@teamscala/service-boot 0.23.317 → 0.23.319

package/src/build-client-assets.d.ts

@@ -1,50 +0,0 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Builds the per-service client bundle and stylesheet into `dist/client/`
- * at UI-service boot time. Outputs are content-hashed so deployments
- * naturally cache-bust:
- *
- *   src/entry-client.ts  ──bun build──>  dist/client/hydrate-<hash>.js
- *   src/app.css          ──tailwindcss──>  dist/client/styles-<hash>.css
- *   (and)                                  dist/client/asset-manifest.json
- *
- * The HTML template references `{{stylesPath}}` / `{{hydratePath}}` —
- * read-html-template.ts substitutes from the manifest at template-read
- * time. Bytes-level changes → new hash → new URL → browser refetch.
- * Without this, `cache-control: immutable` on a fixed filename means
- * returning visitors keep their stale copy forever.
- *
- * Content-fingerprint cache: the CLIENT-BUNDLE DEPENDENCY CLOSURE (source
- * entrypoints + every @teamscala/* module/stylesheet the bundle reaches + the
- * resolved versions of the third-party deps the closure imports) is hashed by
- * CONTENT and stored in the manifest; the rebuild is skipped only when the
- * current closure hashes to the same fingerprint (cache-key-hashes-source-
- * inputs-only — never mtime; see computeInputFingerprint for why mtime silently
- * served stale bundles on Railway). bun.lock is deliberately NOT hashed — it
- * encodes every @teamscala/* version including backend packages outside this
- * service's client bundle, so folding it in would rebuild on every publish
- * (the publish→rebuild storm; `no-uncontrolled-repetition-or-cascade`). First
- * pm2 restart after a real closure change pays the full build cost; unchanged
- * restarts skip. Stale hashed outputs from a prior build are removed in the
- * same pass so dist/client/ doesn't accumulate dead files.
- */
-/**
- * Read ONLY the tombstone state of the current manifest — the runtime
- * (read-html-template, ui-service) calls this to decide whether to surface a
- * build-failure signal. Returns null when the manifest is fresh (no
- * `buildFailed`). Decoupled from the full AssetManifest read so the runtime
- * never depends on the build internals.
- */
-export declare function readClientBuildStatus(cwd?: string): Promise<{
-    failed: true;
-    reason?: string;
-    at?: string;
-} | {
-    failed: false;
-}>;
-export declare function stripRemoteImports(css: string): string;
-export declare function computeInputFingerprint(cwd: string): Promise<string>;
-export declare function buildClientAssets(serviceSlug: string): Promise<void>;

package/src/compose-page-title.d.ts

@@ -1,41 +0,0 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The single canonical page-title composer. Every SSR page handler routes
- * through this (portal/region-shell, public shell, single-page resource). A
- * page title is DERIVED from data that already exists — the website name +
- * the page/entity name — with `builda_pages.meta_title` as an explicit
- * per-page OVERRIDE only, never the primary source.
- *
- * Mirrors the brand-is-org-owned-full-scheme precedent: a value that should
- * be DERIVED was instead hand-set per row, and when unset it silently fell
- * back to something wrong. For themes the wrong fallback was the generic
- * light palette; for titles it was the bare org name — the `default`
- * page_meta_template `titleTemplate: "{org.name}"` produced "GBG Indo" with
- * no site or page context, and per-row `meta_title` carried stale product
- * literals like "Dashboard | scala Hub". The fix is identical in shape:
- * derive by default, override explicitly.
- *
- * Canonical format: `<website.name>: <subject>` (subject = entity title or
- * page name), site-first so a browser tab reads the surface then the page.
- * A resource surface (forms/quiz/gpt) may supply a curated `templateTitle`
- * (e.g. "{agent.name} — {org.name}"); it wins over the default derivation
- * but NOT over an explicit per-page override. The composer NEVER returns a
- * bare org name — that is the regression this closes, and the
- * `page-title-not-bare-org` guard backstops it at the template layer.
- */
-export interface TitleContext {
-    /** Per-page override (builda_pages.meta_title). Wins outright when set. */
-    pageMetaTitle?: string | null;
-    /** Resolved resource-template string (forms/quiz/gpt). Curated per-surface shape. */
-    templateTitle?: string | null;
-    /** builda_websites.name — the surface, the primary site context. */
-    websiteName?: string | null;
-    /** builda_pages.name — the page (e.g. "Dashboard"). */
-    pageName?: string | null;
-    /** Resource entity title (proposal/form/quiz/agent name) — preferred subject. */
-    entityTitle?: string | null;
-}
-export declare function composePageTitle(ctx: TitleContext): string;

package/src/content-gate/access.d.ts

@@ -1,15 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The content-gate ACCESS endpoint mounter. One generic POST handler for every
- * gate: a plain <form> posts {<recordIdField>, email}; on a match against the
- * resource's authorized set it sets the signed access cookie and redirects back,
- * so the page loader's gate then releases the content. No bespoke endpoint per
- * type — each gate is one AccessConfig. Mounted BEFORE the auth gate so it is
- * publicly reachable.
- */
-import type { Hono } from "hono";
-import type { AccessConfig } from "./config-types.ts";
-export declare function attachContentGateAccess(app: Hono, serviceSlug: string, config: AccessConfig): Promise<void>;

package/src/content-gate/config-types.d.ts

@@ -1,99 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The config contracts that PROGRAM a content gate. Each gated content type
- * (agreement, proposal, …) is one ContentGateConfig + one AccessConfig — no
- * bespoke gate functions per type; the engine (gate.ts) and the access mounter
- * (access.ts) are the single shared primitive driven by these.
- */
-type Resolved = Record<string, unknown>;
-/** Drives the SSR-time gate (gate.ts / runContentGate). */
-export interface ContentGateConfig {
-    /** Cookie that carries this gate's access token (e.g. "ag_token"). */
-    cookieName: string;
-    /**
-     * The gated resource id from the resolved graph, or "" when this gate does
-     * not apply to the current page (the engine then no-ops). This is also how a
-     * gate detects "is this my kind of page". Async to allow DB-backed resolution
-     * (e.g. agreement gate resolving the UUID from the page→agreement association
-     * when no pre-placed gate block exists).
-     */
-    getResourceId(resolved: Resolved): string | Promise<string>;
-    /**
-     * Verify the cookie's token for this resource → the verified identity
-     * ({email, optional display name}), or null. Token-agnostic by design:
-     * proposals use the shared content-gate token; agreements keep their existing
-     * token (also minted by the signing ORPC), so the engine never assumes one
-     * token format. Allow-list gates return just {email}; the GPT lead-capture
-     * gate also returns the captured name (carried in its token).
-     */
-    verifyToken(token: string | undefined, resourceId: string, nowMs: number): {
-        email: string;
-        name?: string;
-    } | null;
-    /**
-     * BAKED-IN unified auth. When a gate provides this resolver, the engine
-     * AUTOMATICALLY releases a logged-in viewer whose session email is in the
-     * authorized set — with no valid token and no per-gate code. This is the
-     * platform default for EVERY gated resource: any application surface with
-     * authentication gets "a signed-in, authorized viewer is never re-asked for
-     * their email/OTP" for free, just by exposing its authorized-email set (the
-     * same resolver its AccessConfig uses). Not called when the session is
-     * anonymous. Omit only for open-capture gates that have no authorized set.
-     */
-    resolveAuthorizedEmails?(resourceId: string): Promise<Set<string>>;
-    /**
-     * OPTIONAL OVERRIDE of the baked-in session check above — for the rare gate
-     * whose session→identity rule isn't simply "session email ∈ authorized set".
-     * When present it wins; otherwise the engine uses `resolveAuthorizedEmails`.
-     * Called only when no valid access token is present.
-     */
-    sessionAuthorize?(resolved: Resolved, resourceId: string): {
-        email: string;
-        name?: string;
-    } | null | Promise<{
-        email: string;
-        name?: string;
-    } | null>;
-    /** Reveal + seed the verified viewer's identity/session (token was valid). */
-    onAuthorized(resolved: Resolved, resourceId: string, identity: {
-        email: string;
-        name?: string;
-    }): void | Promise<void>;
-    /** Withhold content (strip/inject the gate) — token absent/invalid. Async-
-     *  capable so a gate can load its display/behaviour settings from a registry
-     *  row (DB-driven, not hardcoded); sync implementations remain valid. */
-    onUnauthorized(resolved: Resolved, resourceId: string): void | Promise<void>;
-}
-/** Drives the public access endpoint (access.ts / attachContentGateAccess). */
-export interface AccessConfig {
-    /** Route to mount, e.g. "/api/proposal-access". */
-    path: string;
-    /** Cookie to set on a match. */
-    cookieName: string;
-    /** Cookie lifetime in ms (Max-Age). */
-    ttlMs: number;
-    /** Form field carrying the resource id, e.g. "proposalId". */
-    recordIdField: string;
-    /**
-     * Open lead-capture gate: ANY non-empty email is accepted (no allow-list).
-     * For surfaces whose "gate" captures a visitor rather than authorizing one
-     * against a fixed set (the public GPT). When true, `resolveAuthorizedEmails`
-     * is not called. Default/omitted = allow-list mode (proposals, agreements).
-     */
-    openCapture?: boolean;
-    /**
-     * The authorized email set for a resource (lowercased), checked server-side.
-     * Not called when `openCapture` is true.
-     */
-    resolveAuthorizedEmails(resourceId: string): Promise<Set<string>>;
-    /**
-     * Mint the access token for a matched email (token-agnostic per gate).
-     * `name` is the optional captured display name (open-capture gates carry it
-     * in the token; allow-list gates ignore it).
-     */
-    signToken(resourceId: string, email: string, nowMs: number, name?: string): string | null;
-}
-export {};

package/src/content-gate/gate.d.ts

@@ -1,13 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The content-gate ENGINE. Runs in the page loader after the resource graph
- * resolves, BEFORE SSR. Orchestration only — the per-type behaviour (which
- * resource, who's authorized, what to seed, how to withhold) is supplied by a
- * ContentGateConfig, so agreements/proposals/future gates are configs, not new
- * functions. The single place that decides whether gated bytes reach the HTML.
- */
-import type { ContentGateConfig } from "./config-types.ts";
-export declare function runContentGate(resolved: Record<string, unknown>, cookieHeader: string | null, nowMs: number, config: ContentGateConfig): Promise<void>;

package/src/content-gate/parse-cookie.d.ts

@@ -1,9 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Parse a single cookie value out of a raw Cookie header — shared by the
- * content-gate engine and any gate config.
- */
-export declare function parseCookie(header: string | null, name: string): string | undefined;

package/src/content-gate/token.d.ts

@@ -1,48 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The single signed, short-lived access token for EVERY content gate (agreement,
- * proposal, and any future gated content). A gate withholds page content
- * server-side until the request carries a valid token for that resource; this is
- * the only thing that releases the content into the SSR, so without it a gated
- * page is never readable/scrapable by a link holder.
- *
- * HMAC-SHA256 (Bun-native) over {c:cookieName, r:resourceId, e:email, x:exp}.
- * `cookieName` is bound INTO the payload so a token minted for one gate
- * (e.g. ag_token) can never satisfy another gate's check (e.g. prop_token).
- *
- * Secret resolver, in preference order: AUTH_SECRET → ENCRYPTION_KEY →
- * DATABASE_URL (first one ≥16 chars). A gate signs AND verifies inside one
- * service, so it only needs a stable per-deployment secret; the fallback keeps a
- * gate working on a service that was never given AUTH_SECRET (e.g. the former
- * public-only proposals viewer) instead of failing closed and locking out every
- * authorized viewer. Any service that has AUTH_SECRET transparently prefers it.
- * Fail-closed: no usable secret yields null (no token, no access).
- */
-/** Mint a token proving `email` is authorized for `resourceId` under `cookieName`. */
-export declare function signAccessToken(cookieName: string, resourceId: string, email: string, nowMs: number, ttlMs: number, 
-/**
- * Optional display name to carry in the token (the public GPT lead-capture
- * gate uses this so a returning visitor's name is known at SSR — first paint
- * renders the full identity, not just the email). Allow-list gates
- * (proposals/agreements) omit it.
- */
-name?: string): string | null;
-/**
- * Validate a token for `cookieName` + `resourceId`. Returns the verified email
- * on success, null otherwise (bad signature, wrong gate, wrong resource,
- * expired, no secret).
- */
-export declare function verifyAccessToken(token: string | undefined | null, cookieName: string, resourceId: string, nowMs: number): string | null;
-/**
- * Like `verifyAccessToken` but returns the full verified identity ({email, name})
- * so a gate that carries a display name in the token (the public GPT lead-capture
- * gate) can seed the visitor's name — not just the email — at SSR. Same
- * signature/expiry/gate-binding checks; null on any failure.
- */
-export declare function verifyAccessTokenIdentity(token: string | undefined | null, cookieName: string, resourceId: string, nowMs: number): {
-    email: string;
-    name?: string;
-} | null;

package/src/content-page-floor.d.ts

@@ -1,39 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Pure decision: does a CONTENT route (no resource_type) whose loader resolved
- * a `page` body source warrant the branded not-found floor? Extracted from
- * register-registry-page-route so the rule is unit-testable independent of the
- * Hono/DB/graph machinery that wraps it (the fix's correctness does not depend
- * on the publish — verify-before-done).
- *
- * Three outcomes:
- *   - no page row (deleted/unmatched path, e.g. /roadmap) → dead-link 404 floor
- *   - page row exists but zero content blocks → empty-page 200 floor
- *   - otherwise → null (render normally)
- *
- * The "Vision Toolbar" leak this closes: a content catchall synthesized an empty
- * page for an unmatched path and served a cacheable 200; resource-not-found-is-
- * the-root-floor only fired for resource_type routes, so dead content links fell
- * through. See resource-not-found.ts for the floor + operator ruling 2026-07-21.
- */
-import { PrimaryResourceMissingError } from "./resource-not-found.ts";
-/**
- * A page ROW exists but its body has zero content blocks — a content gap, not a
- * dead link. True only when the row is present yet `puck_data` is absent or its
- * `content` array is empty. Handles string (raw) and object (normalized) puck_data.
- */
-export declare function pageBodyIsEmpty(page: unknown): boolean;
-/**
- * Decide whether a content route should fall to the branded not-found floor.
- * Returns the error to throw (mapped to the floor by bind-page-handler), or null
- * to render normally. `hasResourceType` routes are handled by the existing
- * resource_type missing check (caller-side) — they return null here.
- */
-export declare function decideContentPageFloor(opts: {
-    hasResourceType: boolean;
-    hasPageContentSource: boolean;
-    page: unknown;
-}): PrimaryResourceMissingError | null;

package/src/discover-blocks.d.ts

@@ -1,28 +0,0 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Surgical block discovery: at boot, queries every block_schema row in the
- * registry whose componentPath starts with one of the service's declared
- * block_packages, then dynamic-imports each one. Per-block try/catch — one
- * dead componentPath logs and skips, the rest still register and the page
- * renders the surviving blocks. This replaces the static
- * `.scala-install/page-manifest.ts` codegen output, which had the failure
- * mode of a single dead block_schema row crashing the whole manifest at
- * compile time.
- *
- * Empty block_packages is NOT fatal here: it falls back to scanning all
- * active block_schema (uninstalled packages skip via the per-block try/catch),
- * so a service whose row is unpopulated but whose blocks are installed still
- * renders. The real "booted with zero blocks" fail-closed is at the call site
- * (loaded.length === 0 → BootFatalError). A DB-unreachable error still throws —
- * no fallback to a package-side puckBlocks scan, which masked blockless boots.
- */
-import type { RendererComponentEntry } from "./types.ts";
-export interface DiscoveredBlocks {
-    components: Record<string, RendererComponentEntry>;
-    loaded: string[];
-    skipped: string[];
-}
-export declare function discoverBlocks(blockPackages: string[]): Promise<DiscoveredBlocks>;

package/src/expand-roster.d.ts

@@ -1,34 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Server-side roster expansion — the executor that handles "render N of block X
- * per data row" so the page never needs a domain-specific panel/list block. A
- * block authored with `props.dataRepeat: "parties"` is a TEMPLATE; before SSR
- * this clones it once per roster item into its parent slot (top-level content or
- * any Container's `content` slot), then drops the marker. Each clone:
- *   - sets `role` + `dataKey` to the item's key, so a prop-driven block (the
- *     SignatureField cell) finds its own party with no per-clone wiring;
- *   - substitutes `{{name}}` / `{{role}}` / `{{company}}` / `{{date}}` /
- *     `{{status}}` placeholders in any string prop (so a recipient row is plain
- *     `Container` + `Text` primitives — the copy lives on the page, not here).
- *     `{{status}}` resolves from the template's own `signedLabel` /
- *     `awaitingLabel` props (DB-driven copy), never hardcoded.
- * Generic over any roster; the agreement page passes its parties.
- */
-export interface RosterItem {
-    key: string;
-    role: string;
-    name: string;
-    title: string | null;
-    company: string | null;
-    signedAt: string | null;
-    signature: string | null;
-}
-/** Agreement-level tokens (one substitution, not per-party). */
-export interface RosterMeta {
-    [token: string]: string;
-}
-/** Expand roster templates + bind agreement-meta placeholders across regions. */
-export declare function expandRosterTemplates(resolved: Record<string, unknown>, parties: RosterItem[], meta?: RosterMeta): void;

package/src/fn-routers/agreement-completion-email.d.ts

@@ -1,14 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Completion delivery. When an agreement is fully EXECUTED (every party has
- * signed), email each party their executed copy + a note to download the
- * Certificate of Completion. Each link is a per-party magic-link (no email gate,
- * no OTP — see attach-agreement-magic.ts). Best-effort and self-contained: it
- * loads its own data and swallows every error, so a send failure is logged and
- * NEVER undoes the signature (the payment-setup non-fatal rule, applied to mail).
- * Fire-and-forget from the sign handler: `void sendAgreementCompletionEmails(...)`.
- */
-export declare function sendAgreementCompletionEmails(agreementId: string, baseUrl: string): Promise<void>;

package/src/fn-routers/agreement-send-router.d.ts

@@ -1,82 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * fn.agreementSend.send — authenticated "send for signature" procedure. Emails
- * each party of an agreement a link to its signing page, stamps the lifecycle
- * (sent_to / sent_at, status draft→sent), and returns a per-recipient result.
- *
- * Off-the-shelf path per building-applications: this is server logic beyond
- * CRUD, so it is a typed ORPC procedure (not a bespoke endpoint), and it sends
- * through the shared Resend adapter (@teamscala/api-resend) — the same surface
- * @teamscala/auth uses for OTP — never a new email integration.
- *
- * Per-org sender: emails go FROM the org's display name on the platform's
- * verified Resend domain ("<Org> via Sign <verified-addr>"), with reply_to set
- * to the org's contact_email, so replies reach the org without each org needing
- * its own verified domain. When an org later verifies its own sending domain,
- * resolveSender is the single place to switch the FROM address.
- *
- * Sending is privileged (it reaches real inboxes), so the procedure requires an
- * authenticated caller — the localhost super-admin bypass authorises operator /
- * portal-SSR callers; the public signing page cannot invoke it.
- */
-import * as v from "valibot";
-interface User {
-    id: string;
-    organisationId: string | null;
-}
-interface Context {
-    user: User | null | undefined;
-    headers: Headers;
-    resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-    prisma: any;
-}
-export declare const agreementSendRouter: {
-    send: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
-        headers: Headers;
-        resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-        prisma: any;
-        user: User;
-    }>, v.ObjectSchema<{
-        readonly agreementId: v.StringSchema<undefined>;
-        /** Public base URL of the signing site, e.g. https://sign-dev.scala.business (no trailing slash). */
-        readonly baseUrl: v.StringSchema<undefined>;
-    }, undefined>, import("@orpc/contract").Schema<{
-        ok: false;
-        error: string;
-        sentAt?: undefined;
-        url?: undefined;
-        sent?: undefined;
-    } | {
-        error?: undefined;
-        ok: boolean;
-        sentAt: string | null;
-        url: string;
-        sent: {
-            email: string;
-            ok: boolean;
-            id?: string;
-            error?: string;
-        }[];
-    }, {
-        ok: false;
-        error: string;
-        sentAt?: undefined;
-        url?: undefined;
-        sent?: undefined;
-    } | {
-        error?: undefined;
-        ok: boolean;
-        sentAt: string | null;
-        url: string;
-        sent: {
-            email: string;
-            ok: boolean;
-            id?: string;
-            error?: string;
-        }[];
-    }>, Record<never, never>, Record<never, never>>;
-};
-export {};

package/src/fn-routers/ai-health-router.d.ts

@@ -1,35 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * `fn.aiHealth` — the AI-availability probe the shared chat hook
- * (`useAIHealthCheck`) polls before showing the chat's health dot. It resolves
- * the same DB-driven default model the chat engine uses (`ai-default-model`
- * config → an active `llm_model` row) and reports `{status, mcp, gateway}`;
- * `status:"ok"` means the chat has a usable model configured.
- *
- * Unauthed (a public GPT surface polls it too) and a LIGHTWEIGHT registry read
- * via the request `prisma` — deliberately NO `@teamscala/chat-completion` import,
- * so wiring this universal procedure never pulls the AI stack into every
- * service. Registered into the `fn` namespace by registerFnRouters, so any
- * chat-capable service answers it instead of 404-ing.
- */
-interface Context {
-    prisma: {
-        registry_entries: {
-            findFirst: (args: unknown) => Promise<{
-                config?: unknown;
-                id?: string;
-            } | null>;
-        };
-    };
-}
-export interface AiHealthResponse {
-    status: "ok" | "error";
-    mcp: boolean;
-    gateway: boolean;
-    error?: string;
-}
-export declare const aiHealthHandler: import("@orpc/server").DecoratedProcedure<Context & Record<never, never>, Context, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<AiHealthResponse, AiHealthResponse>, Record<never, never>, Record<never, never>>;
-export {};

package/src/fn-routers/auth-router.d.ts

@@ -1,47 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * ORPC procedures for auth checks (isOrgAdmin, resolveAdminOverride).
- * Extracted from @teamscala/orpc/fn-router — primitives tier must not
- * contain application-specific auth logic.
- */
-interface User {
-    id: string;
-    name?: string | null;
-    email?: string;
-    organisationId: string | null;
-}
-interface Context {
-    user: User | null | undefined;
-    headers: Headers;
-    resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-    prisma: any;
-    orgId?: string | null;
-}
-declare const authed: import("@orpc/server").BuilderWithMiddlewares<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
-    headers: Headers;
-    resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-    prisma: any;
-    user: User;
-    orgId: string | null | undefined;
-}>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<unknown, unknown>, Record<never, never>, Record<never, never>>;
-export declare const authRouter: {
-    isOrgAdmin: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
-        headers: Headers;
-        resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-        prisma: any;
-        user: User;
-        orgId: string | null | undefined;
-    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<boolean, boolean>, Record<never, never>, Record<never, never>>;
-    resolveAdminOverride: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
-        headers: Headers;
-        resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-        prisma: any;
-        user: User;
-        orgId: string | null | undefined;
-    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<string | null, string | null>, Record<never, never>, Record<never, never>>;
-};
-export type { Context, User };
-export { authed };

package/src/fn-routers/cache-admin-router.d.ts

@@ -1,57 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * `fn.cacheAdmin` — ORPC procedures for in-process cache enable/disable/flush.
- * Replaces the former `/api/data/cache-monitor/*` HANDLER_MAP entries
- * (orpc-is-the-only-api: every API surface is a typed ORPC procedure, never a
- * hand-written Hono route). Calls through @teamscala/cache/registry — the
- * platform-singleton cache surface (cache-is-the-only-cache).
- */
-import * as v from "valibot";
-export declare const cacheAdminRouter: {
-    enable: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("./auth-router.ts").Context & Record<never, never>, import("./auth-router.ts").Context, import("./auth-router.ts").Context>, import("@orpc/server").MergedCurrentContext<import("./auth-router.ts").Context, {
-        headers: Headers;
-        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
-        prisma: any;
-        user: import("./auth-router.ts").User;
-        orgId: string | null | undefined;
-    }>, v.ObjectSchema<{
-        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-    }, undefined>, import("@orpc/contract").Schema<{
-        ok: boolean;
-        name: string;
-    }, {
-        ok: boolean;
-        name: string;
-    }>, Record<never, never>, Record<never, never>>;
-    disable: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("./auth-router.ts").Context & Record<never, never>, import("./auth-router.ts").Context, import("./auth-router.ts").Context>, import("@orpc/server").MergedCurrentContext<import("./auth-router.ts").Context, {
-        headers: Headers;
-        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
-        prisma: any;
-        user: import("./auth-router.ts").User;
-        orgId: string | null | undefined;
-    }>, v.ObjectSchema<{
-        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-    }, undefined>, import("@orpc/contract").Schema<{
-        ok: boolean;
-        name: string;
-    }, {
-        ok: boolean;
-        name: string;
-    }>, Record<never, never>, Record<never, never>>;
-    flush: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("./auth-router.ts").Context & Record<never, never>, import("./auth-router.ts").Context, import("./auth-router.ts").Context>, import("@orpc/server").MergedCurrentContext<import("./auth-router.ts").Context, {
-        headers: Headers;
-        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
-        prisma: any;
-        user: import("./auth-router.ts").User;
-        orgId: string | null | undefined;
-    }>, v.ObjectSchema<{
-        readonly name: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    }, undefined>, import("@orpc/contract").Schema<{
-        flushed: number;
-    }, {
-        flushed: number;
-    }>, Record<never, never>, Record<never, never>>;
-};