@teamscala/service-boot 0.23.479 → 0.23.492

package/src/fn-routers/public-gpt-session-router.ts

@@ -1,378 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * ORPC procedures for public GPT session management.
- * Creates/restores conversations and messages for public-facing GPT pages.
- */
-
-import { os } from "@orpc/server";
-import * as v from "valibot";
-import type { PrismaClient } from "@teamscala/db/client";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { queryRows } from "@teamscala/db/query-rows";
-import { getClient } from "@teamscala/object-storage/create/client/get-client";
-import { persistChatMessages } from "./persist-chat-messages.ts";
-
-interface Context {
-	prisma: PrismaClient;
-	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<unknown>;
-}
-
-const pub = os.$context<Context>();
-
-const createOrRestoreSchema = v.object({
-	contactName: v.string(),
-	email: v.string(),
-	phone: v.optional(v.string()),
-	gptId: v.string(),
-	orgId: v.string(),
-	sourceUrl: v.optional(v.string()),
-});
-
-const loadSchema = v.object({
-	conversationId: v.string(),
-});
-
-const saveMessagesSchema = v.object({
-	conversationId: v.string(),
-	messages: v.array(v.object({
-		// The SDK UIMessage id — persisted AS the row PK so a re-save upserts the
-		// SAME row instead of inserting a duplicate (chat-message-ids-server-stable).
-		id: v.optional(v.string()),
-		role: v.string(),
-		content: v.string(),
-		// Verbatim UIMessage parts (apps/chat.md messages-stored-as-uimessage-verbatim).
-		// Optional so content-only callers still validate. When present we store them
-		// in channel_data.parts so multi-step (tool-using) turns persist the full
-		// answer, not just the first text part — matches the portal/engine save path.
-		parts: v.optional(v.array(v.any())),
-		// UIMessage metadata — per-message token usage; persisted so the context
-		// gauge rehydrates on reload (matches the portal save path).
-		metadata: v.optional(v.record(v.string(), v.any())),
-	})),
-});
-
-const clearSchema = v.object({
-	conversationId: v.string(),
-});
-
-const uploadSchema = v.object({
-		conversationId: v.string(),
-		fileData: v.string(),
-		fileName: v.string(),
-		fileType: v.string(),
-		fileSize: v.number(),
-	});
-
-	export const publicGptSessionRouter = {
-	createOrRestore: pub.input(createOrRestoreSchema).handler(async ({ input, context }) => {
-		const data = input;
-		const prisma = context.prisma;
-		const log = getAppLogger();
-
-		// Email is the session identity, and email is case-insensitive by spec.
-		// Normalize (trim + lowercase) for BOTH store and match so the SAME
-		// person re-logging with any casing/whitespace ("Info@x", "info@x ")
-		// always lands on their existing thread instead of a fresh empty one.
-		const email = (data.email ?? "").trim().toLowerCase();
-
-		try {
-		// Find-or-create the contact in client_database — the platform's single
-		// contact store (per product-pricing-single-source's sibling rule: no
-		// feature-private contact tables; the retired crm_contacts table was
-		// exactly that drift). On UPDATE (e.g. a silent auto-restore that carries
-		// only the server-resolved name and no phone) we must NOT overwrite the
-		// stored name/phone with empty. Match is org + normalized email; there is
-		// no unique constraint on that pair, so findFirst + create/update.
-		const nameParts = (data.contactName ?? "").trim().split(/\s+/);
-		const firstName = nameParts[0] || "Unknown";
-		const lastName = nameParts.slice(1).join(" ") || "-";
-		let contact = await prisma.client_database.findFirst({
-			where: { organisation_id: data.orgId, primary_email: email },
-			select: { id: true, full_name: true, mobile_phone: true },
-		});
-		if (contact) {
-			contact = await prisma.client_database.update({
-				where: { id: contact.id },
-				data: {
-					...(data.contactName
-						? { first_name: firstName, last_name: lastName }
-						: {}),
-					...(data.phone ? { mobile_phone: data.phone } : {}),
-					last_updated_by: "gpt-gate",
-				},
-				select: { id: true, full_name: true, mobile_phone: true },
-			});
-		} else {
-			contact = await prisma.client_database.create({
-				data: {
-					organisation_id: data.orgId,
-					first_name: firstName,
-					last_name: lastName,
-					primary_email: email,
-					mobile_phone: data.phone ?? null,
-					lead_source: "gpt-gate",
-					data_source: "public-form",
-					referral_source: data.gptId,
-					lifecycle_stage: "lead",
-					created_by: "gpt-gate",
-					last_updated_by: "gpt-gate",
-				},
-				select: { id: true, full_name: true, mobile_phone: true },
-			});
-		}
-		// Canonical identity for prefill — the stored contact wins, so a restore
-		// that arrived without a phone still surfaces the saved one.
-		const contactName = contact.full_name ?? data.contactName;
-		const contactPhone = contact.mobile_phone ?? undefined;
-
-		// Restore the visitor's existing conversation on re-login by EMAIL — regardless of status. Previously this filtered status:'active', so any
-		// thread that had been archived (e.g. by a prior Clear) was invisible and the visitor got a brand-new empty conversation every time ("session
-		// gone"). Restore the thread whose MOST RECENT MESSAGE is newest, found
-		// via the messages themselves (last_message_at is unreliable on older
-		// threads), reactivating it if archived. Only fall back to an active
-		// empty thread, then a new one, when the email has no real history.
-		// Case-insensitive email match (raw SQL on the JSONB field) so old rows
-		// stored with any casing still match. Prisma's JSON `equals` is
-		// case-sensitive, which silently fragmented a returning visitor's
-		// history across near-duplicate threads.
-		const candidates = await queryRows<{
-			id: string;
-			status: string;
-			channel_data: Record<string, unknown>;
-			created_at: Date;
-		}>`
-			SELECT id, status, channel_data, created_at
-			FROM conversations
-			WHERE channel = 'ai'
-			AND organisation_id = ${data.orgId}
-			AND channel_data->>'assistant_type' = ${`custom-gpt:${data.gptId}`}
-			AND lower(trim(channel_data->>'contact_email')) = ${email}
-		`;
-
-		// Pick the thread to continue. Prefer the most-recent ACTIVE thread by
-		// creation: after a Clear that is the fresh empty conversation the user
-		// just created, so a cleared session stays fresh on reload instead of
-		// jumping back to an old thread with messages (the unreliable session-id
-		// behaviour reported 2026-06-14 — it previously restored whichever thread
-		// had the newest MESSAGE, which after a clear is an OLD thread). Only when
-		// there is NO active thread do we reactivate the most-recent archived one (a
-		// returning visitor whose thread was archived — preserving the earlier
-		// "session gone" fix), and finally fall through to creating a new thread.
-		const byCreatedDesc = (a: (typeof candidates)[number], b: (typeof candidates)[number]) =>
-			new Date(b.created_at).getTime() - new Date(a.created_at).getTime();
-		let existing: (typeof candidates)[number] | null =
-			candidates.filter((c) => c.status === "active").sort(byCreatedDesc)[0] ?? null;
-		if (!existing && candidates.length > 0) {
-			existing = [...candidates].sort(byCreatedDesc)[0] ?? null;
-			if (existing) {
-				await prisma.conversations.update({
-					where: { id: existing.id },
-					data: { status: "active" },
-				});
-			}
-		}
-
-		if (existing) {
-			const msgs = await prisma.messages.findMany({
-				where: { conversation_id: existing.id },
-				orderBy: { created_at: "asc" },
-			});
-			const channelData = existing.channel_data as Record<string, unknown>;
-			return {
-				conversationId: existing.id,
-				contactName,
-				contactPhone,
-				// Only user/assistant turns reach the client. A stored role:"tool"
-				// row (written by the prior double-persist path) is not a valid
-				// UIMessage role and 500s validateUIMessages on the next turn —
-				// filter it out so already-poisoned conversations restore cleanly.
-				// Tool output is preserved inside the assistant message's parts[].
-				messages: msgs
-					.filter((m: { role: string | null }) => m.role === "user" || m.role === "assistant")
-					.map((m: { id: string; role: string | null; content: string | null; channel_data: unknown; created_at: Date }) => ({ id: m.id, role: m.role, content: m.content, parts: (m.channel_data as { parts?: unknown[] } | null)?.parts, metadata: (m.channel_data as { metadata?: Record<string, unknown> } | null)?.metadata, created_at: m.created_at })),
-				tokenTotals: {
-					inputTokens: (channelData?.total_input_tokens as number) ?? 0,
-					outputTokens: (channelData?.total_output_tokens as number) ?? 0,
-				},
-			};
-		}
-
-		const conversation = await prisma.conversations.create({
-			data: {
-				channel: "ai",
-				organisation_id: data.orgId,
-				title: `GPT Chat - ${contactName}`,
-				status: "active",
-				channel_data: {
-					assistant_type: `custom-gpt:${data.gptId}`,
-					source: "public-gpt",
-					contact_name: contactName,
-					contact_email: email,
-					contact_phone: contactPhone ?? null,
-					source_url: data.sourceUrl ?? null,
-					total_input_tokens: 0,
-					total_output_tokens: 0,
-				},
-				members: { name: contactName, email },
-			},
-		});
-
-		return {
-			conversationId: conversation.id,
-			contactName,
-			contactPhone,
-			messages: [],
-			tokenTotals: { inputTokens: 0, outputTokens: 0 },
-		};
-		} catch (err) {
-			log.error(`[publicGptSession.createOrRestore] failed: ${err instanceof Error ? err.message : String(err)}`);
-			throw err;
-		}
-	}),
-
-	load: pub.input(loadSchema).handler(async ({ input, context }) => {
-		const data = input;
-		const prisma = context.prisma;
-
-		const conversation = await prisma.conversations.findUnique({
-			where: { id: data.conversationId },
-		});
-		if (!conversation) return null;
-
-		const msgs = await prisma.messages.findMany({
-			where: { conversation_id: data.conversationId },
-			orderBy: { created_at: "asc" },
-		});
-
-		const channelData = conversation.channel_data as Record<string, unknown>;
-		return {
-			conversationId: conversation.id,
-			contactName: (channelData?.contact_name as string) ?? "",
-			contactEmail: (channelData?.contact_email as string) ?? "",
-			messages: msgs.map((m: { id: string; role: string | null; content: string | null; channel_data: unknown; created_at: Date }) => ({ id: m.id, role: m.role, content: m.content, parts: (m.channel_data as { parts?: unknown[] } | null)?.parts, metadata: (m.channel_data as { metadata?: Record<string, unknown> } | null)?.metadata, created_at: m.created_at })),
-			tokenTotals: {
-				inputTokens: (channelData?.total_input_tokens as number) ?? 0,
-				outputTokens: (channelData?.total_output_tokens as number) ?? 0,
-			},
-		};
-	}),
-
-	saveMessages: pub.input(saveMessagesSchema).handler(async ({ input, context }) => {
-		const data = input;
-		const prisma = context.prisma;
-
-		const conversation = await prisma.conversations.findUnique({
-			where: { id: data.conversationId },
-		});
-		if (!conversation) return;
-
-		// The write itself lives in ONE shared surface (persist-chat-messages),
-		// identical to the authed chatSession router; this router only resolves
-		// the public identity (contact-linked conversation) above.
-		await persistChatMessages(prisma, {
-			conversationId: data.conversationId,
-			organisationId: conversation.organisation_id,
-			messages: data.messages,
-		});
-	}),
-
-	// Clear = START FRESH. Archive the old thread AND create a brand-new empty
-	// conversation for the same contact, returning its NEW id. The old flow only
-	// archived + emptied the SAME conversation (id unchanged), and the client then
-	// called createOrRestore which reactivated an old thread — so the session id
-	// never changed on clear, then jumped/vanished on reload (the unreliable
-	// behaviour reported 2026-06-14). Creating+returning the new conversation here
-	// makes clear atomic and the id deterministic.
-	clear: pub.input(clearSchema).handler(async ({ input, context }) => {
-		const data = input;
-		const prisma = context.prisma;
-		const log = getAppLogger();
-
-		const old = await prisma.conversations.findUnique({
-			where: { id: data.conversationId },
-		});
-
-		// Archive the old thread + drop its (now-cleared) messages so it never
-		// restores. Audit history is preserved by the messages table's audit triggers.
-		await prisma.messages.deleteMany({
-			where: { conversation_id: data.conversationId },
-		});
-		await prisma.conversations.update({
-			where: { id: data.conversationId },
-			data: { status: "archived" },
-		});
-
-		if (!old) {
-			log.error(`[publicGptSession.clear] conversation ${data.conversationId} not found; cannot create fresh`);
-			throw new Error("conversation not found");
-		}
-
-		// Carry the old thread's identity into the fresh one.
-		const cd = (old.channel_data ?? {}) as {
-			assistant_type?: string;
-			contact_name?: string | null;
-			contact_email?: string | null;
-			contact_phone?: string | null;
-			source_url?: string | null;
-		};
-		const conversation = await prisma.conversations.create({
-			data: {
-				channel: "ai",
-				organisation_id: old.organisation_id,
-				title: old.title ?? "GPT Chat",
-				status: "active",
-				channel_data: {
-					assistant_type: cd.assistant_type,
-					source: "public-gpt",
-					contact_name: cd.contact_name ?? null,
-					contact_email: cd.contact_email ?? null,
-					contact_phone: cd.contact_phone ?? null,
-					source_url: cd.source_url ?? null,
-					total_input_tokens: 0,
-					total_output_tokens: 0,
-				},
-				members: old.members ?? undefined,
-			},
-		});
-
-		return {
-			conversationId: conversation.id,
-			contactName: (cd.contact_name as string) ?? "",
-			contactPhone: (cd.contact_phone as string | undefined) ?? undefined,
-			messages: [] as Array<{ role: string; content: string; parts?: unknown[] }>,
-			tokenTotals: { inputTokens: 0, outputTokens: 0 },
-		};
-	}),
-
-	checkIdentity: pub.input(v.object({ email: v.string() })).handler(async ({ input, context }) => {
-		const existing = await context.prisma.user.findFirst({
-			where: { email: input.email },
-			select: { id: true },
-		});
-		return { isPlatformUser: !!existing };
-	}),
-
-	upload: pub.input(uploadSchema).handler(async ({ input }) => {
-		const log = getAppLogger();
-		const s3 = await getClient();
-		if (!s3) {
-			log.error("[publicGptSession.upload] S3 client not available");
-			throw new Error("File storage unavailable");
-		}
-
-		const key = `gpt/${input.conversationId}/${Date.now()}-${input.fileName}`;
-		const buffer = Buffer.from(input.fileData, "base64");
-
-		await s3.file(key).write(buffer, {
-			type: input.fileType,
-		});
-
-		const url = `/api/assets/${key}`;
-		log.info("[publicGptSession.upload] File uploaded", { key, size: input.fileSize, type: input.fileType });
-		return { success: true as const, url, type: input.fileType };
-	}),
-};

package/src/fn-routers/resend-client.ts

@@ -1,39 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The fn-router Resend send: a per-call adapter (org rest_client token)
- * carrying the {success, id?, error?} shape the routers consume. Replaces
- * the module-global @teamscala/api-resend/send-email wrapper a regen wiped;
- * failure routes through safe-fallback (fail-open-noisy).
- */
-import { createResendAdapter, emailsSend } from "@teamscala/api-resend";
-import { createSafeFallback } from "@teamscala/safe-fallback/create-safe-fallback";
-
-/** The Resend send body (from/to/subject + html/text/reply_to) — forwarded
- * to the adapter operation verbatim; nothing is assembled here. Index 2 is
- * the body arg; index 1 is the spec-derived params (headers) object. */
-export type ResendSendBody = Parameters<typeof emailsSend>[2];
-
-export interface ResendSendResult {
-	success: boolean;
-	id?: string;
-	error?: string;
-}
-
-const sendLayer = createSafeFallback<ResendSendResult>({
-	name: "service-boot:resend-send",
-	onFailure: "fail-open-noisy",
-	degradedResult: { success: false, error: "resend send layer degraded" },
-	failureBudget: 5,
-});
-
-export async function sendResendEmail(token: string, body: ResendSendBody): Promise<ResendSendResult> {
-	const result = await sendLayer.call(async () => {
-		const client = createResendAdapter({ apiKey: token });
-		const res = await emailsSend(client, {}, body);
-		return { success: true, id: res.id } satisfies ResendSendResult;
-	});
-	return result;
-}

package/src/fn-routers/sign-in-flow-router.ts

@@ -1,196 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * `fn.signInFlow` — typed ORPC procedures for the sign-in flow's client-facing
- * reads (flow config, session check, portal list). Replaces the former
- * `/api/data/{sign-in-flow-config,check-session,portals}` HANDLER_MAP entries
- * from the deleted register-data-routes.ts (orpc-is-the-only-api: every API surface is a
- * typed ORPC procedure, never a hand-written Hono route). Logic ported
- * verbatim from those handlers — these are anonymous-allowed reads (they
- * return an empty result for an unauthenticated caller, never throw), so they
- * use a public base procedure reading `context.headers` for the session, NOT
- * the `authed` middleware (which throws UNAUTHORIZED).
- *
- * EXPAND phase: this router is ADDITIVE — registered into the `fn` namespace
- * but not yet retargeted by @teamscala/auth's use-sign-in-flow client (which
- * still hits the /api/data/* routes). The HANDLER_MAP entries stay until the
- * client retarget + round-trip verify land (post-incident, when the auth-flow
- * test harness can run), then are removed (CONTRACT).
- */
-
-import { os } from "@orpc/server";
-import type { Context } from "./auth-router.ts";
-
-// Public base procedure (anonymous-allowed): carries the request headers so the
-// handler can resolve the session the same way the old Hono handlers did.
-const c = os.$context<Context>();
-
-// ServerClient (getServerClient) is the generic typed base client — it carries
-// no per-service model names, so the org+portal reads below narrow it to the
-// exact procedure shape they call. Precise inline cast, not `any` (mirrors the
-// sibling fn-routers' Prisma-cast pattern in panel-data/portal-diagnostics).
-type PortalWebsitesClient = {
-	builda_websites: {
-		findMany: (args: unknown) => Promise<unknown>;
-	};
-};
-
-export const signInFlowRouter = {
-	// Mirrors /api/data/sign-in-flow-config — returns the flow config row.
-	getSignInFlowConfig: c.handler(async () => {
-		const { loadRegistryConfig } = await import(
-			"@teamscala/db/registry/load-config"
-		);
-		const { SignInFlowConfigSchema } = await import(
-			"@teamscala/db-validation/registry-schemas/sign-in-flow-config"
-		);
-		return loadRegistryConfig(
-			"config",
-			"sign-in-flow-config",
-			SignInFlowConfigSchema,
-		);
-	}),
-
-	// Mirrors /api/data/check-session — { user, redirectUrl, portalCount } for a
-	// logged-in user with a resolved org + active portal; {} otherwise.
-	checkSession: c.handler(async ({ context }) => {
-		const { getAppLogger } = await import("@teamscala/logger/app-loggers");
-		try {
-			const { getSession } = await import("@teamscala/auth/get-session");
-			const { buildPortalRedirectUrl } = await import(
-				"@teamscala/auth/sign-in-flow-config/build-portal-redirect-url"
-			);
-			const { SignInFlowConfigSchema } = await import(
-				"@teamscala/db-validation/registry-schemas/sign-in-flow-config"
-			);
-			const { loadRegistryConfig } = await import(
-				"@teamscala/db/registry/load-config"
-			);
-			const { getServerClient } = await import(
-				"@teamscala/orpc/server-client-registry"
-			);
-			const { queryRowsUnsafe } = await import("@teamscala/db/query-rows");
-
-			// Canonical session read (NOT wrapped in `.data`); {} for no user.
-			const session = await getSession(context.headers);
-			if (!session?.user) return {};
-
-			// fn_resolve_user_org_id returns JSONB { orgId } — extract inner field.
-			const orgResult = (await queryRowsUnsafe(
-				'SELECT fn_resolve_user_org_id($1) AS "resolved"',
-				session.user.id,
-			)) as Array<{ resolved: { orgId: string | null } | null }>;
-			const orgId = orgResult?.[0]?.resolved?.orgId;
-			if (!orgId) return {};
-
-			// System (no-arg) server client: org+portal reads are explicit-id
-			// filtered, not RLS-reliant (mirrors the page-server checkSession).
-			const orpcClient = (await getServerClient()) as unknown as PortalWebsitesClient;
-			const portals = (await orpcClient.builda_websites.findMany({
-				where: {
-					website_type: "portal",
-					status: { in: ["active", "published"] },
-					organisation_id: orgId,
-				},
-				select: { id: true, portal_type: true },
-			})) as Array<{ id: string; portal_type: string }>;
-			if (!portals || portals.length === 0) return {};
-
-			const portal = portals[0];
-			const isOrgSplit = portal.portal_type === "org";
-			const flowConfig = await loadRegistryConfig(
-				"config",
-				"sign-in-flow-config",
-				SignInFlowConfigSchema,
-			);
-			const redirectUrl = buildPortalRedirectUrl(
-				flowConfig,
-				portal.id,
-				orgId,
-				isOrgSplit,
-			);
-			return {
-				user: session.user,
-				redirectUrl,
-				portalCount: portals.length,
-			};
-		} catch (error) {
-			// HTTP backstop only — never 500 the session-check endpoint.
-			getAppLogger().error("[fn.signInFlow.checkSession] error", { error });
-			return {};
-		}
-	}),
-
-	// Mirrors /api/data/portals — { portals, userOrgId, userName } for a
-	// logged-in user with a resolved org; empty portals otherwise.
-	listPortals: c.handler(async ({ context }) => {
-		const { getAppLogger } = await import("@teamscala/logger/app-loggers");
-		try {
-			const { getSession } = await import("@teamscala/auth/get-session");
-			const { queryRowsUnsafe } = await import("@teamscala/db/query-rows");
-			const { getServerClient } = await import(
-				"@teamscala/orpc/server-client-registry"
-			);
-
-			const session = await getSession(context.headers);
-			if (!session?.user) {
-				return { portals: [], userOrgId: null, userName: null };
-			}
-
-			const orgResult = (await queryRowsUnsafe(
-				'SELECT fn_resolve_user_org_id($1) AS "resolved"',
-				session.user.id,
-			)) as Array<{ resolved: { orgId: string | null } | null }>;
-			const orgId = orgResult?.[0]?.resolved?.orgId;
-			if (!orgId) {
-				return {
-					portals: [],
-					userOrgId: null,
-					userName: session.user.name ?? null,
-				};
-			}
-
-			const orpcClient = (await getServerClient({
-				userId: session.user.id,
-				isSuperAdmin:
-					(session.user as { isSuperAdmin?: boolean }).isSuperAdmin ?? false,
-			})) as unknown as PortalWebsitesClient;
-			const websites = (await orpcClient.builda_websites.findMany({
-				where: {
-					website_type: "portal",
-					status: { in: ["active", "published"] },
-					organisation_id: orgId,
-				},
-				select: {
-					id: true,
-					company_friendly_name: true,
-					slug: true,
-					status: true,
-					website_type: true,
-					organisation_id: true,
-					portal_type: true,
-				},
-			})) as Array<Record<string, unknown>>;
-
-			const portals = (websites ?? []).map((w) => ({
-				id: w.id,
-				name: w.company_friendly_name ?? "",
-				slug: w.slug ?? null,
-				status: w.status ?? null,
-				website_type: w.website_type ?? null,
-				organisation_id: w.organisation_id ?? null,
-				portal_type: w.portal_type ?? null,
-			}));
-			return {
-				portals,
-				userOrgId: orgId,
-				userName: session.user.name ?? null,
-			};
-		} catch (error) {
-			getAppLogger().error("[fn.signInFlow.listPortals] error", { error });
-			return { portals: [], userOrgId: null, userName: null };
-		}
-	}),
-};