@teamscala/service-boot 0.23.511 → 0.23.513

package/package.json

@@ -5,14 +5,14 @@
     "edit": "edit src/ — dependencies and exports derive from imports; everything else preserved"
   },
   "dependencies": {
-    "@orpc/server": "1.15.0",
+    "@orpc/server": "1.15.1",
     "@teamscala/agreement-generation": "1.0.17",
-    "@teamscala/assessment": "0.0.19",
-    "@teamscala/auth": "1.102.6",
+    "@teamscala/assessment": "0.0.22",
+    "@teamscala/auth": "1.102.11",
     "@teamscala/cache": "1.0.79",
-    "@teamscala/chat-completion": "0.0.453",
-    "@teamscala/db": "1.21.43750",
-    "@teamscala/db-validation": "0.1.292",
+    "@teamscala/chat-completion": "0.0.469",
+    "@teamscala/db": "1.21.43752",
+    "@teamscala/db-validation": "0.1.344",
     "@teamscala/document-signing": "1.0.5",
     "@teamscala/email-client": "0.1.4",
     "@teamscala/encryption": "0.3.98",
@@ -21,25 +21,24 @@
     "@teamscala/formatters": "0.2.95",
     "@teamscala/generic-registry": "1.0.12",
     "@teamscala/hono-boundary": "0.0.1",
-    "@teamscala/host-command-bus": "0.1.1",
     "@teamscala/http": "2.1.105",
     "@teamscala/logger": "1.1.203",
     "@teamscala/mcp-multi-session": "1.3.147",
     "@teamscala/object-storage": "1.2.201",
     "@teamscala/orpc": "2.6.118",
-    "@teamscala/os": "1.15.263",
+    "@teamscala/os": "1.15.264",
     "@teamscala/publish-registry": "0.1.3",
-    "@teamscala/resolver-engine": "1.1.207",
+    "@teamscala/resolver-engine": "1.1.208",
     "@teamscala/timing": "1.0.51",
-    "@teamscala/tool-executor": "4.1.162",
+    "@teamscala/tool-executor": "4.1.166",
     "@teamscala/watchdog": "1.0.53",
-    "hono": "4.13.7",
-    "pg-boss": "12.30.0",
+    "hono": "4.13.8",
+    "pg-boss": "12.33.1",
     "tailwindcss": "4.3.3",
-    "valibot": "1.4.2"
+    "valibot": "1.5.0"
   },
   "devDependencies": {
-    "@happy-dom/global-registrator": "20.14.0",
+    "@happy-dom/global-registrator": "20.14.5",
     "@testing-library/react": "16.3.3",
     "bun-types": "1.4.2"
   },
@@ -1188,5 +1187,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.511"
+  "version": "0.23.513"
 }

package/src/mount-orpc-router.test.ts

@@ -43,11 +43,15 @@ describe("mountOrpcRouter generated-artifact seam", () => {
 		);
 	});
 
-	test("the generic mount no longer injects a gateway URL — the executor derives its host from the registry", async () => {
+	test("the mount injects only the live collaborators — the retired injections stay retired", async () => {
 		// The retired MCP_GATEWAY_URL env name and its injector are gone: the
 		// sdk-mcp-forwarder resolves the SDK execution host from the
 		// mcp_server/scala-mcp registry row via loadRegistryConfig. A missing
 		// row refuses at the boundary (assertSdkHostResolved), never via env.
+		// The @teamscala/host-command-bus invoker injection retired with the
+		// bus (2026-09-19): the mount passes caller identity + secret
+		// decryption only, and host_command tools execute through the native
+		// in-process coding path inside tool-executor.
 		const service = await mkdtemp(join(tmpdir(), "mount-orpc-router-test-"));
 		tempDirs.push(service);
 		await mkdir(join(service, "prisma/generated/orpc/routers"), {
@@ -64,8 +68,8 @@ describe("mountOrpcRouter generated-artifact seam", () => {
 		process.chdir(service);
 
 		// Stub the collaborators the mount reaches BEFORE configureToolExecutor
-		// — the point is to capture the opts object and assert the injector is
-		// absent.
+		// — the point is to capture the opts object and assert the retired
+		// injectors are absent.
 		let seenKeys: Array<string> = [];
 		mock.module("@teamscala/orpc/app-router", () => ({
 			getAppRouter: async () => ({
@@ -85,6 +89,9 @@ describe("mountOrpcRouter generated-artifact seam", () => {
 		await mountOrpcRouter(app as never, "scala-mcp");
 
 		expect(seenKeys).not.toContain("getMcpGatewayUrl");
+		expect(seenKeys).not.toContain("createHostCommandInvoker");
+		expect(seenKeys).toContain("getCallerContext");
+		expect(seenKeys).toContain("decryptSecretConfig");
 	});
 });
 

package/src/mount-orpc-router.ts

@@ -165,22 +165,21 @@ export async function mountOrpcRouter(
 		const { configure: configureToolExecutor } = await import(
 			"@teamscala/tool-executor/configure"
 		);
-		// The host-command-bus collaborators arrive here (the boot layer) —
-		// tool-executor cannot import its tier-2 siblings statically
+		// The caller-identity and secret collaborators arrive here (the boot
+		// layer) — tool-executor cannot import its tier-2 siblings statically
 		// (vertical-dependency-only: a same-tier edge). Resolved eagerly at
-		// mount so the injected factories stay synchronous; the modules are
-		// small and their postgres dependency is already loaded by the db
-		// primitive.
-		const [{ createHostCommandInvoker }, { getCallerContext }, { decryptSecretConfig }] =
+		// mount so the injected factories stay synchronous. The retired
+		// @teamscala/host-command-bus invoker injection no longer happens: the
+		// bus is retired, and host_command tools execute through the native
+		// in-process coding path inside tool-executor.
+		const [{ getCallerContext }, { decryptSecretConfig }] =
 			await Promise.all([
-				import("@teamscala/host-command-bus/invoker"),
 				import("@teamscala/mcp-multi-session/caller-context"),
 				import("@teamscala/encryption/crypto/secret-config"),
 			]);
 		configureToolExecutor({
 			getAppRouter: () => getAppRouter(),
 			getPrisma: () => getConfiguredPrisma(),
-			createHostCommandInvoker: (config) => createHostCommandInvoker(config as never),
 			getCallerContext: () => getCallerContext(),
 			decryptSecretConfig: (raw) => decryptSecretConfig(raw as never),
 		});

package/src/pg-boss-mount.test.ts

@@ -82,7 +82,8 @@ describe("mountPgBoss poll-only contract", () => {
 			packages: ["@teamscala/sync-worker"],
 		});
 
-		const connectionString = captured?.connectionString ?? "";
+		const capturedOpts = captured as unknown as CapturedOpts | undefined;
+		const connectionString = capturedOpts?.connectionString ?? "";
 		// The transaction pooler, exactly as injected — the mount adds no
 		// endpoint derivation.
 		expect(connectionString).toContain(":6543");
@@ -93,8 +94,8 @@ describe("mountPgBoss poll-only contract", () => {
 		// The pg sslmode dialect rewrite still applies.
 		expect(connectionString).toContain("sslmode=no-verify");
 		// Poll-only, spelled: no LISTEN dependency, now and after a bump.
-		expect(captured?.useListenNotify).toBe(false);
+		expect(capturedOpts?.useListenNotify).toBe(false);
 		// pg-boss stays a single sibling connection (pool sizing doctrine).
-		expect(captured?.max).toBe(1);
+		expect(capturedOpts?.max).toBe(1);
 	});
 });

package/src/pg-boss-mount.ts

@@ -196,10 +196,15 @@ export async function mountPgBoss(
 		// unavailable" (logged + event-log row), NEVER a boot-crash. A bare
 		// pg-boss assert reaching boot is the violation.
 		let config: ScheduledJobConfig;
-		try {
-			config = validateRow("scheduled_job", entry.config) as never as ScheduledJobConfig;
-		} catch (err) {
-			const reason = err instanceof Error ? err.message : String(err);
+		// validateRow returns a RESULT WRAPPER ({ok:true,value}|{ok:false,issues}),
+		// never the config itself — measured 2026-09-16: assigning the wrapper as
+		// the config left queue_name/handler_slug undefined and silently skipped
+		// EVERY row on services holding db-validation 0.1.289+.
+		const validated = validateRow("scheduled_job", entry.config);
+		if (!validated.ok) {
+			const reason = validated.issues
+				.map((i) => `${String(i.path?.map((p) => String(p.key)).join(".") ?? "")}: ${i.message}`)
+				.join("; ");
 			log.error(
 				`[pg-boss-mount:${ctx.serviceSlug}] scheduled_job "${entry.slug}" failed schema validation — skipping`,
 				{ reason },
@@ -210,6 +215,7 @@ export async function mountPgBoss(
 			});
 			continue;
 		}
+		config = validated.value as ScheduledJobConfig;
 		if (!config.queue_name || !config.handler_slug) {
 			log.error(
 				`[pg-boss-mount:${ctx.serviceSlug}] scheduled_job "${entry.slug}" missing queue_name or handler_slug — skipping`,