@teamscala/service-boot 0.23.523 → 0.23.525

package/package.json

@@ -118,8 +118,6 @@
     "./content-gate/gate-entry-clears.ts": "./src/content-gate/gate-entry-clears.ts",
     "./content-gate/parse-cookie": "./src/content-gate/parse-cookie.ts",
     "./content-gate/parse-cookie.ts": "./src/content-gate/parse-cookie.ts",
-    "./content-gate/token": "./src/content-gate/token.ts",
-    "./content-gate/token.ts": "./src/content-gate/token.ts",
     "./content-page-floor": "./src/content-page-floor.ts",
     "./content-page-floor.ts": "./src/content-page-floor.ts",
     "./csrf-protection": "./src/csrf-protection.ts",
@@ -138,8 +136,6 @@
     "./install-harness.ts": "./src/install-harness.ts",
     "./install-logging": "./src/install-logging.ts",
     "./install-logging.ts": "./src/install-logging.ts",
-    "./is-react-element-type": "./src/is-react-element-type.ts",
-    "./is-react-element-type.ts": "./src/is-react-element-type.ts",
     "./load-page-manifest": "./src/load-page-manifest.ts",
     "./load-page-manifest.ts": "./src/load-page-manifest.ts",
     "./load-service-install-row": "./src/load-service-install-row.ts",
@@ -162,8 +158,6 @@
     "./page-route-shell-types.ts": "./src/page-route-shell-types.ts",
     "./page-server-loader-graph": "./src/page-server-loader-graph.ts",
     "./page-server-loader-graph.ts": "./src/page-server-loader-graph.ts",
-    "./page-server-orpc/hub-mcp-client": "./src/page-server-orpc/hub-mcp-client.ts",
-    "./page-server-orpc/hub-mcp-client.ts": "./src/page-server-orpc/hub-mcp-client.ts",
     "./page-server-orpc/server-client": "./src/page-server-orpc/server-client.ts",
     "./page-server-orpc/server-client.ts": "./src/page-server-orpc/server-client.ts",
     "./pg-boss-handler-registry": "./src/pg-boss-handler-registry.ts",
@@ -246,8 +240,6 @@
     "./resolvers/portal-route-paths.ts": "./src/resolvers/portal-route-paths.ts",
     "./resolvers/website-by-host-map": "./src/resolvers/website-by-host-map.ts",
     "./resolvers/website-by-host-map.ts": "./src/resolvers/website-by-host-map.ts",
-    "./resource-chat-inject": "./src/resource-chat-inject.ts",
-    "./resource-chat-inject.ts": "./src/resource-chat-inject.ts",
     "./resource-not-found": "./src/resource-not-found.ts",
     "./resource-not-found.ts": "./src/resource-not-found.ts",
     "./run-boot-hook-list": "./src/run-boot-hook-list.ts",
@@ -302,5 +294,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.523"
+  "version": "0.23.525"
 }

package/src/agreement-gate/agreement-lookup.ts

@@ -1,13 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Agreement lookup: typed first-match query over the agreements model via
- * the page-server ORPC client.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";

package/src/agreement-gate/authorized-emails.ts

@@ -1,13 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The agreement's authorized email sets: the signer roster (who may sign) and
- * the roster ∪ owning/party-org members (who may view past the gate).
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -15,7 +8,6 @@ import { parseAgreementParties } from "@teamscala/document-signing/agreement-par
 import { findFirstAgreement } from "./agreement-lookup.ts";
 import { resolveAgreementViewerDirectory } from "./resolution-caches.ts";
 
-/** The agreement's authorized email set (its signer roster) for the access endpoint. */
 export async function resolveAgreementSignerEmails(
 	agreementId: string,
 ): Promise<Set<string>> {
@@ -47,12 +39,6 @@ export async function resolveAgreementSignerEmails(
 	}
 }
 
-/**
- * Every email allowed PAST the gate: the signer roster (who may sign) UNION every
- * member of the owning org (who may VIEW). Signing authority stays roster-only —
- * buildSigningSession gives a non-party org member a view-only session. This is
- * what the access endpoint and session-authorize check.
- */
 export async function resolveAgreementAuthorizedEmails(
 	agreementId: string,
 ): Promise<Set<string>> {

package/src/agreement-gate/placeholder-strip.ts

@@ -1,19 +1,10 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The withholding transform: drop blocks whose own text still carries an
- * {{agreement.*}} token, recursively, so unauthed viewers never see raw
- * placeholders.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import type { ContentBlock } from "./signing-session.ts";
 
-/** True if any of the block's OWN string props carries an {{agreement.*}} token. */
 function blockHasAgreementPlaceholder(block: ContentBlock): boolean {
 	const props = block.props;
 	if (!props) return false;
@@ -23,7 +14,6 @@ function blockHasAgreementPlaceholder(block: ContentBlock): boolean {
 	return false;
 }
 
-/** Drop blocks whose own text still holds an {{agreement.*}} token, recursively. */
 export function stripAgreementPlaceholderBlocks(content: ContentBlock[]): ContentBlock[] {
 	const out: ContentBlock[] = [];
 	for (const block of content) {

package/src/agreement-gate/resolution-caches.ts

@@ -1,11 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The agreement gate's resolution caches: the page→agreement association
- * cache, the owning/party org member-directory caches, and the event-driven
- * invalidation (LISTEN registry_config_changed) that clears them.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/agreement-gate/settings.ts

@@ -1,13 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * DB-driven display + behaviour settings for the AGREEMENT content gate
- * (config/content-gate-agreement), plus its cookie name.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
@@ -15,13 +8,6 @@ import * as v from "valibot";
 
 export const AG_COOKIE = "ag_token";
 
-/**
- * Agreement gate display + behaviour, DB-driven (config/content-gate-agreement),
- * never hardcoded — mirrors proposal-gate's loadProposalGateSettings. requireOtp
- * is the per-gate OTP switch (agreements default ON: a signer verifies identity
- * before signing). title is the fallback used when no agreement name resolves. A
- * missing/invalid row falls back to these defaults so the gate UI ALWAYS renders.
- */
 export const AGREEMENT_GATE_DEFAULTS = {
 	title: "Private document",
 	subtitle: "Verify your email to view and sign this document.",
@@ -36,16 +22,8 @@ const AgreementGateSettingsSchema = v.object({
 	requireOtp: v.optional(v.boolean(), AGREEMENT_GATE_DEFAULTS.requireOtp),
 });
 
-/**
- * The settings type is the SCHEMA'S output, never a hand mirror
- * (`autosave-single-surface` rule 2): the interface re-spelled the schema one
- * block away and drifts the first time the schema grows a field.
- */
 export type AgreementGateSettings = v.InferOutput<typeof AgreementGateSettingsSchema>;
 
-/** Gate copy/behaviour, or null when the config row is absent/broken. Null is
- *  the absent signal — callers default explicitly so a missing row neither 500s
- *  the page nor masks as a populated value (protective-layers-fail-explicitly). */
 export async function loadAgreementGateSettings(): Promise<AgreementGateSettings | null> {
 	try {
 		return await loadRegistryConfig(

package/src/agreement-gate/signing-session.ts

@@ -1,14 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The verified signer's signing session: gate-block discovery across regions,
- * roster/party session construction (signer vs view-only org member), and
- * seeding of the session into every SignatureField.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/agreement-gate/signing-shell.ts

@@ -1,15 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * New-flow signing-shell injection (no pre-placed gate required): agreement
- * meta stashing, body-content discovery, the SignIn gate block builder, and
- * the DB-driven signing shell (config/agreement-signing-shell) with its
- * hardcoded fallback.
- *
- * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
- * paths adjusted only.
  */
 
 /**

package/src/agreement-gate.ts

@@ -1,24 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The AGREEMENT content gate, expressed as config for the content-gate primitive
- * (content-gate/). The agreement-specific bits: which resource (the placed
- * SignIn gate block's id), who's authorized (the signer roster), what to seed
- * (the verified signer's signing session into every SignatureField), and how to
- * withhold (strip the gate region to gate-only + strip {{agreement.*}} chrome).
- * The engine handles cookie/token/verify/orchestration.
- *
- * The signing logic (buildSigningSession, seedSigningBlocks, roster expansion,
- * placeholder strip) is preserved verbatim from the former gate-agreement-
- * content.ts — only the cookie/token orchestration moved into the shared engine.
- *
- * This module holds the two exported configs (agreementGateConfig +
- * agreementAccessConfig). The machinery lives as siblings under
- * ./agreement-gate/ (settings, agreement-lookup, signing-session,
- * placeholder-strip, signing-shell, authorized-emails) — split when the
- * parent held them all at 909 lines.
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
@@ -27,7 +9,6 @@ import {
 	verifyAgreementAccessToken,
 } from "@teamscala/document-signing/agreement-access-token";
 import { expandRosterTemplates } from "./expand-roster.ts";
-import { injectResourceChatLauncher } from "./resource-chat-inject.ts";
 import { agTtlMs } from "./gate-ttls.ts";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { AG_COOKIE, AGREEMENT_GATE_DEFAULTS, loadAgreementGateSettings } from "./agreement-gate/settings.ts";
@@ -54,7 +35,6 @@ import { resolveAgreementAuthorizedEmails } from "./agreement-gate/authorized-em
 export const agreementGateConfig: ContentGateConfig = {
 	cookieName: AG_COOKIE,
 	async getResourceId(resolved) {
-		// Old-flow pages: a pre-placed SignIn gate block carries the UUID.
 		const gate = findAgreementGate(resolved);
 		if (gate.agreementUuid) {
 			const gateRegion = gate.gateRegions[0];
@@ -65,7 +45,6 @@ export const agreementGateConfig: ContentGateConfig = {
 			return gate.agreementUuid;
 		}
 
-		// New-flow pages: resolve UUID from the page→agreement association.
 		const pageId = (resolved.page as { id?: string } | undefined)?.id;
 		if (!pageId) return "";
 
@@ -88,7 +67,6 @@ export const agreementGateConfig: ContentGateConfig = {
 				stashAgreementMeta(resolved, agreement.id, agreement.name);
 				return agreement.id;
 			}
-			// Cache negative so non-agreement pages never re-query.
 			pageAgreementCache.set(pageId, { id: "", name: "" });
 			return "";
 		} catch (err) {
@@ -98,10 +76,6 @@ export const agreementGateConfig: ContentGateConfig = {
 			return "";
 		}
 	},
-	// Baked-in unified auth (engine default): a logged-in viewer whose session
-	// email is in the authorized set (signer roster ∪ owning/party-org members)
-	// is released with no per-gate OTP — session verify is local, works on
-	// Railway. Just exposing the resolver opts into the platform-wide behaviour.
 	resolveAuthorizedEmails: resolveAgreementAuthorizedEmails,
 	verifyToken(token, resourceId, nowMs) {
 		const email = verifyAgreementAccessToken(token, resourceId, nowMs);
@@ -110,7 +84,6 @@ export const agreementGateConfig: ContentGateConfig = {
 	async onAuthorized(resolved, agreementUuid, { email }) {
 		const session = await buildSigningSession(agreementUuid, email);
 		if (!session) {
-			// Session build failed — withhold content as if unauthorized.
 			if (!hasPrePlacedGate(resolved)) {
 				const content = getBodyContentArray(resolved);
 				if (content) {
@@ -135,9 +108,6 @@ export const agreementGateConfig: ContentGateConfig = {
 				})
 			: "";
 
-		// New-flow pages: inject the signing shell BEFORE roster expansion so
-		// the SignatureField template is expanded per party. Old-flow pages
-		// already have pre-placed blocks — skip injection.
 		if (!hasPrePlacedGate(resolved)) {
 			const content = getBodyContentArray(resolved);
 			if (content) {
@@ -148,37 +118,18 @@ export const agreementGateConfig: ContentGateConfig = {
 			}
 		}
 
-		// Expand roster templates + bind agreement-meta placeholders (both flows).
 		expandRosterTemplates(resolved, session.parties, {
 			name: session.agreementName,
 			ref: session.agreementRef,
 			org: session.orgName ?? "",
 			signer: session.authedName,
-			// Role-aware verb for the header status line. authedRole is a party key
-			// for a designated signer, or the literal "viewer" for a view-only
-			// recipient (an org member who isn't on the signer roster). So the
-			// header reads "Viewing as <name>" for a viewer, "Signing as <name>"
-			// for a signer — never implying a viewer can sign.
 			signerVerb: session.authedRole === "viewer" ? "Viewing" : "Signing",
 			signedCount: String(signedCount),
 			total: String(session.parties.length),
 			completedDate,
 		});
-		// Seed the verified session into every SignatureField (both flows).
 		seedSigningBlocks(resolved, session);
 
-		// Floating "Ask about this agreement" GPT bubble — the generic
-		// ResourceChatLauncher (one-ai-chat-system), strictly behind the email
-		// gate. The agreement's clause text becomes the chat's runtime context.
-		await injectResourceChatLauncher(resolved, email, {
-			resourceKey: "agreement",
-			agentConfigSlug: "agreement-assistant-agent",
-			organisationId: session.organisationId ?? undefined,
-			launchLabel: "Ask about this agreement",
-			placeholder: "Ask about this agreement…",
-		});
-
-		// Old-flow only: drop the pre-placed gate block (new flow has none).
 		if (hasPrePlacedGate(resolved)) {
 			const { gateRegions } = findAgreementGate(resolved);
 			for (const { pd, content, gateIdx } of gateRegions) {
@@ -188,13 +139,11 @@ export const agreementGateConfig: ContentGateConfig = {
 	},
 	async onUnauthorized(resolved, agreementUuid) {
 		if (hasPrePlacedGate(resolved)) {
-			// Old flow: strip region to gate-only.
 			const { gateRegions } = findAgreementGate(resolved);
 			for (const { pd, content, gateIdx } of gateRegions) {
 				pd.content = [content[gateIdx]];
 			}
 		} else {
-			// New flow: inject gate, withhold all body content.
 			const meta = resolved[AGREEMENT_META_KEY] as
 				| { name?: string }
 				| undefined;
@@ -213,7 +162,6 @@ export const agreementGateConfig: ContentGateConfig = {
 			}
 		}
 
-		// Common: strip agreement-placeholder blocks + neutralize page meta.
 		for (const value of Object.values(resolved)) {
 			const pd = (
 				value as { puck_data?: { content?: unknown[] } } | null

package/src/apply-logger-config.ts

@@ -1,14 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Late-stage logger configuration — runs AFTER Registry is loaded (the boot
- * pipeline's `apply-logger-config` phase), injecting the DB-driven settings
- * into the logger primitive. Split from install-logging.ts under
- * single-purpose-file: the early bootstrap (hardcoded defaults, primitive
- * injection) and this late reconfiguration are two phases, and the guard
- * counts them as two export groups in one file.
  */
 
 import { setMinLevel } from "@teamscala/logger/creator";

package/src/asset-cache-key.ts

@@ -1,10 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * ETag derivation for the asset proxy that incorporates the negotiated
- * image format so per-Accept variants cache independently.
  */
 
 const SKIP_FORMATS = new Set(["webp", "avif", "gif", "svg", "ico"]);

package/src/asset-optimize.ts

@@ -1,12 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * On-the-fly image optimisation for the asset proxy. Converts stored
- * PNG/JPEG to WebP or AVIF when the browser signals support, using
- * @teamscala/image-optimizer's compressImage primitive. Returns null
- * on failure so the caller can fall back to the original stream.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/asset-proxy.ts

@@ -1,15 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Same-origin S3 asset proxy with on-the-fly image optimisation.
- * Streams objects from the configured S3 bucket, converting PNG/JPEG
- * to WebP/AVIF when the browser declares support via Accept header.
- * Returns 404 for missing keys, 502 for S3 failures. Never redirects.
- * Every non-2xx exit records which stage failed through the app logger:
- * a 404 and a 502 are indistinguishable at the socket, so the fault plane
- * (credential resolution vs store side) is only observable in the log.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/asset-social-card.ts

@@ -1,14 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Dynamic-import wrapper around image-optimizer's in-process sharp
- * social-card op. Mirrors asset-optimize.ts's optional-dependency shape:
- * services without image-optimizer installed transparently get null and
- * fall back to the raw asset stream. In-process (not HTTP) because the
- * og:image transform is a cold path per shared link — no auth handshake,
- * no per-consumer service config.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/attach-agreement-magic.ts

@@ -1,20 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The agreement MAGIC-LINK endpoint. A recipient who clicks an emailed
- * "Review & sign" link — which carries a pre-authorised, signed ag_token for
- * THEIR party — lands here: the token is verified for the agreement, the
- * ag_token cookie is set on the shared parent domain, and the browser is
- * 302-redirected straight into the signing page. No email-entry gate, no OTP —
- * "came from our email" IS the proof of identity, exactly like the
- * proposal-accept hand-off (attach-proposal-accept.ts).
- *
- * The token is the same HMAC ag_token the gate verifies (30-min TTL, scoped to
- * {agreementId, email}); an invalid/expired/forged token sets no cookie and the
- * destination page simply shows the normal email gate. GET so it is a plain
- * clickable link in an email.
  */
 
 import type { Hono } from "hono";

package/src/attach-portal-members.ts

@@ -1,23 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Portal-secured member directory endpoint. Resolves members of an org via a
- * parameterized raw join over better_auth_member + "user" — NOT the typed
- * `member` ORPC model, which is deliberately omitted from the portal's
- * service_schema (security: the raw table is not exposed as a typed CRUD
- * surface). Mirrors the agreement-gate.ts:109-150 precedent.
- *
- * The portal's auth middleware (better-auth-cookie) gates the endpoint — only
- * authenticated users can call it. The orgId comes from the caller's context
- * (the portal resolves it from the session + passes it).
- *
- * Endpoint: GET /api/portal/members?orgId=<uuid>
- *   - orgId omitted: super-admin all-orgs mode (returns every member across
- *     all orgs, strictly gated to super-admin via getSession; used by the
- *     "View As" impersonation dropdown).
- * Response: { members: Array<{ id, user_id, organization_id, role, email, name, image }> }
  */
 
 import type { Hono } from "hono";

package/src/attach-proposal-accept.ts

@@ -1,33 +1,13 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The proposal ACCEPT endpoint. A viewer who has passed the proposal gate (holds
- * a valid prop_token) POSTs {proposalId} here to accept; the server generates a
- * signing document from the proposal (createAgreementFromProposal) and
- * 302-redirects them straight into signing it on the sign site. This replaces
- * the old mailto CTA. Mounted BEFORE the auth gate so it is publicly reachable —
- * the prop_token (not a login) is the proof of identity, exactly like the
- * content-gate access endpoint.
- *
- * Single sign-on across the journey: the viewer already proved their email at
- * the proposal gate (prop_token), so we MUST NOT make them re-enter it on the
- * sign site. Before redirecting, we mint the agreement's ag_token for that same
- * verified email and set it on the SHARED parent domain (Domain=.scala.business)
- * so the browser carries it from proposals.scala.business to sign.scala.business
- * — the agreement gate then auto-reveals + seeds the signing session with zero
- * extra prompts. This requires both hosts to resolve the SAME token secret
- * (AUTH_SECRET→ENCRYPTION_KEY→DATABASE_URL): scala-sign must carry ENCRYPTION_KEY
- * (also required to decrypt the org's Stripe key on full sign), so both hosts
- * land on ENCRYPTION_KEY and the carried token verifies.
  */
 
 import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { signAgreementAccessToken } from "@teamscala/document-signing/agreement-access-token";
 import { parseCookie } from "./content-gate/parse-cookie.ts";
-import { verifyAccessToken } from "./content-gate/token.ts";
+import { verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
 import { agTtlMs } from "./gate-ttls.ts";
 import { createAgreementFromProposal } from "@teamscala/agreement-generation/create-agreement-from-proposal";
 import { getCookieDomain } from "@teamscala/db/registry/cookie-domain";

package/src/attach-proposal-magic.ts

@@ -1,23 +1,11 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The proposal MAGIC-LINK endpoint — the proposal twin of attach-agreement-magic.
- * A recipient who clicks an emailed "View your proposal" link (carrying a signed,
- * per-recipient prop_token) lands here: the token is verified for the proposal,
- * the prop_token cookie is set, and the browser is 302-redirected straight into
- * the proposal page. No email-entry gate, no OTP. An invalid/expired token sets
- * no cookie and the page falls through to the normal email gate.
- *
- * The prop_token is host-scoped (proposals are served on the proposals host only),
- * unlike the agreement ag_token which spans .scala.business for the proposal→sign
- * hand-off. GET so it is a plain clickable link in an email.
  */
 
 import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { verifyAccessToken } from "./content-gate/token.ts";
+import { verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
 import { propTtlMs } from "./gate-ttls.ts";
 
 const PROP_COOKIE = "prop_token";

package/src/attach-transfers-upload.ts

@@ -1,27 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Authenticated asset upload — POST /api/transfers/upload. Restores the
- * handler deleted with @teamscala/server-files (commit ca5643ef); avatar/logo
- * upload had 404'd on every service since. Writes to S3 via
- * @teamscala/object-storage/create/write-ops and returns the SERVABLE URL
- * (`/api/assets/<key>`) the client persists into avatar_url/logo_url — the
- * stored value is the servable value (single-logo-pathway), so display code
- * reads the column with no rewriting. Self-authenticates (getSession) so it
- * mounts BEFORE the auth gate.
- *
- * Key scheme is USER-scoped (`users/<userId>/<type>/<file>-<ts>.<ext>`) per
- * the operator ruling: a profile picture belongs to the individual, not any
- * org (the prior handler's org-scoped `<orgId>/avatars/...` encoded the
- * uploading org into a personal asset). Spec + history:
- * `reference/asset-upload-system.md`.
- *
- * `thumbUrl` mirrors `url` — the full image is served for both; a separate
- * generated thumbnail is a future refinement (the prior handler generated
- * one, but the image-resize dependency is not wired here yet and a missing
- * thumb must not block the upload restoring).
  */
 import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/auth/sign-out.ts

@@ -1,54 +1,11 @@
 /**
  * @system service-boot
- * @status handwritten — none derivable: the api_route row (fn-auth-sign-out) declares the path, auth and input, not a body; host-bus-handler-contracts emits the client node + wiring FROM the row, never a procedure body; the sign-out mechanism is BetterAuth's `auth.api.signOut` on the app's own session + the /api/auth/* → scala-otp forward that auth-gate already performs (the body composes those two, it is not generated from either).
- * @edit edit directly
- *
- * The fn.auth.signOut procedure body (api_route `fn-auth-sign-out`, authed:
- * context). It is the host-side sign-out the Button logout action calls
- * through the generated ORPC client node, replacing the raw browser POST to
- * /api/auth/sign-out. It takes no input — sign-out has no fields — so the
- * generated node is called as `orpcClient.fn.auth.signOut()`, the same no-arg
- * shape as fn.chat.health.
- *
- * WHY A PROCEDURE, NOT THE RAW FETCH. The old client called
- * `/api/auth/sign-out` directly. That path is only served when the host is
- * running the auth gate's `/api/auth/*` forward or a local BetterAuth handler,
- * and it is a bare string path the client hard-codes — a second, unnamed
- * statement of "where sign-out lives". Declaring it as an api_route procedure
- * gives it the one home (the registry row) the rest of the auth surface uses,
- * and the generated node carries the path.
- *
- * WHAT IT DOES, IN ORDER, so server-side behaviour is UNCHANGED from the
- * forwarded POST:
- *  1. Revoke the caller's session through the SAME BetterAuth instance the
- *     session-read path uses (getAuth() — the bridge auth-gate installs, so
- *     it validates through the identical factory). This deletes the session
- *     row and returns the Set-Cookie headers that clear it.
- *  2. When SCALA_OTP_URL is set — centralised auth, per otp-centralised-via-
- *     otp-service — forward the same POST to scala-otp's /api/auth/sign-out
- *     with the caller's cookie, so the central service clears the shared
- *     Domain=.scala.business session too. The local revoke alone would leave
- *     the central session alive. The caller's cookie is carried forward and
- *     scala-otp's response status is checked, so a central refusal is reported
- *     rather than swallowed — the same POST the /api/auth/* forward in
- *     auth-gate performs.
- *
- * HONEST RESIDUAL: the ORPC response is JSON, so the Set-Cookie headers
- * BetterAuth returns on its Response cannot ride back to the browser through
- * this procedure. The session is revoked in the database on both sides, and
- * the caller redirects to the sign-in path, so the browser presents a
- * revoked-and-deleted session token on its next request and the auth gate
- * rejects it — the same observable outcome as the forwarded POST, whose
- * cleared cookie was an optimisation. Clearing the cookie explicitly is the
- * caller's business (the raw /api/auth/clear-stale-cookies route), not this
- * procedure's.
+ * @status handwritten
  */
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 
 export interface SignOutResult {
-	/** True once the local session is revoked (and the central one, when centralised). */
 	ok: boolean;
-	/** True when the sign-out was forwarded to scala-otp. */
 	forwarded: boolean;
 }