refactor: remove dead code and fold duplicated logic across the stack

Whole-repo over-engineering pass (~-926 lines, 52 files).

Backend:
- drop redundant selection_enabled column (modules JSON is now the single
  source of truth); add migration 0011, derive the API field from modules
- fold the fixed-window rateLimit middleware into the shared sliding-window
  checkRateLimit
- dedup attachDb into requireDb; inline warmCatalogAfterMutation
- delete empty db/client.ts and the unused middleware barrel

Schemas:
- delete unused Allergen/Membership/ExtrasType/PublicationState/AnalyticsPeriod
  enums and ~30 dead type aliases and response schemas
- drop the dead legacy.selectionEnabled fallback from normalizeModulesConfig

Web:
- collapse the never-wired dual-display path (getContentDisplayText/.secondary/
  nameSecondary) down to getLocalizedContentValue
- delete generateColorVariables/hexToHSL, the stores barrel, unused selector
  hooks, MENU_ICON_LABELS and the LOCALE_SHORT_CODES map
- share one formatPrice and one sanitizeRichText helper
- replace the chatActionsStore.dispatch switch with direct setters

Chat worker:
- remove the variant/extra pipeline that D1 never populated, its types and
  queries; align the get_item_detail tool description
- drop the dev-only /chat/debug endpoint and the buildWorkersAIPrompt wrapper

Author: vekexasia

backend/drizzle/0011_drop_selection_enabled.sql

@@ -0,0 +1,4 @@
+-- selection_enabled was a legacy mirror of modules.ordering.enabled (added in
+-- 0007, folded into the JSON modules column in 0010). It is now the single
+-- source of truth, so the column is redundant.
+ALTER TABLE settings DROP COLUMN selection_enabled;

backend/src/__tests__/admin-crud.test.ts

@@ -5,7 +5,7 @@ import { createTestDb, makeDbEnv, seedSettings, seedMenu, seedCategory, seedEntr
 beforeAll(() => installJwksMock());
 
 const ADMIN_UID = 'admin-1';
-type SettingsRow = { name: string; payoff: string; ai_chat_enabled: number; ai_voice_enabled: number; selection_enabled: number };
+type SettingsRow = { name: string; payoff: string; ai_chat_enabled: number; ai_voice_enabled: number };
 type PublicationRow = { publication_state: string };
 type CategoryRow = { name: string };
 type EntryRow = { name: string; price: number; hidden: number; out_of_stock: number; category_id: string };
@@ -45,12 +45,12 @@ describe('PUT /admin/settings', () => {
       body: { name: 'Updated Restaurant', payoff: 'Updated tagline', aiChatEnabled: true, aiVoiceEnabled: true, selectionEnabled: true },
     });
     expect(res.status).toBe(200);
-    const row = db.raw.prepare('SELECT name, payoff, ai_chat_enabled, ai_voice_enabled, selection_enabled FROM settings WHERE id = 1').get() as SettingsRow;
+    const row = db.raw.prepare('SELECT name, payoff, ai_chat_enabled, ai_voice_enabled, modules FROM settings WHERE id = 1').get() as SettingsRow & { modules: string };
     expect(row.name).toBe('Updated Restaurant');
     expect(row.payoff).toBe('Updated tagline');
     expect(row.ai_chat_enabled).toBe(1);
     expect(row.ai_voice_enabled).toBe(1);
-    expect(row.selection_enabled).toBe(1);
+    expect(JSON.parse(row.modules).ordering.enabled).toBe(true);
   });
 
   it('turns voice dictation off when Tony chat is disabled', async () => {

backend/src/db/client.ts

@@ -58,7 +58,6 @@ export const settings = sqliteTable('settings', {
   chatAgentPrompt: text('chat_agent_prompt'),
   aiChatEnabled: integer('ai_chat_enabled', { mode: 'boolean' }).default(false).notNull(),
   aiVoiceEnabled: integer('ai_voice_enabled', { mode: 'boolean' }).default(false).notNull(),
-  selectionEnabled: integer('selection_enabled', { mode: 'boolean' }).default(false).notNull(),
   modules: jsonColumn<Record<string, unknown> | null>('modules'),
   primaryLocale: text('primary_locale').default('it').notNull(),
   enabledLocales: jsonColumn<string[] | null>('enabled_locales'),

backend/src/db/schema.ts

@@ -1,13 +1,12 @@
 import { createMiddleware } from 'hono/factory';
-import type { Env, RuntimeConfig } from '../types';
+import type { Env } from '../types';
 import type { AuthUser } from './auth';
 import { createDb } from '../db/index';
 import { isDemoMode } from '../lib/demo';
 
 type AdminBindings = {
   Bindings: Env;
   Variables: {
-    config: RuntimeConfig;
     user: AuthUser;
     db: ReturnType<typeof createDb>;
   };
@@ -19,19 +18,6 @@ function parseAdminEmails(env: Env): Set<string> {
   return new Set(raw.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean));
 }
 
-/**
- * Attaches a Drizzle DB client to the request context.
- * Must run before any route that touches the database.
- */
-export const attachDb = createMiddleware<AdminBindings>(async (c, next) => {
-  const db = createDb(c.env);
-  if (!db) {
-    return c.json({ error: 'Database not configured' }, 503);
-  }
-  c.set('db', db);
-  await next();
-});
-
 /**
  * Allows the request only if the authenticated user's email is in the
  * comma-separated `ADMIN_EMAILS` env var. Email comparison is case-insensitive.

backend/src/middleware/admin-guard.ts

@@ -1,5 +1,6 @@
 import { createMiddleware } from 'hono/factory';
 import type { AppBindings } from '../types';
+import { checkRateLimit } from '../lib/rate-limit';
 
 /**
  * Request logging middleware.
@@ -29,37 +30,14 @@ export const requestLogger = createMiddleware<AppBindings>(async (c, next) => {
 });
 
 /**
- * Simple rate limiter using Cloudflare's cf-connecting-ip.
- * Tracks request counts in a Map (per-isolate, not distributed).
+ * Per-IP rate limiter using Cloudflare's cf-connecting-ip.
+ * Delegates to the shared sliding-window limiter in lib/rate-limit.
  */
-// ponytail: per-isolate counter, not distributed; effective limit scales with the
-// number of live isolates. Upgrade path: Cloudflare Rate Limiting rules, a Durable
-// Object, or Workers KV for a global limit.
-const requestCounts = new Map<string, { count: number; resetAt: number }>();
-
 export function rateLimit(maxRequests: number, windowMs: number) {
   return createMiddleware<AppBindings>(async (c, next) => {
     const ip = c.req.header('cf-connecting-ip') || 'unknown';
-    const now = Date.now();
-
-    let entry = requestCounts.get(ip);
-    if (!entry || now > entry.resetAt) {
-      entry = { count: 0, resetAt: now + windowMs };
-      requestCounts.set(ip, entry);
-    }
-
-    entry.count++;
-
-    if (entry.count > maxRequests) {
-      return c.json(
-        { error: 'Too many requests', retryAfter: Math.ceil((entry.resetAt - now) / 1000) },
-        429,
-      );
-    }
-
-    c.header('X-RateLimit-Limit', String(maxRequests));
-    c.header('X-RateLimit-Remaining', String(Math.max(0, maxRequests - entry.count)));
-
+    const limited = checkRateLimit(`ip:${ip}`, maxRequests, windowMs);
+    if (limited) return limited;
     await next();
   });
 }

backend/src/middleware/index.ts

@@ -1,10 +1,11 @@
 import { Hono, type Context } from 'hono';
 import { eq, and, gte, lt, asc, desc, count, inArray, sql } from 'drizzle-orm';
 import { requireAuth } from '../middleware/auth';
-import { attachDb, requireAdmin } from '../middleware/admin-guard';
+import { requireAdmin } from '../middleware/admin-guard';
+import { requireDb } from '../middleware/db';
 import * as schema from '../db/schema';
 import { computeLeaderboardMovement, VALID_PERIODS, periodToMs, computeWindows } from '../lib/analytics';
-import { buildCatalogFromDb, warmCatalogAfterMutation } from './catalog';
+import { buildCatalogFromDb, refreshCatalogArtifacts } from './catalog';
 import { parseBody } from '../lib/validate';
 import { validateImage } from '../lib/image';
 import { checkRateLimit } from '../lib/rate-limit';
@@ -33,7 +34,7 @@ import type { DbInstance } from '../db';
 // All admin routes require auth + db + admin gate.
 const admin = new Hono<AppBindings>();
 
-const base = [requireAuth, attachDb, requireAdmin] as const;
+const base = [requireAuth, requireDb, requireAdmin] as const;
 
 
 admin.post('/demo/reset', ...base, async (c) => {
@@ -62,7 +63,7 @@ admin.get('/settings', ...base, async (c) => {
       chatAgentPrompt: schema.settings.chatAgentPrompt,
       aiChatEnabled: schema.settings.aiChatEnabled,
       aiVoiceEnabled: schema.settings.aiVoiceEnabled,
-      selectionEnabled: schema.settings.selectionEnabled,
+      modules: schema.settings.modules,
       promotionAlert: schema.settings.promotionAlert,
       publicationState: schema.settings.publicationState,
       primaryLocale: schema.settings.primaryLocale,
@@ -79,7 +80,7 @@ admin.get('/settings', ...base, async (c) => {
     chatAgentPrompt: row.chatAgentPrompt ?? '',
     aiChatEnabled: row.aiChatEnabled,
     aiVoiceEnabled: row.aiChatEnabled && row.aiVoiceEnabled,
-    selectionEnabled: row.selectionEnabled,
+    selectionEnabled: normalizeModulesConfig(row.modules, row).ordering.enabled,
     promotionAlert: row.promotionAlert ?? null,
     publicationState: row.publicationState,
     primaryLocale: row.primaryLocale,
@@ -95,7 +96,6 @@ admin.get('/modules', ...base, async (c) => {
   const [row] = await c.get('db')
     .select({
       modules: schema.settings.modules,
-      selectionEnabled: schema.settings.selectionEnabled,
       aiChatEnabled: schema.settings.aiChatEnabled,
       aiVoiceEnabled: schema.settings.aiVoiceEnabled,
     })
@@ -113,7 +113,6 @@ admin.put('/modules', ...base, async (c) => {
   const [row] = await c.get('db')
     .select({
       modules: schema.settings.modules,
-      selectionEnabled: schema.settings.selectionEnabled,
       aiChatEnabled: schema.settings.aiChatEnabled,
       aiVoiceEnabled: schema.settings.aiVoiceEnabled,
     })
@@ -124,7 +123,6 @@ admin.put('/modules', ...base, async (c) => {
   const modules = normalizeModulesConfig({ ...normalizeModulesConfig(row.modules, row), ...body });
   await updateSettings(c.get('db'), {
     modules,
-    selectionEnabled: modules.ordering.enabled,
     aiChatEnabled: modules.ai.enabled,
     aiVoiceEnabled: modules.ai.enabled && modules.ai.voiceEnabled,
   });
@@ -147,10 +145,9 @@ admin.put('/settings', ...base, async (c) => {
   if (body.chatAgentPrompt !== undefined) updates.chatAgentPrompt = body.chatAgentPrompt;
   if (body.aiChatEnabled !== undefined) updates.aiChatEnabled = body.aiChatEnabled;
   if (body.aiVoiceEnabled !== undefined) updates.aiVoiceEnabled = body.aiChatEnabled === false ? false : body.aiVoiceEnabled;
-  if (body.selectionEnabled !== undefined) updates.selectionEnabled = body.selectionEnabled;
   if (body.aiChatEnabled !== undefined || body.aiVoiceEnabled !== undefined || body.selectionEnabled !== undefined) {
     const [row] = await c.get('db')
-      .select({ modules: schema.settings.modules, selectionEnabled: schema.settings.selectionEnabled, aiChatEnabled: schema.settings.aiChatEnabled, aiVoiceEnabled: schema.settings.aiVoiceEnabled })
+      .select({ modules: schema.settings.modules, aiChatEnabled: schema.settings.aiChatEnabled, aiVoiceEnabled: schema.settings.aiVoiceEnabled })
       .from(schema.settings)
       .where(eq(schema.settings.id, 1));
     const modules = normalizeModulesConfig(row?.modules, row);
@@ -1076,7 +1073,7 @@ async function setLocaleFlag(
 
 async function refreshPublicCatalog(c: Context<AppBindings>): Promise<void> {
   try {
-    await warmCatalogAfterMutation(
+    await refreshCatalogArtifacts(
       c.env,
       c.req.url,
       c.get('db'),

backend/src/middleware/logging.ts

@@ -2,7 +2,7 @@ import { Hono } from 'hono';
 import { eq, asc } from 'drizzle-orm';
 import { requireDb } from '../middleware/db';
 import { requireAuth } from '../middleware/auth';
-import { attachDb, requireAdmin } from '../middleware/admin-guard';
+import { requireAdmin } from '../middleware/admin-guard';
 import { RecordViewBodySchema, normalizeModulesConfig } from '@menu/schemas';
 import type { CatalogResponse } from '@menu/schemas';
 import * as schema from '../db/schema';
@@ -112,7 +112,7 @@ export const catalogRoutes = new Hono<AppBindings>()
    *
    * Admin-only. Regenerates the R2 snapshot from the DB.
    */
-  .post('/publish', requireAuth, attachDb, requireAdmin, async (c) => {
+  .post('/publish', requireAuth, requireDb, requireAdmin, async (c) => {
     const bucket = c.env.PUBLIC_MENU_BUCKET;
     const db = c.get('db');
 
@@ -279,15 +279,6 @@ export async function refreshCatalogArtifacts(
   };
 }
 
-export async function warmCatalogAfterMutation(
-  env: Env,
-  requestUrl: string,
-  db: DbInstance,
-  publishedBy?: string,
-): Promise<void> {
-  await refreshCatalogArtifacts(env, requestUrl, db, publishedBy);
-}
-
 async function isMenuPublished(db: DbInstance): Promise<boolean> {
   const [row] = await db
     .select({ publicationState: schema.settings.publicationState })

backend/src/routes/admin.ts

@@ -1,34 +1,7 @@
 import { describe, it, expect } from 'vitest';
-import {
-  MembershipRoleSchema,
-  AllergenSchema,
-  ExtrasTypeSchema,
-  AnalyticsPeriodSchema,
-  PublicationStateSchema,
-  I18nMapSchema,
-} from '../common.js';
+import { I18nMapSchema } from '../common.js';
 
 describe('common schemas', () => {
-  it('MembershipRoleSchema accepts a known role, rejects others', () => {
-    expect(MembershipRoleSchema.safeParse('manager').success).toBe(true);
-    expect(MembershipRoleSchema.safeParse('intern').success).toBe(false);
-  });
-  it('AllergenSchema validates the enum', () => {
-    expect(AllergenSchema.safeParse('Glutine').success).toBe(true);
-    expect(AllergenSchema.safeParse('Peanuts').success).toBe(false);
-  });
-  it('ExtrasTypeSchema validates the enum', () => {
-    expect(ExtrasTypeSchema.safeParse('zeroorone').success).toBe(true);
-    expect(ExtrasTypeSchema.safeParse('many').success).toBe(false);
-  });
-  it('AnalyticsPeriodSchema validates the enum', () => {
-    expect(AnalyticsPeriodSchema.safeParse('7d').success).toBe(true);
-    expect(AnalyticsPeriodSchema.safeParse('1y').success).toBe(false);
-  });
-  it('PublicationStateSchema only allows draft|published', () => {
-    expect(PublicationStateSchema.safeParse('published').success).toBe(true);
-    expect(PublicationStateSchema.safeParse('archived').success).toBe(false);
-  });
   it('I18nMapSchema accepts locale->field->string, rejects non-string values', () => {
     expect(I18nMapSchema.safeParse({ en: { name: 'Pizza' } }).success).toBe(true);
     expect(I18nMapSchema.safeParse({ en: { name: 5 } }).success).toBe(false);