@teamscala/service-boot 0.23.327 → 0.23.328

package/src/asset-social-card.d.ts

@@ -1,17 +0,0 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Dynamic-import wrapper around image-optimizer's in-process sharp
- * social-card op. Mirrors asset-optimize.ts's optional-dependency shape:
- * services without image-optimizer installed transparently get null and
- * fall back to the raw asset stream. In-process (not HTTP) because the
- * og:image transform is a cold path per shared link — no auth handshake,
- * no per-consumer service config.
- */
-export interface SocialCardOutcome {
-    data: Buffer;
-    processedSize: number;
-}
-export declare function renderSocialCard(buffer: Buffer): Promise<SocialCardOutcome | null>;

package/src/attach-agreement-magic.d.ts

@@ -1,20 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The agreement MAGIC-LINK endpoint. A recipient who clicks an emailed
- * "Review & sign" link — which carries a pre-authorised, signed ag_token for
- * THEIR party — lands here: the token is verified for the agreement, the
- * ag_token cookie is set on the shared parent domain, and the browser is
- * 302-redirected straight into the signing page. No email-entry gate, no OTP —
- * "came from our email" IS the proof of identity, exactly like the
- * proposal-accept hand-off (attach-proposal-accept.ts).
- *
- * The token is the same HMAC ag_token the gate verifies (30-min TTL, scoped to
- * {agreementId, email}); an invalid/expired/forged token sets no cookie and the
- * destination page simply shows the normal email gate. GET so it is a plain
- * clickable link in an email.
- */
-import type { Hono } from "hono";
-export declare function attachAgreementMagic(app: Hono, serviceSlug: string): Promise<void>;

package/src/attach-portal-members.d.ts

@@ -1,23 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Portal-secured member directory endpoint. Resolves members of an org via a
- * parameterized raw join over better_auth_member + "user" — NOT the typed
- * `member` ORPC model, which is deliberately omitted from the portal's
- * service_schema (security: the raw table is not exposed as a typed CRUD
- * surface). Mirrors the agreement-gate.ts:109-150 precedent.
- *
- * The portal's auth middleware (better-auth-cookie) gates the endpoint — only
- * authenticated users can call it. The orgId comes from the caller's context
- * (the portal resolves it from the session + passes it).
- *
- * Endpoint: GET /api/portal/members?orgId=<uuid>
- *   - orgId omitted: super-admin all-orgs mode (returns every member across
- *     all orgs, strictly gated to super-admin via getSession; used by the
- *     "View As" impersonation dropdown).
- * Response: { members: Array<{ id, user_id, organization_id, role, email, name, image }> }
- */
-import type { Hono } from "hono";
-export declare function attachPortalMembers(app: Hono): Promise<void>;

package/src/attach-proposal-accept.d.ts

@@ -1,26 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The proposal ACCEPT endpoint. A viewer who has passed the proposal gate (holds
- * a valid prop_token) POSTs {proposalId} here to accept; the server generates a
- * signing document from the proposal (createAgreementFromProposal) and
- * 302-redirects them straight into signing it on the sign site. This replaces
- * the old mailto CTA. Mounted BEFORE the auth gate so it is publicly reachable —
- * the prop_token (not a login) is the proof of identity, exactly like the
- * content-gate access endpoint.
- *
- * Single sign-on across the journey: the viewer already proved their email at
- * the proposal gate (prop_token), so we MUST NOT make them re-enter it on the
- * sign site. Before redirecting, we mint the agreement's ag_token for that same
- * verified email and set it on the SHARED parent domain (Domain=.scala.business)
- * so the browser carries it from proposals.scala.business to sign.scala.business
- * — the agreement gate then auto-reveals + seeds the signing session with zero
- * extra prompts. This requires both hosts to resolve the SAME token secret
- * (AUTH_SECRET→ENCRYPTION_KEY→DATABASE_URL): scala-sign must carry ENCRYPTION_KEY
- * (also required to decrypt the org's Stripe key on full sign), so both hosts
- * land on ENCRYPTION_KEY and the carried token verifies.
- */
-import type { Hono } from "hono";
-export declare function attachProposalAccept(app: Hono, serviceSlug: string): Promise<void>;

package/src/attach-proposal-magic.d.ts

@@ -1,18 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The proposal MAGIC-LINK endpoint — the proposal twin of attach-agreement-magic.
- * A recipient who clicks an emailed "View your proposal" link (carrying a signed,
- * per-recipient prop_token) lands here: the token is verified for the proposal,
- * the prop_token cookie is set, and the browser is 302-redirected straight into
- * the proposal page. No email-entry gate, no OTP. An invalid/expired token sets
- * no cookie and the page falls through to the normal email gate.
- *
- * The prop_token is host-scoped (proposals are served on the proposals host only),
- * unlike the agreement ag_token which spans .scala.business for the proposal→sign
- * hand-off. GET so it is a plain clickable link in an email.
- */
-import type { Hono } from "hono";
-export declare function attachProposalMagic(app: Hono, serviceSlug: string): Promise<void>;

package/src/attach-transfers-upload.d.ts

@@ -1,27 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Authenticated asset upload — POST /api/transfers/upload. Restores the
- * handler deleted with @teamscala/server-files (commit ca5643ef); avatar/logo
- * upload had 404'd on every service since. Writes to S3 via
- * @teamscala/object-storage/create/write-ops and returns the STORED-form URL
- * (`/api/files/<key>`) the client persists into avatar_url/logo_url — the
- * display path rewrites it to the public `/api/assets/<encoded-key>` proxy
- * via `toAssetPath` (@teamscala/formatters/asset-url). Self-authenticates
- * (getSession) so it mounts BEFORE the auth gate.
- *
- * Key scheme is USER-scoped (`users/<userId>/<type>/<file>-<ts>.<ext>`) per
- * the operator ruling: a profile picture belongs to the individual, not any
- * org (the prior handler's org-scoped `<orgId>/avatars/...` encoded the
- * uploading org into a personal asset). Spec + history:
- * `reference/asset-upload-system.md`.
- *
- * `thumbUrl` mirrors `url` — the full image is served for both; a separate
- * generated thumbnail is a future refinement (the prior handler generated
- * one, but the image-resize dependency is not wired here yet and a missing
- * thumb must not block the upload restoring).
- */
-import type { Hono } from "hono";
-export declare function attachTransfersUpload(app: Hono): Promise<void>;

package/src/auth-gate.d.ts

@@ -1,28 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Auth middleware factory. Three modes, same BetterAuth email-OTP mechanism:
- *
- *   service_install.auth values:
- *   - omitted | "none"            → no gate, no handler (scala-public, scala-sign)
- *   - "better-auth-cookie"        → full session auth: mount handler + session gate
- *   - "email-otp-only"            → mount handler (OTP send/verify), no session gate
- *
- *   The sign-in block determines the UX per mode:
- *   - "full"         → email → OTP → session → portal selection (portal, agents, docs, gpt)
- *   - "email-gate"   → email → OTP → verify-only, no session (forms, proposals, quiz)
- *   - "capture-only" → email field only, no OTP (sign)
- *
- *   There is NO localhost bypass: 127.0.0.1 is gated identically to the tunnel
- *   (no session → /sign-in). Tools needing an authed view sign in
- *   (getSuperAdminSessionCookie); the dev OTP is DB-readable.
- *
- *   When SCALA_OTP_URL is set, /api/auth/* forwards to the centralised
- *   scala-otp service (per otp-centralised-via-otp-service). Otherwise
- *   the local better-auth handler is used (dev-host fallback).
- */
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
-import type { Hono } from "hono";
-export declare function attachAuthGate(app: Hono, config: ServiceInstallConfig, serviceSlug: string): Promise<void>;

package/src/bind-page-handler.d.ts

@@ -1,18 +0,0 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Calls a createPageHandler() handler with the per-request extras the
- * SSR pipeline needs: the resolved userId/orgId (from localhost-bypass
- * or better-auth-cookie), and the htmlTemplate. Shared by the regions
- * and page_slug shell variants.
- */
-import type { Context } from "hono";
-type PageHandler = (req: Request, extras: Record<string, unknown>) => Promise<{
-    body: unknown;
-    status: number;
-    headers: HeadersInit;
-}>;
-export declare function bindPageHandler(c: Context, handler: PageHandler, authMode: string, serviceSlug: string, label: string, resourceOrgId?: string): Promise<Response>;
-export {};

package/src/build-client-assets/input-hashing.d.ts

@@ -1,25 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Input hashing for the client-asset build fingerprint.
- *
- * Split out of build-client-assets.ts, which had grown to 1221 lines holding
- * six distinct concerns (lock + status, manifest, hydrate bundle, source maps,
- * stylesheet/tailwind, and this). `single-purpose-file` did not catch it: that
- * rule flags a file whose top-level exports share no common name root, which
- * measures export-NAME cohesion rather than how many concerns a file holds — so
- * a large file with few tidily-named exports stays invisible to it.
- *
- * This module owns ONE concern: turning the build's real inputs into a stable
- * hash. `computeInputFingerprint` (still in the parent, and still the only
- * exported entry point) composes the two functions exported here; everything
- * else is module-private because nothing outside needs it.
- *
- * Byte-for-byte move — imports adjusted, nothing else. No renames, no type
- * changes (`migrations-copy-not-rewrite`).
- */
-import { createHash } from "node:crypto";
-export declare function hashResolvedPackageStylesheets(cwd: string, h: ReturnType<typeof createHash>): Promise<void>;
-export declare function hashTeamgbgJsGraph(cwd: string, h: ReturnType<typeof createHash>): Promise<void>;

package/src/build-client-assets/source-candidates.d.ts

@@ -1,27 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Tailwind source-candidate scanning for the client CSS build.
- *
- * Split out of build-client-assets.ts (1221 lines, six concerns). Owns ONE
- * concern: turning the resolved `@source` directories into the candidate token
- * set Tailwind's `build()` consumes.
- *
- * Why it exists at all, preserved from the original: Tailwind v4's low-level
- * `compile()` does NOT scan content, and @tailwindcss/oxide's native Scanner is
- * not a dependency of the bare `tailwindcss` lib — only of the integration
- * packages. So the tokens are extracted here. Over-extraction is safe, because
- * `build()` ignores any token that is not a valid utility. Dropping this scan is
- * what shipped an unstyled page to the operator's tablet on 2026-06-13; it is
- * enforced by `css-build-scans-source-candidates`.
- *
- * Byte-for-byte move — imports adjusted, nothing else.
- */
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-export declare function scanSourceCandidates(sources: Array<{
-    base: string;
-    pattern: string;
-    negated?: boolean;
-}>, log: ReturnType<typeof getAppLogger>): Promise<string[]>;

package/src/build-client-assets.d.ts

@@ -1,50 +0,0 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Builds the per-service client bundle and stylesheet into `dist/client/`
- * at UI-service boot time. Outputs are content-hashed so deployments
- * naturally cache-bust:
- *
- *   src/entry-client.ts  ──bun build──>  dist/client/hydrate-<hash>.js
- *   src/app.css          ──tailwindcss──>  dist/client/styles-<hash>.css
- *   (and)                                  dist/client/asset-manifest.json
- *
- * The HTML template references `{{stylesPath}}` / `{{hydratePath}}` —
- * read-html-template.ts substitutes from the manifest at template-read
- * time. Bytes-level changes → new hash → new URL → browser refetch.
- * Without this, `cache-control: immutable` on a fixed filename means
- * returning visitors keep their stale copy forever.
- *
- * Content-fingerprint cache: the CLIENT-BUNDLE DEPENDENCY CLOSURE (source
- * entrypoints + every @teamscala/* module/stylesheet the bundle reaches + the
- * resolved versions of the third-party deps the closure imports) is hashed by
- * CONTENT and stored in the manifest; the rebuild is skipped only when the
- * current closure hashes to the same fingerprint (cache-key-hashes-source-
- * inputs-only — never mtime; see computeInputFingerprint for why mtime silently
- * served stale bundles on Railway). bun.lock is deliberately NOT hashed — it
- * encodes every @teamscala/* version including backend packages outside this
- * service's client bundle, so folding it in would rebuild on every publish
- * (the publish→rebuild storm; `no-uncontrolled-repetition-or-cascade`). First
- * pm2 restart after a real closure change pays the full build cost; unchanged
- * restarts skip. Stale hashed outputs from a prior build are removed in the
- * same pass so dist/client/ doesn't accumulate dead files.
- */
-/**
- * Read ONLY the tombstone state of the current manifest — the runtime
- * (read-html-template, ui-service) calls this to decide whether to surface a
- * build-failure signal. Returns null when the manifest is fresh (no
- * `buildFailed`). Decoupled from the full AssetManifest read so the runtime
- * never depends on the build internals.
- */
-export declare function readClientBuildStatus(cwd?: string): Promise<{
-    failed: true;
-    reason?: string;
-    at?: string;
-} | {
-    failed: false;
-}>;
-export declare function stripRemoteImports(css: string): string;
-export declare function computeInputFingerprint(cwd: string): Promise<string>;
-export declare function buildClientAssets(serviceSlug: string): Promise<void>;

package/src/compose-page-title.d.ts

@@ -1,41 +0,0 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The single canonical page-title composer. Every SSR page handler routes
- * through this (portal/region-shell, public shell, single-page resource). A
- * page title is DERIVED from data that already exists — the website name +
- * the page/entity name — with `builda_pages.meta_title` as an explicit
- * per-page OVERRIDE only, never the primary source.
- *
- * Mirrors the brand-is-org-owned-full-scheme precedent: a value that should
- * be DERIVED was instead hand-set per row, and when unset it silently fell
- * back to something wrong. For themes the wrong fallback was the generic
- * light palette; for titles it was the bare org name — the `default`
- * page_meta_template `titleTemplate: "{org.name}"` produced "GBG Indo" with
- * no site or page context, and per-row `meta_title` carried stale product
- * literals like "Dashboard | scala Hub". The fix is identical in shape:
- * derive by default, override explicitly.
- *
- * Canonical format: `<website.name>: <subject>` (subject = entity title or
- * page name), site-first so a browser tab reads the surface then the page.
- * A resource surface (forms/quiz/gpt) may supply a curated `templateTitle`
- * (e.g. "{agent.name} — {org.name}"); it wins over the default derivation
- * but NOT over an explicit per-page override. The composer NEVER returns a
- * bare org name — that is the regression this closes, and the
- * `page-title-not-bare-org` guard backstops it at the template layer.
- */
-export interface TitleContext {
-    /** Per-page override (builda_pages.meta_title). Wins outright when set. */
-    pageMetaTitle?: string | null;
-    /** Resolved resource-template string (forms/quiz/gpt). Curated per-surface shape. */
-    templateTitle?: string | null;
-    /** builda_websites.name — the surface, the primary site context. */
-    websiteName?: string | null;
-    /** builda_pages.name — the page (e.g. "Dashboard"). */
-    pageName?: string | null;
-    /** Resource entity title (proposal/form/quiz/agent name) — preferred subject. */
-    entityTitle?: string | null;
-}
-export declare function composePageTitle(ctx: TitleContext): string;

package/src/content-gate/access.d.ts

@@ -1,15 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The content-gate ACCESS endpoint mounter. One generic POST handler for every
- * gate: a plain <form> posts {<recordIdField>, email}; on a match against the
- * resource's authorized set it sets the signed access cookie and redirects back,
- * so the page loader's gate then releases the content. No bespoke endpoint per
- * type — each gate is one AccessConfig. Mounted BEFORE the auth gate so it is
- * publicly reachable.
- */
-import type { Hono } from "hono";
-import type { AccessConfig } from "./config-types.ts";
-export declare function attachContentGateAccess(app: Hono, serviceSlug: string, config: AccessConfig): Promise<void>;

package/src/content-gate/config-types.d.ts

@@ -1,99 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The config contracts that PROGRAM a content gate. Each gated content type
- * (agreement, proposal, …) is one ContentGateConfig + one AccessConfig — no
- * bespoke gate functions per type; the engine (gate.ts) and the access mounter
- * (access.ts) are the single shared primitive driven by these.
- */
-type Resolved = Record<string, unknown>;
-/** Drives the SSR-time gate (gate.ts / runContentGate). */
-export interface ContentGateConfig {
-    /** Cookie that carries this gate's access token (e.g. "ag_token"). */
-    cookieName: string;
-    /**
-     * The gated resource id from the resolved graph, or "" when this gate does
-     * not apply to the current page (the engine then no-ops). This is also how a
-     * gate detects "is this my kind of page". Async to allow DB-backed resolution
-     * (e.g. agreement gate resolving the UUID from the page→agreement association
-     * when no pre-placed gate block exists).
-     */
-    getResourceId(resolved: Resolved): string | Promise<string>;
-    /**
-     * Verify the cookie's token for this resource → the verified identity
-     * ({email, optional display name}), or null. Token-agnostic by design:
-     * proposals use the shared content-gate token; agreements keep their existing
-     * token (also minted by the signing ORPC), so the engine never assumes one
-     * token format. Allow-list gates return just {email}; the GPT lead-capture
-     * gate also returns the captured name (carried in its token).
-     */
-    verifyToken(token: string | undefined, resourceId: string, nowMs: number): {
-        email: string;
-        name?: string;
-    } | null;
-    /**
-     * BAKED-IN unified auth. When a gate provides this resolver, the engine
-     * AUTOMATICALLY releases a logged-in viewer whose session email is in the
-     * authorized set — with no valid token and no per-gate code. This is the
-     * platform default for EVERY gated resource: any application surface with
-     * authentication gets "a signed-in, authorized viewer is never re-asked for
-     * their email/OTP" for free, just by exposing its authorized-email set (the
-     * same resolver its AccessConfig uses). Not called when the session is
-     * anonymous. Omit only for open-capture gates that have no authorized set.
-     */
-    resolveAuthorizedEmails?(resourceId: string): Promise<Set<string>>;
-    /**
-     * OPTIONAL OVERRIDE of the baked-in session check above — for the rare gate
-     * whose session→identity rule isn't simply "session email ∈ authorized set".
-     * When present it wins; otherwise the engine uses `resolveAuthorizedEmails`.
-     * Called only when no valid access token is present.
-     */
-    sessionAuthorize?(resolved: Resolved, resourceId: string): {
-        email: string;
-        name?: string;
-    } | null | Promise<{
-        email: string;
-        name?: string;
-    } | null>;
-    /** Reveal + seed the verified viewer's identity/session (token was valid). */
-    onAuthorized(resolved: Resolved, resourceId: string, identity: {
-        email: string;
-        name?: string;
-    }): void | Promise<void>;
-    /** Withhold content (strip/inject the gate) — token absent/invalid. Async-
-     *  capable so a gate can load its display/behaviour settings from a registry
-     *  row (DB-driven, not hardcoded); sync implementations remain valid. */
-    onUnauthorized(resolved: Resolved, resourceId: string): void | Promise<void>;
-}
-/** Drives the public access endpoint (access.ts / attachContentGateAccess). */
-export interface AccessConfig {
-    /** Route to mount, e.g. "/api/proposal-access". */
-    path: string;
-    /** Cookie to set on a match. */
-    cookieName: string;
-    /** Cookie lifetime in ms (Max-Age). */
-    ttlMs: number;
-    /** Form field carrying the resource id, e.g. "proposalId". */
-    recordIdField: string;
-    /**
-     * Open lead-capture gate: ANY non-empty email is accepted (no allow-list).
-     * For surfaces whose "gate" captures a visitor rather than authorizing one
-     * against a fixed set (the public GPT). When true, `resolveAuthorizedEmails`
-     * is not called. Default/omitted = allow-list mode (proposals, agreements).
-     */
-    openCapture?: boolean;
-    /**
-     * The authorized email set for a resource (lowercased), checked server-side.
-     * Not called when `openCapture` is true.
-     */
-    resolveAuthorizedEmails(resourceId: string): Promise<Set<string>>;
-    /**
-     * Mint the access token for a matched email (token-agnostic per gate).
-     * `name` is the optional captured display name (open-capture gates carry it
-     * in the token; allow-list gates ignore it).
-     */
-    signToken(resourceId: string, email: string, nowMs: number, name?: string): string | null;
-}
-export {};

package/src/content-gate/gate.d.ts

@@ -1,13 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The content-gate ENGINE. Runs in the page loader after the resource graph
- * resolves, BEFORE SSR. Orchestration only — the per-type behaviour (which
- * resource, who's authorized, what to seed, how to withhold) is supplied by a
- * ContentGateConfig, so agreements/proposals/future gates are configs, not new
- * functions. The single place that decides whether gated bytes reach the HTML.
- */
-import type { ContentGateConfig } from "./config-types.ts";
-export declare function runContentGate(resolved: Record<string, unknown>, cookieHeader: string | null, nowMs: number, config: ContentGateConfig): Promise<void>;

package/src/content-gate/parse-cookie.d.ts

@@ -1,9 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Parse a single cookie value out of a raw Cookie header — shared by the
- * content-gate engine and any gate config.
- */
-export declare function parseCookie(header: string | null, name: string): string | undefined;

package/src/content-gate/token.d.ts

@@ -1,48 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The single signed, short-lived access token for EVERY content gate (agreement,
- * proposal, and any future gated content). A gate withholds page content
- * server-side until the request carries a valid token for that resource; this is
- * the only thing that releases the content into the SSR, so without it a gated
- * page is never readable/scrapable by a link holder.
- *
- * HMAC-SHA256 (Bun-native) over {c:cookieName, r:resourceId, e:email, x:exp}.
- * `cookieName` is bound INTO the payload so a token minted for one gate
- * (e.g. ag_token) can never satisfy another gate's check (e.g. prop_token).
- *
- * Secret resolver, in preference order: AUTH_SECRET → ENCRYPTION_KEY →
- * DATABASE_URL (first one ≥16 chars). A gate signs AND verifies inside one
- * service, so it only needs a stable per-deployment secret; the fallback keeps a
- * gate working on a service that was never given AUTH_SECRET (e.g. the former
- * public-only proposals viewer) instead of failing closed and locking out every
- * authorized viewer. Any service that has AUTH_SECRET transparently prefers it.
- * Fail-closed: no usable secret yields null (no token, no access).
- */
-/** Mint a token proving `email` is authorized for `resourceId` under `cookieName`. */
-export declare function signAccessToken(cookieName: string, resourceId: string, email: string, nowMs: number, ttlMs: number, 
-/**
- * Optional display name to carry in the token (the public GPT lead-capture
- * gate uses this so a returning visitor's name is known at SSR — first paint
- * renders the full identity, not just the email). Allow-list gates
- * (proposals/agreements) omit it.
- */
-name?: string): string | null;
-/**
- * Validate a token for `cookieName` + `resourceId`. Returns the verified email
- * on success, null otherwise (bad signature, wrong gate, wrong resource,
- * expired, no secret).
- */
-export declare function verifyAccessToken(token: string | undefined | null, cookieName: string, resourceId: string, nowMs: number): string | null;
-/**
- * Like `verifyAccessToken` but returns the full verified identity ({email, name})
- * so a gate that carries a display name in the token (the public GPT lead-capture
- * gate) can seed the visitor's name — not just the email — at SSR. Same
- * signature/expiry/gate-binding checks; null on any failure.
- */
-export declare function verifyAccessTokenIdentity(token: string | undefined | null, cookieName: string, resourceId: string, nowMs: number): {
-    email: string;
-    name?: string;
-} | null;

package/src/content-page-floor.d.ts

@@ -1,39 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Pure decision: does a CONTENT route (no resource_type) whose loader resolved
- * a `page` body source warrant the branded not-found floor? Extracted from
- * register-registry-page-route so the rule is unit-testable independent of the
- * Hono/DB/graph machinery that wraps it (the fix's correctness does not depend
- * on the publish — verify-before-done).
- *
- * Three outcomes:
- *   - no page row (deleted/unmatched path, e.g. /roadmap) → dead-link 404 floor
- *   - page row exists but zero content blocks → empty-page 200 floor
- *   - otherwise → null (render normally)
- *
- * The "Vision Toolbar" leak this closes: a content catchall synthesized an empty
- * page for an unmatched path and served a cacheable 200; resource-not-found-is-
- * the-root-floor only fired for resource_type routes, so dead content links fell
- * through. See resource-not-found.ts for the floor + operator ruling 2026-07-21.
- */
-import { PrimaryResourceMissingError } from "./resource-not-found.ts";
-/**
- * A page ROW exists but its body has zero content blocks — a content gap, not a
- * dead link. True only when the row is present yet `puck_data` is absent or its
- * `content` array is empty. Handles string (raw) and object (normalized) puck_data.
- */
-export declare function pageBodyIsEmpty(page: unknown): boolean;
-/**
- * Decide whether a content route should fall to the branded not-found floor.
- * Returns the error to throw (mapped to the floor by bind-page-handler), or null
- * to render normally. `hasResourceType` routes are handled by the existing
- * resource_type missing check (caller-side) — they return null here.
- */
-export declare function decideContentPageFloor(opts: {
-    hasResourceType: boolean;
-    hasPageContentSource: boolean;
-    page: unknown;
-}): PrimaryResourceMissingError | null;

package/src/discover-blocks.d.ts

@@ -1,28 +0,0 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Surgical block discovery: at boot, queries every block_schema row in the
- * registry whose componentPath starts with one of the service's declared
- * block_packages, then dynamic-imports each one. Per-block try/catch — one
- * dead componentPath logs and skips, the rest still register and the page
- * renders the surviving blocks. This replaces the static
- * `.scala-install/page-manifest.ts` codegen output, which had the failure
- * mode of a single dead block_schema row crashing the whole manifest at
- * compile time.
- *
- * Empty block_packages is NOT fatal here: it falls back to scanning all
- * active block_schema (uninstalled packages skip via the per-block try/catch),
- * so a service whose row is unpopulated but whose blocks are installed still
- * renders. The real "booted with zero blocks" fail-closed is at the call site
- * (loaded.length === 0 → BootFatalError). A DB-unreachable error still throws —
- * no fallback to a package-side puckBlocks scan, which masked blockless boots.
- */
-import type { RendererComponentEntry } from "./types.ts";
-export interface DiscoveredBlocks {
-    components: Record<string, RendererComponentEntry>;
-    loaded: string[];
-    skipped: string[];
-}
-export declare function discoverBlocks(blockPackages: string[]): Promise<DiscoveredBlocks>;

package/src/expand-roster.d.ts

@@ -1,34 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Server-side roster expansion — the executor that handles "render N of block X
- * per data row" so the page never needs a domain-specific panel/list block. A
- * block authored with `props.dataRepeat: "parties"` is a TEMPLATE; before SSR
- * this clones it once per roster item into its parent slot (top-level content or
- * any Container's `content` slot), then drops the marker. Each clone:
- *   - sets `role` + `dataKey` to the item's key, so a prop-driven block (the
- *     SignatureField cell) finds its own party with no per-clone wiring;
- *   - substitutes `{{name}}` / `{{role}}` / `{{company}}` / `{{date}}` /
- *     `{{status}}` placeholders in any string prop (so a recipient row is plain
- *     `Container` + `Text` primitives — the copy lives on the page, not here).
- *     `{{status}}` resolves from the template's own `signedLabel` /
- *     `awaitingLabel` props (DB-driven copy), never hardcoded.
- * Generic over any roster; the agreement page passes its parties.
- */
-export interface RosterItem {
-    key: string;
-    role: string;
-    name: string;
-    title: string | null;
-    company: string | null;
-    signedAt: string | null;
-    signature: string | null;
-}
-/** Agreement-level tokens (one substitution, not per-party). */
-export interface RosterMeta {
-    [token: string]: string;
-}
-/** Expand roster templates + bind agreement-meta placeholders across regions. */
-export declare function expandRosterTemplates(resolved: Record<string, unknown>, parties: RosterItem[], meta?: RosterMeta): void;

package/src/fn-routers/agreement-completion-email.d.ts

@@ -1,14 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Completion delivery. When an agreement is fully EXECUTED (every party has
- * signed), email each party their executed copy + a note to download the
- * Certificate of Completion. Each link is a per-party magic-link (no email gate,
- * no OTP — see attach-agreement-magic.ts). Best-effort and self-contained: it
- * loads its own data and swallows every error, so a send failure is logged and
- * NEVER undoes the signature (the payment-setup non-fatal rule, applied to mail).
- * Fire-and-forget from the sign handler: `void sendAgreementCompletionEmails(...)`.
- */
-export declare function sendAgreementCompletionEmails(agreementId: string, baseUrl: string): Promise<void>;