@teamscala/service-boot 0.23.329 → 0.23.331

package/src/fn-routers/tasks-router.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ORPC procedures for task creation with initial comment.
+ * Extracted from @teamscala/orpc/fn-router — primitives tier must not
+ * contain application-specific work_items logic.
+ */
+import { type Context } from "./auth-router.ts";
+export declare const tasksRouter: {
+    createWithComment: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<{
+        success: boolean;
+        data: any;
+    }, {
+        success: boolean;
+        data: any;
+    }>, Record<never, never>, Record<never, never>>;
+};

package/src/fn-routers/user-preferences-router.d.ts

@@ -0,0 +1,77 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ORPC procedures for a GENERIC per-user preference store backed by the
+ * `user_preferences` table. The user is resolved from the ORPC session context
+ * (`authed` middleware → `context.user.id`); the client supplies the org + key
+ * + value. This is the DB-durable, user-scoped key/value surface any feature
+ * can use — the AI browser-control focus (key `ai_ui_focus`) is the first
+ * consumer; it is NOT scala-projects-bespoke.
+ *
+ * Why this exists (over the generated `user_preferences` CRUD): the generated
+ * create/update do NOT resolve `user_id` server-side (only `organisation_id`
+ * from ctx.orgId), so a client cannot correctly write a per-user row through
+ * them. This proc stamps `user_id` from the authenticated caller, making the
+ * write safe + per-user. It also emits the `data_change` notify so the
+ * realtime surface (regions.watchDataChange) pushes updates to subscribed
+ * clients — the cross-region channel for the AI focus (the AiChat panel writes
+ * a focus here; the project-list-view in a different region subscribes +
+ * reacts, no shared React-context ancestor needed).
+ *
+ * Ownership is user_id: a caller reads/writes ONLY their own preferences. The
+ * org is part of the compound key (per-org isolation) but is client-supplied
+ * (the session carries the user, not the active org).
+ *
+ * DECISION — host-scoping of `user_preferences`: the table is NOT yet a shared
+ * `@teamscala/db` model (it lives in scala-projects's schema today), so this proc
+ * is genuinely host-scoped: it runs correctly on services whose Prisma client
+ * declares `user_preferences` (scala-projects is the first host) + is inert
+ * elsewhere. `Context.prisma` is `any`-typed, so the proc COMPILES workspace-
+ * wide (no type error on a model a host may not declare) — the `any` is the
+ * deliberate seam that lets one generic proc serve hosts incrementally as they
+ * adopt the table. Per-user preferences are platform-universal, so the tracked
+ * follow-on is to promote `user_preferences` to a shared `@teamscala/db` model
+ * (open-migration: `user_preferences→shared-model`, exit: every kind:ui host
+ * can mount this proc with no schema precondition) — at which point the proc is
+ * universally hostable + the `any` seam can tighten to the shared client. Until
+ * then the proc is opt-in per host (declare the table → get the capability).
+ */
+import * as v from "valibot";
+import { type Context } from "./auth-router.ts";
+export declare const userPreferencesRouter: {
+    upsert: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly organisationId: v.StringSchema<undefined>;
+        /** The preference key (e.g. `ai_ui_focus`). Namespaced by feature. */
+        readonly key: v.StringSchema<undefined>;
+        /** The JSON value. Arbitrary per feature — typed by the caller. */
+        readonly value: v.AnySchema;
+    }, undefined>, import("@orpc/contract").Schema<{
+        success: boolean;
+    }, {
+        success: boolean;
+    }>, Record<never, never>, Record<never, never>>;
+    get: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly organisationId: v.StringSchema<undefined>;
+        readonly key: v.StringSchema<undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        value: any;
+        updatedAt: any;
+    }, {
+        value: any;
+        updatedAt: any;
+    }>, Record<never, never>, Record<never, never>>;
+};

package/src/fn-routers/work-items-router.d.ts

@@ -0,0 +1,102 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ORPC procedure for safely deleting a work_item (initiative/project/task).
+ * Refuses the delete when the row still has child rows (parent_id = id), so a
+ * delete can NEVER orphan its descendants — the tree must be emptied bottom-up.
+ *
+ * Initiatives, projects and tasks are all rows of the ONE `work_items` table
+ * discriminated by `kind`, and `parent_id` carries no DB-level foreign key, so
+ * a plain `work_items.delete` leaves dangling children with no referential
+ * integrity to stop it. This one guard covers every level (you may only delete
+ * a leaf — a node with no children), which is exactly the "empty it first"
+ * behaviour the board wants.
+ */
+import { type Context } from "./auth-router.ts";
+export declare const workItemsRouter: {
+    /**
+     * Fired client-side right after a task's status is set to
+     * "pending_approval" (RaCI: the task's assignee is Responsible; the
+     * project's Accountable person is the approver). Walks parent_id up to
+     * the nearest project-kind ancestor, emails every accountable person on
+     * it. Never throws to the caller — a notification failure must not block
+     * the status change that already committed.
+     */
+    requestApproval: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<{
+        notified: number;
+    }, {
+        notified: number;
+    }>, Record<never, never>, Record<never, never>>;
+    /**
+     * Fired client-side right after a comment is created, when the comment
+     * text contains an @mention the client already resolved to a team-member
+     * id (client does the name matching against the people list it already
+     * has loaded; this handler only sends). Never throws to the caller for
+     * same reason as requestApproval -- a notification failure must not
+     * surface as a failed comment post.
+     */
+    notifyMentions: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<{
+        notified: number;
+    }, {
+        notified: number;
+    }>, Record<never, never>, Record<never, never>>;
+    /**
+     * Org-scoped member list for the task-comments panel — @mention matching AND
+     * comment-sender display (name + avatar). ChatPanel.tsx has no
+     * serverLoader/orgId prop (client-only overlay content), so it can't do the
+     * SSR raw-SQL org-scope join load-project-list-view.ts uses; this exposes
+     * the same result via a custom procedure instead of widening service_schema
+     * to the raw better_auth_member table.
+     *
+     * This is the SINGLE source of member display info for the comments panel:
+     * it coalesces BOTH name/email/avatar families on the user model into one
+     * shape (the `full_name`/`primary_email`/`avatar_url` family AND the
+     * better-auth `name`/`email`/`image` family). Returning avatar here lets the
+     * client resolve sender name+avatar from this one list and drop the separate
+     * `user.findMany` enrichment fetch it previously ran as a second waterfall
+     * hop after `comments.findMany` (loading-shape: one wave-parallel hit, not a
+     * dependent client-side round-trip chain).
+     */
+    orgMembers: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<{
+        id: string;
+        name: string;
+        email: string;
+        avatar: string | null;
+    }[], {
+        id: string;
+        name: string;
+        email: string;
+        avatar: string | null;
+    }[]>, Record<never, never>, Record<never, never>>;
+    deleteEmpty: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<{
+        success: boolean;
+    }, {
+        success: boolean;
+    }>, Record<never, never>, Record<never, never>>;
+};

package/src/gate-ttls.d.ts

@@ -0,0 +1,6 @@
+/** Populate the TTL cache from the registry rows. Idempotent; keeps defaults on
+ *  any miss so the gates ALWAYS render (protective-layers-fail-explicitly). */
+export declare function initGateTtls(): Promise<void>;
+export declare function agTtlMs(): number;
+export declare function propTtlMs(): number;
+export declare function gptTtlMs(): number;

package/src/gpt-gate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The PUBLIC GPT identity gate, expressed as config for the content-gate
+ * primitive (content-gate/). Unlike proposals/agreements this is NOT access
+ * control — every email is a valid visitor (lead capture). Its whole job is to
+ * make a returning visitor's identity known AT SSR so the GPT body renders the
+ * real conversation on first paint instead of server-rendering the capture gate
+ * and then swapping to the chat after hydration (the ssr-then-live-handoff +
+ * "know the visitor at SSR first paint" violation: building-applications).
+ *
+ * Flow: the capture form POSTs {gptId, email} to /api/gpt-access (openCapture →
+ * any email matches); the access endpoint sets a signed `gpt_token` cookie. On
+ * the next request runContentGate verifies that cookie for this agent and seeds
+ * resolved.initialVisitor — which the GPT body serverLoader (ssrGptSession) then
+ * uses to SSR-restore the conversation, and GptBodyBlock uses to skip the gate.
+ * onUnauthorized is a no-op: an un-gated (first-time) visitor sees the capture
+ * form the block renders itself when no visitor is known — that is correct, not
+ * a flash (they ARE anonymous), so there is nothing to withhold.
+ */
+import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
+export declare const gptGateConfig: ContentGateConfig;
+export declare const gptAccessConfig: AccessConfig;

package/src/handlers/bun-stable-watch.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/pane-outbox-drain.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/projects-digest.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The `projects-daily-digest` / `projects-weekly-digest` pg-boss handlers for
+ * scala-projects. Same fixed-query shape as prune-stale-data: no row-driven
+ * SQL, every query is a literal Prisma call against work_items; the
+ * scheduled_job row only carries the cron.
+ *
+ * Daily digest: per assignee, tasks assigned to them created in the last 24h.
+ * Weekly digest: per assignee, their overdue tasks + tasks due in the next 7
+ * days. Both group work_items by assignee_id so one org-wide query covers
+ * every member, then send one email per assignee via the
+ * projects-daily-digest / projects-weekly-digest email_template rows.
+ *
+ * Registered under `@teamscala/service-boot:projects-daily-digest` and
+ * `@teamscala/service-boot:projects-weekly-digest`.
+ */
+import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
+export declare function sendDailyDigest(_ctx: {
+    config: ScheduledJobConfig;
+}): Promise<void>;
+export declare function sendWeeklyDigest(_ctx: {
+    config: ScheduledJobConfig;
+}): Promise<void>;

package/src/handlers/prune-stale-data.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The `db-prune-stale-data` pg-boss handler. Reads the `retention` map from the
+ * `scheduled_job` row config and prunes stale rows per entry.
+ *
+ * Writes use Prisma ORM methods (deleteMany/updateMany) via the prisma-registry
+ * client — NEVER raw SQL. The `@teamscala/db` client carries the `blockRawSqlWrites`
+ * audit extension: `$executeRaw`/`$executeRawUnsafe` are blocked so every write
+ * is audited; ORM methods are the canonical audited path.
+ *
+ * SAFETY — identifier allowlist: each retention key selects a FIXED, hardcoded
+ * Prisma model + field (table/field names are literal in code, never derived
+ * from the row); the row's value (a duration string) is parsed to a cutoff Date.
+ * A row can therefore never inject arbitrary SQL or address an unvetted model.
+ * Keys not in the allowlist are skipped + logged.
+ *
+ * `audit_trail.*` is INTENTIONALLY EXCLUDED: `audit-trail-permanent` (critical)
+ * forbids any DELETE FROM audit_trail. The legacy row's
+ * `audit_trail.sync_entities: "delete all"` entry is stale drift from before
+ * the 2026-06-19 hardening — surfaced (skipped + warned), never executed.
+ *
+ * Registered under slug `@teamscala/service-boot:prune-stale-data`.
+ */
+import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
+export declare function pruneStaleData({ config, }: {
+    config: ScheduledJobConfig;
+}): Promise<void>;

package/src/handlers/registry-stale-inactive-sweep.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/scala-tools-currency-watch.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/singleton-tools-currency-watch.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/sweep-event-log.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/sweep-host-cache.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/sweep-host-cache.ts

@@ -16,14 +16,8 @@
  * Path convention (config.retention keys, substituted at runtime via `userHome()`
  * / `workspaceRoot()` per `host-literals-via-substitution` — source never
  * hardcodes host paths):
-*   "${HOME}/.bun/install/cache"          → "30 days"
-*   "${HOME}/.config/*.retired-*"         → "14 days"  (glob leaf, optional)
-*
-* config.retention_dirs — whole-DIRECTORY prune for build caches (Rust
-* `target/`) whose unit is the dir, not the file (file-by-mtime would corrupt
-* the cache). Keys support `*` globs; a matched dir is deleted ENTIRELY only
-* when its newest file is older than the cutoff:
-*   "${WORKSPACE}/<repo>/target"         → "30 days"  (glob wildcard, whole-dir delete)
+ *   "${HOME}/.bun/install/cache"          → "30 days"
+ *   "${HOME}/.config/*.retired-*"         → "14 days"  (glob leaf, optional)
  *
  * Deletion runs through Bun fs APIs — pure filesystem deletion needs no shell,
  * so `spawn-is-the-only-spawn` does not apply (that governs shell commands).
@@ -40,7 +34,7 @@
  * Registered under slug `@teamscala/service-boot:sweep-host-cache`.
  */
 import { rm, readdir, stat } from "node:fs/promises";
-import { readdirSync, type Dirent } from "node:fs";
+import type { Dirent } from "node:fs";
 import { join } from "node:path";
 import { spawnSync } from "@teamscala/os/spawn/spawn";
 import { userHome, workspaceRoot } from "@teamscala/os/host-paths";
@@ -123,97 +117,11 @@ async function sweepPath(
 	return { path: rootDir, scanned, deleted, bytesFreed };
 }
 
-/**
- * Expand a path pattern containing single-segment `*` wildcards into concrete
- * paths (files or dirs). Used by `retention_dirs` so a single config key like
-* a pattern like `${WORKSPACE}/<star>/target` reaches every repo's target dir.
-* Sync + bounded: the
- * pattern is shallow (3 segments), and this runs once
- * nightly. Non-existent segments yield no matches (the caller stats each result).
- */
-export function expandGlob(pattern: string): string[] {
-	const absolute = pattern.startsWith("/");
-	const segments = (absolute ? pattern.slice(1) : pattern)
-		.split("/")
-		.filter((s) => s.length > 0);
-	let current: string[] = [absolute ? "/" : "."];
-	for (const seg of segments) {
-		if (current.length === 0) break;
-		const next: string[] = [];
-		for (const dir of current) {
-			let names: string[];
-			try {
-				names = readdirSync(dir);
-			} catch {
-				continue;
-			}
-			for (const name of names) {
-				if (seg === "*" || seg === name) next.push(join(dir, name));
-			}
-		}
-		current = next;
-	}
-	return current;
-}
-
-/**
- * Is `dir` stale — i.e. NO file under it is newer than `cutoffMs`? Walks
- * recursively and SHORT-CIRCUITS the instant it finds a fresh file (so an
- * actively-built target dir returns fast without walking its full tree). On a
- * stale dir the walk is complete and returns the total size + file count, so
- * the caller can report bytes-freed before deleting the dir whole.
- */
-export async function checkDirStale(
-	dir: string,
-	cutoffMs: number,
-): Promise<{ stale: boolean; bytes: number; fileCount: number }> {
-	const stack: string[] = [dir];
-	let bytes = 0;
-	let fileCount = 0;
-	while (stack.length > 0) {
-		const d = stack.pop();
-		if (d === undefined) break;
-		let entries: Dirent[];
-		try {
-			entries = await readdir(d, { withFileTypes: true });
-		} catch {
-			continue;
-		}
-		for (const entry of entries) {
-			const full = join(d, entry.name);
-			if (entry.isDirectory()) {
-				stack.push(full);
-			} else if (entry.isFile()) {
-				try {
-					const st = await stat(full);
-					if (st.mtimeMs >= cutoffMs) {
-						return { stale: false, bytes: 0, fileCount: 0 };
-					}
-					bytes += st.size;
-					fileCount++;
-				} catch {
-					// vanished/unreadable — skip
-				}
-			}
-		}
-	}
-	return { stale: true, bytes, fileCount };
-}
-
-/** Parse the root-fs Use% from `df --output=pcent,target` output (pure, for tests).
- *  Returns null if no root-mount line is found. */
-export function parseRootDiskPct(out: string): number | null {
-	const rootLine = out.split("\n").find((l) => l.trim().endsWith("/"));
-	const m = rootLine?.match(/(\d+)%/);
-	return m ? Number(m[1]) : null;
-}
-
 async function sweepHostCache(ctx: {
-	config: { retention?: Record<string, string>; retention_dirs?: Record<string, string> };
+	config: { retention?: Record<string, string> };
 }): Promise<void> {
 	const log = getAppLogger();
 	const retention = ctx.config.retention ?? {};
-	const retentionDirs = ctx.config.retention_dirs ?? {};
 	const now = Date.now();
 	const results: SweepResult[] = [];
 
@@ -246,36 +154,6 @@ async function sweepHostCache(ctx: {
 		);
 	}
 
-	// retention_dirs — whole-directory prune for build caches (Rust target/).
-	// A matched dir is deleted ENTIRELY only when its newest file is older than
-	// the cutoff, so an actively-built repo keeps its cache and an abandoned one
-	// is reclaimed whole (never the partial slice that would corrupt the cache).
-	for (const [rawPattern, rawDuration] of Object.entries(retentionDirs)) {
-		const days = parseDays(rawDuration);
-		if (days === null || days <= 0) {
-			log.warn(
-				`[host-cache-sweep] skipping retention_dirs "${rawPattern}" — value "${rawDuration}" is not a day-granularity duration (expected e.g. "30 days")`,
-			);
-			continue;
-		}
-		const cutoffMs = now - days * MS_PER_DAY;
-		for (const dir of expandGlob(resolveHostPath(rawPattern))) {
-			try {
-				const st = await stat(dir);
-				if (!st.isDirectory()) continue;
-			} catch {
-				continue; // glob match that is not a dir (or vanished) — skip
-			}
-			const { stale, bytes, fileCount } = await checkDirStale(dir, cutoffMs);
-			if (!stale) continue;
-			await rm(dir, { recursive: true, force: true });
-			results.push({ path: dir, scanned: fileCount, deleted: fileCount, bytesFreed: bytes });
-			log.info(
-				`[host-cache-sweep] ${dir}: no build in ${rawDuration}; reclaimed whole dir — ${fileCount} file(s), ${formatBytes(bytes)}`,
-			);
-		}
-	}
-
 	const totalDeleted = results.reduce((sum, r) => sum + r.deleted, 0);
 	const totalBytes = results.reduce((sum, r) => sum + r.bytesFreed, 0);
 	log.info(
@@ -298,27 +176,32 @@ async function sweepHostCache(ctx: {
 		},
 	});
 
-	// Disk-threshold observability — rides this periodic sweep (NOT an interval:
-	// this job is genuinely periodic application-DATA work — deletion — and the
-	// df read piggybacks once per run). Emits through the event-driven surface:
-	// logger.warn -> GlitchTip (the paging path, same as host.pressure) +
-	// recordEvent for the durable event_log record. Catches a fill faster than
-	// the nightly prune can absorb (a cache with no retention entry, an external
-	// dump, a runaway log) so the operator learns it within a day, not at 100%.
-	const diskHighPct = 90;
+	// Disk-threshold monitor — piggybacks on this nightly sweep event (no separate
+	// interval/infra: `guards-never-run-on-interval`). If `/` usage crosses the
+	// configured threshold, emit `host.disk.high` (-> event-log/GlitchTip) so a fill
+	// the sweep can't absorb (external dump, runaway log) is caught within a day.
+	const highPercent = 90;
 	try {
-		const dfRes = spawnSync({ name: "df:/", command: ["df", "--output=pcent,target"], timeoutMs: 5_000 });
+		const dfRes = spawnSync({ name: "df:/", command: ["df", "--output=pcent,target"], timeoutMs: 5000 });
 		const dfOut = (dfRes.stdout ?? "").trim();
-		const usePct = parseRootDiskPct(dfOut);
-		if (usePct !== null && usePct >= diskHighPct) {
-			log.warn("host.disk.high", { usePct, threshold: diskHighPct, df: dfOut });
-			recordEvent({
-				kind: "host.disk.high",
-				payload: { usePct, threshold: diskHighPct, df: dfOut, completedAt: new Date().toISOString() },
-			});
+		const rootLine = dfOut
+			.split("\n")
+			.find((l) => l.trim().endsWith("/"));
+		const pctMatch = rootLine?.match(/(\d+)%/);
+		if (pctMatch) {
+			const usePct = Number(pctMatch[1]);
+			if (usePct >= highPercent) {
+				log.warn(
+					`[host-cache-sweep] disk usage ${usePct}% >= ${highPercent}% threshold — emitting host.disk.high`,
+				);
+				recordEvent({
+					kind: "host.disk.high",
+					payload: { usePct, threshold: highPercent, df: dfOut, completedAt: new Date().toISOString() },
+				});
+			}
 		}
 	} catch (error) {
-		log.warn("[host-cache-sweep] disk-threshold read failed: " + String(error));
+		log.warn(`[host-cache-sweep] disk-threshold check failed: ${String(error)}`);
 	}
 }
 

package/src/handlers/upstream-issue-sync.d.ts

@@ -0,0 +1 @@
+export {};

package/src/handlers/whatsapp-liveness-logic.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Pure transition-detection logic for the WhatsApp linked-device liveness monitor
+ * (`whatsapp-liveness` handler). Split out from the GOWA-coupled handler so the
+ * logic is unit-testable with zero adapter dependencies, and the handler is a thin
+ * poll→detect→emit shell. The connection signal is the GOWA device `state` field
+ * (`"logged_in"` == connected) — see `whatsapp-remote-logout-monitor`.
+ */
+/** GOWA device `state` value meaning the linked phone is connected + authenticated. */
+export declare const GOWA_CONNECTED_STATE = "logged_in";
+export interface WhatsAppDeviceState {
+    id: string;
+    state: string;
+    jid?: string;
+    display_name?: string;
+}
+export interface LivenessTransitions {
+    disconnected: WhatsAppDeviceState[];
+    reconnected: WhatsAppDeviceState[];
+}
+/**
+ * Detect connected↔disconnected transitions between the last-known and the freshly
+ * observed device states.
+ *
+ * `prev` is the last-known `state` per device id. A device ABSENT from `prev` is a
+ * first sighting: it seeds the baseline and yields NO transition (so the monitor
+ * never alerts on a state it never observed the device leave, and a process restart
+ * re-baselines without false positives). A device present in `prev` is compared:
+ * connected→not is `disconnected`; not→connected is `reconnected`.
+ */
+export declare function detectLivenessTransitions(prev: Map<string, string>, curr: WhatsAppDeviceState[]): LivenessTransitions;

package/src/handlers/whatsapp-liveness.d.ts

@@ -0,0 +1,4 @@
+import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
+export declare function pollWhatsAppLiveness({ config: _config, }: {
+    config: ScheduledJobConfig;
+}): Promise<void>;

package/src/hono-error-handler.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The single app.onError factory for every Hono app (UI + backend). Two error
+ * classes, deliberately separate:
+ *  - HTTPException: a DELIBERATE status-bearing throw (e.g. hono bodyLimit's
+ *    413). Preserve its status + message verbatim — buildErrorReport only knows
+ *    500/503 and would erase a deliberate 413/401/etc.
+ *  - anything else: an UNEXPECTED error → buildErrorReport (errorId correlation,
+ *    transient-vs-bug classification, 503 + Retry-After when retryable, else 500).
+ *
+ * Resolves the apparent tension between `hono-global-error-handler` (HTTPException
+ * → status + JSON) and `error-responses-via-error-report` (every error response
+ * via buildErrorReport): the latter governs UNEXPECTED errors; HTTPException is
+ * the documented deliberate-status carve-out. The handler is a consumer of
+ * buildErrorReport, never a second classifier for the unexpected branch.
+ */
+import type { Context } from "hono";
+/**
+ * Returns an `app.onError` handler tagged with `label` (used in the log line so
+ * the boot site that surfaced the error is identifiable).
+ */
+export declare function createRequestErrorHandler(label: string): (err: unknown, c: Context) => Response;

package/src/install-harness.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ * @indivisible-unit
+ *
+ * Install harness — sandbox-mounts each declared package and captures
+ * registry.require() calls via AsyncLocalStorage. Validates all required
+ * rows exist before returning. Throws HarnessInstallError with full
+ * context on failure. Per Constitution Rule 2 step 3.
+ *
+ * Marked @indivisible-unit: HarnessInstallError is the error class
+ * validatePackageDependencies (might) throw — they form one canonical
+ * "install harness validation" unit (the validator + the failure-mode
+ * class it produces).
+ */
+export interface PackageDescriptor {
+    name: string;
+    initPath: string;
+}
+export interface HarnessValidationResult {
+    valid: true;
+    dependencies: Array<{
+        slug: string;
+    }>;
+}
+export interface HarnessValidationError {
+    valid: false;
+    missing: Array<{
+        slug: string;
+        packageName: string;
+    }>;
+}
+export type HarnessOutcome = HarnessValidationResult | HarnessValidationError;
+export declare class HarnessInstallError extends Error {
+    readonly missing: Array<{
+        slug: string;
+        packageName: string;
+    }>;
+    constructor(missing: Array<{
+        slug: string;
+        packageName: string;
+    }>);
+}
+export declare function validatePackageDependencies(packages: PackageDescriptor[], mountFn: (pkg: PackageDescriptor) => Promise<void>): Promise<HarnessOutcome>;