@teamscala/service-boot 0.23.516 → 0.23.518

package/src/agreement-gate/settings.ts

@@ -22,14 +22,7 @@ export const AG_COOKIE = "ag_token";
  * before signing). title is the fallback used when no agreement name resolves. A
  * missing/invalid row falls back to these defaults so the gate UI ALWAYS renders.
  */
-export interface AgreementGateSettings {
-	title: string;
-	subtitle: string;
-	submitLabel: string;
-	requireOtp: boolean;
-}
-
-export const AGREEMENT_GATE_DEFAULTS: AgreementGateSettings = {
+export const AGREEMENT_GATE_DEFAULTS = {
 	title: "Private document",
 	subtitle: "Verify your email to view and sign this document.",
 	submitLabel: "Access document",
@@ -43,6 +36,13 @@ const AgreementGateSettingsSchema = v.object({
 	requireOtp: v.optional(v.boolean(), AGREEMENT_GATE_DEFAULTS.requireOtp),
 });
 
+/**
+ * The settings type is the SCHEMA'S output, never a hand mirror
+ * (`autosave-single-surface` rule 2): the interface re-spelled the schema one
+ * block away and drifts the first time the schema grows a field.
+ */
+export type AgreementGateSettings = v.InferOutput<typeof AgreementGateSettingsSchema>;
+
 /** Gate copy/behaviour, or null when the config row is absent/broken. Null is
  *  the absent signal — callers default explicitly so a missing row neither 500s
  *  the page nor masks as a populated value (protective-layers-fail-explicitly). */

package/src/apply-logger-config.test.ts

@@ -0,0 +1,46 @@
+/**
+ * @status generated — ts-api-smoke template (scala-test-suites
+ * templates/ts_api_smoke.pkl @1.3.0) over the exports map of @teamscala/service-boot.
+ * ./apply-logger-config declares 1 runtime export(s) and 3 declared behaviour vector(s);
+ * this suite asserts the import resolves, the runtime surface matches
+ * exactly, and every export carries its declared kind. Regenerate from
+ * inputs/bun-server-service-boot/api_smoke.json (scala-test-suites) — hand edits are
+ * overwritten.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { mock } from "bun:test";
+const __setMinLevel: string[] = [];
+const __fileSinks: Record<string, unknown>[] = [];
+mock.module("@teamscala/logger/creator", () => ({ setMinLevel: (level: string) => { __setMinLevel.push(level); } }));
+mock.module("@teamscala/logger/file-sink", () => ({ configureFileSink: (cfg: Record<string, unknown>) => { __fileSinks.push(cfg); } }));
+
+const mod = await import("./apply-logger-config");
+
+const { applyLoggerConfig } = mod;
+
+describe("apply-logger-config exports-map smoke", () => {
+	it("the runtime export set is exactly the declared surface", () => {
+		expect(Object.keys(mod).sort()).toEqual([
+			"applyLoggerConfig",
+		]);
+	});
+	it("applyLoggerConfig is a function", () => {
+		expect(typeof mod["applyLoggerConfig"]).toBe("function");
+	});
+	it("a declared min level reaches the logger creator", async () => {
+		__setMinLevel.length = 0;
+		applyLoggerConfig({ minLevel: "debug" });
+		expect(__setMinLevel).toEqual(["debug"]);
+	});
+	it("an undeclared min level leaves the creator untouched", async () => {
+		__setMinLevel.length = 0;
+		applyLoggerConfig({});
+		expect(__setMinLevel).toEqual([]);
+	});
+	it("the file sink is configured from the boot row's own values", async () => {
+		__fileSinks.length = 0;
+		applyLoggerConfig({ logDir: "/var/log/scala", maxFileSize: 10, maxFiles: 3 });
+		expect(__fileSinks).toEqual([{ logDir: "/var/log/scala", maxFileSize: 10, maxFiles: 3 }]);
+	});
+});

package/src/apply-logger-config.ts

@@ -0,0 +1,31 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Late-stage logger configuration — runs AFTER Registry is loaded (the boot
+ * pipeline's `apply-logger-config` phase), injecting the DB-driven settings
+ * into the logger primitive. Split from install-logging.ts under
+ * single-purpose-file: the early bootstrap (hardcoded defaults, primitive
+ * injection) and this late reconfiguration are two phases, and the guard
+ * counts them as two export groups in one file.
+ */
+
+import { setMinLevel } from "@teamscala/logger/creator";
+import { configureFileSink } from "@teamscala/logger/file-sink";
+
+export function applyLoggerConfig(config: {
+	minLevel?: "debug" | "info" | "warn" | "error";
+	logDir?: string;
+	maxFileSize?: number;
+	maxFiles?: number;
+}): void {
+	if (config.minLevel) {
+		setMinLevel(config.minLevel);
+	}
+	configureFileSink({
+		logDir: config.logDir,
+		maxFileSize: config.maxFileSize,
+		maxFiles: config.maxFiles,
+	});
+}

package/src/asset-proxy.test.ts

@@ -23,10 +23,14 @@ describe("handleAssetProxy", () => {
 
 	it("reaches the S3 client for a valid asset key (no early 404)", async () => {
 		// A valid key passes the path + key guards and proceeds to getClient.
-		// With no registry/env in the test context getClient cannot resolve and
-		// rejects — proving the handler did NOT short-circuit on the path/key.
-		await expect(
-			handleAssetProxy(new Request("https://host.example/api/assets/logo.png")),
-		).rejects.toThrow();
+		// getClient's contract is ABSENT CREDS → null — "a visible config
+		// error", never a rejection and never a silent 404 (object-storage
+		// get-client; getCredentials never throws) — so the resolved 502 is
+		// the evidence the handler reached the client step rather than
+		// short-circuiting on the path or key.
+		const res = await handleAssetProxy(
+			new Request("https://host.example/api/assets/logo.png"),
+		);
+		expect(res.status).toBe(502);
 	});
 });

package/src/auth/sign-out.ts

@@ -0,0 +1,122 @@
+/**
+ * @system service-boot
+ * @status handwritten — none derivable: the api_route row (fn-auth-sign-out) declares the path, auth and input, not a body; host-bus-handler-contracts emits the client node + wiring FROM the row, never a procedure body; the sign-out mechanism is BetterAuth's `auth.api.signOut` on the app's own session + the /api/auth/* → scala-otp forward that auth-gate already performs (the body composes those two, it is not generated from either).
+ * @edit edit directly
+ *
+ * The fn.auth.signOut procedure body (api_route `fn-auth-sign-out`, authed:
+ * context). It is the host-side sign-out the Button logout action calls
+ * through the generated ORPC client node, replacing the raw browser POST to
+ * /api/auth/sign-out. It takes no input — sign-out has no fields — so the
+ * generated node is called as `orpcClient.fn.auth.signOut()`, the same no-arg
+ * shape as fn.chat.health.
+ *
+ * WHY A PROCEDURE, NOT THE RAW FETCH. The old client called
+ * `/api/auth/sign-out` directly. That path is only served when the host is
+ * running the auth gate's `/api/auth/*` forward or a local BetterAuth handler,
+ * and it is a bare string path the client hard-codes — a second, unnamed
+ * statement of "where sign-out lives". Declaring it as an api_route procedure
+ * gives it the one home (the registry row) the rest of the auth surface uses,
+ * and the generated node carries the path.
+ *
+ * WHAT IT DOES, IN ORDER, so server-side behaviour is UNCHANGED from the
+ * forwarded POST:
+ *  1. Revoke the caller's session through the SAME BetterAuth instance the
+ *     session-read path uses (getAuth() — the bridge auth-gate installs, so
+ *     it validates through the identical factory). This deletes the session
+ *     row and returns the Set-Cookie headers that clear it.
+ *  2. When SCALA_OTP_URL is set — centralised auth, per otp-centralised-via-
+ *     otp-service — forward the same POST to scala-otp's /api/auth/sign-out
+ *     with the caller's cookie, so the central service clears the shared
+ *     Domain=.scala.business session too. The local revoke alone would leave
+ *     the central session alive. The caller's cookie is carried forward and
+ *     scala-otp's response status is checked, so a central refusal is reported
+ *     rather than swallowed — the same POST the /api/auth/* forward in
+ *     auth-gate performs.
+ *
+ * HONEST RESIDUAL: the ORPC response is JSON, so the Set-Cookie headers
+ * BetterAuth returns on its Response cannot ride back to the browser through
+ * this procedure. The session is revoked in the database on both sides, and
+ * the caller redirects to the sign-in path, so the browser presents a
+ * revoked-and-deleted session token on its next request and the auth gate
+ * rejects it — the same observable outcome as the forwarded POST, whose
+ * cleared cookie was an optimisation. Clearing the cookie explicitly is the
+ * caller's business (the raw /api/auth/clear-stale-cookies route), not this
+ * procedure's.
+ */
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+
+export interface SignOutResult {
+	/** True once the local session is revoked (and the central one, when centralised). */
+	ok: boolean;
+	/** True when the sign-out was forwarded to scala-otp. */
+	forwarded: boolean;
+}
+
+interface SignOutContext {
+	headers?: Headers;
+}
+
+export async function signOut(context: SignOutContext): Promise<SignOutResult> {
+	// The auth gate registers the BetterAuth factory at boot for every authed
+	// service (auth-gate.ts), so this consumes getAuth() and does NOT
+	// re-register: registerAuthFactory drops the memoized instance on every
+	// call, so a per-request registration would rebuild the whole better-auth
+	// module graph on each sign-out. getAuth() throws if no factory is
+	// registered, which the authed middleware has already excluded.
+	const { getAuth } = await import("@teamscala/auth/auth-registry.ts");
+	const auth = await getAuth();
+	const headers = context?.headers ?? new Headers();
+
+	// 1. Revoke the local session through the app's own BetterAuth instance.
+	//    The ORPC handler's headers carry the session cookie, so signOut finds
+	//    and deletes that exact session.
+	const local = await auth.api.signOut({ headers });
+	const localOk = Boolean(local?.success);
+
+	const otpUrl = process.env.SCALA_OTP_URL;
+	if (!otpUrl) {
+		if (!localOk) {
+			getAppLogger().warn("[auth-sign-out] local signOut reported no session");
+		}
+		return { ok: localOk, forwarded: false };
+	}
+
+	// 2. Centralised auth: forward to scala-otp so the shared session is
+	//    cleared there too, carrying the caller's cookie forward and the
+	//    Set-Cookie back. Same shape as the /api/auth/* forward in auth-gate.
+	const otpBase = otpUrl.replace(/\/+$/, "");
+	const target = `${otpBase}/api/auth/sign-out`;
+	const cookie = headers.get("cookie");
+	try {
+		const fwdHeaders = new Headers();
+		if (cookie) fwdHeaders.set("cookie", cookie);
+		fwdHeaders.set("host", new URL(otpBase).host);
+		fwdHeaders.set("content-type", "application/json");
+		const upstream = await fetch(target, {
+			method: "POST",
+			headers: fwdHeaders,
+			body: "{}",
+		});
+		// A central refusal must not masquerade as a successful sign-out: the
+		// local session is already gone, but the shared one is not, so report
+		// ok:false and let the caller see it.
+		if (!upstream.ok) {
+			getAppLogger().error("[auth-sign-out] scala-otp sign-out refused", {
+				target,
+				status: upstream.status,
+			});
+			return { ok: false, forwarded: true };
+		}
+		return { ok: localOk, forwarded: true };
+	} catch (err) {
+		getAppLogger().error("[auth-sign-out] failed to reach scala-otp", {
+			target,
+			error: err instanceof Error ? err.message : String(err),
+		});
+		// The local session is revoked; the central one may still be live. This
+		// is a partial success the caller must be able to see, so it is
+		// returned rather than thrown — throwing would 500 an otherwise-usable
+		// sign-out that did clear the local cookie.
+		return { ok: false, forwarded: true };
+	}
+}

package/src/build-client-assets/hydrate-bundle.ts

@@ -58,7 +58,7 @@
 import { mkdir, readdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { fileHash, removeStaleHashedFiles } from "./hashed-output.ts";
+import { removeStaleHashedFiles } from "./hashed-output.ts";
 import {
 	uploadSourceMaps,
 	type SourceMapUploadResult,
@@ -265,9 +265,19 @@ export async function buildHydrateBundle(
 	}
 	const hashedName = entryOutput.path.split("/").pop() as string;
 	const hashedPath = join(outDir, hashedName);
-	const hash =
-		/^hydrate-([A-Za-z0-9]+)\.js$/.exec(hashedName)?.[1] ??
-		(await fileHash(hashedPath));
+	// The bundler OWNS this name (naming.entry above). Read the release hash
+	// out of it; a name that no longer matches the declared
+	// hydrate-<hash>.js shape means the naming contract changed underneath
+	// us — refuse rather than re-derive a second hash from file bytes
+	// (`one-generator-pattern`): a fallback here would produce a release id
+	// the URL does not carry.
+	const hashMatch = /^hydrate-([A-Za-z0-9]+)\.js$/.exec(hashedName);
+	if (!hashMatch) {
+		throw new Error(
+			`[build-client-assets] Bun.build entry output "${hashedName}" does not match the declared hydrate-<hash>.js naming — refusing to ship a bundle whose release id cannot be read from its own name`,
+		);
+	}
+	const hash = hashMatch[1];
 	removeStaleHashedFiles(outDir, HYDRATE_BASE, "js", hashedName);
 
 	// Splitting emits one chunk per lazy import() alongside the entry. Keep the

package/src/build-client-assets/manifest.ts

@@ -28,22 +28,10 @@ export interface AssetManifest {
 	// tombstone reads as unbuilt everywhere (verification, readiness, render).
 	stylesPath?: string;
 	hydratePath?: string;
-	// Content fingerprint of the CLIENT-BUNDLE DEPENDENCY CLOSURE (source entrypoints + @teamscala/* JS/CSS in the closure + third-party closure-dep
-	// versions), hashed by CONTENT — never mtime (cache-key-hashes-source- inputs-only). The boot/build freshness check rebuilds iff this differs
-	// from the current closure. mtime comparison is fundamentally broken on Railway: deploy-build bakes the bundle at image-build time, and under the
-	// hoisted linker + warm `bun-install` cache the installed @teamscala/* files are hardlinks carrying OLD extraction mtimes while the baked manifest's
-	// mtime is newer — so `source.mtime > manifest.mtime` is false and the build wrongly skips, baking (then serving forever) a STALE client bundle
-	// even though a newer @teamscala/* version is installed. Observed 2026-06-14:
-	// scala-gpt shipped ui-foundation < 85 in the bundle while a newer version
-	// was installed, so a published+installed fix never reached the browser.
-	// Content hashing of the closure is immune to mtime games. bun.lock is
-	// excluded by design — see computeInputFingerprint.
-	inputFingerprint?: string;
 	// TOMBSTONE fields — present iff the last build FAILED (no-silent-reverts).
 	// `buildFailed: true` + reason + timestamp are written by performBuild
-	// before it re-throws. The next boot's fingerprint check sees the
-	// `failed:<iso>` sentinel and cannot match → forces a retry (no silent
-	// skip on the stale manifest). read-html-template reads these to stamp
+	// before it re-throws; every boot rebuilds unconditionally, so the failed
+	// build is retried by construction. read-html-template reads these to stamp
 	// the served HTML with the failure status (operator-visible signal that
 	// the bundle is stale, not fresh).
 	buildFailed?: boolean;
@@ -52,9 +40,9 @@ export interface AssetManifest {
 	// VERIFIED outcome of the last source-map upload attempt for THIS build's
 	// release (`uploaded` = every response checked 2xx; `failed` names each
 	// rejection in `failures`; `skipped` = no SENTRY_AUTH_TOKEN/SENTRY_URL).
-	// The fingerprint-skip path reads it: any status other than `uploaded`
-	// re-runs the upload from the retained map cache on every boot until it
-	// verifies — an unuploaded release must not silently persist forever.
+	// Every boot rebuilds and re-attempts the upload, so a failed upload is
+	// retried until it verifies — an unuploaded release must not silently
+	// persist forever.
 	sourceMaps?: SourceMapUploadResult;
 }
 
@@ -94,7 +82,6 @@ export async function readManifest(outDir: string): Promise<AssetManifest | null
 			return {
 				stylesPath: parsed.stylesPath,
 				hydratePath: parsed.hydratePath,
-				inputFingerprint: parsed.inputFingerprint,
 				buildFailed: parsed.buildFailed,
 				buildFailedReason: parsed.buildFailedReason,
 				buildFailedAt: parsed.buildFailedAt,

package/src/build-client-assets/styles-build.test.ts

@@ -12,6 +12,7 @@ import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { bunResolveStylesheet } from "./styles-build.ts";
+import { compile } from "tailwindcss";
 
 async function makeTree(tag: string, files: Record<string, string>) {
 	const root = join(tmpdir(), `styles-build-${tag}-${process.pid}`);
@@ -25,14 +26,14 @@ async function makeTree(tag: string, files: Record<string, string>) {
 }
 
 describe("bunResolveStylesheet — relative ids", () => {
-	test("a relative import that exists resolves and inlines its nested @imports", async () => {
+	test("a relative import that exists resolves and returns raw content", async () => {
 		const root = await makeTree("rel-ok", {
 			"src/entry.css": '@import "./leaf.css";\n.body { color: red; }\n',
 			"src/leaf.css": ".leaf { color: blue; }\n",
 		});
 		const r = await bunResolveStylesheet("./entry.css", join(root, "src"), root);
 		expect(r.content).toContain(".body");
-		expect(r.content).toContain(".leaf");
+		expect(r.content).not.toContain(".leaf");
 		await rm(root, { recursive: true, force: true });
 	});
 
@@ -130,7 +131,7 @@ describe("bunResolveStylesheet — remote @imports", () => {
 		await rm(root, { recursive: true, force: true });
 	});
 
-	test("a LOCAL @import of a missing file THROWS at the build instead of leaving a literal", async () => {
+	test("a LOCAL @import of a missing file THROWS at compile, not the resolver, instead of leaving a literal", async () => {
 		const root = await makeTree("local-missing-nested", {
 			"node_modules/broken-pkg/package.json": JSON.stringify({
 				name: "broken-pkg",
@@ -139,11 +140,13 @@ describe("bunResolveStylesheet — remote @imports", () => {
 			"node_modules/broken-pkg/index.css": '@import "./gone.css";\n.real { color: red; }\n',
 			"src/app.css": ".x { color: red; }\n",
 		});
-		const err = await bunResolveStylesheet(
-			"broken-pkg",
-			join(root, "src"),
-			root,
-		).catch((e) => e);
+		const r = await bunResolveStylesheet("broken-pkg", join(root, "src"), root);
+		expect(r.content).toContain('@import "./gone.css"');
+		const err = await compile(r.content, {
+			async loadStylesheet(id, base) {
+				return bunResolveStylesheet(id, base, root);
+			},
+		}).catch((e) => e);
 		expect(err).toBeInstanceOf(Error);
 		expect((err as Error).message).toContain('"./gone.css"');
 		await rm(root, { recursive: true, force: true });

package/src/build-client-assets/styles-build.ts

@@ -4,9 +4,19 @@
  * @edit edit directly
  *
  * The Tailwind stylesheet unit of the client-asset build: Bun-native
- * stylesheet resolution, recursive inlining of nested @imports (the
- * 2026-07-05 dropped-leaf outage), stripping of remote (CSP-forbidden)
- * @imports, and the content-hashed styles-<hash>.css build.
+ * stylesheet resolution returning RAW content, stripping of remote
+ * (CSP-forbidden) @imports, and the content-hashed styles-<hash>.css
+ * build.
+ *
+ * NESTED @IMPORTS ARE THE SUPPLIER'S JOB: tailwind 4.3.3's compile()
+ * re-invokes loadStylesheet for every @import INSIDE loaded content and
+ * splices the loaded nodes into the tree (verified in the installed
+ * dist source — the dr() recursion, depth-capped at 100), so a present
+ * nested leaf is inlined by the supplier and a missing one throws at
+ * compile; the suite pins both. The 2026-07-05 dropped-leaf outage was
+ * guarded by an in-process flattener here; with the supplier recursion
+ * verified the flattener is a second owner of the same fact and is
+ * deleted.
  *
  * Split out of build-client-assets.ts (962 lines) alongside its build
  * siblings. Byte-for-byte move from the parent — imports adjusted, nothing
@@ -22,7 +32,7 @@ import { mkdir, rename } from "node:fs/promises";
 
 const STYLES_BASE = "styles";
 
-async function resolveStylesheetRaw(
+export async function bunResolveStylesheet(
 	id: string,
 	base: string,
 	cwd: string,
@@ -118,65 +128,6 @@ async function resolveStylesheetRaw(
 	);
 }
 
-// Tailwind v4's compile() invokes `loadStylesheet` for DIRECT @imports in the entry (app.css) but does NOT re-invoke it for @imports WITHIN the loaded
-// content — so a package styles.css that itself `@import "./Leaf.css"` (a nested RELATIVE import) has its leaf silently dropped from the prod bundle.
-// This dropped every block-specific class reachable only via a nested
-// relative @import (project-list-view/ProjectListView.css's
-// .nested-list-table-host, audit-block's nested css, etc.) while direct
-// package @imports (generic-ui/blk-utilities → .blk-*) survived — the
-// 2026-07-05 #6 outage (broken projects UI). Inline nested @imports here so
-// the content returned to Tailwind is flat; the compile() loadStylesheet
-// callback then never sees a nested @import it would drop. Cycle-safe via
-// `seen` (mirrors hashResolvedPackageStylesheet's transitive walk).
-const CSS_IMPORT_RE = /@import\s+(?:url\()?\s*["']([^"']+)["']\s*\)?[^;]*;?/g;
-async function inlineCssImports(
-	css: string,
-	base: string,
-	cwd: string,
-	seen: Set<string>,
-): Promise<string> {
-	let result = "";
-	let lastIdx = 0;
-	for (const m of css.matchAll(CSS_IMPORT_RE)) {
-		const spec = m[1].trim();
-		result += css.slice(lastIdx, m.index);
-		lastIdx = (m.index ?? 0) + m[0].length;
-		// Keep the tailwindcss entry verbatim (Tailwind compile owns it —
-		// including any trailing `source(none)` etc. — via m[0]).
-		if (spec === "tailwindcss" || spec.startsWith("tailwindcss/")) {
-			result += m[0];
-			continue;
-		}
-		// Remote @imports are CSP-forbidden and stripped by
-		// stripRemoteImports AFTER the compile: skip them here EXPLICITLY —
-		// they must never reach resolveStylesheetRaw, and an unresolved
-		// LOCAL import below is a throw, not a swallow.
-		if (spec.startsWith("http://") || spec.startsWith("https://")) {
-			result += m[0];
-			continue;
-		}
-		if (seen.has(spec)) continue; // cycle guard
-		seen.add(spec);
-		const resolved = await resolveStylesheetRaw(spec, base, cwd);
-		result += await inlineCssImports(resolved.content, resolved.base, cwd, seen);
-	}
-	result += css.slice(lastIdx);
-	return result;
-}
-
-async function bunResolveStylesheet(
-	id: string,
-	base: string,
-	cwd: string,
-): Promise<{ path: string; base: string; content: string }> {
-	const resolved = await resolveStylesheetRaw(id, base, cwd);
-	if (id === "tailwindcss" || id.startsWith("tailwindcss/")) return resolved;
-	const content = await inlineCssImports(resolved.content, resolved.base, cwd, new Set([resolved.path]));
-	return { ...resolved, content };
-}
-
-export { bunResolveStylesheet };
-
 // The app owns its fonts via an explicit, CSP-allowlisted <link> in index.html (Google Fonts — `style-src ... fonts.googleapis.com`, `font-src ...
 // fonts.gstatic.com`). Third-party package CSS MUST NOT inject its own remote `@import url(http…)`: @puckeditor/core/dist/index.css opens with
 // `@import "https://rsms.me/inter/inter.css"`, an arbitrary CDN our CSP does NOT allow. The Tailwind compile inlines that mid-output, where it was either

package/src/build-client-assets.test.ts

@@ -11,7 +11,6 @@ import { mkdtemp, mkdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterAll, describe, expect, test } from "bun:test";
-import { computeInputFingerprint } from "./build-client-assets/input-fingerprint.ts";
 import { stripRemoteImports } from "./build-client-assets/styles-build.ts";
 
 describe("stripRemoteImports", () => {
@@ -48,163 +47,3 @@ describe("stripRemoteImports", () => {
 	});
 });
 
-// The client-bundle freshness check keys on input CONTENT, never mtime
-// (cache-key-hashes-source-inputs-only). mtime comparison silently served a
-// stale bundle on Railway (deploy-build bakes at image-build time; hoisted
-// hardlinks carry old mtimes; baked manifest is newer → wrongly skips), so a
-// published+installed @teamscala/* fix never reached the browser (2026-06-14).
-// These tests prove the fingerprint changes iff an input's CONTENT changes.
-describe("computeInputFingerprint", () => {
-	const dirs: string[] = [];
-	async function makeService(files: Record<string, string>): Promise<string> {
-		const dir = await mkdtemp(join(tmpdir(), "bca-fp-"));
-		dirs.push(dir);
-		await mkdir(join(dir, "src"), { recursive: true });
-		for (const [rel, content] of Object.entries(files)) {
-			await mkdir(dirname(join(dir, rel)), { recursive: true });
-			await Bun.file(join(dir, rel)).write(content);
-		}
-		return dir;
-	}
-	afterAll(async () => {
-		for (const d of dirs) await rm(d, { recursive: true, force: true });
-	});
-
-	test("identical inputs → identical fingerprint (skip path)", async () => {
-		const files = {
-			"bun.lock": `{ "ui-foundation": "99.100.86" }`,
-			"src/entry-client.ts": "export {};",
-			"src/page-manifest.ts": "export const M = {};",
-			"src/app.css": ".a{}",
-		};
-		const a = await makeService(files);
-		const b = await makeService(files);
-		expect(await computeInputFingerprint(a)).toBe(
-			await computeInputFingerprint(b),
-		);
-	});
-
-	// `no-uncontrolled-repetition-or-cascade`: bun.lock is NOT an input. A
-	// version bump of a package NOT in this service's client bundle (here
-	// ui-foundation is named in bun.lock but never imported and not installed)
-	// MUST NOT invalidate — otherwise every backend @teamscala/* publish rebuilds
-	// every UI service (the publish→rebuild storm). The closure content hashes
-	// are unchanged, so the fingerprint is identical → skip → storm cannot form.
-	test("a bun.lock change for a NON-closure package → SAME fingerprint (no false rebuild)", async () => {
-		const base = {
-			"src/entry-client.ts": "export {};",
-			"src/page-manifest.ts": "export const M = {};",
-			"src/app.css": ".a{}",
-		};
-		const oldD = await makeService({
-			...base,
-			"bun.lock": `{ "ui-foundation": "99.100.85" }`,
-		});
-		const newD = await makeService({
-			...base,
-			"bun.lock": `{ "ui-foundation": "99.100.86" }`,
-		});
-		expect(await computeInputFingerprint(oldD)).toBe(
-			await computeInputFingerprint(newD),
-		);
-	});
-
-	// The closure-scoped third-party boundary versions: a version bump of a
-	// third-party package that IS in the client closure still invalidates — the
-	// correctness property dropping bun.lock must not regress. The canonical case
-	// is react; a react version bump in the bundle MUST rebuild.
-	test("a third-party closure-dep version bump → different fingerprint (rebuild)", async () => {
-		const makeWith = (version: string) => ({
-			"src/entry-client.ts": `import "fake-react";\n`,
-			"src/page-manifest.ts": "export const M = {};\n",
-			"src/app.css": ".a{}",
-			"node_modules/fake-react/package.json":
-				`{"name":"fake-react","version":"${version}","exports":{".":"./index.js"}}\n`,
-			"node_modules/fake-react/index.js": `export const R = "${version}";\n`,
-		});
-		const before = await makeService(makeWith("1.0.0"));
-		const after = await makeService(makeWith("1.0.1"));
-		expect(await computeInputFingerprint(before)).not.toBe(
-			await computeInputFingerprint(after),
-		);
-	});
-
-	test("a regenerated page-manifest → different fingerprint", async () => {
-		const base = {
-			"bun.lock": `{ "x": "1" }`,
-			"src/entry-client.ts": "export {};",
-			"src/app.css": ".a{}",
-		};
-		const before = await makeService({
-			...base,
-			"src/page-manifest.ts": "export const M = { Hero: 1 };",
-		});
-		const after = await makeService({
-			...base,
-			"src/page-manifest.ts": "export const M = { Hero: 1, Cta: 2 };",
-		});
-		expect(await computeInputFingerprint(before)).not.toBe(
-			await computeInputFingerprint(after),
-		);
-	});
-
-	test("a missing input (backend service, no app.css) is stable, not a throw", async () => {
-		const dir = await makeService({
-			"bun.lock": `{ "x": "1" }`,
-			"src/entry-client.ts": "export {};",
-			"src/page-manifest.ts": "export const M = {};",
-		});
-		const fp1 = await computeInputFingerprint(dir);
-		const fp2 = await computeInputFingerprint(dir);
-		expect(fp1).toBe(fp2);
-		expect(fp1).toMatch(/^[a-f0-9]{16}$/);
-	});
-
-	// Regression guard for the 2026-07-12 scala-agents stale-bundle bug. A boot
-	// that builds MID-INSTALL (dep-sync restarts after writing the new
-	// bun.lock but before node_modules extraction finishes) bakes OLD @teamscala/*
-	// JS while the lock-derived fingerprint records "current" — so every later
-	// restart recomputes the same fingerprint, skips the rebuild, and serves the
-	// STALE bundle forever. Bun.build itself never caches stale modules (an
-	// isolated splitting+minify repro proved it reads fresh content across
-	// processes), so the defense is to hash the actual @teamgbg JS CONTENT the
-	// bundle is built from (the JS twin of hashResolvedPackageStylesheets). With
-	// that in the fingerprint, the freshly-installed bytes hash differently and
-	// the bundle self-heals on the next boot. (bun.lock + entry files are
-	// IDENTICAL across these two fixtures — only the @teamgbg JS body changes.)
-	test("a @teamgbg JS module content change → different fingerprint (mid-install stale-bake self-heal)", async () => {
-		const makeWith = (pkgJs: string) => ({
-			"bun.lock": `{ "locks": { "@teamscala/repro-pkg": "1.0.0" } }`,
-			"src/entry-client.ts": `import { M } from "@teamscala/repro-pkg";\nconsole.log(M);\n`,
-			"src/page-manifest.ts": "export const M = {};\n",
-			"src/app.css": ".a{}",
-			"node_modules/@teamscala/repro-pkg/package.json":
-				`{"name":"@teamscala/repro-pkg","version":"1.0.0","exports":{".":"./index.ts"}}\n`,
-			"node_modules/@teamscala/repro-pkg/index.ts": pkgJs,
-		});
-		const before = await makeService(makeWith("export const M = 'AAA_REPRO';\n"));
-		const after = await makeService(makeWith("export const M = 'BBB_REPRO';\n"));
-		expect(await computeInputFingerprint(before)).not.toBe(
-			await computeInputFingerprint(after),
-		);
-	});
-
-	// The JS graph walk runs bounded-concurrent; the aggregate must be stable
-	// across runs (independent of async scheduling) — the per-file hashes are
-	// folded in sorted path order.
-	test("@teamgbg JS graph fingerprint is deterministic across runs", async () => {
-		const dir = await makeService({
-			"bun.lock": `{ "locks": { "@teamscala/repro-pkg": "1.0.0" } }`,
-			"src/entry-client.ts": `import { M } from "@teamscala/repro-pkg";\nconsole.log(M);\n`,
-			"src/page-manifest.ts": "export const M = {};\n",
-			"src/app.css": ".a{}",
-			"node_modules/@teamscala/repro-pkg/package.json":
-				`{"name":"@teamscala/repro-pkg","version":"1.0.0","exports":{".":"./index.ts"}}\n`,
-			"node_modules/@teamscala/repro-pkg/index.ts": "export const M = 'STABLE';\n",
-		});
-		const a = await computeInputFingerprint(dir);
-		const b = await computeInputFingerprint(dir);
-		expect(a).toBe(b);
-		expect(a).toMatch(/^[a-f0-9]{16}$/);
-	});
-});