on purpose.

tsc, lint, 19588 unit tests and check:guards green; antipattern baseline
ratcheted (naive-ore-round 622 -> 620, hand-rolled-invariant 115 -> 113).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test(transactions): import RawTransaction from @/types after the ingest re-export removal

CI's type ratchet (check:types, full tsconfig) caught the one test file
that still imported the type through lib/transactions/ingest.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

lib/webhooks/signing.ts

@@ -8,8 +8,10 @@
  *   `${t}.${rawBody}`
  *
  * The `t` (unix timestamp in seconds) is included in the signed payload
- * so receivers can implement replay-window checks. We default to a 5-minute
- * tolerance on the verify side; receivers can pick their own.
+ * so receivers can implement replay-window checks. The receiver-side
+ * verification (parse the header, recompute the HMAC, apply a 5-minute
+ * tolerance) is documented in the docs cookbook (lib/docs/content/webhooks.ts);
+ * receivers can pick their own tolerance.
  *
  * Why HMAC-SHA256 (not Ed25519): every Node/Python/Go/Ruby stdlib has it,
  * receivers can verify without adding a dep. Asymmetric signing buys nothing
@@ -49,74 +51,6 @@ export function signPayload(args: {
   }
 }
 
-/**
- * Parse a signature header into its components. Returns null if malformed.
- * Used by the receiver-side example in the docs cookbook (Phase 6 PR-2);
- * exported here so a single canonical implementation lives in this file.
- */
-export function parseSignatureHeader(header: string): SignedHeaderParts | null {
-  const parts = header.split(',').map((s) => s.trim())
-  let t: number | null = null
-  let v1: string | null = null
-  for (const p of parts) {
-    const eq = p.indexOf('=')
-    if (eq === -1) continue
-    const k = p.slice(0, eq)
-    const v = p.slice(eq + 1)
-    if (k === 't') {
-      const parsed = Number.parseInt(v, 10)
-      if (Number.isFinite(parsed)) t = parsed
-    } else if (k === 'v1') {
-      v1 = v
-    }
-  }
-  if (t === null || !v1) return null
-  return { t, v1 }
-}
-
-/**
- * Verify a signature against a raw body. Constant-time comparison.
- * Returns true if the signature is valid AND within the tolerance window.
- *
- * Use this in the cookbook examples and in the :test endpoint's loopback
- * verification.
- */
-export function verifySignature(args: {
-  body: string
-  header: string
-  secret: string
-  /** Tolerance window in seconds. Defaults to 300 (5 min). */
-  toleranceSeconds?: number
-  /** Override for tests. Defaults to current unix-seconds. */
-  now?: number
-}): boolean {
-  const parsed = parseSignatureHeader(args.header)
-  if (!parsed) return false
-
-  const tolerance = args.toleranceSeconds ?? 300
-  const now = args.now ?? Math.floor(Date.now() / 1000)
-  if (Math.abs(now - parsed.t) > tolerance) return false
-
-  const expected = crypto
-    .createHmac(ALGORITHM, args.secret)
-    .update(`${parsed.t}.${args.body}`)
-    .digest('hex')
-
-  // timingSafeEqual requires equal-length buffers: return false (not throw)
-  // for length mismatch, the common case for a forged signature.
-  //
-  // Compare buffer lengths AFTER decoding rather than hex-string lengths:
-  // `Buffer.from(v1, 'hex')` silently drops invalid hex bytes, so a v1 that
-  // is the right hex length (64 chars for SHA-256) but contains non-hex
-  // characters decodes to a SHORTER buffer than `expected`. Without this
-  // check the timingSafeEqual call throws RangeError instead of returning
-  // false, exposing a crash path to any caller passing a malformed header.
-  const expectedBuf = Buffer.from(expected, 'hex')
-  const actualBuf = Buffer.from(parsed.v1, 'hex')
-  if (expectedBuf.length !== actualBuf.length) return false
-  return crypto.timingSafeEqual(expectedBuf, actualBuf)
-}
-
 /**
  * Generate a fresh webhook secret. 32 bytes of crypto-random hex (256 bits
  * of entropy, 64-character output). Returned to the caller exactly once on

lib/webhooks/url-guard.ts

@@ -182,5 +182,3 @@ function classifyAddress(address: string): AddressClass {
   if (/^fe[89ab]/.test(v6)) return 'link_local_address'
   return 'public'
 }
-
-export const __TESTING__ = { classifyAddress }