@teamscala/service-boot 0.23.391 → 0.23.395

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.391",
+  "version": "0.23.395",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -34,9 +34,11 @@
     "@teamscala/generic-registry": "*",
     "@teamscala/http": "*",
     "@teamscala/logger": "*",
+    "@teamscala/notify-cache": "*",
     "@teamscala/object-storage": "*",
     "@teamscala/orpc": "*",
     "@teamscala/os": "*",
+    "@teamscala/publish-registry": "*",
     "@teamscala/realtime-utils": "*",
     "@teamscala/resolver-engine": "*",
     "@teamscala/timing": "*",
@@ -562,6 +564,14 @@
       "types": "./src/load-service-prisma-client.d.ts",
       "default": "./src/load-service-prisma-client.ts"
     },
+    "./module-not-found": {
+      "types": "./src/module-not-found.d.ts",
+      "default": "./src/module-not-found.ts"
+    },
+    "./module-not-found.ts": {
+      "types": "./src/module-not-found.d.ts",
+      "default": "./src/module-not-found.ts"
+    },
     "./mount": {
       "types": "./src/mount.d.ts",
       "default": "./src/mount.ts"

package/src/fn-routers/public-assessment-router.ts

@@ -119,7 +119,6 @@ async function sendAuthorityReportEmail(opts: {
 	categoryScores: Record<string, number>;
 	ctaUrl?: string;
 	organisationId?: string | null;
-	brand?: import("@teamscala/email/identity/resolve-email-sender").OrgBrandTokens;
 	prisma: any;
 }): Promise<void> {
 	const log = getAppLogger();
@@ -137,7 +136,23 @@ async function sendAuthorityReportEmail(opts: {
 	}
 	initResendClient(decrypted.token);
 
-	const sender = await resolveEmailSender(opts.organisationId ?? null);
+	const brandRow =
+		opts.organisationId && opts.prisma
+			? await fetchOrgBrand(
+					opts.prisma as Parameters<typeof fetchOrgBrand>[0],
+					opts.organisationId,
+				).catch(() => null)
+			: null;
+	const sender = await resolveEmailSender(opts.organisationId ?? null, {
+		brand: brandRow
+			? {
+					orgName: brandRow.companyName ?? "",
+					primaryColor: brandRow.primaryColor,
+					accentColor: brandRow.accentColor ?? null,
+					logoUrl: brandRow.logo.light ?? null,
+				}
+			: undefined,
+	});
 	const primary = sender.brand.primaryColor;
 	const muted = "#6b7280"; // structural neutral for body labels
 	const logoUrl = sender.brand.logoUrl;
@@ -441,21 +456,6 @@ export const publicAssessmentRouter = {
 				(typeof assessment.cta_url === "string" && assessment.cta_url) ||
 				undefined;
 			if (band) {
-				const prisma = (context as { prisma: unknown }).prisma;
-				const brandRow = opts.organisationId
-					? await fetchOrgBrand(
-							prisma as Parameters<typeof fetchOrgBrand>[0],
-							opts.organisationId,
-						).catch(() => null)
-					: null;
-				const brand = brandRow
-					? {
-							orgName: brandRow.companyName ?? "",
-							primaryColor: brandRow.primaryColor,
-							accentColor: brandRow.accentColor ?? null,
-							logoUrl: brandRow.logo.light ?? null,
-						}
-					: undefined;
 				void sendAuthorityReportEmail({
 					to: email,
 					firstName,
@@ -463,8 +463,7 @@ export const publicAssessmentRouter = {
 					bandLabel: band.label,
 					categoryScores,
 					ctaUrl,
-					organisationId: opts.organisationId,
-					brand,
+					organisationId: orgId,
 					prisma,
 				}).catch((e) =>
 					log.error(

package/src/handlers/bun-stable-watch.ts

@@ -24,9 +24,10 @@
 import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { getDistTagVersion } from "@teamscala/publish-registry";
 import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
 
-const BUN_NPM_LATEST = "https://registry.npmjs.org/bun/latest";
+const NPM_REGISTRY = "https://registry.npmjs.org";
 const TARGET_STABLE = "1.4.0"; // flip back when a stable at or above this ships
 
 interface BunLatestManifest {
@@ -54,23 +55,19 @@ function isStableAtOrAbove(version: string, target: string): boolean {
 
 async function bunStableWatch(_ctx: { config: ScheduledJobConfig }): Promise<void> {
 	const log = getAppLogger();
-	let manifest: BunLatestManifest;
-	try {
-		const res = await fetch(BUN_NPM_LATEST, { headers: { accept: "application/json" } });
-		if (!res.ok) throw new Error(`npm bun/latest HTTP ${res.status}`);
-		manifest = (await res.json()) as BunLatestManifest;
-	} catch (err) {
-		log.warn(`[bun-stable-watch] failed to fetch npm bun/latest: ${err}`);
+	const version = await getDistTagVersion("bun", "latest", NPM_REGISTRY);
+	if (!version) {
+		log.warn("[bun-stable-watch] failed to fetch npm bun/latest");
 		return;
 	}
-	if (isStableAtOrAbove(manifest.version, TARGET_STABLE)) {
+	if (isStableAtOrAbove(version, TARGET_STABLE)) {
 		log.warn(
-			`[bun-stable-watch] Bun stable ${manifest.version} (>=${TARGET_STABLE}) shipped — escape hatch 'bun-14-lock-resolution-pin' is ready to retire. Run the atomic flip-back: config/scala-tools-deps.lockResolutionBun -> "bun" + railpack_config rows -> 1.4.0 stable + delete /usr/local/bin/bun-1.3.14 + a green deploy.`,
+			`[bun-stable-watch] Bun stable ${version} (>=${TARGET_STABLE}) shipped — escape hatch 'bun-14-lock-resolution-pin' is ready to retire. Run the atomic flip-back: config/scala-tools-deps.lockResolutionBun -> "bun" + railpack_config rows -> 1.4.0 stable + delete /usr/local/bin/bun-1.3.14 + a green deploy.`,
 		);
 		recordEvent({
 			kind: "bun.stable.shipped",
 			payload: {
-				latest: manifest.version,
+				latest: version,
 				targetStable: TARGET_STABLE,
 				note: "escape hatch bun-14-lock-resolution-pin ready to retire; verify railpack 1.4.0 support then run the atomic flip-back",
 			},
@@ -78,11 +75,11 @@ async function bunStableWatch(_ctx: { config: ScheduledJobConfig }): Promise<voi
 		return;
 	}
 	log.info(
-		`[bun-stable-watch] npm bun/latest = ${manifest.version} — not yet stable ${TARGET_STABLE}; escape hatch remains`,
+		`[bun-stable-watch] npm bun/latest = ${version} — not yet stable ${TARGET_STABLE}; escape hatch remains`,
 	);
 	recordEvent({
 		kind: "bun.watch.tick",
-		payload: { latest: manifest.version, targetStable: TARGET_STABLE },
+		payload: { latest: version, targetStable: TARGET_STABLE },
 	});
 }
 

package/src/handlers/singleton-tools-currency-watch.ts

@@ -28,6 +28,7 @@ import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { spawn } from "@teamscala/os/spawn";
+import { getDistTagVersion } from "@teamscala/publish-registry";
 import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
 
 /**
@@ -180,7 +181,7 @@ async function fetchLatestGithubRelease(repo: string): Promise<string | null> {
 async function fetchLatestVersion(pkg: string, distTag: string): Promise<string | null> {
 	try {
 		// @teamscala/* packages use the internal dist-tag tool; public npm packages
-		// fetch directly from the npm registry (same pattern as bun-stable-watch).
+		// fetch directly from the npm registry via the typed primitive.
 		if (pkg.startsWith("@teamscala/")) {
 			const result = await spawn({
 				name: "singleton-tools-currency:dist-tag",
@@ -196,12 +197,7 @@ async function fetchLatestVersion(pkg: string, distTag: string): Promise<string
 			if (!latest || !parseSemver(latest)) return null;
 			return latest;
 		}
-		// Public npm package: fetch the dist-tag manifest directly.
-		const url = `https://registry.npmjs.org/${encodeURIComponent(pkg)}/${encodeURIComponent(distTag)}`;
-		const res = await fetch(url, { headers: { accept: "application/json" } });
-		if (!res.ok) return null;
-		const manifest = (await res.json()) as { version: string };
-		return manifest.version ?? null;
+		return getDistTagVersion(pkg, distTag, "https://registry.npmjs.org");
 	} catch {
 		return null;
 	}

package/src/read-html-template.ts

@@ -39,6 +39,7 @@
  * bytes across restarts).
  */
 
+import { createCache } from "@teamscala/cache/create-cache";
 import { readClientBuildStatus } from "./build-client-assets.ts";
 import { join } from "node:path";
 
@@ -70,7 +71,15 @@ const PAGE_DOCUMENT = `<!doctype html>
 	</body>
 </html>`;
 
-let cached: { html: string; manifestMtime: number } | null = null;
+interface CachedHtml {
+	html: string;
+	manifestMtime: number;
+}
+
+const htmlCache = createCache<CachedHtml>("service-boot:html-template", {
+	ttlMs: Number.POSITIVE_INFINITY,
+	maxSize: 1,
+});
 
 function manifestPath(): string {
 	return join(process.cwd(), "dist", "client", "asset-manifest.json");
@@ -98,8 +107,9 @@ async function loadManifest(): Promise<AssetManifest> {
 }
 
 export async function readHtmlTemplate(): Promise<string> {
-	const mtime = await manifestMtimeMs();
-	if (cached && cached.manifestMtime === mtime) return cached.html;
+	const manifestMtime = await manifestMtimeMs();
+	const cached = htmlCache.get("default");
+	if (cached && cached.manifestMtime === manifestMtime) return cached.html;
 	const manifest = await loadManifest();
 	let html = PAGE_DOCUMENT
 		.replace(/\{\{stylesPath\}\}/g, manifest.stylesPath)
@@ -116,6 +126,6 @@ export async function readHtmlTemplate(): Promise<string> {
 			? html.replace("</head>", `${meta}</head>`)
 			: `${meta}${html}`;
 	}
-	cached = { html, manifestMtime: mtime };
+	htmlCache.set("default", { html, manifestMtime });
 	return html;
 }

package/src/register-page-routes.ts

@@ -44,6 +44,8 @@ export async function registerPageRoutes(
 	const authMode = (config as { auth?: string }).auth ?? "none";
 	const providers = ((config as { providers?: string[] }).providers ??
 		[]) as string[];
+	const portalScoped =
+		(config as { portal_scoped?: boolean }).portal_scoped === true;
 
 	const registryPatterns = await registerRegistryPageRoute({
 		app,
@@ -53,6 +55,7 @@ export async function registerPageRoutes(
 		authMode,
 		renderMode,
 		providers,
+		portalScoped,
 	});
 
 	return registryPatterns;

package/src/register-registry-page-route.ts

@@ -79,6 +79,12 @@ interface RegistryRouteArgs {
 	authMode: string;
 	renderMode: RenderModeLiteral;
 	providers: string[];
+	/** Declared service_install fact: this service's page URL space is
+	 * org-scoped portal-shaped (/<websiteId>/<orgId>/<path>). Gates the SSR
+	 * portal home redirect — NOT derivable from catchall presence: a flat-path
+	 * catchall service (scala-agents-ui) serves its real page at "/" and must
+	 * not be redirected to an org-scoped path that has no page there. */
+	portalScoped: boolean;
 }
 
 function extractUrlParams(
@@ -111,6 +117,7 @@ export async function registerRegistryPageRoute(
 		authMode,
 		renderMode,
 		providers: baseProviders,
+		portalScoped,
 	} = args;
 	const log = getAppLogger();
 
@@ -123,16 +130,6 @@ export async function registerRegistryPageRoute(
 	);
 	if (serviceRoutes.length === 0) return [];
 
-	// Only a service serving arbitrary portal paths (a `/*` catchall route —
-	// the portal) redirects signed-in users from `/` into
-	// /<website>/<org>/dashboard. Single-site portal-mode services (the
-	// fleet dashboard) serve their real page AT `/` — the unconditional
-	// redirect 404-looped them (2026-06-06; service-runtime@1.15.82 made
-	// the redirect opt-in via this flag).
-	const servesPortalCatchall = serviceRoutes.some(
-		(r) => r.config.pattern === "/*",
-	);
-
 	// Sort routes so more specific patterns register before wildcard/param routes.
 	// Hono matches by registration order, so `/*` (the portal catchall) registered
 	// before `/sign-in` would swallow the sign-in page and render it inside the
@@ -834,7 +831,11 @@ export async function registerRegistryPageRoute(
 			providers: routeProviders,
 			renderMode: routeRenderMode,
 			loadData: loadData as never,
-			portalHomeRedirect: servesPortalCatchall,
+			// The portal home redirect follows the DECLARED portal_scoped service
+		// fact (see RegistryRouteArgs.portalScoped) — a signed-in user at "/" of
+		// an org-scoped portal belongs at /<websiteId>/<orgId>/dashboard; a
+		// flat-path service (the fleet dashboard) serves its real page at "/".
+			portalHomeRedirect: portalScoped,
 			serviceSlug,
 		});
 

package/src/scala-tools-currency-watchdog.ts

@@ -5,6 +5,8 @@
  *
  * Polls the installed scala-tools package against GitHub Packages and repairs
  * stale daemon tooling by reinstalling and letting PM2 restart the process.
+ * The fetch routes through `getGithubPackagesLatestVersion` so the URL
+ * encoding and GitHub-Packages auth header live in the typed primitive.
  */
 
 import { recordEvent } from "@teamscala/event-log/record-event";
@@ -14,6 +16,7 @@ import { createWatchdog } from "@teamscala/watchdog/create-watchdog";
 import type { WatchdogHandle } from "@teamscala/watchdog/types";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
+import { getGithubPackagesLatestVersion } from "@teamscala/publish-registry";
 import * as v from "valibot";
 
 const PACKAGE_NAME = "@teamscala/scala-tools";
@@ -55,10 +58,6 @@ interface PackageManifest {
 	version?: unknown;
 }
 
-interface PackagePackument {
-	"dist-tags"?: { latest?: unknown };
-}
-
 let watchdog: WatchdogHandle | null = null;
 
 async function readInstalledVersion(cwd: string): Promise<string | null> {
@@ -70,24 +69,25 @@ async function readInstalledVersion(cwd: string): Promise<string | null> {
 	}
 }
 
-async function readLatestVersion(fetchTimeoutMs: number): Promise<string | null> {
+/**
+ * PACKAGE_URL is `<registry>/<encoded-name>`. Split it so the typed primitive
+ * owns the URL encoding (encodeURIComponent) and the GitHub-Packages auth
+ * header shape — neither is this file's concern.
+ */
+function registryFromPackageUrl(pkgUrl: string): { registry: string; name: string } {
+	const lastSlash = pkgUrl.lastIndexOf("/");
+	if (lastSlash < 0) return { registry: pkgUrl, name: "" };
+	return {
+		registry: pkgUrl.slice(0, lastSlash),
+		name: decodeURIComponent(pkgUrl.slice(lastSlash + 1)),
+	};
+}
+
+async function readLatestVersion(_fetchTimeoutMs: number): Promise<string | null> {
 	const token = await getGithubPackagesToken();
 	if (!token) return null;
-	try {
-		const response = await fetch(PACKAGE_URL, {
-			headers: {
-				accept: "application/vnd.github+json",
-				authorization: `Bearer ${token}`,
-			},
-			signal: AbortSignal.timeout(fetchTimeoutMs),
-		});
-		if (!response.ok) return null;
-		const packument = (await response.json()) as PackagePackument;
-		const latest = packument["dist-tags"]?.latest;
-		return typeof latest === "string" ? latest : null;
-	} catch {
-		return null;
-	}
+	const { registry, name } = registryFromPackageUrl(PACKAGE_URL);
+	return getGithubPackagesLatestVersion(name, token, registry);
 }
 
 async function checkCurrency(): Promise<{ healthy: boolean; details?: Record<string, unknown> }> {