@teamscala/service-boot 0.23.329 → 0.23.331

package/src/content-gate/gate.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The content-gate ENGINE. Runs in the page loader after the resource graph
+ * resolves, BEFORE SSR. Orchestration only — the per-type behaviour (which
+ * resource, who's authorized, what to seed, how to withhold) is supplied by a
+ * ContentGateConfig, so agreements/proposals/future gates are configs, not new
+ * functions. The single place that decides whether gated bytes reach the HTML.
+ */
+import type { ContentGateConfig } from "./config-types.ts";
+export declare function runContentGate(resolved: Record<string, unknown>, cookieHeader: string | null, nowMs: number, config: ContentGateConfig): Promise<void>;

package/src/content-gate/parse-cookie.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Parse a single cookie value out of a raw Cookie header — shared by the
+ * content-gate engine and any gate config.
+ */
+export declare function parseCookie(header: string | null, name: string): string | undefined;

package/src/content-gate/token.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The single signed, short-lived access token for EVERY content gate (agreement,
+ * proposal, and any future gated content). A gate withholds page content
+ * server-side until the request carries a valid token for that resource; this is
+ * the only thing that releases the content into the SSR, so without it a gated
+ * page is never readable/scrapable by a link holder.
+ *
+ * HMAC-SHA256 (Bun-native) over {c:cookieName, r:resourceId, e:email, x:exp}.
+ * `cookieName` is bound INTO the payload so a token minted for one gate
+ * (e.g. ag_token) can never satisfy another gate's check (e.g. prop_token).
+ *
+ * Secret resolver, in preference order: AUTH_SECRET → ENCRYPTION_KEY →
+ * DATABASE_URL (first one ≥16 chars). A gate signs AND verifies inside one
+ * service, so it only needs a stable per-deployment secret; the fallback keeps a
+ * gate working on a service that was never given AUTH_SECRET (e.g. the former
+ * public-only proposals viewer) instead of failing closed and locking out every
+ * authorized viewer. Any service that has AUTH_SECRET transparently prefers it.
+ * Fail-closed: no usable secret yields null (no token, no access).
+ */
+/** Mint a token proving `email` is authorized for `resourceId` under `cookieName`. */
+export declare function signAccessToken(cookieName: string, resourceId: string, email: string, nowMs: number, ttlMs: number, 
+/**
+ * Optional display name to carry in the token (the public GPT lead-capture
+ * gate uses this so a returning visitor's name is known at SSR — first paint
+ * renders the full identity, not just the email). Allow-list gates
+ * (proposals/agreements) omit it.
+ */
+name?: string): string | null;
+/**
+ * Validate a token for `cookieName` + `resourceId`. Returns the verified email
+ * on success, null otherwise (bad signature, wrong gate, wrong resource,
+ * expired, no secret).
+ */
+export declare function verifyAccessToken(token: string | undefined | null, cookieName: string, resourceId: string, nowMs: number): string | null;
+/**
+ * Like `verifyAccessToken` but returns the full verified identity ({email, name})
+ * so a gate that carries a display name in the token (the public GPT lead-capture
+ * gate) can seed the visitor's name — not just the email — at SSR. Same
+ * signature/expiry/gate-binding checks; null on any failure.
+ */
+export declare function verifyAccessTokenIdentity(token: string | undefined | null, cookieName: string, resourceId: string, nowMs: number): {
+    email: string;
+    name?: string;
+} | null;

package/src/content-page-floor.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Pure decision: does a CONTENT route (no resource_type) whose loader resolved
+ * a `page` body source warrant the branded not-found floor? Extracted from
+ * register-registry-page-route so the rule is unit-testable independent of the
+ * Hono/DB/graph machinery that wraps it (the fix's correctness does not depend
+ * on the publish — verify-before-done).
+ *
+ * Three outcomes:
+ *   - no page row (deleted/unmatched path, e.g. /roadmap) → dead-link 404 floor
+ *   - page row exists but zero content blocks → empty-page 200 floor
+ *   - otherwise → null (render normally)
+ *
+ * The "Vision Toolbar" leak this closes: a content catchall synthesized an empty
+ * page for an unmatched path and served a cacheable 200; resource-not-found-is-
+ * the-root-floor only fired for resource_type routes, so dead content links fell
+ * through. See resource-not-found.ts for the floor + operator ruling 2026-07-21.
+ */
+import { PrimaryResourceMissingError } from "./resource-not-found.ts";
+/**
+ * A page ROW exists but its body has zero content blocks — a content gap, not a
+ * dead link. True only when the row is present yet `puck_data` is absent or its
+ * `content` array is empty. Handles string (raw) and object (normalized) puck_data.
+ */
+export declare function pageBodyIsEmpty(page: unknown): boolean;
+/**
+ * Decide whether a content route should fall to the branded not-found floor.
+ * Returns the error to throw (mapped to the floor by bind-page-handler), or null
+ * to render normally. `hasResourceType` routes are handled by the existing
+ * resource_type missing check (caller-side) — they return null here.
+ */
+export declare function decideContentPageFloor(opts: {
+    hasResourceType: boolean;
+    hasPageContentSource: boolean;
+    page: unknown;
+}): PrimaryResourceMissingError | null;

package/src/discover-blocks.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Surgical block discovery: at boot, queries every block_schema row in the
+ * registry whose componentPath starts with one of the service's declared
+ * block_packages, then dynamic-imports each one. Per-block try/catch — one
+ * dead componentPath logs and skips, the rest still register and the page
+ * renders the surviving blocks. This replaces the static
+ * `.scala-install/page-manifest.ts` codegen output, which had the failure
+ * mode of a single dead block_schema row crashing the whole manifest at
+ * compile time.
+ *
+ * Empty block_packages is NOT fatal here: it falls back to scanning all
+ * active block_schema (uninstalled packages skip via the per-block try/catch),
+ * so a service whose row is unpopulated but whose blocks are installed still
+ * renders. The real "booted with zero blocks" fail-closed is at the call site
+ * (loaded.length === 0 → BootFatalError). A DB-unreachable error still throws —
+ * no fallback to a package-side puckBlocks scan, which masked blockless boots.
+ */
+import type { RendererComponentEntry } from "./types.ts";
+export interface DiscoveredBlocks {
+    components: Record<string, RendererComponentEntry>;
+    loaded: string[];
+    skipped: string[];
+}
+export declare function discoverBlocks(blockPackages: string[]): Promise<DiscoveredBlocks>;

package/src/discover-blocks.ts

@@ -23,7 +23,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
-import { getServerClient } from "./page-server-orpc/server-client.ts";
+import { getServerClient } from "@teamscala/orpc/server-client-registry";
 import * as v from "valibot";
 import type { RendererComponentEntry } from "./types.ts";
 

package/src/expand-roster.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Server-side roster expansion — the executor that handles "render N of block X
+ * per data row" so the page never needs a domain-specific panel/list block. A
+ * block authored with `props.dataRepeat: "parties"` is a TEMPLATE; before SSR
+ * this clones it once per roster item into its parent slot (top-level content or
+ * any Container's `content` slot), then drops the marker. Each clone:
+ *   - sets `role` + `dataKey` to the item's key, so a prop-driven block (the
+ *     SignatureField cell) finds its own party with no per-clone wiring;
+ *   - substitutes `{{name}}` / `{{role}}` / `{{company}}` / `{{date}}` /
+ *     `{{status}}` placeholders in any string prop (so a recipient row is plain
+ *     `Container` + `Text` primitives — the copy lives on the page, not here).
+ *     `{{status}}` resolves from the template's own `signedLabel` /
+ *     `awaitingLabel` props (DB-driven copy), never hardcoded.
+ * Generic over any roster; the agreement page passes its parties.
+ */
+export interface RosterItem {
+    key: string;
+    role: string;
+    name: string;
+    title: string | null;
+    company: string | null;
+    signedAt: string | null;
+    signature: string | null;
+}
+/** Agreement-level tokens (one substitution, not per-party). */
+export interface RosterMeta {
+    [token: string]: string;
+}
+/** Expand roster templates + bind agreement-meta placeholders across regions. */
+export declare function expandRosterTemplates(resolved: Record<string, unknown>, parties: RosterItem[], meta?: RosterMeta): void;

package/src/fn-routers/agreement-completion-email.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Completion delivery. When an agreement is fully EXECUTED (every party has
+ * signed), email each party their executed copy + a note to download the
+ * Certificate of Completion. Each link is a per-party magic-link (no email gate,
+ * no OTP — see attach-agreement-magic.ts). Best-effort and self-contained: it
+ * loads its own data and swallows every error, so a send failure is logged and
+ * NEVER undoes the signature (the payment-setup non-fatal rule, applied to mail).
+ * Fire-and-forget from the sign handler: `void sendAgreementCompletionEmails(...)`.
+ */
+export declare function sendAgreementCompletionEmails(agreementId: string, baseUrl: string): Promise<void>;

package/src/fn-routers/agreement-send-router.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * fn.agreementSend.send — authenticated "send for signature" procedure. Emails
+ * each party of an agreement a link to its signing page, stamps the lifecycle
+ * (sent_to / sent_at, status draft→sent), and returns a per-recipient result.
+ *
+ * Off-the-shelf path per building-applications: this is server logic beyond
+ * CRUD, so it is a typed ORPC procedure (not a bespoke endpoint), and it sends
+ * through the shared Resend adapter (@teamscala/api-resend) — the same surface
+ * @teamscala/auth uses for OTP — never a new email integration.
+ *
+ * Per-org sender: emails go FROM the org's display name on the platform's
+ * verified Resend domain ("<Org> via Sign <verified-addr>"), with reply_to set
+ * to the org's contact_email, so replies reach the org without each org needing
+ * its own verified domain. When an org later verifies its own sending domain,
+ * resolveSender is the single place to switch the FROM address.
+ *
+ * Sending is privileged (it reaches real inboxes), so the procedure requires an
+ * authenticated caller — the localhost super-admin bypass authorises operator /
+ * portal-SSR callers; the public signing page cannot invoke it.
+ */
+import * as v from "valibot";
+interface User {
+    id: string;
+    organisationId: string | null;
+}
+interface Context {
+    user: User | null | undefined;
+    headers: Headers;
+    resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+    prisma: any;
+}
+export declare const agreementSendRouter: {
+    send: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+        prisma: any;
+        user: User;
+    }>, v.ObjectSchema<{
+        readonly agreementId: v.StringSchema<undefined>;
+        /** Public base URL of the signing site, e.g. https://sign-dev.scala.business (no trailing slash). */
+        readonly baseUrl: v.StringSchema<undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        ok: false;
+        error: string;
+        sentAt?: undefined;
+        url?: undefined;
+        sent?: undefined;
+    } | {
+        error?: undefined;
+        ok: boolean;
+        sentAt: string | null;
+        url: string;
+        sent: {
+            email: string;
+            ok: boolean;
+            id?: string;
+            error?: string;
+        }[];
+    }, {
+        ok: false;
+        error: string;
+        sentAt?: undefined;
+        url?: undefined;
+        sent?: undefined;
+    } | {
+        error?: undefined;
+        ok: boolean;
+        sentAt: string | null;
+        url: string;
+        sent: {
+            email: string;
+            ok: boolean;
+            id?: string;
+            error?: string;
+        }[];
+    }>, Record<never, never>, Record<never, never>>;
+};
+export {};

package/src/fn-routers/ai-health-router.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * `fn.aiHealth` — the AI-availability probe the shared chat hook
+ * (`useAIHealthCheck`) polls before showing the chat's health dot. It resolves
+ * the same DB-driven default model the chat engine uses (`ai-default-model`
+ * config → an active `llm_model` row) and reports `{status, mcp, gateway}`;
+ * `status:"ok"` means the chat has a usable model configured.
+ *
+ * Unauthed (a public GPT surface polls it too) and a LIGHTWEIGHT registry read
+ * via the request `prisma` — deliberately NO `@teamscala/chat-completion` import,
+ * so wiring this universal procedure never pulls the AI stack into every
+ * service. Registered into the `fn` namespace by registerFnRouters, so any
+ * chat-capable service answers it instead of 404-ing.
+ */
+interface Context {
+    prisma: {
+        registry_entries: {
+            findFirst: (args: unknown) => Promise<{
+                config?: unknown;
+                id?: string;
+            } | null>;
+        };
+    };
+}
+export interface AiHealthResponse {
+    status: "ok" | "error";
+    mcp: boolean;
+    gateway: boolean;
+    error?: string;
+}
+export declare const aiHealthHandler: import("@orpc/server").DecoratedProcedure<Context & Record<never, never>, Context, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<AiHealthResponse, AiHealthResponse>, Record<never, never>, Record<never, never>>;
+export {};

package/src/fn-routers/auth-router.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ORPC procedures for auth checks (isOrgAdmin, resolveAdminOverride).
+ * Extracted from @teamscala/orpc/fn-router — primitives tier must not
+ * contain application-specific auth logic.
+ */
+interface User {
+    id: string;
+    name?: string | null;
+    email?: string;
+    organisationId: string | null;
+}
+interface Context {
+    user: User | null | undefined;
+    headers: Headers;
+    resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+    prisma: any;
+    orgId?: string | null;
+}
+declare const authed: import("@orpc/server").BuilderWithMiddlewares<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+    headers: Headers;
+    resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+    prisma: any;
+    user: User;
+    orgId: string | null | undefined;
+}>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<unknown, unknown>, Record<never, never>, Record<never, never>>;
+export declare const authRouter: {
+    isOrgAdmin: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+        prisma: any;
+        user: User;
+        orgId: string | null | undefined;
+    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<boolean, boolean>, Record<never, never>, Record<never, never>>;
+    resolveAdminOverride: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+        prisma: any;
+        user: User;
+        orgId: string | null | undefined;
+    }>, import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<string | null, string | null>, Record<never, never>, Record<never, never>>;
+};
+export type { Context, User };
+export { authed };

package/src/fn-routers/cache-admin-router.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * `fn.cacheAdmin` — ORPC procedures for in-process cache enable/disable/flush.
+ * Replaces the former `/api/data/cache-monitor/*` HANDLER_MAP entries
+ * (orpc-is-the-only-api: every API surface is a typed ORPC procedure, never a
+ * hand-written Hono route). Calls through @teamscala/cache/registry — the
+ * platform-singleton cache surface (cache-is-the-only-cache).
+ */
+import * as v from "valibot";
+export declare const cacheAdminRouter: {
+    enable: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("./auth-router.ts").Context & Record<never, never>, import("./auth-router.ts").Context, import("./auth-router.ts").Context>, import("@orpc/server").MergedCurrentContext<import("./auth-router.ts").Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        ok: boolean;
+        name: string;
+    }, {
+        ok: boolean;
+        name: string;
+    }>, Record<never, never>, Record<never, never>>;
+    disable: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("./auth-router.ts").Context & Record<never, never>, import("./auth-router.ts").Context, import("./auth-router.ts").Context>, import("@orpc/server").MergedCurrentContext<import("./auth-router.ts").Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        ok: boolean;
+        name: string;
+    }, {
+        ok: boolean;
+        name: string;
+    }>, Record<never, never>, Record<never, never>>;
+    flush: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("./auth-router.ts").Context & Record<never, never>, import("./auth-router.ts").Context, import("./auth-router.ts").Context>, import("@orpc/server").MergedCurrentContext<import("./auth-router.ts").Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly name: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        flushed: number;
+    }, {
+        flushed: number;
+    }>, Record<never, never>, Record<never, never>>;
+};

package/src/fn-routers/chat-session-router.d.ts

@@ -0,0 +1,219 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ORPC procedures for the AUTHENTICATED AI-chat conversation lifecycle —
+ * the org+user-keyed sibling of publicGptSessionRouter (which is contact-
+ * linked for anonymous public GPT visitors). One signed-in user chatting
+ * with one agent in one org owns a thread of `conversations` rows; this
+ * router createOrRestore-s the active one, saves turns, archives+news on
+ * clear, lists past threads, and loads a specific thread.
+ *
+ * Identity: the USER is resolved from the ORPC session context (`authed`
+ * middleware → `context.user.id`); the ORGANISATION is supplied by the
+ * client (it is the URL :orgId for org-scoped apps like scala-projects —
+ * the session does not carry it) and VERIFIED — the caller must be a
+ * member of that organisation, else FORBIDDEN. A caller cannot read or
+ * write another user's threads (ownership is user_id) or another org's
+ * (createOrRestore/list are membership-scoped to the supplied org).
+ *
+ * This restores the capability the portal AI chat lost when the June
+ * chat-engine migration severed `usePortalConversationId` + the
+ * `portalConversation` router (capability-named `chatSession` here per
+ * name-by-capability; the host-named orphan was deleted in the same change).
+ *
+ * Persistence model: the chat client owns writes via onMessagesPersist →
+ * saveMessages, and sends clientPersists:true so handle-chat-stream skips its
+ * own persistChatRun (single writer, no double-persist). Verbatim UIMessage
+ * parts are stored in messages.channel_data.parts so multi-step (tool-using)
+ * turns round-trip losslessly (apps/chat.md messages-stored-as-uimessage-verbatim).
+ */
+import * as v from "valibot";
+import { type Context } from "./auth-router.ts";
+export declare const chatSessionRouter: {
+    createOrRestore: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly agentId: v.StringSchema<undefined>;
+        readonly organisationId: v.StringSchema<undefined>;
+        /**
+         * SSR-only: the real user's id, passed by the AiChat serverLoader. The
+         * in-process server client is system-authed (context.user.id === "system"),
+         * so without this the conversation is created under user_id="system" and
+         * the real user's saveMessages hits assertOwns → FORBIDDEN. Only honoured
+         * when the caller is the system user (server-side SSR), never from a
+         * client-side ORPC call.
+         */
+        readonly userId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        conversationId: any;
+        model: any;
+        messages: {
+            id: any;
+            role: any;
+            content: any;
+            parts: unknown[] | undefined;
+            metadata: Record<string, unknown> | undefined;
+            created_at: any;
+            occurred_at: any;
+        }[];
+        tokenTotals: {
+            inputTokens: number;
+            outputTokens: number;
+        };
+        hasMore: boolean;
+    }, {
+        conversationId: any;
+        model: any;
+        messages: {
+            id: any;
+            role: any;
+            content: any;
+            parts: unknown[] | undefined;
+            metadata: Record<string, unknown> | undefined;
+            created_at: any;
+            occurred_at: any;
+        }[];
+        tokenTotals: {
+            inputTokens: number;
+            outputTokens: number;
+        };
+        hasMore: boolean;
+    }>, Record<never, never>, Record<never, never>>;
+    loadEarlier: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly conversationId: v.StringSchema<undefined>;
+        /** Cursor: the occurred_at (ISO) of the oldest currently-loaded message. */
+        readonly before: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, undefined>]>;
+        /** Cap; defaults to RECENT_MESSAGE_LIMIT, clamped to it. */
+        readonly limit: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        messages: {
+            id: any;
+            role: any;
+            content: any;
+            parts: unknown[] | undefined;
+            metadata: Record<string, unknown> | undefined;
+            created_at: any;
+            occurred_at: any;
+        }[];
+        hasMore: boolean;
+    }, {
+        messages: {
+            id: any;
+            role: any;
+            content: any;
+            parts: unknown[] | undefined;
+            metadata: Record<string, unknown> | undefined;
+            created_at: any;
+            occurred_at: any;
+        }[];
+        hasMore: boolean;
+    }>, Record<never, never>, Record<never, never>>;
+    saveMessages: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly conversationId: v.StringSchema<undefined>;
+        readonly messages: v.ArraySchema<v.ObjectSchema<{
+            readonly id: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly role: v.StringSchema<undefined>;
+            readonly content: v.StringSchema<undefined>;
+            readonly parts: v.OptionalSchema<v.ArraySchema<v.AnySchema, undefined>, undefined>;
+            readonly metadata: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.AnySchema, undefined>, undefined>;
+        }, undefined>, undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        success: boolean;
+    }, {
+        success: boolean;
+    }>, Record<never, never>, Record<never, never>>;
+    clear: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly conversationId: v.StringSchema<undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        conversationId: any;
+        messages: never[];
+        tokenTotals: {
+            inputTokens: number;
+            outputTokens: number;
+        };
+    }, {
+        conversationId: any;
+        messages: never[];
+        tokenTotals: {
+            inputTokens: number;
+            outputTokens: number;
+        };
+    }>, Record<never, never>, Record<never, never>>;
+    list: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly agentId: v.StringSchema<undefined>;
+        readonly organisationId: v.StringSchema<undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        conversations: any;
+    }, {
+        conversations: any;
+    }>, Record<never, never>, Record<never, never>>;
+    load: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<Context & Record<never, never>, Context, Context>, import("@orpc/server").MergedCurrentContext<Context, {
+        headers: Headers;
+        resolveUser?: (headers: Headers, prisma: any) => Promise<import("./auth-router.ts").User | null>;
+        prisma: any;
+        user: import("./auth-router.ts").User;
+        orgId: string | null | undefined;
+    }>, v.ObjectSchema<{
+        readonly conversationId: v.StringSchema<undefined>;
+    }, undefined>, import("@orpc/contract").Schema<{
+        conversationId: any;
+        messages: {
+            id: any;
+            role: any;
+            content: any;
+            parts: unknown[] | undefined;
+            metadata: Record<string, unknown> | undefined;
+            created_at: any;
+            occurred_at: any;
+        }[];
+        tokenTotals: {
+            inputTokens: number;
+            outputTokens: number;
+        };
+    }, {
+        conversationId: any;
+        messages: {
+            id: any;
+            role: any;
+            content: any;
+            parts: unknown[] | undefined;
+            metadata: Record<string, unknown> | undefined;
+            created_at: any;
+            occurred_at: any;
+        }[];
+        tokenTotals: {
+            inputTokens: number;
+            outputTokens: number;
+        };
+    }>, Record<never, never>, Record<never, never>>;
+};

package/src/fn-routers/email-defaults.d.ts

@@ -0,0 +1 @@
+export declare function getDefaultEmailSender(): Promise<string>;

package/src/fn-routers/email-link-ttl.d.ts

@@ -0,0 +1 @@
+export declare function getEmailLinkTtlMs(): Promise<number>;