@teamscala/service-boot 0.23.503 → 0.23.505

package/package.json

@@ -1130,5 +1130,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.503"
+  "version": "0.23.505"
 }

package/src/agreement-gate/signing-shell.test.ts

@@ -1,18 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural pins for the agreement signing-shell units. The load-bearing
- * cases: the gate block carries the OTP switch as the STRING the renderer
- * validates against (a boolean is stripped before the block reaches the
- * component — the same coercion that bit the pre-placed gate), an empty
- * registry title falls back to the DB-driven default, the signing shell
- * ALWAYS renders (registry failure falls back to the hardcoded shell), the
- * shell is deep-cloned per call (injection mutates the tree in place), and
- * the pre-placed-gate probe recognises an agreement gate by its context
- * field — a PROPOSAL gate in the same region must not read as an agreement.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, mock, test } from "bun:test";
 
 let registryBlocks: unknown = undefined;

package/src/agreement-gate.test.ts

@@ -1,18 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Regression test for the new-flow agreement gate's body-region targeting.
- * The body region of the public sign shell IS resolved.page (composed by
- * register-registry-page-route.ts Branch 2 as extractPuckData(resolved.page)).
- * A prior version of getBodyContentArray scored every region by top-level
- * non-shell block count and picked the highest — which misruted to /header when
- * the body wrapped its clauses inside a Container (body top-level count ~1-2
- * vs nested clause count ~40). onUnauthorized then cleared the HEADER and
- * injected the gate there, leaving the entire agreement body visible past the
- * gate. This test pins the fix: the body is withheld, the header is untouched.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { agreementGateConfig } from "./agreement-gate.ts";

package/src/asset-proxy.test.ts

@@ -1,12 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Co-located tests for handleAssetProxy's early-return paths: a non-asset path
- * 404s, and an asset path with no resolvable S3 client 502s (getClient returns
- * null when creds/config are absent — the documented "no client" contract).
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { handleAssetProxy } from "./asset-proxy.ts";
 

package/src/attach-portal-members.test.ts

@@ -1,16 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural pins for the portal member directory endpoint. The load-bearing
- * cases: org-scoped reads bind the orgId as a PARAMETER (never interpolated —
- * the orgId arrives from the query string), the all-orgs "View As" mode is
- * gated to admin/super_admin sessions (any other caller without an orgId is
- * a 400, and an unauthenticated caller never reaches the probe query at
- * all), and a database fault is reported as resolve-failed rather than a
- * 500 leaking driver detail.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, mock, test } from "bun:test";
 import { Hono } from "hono";
 

package/src/attach-transfers-upload.test.ts

@@ -1,13 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Co-located test for attachTransfersUpload: it registers the POST
- * /api/transfers/upload route on the host app. Hono is a type-only import
- * (the real app is built by the runtime), so the host interface is mocked
- * here to exercise registration without the Hono dependency.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { attachTransfersUpload } from "./attach-transfers-upload.ts";
 

package/src/auth-gate.test.ts

@@ -1,10 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The signed-out screen must be able to render its own branding.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { isStaticAssetPath } from "./auth-gate.ts";

package/src/build-client-assets/manifest.test.ts

@@ -1,17 +1,11 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * verifyClientBuildAssets is the capability probe the readiness flip gates on
- * (`a-component-may-not-report-a-state-it-has-not-verified`): a manifest is
- * servable only when BOTH assets it names exist on disk. Measured 2026-09-01
- * (the unstyled-proposal incident): a manifest that never ran — or a first-boot
- * tombstone carrying the unhashed FALLBACK_MANIFEST paths — read as a
- * legitimate bundle and the service served pages whose stylesheet 404'd while
- * every health surface reported ok. These tests pin the refusal for all three
- * unbuilt shapes and the pass for a real build.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";

package/src/build-client-assets/source-candidates.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Fixtures for the @source candidate scan. The load-bearing case is the
- * DIRECTORY probe: sources are directories, and a Bun.file(dir).exists()
- * probe answers false for them — which silently skipped every source,
- * zeroed the candidate set, and stripped all Tailwind utilities from every
- * kind:ui service's stylesheet (2026-09-01, operator-visible).
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";

package/src/build-client-assets/sourcemaps-upload.test.ts

@@ -1,18 +1,11 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Behaviour tests for the source-map upload unit. Two measured defects are
- * regression-locked here: (1) the pre-2026-09 flow deleted the maps after an
- * upload whose responses were never checked, and (2) the direct release-files
- * POST it used returns HTTP 405 on GlitchTip, so NOTHING had ever uploaded.
- * The CLI integration is verified live on the dev host (57/57 of the
- * scala-roadmap release 3b940e0030 uploaded clean); in-test subprocess
- * verification is deferred (spawnSync blocks the bun event loop, which would
- * deadlock a same-process mock server). These tests cover the pure
- * boundaries the verification layer depends on.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { mkdtemp, mkdir, readdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/src/build-client-assets/styles-build.test.ts

@@ -1,18 +1,12 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural pins for the stylesheet resolver (operator ruling 2026-09-03:
- * the fallback chain IS the drift — a bare id resolved via Bun.resolve
- * returned whatever the package's main was (a .js for a normal package),
- * the resolve(base, id) tail invented nonexistent paths whose ENOENT
- * surfaced as misleading downstream CSS errors, and inlineCssImports
- * SWALLOWED unresolved imports, leaving literals that failed downstream
- * instead of at the build. Every case below pins the ruled contract:
- * resolve or THROW naming the specifier; remote https imports are skipped
- * explicitly, never resolved and never thrown on.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";

package/src/build-client-assets.test.ts

@@ -1,15 +1,11 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Regression guard for stripRemoteImports. Third-party package CSS must not
- * inject a remote @import (the dropped/CSP-blocked Inter-font class, scala-docs
- * 2026-06-13): @puckeditor/core/dist/index.css leads with `@import
- * "https://rsms.me/inter/inter.css"`, a CDN our CSP forbids. The compiled
- * bundle must carry zero remote @imports; the app loads its font from the
- * CSP-allowlisted Google Fonts <link> in index.html instead.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { mkdtemp, mkdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/src/capability-slug.test.ts

@@ -1,3 +1,12 @@
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { toCapabilitySlug } from "./capability-slug.ts";
 

package/src/compose-page-title.test.ts

@@ -1,12 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Pins composePageTitle: the single canonical title composer. The title is
- * derived from website + page/entity name with meta_title as an explicit
- * per-page OVERRIDE only, and it NEVER degrades to a bare org name.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { composePageTitle } from "./compose-page-title.ts";

package/src/content-gate/catalog.test.ts

@@ -1,11 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The catalog's invariants — the ones that were unenforceable while the gate
- * list lived as two hand-written arrays in two files.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import {

package/src/content-gate/token.test.ts

@@ -1,17 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Round-trip + binding tests for the content-gate access token. Covers the
- * identity-carrying additions (signAccessToken `name` + verifyAccessTokenIdentity)
- * used by the public GPT lead-capture gate, plus the gate/resource/expiry
- * binding that every gate relies on to withhold content from a link holder.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
-// A stable secret so secret() resolves deterministically in the test. Set BEFORE
-// importing the module under test (secret() reads it at call time, so order is
-// not strictly required, but this keeps the intent explicit).
 process.env.AUTH_SECRET = "test-secret-at-least-16-chars-long";
 
 import { describe, expect, test } from "bun:test";

package/src/content-page-floor.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit proof of the /roadmap fix's core decision (independent of the publish /
- * deploy — verify-before-done). Exercises the pure floor decision + the floor
- * render for every case: dead link (no row → 404), empty page (zero blocks →
- * 200), normal page (renders), resource_type route (handled elsewhere), and
- * region-slot shell (no page source — untouched).
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { test, expect } from "bun:test";
 import {
 	decideContentPageFloor,

package/src/csrf-body-limit.test.ts

@@ -1,18 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavior proofs for the two boot-chain security invariants:
- *  - security-csrf-protection: a state-changing form-element POST from an
- *    untrusted Origin is refused 403; the managed-base-domain Origin (the
- *    derived trusted set) is allowed; same-origin sec-fetch-site is allowed.
- *  - security-body-limit: a body over the global limit is refused 413 BEFORE
- *    any handler runs, and the transfers upload rejects an over-sized
- *    Content-Length without buffering the body.
- * Proxy-is-not-behaviour guards: these exercise the real middleware through
- * real Hono requests.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";

package/src/handlers/messaging-send-reconcile-logic.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Fixture pair for the outbound-dispatch reconciliation logic: the clean
- * fixture (every GOWA outbound id already recorded) and the violating fixture
- * (a raw-dispatched send GOWA knows about that left no messaging_logs row —
- * the 2026-08-26 measured class — which MUST come back as a backfill
- * candidate).
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import {
 	buildBackfillRow,

package/src/handlers/messaging-send-recording-logic.test.ts

@@ -1,12 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit tests for the pure detection logic of the messaging send-recording
- * watch: healthy shape (zero rows) yields null; the failure shape yields the
- * aggregate with ordered bounds; the sample keeps the MOST RECENT rows.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import {
 	buildUnrecordedPayload,

package/src/handlers/messaging-send-recording-watch.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Handler-level integration test for `messagingSendRecordingWatch`: mocks the
- * Prisma registry + recordEvent, drives the two observed live shapes (the
- * three pre-fix rows measured 2026-08-20, and the healthy all-recorded state),
- * and asserts the `messaging.send.unrecorded` durable event fires for exactly
- * the failure shape — without touching the real database.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { beforeEach, expect, mock, test } from "bun:test";
 
 const recordEventCalls: Array<{ kind: string; payload: Record<string, unknown> }> = [];

package/src/handlers/messaging-send-sweep-selection.test.ts

@@ -1,10 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Tests for the reconcile sweep's chat-page selection.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import {
 	selectChatsToSweep,

package/src/handlers/platform-fault-escalation/probe.test.ts

@@ -1,13 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural tests for the capability probe behind the resolve gate
- * (operator ruling 2026-08-28): an episode whose subject is genuinely down
- * must FAIL to close. Health surfaces encode capability in the STATUS CODE
- * (llm-router /health answers 503 while degraded), so healthy means 2xx.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { probeHttpOk } from "./probe.ts";
 

package/src/handlers/platform-fault-escalation-refresh.test.ts

@@ -1,25 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit tests for episode FACT CURRENCY — a separate concern from the
- * threshold/dedup semantics locked by `platform-fault-escalation.test.ts`,
- * and kept in its own file because that one already sits over the size
- * budget.
- *
- * WHAT THIS LOCKS. The sweep escalated once and then never wrote the row
- * again, so an open episode's window facts froze at their escalation-time
- * values while the fault kept firing. Measured 2026-08-28: the
- * `host-command-bus.command.failed` row read `last_seen_at` fifteen hours old
- * with 1,150 further events recorded after it, and a reader — this lane
- * included — concluded from the row that the fault had stopped.
- *
- * The stale value is not only cosmetic: `decideSweep` falls back to
- * `episode.lastSeenAt` once a kind drops out of the window, so a frozen
- * timestamp makes a just-gone-quiet fault look quiet for hours and closes the
- * episode immediately instead of after its configured resolve window.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { episodeNeedsRefresh, pagesOperator } from "./platform-fault-escalation-logic.ts";