@teamscala/service-boot 0.23.516 → 0.23.518

package/src/handlers/singleton-tools-currency-watch.ts

@@ -1,380 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The `singleton-tools-currency-watch` pg-boss handler — keeps every tool
- * declared in `config/scala-singleton-tools` at its `version_source` latest.
- *
- * Each tool entry now carries a `version_source` block:
- *   { type: "npm_package", name: "<pkg>", dist_tag: "latest" }
- * The handler reads the row, checks each tool's installed version against the
- * registry dist-tag, and reinstalls when stale. Reinstall strategy per kind:
- *   - "js" (oxlint): `bun add <pkg>@<dist_tag>` in the tool's `install_dir`
- *   - "elf" (tsgo/tsc): `bun add -g <pkg>@<dist_tag>` (global install)
- *   - "bare" (bun): SKIPPED — bun is a standalone ELF binary; its upgrade is
- *     owned by `bun-stable-watch` (which watches for 1.4.0 stable). This handler
- *     logs a skip event so the gap is observable, never silent.
- *
- * Boot-safety (protective-layers-fail-explicitly): every step is wrapped — a
- * dist-tag fetch failure, version-parse failure, or install failure NEVER
- * crashes the job or loga; each records a failure event + returns. Repeated
- * reinstalls are prevented by strict semver-lt comparison.
- *
- * Registered under slug `@teamscala/service-boot:singleton-tools-currency-watch`.
- */
-/**
- * Where a tool's "latest" comes from.
- *
- * A DISCRIMINATED UNION, deliberately, rather than an optional `repo` field
- * hanging off one shape: an unhandled variant then fails to compile instead of
- * silently taking the npm branch. The previous single-member form
- * (`type: "npm_package"`) made a GitHub-released binary UNREPRESENTABLE, not
- * merely unregistered — which is why standalone-ELF CLIs were absent from
- * `config/scala-singleton-tools` entirely. They live in ~/.local/bin and are
- * not npm-managed, so they could not be described at all.
- *
- * Their LOCATION is correct and must not be "fixed": `bun-bin-is-unstable`
- * designates ${HOME}/.local/bin as the home for operator CLIs precisely so they
- * never shadow a /usr/local/bin singleton wrapper. The gap was currency
- * tracking, never placement.
- */
-
-		// A GitHub-released binary is NOT installed by a package manager, so there
-		// is no "reinstall" verb to call — it would have to be downloaded, verified,
-		// made executable and swapped atomically over a file that may be RUNNING.
-		// That is a real install path with real failure modes (partial download,
-		// wrong architecture, replacing a binary mid-execution), and doing it badly
-		// is worse than not doing it: a half-written CLI is a broken CLI.
-		//
-		// So this reports the drift and stops. Detection is live from today; the
-		// automated swap is a separate, deliberate change. Reporting a version the
-		// watcher cannot actually install is honest — silently claiming currency
-		// would not be.
-
-import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { spawn } from "@teamscala/os/spawn";
-import { getDistTagVersion } from "@teamscala/publish-registry";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-
-type VersionSource =
-	| {
-			type: "npm_package";
-			name: string;
-			dist_tag: string;
-	  }
-	| {
-			/** A GitHub release asset — the shape standalone-ELF CLIs ship as. */
-			type: "github_release";
-			/** "owner/repo". */
-			repo: string;
-			/**
-			 * Regex matched against each release asset's name to pick the download.
-			 * Required: a repo publishing several platform builds has no safe default,
-			 * and guessing one installs the wrong architecture silently.
-			 */
-			asset_pattern: string;
-	  };
-
-interface SingletonTool {
-	name: string;
-	kind: "elf" | "bare" | "js";
-	real_path: string;
-	lock_name?: string;
-	install_dir?: string;
-	version_source?: VersionSource;
-}
-
-interface SingletonToolsConfig {
-	tools: SingletonTool[];
-}
-
-interface SemverParts {
-	major: number;
-	minor: number;
-	patch: number;
-	/** Pre-release suffix, e.g. "dev.20260620.1" or "" for stable. */
-	pre: string;
-}
-
-function parseSemver(v: string): SemverParts | null {
-	const m = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(v.trim());
-	if (!m) return null;
-	return { major: Number(m[1]!), minor: Number(m[2]!), patch: Number(m[3]!), pre: m[4] ?? "" };
-}
-
-/** Compare two pre-release identifiers: "dev.20260707.2" > "dev.20260620.1". */
-function preLt(a: string, b: string): boolean {
-	// Split on dots, compare each segment numerically if possible, else lexicographically.
-	const sa = a.split(".");
-	const sb = b.split(".");
-	for (let i = 0; i < Math.min(sa.length, sb.length); i++) {
-		const na = Number(sa[i]);
-		const nb = Number(sb[i]);
-		if (!Number.isNaN(na) && !Number.isNaN(nb)) {
-			if (na !== nb) return na < nb;
-		} else if (sa[i] !== sb[i]) {
-			return sa[i]! < sb[i]!;
-		}
-	}
-	return sa.length < sb.length;
-}
-
-function semverLt(a: string, b: string): boolean {
-	const pa = parseSemver(a);
-	const pb = parseSemver(b);
-	if (!pa || !pb) return false;
-	if (pa.major !== pb.major) return pa.major < pb.major;
-	if (pa.minor !== pb.minor) return pa.minor < pb.minor;
-	if (pa.patch !== pb.patch) return pa.patch < pb.patch;
-	// Same major.minor.patch — compare pre-release.
-	// No pre-release (stable) > any pre-release.
-	if (!pa.pre && !pb.pre) return false;
-	if (!pa.pre) return false; // a is stable, b is pre — a is newer
-	if (!pb.pre) return true; // a is pre, b is stable — a is older
-	return preLt(pa.pre, pb.pre);
-}
-
-/** Read the installed version from a tool's real_path (symlink-resolved binary). */
-async function readInstalledVersion(tool: SingletonTool): Promise<string | null> {
-	try {
-		const vs = tool.version_source;
-		// The package.json path only exists for an npm-sourced JS tool. A
-		// github_release tool has no node_modules entry, so it falls through to the
-		// `--version` probe below like any other binary.
-		if (tool.kind === "js" && tool.install_dir && vs?.type === "npm_package") {
-			// JS tools: read the installed package's package.json
-			const pkgJsonPath = `${tool.install_dir}/node_modules/${vs.name}/package.json`;
-			const pkg = await Bun.file(pkgJsonPath).json() as { version: string };
-			return pkg.version;
-		}
-		// ELF/bare: run --version on the binary
-		const result = await spawn({
-			name: `singleton-tools-currency:version-${tool.name}`,
-			command: [tool.real_path, "--version"],
-			timeoutMs: 15_000,
-		});
-		const out = (result.stdout ?? "").trim();
-		// tsgo prints "Version 7.0.0-dev.20260620.1" — extract the version
-		const vMatch = /(\d+\.\d+\.\d+(?:-dev\.\d+)?)/.exec(out);
-		return vMatch?.[1] ?? out;
-	} catch {
-		return null;
-	}
-}
-
-/**
- * Latest published version for a GitHub-released tool.
- *
- * Reads the repo's latest release tag rather than enumerating assets, because
- * the tag is what carries the VERSION; the asset pattern only decides which
- * build to download at install time. A leading "v" is stripped so the value
- * compares against `readInstalledVersion` output under the same semver parser.
- */
-async function fetchLatestGithubRelease(repo: string): Promise<string | null> {
-	try {
-		const res = await fetch(
-			`https://api.github.com/repos/${repo}/releases/latest`,
-			{ headers: { accept: "application/vnd.github+json" } },
-		);
-		if (!res.ok) return null;
-		const release = (await res.json()) as { tag_name?: string };
-		const tag = (release.tag_name ?? "").trim().replace(/^v/, "");
-		if (!tag || !parseSemver(tag)) return null;
-		return tag;
-	} catch {
-		return null;
-	}
-}
-
-/** Fetch the latest version from npm for a given package + dist-tag. */
-async function fetchLatestVersion(pkg: string, distTag: string): Promise<string | null> {
-	try {
-		// @teamscala/* packages use the internal dist-tag tool; public npm packages
-		// fetch directly from the npm registry via the typed primitive.
-		if (pkg.startsWith("@teamscala/")) {
-			const result = await spawn({
-				name: "singleton-tools-currency:dist-tag",
-				command: ["scala-tools", "packages", "dist-tag", "get", pkg, distTag],
-				timeoutMs: 30_000,
-			});
-			const latest =
-				(result.stdout ?? "")
-					.split("\n")
-					.map((l) => l.trim())
-					.filter(Boolean)
-					.pop() ?? "";
-			if (!latest || !parseSemver(latest)) return null;
-			return latest;
-		}
-		return getDistTagVersion(pkg, distTag, "https://registry.npmjs.org");
-	} catch {
-		return null;
-	}
-}
-
-/** Reinstall a stale tool to the latest version. */
-async function reinstallTool(tool: SingletonTool, latest: string): Promise<boolean> {
-	const log = getAppLogger();
-	const vs = tool.version_source;
-	if (!vs) return false;
-
-	if (vs.type === "github_release") {
-		log.warn(
-			`[singleton-tools-currency] ${tool.name}: STALE, latest ${latest} from ${vs.repo}. Automated github_release install is not implemented — update it manually.`,
-		);
-		recordEvent({
-			kind: "singleton-tools.currency.tick",
-			payload: {
-				tool: tool.name,
-				latest,
-				status: "stale-manual-update-required",
-				repo: vs.repo,
-			},
-		});
-		return false;
-	}
-
-	if (tool.kind === "js" && tool.install_dir) {
-		// JS tool: bun add in the install_dir
-		const result = await spawn({
-			name: `singleton-tools-currency:install-${tool.name}`,
-			command: ["bun", "add", `${vs.name}@${vs.dist_tag}`],
-			cwd: tool.install_dir,
-			timeoutMs: 300_000,
-		});
-		if ((result.exitCode ?? -1) !== 0) {
-			log.error(
-				`[singleton-tools-currency] ${tool.name} install failed (exit ${result.exitCode}): ${(result.stderr ?? "").slice(0, 200)}`,
-			);
-			return false;
-		}
-		return true;
-	}
-
-	if (tool.kind === "elf") {
-		// ELF tool: bun add -g
-		const result = await spawn({
-			name: `singleton-tools-currency:install-${tool.name}`,
-			command: ["bun", "add", "-g", `${vs.name}@${vs.dist_tag}`],
-			timeoutMs: 300_000,
-		});
-		if ((result.exitCode ?? -1) !== 0) {
-			log.error(
-				`[singleton-tools-currency] ${tool.name} global install failed (exit ${result.exitCode}): ${(result.stderr ?? "").slice(0, 200)}`,
-			);
-			return false;
-		}
-		return true;
-	}
-
-	// bare (bun) — skip, owned by bun-stable-watch
-	log.info(`[singleton-tools-currency] ${tool.name} (bare) — skip, owned by bun-stable-watch`);
-	return false;
-}
-
-async function singletonToolsCurrencyWatch(_ctx: { config: ScheduledJobConfig }): Promise<void> {
-	const log = getAppLogger();
-
-	let config: SingletonToolsConfig;
-	try {
-		config = loadRegistryConfig("config", "scala-singleton-tools") as never as SingletonToolsConfig;
-	} catch (err) {
-		log.warn(
-			`[singleton-tools-currency] cannot load config/scala-singleton-tools — skip: ${err instanceof Error ? err.message : String(err)}`,
-		);
-		recordEvent({
-			kind: "singleton-tools.currency.tick",
-			payload: { note: "config/scala-singleton-tools unreadable" },
-		});
-		return;
-	}
-
-	for (const tool of config.tools) {
-		const vs = tool.version_source;
-		if (!vs) {
-			// A tool with no version_source is NOT tracked, and that must be loud.
-			// This previously `continue`d silently as "not yet inside the mechanism",
-			// which is how a gap becomes permanent: nothing distinguishes a tool
-			// nobody has declared from one that is up to date, so the watcher reports
-			// a clean tick while the tool rots. That is the exact shape of
-			// `a-component-may-not-report-a-state-it-has-not-verified` — the run
-			// advertises coverage it never performed.
-			log.warn(
-				`[singleton-tools-currency] ${tool.name}: NO version_source — not tracked, cannot be kept current. Add one to config/scala-singleton-tools.`,
-			);
-			recordEvent({
-				kind: "singleton-tools.currency.tick",
-				payload: { tool: tool.name, status: "no-version-source" },
-			});
-			continue;
-		}
-
-		if (tool.kind === "bare") {
-			// bun: owned by bun-stable-watch; log a tick so the gap is observable
-			recordEvent({
-				kind: "singleton-tools.currency.tick",
-				payload: { tool: tool.name, status: "deferred-to-bun-stable-watch" },
-			});
-			continue;
-		}
-
-		const installed = await readInstalledVersion(tool);
-		if (!installed) {
-			log.warn(`[singleton-tools-currency] ${tool.name}: cannot read installed version — skip`);
-			recordEvent({
-				kind: "singleton-tools.currency.tick",
-				payload: { tool: tool.name, installed: null, note: "unreadable" },
-			});
-			continue;
-		}
-
-		// Branch on the discriminant, never on a field's presence — an unhandled
-		// variant is a compile error here rather than a silent fall-through to npm.
-		const latest =
-			vs.type === "npm_package"
-				? await fetchLatestVersion(vs.name, vs.dist_tag)
-				: await fetchLatestGithubRelease(vs.repo);
-		if (!latest) {
-			log.warn(`[singleton-tools-currency] ${tool.name}: cannot fetch latest — skip`);
-			recordEvent({
-				kind: "singleton-tools.currency.tick",
-				payload: { tool: tool.name, installed, latest: null, note: "dist-tag unreadable" },
-			});
-			continue;
-		}
-
-		if (!semverLt(installed, latest)) {
-			recordEvent({
-				kind: "singleton-tools.currency.tick",
-				payload: { tool: tool.name, installed, latest, status: "current" },
-			});
-			continue;
-		}
-
-		// STALE — reinstall
-		log.warn(
-			`[singleton-tools-currency] ${tool.name} ${installed} < latest ${latest} — reinstalling`,
-		);
-		const ok = await reinstallTool(tool, latest);
-		if (ok) {
-			recordEvent({
-				kind: "singleton-tools.currency.reinstalled",
-				payload: { tool: tool.name, from: installed, to: latest },
-			});
-		} else {
-			recordEvent({
-				kind: "singleton-tools.currency.install-failed",
-				payload: { tool: tool.name, from: installed, to: latest },
-			});
-		}
-	}
-}
-
-pgBossHandlerRegistry.register(
-	"@teamscala/service-boot:singleton-tools-currency-watch",
-	singletonToolsCurrencyWatch,
-);

package/src/handlers/sweep-event-log.ts

@@ -1,98 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The `event-log-sweep` pg-boss handler. Reads the `retention` map from
- * the `scheduled_job` row config and sweeps the two dev-host operational
- * log tables via `@teamscala/event-log`'s sweep executors (those run
- * through the event-log primitive's configured writer — neither table is
- * a Prisma model, and the audited @teamscala/db client blocks raw SQL, so
- * the primitive owns their lifecycle).
- *
- * Retention map convention (values are durations, "90 days"):
- *   "event_log"            → default window for kinds with no override
- *   "event_log:<prefix>"   → kind-prefix override (e.g. "event_log:guard.gate." for gate-latency telemetry)
- *   "hook_execution_log"   → flat window for the agent-CLI hook log
- * auth.* events are permanent regardless of config (enforced in the sweep
- * executor). Unknown keys are skipped + logged, never executed.
- *
- * Registered under slug `@teamscala/service-boot:sweep-event-log`.
- */
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { sweepHookExecutionLog, sweepOldEvents } from "@teamscala/event-log/sweep-old";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-
-const DURATION_RE = /^(\d+)\s+(day|week|month)s?$/;
-const UNIT_TO_DAYS: Record<string, number> = {
-	day: 1,
-	week: 7,
-	month: 30,
-};
-
-function parseDays(raw: string): number | null {
-	const match = DURATION_RE.exec(raw.trim());
-	if (!match) return null;
-	return Number(match[1]) * (UNIT_TO_DAYS[match[2] as string] ?? 0);
-}
-
-async function sweepEventLog(ctx: {
-	config: { retention?: Record<string, string> };
-}): Promise<void> {
-	const log = getAppLogger();
-	const retention = ctx.config.retention ?? {};
-
-	let defaultDays: number | undefined;
-	const byPrefix: Record<string, number> = {};
-	let hookLogDays: number | null = null;
-
-	for (const [key, rawValue] of Object.entries(retention)) {
-		const days = parseDays(rawValue);
-		if (days === null || days <= 0) {
-			log.warn(
-				`[event-log-sweep] skipping "${key}" — value "${rawValue}" is not a day-granularity duration (expected e.g. "90 days")`,
-			);
-			continue;
-		}
-		if (key === "event_log") defaultDays = days;
-		else if (key.startsWith("event_log:")) byPrefix[key.slice("event_log:".length)] = days;
-		else if (key === "hook_execution_log") hookLogDays = days;
-		else {
-			log.warn(`[event-log-sweep] skipping "${key}" — not a sweep target this handler knows`);
-		}
-	}
-
-	const events = await sweepOldEvents({
-		retentionDays: defaultDays,
-		retentionByPrefix: byPrefix,
-	});
-	log.info(
-		`[event-log-sweep] event_log: ${events.deleted} row(s) swept (default cutoff ${events.cutoffAt.toISOString()}, ${Object.keys(byPrefix).length} prefix override(s))`,
-	);
-
-	let hookLogDeleted: number | null = null;
-	if (hookLogDays !== null) {
-		const hooks = await sweepHookExecutionLog(hookLogDays);
-		hookLogDeleted = hooks.deleted;
-		log.info(
-			`[event-log-sweep] hook_execution_log: ${hooks.deleted} row(s) swept (cutoff ${hooks.cutoffAt.toISOString()})`,
-		);
-	}
-
-	// Liveness signal: loga's sweep-liveness watchdog escalates if no
-	// sweep.completed event lands within 48h (a silently-stopped sweep means
-	// unbounded event_log growth returns). Recorded AFTER the sweep so a failed
-	// sweep emits no heartbeat.
-	recordEvent({
-		kind: "sweep.completed",
-		payload: {
-			eventLogDeleted: events.deleted,
-			hookLogDeleted,
-			cutoffAt: events.cutoffAt.toISOString(),
-			completedAt: new Date().toISOString(),
-		},
-	});
-}
-
-pgBossHandlerRegistry.register("@teamscala/service-boot:sweep-event-log", sweepEventLog);

package/src/handlers/upstream-issue-sync.ts

@@ -1,220 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The `upstream-issue-sync` pg-boss handler (doctrine `upstream-issues-tracked-in-
- * registry`). For each active `upstream_issue` registry row it polls the row's
- * GitHub issue + comments and writes back `state` / `comment_count` /
- * `last_comment_at` / `latest_response` / `last_synced_at`, emitting
- * `recordEvent({ kind: "upstream.issue.response" })` when a NEW maintainer
- * (non-filer) comment appears — so a maintainer response on an issue we filed
- * never goes unnoticed.
- *
- * Polls via the authenticated `gh` CLI (`@teamscala/os` spawn — `gh api` is the
- * off-the-shelf GitHub client; NOT a bespoke fetch). There is deliberately NO
- * `@teamscala/api-github` adapter: one existed as a hand-written `rest_client`
- * row with zero importers — this handler chose the CLI instead — so it was
- * deleted on 2026-09-02 rather than converted to a spec-derived adapter. GitHub
- * publishes an OpenAPI spec, so if a future consumer needs typed access the
- * answer is a spec-derived row, never a hand-listed one.
- *
- * Registered under slug `@teamscala/service-boot:upstream-issue-sync`. Mirrors
- * `bun-stable-watch` (dev-host pg-boss handler). Reads rows via the `getAllEntries`
- * helper and writes back via `persistRegistryEntryConfig` (the validated
- * registry_entries writer — `registry-via-helper` blocks direct registry Prisma
- * in package code).
- */
-import { getAllEntries } from "@teamscala/db/registry/accessors";
-import { persistRegistryEntryConfig } from "@teamscala/db/registry/persist-entry-config";
-import { validateRow } from "@teamscala/db-validation/validate-row";
-import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { spawn } from "@teamscala/os/spawn";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import * as v from "valibot";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-import { createCache } from "@teamscala/cache/create-cache";
-
-interface GhIssue {
-	state: string;
-	comments: number;
-	author: string;
-}
-
-interface GhComment {
-	author: string;
-	at: string;
-	body: string;
-}
-
-interface CapturedResponse {
-	author: string;
-	excerpt: string;
-	at: string;
-}
-
-const DEFAULT_GH_TIMEOUT_MS = 20_000;
-const ghTimeoutCache = createCache<number>("service-boot:gh-timeout", {
-	ttlMs: Number.POSITIVE_INFINITY,
-	maxSize: 1,
-});
-
-async function getGhTimeoutMs(): Promise<number> {
-	const hit = ghTimeoutCache.get("default");
-	if (hit !== undefined) return hit;
-	const row = await loadRegistryConfig("config", "upstream-issue-sync", v.looseObject({}));
-	const timeoutMs = (row?.gh_timeout_ms as number | undefined) ?? DEFAULT_GH_TIMEOUT_MS;
-	ghTimeoutCache.set("default", timeoutMs);
-	return timeoutMs;
-}
-const EXCERPT_MAX = 160;
-
-/** Fetch a GitHub issue's state/comment-count/author via `gh api`. */
-async function ghIssue(owner: string, repo: string, number: number): Promise<GhIssue | null> {
-	const { stdout, exitCode, stderr } = await spawn({
-		name: "upstream-issue-sync:gh-issue",
-		command: [
-			"gh",
-			"api",
-			`repos/${owner}/${repo}/issues/${number}`,
-			"--jq",
-			"{state: .state, comments: .comments, author: .user.login}",
-		],
-		timeoutMs: await getGhTimeoutMs(),
-	});
-	if (exitCode !== 0) {
-		getAppLogger().warn(
-			`[upstream-issue-sync] gh api issue ${owner}/${repo}#${number} failed: ${stderr.trim() || stdout.trim()}`,
-		);
-		return null;
-	}
-	try {
-		return JSON.parse(stdout) as GhIssue;
-	} catch {
-		return null;
-	}
-}
-
-/** Fetch a GitHub issue's comments via `gh api` (per_page=100). */
-async function ghComments(owner: string, repo: string, number: number): Promise<GhComment[]> {
-	const { stdout, exitCode } = await spawn({
-		name: "upstream-issue-sync:gh-comments",
-		command: [
-			"gh",
-			"api",
-			`repos/${owner}/${repo}/issues/${number}/comments?per_page=100`,
-			"--jq",
-			"[.[] | {author: .user.login, at: .created_at, body: .body}]",
-		],
-		timeoutMs: await getGhTimeoutMs(),
-	});
-	if (exitCode !== 0) return [];
-	try {
-		const parsed = JSON.parse(stdout) as GhComment[];
-		return Array.isArray(parsed) ? parsed : [];
-	} catch {
-		return [];
-	}
-}
-
-function excerpt(body: string): string {
-	const flat = body.replace(/\s+/g, " ").trim();
-	return flat.length > EXCERPT_MAX ? `${flat.slice(0, EXCERPT_MAX)}…` : flat;
-}
-
-/**
- * The newest comment NOT by the issue filer (a maintainer response), or null.
- * GitHub returns comments oldest-first; sort by `at` to be safe.
- */
-function newestMaintainerResponse(
-	comments: GhComment[],
-	filer: string,
-): CapturedResponse | null {
-	const external = comments
-		.filter((c) => c.author !== filer)
-		.sort((a, b) => (a.at < b.at ? 1 : a.at > b.at ? -1 : 0));
-	const newest = external[0];
-	if (!newest) return null;
-	return { author: newest.author, excerpt: excerpt(newest.body), at: newest.at };
-}
-
-async function upstreamIssueSync(_ctx: { config: ScheduledJobConfig }): Promise<void> {
-	const log = getAppLogger();
-
-	const rows = getAllEntries().filter(
-		(e) => (e.type as string) === "upstream_issue" && e.is_active,
-	);
-	if (rows.length === 0) {
-		log.info("[upstream-issue-sync] no active upstream_issue rows");
-		return;
-	}
-
-	let updated = 0;
-	for (const row of rows) {
-		const cfg = row.config as Record<string, unknown>;
-		const repo = String(cfg.repo ?? "");
-		const issueNumber = Number(cfg.issue_number);
-		const [owner, repoName] = repo.split("/");
-		if (!owner || !repoName || !Number.isInteger(issueNumber)) {
-			log.warn(`[upstream-issue-sync] row ${row.slug} has invalid repo/issue_number`);
-			continue;
-		}
-
-		const issue = await ghIssue(owner, repoName, issueNumber);
-		if (!issue) continue; // gh failure already logged; skip this row this cycle
-		const comments = await ghComments(owner, repoName, issueNumber);
-		const lastCommentAt =
-			comments.length > 0 ? (comments.map((c) => c.at).sort().at(-1) ?? null) : null;
-		const latestResponse = newestMaintainerResponse(comments, issue.author);
-
-		const prevResponseAt = (
-			cfg.latest_response as { at?: string } | null | undefined
-		)?.at ?? null;
-
-		const nowIso = new Date().toISOString();
-		const nextConfig = {
-			...cfg,
-			state: issue.state === "closed" ? "closed" : "open",
-			comment_count: issue.comments,
-			last_comment_at: lastCommentAt,
-			latest_response: latestResponse,
-			last_synced_at: nowIso,
-		};
-
-		try {
-			await persistRegistryEntryConfig("upstream_issue", row.slug, nextConfig, validateRow);
-		} catch (err) {
-			log.warn(
-				`[upstream-issue-sync] row ${row.slug} write failed (validation or db): ${err instanceof Error ? err.message : String(err)}`,
-			);
-			continue;
-		}
-		updated += 1;
-
-		// New maintainer response? (newer than the previously-recorded one)
-		const isNewResponse =
-			latestResponse !== null && (prevResponseAt === null || latestResponse.at > prevResponseAt);
-		if (isNewResponse) {
-			recordEvent({
-				kind: "upstream.issue.response",
-				payload: {
-					slug: row.slug,
-					repo,
-					issue_number: issueNumber,
-					author: latestResponse.author,
-					excerpt: latestResponse.excerpt,
-					at: latestResponse.at,
-				},
-			});
-			log.info(
-				`[upstream-issue-sync] ${row.slug}: new maintainer response from @${latestResponse.author}`,
-			);
-		}
-	}
-
-	log.info(`[upstream-issue-sync] synced ${updated}/${rows.length} upstream_issue rows`);
-}
-
-pgBossHandlerRegistry.register("@teamscala/service-boot:upstream-issue-sync", upstreamIssueSync);