@teamscala/service-boot 0.23.523 → 0.23.525

package/src/two-phase-readiness.ts

@@ -1,12 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Phase-2 readiness state box for the two-phase boot: the real page handler +
- * readiness flags (private lets), the writers/flippers, the `/health` endpoint
- * that gates on them, and the phase-1 page handler that delegates to the real
- * handler once phase 2 completes. Every reader goes through these exports.
  */
 
 /**

package/src/types.ts

@@ -1,9 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Shared type definitions for service-boot boot helpers.
  */
 
 type RendererComponent = (props: Record<string, unknown>) => unknown;
@@ -11,9 +8,6 @@ type RendererComponent = (props: Record<string, unknown>) => unknown;
 export interface RendererComponentEntry {
 	render: RendererComponent;
 	fields?: Record<string, { type: string }>;
-	/** block_schema.defaults, carried onto the entry by discoverBlocks so
-	 *  buildPuckConfig merges them under authored props at SSR
-	 *  (blocks-fully-programmable). */
 	defaultProps?: Record<string, unknown>;
 }
 
@@ -34,18 +28,7 @@ export interface PageHandlerConfig {
 	providers?: string[];
 	loadData: (request: Request) => Promise<unknown>;
 	renderMode?: "public" | "portals" | "utility";
-	/**
-	 * Owning service slug — used by the page-server render catch to resolve
-	 * the branded logo on the render-error page. Mirrors service-runtime's
-	 * PageHandlerConfig.
-	 */
 	serviceSlug?: string;
-	/**
-	 * Redirect a signed-in user's `/` to their org-scoped portal dashboard.
-	 * Set only for services serving a `/*` catchall page_route (the portal);
-	 * single-site portal-mode services serve their real page at `/`.
-	 * Mirrors service-runtime's PageHandlerConfig (1.15.82).
-	 */
 	portalHomeRedirect?: boolean;
 }
 

package/src/ui-service.ts

@@ -1,11 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Boots a `kind: "ui"` service. Reads the service_install registry row and
- * orchestrates a fixed pipeline of single-purpose stages onto one Hono app
- * served by @teamscala/service-runtime/serve (one Bun.serve in dev and prod).
  */
 
 /**
@@ -22,32 +17,7 @@
  * place and is NOT undone.
  */
 
-	// Resolve the listen port through the SHARED resolver (`resolveServicePort`),
-	// the same one the backend branch uses. The registry wins wherever it has an
-	// opinion and a contradicting PORT env is reported, never silently obeyed —
-	// full reasoning in that file.
-	//
-	// This branch previously took `process.env.PORT` unconditionally, which is
-	// how scala-quiz (declared 5203) booted onto session-picker's 3021 from a
-	// leaked env and silently split that daemon's traffic (2026-07-31). On the
-	// dev host the registry wins a conflict (below). On Railway the injected PORT
-	// wins instead — Railway healthchecks exactly that port, and the row's port
-	// is the service's LOCAL dev port (e.g. portal 5200), so binding it on Railway
-	// makes the healthcheck probe a dead port and the deploy fails (`isRailway`
-	// path in the resolver).
-
-			// NO-SILENT-REVERTS — surface the failed client build to OBSERVABILITY
-			// (event-log → GlitchTip, per event-log-is-the-only-durable-event-log).
-			// The minimal-app fallback keeps serving SSR from the LAST-successful
-			// manifest (now a tombstone, see build-client-assets.ts), so the page
-			// looks "up" while the client bundle is stale. Without this signal the
-			// failure is buried in boot stderr and a published fix that reached
-			// node_modules but failed to bundle ships invisibly stale (the
-			// scala-agents 2026-07-18 incident: ui-foundation@3.4.5 installed but
-			// served pre-fix bytes across restarts while node_modules was
-			// mid-install). The boot.client-build-failed event routes into
-			// event-log's 7-day retention → surfaces in GlitchTip as an incident
-			// trail the operator actually watches.
+
 
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -96,7 +66,6 @@ export async function bootUiService(
 	const log = getAppLogger();
 	const startTime = Date.now();
 
-	// Phase 1: Build minimal tool-only app
 	const minimalAppResult = await buildMinimalApp(
 		config,
 		serviceSlug,
@@ -107,12 +76,6 @@ export async function bootUiService(
 
 	const isRailway = Boolean(process.env.RAILWAY_ENVIRONMENT);
 	const envPort = process.env.PORT ? Number(process.env.PORT) : undefined;
-	// The APP binds its PRIVATE port (app_port) when present — for scale-to-zero
-	// services `port` is the ACTIVATOR's ingress (what callers resolve), not the
-	// app's bind. Falling back to `port` keeps RESIDENT + unmigrated services
-	// unchanged. Without this, a migrated row (port=activator) would make the app
-	// bind the activator's port → SO_REUSEPORT silent load-balancing (the
-	// service-ports-from-registry trap: clean boot, two owners in ss -ltnp).
 	const declaredAppPort = config.app_port ?? config.port;
 	const resolution = resolveServicePort(envPort, declaredAppPort, isRailway);
 	if ("error" in resolution) {
@@ -134,21 +97,17 @@ export async function bootUiService(
 	}
 	const port = requireValidPort(resolution.port, serviceSlug);
 
-	// service-runtime owns the TCP listener. service-boot only composes the app
-	// and starts the two-phase build; the runtime binds the returned app.
 	const minimalReadyTime = Date.now();
 	const minimalDuration = minimalReadyTime - startTime;
 	log.info(
 		`[ui-service-boot:${serviceSlug}] Minimal app composed on port ${port} in ${minimalDuration}ms`,
 	);
 
-	// FLIP READY SWITCH: minimal app is ready, MCP tools can connect
 	setReady();
 	log.info(
 		`[ui-service-boot:${serviceSlug}] Ready gate flipped - MCP tools can now connect (full app building in background)`,
 	);
 
-	// Phase 2: Build full app in background (non-blocking)
 	;(async () => {
 		try {
 			const PHASE2_TIMEOUT_MS = 120_000;
@@ -164,7 +123,6 @@ export async function bootUiService(
 			const fullBuildTime = Date.now();
 			const fullDuration = fullBuildTime - startTime;
 
-			// Swap the app reference atomically
 			swapToFullApp(fullAppResult.app, serviceSlug);
 
 			log.info(
@@ -183,13 +141,9 @@ export async function bootUiService(
 					at: new Date().toISOString(),
 				},
 			});
-			// Continue with minimal app - better than crashing
 		}
 	})();
 
-	// Return result compatible with the existing UiServiceBootResult interface
-	// Note: blocks/routes will be empty initially since they're built in the background.
-	// The service is operational for MCP tools.
 	return {
 		kind: "ui",
 		blocks: [], // Will be populated when full app builds

package/src/ws-boot-self-test.ts

@@ -1,19 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Post-listen WebSocket self-test. Runs after serveStart binds the port.
- * For each declared websocket_routes path, opens a synthetic WebSocket
- * connection and asserts 101 upgrade. Non-101 → BootFatalError.
- *
- * This catches the class of bugs where:
- * - WS route registered after ORPC catch-all (order-dependent 404)
- * - fetchWithPeerPort clones the Request on WS upgrade (breaks Bun.upgrade identity)
- * - websocket_routes config row is stale / missing a handler
- *
- * Runs synchronously after serveStart so the boot aborts before the service
- * reports healthy.
  */
 
 import type { ServiceInstallConfig } from "./load-service-install-row";

package/src/content-gate/gate-entry-marker.test.ts

@@ -1,111 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Locks the OPT-IN gate-entry marker. A gate that does NOT declare
- * entryCookieName must behave exactly as before — a valid token authorizes on
- * any load and nothing is recorded for clearing (condition 1: every non-opting
- * service unchanged). An opting gate authorizes ONLY the request that carries
- * the marker (the identity submit's own redirect) and returns the marker name
- * so the page Response clears it — one view, then the gate is presented again.
- *
- * The clears are asserted from the CALL'S RETURN VALUE: the store lives only
- * inside the run() scope, and the first shipped version read it afterwards,
- * saw nothing, and left the marker in the browser (measured live 2026-09-14).
- *
- * Operator ruling 2026-09-14 (refresh must return to the identity gate),
- * mechanism measured live: the quiz_token cookie alone was the carrier that
- * skipped the gate on reload.
- */
-import { describe, expect, test } from "bun:test";
-import type { ContentGateConfig } from "./config-types.ts";
-import { runContentGate } from "./gate.ts";
-import { withGateEntryClears } from "./gate-entry-clears.ts";
-
-function makeConfig(entryCookieName?: string) {
-	const calls = { authorized: 0, unauthorized: 0 };
-	const cfg: ContentGateConfig = {
-		cookieName: "quiz_token",
-		entryCookieName,
-		getResourceId: () => "res-1",
-		verifyToken: (token) =>
-			token === "good" ? { email: "v@example.com", name: "V" } : null,
-		onAuthorized: () => {
-			calls.authorized++;
-		},
-		onUnauthorized: () => {
-			calls.unauthorized++;
-		},
-	};
-	return { cfg, calls };
-}
-
-describe("gate entry marker is opt-in and one-view", () => {
-	test("non-opting gate: a valid token authorizes on any load, nothing cleared — behaviour unchanged", async () => {
-		const { cfg, calls } = makeConfig();
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
-			expect(out.authorized).toBe(true);
-			expect(calls.authorized).toBe(1);
-		});
-		expect(clears).toEqual([]);
-	});
-
-	test("opting gate: token WITHOUT the marker is unauthorized — a refresh shows the gate", async () => {
-		const { cfg, calls } = makeConfig("quiz_token_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
-			expect(out.authorized).toBe(false);
-			expect(calls.unauthorized).toBe(1);
-			expect(calls.authorized).toBe(0);
-		});
-		expect(clears).toEqual([]);
-	});
-
-	test("opting gate: token + marker authorizes and RETURNS the marker for clearing — one view", async () => {
-		const { cfg, calls } = makeConfig("quiz_token_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate(
-				{},
-				"quiz_token=good; quiz_token_entered=1",
-				Date.now(),
-				cfg,
-			);
-			expect(out.authorized).toBe(true);
-			expect(calls.authorized).toBe(1);
-		});
-		expect(clears).toEqual(["quiz_token_entered"]);
-	});
-
-	test("opting gate: marker present but token invalid stays unauthorized and clears nothing", async () => {
-		const { cfg, calls } = makeConfig("quiz_token_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate(
-				{},
-				"quiz_token=bad; quiz_token_entered=1",
-				Date.now(),
-				cfg,
-			);
-			expect(out.authorized).toBe(false);
-			expect(calls.unauthorized).toBe(1);
-		});
-		expect(clears).toEqual([]);
-	});
-
-	test("two gates in one request each report their own marker, drained once", async () => {
-		const first = makeConfig("gate_a_entered");
-		const second = makeConfig("gate_b_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			await runContentGate({}, "quiz_token=good; gate_a_entered=1", Date.now(), first.cfg);
-			await runContentGate({}, "quiz_token=good; gate_b_entered=1", Date.now(), second.cfg);
-		});
-		expect(clears).toEqual(["gate_a_entered", "gate_b_entered"]);
-	});
-
-	test("the quiz gate and its access endpoint both opt in on the same marker name", async () => {
-		const { quizAccessConfig, quizGateConfig } = await import("../quiz-gate.ts");
-		expect(quizGateConfig.entryCookieName).toBe("quiz_token_entered");
-		expect(quizAccessConfig.entryCookieName).toBe("quiz_token_entered");
-	});
-});

package/src/content-gate/token.segmentation.test.ts

@@ -1,76 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Segmentation carriage in the content-gate token. The quiz's composed gate
- * screen captures company/linkedin_url/website/team_size alongside the
- * identity; the token carries them to the next render so the submit can put
- * all seven fields on the ONE response row with no client storage. The
- * generated `token.test.ts` owns the identity/binding suite; these are the
- * segmentation-specific cases (including the backward-compatibility contract:
- * a token minted before `s` existed verifies identically).
- */
-
-process.env.AUTH_SECRET = "local-test-fixture-entropy-0001";
-
-import { describe, expect, test } from "bun:test";
-import { signAccessToken, verifyAccessTokenIdentity } from "./token.ts";
-
-const NOW = 1_000_000_000_000;
-const TTL = 60_000;
-
-function decodePayload(token: string): Record<string, unknown> {
-	return JSON.parse(Buffer.from(token.split(".")[0], "base64url").toString());
-}
-
-describe("content-gate token — segmentation carriage", () => {
-	test("round-trips the four captured fields", () => {
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, "Ann", "+614", {
-			company: "Acme",
-			linkedinUrl: "https://www.linkedin.com/in/ann",
-			website: "https://acme.test",
-			teamSize: "Me + team of 2–5",
-		});
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id?.email).toBe("a@b.com");
-		expect(id?.name).toBe("Ann");
-		expect(id?.phone).toBe("+614");
-		expect(id?.segmentation).toEqual({
-			company: "Acme",
-			linkedinUrl: "https://www.linkedin.com/in/ann",
-			website: "https://acme.test",
-			teamSize: "Me + team of 2–5",
-		});
-	});
-
-	test("BACKWARD COMPATIBILITY: a pre-widening token (no s key) verifies with segmentation undefined — never an error", () => {
-		// Mint with the old shape by omitting segmentation entirely, then assert
-		// the exact contract a deploy-window survivor must satisfy.
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, "Ann", "+614");
-		expect(decodePayload(t as string).s).toBeUndefined();
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id).toEqual({ email: "a@b.com", name: "Ann", phone: "+614", segmentation: undefined });
-	});
-
-	test("empty/whitespace segmentation values produce no s key at all", () => {
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, undefined, undefined, {
-			company: "   ",
-			linkedinUrl: "",
-			website: undefined,
-			teamSize: undefined,
-		});
-		expect(decodePayload(t as string).s).toBeUndefined();
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id?.segmentation).toBeUndefined();
-	});
-
-	test("values are trimmed on sign", () => {
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, undefined, undefined, {
-			company: "  Acme  ",
-			teamSize: "Just me",
-		});
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id?.segmentation).toEqual({ company: "Acme", teamSize: "Just me" });
-	});
-});

package/src/content-gate/token.test.ts

@@ -1,65 +0,0 @@
-// @system codegen
-// @status generated
-// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-//
-// This suite's assertions are OWNED by the codegen band: the band module
-// carries them verbatim, this file is the emission, and hand edits here are
-// overwritten on the next run. The rationale each assertion carries moved
-// with it into the band.
-
-process.env.AUTH_SECRET = "test-secret-at-least-16-chars-long";
-
-import { describe, expect, test } from "bun:test";
-import {
-	signAccessToken,
-	verifyAccessToken,
-	verifyAccessTokenIdentity,
-} from "./token.ts";
-
-const NOW = 1_000_000_000_000;
-const TTL = 60_000;
-
-describe("content-gate token — identity", () => {
-	test("signs + verifies email AND name (GPT capture)", () => {
-		const t = signAccessToken("gpt_token", "gpt-1", "A@B.com", NOW, TTL, "Ann");
-		expect(t).toBeTruthy();
-		const id = verifyAccessTokenIdentity(t, "gpt_token", "gpt-1", NOW + 1);
-		expect(id).toEqual({ email: "a@b.com", name: "Ann" });
-	});
-
-	test("name omitted → identity has email, name undefined", () => {
-		const t = signAccessToken("gpt_token", "gpt-1", "a@b.com", NOW, TTL);
-		const id = verifyAccessTokenIdentity(t, "gpt_token", "gpt-1", NOW + 1);
-		expect(id).toEqual({ email: "a@b.com", name: undefined });
-	});
-
-	test("email-only verifyAccessToken still works (proposals/agreements)", () => {
-		const t = signAccessToken("prop_token", "p-1", "a@b.com", NOW, TTL);
-		expect(verifyAccessToken(t, "prop_token", "p-1", NOW + 1)).toBe("a@b.com");
-	});
-});
-
-describe("content-gate token — binding (withholds content)", () => {
-	const t = signAccessToken("gpt_token", "gpt-1", "a@b.com", NOW, TTL, "Ann");
-
-	test("wrong gate (cookieName) → null", () => {
-		expect(verifyAccessTokenIdentity(t, "prop_token", "gpt-1", NOW + 1)).toBeNull();
-	});
-
-	test("wrong resource → null", () => {
-		expect(verifyAccessTokenIdentity(t, "gpt_token", "gpt-2", NOW + 1)).toBeNull();
-	});
-
-	test("expired → null", () => {
-		expect(verifyAccessTokenIdentity(t, "gpt_token", "gpt-1", NOW + TTL + 1)).toBeNull();
-	});
-
-	test("tampered signature → null", () => {
-		const bad = `${t?.split(".")[0]}.deadbeef`;
-		expect(verifyAccessTokenIdentity(bad, "gpt_token", "gpt-1", NOW + 1)).toBeNull();
-	});
-
-	test("missing token → null", () => {
-		expect(verifyAccessTokenIdentity(undefined, "gpt_token", "gpt-1", NOW)).toBeNull();
-	});
-});

package/src/content-gate/token.ts

@@ -1,219 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The single signed, short-lived access token for EVERY content gate (agreement,
- * proposal, and any future gated content). A gate withholds page content
- * server-side until the request carries a valid token for that resource; this is
- * the only thing that releases the content into the SSR, so without it a gated
- * page is never readable/scrapable by a link holder.
- *
- * HMAC-SHA256 (Bun-native) over {c:cookieName, r:resourceId, e:email, x:exp},
- * plus the optional captured identity a lead-capture gate carries (n:name,
- * p:phone) so a returning visitor is fully known at SSR with NO client storage.
- * `cookieName` is bound INTO the payload so a token minted for one gate
- * (e.g. ag_token) can never satisfy another gate's check (e.g. prop_token).
- *
- * Secret resolver, in preference order: AUTH_SECRET → ENCRYPTION_KEY →
- * the tenant DB address via @teamscala/db's named-need resolver (first one
- * ≥16 chars). A gate signs AND verifies inside one
- * service, so it only needs a stable per-deployment secret; the fallback keeps a
- * gate working on a service that was never given AUTH_SECRET (e.g. the former
- * public-only proposals viewer) instead of failing closed and locking out every
- * authorized viewer. Any service that has AUTH_SECRET transparently prefers it.
- * Fail-closed: no usable secret yields null (no token, no access).
- */
-
-import type { GateSegmentation } from "./config-types.ts";
-import { resolveDbUrlOrNull } from "@teamscala/db/db-url";
-
-function secret(): string | null {
-	// The last resort is the tenant DB address, read through the named-need
-	// resolver (wrong-database guard, 2026-09-27) — never `process.env` here;
-	// the resolver is the only env-aware surface and it names the plane. It is
-	// used only as a stable per-deployment string (≥16 chars), never as a
-	// connection target.
-	for (const s of [
-		process.env.AUTH_SECRET,
-		process.env.ENCRYPTION_KEY,
-		resolveDbUrlOrNull("tenant"),
-	]) {
-		if (s && s.length >= 16) return s;
-	}
-	return null;
-}
-
-function hmac(payloadB64: string, key: string): string {
-	return new Bun.CryptoHasher("sha256", key).update(payloadB64).digest("base64url");
-}
-
-/** Constant-time string compare (equal-length); avoids node:crypto. */
-function safeEqual(a: string, b: string): boolean {
-	if (a.length !== b.length) return false;
-	let diff = 0;
-	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-	return diff === 0;
-}
-
-/** Mint a token proving `email` is authorized for `resourceId` under `cookieName`. */
-export function signAccessToken(
-	cookieName: string,
-	resourceId: string,
-	email: string,
-	nowMs: number,
-	ttlMs: number,
-	/**
-	 * Optional display name to carry in the token (the public GPT lead-capture
-	 * gate uses this so a returning visitor's name is known at SSR — first paint
-	 * renders the full identity, not just the email). Allow-list gates
-	 * (proposals/agreements) omit it.
-	 */
-	name?: string,
-	/**
-	 * Optional captured phone, same reasoning as `name`. It exists so a capture
-	 * gate needs NO browser storage to remember it: the operator's ruling is
-	 * that identity lives in the database and the request, never in
-	 * localStorage.
-	 */
-	phone?: string,
-	/**
-	 * Optional prospect segmentation captured alongside the identity on the
-	 * quiz's composed gate screen (company / LinkedIn / website / team size).
-	 * Same reasoning as name/phone: it rides the signed request, never client
-	 * storage. OPTIONAL and absent from older tokens — a token without it
-	 * verifies exactly as before.
-	 */
-	segmentation?: GateSegmentation,
-): string | null {
-	const key = secret();
-	if (!key) return null;
-	const payload: {
-		c: string;
-		r: string;
-		e: string;
-		x: number;
-		n?: string;
-		p?: string;
-		s?: GateSegmentation;
-	} = {
-		c: cookieName,
-		r: resourceId,
-		e: email.trim().toLowerCase(),
-		x: nowMs + ttlMs,
-	};
-	const trimmedName = name?.trim();
-	if (trimmedName) payload.n = trimmedName;
-	const trimmedPhone = phone?.trim();
-	if (trimmedPhone) payload.p = trimmedPhone;
-	const seg: GateSegmentation = {};
-	const segCompany = segmentation?.company?.trim();
-	if (segCompany) seg.company = segCompany;
-	const segLinkedin = segmentation?.linkedinUrl?.trim();
-	if (segLinkedin) seg.linkedinUrl = segLinkedin;
-	const segWebsite = segmentation?.website?.trim();
-	if (segWebsite) seg.website = segWebsite;
-	const segTeamSize = segmentation?.teamSize?.trim();
-	if (segTeamSize) seg.teamSize = segTeamSize;
-	if (Object.keys(seg).length > 0) payload.s = seg;
-	const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-	return `${payloadB64}.${hmac(payloadB64, key)}`;
-}
-
-/**
- * Validate a token for `cookieName` + `resourceId`. Returns the verified email
- * on success, null otherwise (bad signature, wrong gate, wrong resource,
- * expired, no secret).
- */
-export function verifyAccessToken(
-	token: string | undefined | null,
-	cookieName: string,
-	resourceId: string,
-	nowMs: number,
-): string | null {
-	if (!token) return null;
-	const key = secret();
-	if (!key) return null;
-	const dot = token.indexOf(".");
-	if (dot <= 0) return null;
-	const payloadB64 = token.slice(0, dot);
-	const sig = token.slice(dot + 1);
-	if (!safeEqual(sig, hmac(payloadB64, key))) return null;
-	try {
-		const p = JSON.parse(Buffer.from(payloadB64, "base64url").toString()) as {
-			c?: string;
-			r?: string;
-			e?: string;
-			x?: number;
-		};
-		if (p.c !== cookieName) return null;
-		if (p.r !== resourceId) return null;
-		if (typeof p.x !== "number" || p.x < nowMs) return null;
-		return typeof p.e === "string" ? p.e : null;
-	} catch {
-		return null;
-	}
-}
-
-/**
- * Like `verifyAccessToken` but returns the full verified identity
- * ({email, name, phone, segmentation}) so a gate that carries a display name in
- * the token (the public GPT lead-capture gate) can seed the visitor's name — not
- * just the email — at SSR, and the quiz gate can seed the captured prospect
- * segmentation the same way. Same signature/expiry/gate-binding checks; null on
- * any failure. A token minted BEFORE segmentation existed carries no `s` key and
- * verifies identically (segmentation comes back undefined) — never an error.
- */
-export function verifyAccessTokenIdentity(
-	token: string | undefined | null,
-	cookieName: string,
-	resourceId: string,
-	nowMs: number,
-): {
-	email: string;
-	name?: string;
-	phone?: string;
-	segmentation?: GateSegmentation;
-} | null {
-	if (!token) return null;
-	const key = secret();
-	if (!key) return null;
-	const dot = token.indexOf(".");
-	if (dot <= 0) return null;
-	const payloadB64 = token.slice(0, dot);
-	const sig = token.slice(dot + 1);
-	if (!safeEqual(sig, hmac(payloadB64, key))) return null;
-	try {
-		const p = JSON.parse(Buffer.from(payloadB64, "base64url").toString()) as {
-			c?: string;
-			r?: string;
-			e?: string;
-			x?: number;
-			n?: string;
-			p?: string;
-			s?: GateSegmentation;
-		};
-		if (p.c !== cookieName) return null;
-		if (p.r !== resourceId) return null;
-		if (typeof p.x !== "number" || p.x < nowMs) return null;
-		if (typeof p.e !== "string") return null;
-		const segmentation =
-			p.s && typeof p.s === "object"
-				? {
-						company: typeof p.s.company === "string" ? p.s.company : undefined,
-						linkedinUrl:
-							typeof p.s.linkedinUrl === "string" ? p.s.linkedinUrl : undefined,
-						website: typeof p.s.website === "string" ? p.s.website : undefined,
-						teamSize: typeof p.s.teamSize === "string" ? p.s.teamSize : undefined,
-					}
-				: undefined;
-		return {
-			email: p.e,
-			name: typeof p.n === "string" ? p.n : undefined,
-			phone: typeof p.p === "string" ? p.p : undefined,
-			segmentation,
-		};
-	} catch {
-		return null;
-	}
-}