@teamscala/service-boot 0.23.455 → 0.23.456

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.455",
+  "version": "0.23.456",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/build-client-assets/styles-build.test.ts

@@ -0,0 +1,157 @@
+/**
+ * @system server-handlers
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavioural pins for the stylesheet resolver (operator ruling 2026-09-03:
+ * the fallback chain IS the drift — a bare id resolved via Bun.resolve
+ * returned whatever the package's main was (a .js for a normal package),
+ * the resolve(base, id) tail invented nonexistent paths whose ENOENT
+ * surfaced as misleading downstream CSS errors, and inlineCssImports
+ * SWALLOWED unresolved imports, leaving literals that failed downstream
+ * instead of at the build. Every case below pins the ruled contract:
+ * resolve or THROW naming the specifier; remote https imports are skipped
+ * explicitly, never resolved and never thrown on.
+ */
+import { describe, expect, test } from "bun:test";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { bunResolveStylesheet } from "./styles-build.ts";
+
+async function makeTree(tag: string, files: Record<string, string>) {
+	const root = join(tmpdir(), `styles-build-${tag}-${process.pid}`);
+	await rm(root, { recursive: true, force: true });
+	for (const [rel, content] of Object.entries(files)) {
+		const p = join(root, rel);
+		await mkdir(p.slice(0, p.lastIndexOf("/")), { recursive: true });
+		await writeFile(p, content);
+	}
+	return root;
+}
+
+describe("bunResolveStylesheet — relative ids", () => {
+	test("a relative import that exists resolves and inlines its nested @imports", async () => {
+		const root = await makeTree("rel-ok", {
+			"src/entry.css": '@import "./leaf.css";\n.body { color: red; }\n',
+			"src/leaf.css": ".leaf { color: blue; }\n",
+		});
+		const r = await bunResolveStylesheet("./entry.css", join(root, "src"), root);
+		expect(r.content).toContain(".body");
+		expect(r.content).toContain(".leaf");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a relative import that does NOT exist throws naming the specifier and the path", async () => {
+		const root = await makeTree("rel-missing", {
+			"src/entry.css": ".body { color: red; }\n",
+		});
+		const err = await bunResolveStylesheet(
+			"./nope.css",
+			join(root, "src"),
+			root,
+		).catch((e) => e);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"./nope.css"');
+		expect((err as Error).message).toContain("not found");
+		await rm(root, { recursive: true, force: true });
+	});
+});
+
+describe("bunResolveStylesheet — bare ids", () => {
+	test("a CSS-only package resolves via its declared style entry", async () => {
+		const root = await makeTree("bare-style", {
+			"node_modules/tw-animate-css/package.json": JSON.stringify({
+				name: "tw-animate-css",
+				exports: { ".": { style: "./dist/tw-animate.css" } },
+			}),
+			"node_modules/tw-animate-css/dist/tw-animate.css":
+				".tw-animate { animation: none; }\n",
+			"src/app.css": '.x { color: red; }\n',
+		});
+		const r = await bunResolveStylesheet(
+			"tw-animate-css",
+			join(root, "src"),
+			root,
+		);
+		expect(r.content).toContain(".tw-animate");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a normal JS package (no style entry) THROWS naming the specifier — never its .js main", async () => {
+		const root = await makeTree("bare-js-main", {
+			"node_modules/lodash/package.json": JSON.stringify({
+				name: "lodash",
+				main: "lodash.js",
+			}),
+			"node_modules/lodash/lodash.js": "module.exports = {};\n",
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const err = await bunResolveStylesheet(
+			"lodash",
+			join(root, "src"),
+			root,
+		).catch((e) => e);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"lodash"');
+		expect((err as Error).message).toContain("no style entry");
+		expect((err as Error).message).not.toContain("lodash.js");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a bare id with no package anywhere THROWS naming the specifier and both roots", async () => {
+		const root = await makeTree("bare-missing", {
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const src = join(root, "src");
+		const err = await bunResolveStylesheet("no-such-pkg", src, root).catch(
+			(e) => e,
+		);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"no-such-pkg"');
+		expect((err as Error).message).toContain("unresolved");
+		expect((err as Error).message).toContain(src);
+		await rm(root, { recursive: true, force: true });
+	});
+});
+
+describe("bunResolveStylesheet — remote @imports", () => {
+	test("a remote https @import is kept verbatim (stripped later by stripRemoteImports), never resolved", async () => {
+		const root = await makeTree("remote-skip", {
+			"node_modules/cdn-fonts/package.json": JSON.stringify({
+				name: "cdn-fonts",
+				exports: { ".": { style: "./index.css" } },
+			}),
+			"node_modules/cdn-fonts/index.css":
+				'@import "https://rsms.me/inter/inter.css";\n.cdn { font-family: inter; }\n',
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const r = await bunResolveStylesheet(
+			"cdn-fonts",
+			join(root, "src"),
+			root,
+		);
+		expect(r.content).toContain("https://rsms.me/inter/inter.css");
+		expect(r.content).toContain(".cdn");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a LOCAL @import of a missing file THROWS at the build instead of leaving a literal", async () => {
+		const root = await makeTree("local-missing-nested", {
+			"node_modules/broken-pkg/package.json": JSON.stringify({
+				name: "broken-pkg",
+				exports: { ".": { style: "./index.css" } },
+			}),
+			"node_modules/broken-pkg/index.css": '@import "./gone.css";\n.real { color: red; }\n',
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const err = await bunResolveStylesheet(
+			"broken-pkg",
+			join(root, "src"),
+			root,
+		).catch((e) => e);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"./gone.css"');
+		await rm(root, { recursive: true, force: true });
+	});
+});

package/src/build-client-assets/styles-build.ts

@@ -31,31 +31,52 @@ async function resolveStylesheetRaw(
 		const r = await Bun.resolve("tailwindcss/index.css", cwd);
 		return { path: r, base: dirname(r), content: await Bun.file(r).text() };
 	}
-	try {
-		const r = await Bun.resolve(id, base);
-		return { path: r, base: dirname(r), content: await Bun.file(r).text() };
-	} catch (error) {
-		getAppLogger().warn("style import resolve failed — trying package fallback", error);
+	if (id.startsWith(".")) {
+		// Relative import: resolve against the importing file's directory and
+		// REQUIRE existence — a missing leaf is a build-breaking error naming
+		// the specifier, never a silently-dropped subtree.
+		const p = resolve(base, id);
+		if (!(await Bun.file(p).exists())) {
+			throw new Error(
+				`style import "${id}" not found at ${p} (resolved relative to ${base})`,
+			);
+		}
+		return { path: p, base: dirname(p), content: await Bun.file(p).text() };
 	}
-	if (!id.startsWith(".")) {
-		try {
-			const pkgPath = await Bun.resolve(id + "/package.json", cwd);
-			const pkg = JSON.parse(await Bun.file(pkgPath).text());
-			const entry =
-				pkg.exports?.["."]?.style || pkg.style || pkg.main;
-			if (entry) {
+	// Bare specifier: find node_modules/<id>/package.json by walking upward
+	// from the importing file's dir then cwd, and read the DECLARED STYLE
+	// entry (exports["."].style / style). Bun.resolve is not used here: it
+	// hands back whatever the package's main is — for a normal JS package
+	// that is a .js entry, not the declared stylesheet. A package with no
+	// style entry is not a stylesheet import: that is a build-breaking
+	// error naming the specifier, never an invented path whose ENOENT
+	// surfaces as a misleading downstream CSS error.
+	const tried: string[] = [];
+	for (const root of [base, cwd]) {
+		let dir = root;
+		for (;;) {
+			const pkgPath = join(dir, "node_modules", id, "package.json");
+			if (await Bun.file(pkgPath).exists()) {
+				const pkg = await Bun.file(pkgPath).json();
+				const entry: string | undefined =
+					pkg.exports?.["."]?.style ?? pkg.style;
+				if (!entry) {
+					throw new Error(
+						`style import "${id}" resolved to ${pkgPath} but the package declares no style entry (exports["."].style / style) — not a stylesheet package`,
+					);
+				}
 				const r = resolve(dirname(pkgPath), entry);
 				return { path: r, base: dirname(r), content: await Bun.file(r).text() };
 			}
-		} catch (error) {
-			getAppLogger().warn(
-				"package style entry resolve failed — falling back to bare resolve",
-				error,
-			);
+			tried.push(pkgPath);
+			const parent = dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
 		}
 	}
-	const r = resolve(base, id);
-	return { path: r, base: dirname(r), content: await Bun.file(r).text() };
+	throw new Error(
+		`style import "${id}" unresolved — no node_modules/${id}/package.json found walking up from ${base} or ${cwd} (${tried.length} location(s) tried)`,
+	);
 }
 
 // Tailwind v4's compile() invokes `loadStylesheet` for DIRECT @imports in the entry (app.css) but does NOT re-invoke it for @imports WITHIN the loaded
@@ -87,14 +108,18 @@ async function inlineCssImports(
 			result += m[0];
 			continue;
 		}
+		// Remote @imports are CSP-forbidden and stripped by
+		// stripRemoteImports AFTER the compile: skip them here EXPLICITLY —
+		// they must never reach resolveStylesheetRaw, and an unresolved
+		// LOCAL import below is a throw, not a swallow.
+		if (spec.startsWith("http://") || spec.startsWith("https://")) {
+			result += m[0];
+			continue;
+		}
 		if (seen.has(spec)) continue; // cycle guard
 		seen.add(spec);
-		try {
-			const resolved = await resolveStylesheetRaw(spec, base, cwd);
-			result += await inlineCssImports(resolved.content, resolved.base, cwd, seen);
-		} catch {
-			result += m[0]; // unresolved — keep literal; CSS/Tailwind will surface it
-		}
+		const resolved = await resolveStylesheetRaw(spec, base, cwd);
+		result += await inlineCssImports(resolved.content, resolved.base, cwd, seen);
 	}
 	result += css.slice(lastIdx);
 	return result;
@@ -111,6 +136,8 @@ async function bunResolveStylesheet(
 	return { ...resolved, content };
 }
 
+export { bunResolveStylesheet };
+
 // The app owns its fonts via an explicit, CSP-allowlisted <link> in index.html (Google Fonts — `style-src ... fonts.googleapis.com`, `font-src ...
 // fonts.gstatic.com`). Third-party package CSS MUST NOT inject its own remote `@import url(http…)`: @puckeditor/core/dist/index.css opens with
 // `@import "https://rsms.me/inter/inter.css"`, an arbitrary CDN our CSP does NOT allow. The Tailwind compile inlines that mid-output, where it was either

package/src/proposal-authorized-emails.ts

@@ -33,8 +33,6 @@ export async function resolveProposalAuthorizedEmails(
 	proposalId: string,
 ): Promise<Set<string>> {
 	try {
-		const { getPrisma } = await import("@teamscala/db/prisma-registry");
-		const prisma = getPrisma();
 		const rows = await queryRows`
 			SELECT lower(u.email) AS email
 			  FROM better_auth_member m