@teamscala/service-boot 0.23.479 → 0.23.492

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.479",
+  "version": "0.23.492",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -380,242 +380,6 @@
       "types": "./src/expand-roster.d.ts",
       "default": "./src/expand-roster.ts"
     },
-    "./fn-routers/agreement-certificate": {
-      "types": "./src/fn-routers/agreement-certificate.d.ts",
-      "default": "./src/fn-routers/agreement-certificate.ts"
-    },
-    "./fn-routers/agreement-certificate.ts": {
-      "types": "./src/fn-routers/agreement-certificate.d.ts",
-      "default": "./src/fn-routers/agreement-certificate.ts"
-    },
-    "./fn-routers/agreement-completion-email": {
-      "types": "./src/fn-routers/agreement-completion-email.d.ts",
-      "default": "./src/fn-routers/agreement-completion-email.ts"
-    },
-    "./fn-routers/agreement-completion-email.ts": {
-      "types": "./src/fn-routers/agreement-completion-email.d.ts",
-      "default": "./src/fn-routers/agreement-completion-email.ts"
-    },
-    "./fn-routers/agreement-send-router": {
-      "types": "./src/fn-routers/agreement-send-router.d.ts",
-      "default": "./src/fn-routers/agreement-send-router.ts"
-    },
-    "./fn-routers/agreement-send-router.ts": {
-      "types": "./src/fn-routers/agreement-send-router.d.ts",
-      "default": "./src/fn-routers/agreement-send-router.ts"
-    },
-    "./fn-routers/agreement-sign-side-effects": {
-      "types": "./src/fn-routers/agreement-sign-side-effects.d.ts",
-      "default": "./src/fn-routers/agreement-sign-side-effects.ts"
-    },
-    "./fn-routers/agreement-sign-side-effects.ts": {
-      "types": "./src/fn-routers/agreement-sign-side-effects.d.ts",
-      "default": "./src/fn-routers/agreement-sign-side-effects.ts"
-    },
-    "./fn-routers/agreement-signing-evidence": {
-      "types": "./src/fn-routers/agreement-signing-evidence.d.ts",
-      "default": "./src/fn-routers/agreement-signing-evidence.ts"
-    },
-    "./fn-routers/agreement-signing-evidence.ts": {
-      "types": "./src/fn-routers/agreement-signing-evidence.d.ts",
-      "default": "./src/fn-routers/agreement-signing-evidence.ts"
-    },
-    "./fn-routers/assessment-report-data": {
-      "types": "./src/fn-routers/assessment-report-data.d.ts",
-      "default": "./src/fn-routers/assessment-report-data.ts"
-    },
-    "./fn-routers/assessment-report-data.ts": {
-      "types": "./src/fn-routers/assessment-report-data.d.ts",
-      "default": "./src/fn-routers/assessment-report-data.ts"
-    },
-    "./fn-routers/assessment-report-email": {
-      "types": "./src/fn-routers/assessment-report-email.d.ts",
-      "default": "./src/fn-routers/assessment-report-email.ts"
-    },
-    "./fn-routers/assessment-report-email.ts": {
-      "types": "./src/fn-routers/assessment-report-email.d.ts",
-      "default": "./src/fn-routers/assessment-report-email.ts"
-    },
-    "./fn-routers/assessment-report-pair": {
-      "types": "./src/fn-routers/assessment-report-pair.d.ts",
-      "default": "./src/fn-routers/assessment-report-pair.ts"
-    },
-    "./fn-routers/assessment-report-pair.ts": {
-      "types": "./src/fn-routers/assessment-report-pair.d.ts",
-      "default": "./src/fn-routers/assessment-report-pair.ts"
-    },
-    "./fn-routers/assessment-research-report-data": {
-      "types": "./src/fn-routers/assessment-research-report-data.d.ts",
-      "default": "./src/fn-routers/assessment-research-report-data.ts"
-    },
-    "./fn-routers/assessment-research-report-data.ts": {
-      "types": "./src/fn-routers/assessment-research-report-data.d.ts",
-      "default": "./src/fn-routers/assessment-research-report-data.ts"
-    },
-    "./fn-routers/assessment-scoring": {
-      "types": "./src/fn-routers/assessment-scoring.d.ts",
-      "default": "./src/fn-routers/assessment-scoring.ts"
-    },
-    "./fn-routers/assessment-scoring.ts": {
-      "types": "./src/fn-routers/assessment-scoring.d.ts",
-      "default": "./src/fn-routers/assessment-scoring.ts"
-    },
-    "./fn-routers/auth-router": {
-      "types": "./src/fn-routers/auth-router.d.ts",
-      "default": "./src/fn-routers/auth-router.ts"
-    },
-    "./fn-routers/auth-router.ts": {
-      "types": "./src/fn-routers/auth-router.d.ts",
-      "default": "./src/fn-routers/auth-router.ts"
-    },
-    "./fn-routers/chat-session-router": {
-      "types": "./src/fn-routers/chat-session-router.d.ts",
-      "default": "./src/fn-routers/chat-session-router.ts"
-    },
-    "./fn-routers/chat-session-router.ts": {
-      "types": "./src/fn-routers/chat-session-router.d.ts",
-      "default": "./src/fn-routers/chat-session-router.ts"
-    },
-    "./fn-routers/chat-session-router-shared": {
-      "types": "./src/fn-routers/chat-session-router-shared.d.ts",
-      "default": "./src/fn-routers/chat-session-router-shared.ts"
-    },
-    "./fn-routers/chat-session-router-shared.ts": {
-      "types": "./src/fn-routers/chat-session-router-shared.d.ts",
-      "default": "./src/fn-routers/chat-session-router-shared.ts"
-    },
-    "./fn-routers/conversation-ownership": {
-      "types": "./src/fn-routers/conversation-ownership.d.ts",
-      "default": "./src/fn-routers/conversation-ownership.ts"
-    },
-    "./fn-routers/conversation-ownership.ts": {
-      "types": "./src/fn-routers/conversation-ownership.d.ts",
-      "default": "./src/fn-routers/conversation-ownership.ts"
-    },
-    "./fn-routers/email-defaults": {
-      "types": "./src/fn-routers/email-defaults.d.ts",
-      "default": "./src/fn-routers/email-defaults.ts"
-    },
-    "./fn-routers/email-defaults.ts": {
-      "types": "./src/fn-routers/email-defaults.d.ts",
-      "default": "./src/fn-routers/email-defaults.ts"
-    },
-    "./fn-routers/email-link-ttl": {
-      "types": "./src/fn-routers/email-link-ttl.d.ts",
-      "default": "./src/fn-routers/email-link-ttl.ts"
-    },
-    "./fn-routers/email-link-ttl.ts": {
-      "types": "./src/fn-routers/email-link-ttl.d.ts",
-      "default": "./src/fn-routers/email-link-ttl.ts"
-    },
-    "./fn-routers/index": {
-      "types": "./src/fn-routers/index.d.ts",
-      "default": "./src/fn-routers/index.ts"
-    },
-    "./fn-routers/index.ts": {
-      "types": "./src/fn-routers/index.d.ts",
-      "default": "./src/fn-routers/index.ts"
-    },
-    "./fn-routers": {
-      "types": "./src/fn-routers/index.d.ts",
-      "default": "./src/fn-routers/index.ts"
-    },
-    "./fn-routers/linkedin-identity": {
-      "types": "./src/fn-routers/linkedin-identity.d.ts",
-      "default": "./src/fn-routers/linkedin-identity.ts"
-    },
-    "./fn-routers/linkedin-identity.ts": {
-      "types": "./src/fn-routers/linkedin-identity.d.ts",
-      "default": "./src/fn-routers/linkedin-identity.ts"
-    },
-    "./fn-routers/messaging-whatsapp-router": {
-      "types": "./src/fn-routers/messaging-whatsapp-router.d.ts",
-      "default": "./src/fn-routers/messaging-whatsapp-router.ts"
-    },
-    "./fn-routers/messaging-whatsapp-router.ts": {
-      "types": "./src/fn-routers/messaging-whatsapp-router.d.ts",
-      "default": "./src/fn-routers/messaging-whatsapp-router.ts"
-    },
-    "./fn-routers/panel-data-router": {
-      "types": "./src/fn-routers/panel-data-router.d.ts",
-      "default": "./src/fn-routers/panel-data-router.ts"
-    },
-    "./fn-routers/panel-data-router.ts": {
-      "types": "./src/fn-routers/panel-data-router.d.ts",
-      "default": "./src/fn-routers/panel-data-router.ts"
-    },
-    "./fn-routers/persist-chat-messages": {
-      "types": "./src/fn-routers/persist-chat-messages.d.ts",
-      "default": "./src/fn-routers/persist-chat-messages.ts"
-    },
-    "./fn-routers/persist-chat-messages.ts": {
-      "types": "./src/fn-routers/persist-chat-messages.d.ts",
-      "default": "./src/fn-routers/persist-chat-messages.ts"
-    },
-    "./fn-routers/proposal-send-router": {
-      "types": "./src/fn-routers/proposal-send-router.d.ts",
-      "default": "./src/fn-routers/proposal-send-router.ts"
-    },
-    "./fn-routers/proposal-send-router.ts": {
-      "types": "./src/fn-routers/proposal-send-router.d.ts",
-      "default": "./src/fn-routers/proposal-send-router.ts"
-    },
-    "./fn-routers/public-agreement-router": {
-      "types": "./src/fn-routers/public-agreement-router.d.ts",
-      "default": "./src/fn-routers/public-agreement-router.ts"
-    },
-    "./fn-routers/public-agreement-router.ts": {
-      "types": "./src/fn-routers/public-agreement-router.d.ts",
-      "default": "./src/fn-routers/public-agreement-router.ts"
-    },
-    "./fn-routers/public-assessment-router": {
-      "types": "./src/fn-routers/public-assessment-router.d.ts",
-      "default": "./src/fn-routers/public-assessment-router.ts"
-    },
-    "./fn-routers/public-assessment-router.ts": {
-      "types": "./src/fn-routers/public-assessment-router.d.ts",
-      "default": "./src/fn-routers/public-assessment-router.ts"
-    },
-    "./fn-routers/public-gpt-session-router": {
-      "types": "./src/fn-routers/public-gpt-session-router.d.ts",
-      "default": "./src/fn-routers/public-gpt-session-router.ts"
-    },
-    "./fn-routers/public-gpt-session-router.ts": {
-      "types": "./src/fn-routers/public-gpt-session-router.d.ts",
-      "default": "./src/fn-routers/public-gpt-session-router.ts"
-    },
-    "./fn-routers/resend-client": {
-      "types": "./src/fn-routers/resend-client.d.ts",
-      "default": "./src/fn-routers/resend-client.ts"
-    },
-    "./fn-routers/resend-client.ts": {
-      "types": "./src/fn-routers/resend-client.d.ts",
-      "default": "./src/fn-routers/resend-client.ts"
-    },
-    "./fn-routers/sign-in-flow-router": {
-      "types": "./src/fn-routers/sign-in-flow-router.d.ts",
-      "default": "./src/fn-routers/sign-in-flow-router.ts"
-    },
-    "./fn-routers/sign-in-flow-router.ts": {
-      "types": "./src/fn-routers/sign-in-flow-router.d.ts",
-      "default": "./src/fn-routers/sign-in-flow-router.ts"
-    },
-    "./fn-routers/user-preferences-router": {
-      "types": "./src/fn-routers/user-preferences-router.d.ts",
-      "default": "./src/fn-routers/user-preferences-router.ts"
-    },
-    "./fn-routers/user-preferences-router.ts": {
-      "types": "./src/fn-routers/user-preferences-router.d.ts",
-      "default": "./src/fn-routers/user-preferences-router.ts"
-    },
-    "./fn-routers/work-items-router": {
-      "types": "./src/fn-routers/work-items-router.d.ts",
-      "default": "./src/fn-routers/work-items-router.ts"
-    },
-    "./fn-routers/work-items-router.ts": {
-      "types": "./src/fn-routers/work-items-router.d.ts",
-      "default": "./src/fn-routers/work-items-router.ts"
-    },
     "./gate-ttls": {
       "types": "./src/gate-ttls.d.ts",
       "default": "./src/gate-ttls.ts"
@@ -888,14 +652,6 @@
       "types": "./src/page-route-shell-types.d.ts",
       "default": "./src/page-route-shell-types.ts"
     },
-    "./page-server-orpc/audit-revert-router": {
-      "types": "./src/page-server-orpc/audit-revert-router.d.ts",
-      "default": "./src/page-server-orpc/audit-revert-router.ts"
-    },
-    "./page-server-orpc/audit-revert-router.ts": {
-      "types": "./src/page-server-orpc/audit-revert-router.d.ts",
-      "default": "./src/page-server-orpc/audit-revert-router.ts"
-    },
     "./page-server-orpc/hub-mcp-client": {
       "types": "./src/page-server-orpc/hub-mcp-client.d.ts",
       "default": "./src/page-server-orpc/hub-mcp-client.ts"
@@ -904,14 +660,6 @@
       "types": "./src/page-server-orpc/hub-mcp-client.d.ts",
       "default": "./src/page-server-orpc/hub-mcp-client.ts"
     },
-    "./page-server-orpc/puck-pages-router": {
-      "types": "./src/page-server-orpc/puck-pages-router.d.ts",
-      "default": "./src/page-server-orpc/puck-pages-router.ts"
-    },
-    "./page-server-orpc/puck-pages-router.ts": {
-      "types": "./src/page-server-orpc/puck-pages-router.d.ts",
-      "default": "./src/page-server-orpc/puck-pages-router.ts"
-    },
     "./page-server-orpc/server-client": {
       "types": "./src/page-server-orpc/server-client.d.ts",
       "default": "./src/page-server-orpc/server-client.ts"
@@ -920,14 +668,6 @@
       "types": "./src/page-server-orpc/server-client.d.ts",
       "default": "./src/page-server-orpc/server-client.ts"
     },
-    "./page-server-orpc/user-preferences-router": {
-      "types": "./src/page-server-orpc/user-preferences-router.d.ts",
-      "default": "./src/page-server-orpc/user-preferences-router.ts"
-    },
-    "./page-server-orpc/user-preferences-router.ts": {
-      "types": "./src/page-server-orpc/user-preferences-router.d.ts",
-      "default": "./src/page-server-orpc/user-preferences-router.ts"
-    },
     "./pg-boss-handler-registry": {
       "types": "./src/pg-boss-handler-registry.d.ts",
       "default": "./src/pg-boss-handler-registry.ts"

package/src/agreement-gate/signing-session.ts

@@ -20,7 +20,7 @@ import {
 import {
 	buildCertificateData,
 	type CertificateData,
-} from "../fn-routers/agreement-certificate.ts";
+} from "@teamscala/agreement-generation/agreement-certificate";
 import { findFirstAgreement } from "./agreement-lookup.ts";
 import { resolveAgreementViewerDirectory } from "./resolution-caches.ts";
 

package/src/build-client-assets/styles-build.ts

@@ -213,8 +213,18 @@ export async function buildTailwindCss(
 	await mkdir(outDir, { recursive: true });
 
 	const cssSource = await Bun.file(entry).text();
+	// base MUST be the ENTRY FILE's directory (src/), never the service root.
+	// The generated app.css authors its @source dirs relative to itself
+	// ("../node_modules/@teamscala/<pkg>/src"); Tailwind 4.3 resolves @source
+	// against THIS base, so passing the service root aimed every scan one
+	// level too high (workspace/node_modules — empty) and the candidate set
+	// collapsed to zero: build([]) strips every Tailwind utility and every
+	// kind:ui service renders with naked buttons/controls while the
+	// stylesheet still loads with its full package-rule payload (measured
+	// 2026-09-05, operator-visible fleet-wide). Package-specifier @imports are
+	// unaffected — they resolve through loadStylesheet's Bun.resolve walk.
 	const compiler = await compile(cssSource, {
-		base: cwd,
+		base: join(cwd, "src"),
 		async loadStylesheet(id, base) {
 			return bunResolveStylesheet(id, base, cwd);
 		},

package/src/mount-orpc-router.ts

@@ -6,7 +6,7 @@
  * Mounts the composed ORPC app router (generated Prisma CRUD + custom fn routers)
  * at /api/rpc/* over HTTP via @orpc/server/fetch's RPCHandler.
  * Uses getAppRouter() from @teamscala/orpc/app-router which merges generated
- * routers with custom routers registered via registerCustomRouter().
+ * routers plus the row-composed fn namespace (orpc-bundle from api_route rows).
  */
 
 import { join } from "node:path";

package/src/register-page-server-client.ts

@@ -99,21 +99,7 @@ export async function registerPageServerClient(
 			);
 		}
 
-		const { puckPagesRouter } = await import(
-			"@teamscala/service-boot/page-server-orpc/puck-pages-router"
-		);
-		const { userPreferencesRouter } = await import(
-			"@teamscala/service-boot/page-server-orpc/user-preferences-router"
-		);
-		const { auditRevertRouter } = await import(
-			"@teamscala/service-boot/page-server-orpc/audit-revert-router"
-		);
-		const composed = {
-			...((appRouter as Record<string, unknown> | null) ?? {}),
-			puckPages: puckPagesRouter,
-			userPreferences: userPreferencesRouter,
-			auditRevert: auditRevertRouter,
-		};
+		const composed = (appRouter as Record<string, unknown> | null) ?? {};
 		const { loadRegistryConfig } = await import(
 			"@teamscala/db/registry/load-config"
 		);

package/src/register-registry-page-route/region-slots-page-data.ts

@@ -92,7 +92,7 @@ export function regionSlotsPageData(
 					{
 						templateTitle: (meta.title as string) || undefined,
 						websiteName: (website.name as string) || undefined,
-						organisationName: (brand.companyName as string) || undefined,
+						organisationName: (brand.companyFriendlyName as string) || (brand.companyName as string) || undefined,
 						entityTitle: entityTitle || undefined,
 					},
 					{ orgPrefix },
@@ -164,7 +164,7 @@ export function regionSlotsPageData(
 			{
 				templateTitle: (meta.title as string) || undefined,
 				websiteName: (website.name as string) || undefined,
-				organisationName: (brand.companyName as string) || undefined,
+				organisationName: (brand.companyFriendlyName as string) || (brand.companyName as string) || undefined,
 					pageName: contentPageName,
 					entityTitle: entityTitle || undefined,
 				},

package/src/register-ws-routes.ts

@@ -6,7 +6,7 @@
  * Registers each `service_install.websocket_routes[]` entry as a Hono WS route.
  * The ORPC WS (`/api/rpc/ws`) is mounted by the canonical primitive
  * `mountOrpcWs` (@teamscala/orpc/ws/server) over the FULLY-COMPOSED app router —
- * this runs AFTER registerFnRouters, so the eager RPCHandler snapshots every
+ * this runs AFTER the app router composition, so the eager RPCHandler snapshots every
  * namespace, and any `output: eventIterator(...)` procedure dispatches (rule
  * `orpc-ws-via-mount-orpc-ws`). It is NOT a server_package WsRouteHandler — it
  * is exempt from the legacy invariant below.

package/src/fn-routers/agreement-certificate.ts

@@ -1,224 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The Certificate of Completion for an executed agreement: DB-driven display
- * copy (config/certificate-of-completion), the CertificateData shape, and
- * the party-gated builder.
- *
- * Split out of fn-routers/public-agreement-router.ts (853 lines) —
- * byte-for-byte move; import paths adjusted only.
- */
-
-import * as v from "valibot";
-import { queryRows } from "@teamscala/db/query-rows";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import {
-	parseAgreementParties as parseParties,
-} from "@teamscala/document-signing/agreement-parties";
-import { parseEvidence } from "./agreement-signing-evidence.ts";
-
-/** The Certificate of Completion display copy. DB-driven via the
- *  `config/certificate-of-completion` registry row — mirrors the agreement gate's
- *  `config/content-gate-agreement` pattern (same signing surface), so an operator
- *  can rebrand/reword the certificate via `registry_edit` with no deploy; the
- *  hardcoded defaults are the fallback. Generic structural data-column labels
- *  (Signer/Role/Envelope ID/…) stay in the component, exactly as the gate keeps
- *  its structural markup in code. */
-export interface CertificateCopy {
-	title: string;
-	signersHeading: string;
-	sealHeading: string;
-	sealNote: string;
-	footer: string;
-	badgeCompleted: string;
-	badgeInProgress: string;
-	/** Audit-table column labels — DB-driven so rewording is a registry_edit.
-	 *  Each labels BOTH the <th> header AND the stacked-row data-label on mobile
-	 *  (one source, kept in sync), never a second hardcoded copy. */
-	colSigner: string;
-	colRole: string;
-	colSigned: string;
-	colIp: string;
-	colAuth: string;
-}
-
-const CERTIFICATE_COPY_DEFAULTS: CertificateCopy = {
-	title: "CERTIFICATE OF COMPLETION",
-	signersHeading: "Signers",
-	sealHeading: "Tamper-evident seal",
-	sealNote:
-		"{{hashAlgo}} hash of the executed document + signed roster, sealed {{hashedAt}}. Re-hashing the stored document and comparing to this value proves it has not been altered since signing.",
-	footer:
-		"This certificate is a record of the electronic signing of the above agreement, produced from the platform's permanent audit trail. Electronic signatures are legally recognised under the ESIGN Act and UETA (US) and eIDAS (EU).",
-	badgeCompleted: "Completed",
-	badgeInProgress: "In progress",
-	colSigner: "Signer",
-	colRole: "Role",
-	colSigned: "Signed (UTC)",
-	colIp: "IP address",
-	colAuth: "Auth",
-};
-
-const CertificateCopySchema = v.object({
-	title: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.title),
-	signersHeading: v.optional(
-		v.string(),
-		CERTIFICATE_COPY_DEFAULTS.signersHeading,
-	),
-	sealHeading: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.sealHeading),
-	sealNote: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.sealNote),
-	footer: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.footer),
-	badgeCompleted: v.optional(
-		v.string(),
-		CERTIFICATE_COPY_DEFAULTS.badgeCompleted,
-	),
-	badgeInProgress: v.optional(
-		v.string(),
-		CERTIFICATE_COPY_DEFAULTS.badgeInProgress,
-	),
-	colSigner: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.colSigner),
-	colRole: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.colRole),
-	colSigned: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.colSigned),
-	colIp: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.colIp),
-	colAuth: v.optional(v.string(), CERTIFICATE_COPY_DEFAULTS.colAuth),
-});
-
-async function loadCertificateCopy(): Promise<CertificateCopy | null> {
-	try {
-		return await loadRegistryConfig(
-			"config",
-			"certificate-of-completion",
-			CertificateCopySchema,
-		);
-	} catch {
-		// Absent signal, not a masking fallback (protective-layers-fail-explicitly):
-		// null propagates to CertificateData.copy, and the component renders its
-		// FALLBACK_COPY — same default values, but the absence is honest rather
-		// than disguised as a successful config load.
-		return null;
-	}
-}
-
-/** The Certificate of Completion data shape — the court-style audit certificate.
- *  One home: {@link buildCertificateData} is consumed by the SSR agreement
- *  gate, so the signing block receives the server-seeded prop. */
-export interface CertificateData {
-	ok: boolean;
-	envelopeId?: string;
-	documentName?: string | null;
-	issuedAt?: string;
-	complete?: boolean;
-	createdAt?: string | null;
-	sentAt?: string | null;
-	viewedAt?: string | null;
-	signedAt?: string | null;
-	documentHash?: string | null;
-	hashAlgo?: string | null;
-	hashedAt?: string | null;
-	parties?: {
-		role: string;
-		name: string | null;
-		email: string | null;
-		title: string | null;
-		company: string | null;
-		signedAt: string | null;
-		ip: string | null;
-		userAgent: string | null;
-		authMethod: string | null;
-	}[];
-	/** DB-driven display copy (config/certificate-of-completion); null when the
-	 *  config row is missing/broken — the component falls back to FALLBACK_COPY. */
-	copy?: CertificateCopy | null;
-}
-
-/**
- * Build the Certificate of Completion data for an agreement, gated to a party
- * email — signer evidence (IP/device) is never exposed to a non-party. One data
- * home: the SSR agreement gate (`buildSigningSession` in agreement-gate.ts)
- * calls this. The read is
- * intentionally RLS-unscoped via the raw registry prisma — the certificate is
- * reached without a session (AG cookie only), which context.prisma's RLS would
- * otherwise treat as no-org and hide. Accepts either the agreement record id or
- * its page id (the UUID the signer sees in the URL is the page id).
- */
-export async function buildCertificateData(
-	agreementId: string,
-	email: string,
-): Promise<CertificateData> {
-	const id = agreementId.trim();
-	const mail = email.trim().toLowerCase();
-	if (!id || !mail) return { ok: false };
-	const [agreement] = await queryRows<
-		{
-			id: string;
-			name: string;
-			created_at: Date | null;
-			sent_at: Date | null;
-			viewed_at: Date | null;
-			signed_at: Date | null;
-			signature_data: unknown;
-			signer_email: string | null;
-			signer_name: string | null;
-		}
-	>`
-		SELECT id, name, created_at, sent_at, viewed_at, signed_at,
-		       signature_data, signer_email, signer_name
-		  FROM agreements
-		 WHERE (id = ${id} OR page_id = ${id})
-		 LIMIT 1`;
-	if (!agreement) return { ok: false };
-	const parties = parseParties(agreement.signature_data);
-	const evidence = parseEvidence(agreement.signature_data);
-	const isParty = parties
-		? parties.some((p) => p.email.trim().toLowerCase() === mail)
-		: String(agreement.signer_email ?? "")
-				.trim()
-				.toLowerCase() === mail;
-	if (!isParty) return { ok: false };
-	const complete =
-		!!agreement.signed_at || (parties?.every((p) => p.signedAt) ?? false);
-	const iso = (d: Date | null | undefined) => d?.toISOString() ?? null;
-	const copy = await loadCertificateCopy();
-	return {
-		ok: true,
-		copy,
-		envelopeId: agreement.id,
-		documentName: agreement.name,
-		issuedAt: new Date().toISOString(),
-		complete,
-		createdAt: iso(agreement.created_at),
-		sentAt: iso(agreement.sent_at),
-		viewedAt: iso(agreement.viewed_at),
-		signedAt: iso(agreement.signed_at),
-		documentHash: evidence?.documentHash ?? null,
-		hashAlgo: evidence?.hashAlgo ?? null,
-		hashedAt: evidence?.hashedAt ?? null,
-		parties: parties
-			? parties.map((p) => ({
-					role: p.key,
-					name: p.name,
-					email: p.email,
-					title: p.title,
-					company: p.company,
-					signedAt: p.signedAt,
-					ip: p.signedIp ?? null,
-					userAgent: p.signedUserAgent ?? null,
-					authMethod: p.authMethod ?? null,
-				}))
-			: [
-					{
-						role: "signer",
-						name: agreement.signer_name,
-						email: agreement.signer_email,
-						title: null,
-						company: null,
-						signedAt: iso(agreement.signed_at),
-						ip: null,
-						userAgent: null,
-						authMethod: "email-match",
-					},
-				],
-	};
-}