@teamscala/service-boot 0.23.389 → 0.23.394

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.389",
+  "version": "0.23.394",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -34,9 +34,11 @@
     "@teamscala/generic-registry": "*",
     "@teamscala/http": "*",
     "@teamscala/logger": "*",
+    "@teamscala/notify-cache": "*",
     "@teamscala/object-storage": "*",
     "@teamscala/orpc": "*",
     "@teamscala/os": "*",
+    "@teamscala/publish-registry": "*",
     "@teamscala/realtime-utils": "*",
     "@teamscala/resolver-engine": "*",
     "@teamscala/timing": "*",
@@ -562,6 +564,14 @@
       "types": "./src/load-service-prisma-client.d.ts",
       "default": "./src/load-service-prisma-client.ts"
     },
+    "./module-not-found": {
+      "types": "./src/module-not-found.d.ts",
+      "default": "./src/module-not-found.ts"
+    },
+    "./module-not-found.ts": {
+      "types": "./src/module-not-found.d.ts",
+      "default": "./src/module-not-found.ts"
+    },
     "./mount": {
       "types": "./src/mount.d.ts",
       "default": "./src/mount.ts"

package/src/fn-routers/email-defaults.ts

@@ -3,20 +3,26 @@
  * @status handwritten
  * @edit edit directly
  *
- * Cached reader for the `email-defaults` config row's `default_sender` — the
- * from-address for outbound transactional email (agreement/proposal/assessment
- * senders). Replaces the former process.env.DEFAULT_EMAIL_SENDER read
- * (configured-primitives: the registry row is the source of truth, not env).
+ * Hot snapshot of `email-defaults.default_sender` (outbound transactional
+ * from-address). Replaces the former process.env.DEFAULT_EMAIL_SENDER read.
+ * Invalidated by NOTIFY on `registry_config_changed`; `staleAfterMs` is the
+ * safety ceiling for an upstream regression that drops notifications.
  */
+import { createNotifyCache } from "@teamscala/notify-cache/create-notify-cache";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 
 const FALLBACK_SENDER = "noreply@gateway.scala.business";
-let cached: string | undefined;
+const defaultSenderCache = createNotifyCache<string>({
+	name: "service-boot:default-email-sender",
+	load: async () => {
+		const row = await loadRegistryConfig("config", "email-defaults", v.looseObject({}));
+		return (row?.default_sender as string | undefined) ?? FALLBACK_SENDER;
+	},
+	invalidateOn: ["registry_config_changed"],
+	staleAfterMs: 5 * 60 * 1000,
+});
 
 export async function getDefaultEmailSender(): Promise<string> {
-	if (cached !== undefined) return cached;
-	const row = await loadRegistryConfig("config", "email-defaults", v.looseObject({}));
-	cached = (row?.default_sender as string | undefined) ?? FALLBACK_SENDER;
-	return cached;
+	return defaultSenderCache.get();
 }

package/src/fn-routers/email-link-ttl.ts

@@ -3,21 +3,26 @@
  * @status handwritten
  * @edit edit directly
  *
- * Cached reader for the `email-links` config row's `email_link_ttl_ms` — the
- * validity window for agreement/proposal email-access magic links (dedup'd
- * across the 3 fn-routers that mint them). Replaces the former per-file
- * hardcoded EMAIL_LINK_TTL_MS constant (config-constants: the registry row is
- * the source of truth, not the literal).
+ * Hot snapshot of `email-links.email_link_ttl_ms` (magic-link validity
+ * window, dedup'd across the 3 fn-routers that mint them). Replaces the
+ * former per-file EMAIL_LINK_TTL_MS constant. Invalidated by NOTIFY on
+ * `registry_config_changed`.
  */
+import { createNotifyCache } from "@teamscala/notify-cache/create-notify-cache";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 
 const DEFAULT_EMAIL_LINK_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-let cached: number | undefined;
+const emailLinkTtlCache = createNotifyCache<number>({
+	name: "service-boot:email-link-ttl",
+	load: async () => {
+		const row = await loadRegistryConfig("config", "email-links", v.looseObject({}));
+		return (row?.email_link_ttl_ms as number | undefined) ?? DEFAULT_EMAIL_LINK_TTL_MS;
+	},
+	invalidateOn: ["registry_config_changed"],
+	staleAfterMs: 5 * 60 * 1000,
+});
 
 export async function getEmailLinkTtlMs(): Promise<number> {
-	if (cached !== undefined) return cached;
-	const row = await loadRegistryConfig("config", "email-links", v.looseObject({}));
-	cached = (row?.email_link_ttl_ms as number | undefined) ?? DEFAULT_EMAIL_LINK_TTL_MS;
-	return cached;
+	return emailLinkTtlCache.get();
 }

package/src/fn-routers/public-assessment-router.ts

@@ -25,10 +25,11 @@ import * as v from "valibot";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { sendEmail, initResendClient } from "@teamscala/api-resend/send-email";
 import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
+import { resolveEmailSender } from "@teamscala/email/identity/resolve-email-sender";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { fetchOrgBrand } from "@teamscala/resolver-engine/data-resolvers/fetch-org-brand";
 import { recordEvent } from "@teamscala/event-log/record-event";
-import { getDefaultEmailSender } from "./email-defaults.ts";
 
 interface Context {
 	prisma: any;
@@ -106,9 +107,9 @@ function bandForScore(
 
 /**
  * Best-effort branded Authority Index Report email. Self-contained: loads its
- * own Resend secret, swallows every error — a send failure is logged and NEVER
- * undoes the submit (the agreement-completion-email pattern). Fire-and-forget
- * from the submit handler.
+ * own Resend secret, swallows every error. Sender identity + brand tokens
+ * come from resolveEmailSender (per-org email_sender row). On Resend refusal
+ * the call falls back to the platform sender and logs the reason.
  */
 async function sendAuthorityReportEmail(opts: {
 	to: string;
@@ -117,6 +118,8 @@ async function sendAuthorityReportEmail(opts: {
 	bandLabel: string;
 	categoryScores: Record<string, number>;
 	ctaUrl?: string;
+	organisationId?: string | null;
+	prisma: any;
 }): Promise<void> {
 	const log = getAppLogger();
 	const rawSecret = await loadRegistryConfig(
@@ -132,17 +135,42 @@ async function sendAuthorityReportEmail(opts: {
 		return;
 	}
 	initResendClient(decrypted.token);
-	const from = await getDefaultEmailSender();
+
+	const brandRow =
+		opts.organisationId && opts.prisma
+			? await fetchOrgBrand(
+					opts.prisma as Parameters<typeof fetchOrgBrand>[0],
+					opts.organisationId,
+				).catch(() => null)
+			: null;
+	const sender = await resolveEmailSender(opts.organisationId ?? null, {
+		brand: brandRow
+			? {
+					orgName: brandRow.companyName ?? "",
+					primaryColor: brandRow.primaryColor,
+					accentColor: brandRow.accentColor ?? null,
+					logoUrl: brandRow.logo.light ?? null,
+				}
+			: undefined,
+	});
+	const primary = sender.brand.primaryColor;
+	const muted = "#6b7280"; // structural neutral for body labels
+	const logoUrl = sender.brand.logoUrl;
+	const logoHtml =
+		logoUrl && /^https?:\/\//.test(logoUrl)
+			? `<p style="margin:0 0 20px"><img src="${logoUrl}" alt="${sender.brand.orgName || ""}" style="max-height:56px;display:block"></p>`
+			: "";
+
 	// Subject + body from the `authority-index-report` email_template row, not
-	// literals here (email-template-registry-type). The per-pillar rows and the
-	// optional CTA are the only DYNAMIC markup, so they are rendered here and
-	// passed as merge vars — the row still owns all the copy and the layout.
+	// literals here (email-template-registry-type). Dynamic markup is rendered
+	// here and passed as merge vars — the row owns copy + layout; colours +
+	// logo come from the org brand tokens, NOT inline literals.
 	const pillarRows = (
 		Object.entries(opts.categoryScores) as Array<[string, number]>
 	)
 		.map(
 			([name, score]) =>
-				`<tr><td style="padding:6px 0;color:#374151">${name}</td><td style="padding:6px 0;text-align:right;font-weight:600;color:#111827">${score} / 100</td></tr>`,
+				`<tr><td style="padding:6px 0;color:${muted}">${name}</td><td style="padding:6px 0;text-align:right;font-weight:600;color:${primary}">${score} / 100</td></tr>`,
 		)
 		.join("");
 	const pillarsText = (
@@ -156,27 +184,80 @@ async function sendAuthorityReportEmail(opts: {
 		bandLabel: opts.bandLabel,
 		pillarRows,
 		pillarsText,
+		brandPrimaryColor: primary,
+		brandAccentColor: sender.brand.accentColor ?? primary,
+		brandLogoHtml: logoHtml,
+		orgName: sender.brand.orgName,
 		ctaHtml: opts.ctaUrl
-			? `<p style="margin:24px 0 0"><a href="${opts.ctaUrl}" style="display:inline-block;background:#111827;color:#ffffff;text-decoration:none;font-weight:600;padding:12px 22px;border-radius:8px">Book your Authority Growth Session</a></p>`
+			? `<p style="margin:24px 0 0"><a href="${opts.ctaUrl}" style="display:inline-block;background:${primary};color:#ffffff;text-decoration:none;font-weight:600;padding:12px 22px;border-radius:8px">Book your Authority Growth Session</a></p>`
 			: "",
 		ctaText: opts.ctaUrl ? `\nBook your Authority Growth Session: ${opts.ctaUrl}` : "",
 	});
-	const res = await sendEmail({
-		from,
-		to: opts.to,
-		subject: tpl.subject,
-		html: tpl.bodyHtml,
-		text: tpl.bodyText,
-	});
+
+	const sendOnce = async (fromHeader: string, replyToHeader: string | undefined) =>
+		sendEmail({
+			from: fromHeader,
+			to: opts.to,
+			subject: tpl.subject,
+			html: tpl.bodyHtml,
+			text: tpl.bodyText,
+			reply_to: replyToHeader,
+		});
+
+	let res = await sendOnce(sender.from, sender.replyTo);
+	let usedFrom = sender.from;
+	if (!res.success) {
+		// Resend refused the org sender (likely unverified domain). Fall back
+		// to the platform sender; never fail because a verification lookup
+		// failed — the resolver returns the row, the failure is at Resend.
+		const platformRow = await loadRegistryConfig(
+			"config",
+			"email-defaults",
+			v.looseObject({ default_sender: v.optional(v.string()) }),
+		).catch(() => null);
+		const fallbackFrom =
+			(platformRow?.default_sender as string | undefined)?.trim() ||
+			"scala <noreply@gateway.scala.business>";
+		log.warn(
+			`[authority-report-email] org sender ${sender.from} refused by Resend (${res.error ?? "unknown"}); falling back to platform ${fallbackFrom}`,
+		);
+		res = await sendOnce(fallbackFrom, undefined);
+		usedFrom = fallbackFrom;
+	}
+
 	if (res.success) {
 		log.info(
-			`[authority-report-email] sent to ${opts.to}${res.id ? ` (id ${res.id})` : ""}`,
+			`[authority-report-email] sent to ${opts.to}${res.id ? ` (id ${res.id})` : ""} from=${usedFrom}${sender.isOrgIdentity ? "" : " (platform fallback)"}`,
 		);
 	} else {
 		log.error(
 			`[authority-report-email] failed to ${opts.to}: ${res.error ?? "unknown"}`,
 		);
 	}
+
+	// email-send-audited: best-effort audit row. Guarded so a stale prisma
+	// client (scala-quiz schema predates email_send_log) skips cleanly.
+	try {
+		const auditPrisma = opts.prisma as {
+			email_send_log?: { create: (args: unknown) => Promise<unknown> };
+		};
+		if (auditPrisma?.email_send_log) {
+			await auditPrisma.email_send_log.create({
+				data: {
+					to_address: opts.to,
+					template_slug: "authority-index-report",
+					status: res.success ? "sent" : "failed",
+					provider_message_id: res.id ?? null,
+					error: res.success ? null : (res.error ?? "unknown"),
+					from_address: usedFrom,
+				},
+			});
+		}
+	} catch (auditErr) {
+		log.warn(
+			`[authority-report-email] audit row write failed: ${auditErr instanceof Error ? auditErr.message : String(auditErr)}`,
+		);
+	}
 }
 
 function scoreAnswers(
@@ -382,6 +463,8 @@ export const publicAssessmentRouter = {
 					bandLabel: band.label,
 					categoryScores,
 					ctaUrl,
+					organisationId: orgId,
+					prisma,
 				}).catch((e) =>
 					log.error(
 						`[publicAssessment.submit] report email non-fatal: ${e instanceof Error ? e.message : String(e)}`,

package/src/handlers/bun-stable-watch.ts

@@ -24,9 +24,10 @@
 import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { getDistTagVersion } from "@teamscala/publish-registry";
 import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
 
-const BUN_NPM_LATEST = "https://registry.npmjs.org/bun/latest";
+const NPM_REGISTRY = "https://registry.npmjs.org";
 const TARGET_STABLE = "1.4.0"; // flip back when a stable at or above this ships
 
 interface BunLatestManifest {
@@ -54,23 +55,19 @@ function isStableAtOrAbove(version: string, target: string): boolean {
 
 async function bunStableWatch(_ctx: { config: ScheduledJobConfig }): Promise<void> {
 	const log = getAppLogger();
-	let manifest: BunLatestManifest;
-	try {
-		const res = await fetch(BUN_NPM_LATEST, { headers: { accept: "application/json" } });
-		if (!res.ok) throw new Error(`npm bun/latest HTTP ${res.status}`);
-		manifest = (await res.json()) as BunLatestManifest;
-	} catch (err) {
-		log.warn(`[bun-stable-watch] failed to fetch npm bun/latest: ${err}`);
+	const version = await getDistTagVersion("bun", "latest", NPM_REGISTRY);
+	if (!version) {
+		log.warn("[bun-stable-watch] failed to fetch npm bun/latest");
 		return;
 	}
-	if (isStableAtOrAbove(manifest.version, TARGET_STABLE)) {
+	if (isStableAtOrAbove(version, TARGET_STABLE)) {
 		log.warn(
-			`[bun-stable-watch] Bun stable ${manifest.version} (>=${TARGET_STABLE}) shipped — escape hatch 'bun-14-lock-resolution-pin' is ready to retire. Run the atomic flip-back: config/scala-tools-deps.lockResolutionBun -> "bun" + railpack_config rows -> 1.4.0 stable + delete /usr/local/bin/bun-1.3.14 + a green deploy.`,
+			`[bun-stable-watch] Bun stable ${version} (>=${TARGET_STABLE}) shipped — escape hatch 'bun-14-lock-resolution-pin' is ready to retire. Run the atomic flip-back: config/scala-tools-deps.lockResolutionBun -> "bun" + railpack_config rows -> 1.4.0 stable + delete /usr/local/bin/bun-1.3.14 + a green deploy.`,
 		);
 		recordEvent({
 			kind: "bun.stable.shipped",
 			payload: {
-				latest: manifest.version,
+				latest: version,
 				targetStable: TARGET_STABLE,
 				note: "escape hatch bun-14-lock-resolution-pin ready to retire; verify railpack 1.4.0 support then run the atomic flip-back",
 			},
@@ -78,11 +75,11 @@ async function bunStableWatch(_ctx: { config: ScheduledJobConfig }): Promise<voi
 		return;
 	}
 	log.info(
-		`[bun-stable-watch] npm bun/latest = ${manifest.version} — not yet stable ${TARGET_STABLE}; escape hatch remains`,
+		`[bun-stable-watch] npm bun/latest = ${version} — not yet stable ${TARGET_STABLE}; escape hatch remains`,
 	);
 	recordEvent({
 		kind: "bun.watch.tick",
-		payload: { latest: manifest.version, targetStable: TARGET_STABLE },
+		payload: { latest: version, targetStable: TARGET_STABLE },
 	});
 }
 

package/src/handlers/singleton-tools-currency-watch.ts

@@ -28,6 +28,7 @@ import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { spawn } from "@teamscala/os/spawn";
+import { getDistTagVersion } from "@teamscala/publish-registry";
 import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
 
 /**
@@ -180,7 +181,7 @@ async function fetchLatestGithubRelease(repo: string): Promise<string | null> {
 async function fetchLatestVersion(pkg: string, distTag: string): Promise<string | null> {
 	try {
 		// @teamscala/* packages use the internal dist-tag tool; public npm packages
-		// fetch directly from the npm registry (same pattern as bun-stable-watch).
+		// fetch directly from the npm registry via the typed primitive.
 		if (pkg.startsWith("@teamscala/")) {
 			const result = await spawn({
 				name: "singleton-tools-currency:dist-tag",
@@ -196,12 +197,7 @@ async function fetchLatestVersion(pkg: string, distTag: string): Promise<string
 			if (!latest || !parseSemver(latest)) return null;
 			return latest;
 		}
-		// Public npm package: fetch the dist-tag manifest directly.
-		const url = `https://registry.npmjs.org/${encodeURIComponent(pkg)}/${encodeURIComponent(distTag)}`;
-		const res = await fetch(url, { headers: { accept: "application/json" } });
-		if (!res.ok) return null;
-		const manifest = (await res.json()) as { version: string };
-		return manifest.version ?? null;
+		return getDistTagVersion(pkg, distTag, "https://registry.npmjs.org");
 	} catch {
 		return null;
 	}

package/src/read-html-template.ts

@@ -39,6 +39,7 @@
  * bytes across restarts).
  */
 
+import { createCache } from "@teamscala/cache/create-cache";
 import { readClientBuildStatus } from "./build-client-assets.ts";
 import { join } from "node:path";
 
@@ -70,7 +71,15 @@ const PAGE_DOCUMENT = `<!doctype html>
 	</body>
 </html>`;
 
-let cached: { html: string; manifestMtime: number } | null = null;
+interface CachedHtml {
+	html: string;
+	manifestMtime: number;
+}
+
+const htmlCache = createCache<CachedHtml>("service-boot:html-template", {
+	ttlMs: Number.POSITIVE_INFINITY,
+	maxSize: 1,
+});
 
 function manifestPath(): string {
 	return join(process.cwd(), "dist", "client", "asset-manifest.json");
@@ -98,8 +107,9 @@ async function loadManifest(): Promise<AssetManifest> {
 }
 
 export async function readHtmlTemplate(): Promise<string> {
-	const mtime = await manifestMtimeMs();
-	if (cached && cached.manifestMtime === mtime) return cached.html;
+	const manifestMtime = await manifestMtimeMs();
+	const cached = htmlCache.get("default");
+	if (cached && cached.manifestMtime === manifestMtime) return cached.html;
 	const manifest = await loadManifest();
 	let html = PAGE_DOCUMENT
 		.replace(/\{\{stylesPath\}\}/g, manifest.stylesPath)
@@ -116,6 +126,6 @@ export async function readHtmlTemplate(): Promise<string> {
 			? html.replace("</head>", `${meta}</head>`)
 			: `${meta}${html}`;
 	}
-	cached = { html, manifestMtime: mtime };
+	htmlCache.set("default", { html, manifestMtime });
 	return html;
 }

package/src/scala-tools-currency-watchdog.ts

@@ -5,6 +5,8 @@
  *
  * Polls the installed scala-tools package against GitHub Packages and repairs
  * stale daemon tooling by reinstalling and letting PM2 restart the process.
+ * The fetch routes through `getGithubPackagesLatestVersion` so the URL
+ * encoding and GitHub-Packages auth header live in the typed primitive.
  */
 
 import { recordEvent } from "@teamscala/event-log/record-event";
@@ -14,6 +16,7 @@ import { createWatchdog } from "@teamscala/watchdog/create-watchdog";
 import type { WatchdogHandle } from "@teamscala/watchdog/types";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
+import { getGithubPackagesLatestVersion } from "@teamscala/publish-registry";
 import * as v from "valibot";
 
 const PACKAGE_NAME = "@teamscala/scala-tools";
@@ -55,10 +58,6 @@ interface PackageManifest {
 	version?: unknown;
 }
 
-interface PackagePackument {
-	"dist-tags"?: { latest?: unknown };
-}
-
 let watchdog: WatchdogHandle | null = null;
 
 async function readInstalledVersion(cwd: string): Promise<string | null> {
@@ -70,24 +69,25 @@ async function readInstalledVersion(cwd: string): Promise<string | null> {
 	}
 }
 
-async function readLatestVersion(fetchTimeoutMs: number): Promise<string | null> {
+/**
+ * PACKAGE_URL is `<registry>/<encoded-name>`. Split it so the typed primitive
+ * owns the URL encoding (encodeURIComponent) and the GitHub-Packages auth
+ * header shape — neither is this file's concern.
+ */
+function registryFromPackageUrl(pkgUrl: string): { registry: string; name: string } {
+	const lastSlash = pkgUrl.lastIndexOf("/");
+	if (lastSlash < 0) return { registry: pkgUrl, name: "" };
+	return {
+		registry: pkgUrl.slice(0, lastSlash),
+		name: decodeURIComponent(pkgUrl.slice(lastSlash + 1)),
+	};
+}
+
+async function readLatestVersion(_fetchTimeoutMs: number): Promise<string | null> {
 	const token = await getGithubPackagesToken();
 	if (!token) return null;
-	try {
-		const response = await fetch(PACKAGE_URL, {
-			headers: {
-				accept: "application/vnd.github+json",
-				authorization: `Bearer ${token}`,
-			},
-			signal: AbortSignal.timeout(fetchTimeoutMs),
-		});
-		if (!response.ok) return null;
-		const packument = (await response.json()) as PackagePackument;
-		const latest = packument["dist-tags"]?.latest;
-		return typeof latest === "string" ? latest : null;
-	} catch {
-		return null;
-	}
+	const { registry, name } = registryFromPackageUrl(PACKAGE_URL);
+	return getGithubPackagesLatestVersion(name, token, registry);
 }
 
 async function checkCurrency(): Promise<{ healthy: boolean; details?: Record<string, unknown> }> {