@teamscala/service-boot 0.23.318 → 0.23.319

package/src/serve/stamp-transport-identity.ts

@@ -26,10 +26,23 @@
  * identity — a clone can never upgrade).
  */
 
+import { CALLER_HEADERS } from "@teamscala/os/contracts/mcp";
 import { resolveSocketPeer } from "@teamscala/proc-walker/socket-peer";
 
 const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
 
+/**
+ * Preserve useful process attribution without copying arbitrary argv into logs.
+ * Arguments routinely contain bearer headers, inline scripts, URLs and secret
+ * values. There is no complete flag-name redaction list, so the safe boundary
+ * is structural: retain argv[0] and state that arguments were removed.
+ */
+export function summariseLocalCommand(cmdline: readonly string[]): string | null {
+	const executable = cmdline[0]?.trim();
+	if (!executable) return null;
+	return cmdline.length > 1 ? `${executable} [arguments redacted]` : executable;
+}
+
 /**
  * Return a Request with transport-identity headers stamped, or the original
  * `req` when no stamping is needed/possible. Never throws.
@@ -53,15 +66,15 @@ export function stampTransportIdentity(
 		const port = peer?.port;
 		const address = peer?.address ?? null;
 		const needsPort =
-			typeof port === "number" && port > 0 && !req.headers.has("x-caller-remote-port");
+			typeof port === "number" && port > 0 && !req.headers.has(CALLER_HEADERS.REMOTE_PORT);
 		// Nothing to stamp when there is no peer address and no port to add.
 		if (!needsPort && address === null) return req;
 
 		const headers = new Headers(req.headers);
-		if (needsPort) headers.set("x-caller-remote-port", String(port));
+		if (needsPort) headers.set(CALLER_HEADERS.REMOTE_PORT, String(port));
 		if (address) {
-			headers.delete("x-caller-remote-address");
-			headers.set("x-caller-remote-address", String(address));
+			headers.delete(CALLER_HEADERS.REMOTE_ADDRESS);
+			headers.set(CALLER_HEADERS.REMOTE_ADDRESS, String(address));
 		}
 		// Local-caller attribution: loopback peer + no forwarding header => a
 		// direct local fetch whose owning process we can name via /proc.
@@ -75,9 +88,9 @@ export function stampTransportIdentity(
 		) {
 			const owner = resolveSocketPeer(port);
 			if (owner) {
-				headers.set("x-caller-local-comm", owner.comm);
-				const cmd = owner.cmdline.join(" ").trim();
-				if (cmd) headers.set("x-caller-local-cmd", cmd.slice(0, 160));
+				headers.set(CALLER_HEADERS.LOCAL_COMM, owner.comm);
+				const cmd = summariseLocalCommand(owner.cmdline);
+				if (cmd) headers.set(CALLER_HEADERS.LOCAL_CMD, cmd);
 			}
 		}
 		return new Request(req.url, {

package/src/two-phase-boot.ts

@@ -54,6 +54,7 @@ import { registerPageRoutes } from "./register-page-routes.ts";
 import { runBootHookList } from "./run-boot-hook-list.ts";
 import { buildClientAssets } from "./build-client-assets.ts";
 import { discoverBlocks } from "./discover-blocks.ts";
+import { registerPageServerClient } from "./register-page-server-client.ts";
 import { swapApp } from "./mutable-app-ref.ts";
 import type { CreatePageHandler } from "./types.ts";
 
@@ -63,13 +64,60 @@ let realPageHandler: CreatePageHandler | null = null;
 let fullAppReady = false;
 
 /**
- * Set the real page handler (called when Phase 2 completes).
+ * Set the real page handler (called when Phase 2 completes on an SSR service).
+ *
+ * Registering the SSR handler implies the full app is built, so this also flips
+ * readiness — but the reverse does NOT hold, which is why `markFullAppReady`
+ * exists separately. See its note.
  */
 export function setPageHandler(handler: CreatePageHandler): void {
 	realPageHandler = handler;
+	markFullAppReady();
+}
+
+/**
+ * Flip readiness once phase 2 has built the full app.
+ *
+ * SEPARATE FROM `setPageHandler` BECAUSE THE TWO FACTS CAME APART. Readiness
+ * means "phase 2 finished"; the page handler means "this service renders pages
+ * server-side". Every service was SSR, so one flag honestly carried both — until
+ * `render_mode=client` (`granular runtime`) made a service that completes phase 2
+ * and never registers an SSR handler.
+ *
+ * Leaving readiness inside `setPageHandler` made such a service PERMANENTLY
+ * un-ready: `/health` answered `{"status":"starting"}` forever while the process
+ * was healthy and serving. That is the failure `readiness-gated-boot` is written
+ * against — a service must be "binary: fully-ready or cleanly-unavailable", and
+ * a never-ready health signal makes the activator's wake gate and every
+ * health-gated router treat a working service as down.
+ *
+ * Measured 2026-08-07 on scala-agents-ui: boot completed in 5023ms, "Full app
+ * built: 50 block(s)" logged, `GET /` correctly 302'd to sign-in, and `/health`
+ * still reported starting — while three untouched UI services reported ok.
+ */
+export function markFullAppReady(): void {
 	fullAppReady = true;
 }
 
+/**
+ * Reset both phase-2 flags. TEST-ONLY.
+ *
+ * `fullAppReady` is module state that only ever transitions false -> true in
+ * production, and Bun shares a module instance across every test file in a run —
+ * so the SSR readiness test and the client-only readiness test contaminate each
+ * other purely by file order. Splitting them across files does NOT isolate them;
+ * it only hides the coupling until CI runs them together.
+ *
+ * A test that passes alone and fails in a suite is worse than no test, so the
+ * reset is exported rather than left as an ordering convention nobody can see.
+ * Never called from production code — `setPageHandler`/`markFullAppReady` are
+ * the only writers on the boot path.
+ */
+export function __resetPhase2StateForTest(): void {
+	realPageHandler = null;
+	fullAppReady = false;
+}
+
 /**
  * Get the current page handler state.
  */
@@ -247,16 +295,6 @@ export async function buildMinimalApp(
 		preloadServerPackages(serverPackages),
 	);
 	const ttlPromise = runStep("init-gate-ttls", () => initGateTtls());
-	const discoverPromise = runStep("discover-blocks", () =>
-		discoverBlocks(blockPackages),
-	);
-	// Attach an immediate rejection sink: discoverPromise is fired here but
-	// awaited much later (after the gate chain + mounts). If discoverBlocks
-	// rejects during that overlap window, the rejection would surface as an
-	// unhandledRejection before the await below can catch it. The sink is a
-	// no-op — the real error still propagates at the `await discoverPromise`
-	// site because each consumer of a rejected promise receives the rejection.
-	discoverPromise.catch(() => {});
 
 	// Public access endpoints — MUST be registered before the auth gate (Hono
 	// dispatches middleware + handlers in registration order; the content-gate
@@ -305,6 +343,21 @@ export async function buildMinimalApp(
 		await runStep("mount-orpc-router", () => mountOrpcRouter(app, serviceSlug));
 	}
 
+	// Register the in-process ORPC server client BEFORE discoverBlocks — it
+	// calls getServerClient() which needs the client set here. Must follow
+	// mount-orpc-router (which builds the router getAppRouter uses).
+	// Previously ran inside register-page-routes (too late — discoverBlocks
+	// fired before it, hitting the empty-router fallback).
+	await runStep("register-page-server-client", () =>
+		registerPageServerClient(serviceSlug),
+	);
+
+	// NOW fire discoverBlocks (getServerClient is set). Awaited below before
+	// register-page-routes consumes the result.
+	const discoverPromise = runStep("discover-blocks", () =>
+		discoverBlocks(blockPackages),
+	);
+
 	const wsRouteCount = await runStep("register-ws-routes", () =>
 		registerWsRoutes(app, config, mountRegistry, serviceSlug),
 	);
@@ -376,7 +429,8 @@ export async function buildMinimalApp(
 				// (the same pulsating-logo holding page scale-to-zero uses) —
 				// never bare plain text (loading-via-logo-loading).
 					if (!fullAppReady || !realPageHandler) {
-						return new Response(buildWakingPageHtml({}), {
+						const logo = await resolveErrorPageLogo(serviceSlug);
+						return new Response(buildWakingPageHtml({ logoUrl: logo }), {
 							status: 503,
 							headers: {
 								"content-type": "text/html; charset=utf-8",
@@ -498,11 +552,25 @@ export async function buildFullApp(
 			`${Object.keys(components).length} component(s)`,
 	);
 
-	// Set the real page handler so the dynamic handler in Phase 1 can delegate to it
-	setPageHandler(deps.createPageHandler);
-	log.info(
-		`[two-phase-boot:${serviceSlug}] Real page handler registered - page routes now delegate to full app`,
-	);
+	// Set the real page handler so the dynamic handler in Phase 1 can delegate to it.
+	// Client-only services (render_mode=client) have no SSR page handler — skip
+	// (they serve via the client bundle, never SSR). Guarded so undefined is a
+	// no-op rather than a crash.
+	if (deps.createPageHandler) {
+		setPageHandler(deps.createPageHandler);
+		log.info(
+			`[two-phase-boot:${serviceSlug}] Real page handler registered - page routes now delegate to full app`,
+		);
+	} else {
+		// The full app IS built — this service simply never renders server-side,
+		// so readiness is flipped directly rather than as a side effect of
+		// registering an SSR handler that will never exist. Without this a
+		// client-only service is permanently un-ready (see markFullAppReady).
+		markFullAppReady();
+		log.info(
+			`[two-phase-boot:${serviceSlug}] Client-only mode (render_mode=client) — no SSR page handler registered`,
+		);
+	}
 
 	const resolvedBlocks = loaded.map((slug) => ({
 		slug,

package/src/two-phase-health-gate-client-only.test.ts

@@ -0,0 +1,77 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * A CLIENT-ONLY service (`render_mode=client`) must reach ready, even though it
+ * never registers an SSR page handler.
+ *
+ * Separate file from `two-phase-health-gate.test.ts` on purpose: `fullAppReady`
+ * is module state that only transitions false -> true and has no reset hook, so
+ * the two ready-paths cannot both be exercised in one module instance. A reset
+ * hook would exist only for tests.
+ *
+ * THE REGRESSION THIS LOCKS (measured 2026-08-07 on scala-agents-ui). Readiness
+ * used to be flipped INSIDE `setPageHandler`, which was honest while every
+ * service was SSR. `render_mode=client` made a service that completes phase 2
+ * and never calls it, so `/health` answered `{"status":"starting"}` FOREVER
+ * while the process was healthy and serving — boot completed in 5023ms, "Full
+ * app built: 50 block(s)" logged, `GET /` correctly 302'd to sign-in, and three
+ * untouched UI services reported ok beside it.
+ *
+ * That is precisely what `readiness-gated-boot` forbids ("binary: fully-ready or
+ * cleanly-unavailable"): a permanently-un-ready health signal makes the
+ * activator's wake gate and every health-gated router treat a working service as
+ * down. Exercised through a real Hono request against the REAL exported handler
+ * (`proxy-is-not-behaviour`) — a source grep would prove the call exists, never
+ * that the endpoint answers 200.
+ */
+
+import { beforeAll, describe, expect, test } from "bun:test";
+import { Hono } from "hono";
+import {
+	__resetPhase2StateForTest,
+	getPageHandlerState,
+	healthHandler,
+	markFullAppReady,
+} from "./two-phase-boot.ts";
+
+/** Mount the real handler exactly as buildMinimalApp does. */
+const app = new Hono().get("/health", healthHandler);
+
+describe("/health for a client-only service", () => {
+	// Bun shares one module instance across every test file in a run, so the SSR
+	// readiness test's setPageHandler leaks into this file when both run together.
+	// Without this reset the suite passes file-by-file and fails in CI.
+	beforeAll(() => {
+		__resetPhase2StateForTest();
+	});
+
+	test("before phase 2 completes it reports 503, not ready", async () => {
+		expect(getPageHandlerState().ready).toBe(false);
+
+		const res = await app.request("/health");
+
+		expect(res.status).toBe(503);
+		expect(await res.json()).toEqual({ status: "starting" });
+	});
+
+	test("reaches ready without an SSR page handler", async () => {
+		// The real client-only phase-2 path: buildFullApp finishes and marks the
+		// app ready WITHOUT setPageHandler, because there is no SSR handler.
+		markFullAppReady();
+
+		const state = getPageHandlerState();
+		expect(state.ready).toBe(true);
+		// The discriminator: ready is true while hasHandler stays false. Asserting
+		// both is what separates this from the SSR path — a fix that flipped ready
+		// by registering a dummy handler would pass `ready` and fail here.
+		expect(state.hasHandler).toBe(false);
+
+		const res = await app.request("/health");
+
+		expect(res.status).toBe(200);
+		expect(res.ok).toBe(true);
+		expect(await res.json()).toEqual({ status: "ok" });
+	});
+});

package/src/two-phase-health-gate.test.ts

@@ -27,9 +27,14 @@
  * 137ms warm), which is why one app looked healthy and the others did not.
  */
 
-import { describe, expect, test } from "bun:test";
+import { beforeAll, describe, expect, test } from "bun:test";
 import { Hono } from "hono";
-import { healthHandler, setPageHandler, getPageHandlerState } from "./two-phase-boot.ts";
+import {
+	__resetPhase2StateForTest,
+	getPageHandlerState,
+	healthHandler,
+	setPageHandler,
+} from "./two-phase-boot.ts";
 
 /** Mount the real handler exactly as buildMinimalApp does. */
 const app = new Hono().get("/health", healthHandler);
@@ -41,6 +46,12 @@ const app = new Hono().get("/health", healthHandler);
  * hook and adding one would exist only for tests.
  */
 describe("/health is gated on page-serving readiness", () => {
+	// Bun shares one module instance across test files, so a sibling file that
+	// marks the app ready would otherwise decide this file's first assertion.
+	beforeAll(() => {
+		__resetPhase2StateForTest();
+	});
+
 	test("before the phase-2 swap it reports 503, not ready", async () => {
 		expect(getPageHandlerState().ready).toBe(false);
 

package/src/agreement-gate.d.ts

@@ -1,19 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The AGREEMENT content gate, expressed as config for the content-gate primitive
- * (content-gate/). The agreement-specific bits: which resource (the placed
- * SignIn gate block's id), who's authorized (the signer roster), what to seed
- * (the verified signer's signing session into every SignatureField), and how to
- * withhold (strip the gate region to gate-only + strip {{agreement.*}} chrome).
- * The engine handles cookie/token/verify/orchestration.
- *
- * The signing logic (buildSigningSession, seedSigningBlocks, roster expansion,
- * placeholder strip) is preserved verbatim from the former gate-agreement-
- * content.ts — only the cookie/token orchestration moved into the shared engine.
- */
-import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-export declare const agreementGateConfig: ContentGateConfig;
-export declare const agreementAccessConfig: AccessConfig;

package/src/asset-cache-key.d.ts

@@ -1,11 +0,0 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * ETag derivation for the asset proxy that incorporates the negotiated
- * image format so per-Accept variants cache independently.
- */
-export type TargetFormat = "webp" | "avif" | "jpeg" | "png" | "gif" | "svg" | "ico" | "original";
-export declare function negotiateFormat(acceptHeader: string | null, storedContentType: string): TargetFormat;
-export declare function buildEtag(baseEtag: string, format: TargetFormat): string;

package/src/asset-optimize.d.ts

@@ -1,17 +0,0 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * On-the-fly image optimisation for the asset proxy. Converts stored
- * PNG/JPEG to WebP or AVIF when the browser signals support, using
- * @teamscala/image-optimizer's compressImage primitive. Returns null
- * on failure so the caller can fall back to the original stream.
- */
-import type { TargetFormat } from "./asset-cache-key.ts";
-export interface OptimizeResult {
-    data: Buffer;
-    format: string;
-    processedSize: number;
-}
-export declare function optimizeImage(buffer: Buffer, targetFormat: TargetFormat): Promise<OptimizeResult | null>;

package/src/asset-proxy.d.ts

@@ -1,11 +0,0 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Same-origin S3 asset proxy with on-the-fly image optimisation.
- * Streams objects from the configured S3 bucket, converting PNG/JPEG
- * to WebP/AVIF when the browser declares support via Accept header.
- * Returns 404 for missing keys, 502 for S3 failures. Never redirects.
- */
-export declare function handleAssetProxy(req: Request): Promise<Response>;

package/src/asset-social-card.d.ts

@@ -1,17 +0,0 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Dynamic-import wrapper around image-optimizer's in-process sharp
- * social-card op. Mirrors asset-optimize.ts's optional-dependency shape:
- * services without image-optimizer installed transparently get null and
- * fall back to the raw asset stream. In-process (not HTTP) because the
- * og:image transform is a cold path per shared link — no auth handshake,
- * no per-consumer service config.
- */
-export interface SocialCardOutcome {
-    data: Buffer;
-    processedSize: number;
-}
-export declare function renderSocialCard(buffer: Buffer): Promise<SocialCardOutcome | null>;

package/src/attach-agreement-magic.d.ts

@@ -1,20 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The agreement MAGIC-LINK endpoint. A recipient who clicks an emailed
- * "Review & sign" link — which carries a pre-authorised, signed ag_token for
- * THEIR party — lands here: the token is verified for the agreement, the
- * ag_token cookie is set on the shared parent domain, and the browser is
- * 302-redirected straight into the signing page. No email-entry gate, no OTP —
- * "came from our email" IS the proof of identity, exactly like the
- * proposal-accept hand-off (attach-proposal-accept.ts).
- *
- * The token is the same HMAC ag_token the gate verifies (30-min TTL, scoped to
- * {agreementId, email}); an invalid/expired/forged token sets no cookie and the
- * destination page simply shows the normal email gate. GET so it is a plain
- * clickable link in an email.
- */
-import type { Hono } from "hono";
-export declare function attachAgreementMagic(app: Hono, serviceSlug: string): Promise<void>;

package/src/attach-portal-members.d.ts

@@ -1,23 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Portal-secured member directory endpoint. Resolves members of an org via a
- * parameterized raw join over better_auth_member + "user" — NOT the typed
- * `member` ORPC model, which is deliberately omitted from the portal's
- * service_schema (security: the raw table is not exposed as a typed CRUD
- * surface). Mirrors the agreement-gate.ts:109-150 precedent.
- *
- * The portal's auth middleware (better-auth-cookie) gates the endpoint — only
- * authenticated users can call it. The orgId comes from the caller's context
- * (the portal resolves it from the session + passes it).
- *
- * Endpoint: GET /api/portal/members?orgId=<uuid>
- *   - orgId omitted: super-admin all-orgs mode (returns every member across
- *     all orgs, strictly gated to super-admin via getSession; used by the
- *     "View As" impersonation dropdown).
- * Response: { members: Array<{ id, user_id, organization_id, role, email, name, image }> }
- */
-import type { Hono } from "hono";
-export declare function attachPortalMembers(app: Hono): Promise<void>;

package/src/attach-proposal-accept.d.ts

@@ -1,26 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The proposal ACCEPT endpoint. A viewer who has passed the proposal gate (holds
- * a valid prop_token) POSTs {proposalId} here to accept; the server generates a
- * signing document from the proposal (createAgreementFromProposal) and
- * 302-redirects them straight into signing it on the sign site. This replaces
- * the old mailto CTA. Mounted BEFORE the auth gate so it is publicly reachable —
- * the prop_token (not a login) is the proof of identity, exactly like the
- * content-gate access endpoint.
- *
- * Single sign-on across the journey: the viewer already proved their email at
- * the proposal gate (prop_token), so we MUST NOT make them re-enter it on the
- * sign site. Before redirecting, we mint the agreement's ag_token for that same
- * verified email and set it on the SHARED parent domain (Domain=.scala.business)
- * so the browser carries it from proposals.scala.business to sign.scala.business
- * — the agreement gate then auto-reveals + seeds the signing session with zero
- * extra prompts. This requires both hosts to resolve the SAME token secret
- * (AUTH_SECRET→ENCRYPTION_KEY→DATABASE_URL): scala-sign must carry ENCRYPTION_KEY
- * (also required to decrypt the org's Stripe key on full sign), so both hosts
- * land on ENCRYPTION_KEY and the carried token verifies.
- */
-import type { Hono } from "hono";
-export declare function attachProposalAccept(app: Hono, serviceSlug: string): Promise<void>;

package/src/attach-proposal-magic.d.ts

@@ -1,18 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The proposal MAGIC-LINK endpoint — the proposal twin of attach-agreement-magic.
- * A recipient who clicks an emailed "View your proposal" link (carrying a signed,
- * per-recipient prop_token) lands here: the token is verified for the proposal,
- * the prop_token cookie is set, and the browser is 302-redirected straight into
- * the proposal page. No email-entry gate, no OTP. An invalid/expired token sets
- * no cookie and the page falls through to the normal email gate.
- *
- * The prop_token is host-scoped (proposals are served on the proposals host only),
- * unlike the agreement ag_token which spans .scala.business for the proposal→sign
- * hand-off. GET so it is a plain clickable link in an email.
- */
-import type { Hono } from "hono";
-export declare function attachProposalMagic(app: Hono, serviceSlug: string): Promise<void>;

package/src/attach-transfers-upload.d.ts

@@ -1,27 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Authenticated asset upload — POST /api/transfers/upload. Restores the
- * handler deleted with @teamscala/server-files (commit ca5643ef); avatar/logo
- * upload had 404'd on every service since. Writes to S3 via
- * @teamscala/object-storage/create/write-ops and returns the STORED-form URL
- * (`/api/files/<key>`) the client persists into avatar_url/logo_url — the
- * display path rewrites it to the public `/api/assets/<encoded-key>` proxy
- * via `toAssetPath` (@teamscala/formatters/asset-url). Self-authenticates
- * (getSession) so it mounts BEFORE the auth gate.
- *
- * Key scheme is USER-scoped (`users/<userId>/<type>/<file>-<ts>.<ext>`) per
- * the operator ruling: a profile picture belongs to the individual, not any
- * org (the prior handler's org-scoped `<orgId>/avatars/...` encoded the
- * uploading org into a personal asset). Spec + history:
- * `reference/asset-upload-system.md`.
- *
- * `thumbUrl` mirrors `url` — the full image is served for both; a separate
- * generated thumbnail is a future refinement (the prior handler generated
- * one, but the image-resize dependency is not wired here yet and a missing
- * thumb must not block the upload restoring).
- */
-import type { Hono } from "hono";
-export declare function attachTransfersUpload(app: Hono): Promise<void>;

package/src/auth-gate.d.ts

@@ -1,28 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Auth middleware factory. Three modes, same BetterAuth email-OTP mechanism:
- *
- *   service_install.auth values:
- *   - omitted | "none"            → no gate, no handler (scala-public, scala-sign)
- *   - "better-auth-cookie"        → full session auth: mount handler + session gate
- *   - "email-otp-only"            → mount handler (OTP send/verify), no session gate
- *
- *   The sign-in block determines the UX per mode:
- *   - "full"         → email → OTP → session → portal selection (portal, agents, docs, gpt)
- *   - "email-gate"   → email → OTP → verify-only, no session (forms, proposals, quiz)
- *   - "capture-only" → email field only, no OTP (sign)
- *
- *   There is NO localhost bypass: 127.0.0.1 is gated identically to the tunnel
- *   (no session → /sign-in). Tools needing an authed view sign in
- *   (getSuperAdminSessionCookie); the dev OTP is DB-readable.
- *
- *   When SCALA_OTP_URL is set, /api/auth/* forwards to the centralised
- *   scala-otp service (per otp-centralised-via-otp-service). Otherwise
- *   the local better-auth handler is used (dev-host fallback).
- */
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
-import type { Hono } from "hono";
-export declare function attachAuthGate(app: Hono, config: ServiceInstallConfig, serviceSlug: string): Promise<void>;

package/src/bind-page-handler.d.ts

@@ -1,18 +0,0 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Calls a createPageHandler() handler with the per-request extras the
- * SSR pipeline needs: the resolved userId/orgId (from localhost-bypass
- * or better-auth-cookie), and the htmlTemplate. Shared by the regions
- * and page_slug shell variants.
- */
-import type { Context } from "hono";
-type PageHandler = (req: Request, extras: Record<string, unknown>) => Promise<{
-    body: unknown;
-    status: number;
-    headers: HeadersInit;
-}>;
-export declare function bindPageHandler(c: Context, handler: PageHandler, authMode: string, serviceSlug: string, label: string, resourceOrgId?: string): Promise<Response>;
-export {};

package/src/build-client-assets/input-hashing.d.ts

@@ -1,25 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Input hashing for the client-asset build fingerprint.
- *
- * Split out of build-client-assets.ts, which had grown to 1221 lines holding
- * six distinct concerns (lock + status, manifest, hydrate bundle, source maps,
- * stylesheet/tailwind, and this). `single-purpose-file` did not catch it: that
- * rule flags a file whose top-level exports share no common name root, which
- * measures export-NAME cohesion rather than how many concerns a file holds — so
- * a large file with few tidily-named exports stays invisible to it.
- *
- * This module owns ONE concern: turning the build's real inputs into a stable
- * hash. `computeInputFingerprint` (still in the parent, and still the only
- * exported entry point) composes the two functions exported here; everything
- * else is module-private because nothing outside needs it.
- *
- * Byte-for-byte move — imports adjusted, nothing else. No renames, no type
- * changes (`migrations-copy-not-rewrite`).
- */
-import { createHash } from "node:crypto";
-export declare function hashResolvedPackageStylesheets(cwd: string, h: ReturnType<typeof createHash>): Promise<void>;
-export declare function hashTeamgbgJsGraph(cwd: string, h: ReturnType<typeof createHash>): Promise<void>;

package/src/build-client-assets/source-candidates.d.ts

@@ -1,27 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Tailwind source-candidate scanning for the client CSS build.
- *
- * Split out of build-client-assets.ts (1221 lines, six concerns). Owns ONE
- * concern: turning the resolved `@source` directories into the candidate token
- * set Tailwind's `build()` consumes.
- *
- * Why it exists at all, preserved from the original: Tailwind v4's low-level
- * `compile()` does NOT scan content, and @tailwindcss/oxide's native Scanner is
- * not a dependency of the bare `tailwindcss` lib — only of the integration
- * packages. So the tokens are extracted here. Over-extraction is safe, because
- * `build()` ignores any token that is not a valid utility. Dropping this scan is
- * what shipped an unstyled page to the operator's tablet on 2026-06-13; it is
- * enforced by `css-build-scans-source-candidates`.
- *
- * Byte-for-byte move — imports adjusted, nothing else.
- */
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-export declare function scanSourceCandidates(sources: Array<{
-    base: string;
-    pattern: string;
-    negated?: boolean;
-}>, log: ReturnType<typeof getAppLogger>): Promise<string[]>;