@teamscala/service-boot 0.23.493 → 0.23.495

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.493",
+  "version": "0.23.495",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -18,16 +18,13 @@
   "dependencies": {
     "@orpc/server": "*",
     "@teamscala/agreement-generation": "*",
-    "@teamscala/api-resend": "*",
     "@teamscala/auth": "*",
     "@teamscala/cache": "*",
     "@teamscala/chat-completion": "*",
     "@teamscala/db": "*",
     "@teamscala/db-validation": "*",
     "@teamscala/document-signing": "*",
-    "@teamscala/email": "*",
     "@teamscala/email-client": "*",
-    "@teamscala/email-template": "*",
     "@teamscala/encryption": "*",
     "@teamscala/event-log": "*",
     "@teamscala/file-lock": "*",
@@ -38,14 +35,11 @@
     "@teamscala/http": "*",
     "@teamscala/logger": "*",
     "@teamscala/mcp-multi-session": "*",
-    "@teamscala/notify-cache": "*",
     "@teamscala/object-storage": "*",
     "@teamscala/orpc": "*",
     "@teamscala/os": "*",
     "@teamscala/publish-registry": "*",
-    "@teamscala/realtime-utils": "*",
     "@teamscala/resolver-engine": "*",
-    "@teamscala/safe-fallback": "*",
     "@teamscala/timing": "*",
     "@teamscala/tool-executor": "*",
     "@teamscala/watchdog": "*",

package/src/build-client-assets/hydrate-bundle.ts

@@ -55,7 +55,7 @@
 	// be silently bypassed; a valid local-export chunk carries a
 	// class/function/const/var/let/import, a valid re-export carries `from`).
 
-import { mkdir, readdir, rename, rm } from "node:fs/promises";
+import { mkdir, readdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { fileHash, removeStaleHashedFiles } from "./hashed-output.ts";
@@ -79,7 +79,6 @@ export async function buildHydrateBundle(
 ): Promise<HydrateBundleResult | null> {
 	const entry = join(cwd, "src", "entry-client.ts");
 	const outDir = join(cwd, "dist", "client");
-	const tmpFile = join(outDir, `${HYDRATE_BASE}.js`);
 
 	if (!(await Bun.file(entry).exists())) {
 		log.warn(
@@ -123,7 +122,26 @@ export async function buildHydrateBundle(
 			entrypoints: [entry],
 			target: "browser",
 			outdir: outDir,
-			naming: `${HYDRATE_BASE}.js`,
+			// THE BUNDLER OWNS THE HASH, because it also writes the references.
+			// Under `splitting: true` + `publicPath`, Bun bakes the entry's
+			// build-time name into every chunk that imports it. Naming the entry
+			// `hydrate.js` here and RENAMING it to `hydrate-<hash>.js` afterwards
+			// moved the file but could not rewrite the specifiers already emitted
+			// into the chunks — so every chunk imported `/assets/hydrate.js`, which
+			// no longer existed. 404 on the module, the importing block dies, and
+			// the page still returns 200 with every guard green.
+			//
+			// MEASURED 2026-09-08 on quiz.scala.business: `AssessmentFlowBlock`
+			// failed with "Failed to fetch dynamically imported module"; crawling
+			// the served graph (142 level-1 + 76 level-2 assets) found exactly one
+			// broken URL — `/assets/hydrate.js` — imported by the entry itself and
+			// by most chunks. Hash applied OUTSIDE the generator is two artefacts
+			// that must agree with nothing making them (`one-generator-pattern`).
+			naming: {
+				entry: `${HYDRATE_BASE}-[hash].[ext]`,
+				chunk: "chunk-[hash].[ext]",
+				asset: "[name]-[hash].[ext]",
+			},
 			minifyWhitespace: process.env.NODE_ENV === "production",
 			minifySyntax: process.env.NODE_ENV === "production",
 			minifyIdentifiers: false,
@@ -232,10 +250,24 @@ export async function buildHydrateBundle(
 		);
 	}
 
-	const hash = await fileHash(tmpFile);
-	const hashedName = `${HYDRATE_BASE}-${hash}.js`;
+	// Bun emitted the hashed entry itself, so the name it wrote into every
+	// chunk IS the name on disk. Read it back from the build's own output
+	// list rather than reconstructing it — a reconstructed name is a second
+	// copy of a fact the bundler already owns, which is the defect this
+	// change removes (`a-mutating-verb-reads-back-what-it-claims`).
+	const entryOutput = result.outputs.find(
+		(o) => o.kind === "entry-point",
+	);
+	if (!entryOutput) {
+		throw new Error(
+			"[build-client-assets] Bun.build reported success but emitted no entry-point output — refusing to ship a bundle with no entry.",
+		);
+	}
+	const hashedName = entryOutput.path.split("/").pop() as string;
 	const hashedPath = join(outDir, hashedName);
-	await rename(tmpFile, hashedPath);
+	const hash =
+		/^hydrate-([A-Za-z0-9]+)\.js$/.exec(hashedName)?.[1] ??
+		(await fileHash(hashedPath));
 	removeStaleHashedFiles(outDir, HYDRATE_BASE, "js", hashedName);
 
 	// Splitting emits one chunk per lazy import() alongside the entry. Keep the

package/src/build-client-assets/source-candidates.test.ts

@@ -10,7 +10,7 @@
  * kind:ui service's stylesheet (2026-09-01, operator-visible).
  */
 import { describe, expect, test } from "bun:test";
-import { mkdir, rm, writeFile } from "node:fs/promises";
+import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { scanSourceCandidates } from "./source-candidates.ts";
@@ -23,7 +23,7 @@ async function makeSourceTree(tag: string, files: Record<string, string>) {
 	for (const [rel, content] of Object.entries(files)) {
 		const p = join(root, rel);
 		await mkdir(p.slice(0, p.lastIndexOf("/")), { recursive: true });
-		await writeFile(p, content);
+		await Bun.file(p).write(content);
 	}
 	return root;
 }

package/src/build-client-assets/sourcemaps-upload.test.ts

@@ -14,7 +14,7 @@
  * boundaries the verification layer depends on.
  */
 
-import { mkdtemp, mkdir, readdir, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, mkdir, readdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, afterEach, describe, expect, test } from "bun:test";
@@ -36,10 +36,7 @@ async function makeDir(): Promise<string> {
 async function seedMaps(outDir: string, names: string[]): Promise<void> {
 	await mkdir(outDir, { recursive: true });
 	for (const name of names) {
-		await writeFile(
-			join(outDir, name),
-			JSON.stringify({ version: 3, sources: ["a.ts"], mappings: "AAAA" }),
-		);
+		await Bun.file(join(outDir, name)).write(JSON.stringify({ version: 3, sources: ["a.ts"], mappings: "AAAA" }));
 	}
 }
 

package/src/build-client-assets/styles-build.test.ts

@@ -14,7 +14,7 @@
  * explicitly, never resolved and never thrown on.
  */
 import { describe, expect, test } from "bun:test";
-import { mkdir, rm, writeFile } from "node:fs/promises";
+import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { bunResolveStylesheet } from "./styles-build.ts";
@@ -25,7 +25,7 @@ async function makeTree(tag: string, files: Record<string, string>) {
 	for (const [rel, content] of Object.entries(files)) {
 		const p = join(root, rel);
 		await mkdir(p.slice(0, p.lastIndexOf("/")), { recursive: true });
-		await writeFile(p, content);
+		await Bun.file(p).write(content);
 	}
 	return root;
 }

package/src/install-harness.ts

@@ -2,14 +2,13 @@
  * @system server-boot
  * @status handwritten
  * @edit edit directly
- * @indivisible-unit owner=unassigned reason=81 lines; pre-2026-08-27 exemption, unreviewed
  *
  * Install harness — sandbox-mounts each declared package and captures
  * registry.require() calls via AsyncLocalStorage. Validates all required
  * rows exist before returning. Throws HarnessInstallError with full
  * context on failure. Per Constitution Rule 2 step 3.
  *
- * Marked @indivisible-unit: HarnessInstallError is the error class
+ * Marked: HarnessInstallError is the error class
  * validatePackageDependencies (might) throw — they form one canonical
  * "install harness validation" unit (the validator + the failure-mode
  * class it produces).

package/src/install-logging.ts

@@ -2,7 +2,6 @@
  * @system server-boot
  * @status handwritten
  * @edit edit directly
- * @indivisible-unit owner=unassigned reason=188 lines; pre-2026-08-27 exemption, unreviewed
  *
  * One-call install of the entire logging pipeline. After installLogging()
  * runs, every error in the service — process-level, HTTP middleware, Hono
@@ -11,7 +10,7 @@
  * loga (dev) with full context. Application code never imports the logger
  * or wraps anything in try/catch for telemetry purposes.
  *
- * Marked @indivisible-unit: installLogging (early bootstrap, hardcoded
+ * Marked: installLogging (early bootstrap, hardcoded
  * defaults) and applyLoggerConfig (late-stage, DB-driven) are the two
  * phases of the same one-call install — the service boot pipeline calls
  * them in sequence with the same serviceSlug.

package/src/mount-server-packages.ts

@@ -65,6 +65,10 @@ export async function mountServerPackages(
 	const mountRegistry = createMountRegistry();
 	const mountCtx = createMountContext(serviceSlug, config, app, mountRegistry, getSharedDb);
 	const serverPackages = (config.server_packages ?? []) as string[];
+	/** Packages that loaded but whose mount threw — unavailable, not fatal.
+	 *  Named in the summary so a degraded boot is legible without grepping for
+	 *  the per-package error line. */
+	const degraded: string[] = [];
 
 	if (serverPackages.length === 0) {
 		log.info(`[scala-install:${serviceSlug}] No server_packages declared`);
@@ -125,11 +129,34 @@ export async function mountServerPackages(
 			}
 		} catch (err) {
 			if (err instanceof BootFatalError) throw err;
-			throw new BootFatalError(
-				"mount-server-packages",
-				serviceSlug,
-				`server_package "${pkg}" mount failed: ${err instanceof Error ? err.message : err}`,
-				err,
+			// A PLUGIN THAT FAILS TO MOUNT IS UNAVAILABLE, NOT FATAL. `crash-isolation`
+			// states the law directly — "a failure in one package does not crash the
+			// host" — and names the plugin failure domain: "a broken plugin degrades
+			// to 'that plugin unavailable'". This arm used to wrap ANY mount error in
+			// a BootFatalError, so one plugin's missing config killed a whole service.
+			//
+			// MEASURED 2026-09-07: scala-agents-ui, the operator's fleet monitoring UI,
+			// booted through db, auth, routes and every other server_package, then died
+			// at @teamscala/opencode because OPENCODE_SERVER_URL was absent. systemd
+			// retried five times and gave up, agents.scala.business served 502, and the
+			// operator lost sight of his fleet — over one optional integration missing
+			// one variable, on a page that needs no opencode connection to render.
+			//
+			// THE ASYMMETRY DECIDES IT. A service that boots without one plugin still
+			// serves every route that plugin did not own, and the gap is loud in this
+			// log line and counted in the summary below. A service that refuses to boot
+			// serves NOTHING — including the surface that would have explained why.
+			//
+			// NOT-FOUND STAYS FATAL, deliberately: that arm is above and untouched. A
+			// package that LOADS and then throws is a broken plugin, which is this
+			// case. A package that cannot be resolved at all means the declared
+			// dependency set was never installed — an install-integrity failure, where
+			// booting a half-installed service would serve wrong results while looking
+			// healthy.
+			degraded.push(pkg);
+			log.error(
+				`[scala-install:${serviceSlug}] server_package "${pkg}" UNAVAILABLE — mount failed; ` +
+					`the service continues without it: ${err instanceof Error ? err.message : err}`,
 			);
 		}
 	}
@@ -137,7 +164,12 @@ export async function mountServerPackages(
 	log.info(
 		`[scala-install:${serviceSlug}] Registered ${mountRegistry.handlers.size} handler(s), ` +
 			`${mountRegistry.wsRoutes.size} ws route(s), ` +
-			`${mountRegistry.bootHooks.size} boot hook(s)`,
+			`${mountRegistry.bootHooks.size} boot hook(s)` +
+			// NAMED, NEVER COUNTED. A bare "1 degraded" sends the reader hunting for
+			// which one; the name is the whole value of the line.
+			(degraded.length > 0
+				? `, ${degraded.length} server_package(s) UNAVAILABLE: ${degraded.join(", ")}`
+				: ""),
 	);
 
 	return mountRegistry;

package/src/register-registry-page-route/graph-cache.ts

@@ -1,6 +1,6 @@
 /**
  * @system ui-service-boot
- * @status handwritten @indivisible-unit owner=unassigned reason=91 lines; pre-2026-08-27 exemption, unreviewed
+ * @status handwritten
  * @edit edit directly
  *
  * The two SWR loader-graph caches (static-shell + parameterised routes) for the

package/src/register-registry-page-route/meta-title.ts

@@ -1,6 +1,6 @@
 /**
  * @system ui-service-boot
- * @status handwritten @indivisible-unit owner=unassigned reason=82 lines; pre-2026-08-27 exemption, unreviewed
+ * @status handwritten
  * @edit edit directly
  *
  * Meta/title helpers for the route registrar: interpolate the route's

package/src/resource-not-found.ts

@@ -2,7 +2,6 @@
  * @system service-boot
  * @status handwritten
  * @edit edit directly
- * @indivisible-unit owner=unassigned reason=299 lines; pre-2026-08-27 exemption, unreviewed
  *
  * One cohesive unit — the branded resource-not-found / holding page: the
  * PrimaryResourceMissingError trigger, the org-logo resolver the page