@teamscala/service-boot 0.23.503 → 0.23.506

package/src/content-gate/token.test.ts

@@ -1,17 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Round-trip + binding tests for the content-gate access token. Covers the
- * identity-carrying additions (signAccessToken `name` + verifyAccessTokenIdentity)
- * used by the public GPT lead-capture gate, plus the gate/resource/expiry
- * binding that every gate relies on to withhold content from a link holder.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
-// A stable secret so secret() resolves deterministically in the test. Set BEFORE
-// importing the module under test (secret() reads it at call time, so order is
-// not strictly required, but this keeps the intent explicit).
 process.env.AUTH_SECRET = "test-secret-at-least-16-chars-long";
 
 import { describe, expect, test } from "bun:test";

package/src/content-page-floor.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit proof of the /roadmap fix's core decision (independent of the publish /
- * deploy — verify-before-done). Exercises the pure floor decision + the floor
- * render for every case: dead link (no row → 404), empty page (zero blocks →
- * 200), normal page (renders), resource_type route (handled elsewhere), and
- * region-slot shell (no page source — untouched).
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { test, expect } from "bun:test";
 import {
 	decideContentPageFloor,

package/src/csrf-body-limit.test.ts

@@ -1,18 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavior proofs for the two boot-chain security invariants:
- *  - security-csrf-protection: a state-changing form-element POST from an
- *    untrusted Origin is refused 403; the managed-base-domain Origin (the
- *    derived trusted set) is allowed; same-origin sec-fetch-site is allowed.
- *  - security-body-limit: a body over the global limit is refused 413 BEFORE
- *    any handler runs, and the transfers upload rejects an over-sized
- *    Content-Length without buffering the body.
- * Proxy-is-not-behaviour guards: these exercise the real middleware through
- * real Hono requests.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";

package/src/handlers/messaging-send-reconcile-logic.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Fixture pair for the outbound-dispatch reconciliation logic: the clean
- * fixture (every GOWA outbound id already recorded) and the violating fixture
- * (a raw-dispatched send GOWA knows about that left no messaging_logs row —
- * the 2026-08-26 measured class — which MUST come back as a backfill
- * candidate).
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import {
 	buildBackfillRow,

package/src/handlers/messaging-send-recording-logic.test.ts

@@ -1,12 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit tests for the pure detection logic of the messaging send-recording
- * watch: healthy shape (zero rows) yields null; the failure shape yields the
- * aggregate with ordered bounds; the sample keeps the MOST RECENT rows.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import {
 	buildUnrecordedPayload,

package/src/handlers/messaging-send-recording-watch.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Handler-level integration test for `messagingSendRecordingWatch`: mocks the
- * Prisma registry + recordEvent, drives the two observed live shapes (the
- * three pre-fix rows measured 2026-08-20, and the healthy all-recorded state),
- * and asserts the `messaging.send.unrecorded` durable event fires for exactly
- * the failure shape — without touching the real database.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { beforeEach, expect, mock, test } from "bun:test";
 
 const recordEventCalls: Array<{ kind: string; payload: Record<string, unknown> }> = [];

package/src/handlers/messaging-send-sweep-selection.test.ts

@@ -1,10 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Tests for the reconcile sweep's chat-page selection.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import {
 	selectChatsToSweep,

package/src/handlers/platform-fault-escalation/probe.test.ts

@@ -1,13 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural tests for the capability probe behind the resolve gate
- * (operator ruling 2026-08-28): an episode whose subject is genuinely down
- * must FAIL to close. Health surfaces encode capability in the STATUS CODE
- * (llm-router /health answers 503 while degraded), so healthy means 2xx.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { probeHttpOk } from "./probe.ts";
 

package/src/handlers/platform-fault-escalation-refresh.test.ts

@@ -1,25 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit tests for episode FACT CURRENCY — a separate concern from the
- * threshold/dedup semantics locked by `platform-fault-escalation.test.ts`,
- * and kept in its own file because that one already sits over the size
- * budget.
- *
- * WHAT THIS LOCKS. The sweep escalated once and then never wrote the row
- * again, so an open episode's window facts froze at their escalation-time
- * values while the fault kept firing. Measured 2026-08-28: the
- * `host-command-bus.command.failed` row read `last_seen_at` fifteen hours old
- * with 1,150 further events recorded after it, and a reader — this lane
- * included — concluded from the row that the fault had stopped.
- *
- * The stale value is not only cosmetic: `decideSweep` falls back to
- * `episode.lastSeenAt` once a kind drops out of the window, so a frozen
- * timestamp makes a just-gone-quiet fault look quiet for hours and closes the
- * episode immediately instead of after its configured resolve window.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { episodeNeedsRefresh, pagesOperator } from "./platform-fault-escalation-logic.ts";
 

package/src/handlers/platform-fault-escalation.test.ts

@@ -1,13 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit tests for the pure decision core of the platform-fault escalation
- * sweep (`platform-fault-escalation` handler). The handler's DB/WhatsApp I/O
- * is runtime-verified by the scheduled_job firing; this locks the threshold,
- * dedup and episode semantics from the 2026-08-15 incident brief.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import {
 	composeEscalationMessage,

package/src/handlers/scala-tools-currency-watch.test.ts

@@ -1,3 +1,12 @@
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { join } from "node:path";
 

package/src/handlers/singleton-tools-currency-watch.test.ts

@@ -1,3 +1,12 @@
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { join } from "node:path";
 

package/src/handlers/whatsapp-liveness-handler.test.ts

@@ -1,15 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Handler-level integration test for `pollWhatsAppLiveness`: mocks the central
- * /mcp forwarder (`forwardToolToCentralMcp`) + recordEvent, drives a
- * connected→disconnected transition across two polls, and asserts the
- * `messaging.whatsapp.device.disconnected` recordEvent fires — the "simulated
- * disconnect emitting recordEvent" of `whatsapp-remote-logout-monitor`, without
- * touching the real device or the real /mcp.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { beforeEach, expect, mock, test } from "bun:test";
 
 const recordEventCalls: Array<{ kind: string; payload: Record<string, unknown> }> = [];

package/src/handlers/whatsapp-liveness.test.ts

@@ -1,12 +1,12 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit tests for the pure `detectLivenessTransitions` core of the
- * `whatsapp-liveness` monitor. The handler's GOWA poll + recordEvent emission is
- * runtime-verified by the scheduled_job firing; this locks the transition logic.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { expect, test } from "bun:test";
 import { detectLivenessTransitions } from "./whatsapp-liveness-logic.ts";
 

package/src/interpolate-meta.ts

@@ -0,0 +1,123 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Template interpolation against URL params and resolved loader data:
+ * resolveParamRef, interpolateTemplate, and the meta-context filler.
+ *
+ * interpolateTemplate moved here from resolve-from-loader-config.ts
+ * (file-size-budget): interpolation is its own canonical unit and the meta
+ * filler already consumed it, so the import direction now points at the
+ * family home instead of the wave resolver.
+ *
+ * An unresolved ref keeps its literal template rather than becoming
+ * undefined — a page whose brand failed should show a raw `:brand.companyName`
+ * somewhere visible rather than silently dropping its title.
+ */
+
+export function resolveParamRef(
+	ref: string,
+	params: Record<string, unknown>,
+	resolved: Record<string, unknown>,
+): unknown {
+	const parts = ref.split(".");
+	// A bare (no-dot) ref can name either a resolved source key (e.g. `:response`
+	// passes the whole resolved source object to a resolver_fn) or a URL param
+	// (e.g. `:id`). Prefer the resolved source key, then fall back to the param.
+	// Dotted refs (`:response.total_score`) always read from `resolved`.
+	if (parts.length === 1) {
+		if (resolved != null && typeof resolved === "object" && ref in resolved) {
+			return (resolved as Record<string, unknown>)[ref];
+		}
+		if (params != null && typeof params === "object" && ref in params) {
+			return (params as Record<string, unknown>)[ref];
+		}
+		return undefined;
+	}
+	let current: unknown = resolved;
+	for (const part of parts) {
+		if (current == null || typeof current !== "object") return undefined;
+		current = readField(current as Record<string, unknown>, part);
+	}
+	return current;
+}
+
+/**
+ * A resource_loader row spells DATABASE COLUMN NAMES — `page_id`,
+ * `organisation_id`, `prepared_for` — because that is what the schema calls
+ * them. The ORM hands back CAMELCASE keys — `pageId`, `organisationId`,
+ * `preparedFor`. Nothing reconciled the two, so a `:proposal.page_id` ref read
+ * a key the object does not have and returned undefined.
+ *
+ * MEASURED 2026-09-03, and the consequence is far worse than a missing value.
+ * `interpolateTemplate` DROPS a key whose value is undefined, so a dependent
+ * source declared `where: { id: ":proposal.page_id" }` was issued as
+ * `where: {}` — and findFirst with an empty filter returns AN ARBITRARY FIRST
+ * ROW. A client proposal page therefore loaded an unrelated builda_page,
+ * rendered a stranger's content under the correct brand chrome, and answered
+ * 200 throughout. Instrumenting the live resolver showed every dependent
+ * source doing it: page, website, contact, partnerOrg and clientOrg all with
+ * `where={}`; only `proposal` was correct, because its ref is the URL param
+ * `:id` rather than a sibling source.
+ *
+ * Read the spelled key first, then its camelCase equivalent. Column names stay
+ * the authoring vocabulary and a row never has to know what the ORM did to its
+ * keys.
+ */
+function readField(source: Record<string, unknown>, key: string): unknown {
+	if (key in source) return source[key];
+	const camel = key.replace(/_([a-z0-9])/g, (_m, c: string) => c.toUpperCase());
+	return camel === key ? undefined : source[camel];
+}
+
+export function interpolateTemplate(
+	template: unknown,
+	params: Record<string, unknown>,
+	resolved: Record<string, unknown>,
+): unknown {
+	if (typeof template === "string") {
+		const exactMatch = template.match(/^:([a-zA-Z0-9_.]+)$/);
+		if (exactMatch) {
+			return resolveParamRef(exactMatch[1], params, resolved);
+		}
+		if (template.includes(":")) {
+			return template.replace(
+				/:([a-zA-Z0-9_]+(?:\.[a-zA-Z0-9_]+)*)/g,
+				(_match, ref: string) => {
+					const value = resolveParamRef(ref, params, resolved);
+					return value != null ? String(value) : _match;
+				},
+			);
+		}
+		return template;
+	}
+	if (Array.isArray(template)) {
+		return template.map((v) => interpolateTemplate(v, params, resolved));
+	}
+	if (template != null && typeof template === "object") {
+		const out: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(template)) {
+			const result = interpolateTemplate(v, params, resolved);
+			if (result !== undefined) out[k] = result;
+		}
+		return out;
+	}
+	return template;
+}
+
+export function interpolateMeta(
+	template: Record<string, unknown>,
+	data: Record<string, unknown>,
+): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const [k, v] of Object.entries(template)) {
+		if (v != null && typeof v === "object" && !Array.isArray(v)) {
+			out[k] = interpolateMeta(v as Record<string, unknown>, data);
+		} else {
+			const result = interpolateTemplate(v, {}, data);
+			out[k] = result ?? v;
+		}
+	}
+	return out;
+}

package/src/is-react-element-type.test.ts

@@ -1,12 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Pins the three React idioms a `typeof === "function"` check silently rejects.
- * The memo case is the measured one: PresenceAvatars rendered blank on every
- * scala-projects page carrying it, because memo() returns an object.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { expect, test } from "bun:test";
 import { forwardRef, lazy, memo } from "react";

package/src/loader-errors.ts

@@ -0,0 +1,41 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Error vocabulary for resource_loader source resolution. Split out of
+ * resolve-from-loader-config (file-size-budget): the classes are the
+ * name-matched contract other layers key on, and they belong where they
+ * can be imported without dragging the wave resolver with them.
+ */
+
+export class MissingLoaderModelCapabilityError extends Error {
+	constructor(model: string, sourceKey: string) {
+		super(
+			`[resource_loader] source "${sourceKey}" requires model "${model}", but the generated server client does not expose findFirst for it — regenerate the service schema from its page loaders`,
+		);
+		this.name = "MissingLoaderModelCapabilityError";
+	}
+}
+
+/**
+ * A Prisma/pg query rejected an interpolated URL param as not a valid uuid
+ * (pg 22P02 surfaced as the generated client's SqlQueryError). The value came
+ * from the URL, so the URL names no row — the same state as a deleted row,
+ * not a renderer failure. Deliberately a tight name+message match: a
+ * genuinely malformed query is a config fault and must keep failing loudly.
+ *
+ * Measured 2026-09-12 on scala-quiz prod: scanner paths (/.env, /robots.txt,
+ * *.php) and slug links each threw `invalid input syntax for type uuid` as a
+ * 500 after a ~2.5s DB round trip, and the page-server:render-budget breaker
+ * counted them as CONSECUTIVE render failures — 53 in a row on 2026-09-11 —
+ * so the layer sat DEGRADED fail-closed and every real quiz page 503'd for
+ * hours while the only successful render in the window was a crawler.
+ */
+export function isUrlRefNotUuidError(err: unknown): boolean {
+	return (
+		err instanceof Error &&
+		err.name === "SqlQueryError" &&
+		err.message.includes("invalid input syntax for type uuid")
+	);
+}

package/src/module-not-found.test.ts

@@ -1,15 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Locks the mount candidate-chain regression (2026-08-24): scala-agents-ui
- * crash-looped at boot because @teamscala/cli-session exports ./boot/mount.ts
- * and not ./mount.ts. The chain already listed boot/mount.ts as a fallback,
- * but Bun names an unexported subpath by its BARE package, so the first
- * candidate's miss was classified as a real error and boot died before the
- * fallback ran. The whole value of the chain is that candidate 1 may be absent.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, it } from "bun:test";
 import { barePackageOf, isModuleNotFound } from "./module-not-found";

package/src/mount-orpc-router.test.ts

@@ -1,12 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Regression coverage for the generated-router boot seam. A service schema
- * without its generated router is a codegen failure, not a daemon-only
- * service, so production boot must fail before it can report healthy.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { afterEach, describe, expect, mock, test } from "bun:test";

package/src/page-server-orpc/server-client.test.ts

@@ -1,20 +1,11 @@
-/**
- * @system page-server
- * @status handwritten
- * @edit edit directly
- *
- * The empty-router substitute that hid a total outage.
- *
- * MEASURED 2026-08-20: scala-quiz and scala-forms served 500s on every
- * data-backed page for hours. /health returned 200 and boot logged "ORPC
- * serverClient registered", because an unregistered read was answered with
- * `createRouterClient({}, …)` — a client that looks registered and carries no
- * models. The fault only surfaced later and elsewhere, as
- * MissingLoaderModelCapabilityError during page render.
- *
- * These pin the contract: a missing client is an error at the point of the
- * fault, never a fabricated stand-in.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { afterEach, describe, expect, test } from "bun:test";
 import {