@teamscala/service-boot 0.23.445 → 0.23.448

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.445",
+  "version": "0.23.448",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -32,6 +32,7 @@
     "@teamscala/file-lock": "*",
     "@teamscala/formatters": "*",
     "@teamscala/generic-registry": "*",
+    "@teamscala/hono-boundary": "*",
     "@teamscala/host-command-bus": "*",
     "@teamscala/http": "*",
     "@teamscala/logger": "*",
@@ -458,14 +459,6 @@
       "types": "./src/fn-routers/auth-router.d.ts",
       "default": "./src/fn-routers/auth-router.ts"
     },
-    "./fn-routers/cache-admin-router": {
-      "types": "./src/fn-routers/cache-admin-router.d.ts",
-      "default": "./src/fn-routers/cache-admin-router.ts"
-    },
-    "./fn-routers/cache-admin-router.ts": {
-      "types": "./src/fn-routers/cache-admin-router.d.ts",
-      "default": "./src/fn-routers/cache-admin-router.ts"
-    },
     "./fn-routers/chat-session-router": {
       "types": "./src/fn-routers/chat-session-router.d.ts",
       "default": "./src/fn-routers/chat-session-router.ts"
@@ -526,6 +519,14 @@
       "types": "./src/fn-routers/messaging-whatsapp-router.d.ts",
       "default": "./src/fn-routers/messaging-whatsapp-router.ts"
     },
+    "./fn-routers/panel-data-router": {
+      "types": "./src/fn-routers/panel-data-router.d.ts",
+      "default": "./src/fn-routers/panel-data-router.ts"
+    },
+    "./fn-routers/panel-data-router.ts": {
+      "types": "./src/fn-routers/panel-data-router.d.ts",
+      "default": "./src/fn-routers/panel-data-router.ts"
+    },
     "./fn-routers/persist-chat-messages": {
       "types": "./src/fn-routers/persist-chat-messages.d.ts",
       "default": "./src/fn-routers/persist-chat-messages.ts"
@@ -790,6 +791,14 @@
       "types": "./src/install-logging.d.ts",
       "default": "./src/install-logging.ts"
     },
+    "./is-react-element-type": {
+      "types": "./src/is-react-element-type.d.ts",
+      "default": "./src/is-react-element-type.ts"
+    },
+    "./is-react-element-type.ts": {
+      "types": "./src/is-react-element-type.d.ts",
+      "default": "./src/is-react-element-type.ts"
+    },
     "./load-service-install-row": {
       "types": "./src/load-service-install-row.d.ts",
       "default": "./src/load-service-install-row.ts"

package/src/fn-routers/auth-router.ts

@@ -3,15 +3,18 @@
  * @status handwritten
  * @edit edit directly
  *
- * ORPC procedures for auth checks (isOrgAdmin, resolveAdminOverride).
- * Extracted from @teamscala/orpc/fn-router — primitives tier must not
- * contain application-specific auth logic.
+ * ORPC `authed` middleware shared by the fn-routers NOT YET row-composed:
+ * session resolve → UNAUTHORIZED → setRlsContext → orgId injection. The same
+ * logic the generated fn.ts renders per service (orpc-bundle emits fn.ts
+ * from api_route rows; consult that file when adding a procedure). This
+ * handwritten copy will vanish with the last remaining family.
+ *
+ * isOrgAdmin + resolveAdminOverride moved to @teamscala/db/org-admin and are
+ * ROW-composed as fn.auth.* procedures now.
  */
 
 import { os } from "@orpc/server";
-import { createCache } from "@teamscala/cache/create-cache";
 import type { PrismaClient } from "@teamscala/db/client";
-import { queryRows } from "@teamscala/db/query-rows";
 import { resetRlsContext, setRlsContext } from "@teamscala/db/rls-context";
 
 interface User {
@@ -58,73 +61,5 @@ const authed = os.$context<Context>().use(async (opt) => {
 	}
 });
 
-const adminCache = createCache<boolean>("service-boot:org-admin", {
-	ttlMs: 5 * 60 * 1000,
-	maxSize: 2000,
-});
-
-async function isOrgAdminCached(
-	userId: string,
-	organisationId: string,
-): Promise<boolean> {
-	const cacheKey = `${userId}:${organisationId}`;
-	const cached = adminCache.get(cacheKey);
-	if (cached !== undefined) return cached;
-
-	try {
-		// Raw SQL, not the model API: user_organisation_memberships lives in host
-		// schemas (not the shared client), so a typed model access would only
-		// compile on the hosts that declare it. queryRows is the sanctioned read
-		// surface and is host-portable by table name.
-		const membership = await queryRows<{ id: string }>`
-			SELECT id FROM user_organisation_memberships
-			WHERE user_id = ${userId}
-			  AND organisation_id = ${organisationId}
-			  AND role IN ('admin', 'owner')
-			LIMIT 1`;
-		const result = membership.length > 0;
-		adminCache.set(cacheKey, result);
-		return result;
-	} catch {
-		return false;
-	}
-}
-
-export const authRouter = {
-	isOrgAdmin: authed.handler(async ({ input, context }) => {
-		const data = input as { userId: string; organisationId: string };
-		if (!data.userId || !data.organisationId) return false;
-		return isOrgAdminCached(data.userId, data.organisationId);
-	}),
-	resolveAdminOverride: authed.handler(async ({ input, context }) => {
-		const data = input as {
-			targetUserId?: string;
-			adminOverride?: boolean;
-		};
-		const targetUserId = data.targetUserId as string | undefined;
-		if (!targetUserId) return null;
-		if (targetUserId === context.user?.id) return null;
-		if (!data.adminOverride) {
-			throw new Error(
-				`This tool does not support admin override. Remove targetUserId from the request.`,
-			);
-		}
-		const userId = context.user?.id;
-		const organisationId = context.orgId;
-		if (!userId || !organisationId) {
-			throw new Error(
-				`Admin override requires both user and organisation context.`,
-			);
-		}
-		const admin = await isOrgAdminCached(userId, organisationId);
-		if (!admin) {
-			throw new Error(
-				`Access denied: you must be an org admin or owner to view another user's data.`,
-			);
-		}
-		return targetUserId;
-	}),
-};
-
 export type { Context, User };
 export { authed };

package/src/fn-routers/index.ts

@@ -34,10 +34,8 @@ import { resolvePanelDataHandler } from "./panel-data-router.ts";
 import { watchDataChange } from "@teamscala/realtime-utils/data-change-procedure";
 import { watchPresence } from "@teamscala/realtime-utils/presence-procedure";
 import { agreementSendRouter } from "./agreement-send-router.ts";
-import { cacheAdminRouter } from "./cache-admin-router.ts";
 import { chatSessionRouter } from "./chat-session-router.ts";
 import { proposalSendRouter } from "./proposal-send-router.ts";
-import { authRouter } from "./auth-router.ts";
 import { publicAgreementRouter } from "./public-agreement-router.ts";
 import { publicAssessmentRouter } from "./public-assessment-router.ts";
 import { publicGptSessionRouter } from "./public-gpt-session-router.ts";
@@ -46,12 +44,15 @@ import { userPreferencesRouter } from "./user-preferences-router.ts";
 import { workItemsRouter } from "./work-items-router.ts";
 import { messagingWhatsappRouter } from "./messaging-whatsapp-router.ts";
 
+// fn.cacheAdmin.* and fn.auth.* are ROW-COMPOSED now: api_route rows
+// (handler_type "orpc_fn") are rendered into the service's generated ORPC
+// bundle (routers/fn.ts) by orpc-bundle@1.0.0 and merged into the app router
+// by getAppRouter. Register them by editing ROWS, never by re-adding
+// handwritten routers here. Convert the remaining families the same way.
 export function registerFnRouters(): void {
 	registerCustomRouter("fn", {
 		agreementSend: agreementSendRouter,
 		proposalSend: proposalSendRouter,
-		auth: authRouter,
-		cacheAdmin: cacheAdminRouter,
 		chatSession: chatSessionRouter,
 		messagingWhatsappSend: messagingWhatsappRouter.messagingWhatsappSend,
 		publicAgreement: publicAgreementRouter,

package/src/read-html-template.ts

@@ -53,6 +53,7 @@
 
 import { createCache } from "@teamscala/cache/create-cache";
 import { readClientBuildStatus } from "./build-client-assets/manifest.ts";
+import { themeFontsLink } from "./theme-fonts-link.ts";
 import { join } from "node:path";
 
 interface AssetManifest {
@@ -67,7 +68,7 @@ const PAGE_DOCUMENT = `<!doctype html>
 		<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content" />
 		<link rel="preconnect" href="https://fonts.googleapis.com" />
 		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-		<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=optional" />
+		<!--theme-fonts-->
 		<link rel="stylesheet" href="{{stylesPath}}" />
 		<!--head-outlet-->
 	</head>
@@ -140,7 +141,11 @@ export async function readHtmlTemplate(): Promise<string> {
 	}
 	let html = PAGE_DOCUMENT
 		.replace(/\{\{stylesPath\}\}/g, manifest.stylesPath)
-		.replace(/\{\{hydratePath\}\}/g, manifest.hydratePath);
+		.replace(/\{\{hydratePath\}\}/g, manifest.hydratePath)
+		// The head's font families derive from the css_theme row (one source);
+		// captured at cache build — boot-time semantics, a row edit reaches the
+		// envelope on the next service restart.
+		.replace("<!--theme-fonts-->", () => themeFontsLink());
 	// Tombstone stamp — surfaces a failed client build at the served layer.
 	// `<meta>` in <head> is the minimum-invasive vehicle (no layout shift, no
 	// JS dependency, visible via view-source / devtools / a future status

package/src/register-registry-page-route/public-shell-page-data.test.ts

@@ -0,0 +1,104 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Regression cover for two defects the operator reported on the launcha quiz,
+ * both of which lived in publicShellPageData and were invisible to every other
+ * check because the page rendered 200 with a clean log either way.
+ *
+ * 1. screenMode was never threaded, so a page declaring "full-screen" fell back
+ *    to build-page-tree's card-wrapper default and the site header rendered
+ *    INSIDE the card instead of across the top of the page.
+ * 2. the page title used the LEGAL entity name (companyName) rather than the
+ *    trading name (companyFriendlyName), putting "GMG APAC" on every launcha
+ *    page.
+ *
+ * Both assert the OUTCOME (the emitted flag, the composed title text), not the
+ * presence of a key — a shape assertion would have passed throughout the bug.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { publicShellPageData } from "./public-shell-page-data.ts";
+
+/** Minimal resolved graph: one body page, one brand, one website. */
+function resolvedWith(options: {
+	screenMode?: string;
+	companyName?: string;
+	companyFriendlyName?: string;
+}): Record<string, unknown> {
+	const rootProps: Record<string, unknown> = {};
+	if (options.screenMode) rootProps.screenMode = options.screenMode;
+	return {
+		page: {
+			id: "page-1",
+			name: "The Launcha Authority Index",
+			puck_data: { root: { props: rootProps }, content: [] },
+		},
+		website: { slug: "launcha-website", name: "launcha Website" },
+		brand: {
+			primaryColor: "#FF4500",
+			companyName: options.companyName ?? "GMG APAC",
+			companyFriendlyName: options.companyFriendlyName,
+		},
+	};
+}
+
+describe("publicShellPageData threads screenMode", () => {
+	test("a page declaring full-screen emits fullScreen true", () => {
+		const data = publicShellPageData(
+			resolvedWith({ screenMode: "full-screen" }),
+			{},
+			undefined,
+			undefined,
+		);
+		// The renderer branches on this exact flag. Absent, build-page-tree
+		// wraps the body in a centred card and the header goes inside it.
+		expect(data.fullScreen).toBe(true);
+	});
+
+	test("a page declaring a non-full-screen mode emits fullScreen false", () => {
+		const data = publicShellPageData(
+			resolvedWith({ screenMode: "contained" }),
+			{},
+			undefined,
+			undefined,
+		);
+		expect(data.fullScreen).toBe(false);
+	});
+
+	test("a page declaring nothing omits the flag so the render-mode default still applies", () => {
+		const data = publicShellPageData(resolvedWith({}), {}, undefined, undefined);
+		// Deliberately absent rather than false: an explicit false would override
+		// the public/gpts default and regress every page that never set the prop.
+		expect("fullScreen" in data).toBe(false);
+	});
+});
+
+describe("publicShellPageData titles pages with the trading name", () => {
+	test("the friendly name wins over the legal entity name", () => {
+		const data = publicShellPageData(
+			resolvedWith({
+				companyName: "GMG APAC",
+				companyFriendlyName: "launcha",
+			}),
+			{},
+			undefined,
+			true,
+		);
+		const title = (data.meta as { title?: string }).title ?? "";
+		expect(title).toContain("launcha");
+		expect(title).not.toContain("GMG APAC");
+	});
+
+	test("the legal name is still used when no friendly name is set", () => {
+		const data = publicShellPageData(
+			resolvedWith({ companyName: "GMG APAC" }),
+			{},
+			undefined,
+			true,
+		);
+		const title = (data.meta as { title?: string }).title ?? "";
+		expect(title).toContain("GMG APAC");
+	});
+});

package/src/register-registry-page-route/public-shell-page-data.ts

@@ -95,6 +95,14 @@ export function publicShellPageData(
 	const overrideHeading = pickRootProp<string>(regions, "headingFont");
 	const overrideBody = pickRootProp<string>(regions, "bodyFont");
 
+	// The page's own screenMode, threaded the same way Branch 1 threads it
+	// (single-page-data.ts). Dropping it here is not neutral: build-page-tree
+	// falls back to `fullScreen: renderMode === "public" || "gpts"`, and for a
+	// shell page that resolves false — which wraps the body in a centred card
+	// and puts the site header INSIDE that card instead of across the top of
+	// the page. A page that declares "full-screen" was rendering as a form.
+	const screenMode = pickRootProp<string>(regions, "screenMode");
+
 	const pageName = (page.name as string) || null;
 	const entityTitle = resolveEntityTitle(resolved);
 	const bodyMetaTitle = regions.find((r) => r.slot === "body")?.metaTitle;
@@ -151,13 +159,22 @@ export function publicShellPageData(
 			favicon: (brand.favicon as string) ?? null,
 		},
 		theme,
+		...(screenMode ? { fullScreen: screenMode === "full-screen" } : {}),
 		meta: {
 		title: composePageTitle(
 			{
 					pageMetaTitle: bodyMetaTitle,
 					templateTitle: (meta.title as string) || undefined,
 					websiteName: (website.name as string) || undefined,
-					organisationName: (brand.companyName as string) || undefined,
+					// The FRIENDLY name is what the public sees — the trading brand,
+					// not the legal entity. Reading companyName here put "GMG APAC"
+					// in the title of every launcha page, which the operator has
+					// corrected repeatedly; the friendly name is "launcha". Falls
+					// back to companyName only where no friendly name is set.
+					organisationName:
+						(brand.companyFriendlyName as string) ||
+						(brand.companyName as string) ||
+						undefined,
 					pageName: pageName ?? pageRootTitle,
 					entityTitle: entityTitle || undefined,
 				},

package/src/register-ws-routes.ts

@@ -33,12 +33,13 @@ import type {
 	MountRegistry,
 	WsRouteHandler,
 } from "@teamscala/os/runtime-contracts/mount-context";
+import type {
+	UpgradeWebSocket,
+	WSEvents,
+} from "@teamscala/hono-boundary/websocket-upgrade";
 import type { Context, Hono } from "hono";
-import type { createBunWebSocket } from "hono/bun";
 import * as v from "valibot";
 
-export type UpgradeWebSocket = ReturnType<typeof createBunWebSocket>["upgradeWebSocket"];
-
 const ORPC_WS_PATH = "/api/rpc/ws";
 
 export async function registerWsRoutes(
@@ -63,12 +64,12 @@ export async function registerWsRoutes(
 		// republish of @teamscala/orpc. Missing/empty row falls back to the
 		// primitive's default interval.
 		const wsCfg = await loadOrpcWsConfig(log, serviceSlug);
-		// Casts: mountOrpcWs's hand-rolled UpgradeWebSocket/Router types can't
-		// exactly mirror the injected hono upgradeWebSocket + getAppRouter's
-		// AppRouter at this configured-primitive boundary (mirroring would need
-		// importing hono/bun, unpairing createBunWebSocket). orpc type cleanup is
-		// a follow-up; the runtime shapes are correct.
-		mountOrpcWs(app, router as never, upgradeWebSocket as never, {
+		// Router cast: getAppRouter's AppRouter is not statically the
+		// `Router<any, TContext>` mountOrpcWs is generic over at this
+		// configured-primitive boundary; the runtime shape is correct. The
+		// upgrade function needs no cast — both sides read UpgradeWebSocket
+		// from the generated boundary package.
+		mountOrpcWs(app, router as never, upgradeWebSocket, {
 			path: ORPC_WS_PATH,
 			pingIntervalMs: wsCfg.pingIntervalMs,
 		});
@@ -120,12 +121,12 @@ function adaptLegacyWsHandler(
 	pattern: string,
 	upgradeWebSocket: UpgradeWebSocket,
 ) {
-	return upgradeWebSocket((c: Context) => {
+	return upgradeWebSocket((c: Context): WSEvents => {
 		const params = c.req.param() as Record<string, string>;
 		const upgradeReq = c.req.raw;
 		let extraData: Record<string, unknown> = {};
 		return {
-			async onOpen(_evt: Event, wsc: { raw?: unknown }) {
+			async onOpen(_evt, wsc) {
 				const ws = wsc.raw as never as { data: Record<string, unknown> };
 				if (legacy.upgradeData) {
 					extraData = await legacy.upgradeData(upgradeReq, params);
@@ -133,10 +134,7 @@ function adaptLegacyWsHandler(
 				ws.data = { ...ws.data, route: pattern, params, ...extraData };
 				await legacy.open?.(ws as never);
 			},
-			async onMessage(
-				evt: MessageEvent<string | ArrayBuffer>,
-				wsc: { raw?: unknown },
-			) {
+			async onMessage(evt, wsc) {
 				const ws = wsc.raw as never;
 				const msg =
 					typeof evt.data === "string"
@@ -144,15 +142,11 @@ function adaptLegacyWsHandler(
 						: Buffer.from(evt.data as ArrayBuffer);
 				await legacy.message?.(ws, msg);
 			},
-			async onClose(evt: CloseEvent, wsc: { raw?: unknown }) {
+			async onClose(evt, wsc) {
 				const ws = wsc.raw as never;
 				await legacy.close?.(ws, evt.code, evt.reason);
 			},
-		} as Parameters<typeof upgradeWebSocket>[0] extends (
-			c: infer _Context,
-		) => infer R
-			? R
-			: never;
+		};
 	});
 }
 

package/src/theme-fonts-link.test.ts

@@ -0,0 +1,98 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The served <head> carries every font family the css_theme row declares —
+ * derived from the row (one source), never a hard-coded family list. The old
+ * envelope loaded only Inter, so the proposal heading variant's manuscript
+ * serif never loaded and fell back to Times (2026-09-02).
+ */
+
+import { describe, expect, mock, test } from "bun:test";
+
+type ConfigRow = { fonts?: Record<string, string> } | undefined;
+let injectedConfig: ConfigRow;
+
+mock.module("@teamscala/db/registry/accessors", () => ({
+	getEntryConfig: (_type: string, _slug: string) => injectedConfig,
+}));
+
+const { readHtmlTemplate } = await import("./read-html-template.ts");
+const { primaryFontFamily, themeFontFamilies, themeFontsLink } = await import(
+	"./theme-fonts-link.ts"
+);
+
+const { mkdir, mkdtemp, rm } = await import("node:fs/promises");
+const { tmpdir } = await import("node:os");
+const { join } = await import("node:path");
+const { beforeEach, afterEach } = await import("bun:test");
+
+let dir: string;
+let origCwd: string;
+
+beforeEach(async () => {
+	origCwd = process.cwd();
+	dir = await mkdtemp(join(tmpdir(), "theme-fonts-link-"));
+	await mkdir(join(dir, "dist", "client"), { recursive: true });
+	process.chdir(dir);
+});
+
+afterEach(async () => {
+	process.chdir(origCwd);
+	await rm(dir, { recursive: true, force: true });
+});
+
+async function writeManifest(): Promise<void> {
+	await Bun.file(
+		join(dir, "dist", "client", "asset-manifest.json"),
+	).write(
+		`${JSON.stringify({ stylesPath: "/assets/styles.css", hydratePath: "/assets/hydrate.js" }, null, 2)}\n`,
+	);
+}
+
+async function servedHead(): Promise<string> {
+	await writeManifest();
+	const html = await readHtmlTemplate();
+	return html.slice(0, html.indexOf("</head>"));
+}
+
+describe("theme-fonts-link", () => {
+	test("primaryFontFamily takes the first family of a stack", () => {
+		expect(primaryFontFamily("Inter, sans-serif")).toBe("Inter");
+		expect(primaryFontFamily("'Playfair Display'")).toBe("Playfair Display");
+	});
+
+	test("families derive from the css_theme row, deduplicated", () => {
+		injectedConfig = {
+			fonts: {
+				body: "Inter, sans-serif",
+				heading: "Inter, sans-serif",
+				manuscript: "Playfair Display",
+			},
+		};
+		expect(themeFontFamilies()).toEqual(["Inter", "Playfair Display"]);
+	});
+
+	test("the served head carries every family the row declares", async () => {
+		injectedConfig = {
+			fonts: {
+				body: "Inter, sans-serif",
+				heading: "Inter, sans-serif",
+				manuscript: "Playfair Display",
+			},
+		};
+		const head = await servedHead();
+		expect(head).toContain("family=Inter");
+		expect(head).toContain(encodeURIComponent("Playfair Display"));
+		expect(head).not.toContain("<!--theme-fonts-->");
+	});
+
+	test("an absent row degrades to no fonts link — never throws", async () => {
+		injectedConfig = undefined;
+		expect(themeFontsLink()).toBe("");
+		const head = await servedHead();
+		expect(head).not.toContain("fonts.googleapis.com/css2");
+		expect(head).toContain("<!--head-outlet-->");
+	});
+});

package/src/theme-fonts-link.ts

@@ -0,0 +1,64 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Derives the document head's Google Fonts link from the `css_theme` row's
+ * `fonts` map — the ONE source for the families a page's variants reference
+ * (`the-theme-decides-colour-not-the-component` extends to type). The old
+ * envelope hard-coded Inter, so a proposal heading naming a manuscript serif
+ * ("Playfair Display") never had its family loaded and fell back to Times
+ * (2026-09-02). Now every family the row declares is loaded; a family a
+ * variant names that the row does not declare is a row defect, caught at the
+ * row's schema boundary.
+ *
+ * Read from the boot registry cache (captured at service boot, the same
+ * semantics as the resource_loader capture) and guarded: a missing or
+ * unreadable row degrades to NO fonts link — system fonts render, the page
+ * still works. This module must never throw into the document builder.
+ */
+
+import { getEntryConfig } from "@teamscala/db/registry/accessors";
+
+interface ThemeFontsConfig {
+	fonts?: Record<string, string>;
+}
+
+/** The primary family name of a CSS font stack: "Inter, sans-serif" →
+ * "Inter"; "Playfair Display" → "Playfair Display". */
+export function primaryFontFamily(stack: string): string {
+	const first = stack.split(",")[0] ?? "";
+	return first.trim().replace(/^['"]|['"]$/g, "");
+}
+
+/** The declared theme families, deduplicated by primary family, in row
+ * order (body, heading, manuscript, mono…). Empty when the row is absent. */
+export function themeFontFamilies(): string[] {
+	try {
+		const config = getEntryConfig<ThemeFontsConfig>("css_theme", "default");
+		const fonts = config?.fonts ?? {};
+		const seen = new Set<string>();
+		const families: string[] = [];
+		for (const value of Object.values(fonts)) {
+			if (typeof value !== "string" || value.trim() === "") continue;
+			const primary = primaryFontFamily(value);
+			if (primary === "" || seen.has(primary)) continue;
+			seen.add(primary);
+			families.push(primary);
+		}
+		return families;
+	} catch {
+		return [];
+	}
+}
+
+/** The <link> tag loading every declared theme family, or "" when none. */
+export function themeFontsLink(): string {
+	const families = themeFontFamilies();
+	if (families.length === 0) return "";
+	const WEIGHTS = "400;500;600;700";
+	const params = families
+		.map((family) => `family=${encodeURIComponent(family)}:wght@${WEIGHTS}`)
+		.join("&");
+	return `<link rel="stylesheet" href="https://fonts.googleapis.com/css2?${params}&display=optional" />`;
+}

package/src/two-phase-minimal-app.ts

@@ -100,7 +100,7 @@ export async function buildMinimalApp(
 	config: ServiceInstallConfig,
 	serviceSlug: string,
 	databaseUrl: string,
-	upgradeWebSocket: import("./register-ws-routes.ts").UpgradeWebSocket,
+	upgradeWebSocket: import("@teamscala/hono-boundary/websocket-upgrade").UpgradeWebSocket,
 	getSharedDb?: () => unknown,
 ): Promise<MinimalAppResult> {
 	const log = getAppLogger();

package/src/ui-service.ts

@@ -58,7 +58,7 @@ import { setReady } from "./readiness-gate.ts";
 import { resolveServicePort } from "./resolve-service-port.ts";
 import { buildMinimalApp } from "./two-phase-minimal-app.ts";
 import { buildFullApp, swapToFullApp } from "./two-phase-full-app.ts";
-import type { UpgradeWebSocket } from "./register-ws-routes.ts";
+import type { UpgradeWebSocket } from "@teamscala/hono-boundary/websocket-upgrade";
 
 export interface ResolvedBlock {
 	slug: string;

package/src/fn-routers/cache-admin-router.ts

@@ -1,50 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * `fn.cacheAdmin` — ORPC procedures for in-process cache enable/disable/flush.
- * Replaces the former `/api/data/cache-monitor/*` HANDLER_MAP entries
- * (orpc-is-the-only-api: every API surface is a typed ORPC procedure, never a
- * hand-written Hono route). Calls through @teamscala/cache/registry — the
- * platform-singleton cache surface (cache-is-the-only-cache).
- */
-
-import { os } from "@orpc/server";
-import * as v from "valibot";
-import { authed } from "./auth-router.ts";
-
-const nameSchema = v.object({
-	name: v.pipe(v.string(), v.minLength(1)),
-});
-
-export const cacheAdminRouter = {
-	enable: authed
-		.input(nameSchema)
-		.handler(async ({ input }) => {
-			const { cacheRegistry } = await import("@teamscala/cache/registry");
-			cacheRegistry.enable(input.name);
-			return { ok: true, name: input.name };
-		}),
-
-	disable: authed
-		.input(nameSchema)
-		.handler(async ({ input }) => {
-			const { cacheRegistry } = await import("@teamscala/cache/registry");
-			cacheRegistry.disable(input.name);
-			return { ok: true, name: input.name };
-		}),
-
-	flush: authed
-		.input(v.object({ name: v.optional(v.string()) }))
-		.handler(async ({ input }) => {
-			const { cacheRegistry } = await import("@teamscala/cache/registry");
-			if (input.name) {
-				cacheRegistry.flush(input.name);
-				return { flushed: 1 };
-			}
-			const count = cacheRegistry.getAll().length;
-			cacheRegistry.flush();
-			return { flushed: count };
-		}),
-};