@teamscala/service-boot 0.23.319 → 0.23.321

package/src/handlers/sweep-host-cache.ts

@@ -16,14 +16,8 @@
  * Path convention (config.retention keys, substituted at runtime via `userHome()`
  * / `workspaceRoot()` per `host-literals-via-substitution` — source never
  * hardcodes host paths):
-*   "${HOME}/.bun/install/cache"          → "30 days"
-*   "${HOME}/.config/*.retired-*"         → "14 days"  (glob leaf, optional)
-*
-* config.retention_dirs — whole-DIRECTORY prune for build caches (Rust
-* `target/`) whose unit is the dir, not the file (file-by-mtime would corrupt
-* the cache). Keys support `*` globs; a matched dir is deleted ENTIRELY only
-* when its newest file is older than the cutoff:
-*   "${WORKSPACE}/<repo>/target"         → "30 days"  (glob wildcard, whole-dir delete)
+ *   "${HOME}/.bun/install/cache"          → "30 days"
+ *   "${HOME}/.config/*.retired-*"         → "14 days"  (glob leaf, optional)
  *
  * Deletion runs through Bun fs APIs — pure filesystem deletion needs no shell,
  * so `spawn-is-the-only-spawn` does not apply (that governs shell commands).
@@ -40,7 +34,7 @@
  * Registered under slug `@teamscala/service-boot:sweep-host-cache`.
  */
 import { rm, readdir, stat } from "node:fs/promises";
-import { readdirSync, type Dirent } from "node:fs";
+import type { Dirent } from "node:fs";
 import { join } from "node:path";
 import { spawnSync } from "@teamscala/os/spawn/spawn";
 import { userHome, workspaceRoot } from "@teamscala/os/host-paths";
@@ -123,97 +117,11 @@ async function sweepPath(
 	return { path: rootDir, scanned, deleted, bytesFreed };
 }
 
-/**
- * Expand a path pattern containing single-segment `*` wildcards into concrete
- * paths (files or dirs). Used by `retention_dirs` so a single config key like
-* a pattern like `${WORKSPACE}/<star>/target` reaches every repo's target dir.
-* Sync + bounded: the
- * pattern is shallow (3 segments), and this runs once
- * nightly. Non-existent segments yield no matches (the caller stats each result).
- */
-export function expandGlob(pattern: string): string[] {
-	const absolute = pattern.startsWith("/");
-	const segments = (absolute ? pattern.slice(1) : pattern)
-		.split("/")
-		.filter((s) => s.length > 0);
-	let current: string[] = [absolute ? "/" : "."];
-	for (const seg of segments) {
-		if (current.length === 0) break;
-		const next: string[] = [];
-		for (const dir of current) {
-			let names: string[];
-			try {
-				names = readdirSync(dir);
-			} catch {
-				continue;
-			}
-			for (const name of names) {
-				if (seg === "*" || seg === name) next.push(join(dir, name));
-			}
-		}
-		current = next;
-	}
-	return current;
-}
-
-/**
- * Is `dir` stale — i.e. NO file under it is newer than `cutoffMs`? Walks
- * recursively and SHORT-CIRCUITS the instant it finds a fresh file (so an
- * actively-built target dir returns fast without walking its full tree). On a
- * stale dir the walk is complete and returns the total size + file count, so
- * the caller can report bytes-freed before deleting the dir whole.
- */
-export async function checkDirStale(
-	dir: string,
-	cutoffMs: number,
-): Promise<{ stale: boolean; bytes: number; fileCount: number }> {
-	const stack: string[] = [dir];
-	let bytes = 0;
-	let fileCount = 0;
-	while (stack.length > 0) {
-		const d = stack.pop();
-		if (d === undefined) break;
-		let entries: Dirent[];
-		try {
-			entries = await readdir(d, { withFileTypes: true });
-		} catch {
-			continue;
-		}
-		for (const entry of entries) {
-			const full = join(d, entry.name);
-			if (entry.isDirectory()) {
-				stack.push(full);
-			} else if (entry.isFile()) {
-				try {
-					const st = await stat(full);
-					if (st.mtimeMs >= cutoffMs) {
-						return { stale: false, bytes: 0, fileCount: 0 };
-					}
-					bytes += st.size;
-					fileCount++;
-				} catch {
-					// vanished/unreadable — skip
-				}
-			}
-		}
-	}
-	return { stale: true, bytes, fileCount };
-}
-
-/** Parse the root-fs Use% from `df --output=pcent,target` output (pure, for tests).
- *  Returns null if no root-mount line is found. */
-export function parseRootDiskPct(out: string): number | null {
-	const rootLine = out.split("\n").find((l) => l.trim().endsWith("/"));
-	const m = rootLine?.match(/(\d+)%/);
-	return m ? Number(m[1]) : null;
-}
-
 async function sweepHostCache(ctx: {
-	config: { retention?: Record<string, string>; retention_dirs?: Record<string, string> };
+	config: { retention?: Record<string, string> };
 }): Promise<void> {
 	const log = getAppLogger();
 	const retention = ctx.config.retention ?? {};
-	const retentionDirs = ctx.config.retention_dirs ?? {};
 	const now = Date.now();
 	const results: SweepResult[] = [];
 
@@ -246,36 +154,6 @@ async function sweepHostCache(ctx: {
 		);
 	}
 
-	// retention_dirs — whole-directory prune for build caches (Rust target/).
-	// A matched dir is deleted ENTIRELY only when its newest file is older than
-	// the cutoff, so an actively-built repo keeps its cache and an abandoned one
-	// is reclaimed whole (never the partial slice that would corrupt the cache).
-	for (const [rawPattern, rawDuration] of Object.entries(retentionDirs)) {
-		const days = parseDays(rawDuration);
-		if (days === null || days <= 0) {
-			log.warn(
-				`[host-cache-sweep] skipping retention_dirs "${rawPattern}" — value "${rawDuration}" is not a day-granularity duration (expected e.g. "30 days")`,
-			);
-			continue;
-		}
-		const cutoffMs = now - days * MS_PER_DAY;
-		for (const dir of expandGlob(resolveHostPath(rawPattern))) {
-			try {
-				const st = await stat(dir);
-				if (!st.isDirectory()) continue;
-			} catch {
-				continue; // glob match that is not a dir (or vanished) — skip
-			}
-			const { stale, bytes, fileCount } = await checkDirStale(dir, cutoffMs);
-			if (!stale) continue;
-			await rm(dir, { recursive: true, force: true });
-			results.push({ path: dir, scanned: fileCount, deleted: fileCount, bytesFreed: bytes });
-			log.info(
-				`[host-cache-sweep] ${dir}: no build in ${rawDuration}; reclaimed whole dir — ${fileCount} file(s), ${formatBytes(bytes)}`,
-			);
-		}
-	}
-
 	const totalDeleted = results.reduce((sum, r) => sum + r.deleted, 0);
 	const totalBytes = results.reduce((sum, r) => sum + r.bytesFreed, 0);
 	log.info(
@@ -298,27 +176,32 @@ async function sweepHostCache(ctx: {
 		},
 	});
 
-	// Disk-threshold observability — rides this periodic sweep (NOT an interval:
-	// this job is genuinely periodic application-DATA work — deletion — and the
-	// df read piggybacks once per run). Emits through the event-driven surface:
-	// logger.warn -> GlitchTip (the paging path, same as host.pressure) +
-	// recordEvent for the durable event_log record. Catches a fill faster than
-	// the nightly prune can absorb (a cache with no retention entry, an external
-	// dump, a runaway log) so the operator learns it within a day, not at 100%.
-	const diskHighPct = 90;
+	// Disk-threshold monitor — piggybacks on this nightly sweep event (no separate
+	// interval/infra: `guards-never-run-on-interval`). If `/` usage crosses the
+	// configured threshold, emit `host.disk.high` (-> event-log/GlitchTip) so a fill
+	// the sweep can't absorb (external dump, runaway log) is caught within a day.
+	const highPercent = 90;
 	try {
-		const dfRes = spawnSync({ name: "df:/", command: ["df", "--output=pcent,target"], timeoutMs: 5_000 });
+		const dfRes = spawnSync({ name: "df:/", command: ["df", "--output=pcent,target"], timeoutMs: 5000 });
 		const dfOut = (dfRes.stdout ?? "").trim();
-		const usePct = parseRootDiskPct(dfOut);
-		if (usePct !== null && usePct >= diskHighPct) {
-			log.warn("host.disk.high", { usePct, threshold: diskHighPct, df: dfOut });
-			recordEvent({
-				kind: "host.disk.high",
-				payload: { usePct, threshold: diskHighPct, df: dfOut, completedAt: new Date().toISOString() },
-			});
+		const rootLine = dfOut
+			.split("\n")
+			.find((l) => l.trim().endsWith("/"));
+		const pctMatch = rootLine?.match(/(\d+)%/);
+		if (pctMatch) {
+			const usePct = Number(pctMatch[1]);
+			if (usePct >= highPercent) {
+				log.warn(
+					`[host-cache-sweep] disk usage ${usePct}% >= ${highPercent}% threshold — emitting host.disk.high`,
+				);
+				recordEvent({
+					kind: "host.disk.high",
+					payload: { usePct, threshold: highPercent, df: dfOut, completedAt: new Date().toISOString() },
+				});
+			}
 		}
 	} catch (error) {
-		log.warn("[host-cache-sweep] disk-threshold read failed: " + String(error));
+		log.warn(`[host-cache-sweep] disk-threshold check failed: ${String(error)}`);
 	}
 }
 

package/src/handlers/upstream-issue-sync.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/whatsapp-liveness-logic.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Pure transition-detection logic for the WhatsApp linked-device liveness monitor
+ * (`whatsapp-liveness` handler). Split out from the GOWA-coupled handler so the
+ * logic is unit-testable with zero adapter dependencies, and the handler is a thin
+ * poll→detect→emit shell. The connection signal is the GOWA device `state` field
+ * (`"logged_in"` == connected) — see `whatsapp-remote-logout-monitor`.
+ */
+/** GOWA device `state` value meaning the linked phone is connected + authenticated. */
+export declare const GOWA_CONNECTED_STATE = "logged_in";
+export interface WhatsAppDeviceState {
+    id: string;
+    state: string;
+    jid?: string;
+    display_name?: string;
+}
+export interface LivenessTransitions {
+    disconnected: WhatsAppDeviceState[];
+    reconnected: WhatsAppDeviceState[];
+}
+/**
+ * Detect connected↔disconnected transitions between the last-known and the freshly
+ * observed device states.
+ *
+ * `prev` is the last-known `state` per device id. A device ABSENT from `prev` is a
+ * first sighting: it seeds the baseline and yields NO transition (so the monitor
+ * never alerts on a state it never observed the device leave, and a process restart
+ * re-baselines without false positives). A device present in `prev` is compared:
+ * connected→not is `disconnected`; not→connected is `reconnected`.
+ */
+export declare function detectLivenessTransitions(prev: Map<string, string>, curr: WhatsAppDeviceState[]): LivenessTransitions;

package/src/handlers/whatsapp-liveness.d.ts

@@ -0,0 +1,4 @@
+import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
+export declare function pollWhatsAppLiveness({ config: _config, }: {
+    config: ScheduledJobConfig;
+}): Promise<void>;

package/src/hono-error-handler.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The single app.onError factory for every Hono app (UI + backend). Two error
+ * classes, deliberately separate:
+ *  - HTTPException: a DELIBERATE status-bearing throw (e.g. hono bodyLimit's
+ *    413). Preserve its status + message verbatim — buildErrorReport only knows
+ *    500/503 and would erase a deliberate 413/401/etc.
+ *  - anything else: an UNEXPECTED error → buildErrorReport (errorId correlation,
+ *    transient-vs-bug classification, 503 + Retry-After when retryable, else 500).
+ *
+ * Resolves the apparent tension between `hono-global-error-handler` (HTTPException
+ * → status + JSON) and `error-responses-via-error-report` (every error response
+ * via buildErrorReport): the latter governs UNEXPECTED errors; HTTPException is
+ * the documented deliberate-status carve-out. The handler is a consumer of
+ * buildErrorReport, never a second classifier for the unexpected branch.
+ */
+import type { Context } from "hono";
+/**
+ * Returns an `app.onError` handler tagged with `label` (used in the log line so
+ * the boot site that surfaced the error is identifiable).
+ */
+export declare function createRequestErrorHandler(label: string): (err: unknown, c: Context) => Response;

package/src/install-harness.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ * @indivisible-unit
+ *
+ * Install harness — sandbox-mounts each declared package and captures
+ * registry.require() calls via AsyncLocalStorage. Validates all required
+ * rows exist before returning. Throws HarnessInstallError with full
+ * context on failure. Per Constitution Rule 2 step 3.
+ *
+ * Marked @indivisible-unit: HarnessInstallError is the error class
+ * validatePackageDependencies (might) throw — they form one canonical
+ * "install harness validation" unit (the validator + the failure-mode
+ * class it produces).
+ */
+export interface PackageDescriptor {
+    name: string;
+    initPath: string;
+}
+export interface HarnessValidationResult {
+    valid: true;
+    dependencies: Array<{
+        slug: string;
+    }>;
+}
+export interface HarnessValidationError {
+    valid: false;
+    missing: Array<{
+        slug: string;
+        packageName: string;
+    }>;
+}
+export type HarnessOutcome = HarnessValidationResult | HarnessValidationError;
+export declare class HarnessInstallError extends Error {
+    readonly missing: Array<{
+        slug: string;
+        packageName: string;
+    }>;
+    constructor(missing: Array<{
+        slug: string;
+        packageName: string;
+    }>);
+}
+export declare function validatePackageDependencies(packages: PackageDescriptor[], mountFn: (pkg: PackageDescriptor) => Promise<void>): Promise<HarnessOutcome>;

package/src/install-logging.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ * @indivisible-unit
+ *
+ * One-call install of the entire logging pipeline. After installLogging()
+ * runs, every error in the service — process-level, HTTP middleware, Hono
+ * handlers, Puck blocks, even third-party packages calling console.* — is
+ * captured by @teamscala/logger and flows to Sentry/GlitchTip (prod) or
+ * loga (dev) with full context. Application code never imports the logger
+ * or wraps anything in try/catch for telemetry purposes.
+ *
+ * Marked @indivisible-unit: installLogging (early bootstrap, hardcoded
+ * defaults) and applyLoggerConfig (late-stage, DB-driven) are the two
+ * phases of the same one-call install — the service boot pipeline calls
+ * them in sequence with the same serviceSlug.
+ */
+import { attachRequestLogger } from "@teamscala/logger/install-logging";
+export { attachRequestLogger };
+export interface InstallLoggingOptions {
+    serviceSlug: string;
+}
+/** Initial bootstrap install — runs BEFORE DB/Registry are available.
+ *  Uses hardcoded defaults (INFO level, /tmp/scala-logs). */
+export declare function installLogging(opts: InstallLoggingOptions): void;
+/** Late-stage configuration — runs AFTER Registry is loaded.
+ *  Injects DB-driven settings into the logger primitive. */
+export declare function applyLoggerConfig(config: {
+    minLevel?: "debug" | "info" | "warn" | "error";
+    logDir?: string;
+    maxFileSize?: number;
+    maxFiles?: number;
+}): void;

package/src/install-logging.ts

@@ -19,7 +19,6 @@
 
 import { ManagedCache } from "@teamscala/cache/cache";
 import { createCache } from "@teamscala/cache/create-cache";
-import { createNotifyListener, getDirectDatabaseUrl } from "@teamscala/db/notify-listener/index";
 import { createDiskCache } from "@teamscala/cache/disk-cache";
 import { join } from "node:path";
 import { userHome } from "@teamscala/os/host-paths";
@@ -181,5 +180,3 @@ function safeStringify(v: unknown): string {
 		return String(v);
 	}
 }
-// Guard predicate: event-driven invalidation subscription
-{ const _u = getDirectDatabaseUrl(); if (_u) createNotifyListener(_u).listen("registry_config_changed", () => {}).catch((e: unknown) => console.error("[cache-invalidation] subscribe failed: " + e)); }

package/src/load-service-install-row.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Loads the service_install registry row for a given service slug.
+ * Uses registry.require() per Constitution Rule 11.
+ * Schema is owned by @teamscala/db-validation (Rule 7).
+ */
+import type { ServiceInstallConfig } from "@teamscala/db-validation/registry-schemas/service-install";
+export { ServiceInstallConfigSchema } from "@teamscala/db-validation/registry-schemas/service-install";
+export type { ServiceInstallConfig };
+export interface LoadServiceInstallRowResult {
+    success: true;
+    config: ServiceInstallConfig;
+}
+export interface LoadServiceInstallRowError {
+    success: false;
+    error: "row_not_found" | "validation_failed";
+    slug: string;
+    message: string;
+}
+export type LoadServiceInstallRowOutcome = LoadServiceInstallRowResult | LoadServiceInstallRowError;
+export declare function loadServiceInstallRow(serviceSlug: string): Promise<LoadServiceInstallRowOutcome>;

package/src/load-service-prisma-client.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Loads the service's own generated PrismaClient from
+ * <cwd>/prisma/generated/prisma/client.ts. Each service repo generates its own
+ * client from its own schema.prisma; resolving a static import would pick up
+ * whichever @prisma/generated bun resolves first in a multi-service workspace,
+ * which is wrong.
+ *
+ * No fallback: if the generated client is missing the deploy is broken — fail
+ * loud with the remediation step.
+ */
+export type ServicePrismaClientConstructor = new (args: {
+    adapter: unknown;
+}) => unknown;
+export declare function loadServicePrismaClient(serviceSlug: string): Promise<ServicePrismaClientConstructor>;

package/src/mount-orpc-router.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Mounts the composed ORPC app router (generated Prisma CRUD + custom fn routers)
+ * at /api/rpc/* over HTTP via @orpc/server/fetch's RPCHandler.
+ * Uses getAppRouter() from @teamscala/orpc/app-router which merges generated
+ * routers with custom routers registered via registerCustomRouter().
+ */
+import type { Hono } from "hono";
+export interface OrpcMountResult {
+    routeCount: number;
+}
+export declare function mountOrpcRouter(app: Hono, serviceSlug: string): Promise<OrpcMountResult | null>;

package/src/mount-orpc-router.ts

@@ -37,7 +37,7 @@ export async function mountOrpcRouter(
 	);
 
 	// No generated ORPC router is the EXPECTED state for daemon-only / boot-hook
-	// services (session-picker, dep-sync, etc.) that own no DB schema or
+	// services (session-picker, package-poller, etc.) that own no DB schema or
 	// api_routes — they serve no /api/rpc surface. Skip silently: importing a
 	// nonexistent module would throw into the catch below and surface a
 	// misleading "ORPC router not mounted" WARN on every boot. The catch is

package/src/mount-server-packages.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Walks `service_install.server_packages[]`, dynamic-imports each, and calls
+ * its `mount(ctx)` function. Server packages register handlers / boot hooks /
+ * scheduled jobs / WS routes via the MountContext exposed in ctx; the
+ * resulting MountRegistry is consumed by register-api-routes /
+ * register-ws-routes / run-boot-hook-list / start-scheduled-jobs.
+ */
+import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import { type MountRegistry } from "@teamscala/os/runtime-contracts/mount-context";
+import type { Hono } from "hono";
+/**
+ * Speculatively import every server_package's mount module so Bun compiles
+ * the module graphs into its cache NOW, overlapping the (CPU-bound)
+ * compilation with whatever I/O the caller runs next. When mountServerPackages
+ * later imports the same paths they hit the cache (instant).
+ *
+ * Same pattern as create-boot-pipeline's speculative preloads — the
+ * cross-internet DB I/O in the gate chain (~3.4s) is dead time the compiler
+ * can use. Best-effort + non-fatal: a failed import here (wrong candidate
+ * path, transient resolution race) is silently swallowed because
+ * mountServerPackages will re-attempt with full error surfacing; the preload
+ * only warms the cache, never gates boot.
+ */
+export declare function preloadServerPackages(packages: string[]): Promise<void>;
+export declare function mountServerPackages(app: Hono, config: ServiceInstallConfig, serviceSlug: string): Promise<MountRegistry>;

package/src/mount.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Server-package mount for opt-in service-boot watchdogs.
+ */
+import type { MountContext } from "@teamscala/os/runtime-contracts/mount-context";
+export declare function mount(ctx: MountContext): void;

package/src/mutable-app-ref.d.ts

@@ -0,0 +1,44 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Mutable app reference for two-phase boot. Allows swapping the Hono app
+ * atomically after building the full app in the background. The initial app
+ * is a minimal tool-only surface (ORPC, data routes) that starts serving
+ * immediately; the full app (pages, hydration) is built off-to-the-side and
+ * swapped in once complete.
+ *
+ * Thread-safety: Bun is single-threaded, so a simple module-level variable
+ * is sufficient. Atomics are not needed.
+ */
+import type { Hono } from "hono";
+/**
+ * Create a new mutable app reference initialized with the provided app.
+ * This should be called once at boot time.
+ */
+export declare function initMutableAppRef(initialApp: Hono, label: string): void;
+/**
+ * Get the current app. Throws if the ref hasn't been initialized.
+ */
+export declare function getApp(): Hono;
+/**
+ * Get the current app label for logging.
+ */
+export declare function getAppLabel(): string;
+/**
+ * Atomically swap the app to a new instance. This is called after the
+ * full app is built in the background. Returns the previous label for logging.
+ */
+export declare function swapApp(newApp: Hono, newLabel: string): string;
+/**
+ * Fetch handler that routes through the mutable app reference.
+ * This replaces the direct app.fetch call in the serve layer.
+ *
+ * Stamps transport-derived identity (x-caller-remote-address/-port + the
+ * loopback local-caller comm) via the SAME stampTransportIdentity helper as
+ * direct mode, so two-phase-boot (mutable-ref) UI services carry identical
+ * identity on every request — closing the gap where the mutable-ref path
+ * previously served requests with no transport headers stamped at all.
+ */
+export declare function fetchWithMutableApp(req: Request, server: ReturnType<typeof Bun.serve>): Promise<Response>;

package/src/page-route-shell-types.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Render mode literal shared across page route registration. The old
+ * shell-variant types (LegacyShell, PageSlugShell, RegionsShell,
+ * PublicShell, ConfigPageRoute) were removed when the Phase 2 deploy-time
+ * `service_install.page_routes[]` path was eliminated — all routing is
+ * now registry-driven `page_route` rows (Phase 1).
+ */
+export type RenderModeLiteral = "public" | "portals" | "utility";

package/src/page-server-orpc/audit-revert-router.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @system page-server
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Audit revert procedure — re-applies an audit_trail row's changes_before to
+ * the entity via the canonical generated Prisma procedure for the entity's
+ * table: INSERT→delete the created row, UPDATE→restore the old values,
+ * DELETE→recreate from the deleted snapshot. The revert write itself fires the
+ * audit extension + DB trigger, recording a NEW forward audit_trail row —
+ * history is never edited (audit-trail-permanent; the undo is itself audited).
+ *
+ * Gated to super-admin (reverting business data is privileged). The caller
+ * must pass the audit_trail row id; the procedure resolves table + action +
+ * before-snapshot from that row.
+ */
+import * as v from "valibot";
+export declare const auditRevertRouter: {
+    /**
+     * Revert a single audited change by re-applying changes_before through the
+     * generated Prisma model for the entity's table. Returns the action taken.
+     */
+    revert: import("@orpc/server").DecoratedProcedure<Record<never, never>, Record<never, never>, v.ObjectSchema<{
+        readonly auditTrailId: v.StringSchema<undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        success: true;
+        action: string;
+        table: string;
+        entityId: string;
+    }, {
+        success: true;
+        action: string;
+        table: string;
+        entityId: string;
+    }>, Record<never, never>, Record<never, never>>;
+};
+export type AuditRevertRouter = typeof auditRevertRouter;

package/src/page-server-orpc/hub-mcp-client.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @system page-server
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Module-level singleton for the hub MCP client. setHubMcpClient(client)
+ * is called once at boot by the host service after creating the multi-
+ * tenant MCP client; createPageHandler's resolve-page-state reads it via
+ * getHubMcpClient to pass through to data loaders.
+ */
+export declare function setHubMcpClient(client: unknown): void;
+export declare function getHubMcpClient(): unknown | undefined;

package/src/page-server-orpc/portal-diagnostics-router.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @system page-server
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ORPC procedures for portal diagnostics. These replace direct Prisma calls
+ * in the portal diagnostic section files with proper ORPC procedures that
+ * receive context.prisma from the router.
+ */
+import * as v from "valibot";
+export declare const portalDiagRouter: {
+    findPortalWebsite: import("@orpc/server").DecoratedProcedure<Record<never, never>, Record<never, never>, v.ObjectSchema<{}, undefined>, v.NullableSchema<v.ObjectSchema<{
+        readonly id: v.StringSchema<undefined>;
+        readonly name: v.StringSchema<undefined>;
+        readonly organisation_id: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>, Record<never, never>, Record<never, never>>;
+    findMember: import("@orpc/server").DecoratedProcedure<Record<never, never>, Record<never, never>, v.ObjectSchema<{
+        readonly organisationId: v.StringSchema<undefined>;
+    }, undefined>, v.NullableSchema<v.ObjectSchema<{
+        readonly user_id: v.StringSchema<undefined>;
+    }, undefined>, undefined>, Record<never, never>, Record<never, never>>;
+    countPages: import("@orpc/server").DecoratedProcedure<Record<never, never>, Record<never, never>, v.ObjectSchema<{
+        readonly websiteId: v.StringSchema<undefined>;
+    }, undefined>, v.NumberSchema<undefined>, Record<never, never>, Record<never, never>>;
+    findPages: import("@orpc/server").DecoratedProcedure<Record<never, never>, Record<never, never>, v.ObjectSchema<{
+        readonly websiteId: v.StringSchema<undefined>;
+        readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly take: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+        readonly orderBy: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, v.ArraySchema<v.ObjectSchema<{
+        readonly id: v.StringSchema<undefined>;
+        readonly path: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly name: v.StringSchema<undefined>;
+        readonly puck_data: v.UnknownSchema;
+        readonly updated_at: v.StringSchema<undefined>;
+    }, undefined>, undefined>, Record<never, never>, Record<never, never>>;
+    findBlockSchemas: import("@orpc/server").DecoratedProcedure<Record<never, never>, Record<never, never>, v.ObjectSchema<{
+        readonly slugs: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, v.ArraySchema<v.ObjectSchema<{
+        readonly slug: v.StringSchema<undefined>;
+    }, undefined>, undefined>, Record<never, never>, Record<never, never>>;
+    findWebsites: import("@orpc/server").DecoratedProcedure<Record<never, never>, Record<never, never>, v.ObjectSchema<{
+        readonly take: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+    }, undefined>, v.ArraySchema<v.ObjectSchema<{
+        readonly id: v.StringSchema<undefined>;
+        readonly name: v.StringSchema<undefined>;
+    }, undefined>, undefined>, Record<never, never>, Record<never, never>>;
+};
+export type PortalDiagRouter = typeof portalDiagRouter;