@teamscala/service-boot 0.23.523 → 0.23.524

package/package.json

@@ -302,5 +302,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.523"
+  "version": "0.23.524"
 }

package/src/agreement-gate/agreement-lookup.ts

@@ -1,13 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Agreement lookup: typed first-match query over the agreements model via
- * the page-server ORPC client.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";

package/src/agreement-gate/authorized-emails.ts

@@ -1,13 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The agreement's authorized email sets: the signer roster (who may sign) and
- * the roster ∪ owning/party-org members (who may view past the gate).
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/agreement-gate/placeholder-strip.ts

@@ -1,14 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The withholding transform: drop blocks whose own text still carries an
- * {{agreement.*}} token, recursively, so unauthed viewers never see raw
- * placeholders.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import type { ContentBlock } from "./signing-session.ts";

package/src/agreement-gate/resolution-caches.ts

@@ -1,11 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The agreement gate's resolution caches: the page→agreement association
- * cache, the owning/party org member-directory caches, and the event-driven
- * invalidation (LISTEN registry_config_changed) that clears them.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/agreement-gate/settings.ts

@@ -1,13 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * DB-driven display + behaviour settings for the AGREEMENT content gate
- * (config/content-gate-agreement), plus its cookie name.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";

package/src/agreement-gate/signing-session.ts

@@ -1,14 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The verified signer's signing session: gate-block discovery across regions,
- * roster/party session construction (signer vs view-only org member), and
- * seeding of the session into every SignatureField.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/agreement-gate/signing-shell.ts

@@ -1,15 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * New-flow signing-shell injection (no pre-placed gate required): agreement
- * meta stashing, body-content discovery, the SignIn gate block builder, and
- * the DB-driven signing shell (config/agreement-signing-shell) with its
- * hardcoded fallback.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 /**

package/src/agreement-gate.ts

@@ -1,24 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The AGREEMENT content gate, expressed as config for the content-gate primitive
- * (content-gate/). The agreement-specific bits: which resource (the placed
- * SignIn gate block's id), who's authorized (the signer roster), what to seed
- * (the verified signer's signing session into every SignatureField), and how to
- * withhold (strip the gate region to gate-only + strip {{agreement.*}} chrome).
- * The engine handles cookie/token/verify/orchestration.
- *
- * The signing logic (buildSigningSession, seedSigningBlocks, roster expansion,
- * placeholder strip) is preserved verbatim from the former gate-agreement-
- * content.ts — only the cookie/token orchestration moved into the shared engine.
- *
- * This module holds the two exported configs (agreementGateConfig +
- * agreementAccessConfig). The machinery lives as siblings under
- * ./agreement-gate/ (settings, agreement-lookup, signing-session,
- * placeholder-strip, signing-shell, authorized-emails) — split when the
- * parent held them all at 909 lines.
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";

package/src/apply-logger-config.ts

@@ -1,14 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Late-stage logger configuration — runs AFTER Registry is loaded (the boot
- * pipeline's `apply-logger-config` phase), injecting the DB-driven settings
- * into the logger primitive. Split from install-logging.ts under
- * single-purpose-file: the early bootstrap (hardcoded defaults, primitive
- * injection) and this late reconfiguration are two phases, and the guard
- * counts them as two export groups in one file.
  */
 
 import { setMinLevel } from "@teamscala/logger/creator";

package/src/asset-cache-key.ts

@@ -1,10 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * ETag derivation for the asset proxy that incorporates the negotiated
- * image format so per-Accept variants cache independently.
  */
 
 const SKIP_FORMATS = new Set(["webp", "avif", "gif", "svg", "ico"]);

package/src/asset-optimize.ts

@@ -1,12 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * On-the-fly image optimisation for the asset proxy. Converts stored
- * PNG/JPEG to WebP or AVIF when the browser signals support, using
- * @teamscala/image-optimizer's compressImage primitive. Returns null
- * on failure so the caller can fall back to the original stream.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/asset-proxy.ts

@@ -1,15 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Same-origin S3 asset proxy with on-the-fly image optimisation.
- * Streams objects from the configured S3 bucket, converting PNG/JPEG
- * to WebP/AVIF when the browser declares support via Accept header.
- * Returns 404 for missing keys, 502 for S3 failures. Never redirects.
- * Every non-2xx exit records which stage failed through the app logger:
- * a 404 and a 502 are indistinguishable at the socket, so the fault plane
- * (credential resolution vs store side) is only observable in the log.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/asset-social-card.ts

@@ -1,14 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Dynamic-import wrapper around image-optimizer's in-process sharp
- * social-card op. Mirrors asset-optimize.ts's optional-dependency shape:
- * services without image-optimizer installed transparently get null and
- * fall back to the raw asset stream. In-process (not HTTP) because the
- * og:image transform is a cold path per shared link — no auth handshake,
- * no per-consumer service config.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/attach-agreement-magic.ts

@@ -1,20 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The agreement MAGIC-LINK endpoint. A recipient who clicks an emailed
- * "Review & sign" link — which carries a pre-authorised, signed ag_token for
- * THEIR party — lands here: the token is verified for the agreement, the
- * ag_token cookie is set on the shared parent domain, and the browser is
- * 302-redirected straight into the signing page. No email-entry gate, no OTP —
- * "came from our email" IS the proof of identity, exactly like the
- * proposal-accept hand-off (attach-proposal-accept.ts).
- *
- * The token is the same HMAC ag_token the gate verifies (30-min TTL, scoped to
- * {agreementId, email}); an invalid/expired/forged token sets no cookie and the
- * destination page simply shows the normal email gate. GET so it is a plain
- * clickable link in an email.
  */
 
 import type { Hono } from "hono";

package/src/attach-portal-members.ts

@@ -1,23 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Portal-secured member directory endpoint. Resolves members of an org via a
- * parameterized raw join over better_auth_member + "user" — NOT the typed
- * `member` ORPC model, which is deliberately omitted from the portal's
- * service_schema (security: the raw table is not exposed as a typed CRUD
- * surface). Mirrors the agreement-gate.ts:109-150 precedent.
- *
- * The portal's auth middleware (better-auth-cookie) gates the endpoint — only
- * authenticated users can call it. The orgId comes from the caller's context
- * (the portal resolves it from the session + passes it).
- *
- * Endpoint: GET /api/portal/members?orgId=<uuid>
- *   - orgId omitted: super-admin all-orgs mode (returns every member across
- *     all orgs, strictly gated to super-admin via getSession; used by the
- *     "View As" impersonation dropdown).
- * Response: { members: Array<{ id, user_id, organization_id, role, email, name, image }> }
  */
 
 import type { Hono } from "hono";

package/src/attach-proposal-accept.ts

@@ -1,26 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The proposal ACCEPT endpoint. A viewer who has passed the proposal gate (holds
- * a valid prop_token) POSTs {proposalId} here to accept; the server generates a
- * signing document from the proposal (createAgreementFromProposal) and
- * 302-redirects them straight into signing it on the sign site. This replaces
- * the old mailto CTA. Mounted BEFORE the auth gate so it is publicly reachable —
- * the prop_token (not a login) is the proof of identity, exactly like the
- * content-gate access endpoint.
- *
- * Single sign-on across the journey: the viewer already proved their email at
- * the proposal gate (prop_token), so we MUST NOT make them re-enter it on the
- * sign site. Before redirecting, we mint the agreement's ag_token for that same
- * verified email and set it on the SHARED parent domain (Domain=.scala.business)
- * so the browser carries it from proposals.scala.business to sign.scala.business
- * — the agreement gate then auto-reveals + seeds the signing session with zero
- * extra prompts. This requires both hosts to resolve the SAME token secret
- * (AUTH_SECRET→ENCRYPTION_KEY→DATABASE_URL): scala-sign must carry ENCRYPTION_KEY
- * (also required to decrypt the org's Stripe key on full sign), so both hosts
- * land on ENCRYPTION_KEY and the carried token verifies.
  */
 
 import type { Hono } from "hono";

package/src/attach-proposal-magic.ts

@@ -1,18 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The proposal MAGIC-LINK endpoint — the proposal twin of attach-agreement-magic.
- * A recipient who clicks an emailed "View your proposal" link (carrying a signed,
- * per-recipient prop_token) lands here: the token is verified for the proposal,
- * the prop_token cookie is set, and the browser is 302-redirected straight into
- * the proposal page. No email-entry gate, no OTP. An invalid/expired token sets
- * no cookie and the page falls through to the normal email gate.
- *
- * The prop_token is host-scoped (proposals are served on the proposals host only),
- * unlike the agreement ag_token which spans .scala.business for the proposal→sign
- * hand-off. GET so it is a plain clickable link in an email.
  */
 
 import type { Hono } from "hono";

package/src/attach-transfers-upload.ts

@@ -1,27 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Authenticated asset upload — POST /api/transfers/upload. Restores the
- * handler deleted with @teamscala/server-files (commit ca5643ef); avatar/logo
- * upload had 404'd on every service since. Writes to S3 via
- * @teamscala/object-storage/create/write-ops and returns the SERVABLE URL
- * (`/api/assets/<key>`) the client persists into avatar_url/logo_url — the
- * stored value is the servable value (single-logo-pathway), so display code
- * reads the column with no rewriting. Self-authenticates (getSession) so it
- * mounts BEFORE the auth gate.
- *
- * Key scheme is USER-scoped (`users/<userId>/<type>/<file>-<ts>.<ext>`) per
- * the operator ruling: a profile picture belongs to the individual, not any
- * org (the prior handler's org-scoped `<orgId>/avatars/...` encoded the
- * uploading org into a personal asset). Spec + history:
- * `reference/asset-upload-system.md`.
- *
- * `thumbUrl` mirrors `url` — the full image is served for both; a separate
- * generated thumbnail is a future refinement (the prior handler generated
- * one, but the image-resize dependency is not wired here yet and a missing
- * thumb must not block the upload restoring).
  */
 import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/auth/sign-out.ts

@@ -1,47 +1,6 @@
 /**
  * @system service-boot
- * @status handwritten — none derivable: the api_route row (fn-auth-sign-out) declares the path, auth and input, not a body; host-bus-handler-contracts emits the client node + wiring FROM the row, never a procedure body; the sign-out mechanism is BetterAuth's `auth.api.signOut` on the app's own session + the /api/auth/* → scala-otp forward that auth-gate already performs (the body composes those two, it is not generated from either).
- * @edit edit directly
- *
- * The fn.auth.signOut procedure body (api_route `fn-auth-sign-out`, authed:
- * context). It is the host-side sign-out the Button logout action calls
- * through the generated ORPC client node, replacing the raw browser POST to
- * /api/auth/sign-out. It takes no input — sign-out has no fields — so the
- * generated node is called as `orpcClient.fn.auth.signOut()`, the same no-arg
- * shape as fn.chat.health.
- *
- * WHY A PROCEDURE, NOT THE RAW FETCH. The old client called
- * `/api/auth/sign-out` directly. That path is only served when the host is
- * running the auth gate's `/api/auth/*` forward or a local BetterAuth handler,
- * and it is a bare string path the client hard-codes — a second, unnamed
- * statement of "where sign-out lives". Declaring it as an api_route procedure
- * gives it the one home (the registry row) the rest of the auth surface uses,
- * and the generated node carries the path.
- *
- * WHAT IT DOES, IN ORDER, so server-side behaviour is UNCHANGED from the
- * forwarded POST:
- *  1. Revoke the caller's session through the SAME BetterAuth instance the
- *     session-read path uses (getAuth() — the bridge auth-gate installs, so
- *     it validates through the identical factory). This deletes the session
- *     row and returns the Set-Cookie headers that clear it.
- *  2. When SCALA_OTP_URL is set — centralised auth, per otp-centralised-via-
- *     otp-service — forward the same POST to scala-otp's /api/auth/sign-out
- *     with the caller's cookie, so the central service clears the shared
- *     Domain=.scala.business session too. The local revoke alone would leave
- *     the central session alive. The caller's cookie is carried forward and
- *     scala-otp's response status is checked, so a central refusal is reported
- *     rather than swallowed — the same POST the /api/auth/* forward in
- *     auth-gate performs.
- *
- * HONEST RESIDUAL: the ORPC response is JSON, so the Set-Cookie headers
- * BetterAuth returns on its Response cannot ride back to the browser through
- * this procedure. The session is revoked in the database on both sides, and
- * the caller redirects to the sign-in path, so the browser presents a
- * revoked-and-deleted session token on its next request and the auth gate
- * rejects it — the same observable outcome as the forwarded POST, whose
- * cleared cookie was an optimisation. Clearing the cookie explicitly is the
- * caller's business (the raw /api/auth/clear-stale-cookies route), not this
- * procedure's.
+ * @status handwritten
  */
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 

package/src/auth-gate/public-paths.ts

@@ -1,15 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The auth gate's public-path surface: sign-in paths, the static-asset
- * extension predicate, and the public infra prefixes/paths (self-authenticating
- * service-to-service surfaces, dev-host infra reads, and the access-gate
- * rejection target).
- *
- * Split out of auth-gate.ts (436 lines) — byte-for-byte move; import paths
- * adjusted only.
  */
 
 export const SIGN_IN_PATHS = new Set([

package/src/auth-gate.ts

@@ -1,27 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Auth middleware factory. Three modes, same BetterAuth email-OTP mechanism:
- *
- *   service_install.auth values:
- *   - omitted | "none"            → no gate, no handler (scala-public, scala-sign)
- *   - "better-auth-cookie"        → full session auth: mount handler + session gate
- *   - "email-otp-only"            → mount handler (OTP send/verify), no session gate
- *
- *   The sign-in block determines the UX per mode:
- *   - "full"         → email → OTP → session → portal selection (portal, agents, docs, gpt)
- *   - "email-gate"   → email → OTP → verify-only, no session (forms, proposals, quiz)
- *   - "capture-only" → email field only, no OTP (sign)
- *
- *   There is NO localhost bypass: 127.0.0.1 is gated identically to the tunnel
- *   (no session → /sign-in). Tools needing an authed view sign in
- *   (getSuperAdminSessionCookie); the dev OTP is DB-readable.
- *
- *   When SCALA_OTP_URL is set, /api/auth/* forwards to the centralised
- *   scala-otp service (per otp-centralised-via-otp-service). Otherwise
- *   the local better-auth handler is used (dev-host fallback).
  */
 
 /**

package/src/bind-page-handler.ts

@@ -1,12 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Calls a createPageHandler() handler with the per-request extras the
- * SSR pipeline needs: the resolved userId/orgId (from localhost-bypass
- * or better-auth-cookie), and the htmlTemplate. Shared by the regions
- * and page_slug shell variants.
  */
 
 		// Per-page root.props.maxWidth (the canonical mechanism) centers any page at the chosen width via inline styles — already hydration-safe

package/src/build-client-assets/build-lock.ts

@@ -1,16 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The host-wide client-build lock of the client-asset build: serialises the
- * heavy boot-time client build across ALL kind:ui services
- * (client-asset-builds-serialize-via-lock), with a DB-driven TTL that
- * fail-softs to a hardcoded default.
- *
- * Split out of build-client-assets.ts (962 lines) alongside its build
- * siblings. Byte-for-byte move from the parent — imports adjusted, nothing
- * else.
  */
 
 import { join } from "node:path";

package/src/build-client-assets/hashed-output.ts

@@ -1,16 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Content-hashed output housekeeping for the client-asset build: the
- * short content hash stamped into hashed filenames, and removal of stale
- * hashed files from a previous build so dist/client/ never accumulates
- * dead outputs.
- *
- * Split out of build-client-assets.ts (962 lines) alongside its build
- * siblings. Byte-for-byte move from the parent except createHash →
- * Bun.CryptoHasher (bun-native-crypto guard; identical digest output).
  */
 
 import { readdir, rm } from "node:fs/promises";

package/src/build-client-assets/hydrate-bundle.ts

@@ -1,16 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The hydrate JS bundle unit of the client-asset build: Bun.build over
- * src/entry-client.ts with the resilient-block-imports plugin (dead block
- * imports degrade at runtime instead of crash-looping the service), the
- * post-build dead-facade gate, stale-chunk removal, and source-map upload.
- *
- * Split out of build-client-assets.ts (962 lines) alongside its build
- * siblings. Byte-for-byte move from the parent — imports adjusted, nothing
- * else.
  */
 
 			// Externalize an unresolvable @teamscala/* block import (a deactivated block_schema whose manifest regen never propagated) or a broken

package/src/build-client-assets/manifest.ts

@@ -1,17 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The asset-manifest unit of the client-asset build: the AssetManifest shape,
- * its read/write, the last-failure tombstone status read the runtime surfaces,
- * and the first-boot fallback paths.
- *
- * Split out of build-client-assets.ts (962 lines) alongside its build
- * siblings — the file held six concerns (manifest, hashed output, hydrate
- * bundle, source-map upload, stylesheet build, fingerprint, lock, orchestration).
- *
- * Byte-for-byte move from the parent — imports adjusted, nothing else.
  */
 
 import { join } from "node:path";

package/src/build-client-assets/source-candidates.ts

@@ -1,23 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Tailwind source-candidate scanning for the client CSS build.
- *
- * Split out of build-client-assets.ts (1221 lines, six concerns). Owns ONE
- * concern: turning the resolved `@source` directories into the candidate token
- * set Tailwind's `build()` consumes.
- *
- * Why it exists at all, preserved from the original: Tailwind v4's low-level
- * `compile()` does NOT scan content, and @tailwindcss/oxide's native Scanner is
- * not a dependency of the bare `tailwindcss` lib — only of the integration
- * packages. So the tokens are extracted here. Over-extraction is safe, because
- * `build()` ignores any token that is not a valid utility. Dropping this scan is
- * what shipped an unstyled page to the operator's tablet on 2026-06-13; it is
- * enforced by `css-build-scans-source-candidates`.
- *
- * Byte-for-byte move — imports adjusted, nothing else.
  */
 
 import { resolve } from "node:path";

package/src/build-client-assets/sourcemaps-upload.ts

@@ -1,15 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Upload source maps to GlitchTip via the official `glitchtip-cli` debug-ID
- * flow, then RETAIN the maps outside the served root so a failed upload is
- * retryable on a later boot.
- *
- * Split out of build-client-assets.ts (962 lines) alongside its build
- * siblings. Byte-for-byte move from the parent — imports adjusted, nothing
- * else.
  */
 
 /**

package/src/build-client-assets/styles-build.ts

@@ -1,26 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The Tailwind stylesheet unit of the client-asset build: Bun-native
- * stylesheet resolution returning RAW content, stripping of remote
- * (CSP-forbidden) @imports, and the content-hashed styles-<hash>.css
- * build.
- *
- * NESTED @IMPORTS ARE THE SUPPLIER'S JOB: tailwind 4.3.3's compile()
- * re-invokes loadStylesheet for every @import INSIDE loaded content and
- * splices the loaded nodes into the tree (verified in the installed
- * dist source — the dr() recursion, depth-capped at 100), so a present
- * nested leaf is inlined by the supplier and a missing one throws at
- * compile; the suite pins both. The 2026-07-05 dropped-leaf outage was
- * guarded by an in-process flattener here; with the supplier recursion
- * verified the flattener is a second owner of the same fact and is
- * deleted.
- *
- * Split out of build-client-assets.ts (962 lines) alongside its build
- * siblings. Byte-for-byte move from the parent — imports adjusted, nothing
- * else.
  */
 
 import { dirname, join, resolve } from "node:path";

package/src/build-client-assets.ts

@@ -1,35 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Builds the per-service client bundle and stylesheet into `dist/client/`
- * at UI-service boot time. Outputs are content-hashed so deployments
- * naturally cache-bust:
- *
- *   src/entry-client.ts  ──bun build──>  dist/client/hydrate-<hash>.js
- *   src/app.css          ──tailwindcss──>  dist/client/styles-<hash>.css
- *   (and)                                  dist/client/asset-manifest.json
- *
- * The HTML template references `{{stylesPath}}` / `{{hydratePath}}` —
- * read-html-template.ts substitutes from the manifest at template-read
- * time. Bytes-level changes → new hash → new URL → browser refetch.
- * Without this, `cache-control: immutable` on a fixed filename means
- * returning visitors keep their stale copy forever.
- *
- * This module is the ORCHESTRATION unit: host-wide lock → parallel
- * hydrate/CSS builds → manifest write (or failure tombstone). The
- * build runs on EVERY boot: the content-fingerprint skip cache and its
- * closure-walking hashers (input-fingerprint.ts, input-hashing.ts) are
- * deleted. A skip is the only path that can serve a stale bundle, and
- * it has done so twice (the mtime skip that baked stale bundles until
- * the fingerprint replaced it, 2026-06-14) — no skip is the one shape
- * that cannot skip wrongly, at the cost of a bounded per-boot build
- * serialised by the host-wide lock below. The individual concerns live
- * as siblings under ./build-client-assets/
- * (source-candidates, manifest, hashed-output, hydrate-bundle,
- * sourcemaps-upload, styles-build, build-lock)
- * — split when the parent held them all at 962 lines.
  */
 
 	// Each build is wrapped in its own catch so a JS bundle failure (e.g. transient cross-package export drift) doesn't take down the service