@teamscala/service-boot 0.23.523 → 0.23.525

package/src/content-gate/config-types.ts

@@ -1,71 +1,23 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The config contracts that PROGRAM a content gate. Each gated content type
- * (agreement, proposal, …) is one ContentGateConfig + one AccessConfig — no
- * bespoke gate functions per type; the engine (gate.ts) and the access mounter
- * (access.ts) are the single shared primitive driven by these.
  */
 
+import type { GateSegmentation } from "@teamscala/agreement-generation/content-gate-token";
+
 type Resolved = Record<string, unknown>;
 
-/**
- * Optional prospect-segmentation a lead-capture gate may capture alongside the
- * identity. The quiz gate collects these on its composed identity screen; the
- * token carries them so the next render and the final submit know the visitor
- * fully, with NO client storage (same reasoning as the captured name/phone).
- */
-export interface GateSegmentation {
-	company?: string;
-	linkedinUrl?: string;
-	website?: string;
-	teamSize?: string;
-}
+export type { GateSegmentation };
 
-/** Drives the SSR-time gate (gate.ts / runContentGate). */
 export interface ContentGateConfig {
-	/** Cookie that carries this gate's access token (e.g. "ag_token"). */
 	cookieName: string;
-	/**
-	 * The gated resource id from the resolved graph, or "" when this gate does
-	 * not apply to the current page (the engine then no-ops). This is also how a
-	 * gate detects "is this my kind of page". Async to allow DB-backed resolution
-	 * (e.g. agreement gate resolving the UUID from the page→agreement association
-	 * when no pre-placed gate block exists).
-	 */
 	getResourceId(resolved: Resolved): string | Promise<string>;
-	/**
-	 * Verify the cookie's token for this resource → the verified identity
-	 * ({email, optional display name}), or null. Token-agnostic by design:
-	 * proposals use the shared content-gate token; agreements keep their existing
-	 * token (also minted by the signing ORPC), so the engine never assumes one
-	 * token format. Allow-list gates return just {email}; the GPT lead-capture
-	 * gate also returns the captured name (carried in its token).
-	 */
 	verifyToken(
 		token: string | undefined,
 		resourceId: string,
 		nowMs: number,
 	): { email: string; name?: string; phone?: string; segmentation?: GateSegmentation } | null;
-	/**
-	 * BAKED-IN unified auth. When a gate provides this resolver, the engine
-	 * AUTOMATICALLY releases a logged-in viewer whose session email is in the
-	 * authorized set — with no valid token and no per-gate code. This is the
-	 * platform default for EVERY gated resource: any application surface with
-	 * authentication gets "a signed-in, authorized viewer is never re-asked for
-	 * their email/OTP" for free, just by exposing its authorized-email set (the
-	 * same resolver its AccessConfig uses). Not called when the session is
-	 * anonymous. Omit only for open-capture gates that have no authorized set.
-	 */
 	resolveAuthorizedEmails?(resourceId: string): Promise<Set<string>>;
-	/**
-	 * OPTIONAL OVERRIDE of the baked-in session check above — for the rare gate
-	 * whose session→identity rule isn't simply "session email ∈ authorized set".
-	 * When present it wins; otherwise the engine uses `resolveAuthorizedEmails`.
-	 * Called only when no valid access token is present.
-	 */
 	sessionAuthorize?(
 		resolved: Resolved,
 		resourceId: string,
@@ -73,62 +25,23 @@ export interface ContentGateConfig {
 		| { email: string; name?: string }
 		| null
 		| Promise<{ email: string; name?: string } | null>;
-	/** Reveal + seed the verified viewer's identity/session (token was valid). */
 	onAuthorized(
 		resolved: Resolved,
 		resourceId: string,
 		identity: { email: string; name?: string; phone?: string; segmentation?: GateSegmentation },
 	): void | Promise<void>;
-	/** Withhold content (strip/inject the gate) — token absent/invalid. Async-
-	 *  capable so a gate can load its display/behaviour settings from a registry
-	 *  row (DB-driven, not hardcoded); sync implementations remain valid. */
 	onUnauthorized(resolved: Resolved, resourceId: string): void | Promise<void>;
-	/**
-	 * OPT-IN REQUIRED-GATE-ENTRY. When set, a valid token authorizes ONLY on a
-	 * request that also carries this marker cookie — set by the access endpoint
-	 * alongside the token and consumed (cleared) by the render it authorizes, so
-	 * the marker lives exactly one view: the submit's own redirect releases the
-	 * content, and every later load (a refresh) is unauthorized, showing the
-	 * gate again. Omit for gates whose token is session-scoped by design.
-	 */
 	entryCookieName?: string;
 }
 
-/** Drives the public access endpoint (access.ts / attachContentGateAccess). */
 export interface AccessConfig {
-	/** Route to mount, e.g. "/api/proposal-access". */
 	path: string;
-	/** Cookie to set on a match. */
 	cookieName: string;
-	/** Cookie lifetime in ms (Max-Age). */
 	ttlMs: number;
-	/**
-	 * Marker cookie set alongside the token on a match. The gate requires it
-	 * (ContentGateConfig.entryCookieName) and the render it authorizes clears
-	 * it, so it authorizes exactly the submit's own redirect.
-	 */
 	entryCookieName?: string;
-	/** Form field carrying the resource id, e.g. "proposalId". */
 	recordIdField: string;
-	/**
-	 * Open lead-capture gate: ANY non-empty email is accepted (no allow-list).
-	 * For surfaces whose "gate" captures a visitor rather than authorizing one
-	 * against a fixed set (the public GPT). When true, `resolveAuthorizedEmails`
-	 * is not called. Default/omitted = allow-list mode (proposals, agreements).
-	 */
 	openCapture?: boolean;
-	/**
-	 * The authorized email set for a resource (lowercased), checked server-side.
-	 * Not called when `openCapture` is true.
-	 */
 	resolveAuthorizedEmails(resourceId: string): Promise<Set<string>>;
-	/**
-	 * Mint the access token for a matched email (token-agnostic per gate).
-	 * `name` and `phone` are the optional captured identity, `segmentation` the
-	 * optional captured prospect fields (open-capture gates carry them in the
-	 * token; allow-list gates ignore them). They exist so a capture gate needs
-	 * no browser storage to remember who this is.
-	 */
 	signToken(
 		resourceId: string,
 		email: string,

package/src/content-gate/gate-entry-clears.ts

@@ -1,24 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * REQUEST-SCOPED channel for gate-entry marker clears. A gate that declares an
- * entry marker (config.entryCookieName) consumes it on the render that the
- * access endpoint's own redirect produces; that render's response must clear
- * the marker, or the next load (a refresh) would still carry it and skip the
- * gate. The gate writes the name here; bindPageHandler — which owns the page
- * Response — drains it into Set-Cookie, so the marker lives exactly one view.
- *
- * THE CLEARS COME BACK AS THE CALL'S RETURN VALUE, never from a post-hoc
- * read: the store only exists inside the run() scope, so a reader called after
- * the awaited call has already left it and would see an empty list — which is
- * exactly how the first version of this file shipped a marker that was never
- * cleared (measured live 2026-09-14: the cookie survived the render).
- *
- * AsyncLocalStorage rather than a module-level map: request-scoped by
- * construction, no accumulated process state that a restart would silently
- * reset (in-memory-state-is-not-durable).
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 

package/src/content-gate/gate.ts

@@ -1,29 +1,8 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The content-gate ENGINE. Runs in the page loader after the resource graph
- * resolves, BEFORE SSR. Orchestration only — the per-type behaviour (which
- * resource, who's authorized, what to seed, how to withhold) is supplied by a
- * ContentGateConfig, so agreements/proposals/future gates are configs, not new
- * functions. The single place that decides whether gated bytes reach the HTML.
  */
 
-/**
- * What a gate decided, so a caller can act on it without re-deriving it.
- *
- * THE ASSISTANT MUST NOT OUTRUN THE GATE. Its runtime context is the whole
- * document serialised, so injecting it for an unauthorized viewer would hand
- * the gated bytes to the chat -- the exact thing the gate exists to withhold.
- * The gate already knows the answer; returning it means the page-route
- * assistant setting reads ONE decision instead of inventing a second notion of
- * "is this viewer allowed" that could drift from this one.
- *
- * `applies: false` means the gate did not govern this page at all (a public
- * page), which is different from an unauthorized viewer and must not be
- * confused with one.
- */
 
 import type { ContentGateConfig } from "./config-types.ts";
 import { parseCookie } from "./parse-cookie.ts";
@@ -88,12 +67,6 @@ export async function runContentGate(
 	return { applies: true, authorized: false };
 }
 
-/**
- * The signed-in viewer's authorized identity for this resource, or null. The
- * default (used by every gate) is "session email ∈ the gate's authorized set";
- * a gate may supply a custom sessionAuthorize to override. Anonymous sessions
- * and gates with no authorized-email set return null (stay token-only).
- */
 async function resolveSessionIdentity(
 	resolved: Record<string, unknown>,
 	resourceId: string,

package/src/content-gate/parse-cookie.ts

@@ -1,10 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Parse a single cookie value out of a raw Cookie header — shared by the
- * content-gate engine and any gate config.
  */
 
 export function parseCookie(

package/src/content-page-floor.ts

@@ -1,31 +1,9 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Pure decision: does a CONTENT route (no resource_type) whose loader resolved
- * a `page` body source warrant the branded not-found floor? Extracted from
- * register-registry-page-route so the rule is unit-testable independent of the
- * Hono/DB/graph machinery that wraps it (the fix's correctness does not depend
- * on the publish — verify-before-done).
- *
- * Three outcomes:
- *   - no page row (deleted/unmatched path, e.g. /roadmap) → dead-link 404 floor
- *   - page row exists but zero content blocks → empty-page 200 floor
- *   - otherwise → null (render normally)
- *
- * The "Vision Toolbar" leak this closes: a content catchall synthesized an empty
- * page for an unmatched path and served a cacheable 200; resource-not-found-is-
- * the-root-floor only fired for resource_type routes, so dead content links fell
- * through. See resource-not-found.ts for the floor + operator ruling 2026-07-21.
  */
 import { PrimaryResourceMissingError } from "./resource-not-found.ts";
 
-/**
- * A page ROW exists but its body has zero content blocks — a content gap, not a
- * dead link. True only when the row is present yet `puck_data` is absent or its
- * `content` array is empty. Handles string (raw) and object (normalized) puck_data.
- */
 export function pageBodyIsEmpty(page: unknown): boolean {
 	if (!page || typeof page !== "object") return false;
 	const obj = page as Record<string, unknown>;
@@ -44,12 +22,6 @@ export function pageBodyIsEmpty(page: unknown): boolean {
 	return !Array.isArray(data?.content) || (data.content as unknown[]).length === 0;
 }
 
-/**
- * Decide whether a content route should fall to the branded not-found floor.
- * Returns the error to throw (mapped to the floor by bind-page-handler), or null
- * to render normally. `hasResourceType` routes are handled by the existing
- * resource_type missing check (caller-side) — they return null here.
- */
 export function decideContentPageFloor(opts: {
 	hasResourceType: boolean;
 	hasPageContentSource: boolean;

package/src/csrf-protection.ts

@@ -1,33 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * csrf-protection.ts — platform CSRF middleware (`security-csrf-protection`).
- *
- * Hono's csrf() with a DERIVED trusted-origin set, never a hand-authored
- * allowlist: every trusted origin comes from ONE source per
- * `offered-is-derived` —
- *   - the managed base domain (registry portal-domains) covers the platform's
- *     own `*.scala.business` origins, INCLUDING the cross-service form POST
- *     redirect chains CSP form-action allowlists (proposals → sign etc.), so
- *     the CSRF origin set and the CSP form-action set cannot disagree about
- *     what "one of ours" means;
- *   - customer custom domains resolve through `isTrustedAuthOrigin`
- *     (builda_websites lookup) — the SAME lookup better-auth's trustedOrigins
- *     uses in @teamscala/auth, so a new custom domain is trusted everywhere at
- *     once or nowhere.
- *
- * hono csrf() arms only on form-element content types (urlencoded, multipart,
- * text/plain) — browsers cannot produce a cross-site application/json request
- * from a form, so the JSON API surface (ORPC) is protected by cookie
- * SameSite=Lax + this middleware's text/plain coverage.
- *
- * Custom-domain lookups are cached per-hostname with a TTL: a POSITIVE result
- * is cached for the full TTL (a domain that stopped being ours keeps working
- * for at most the TTL), a NEGATIVE result for a short window (a brand-new
- * custom domain becomes trusted within seconds). The cache is a request
- * accelerator over a DB fact, never the source of truth.
  */
 
 import { getManagedBaseDomain } from "@teamscala/auth/auth-env-resolution";

package/src/error-page-logo.ts

@@ -1,29 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The error/holding page's brand logo: resolve the host org's dark-theme
- * wordmark from its install row and inline it as a data URI. Split from
- * resource-not-found.ts under single-purpose-file (the builder consumes a
- * logoUrl argument; only these resolvers touch storage and the registry).
- *
- * The host org's LOGO (wordmark) for the dark error page — the favicon is a
- * tab glyph, the wrong asset at page scale (operator-observed: a lone "h"
- * where the launcha wordmark belonged). Resolution: the service's own
- * install row names its owner (brand_org); the org's dark-theme logo (a
- * light-coloured mark, correct on the dark page) is preferred, light-theme
- * second. Every step skew-tolerant: any miss → null → the builder renders a
- * logo-less dark page.
- *
- * Returns the logo as an INLINE data URI (not a `/api/assets/` proxy URL) so
- * the branded holding/error page ships the logo IN the initial HTML bytes —
- * no second fetch, no post-paint pop-in, no dependency on the asset proxy the
- * degraded service is failing to serve (incident 2026-07-27: the logo on a
- * DEGRADED render-layer holding page appeared after the page painted). The
- * logo sibling of icons-render-ssr-inline. Size-capped: a pathological
- * (>MAX_INLINE_LOGO_BYTES) logo falls back to null rather than bloating the
- * HTML; the page renders logo-less, never broken.
  */
 
 import { getClient } from "@teamscala/object-storage/create/client/get-client";
@@ -32,7 +9,7 @@ import { registerCacheInvalidation } from "@teamscala/db/notify-listener/cache-i
 import { getServerClient } from "@teamscala/orpc/server-client-registry";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { ServiceInstallConfigSchema } from "./load-service-install-row.ts";
+import { ServiceInstallBootSchema } from "./load-service-install-row.ts";
 
 const logoCache = createCache<string | null>("service-boot:error-page-logo", {
 	ttlMs: 5 * 60_000,
@@ -48,7 +25,7 @@ export async function resolveErrorPageLogo(
 			const cfg = await loadRegistryConfig(
 				"service_install",
 				serviceSlug,
-				ServiceInstallConfigSchema,
+				ServiceInstallBootSchema,
 			);
 			const org = (cfg as { brand_org?: string }).brand_org;
 			if (!org) {
@@ -95,20 +72,10 @@ export async function resolveErrorPageLogo(
 	});
 }
 
-/** Above this byte size, inlining bloats the HTML more than it helps — fall
- * back to a logo-less page. Typical org logos are 5–30 KB, so this only
- * catches a genuinely oversized upload. */
 const MAX_INLINE_LOGO_BYTES = 100 * 1024;
 
 const ASSETS_PREFIX = "/api/assets/";
 
-/**
- * Inline a stored logo value as a `data:<mime>;base64,…` URI by fetching its
- * bytes from S3 (the same store `/api/assets/` proxies to). The stored value
- * IS the servable form — `/api/assets/<key>` — so the bucket key is the path
- * segment after that prefix (single-logo-pathway). Skew-tolerant: any miss →
- * null.
- */
 type LogoStorage = {
 	file(key: string): {
 		stat(): Promise<unknown>;

package/src/expand-roster.ts

@@ -1,21 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Server-side roster expansion — the executor that handles "render N of block X
- * per data row" so the page never needs a domain-specific panel/list block. A
- * block authored with `props.dataRepeat: "parties"` is a TEMPLATE; before SSR
- * this clones it once per roster item into its parent slot (top-level content or
- * any Container's `content` slot), then drops the marker. Each clone:
- *   - sets `role` + `dataKey` to the item's key, so a prop-driven block (the
- *     SignatureField cell) finds its own party with no per-clone wiring;
- *   - substitutes `{{name}}` / `{{role}}` / `{{company}}` / `{{date}}` /
- *     `{{status}}` placeholders in any string prop (so a recipient row is plain
- *     `Container` + `Text` primitives — the copy lives on the page, not here).
- *     `{{status}}` resolves from the template's own `signedLabel` /
- *     `awaitingLabel` props (DB-driven copy), never hardcoded.
- * Generic over any roster; the agreement page passes its parties.
  */
 
 export interface RosterItem {
@@ -46,7 +31,6 @@ function formatDate(iso: string | null): string {
 	}
 }
 
-/** Resolve a `{{field}}` token for one roster item. */
 function tokenValue(
 	field: string,
 	item: RosterItem,
@@ -70,7 +54,6 @@ function tokenValue(
 	}
 }
 
-/** Replace every `{{field}}` token in a string with the item's value. */
 function substitute(
 	value: string,
 	item: RosterItem,
@@ -81,7 +64,6 @@ function substitute(
 	);
 }
 
-/** The `content` slot arrays a block exposes (Container.props.content, …). */
 function slotArrays(block: Block): unknown[][] {
 	const out: unknown[][] = [];
 	const props = block.props;
@@ -94,7 +76,6 @@ function slotArrays(block: Block): unknown[][] {
 	return out;
 }
 
-/** Deep-clone a template block, binding it to one roster item. */
 function cloneForItem(template: Block, item: RosterItem): Block {
 	const labels = {
 		signed: String(template.props?.signedLabel ?? ""),
@@ -125,7 +106,6 @@ function cloneForItem(template: Block, item: RosterItem): Block {
 	return clone;
 }
 
-/** Is this block a per-party template to expand? */
 function isPartyTemplate(block: Block): boolean {
 	// Generic marker (any block that declares `dataRepeat`)…
 	if (block?.props?.dataRepeat === "parties") return true;
@@ -139,7 +119,6 @@ function isPartyTemplate(block: Block): boolean {
 	return false;
 }
 
-/** Expand every per-party template in a content array, recursing into slots. */
 function expandArray(content: unknown[], parties: RosterItem[]): unknown[] {
 	const out: unknown[] = [];
 	for (const raw of content) {
@@ -159,12 +138,10 @@ function expandArray(content: unknown[], parties: RosterItem[]): unknown[] {
 	return out;
 }
 
-/** Agreement-level tokens (one substitution, not per-party). */
 export interface RosterMeta {
 	[token: string]: string;
 }
 
-/** Substitute `{{agreement.token}}` placeholders in every string prop, in place. */
 function substituteMeta(node: unknown, meta: RosterMeta): unknown {
 	if (typeof node === "string") {
 		return node.replace(/\{\{\s*agreement\.(\w+)\s*\}\}/g, (_m, t) =>
@@ -181,7 +158,6 @@ function substituteMeta(node: unknown, meta: RosterMeta): unknown {
 	return node;
 }
 
-/** Expand roster templates + bind agreement-meta placeholders across regions. */
 export function expandRosterTemplates(
 	resolved: Record<string, unknown>,
 	parties: RosterItem[],

package/src/gate-ttls.ts

@@ -1,18 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Cached readers for the content-gate access-token TTL config rows
- * (agreement-gate / proposal-gate / gpt-gate / quiz-gate). initGateTtls() runs once at boot
- * (two-phase-boot, before the gates mount) to populate the cache from the
- * registry rows; the sync getters (agTtlMs/propTtlMs/gptTtlMs) return the
- * cached value — or the former hardcoded default before init / on row-miss — so
- * the sync AccessConfig.ttlMs fields + sync hono magic-link handlers read them
- * without async. Replaces the per-file AG_TTL_MS / PROP_TTL_MS / GPT_TTL_MS
- * constants (config-constants: the registry row is the source, dedup'd across
- * each gate + its attach-* magic counterpart so token TTL and cookie maxAge
- * never drift).
  */
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";

package/src/gpt-gate.ts

@@ -1,28 +1,10 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The PUBLIC GPT identity gate, expressed as config for the content-gate
- * primitive (content-gate/). Unlike proposals/agreements this is NOT access
- * control — every email is a valid visitor (lead capture). Its whole job is to
- * make a returning visitor's identity known AT SSR so the GPT body renders the
- * real conversation on first paint instead of server-rendering the capture gate
- * and then swapping to the chat after hydration (the ssr-then-live-handoff +
- * "know the visitor at SSR first paint" violation: building-applications).
- *
- * Flow: the capture form POSTs {gptId, email} to /api/gpt-access (openCapture →
- * any email matches); the access endpoint sets a signed `gpt_token` cookie. On
- * the next request runContentGate verifies that cookie for this agent and seeds
- * resolved.initialVisitor — which the GPT body serverLoader (ssrGptSession) then
- * uses to SSR-restore the conversation, and GptBodyBlock uses to skip the gate.
- * onUnauthorized is a no-op: an un-gated (first-time) visitor sees the capture
- * form the block renders itself when no visitor is known — that is correct, not
- * a flash (they ARE anonymous), so there is nothing to withhold.
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-import { signAccessToken, verifyAccessTokenIdentity } from "./content-gate/token.ts";
+import { signAccessToken, verifyAccessTokenIdentity } from "@teamscala/agreement-generation/content-gate-token";
 import { gptTtlMs } from "./gate-ttls.ts";
 
 const GPT_COOKIE = "gpt_token";

package/src/hono-error-handler.ts

@@ -1,21 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The single app.onError factory for every Hono app (UI + backend). Two error
- * classes, deliberately separate:
- *  - HTTPException: a DELIBERATE status-bearing throw (e.g. hono bodyLimit's
- *    413). Preserve its status + message verbatim — buildErrorReport only knows
- *    500/503 and would erase a deliberate 413/401/etc.
- *  - anything else: an UNEXPECTED error → buildErrorReport (errorId correlation,
- *    transient-vs-bug classification, 503 + Retry-After when retryable, else 500).
- *
- * Resolves the apparent tension between `hono-global-error-handler` (HTTPException
- * → status + JSON) and `error-responses-via-error-report` (every error response
- * via buildErrorReport): the latter governs UNEXPECTED errors; HTTPException is
- * the documented deliberate-status carve-out. The handler is a consumer of
- * buildErrorReport, never a second classifier for the unexpected branch.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -23,10 +8,6 @@ import { buildErrorReport } from "@teamscala/os/errors/error-report";
 import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
 
-/**
- * Returns an `app.onError` handler tagged with `label` (used in the log line so
- * the boot site that surfaced the error is identifiable).
- */
 export function createRequestErrorHandler(label: string) {
 	return (err: unknown, c: Context): Response => {
 		// Errors must never be swallowed (errors-always-logged): every unhandled

package/src/install-harness.ts

@@ -1,17 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Install harness — sandbox-mounts each declared package and captures
- * registry.require() calls via AsyncLocalStorage. Validates all required
- * rows exist before returning. Throws HarnessInstallError with full
- * context on failure. Per Constitution Rule 2 step 3.
- *
- * Marked: HarnessInstallError is the error class
- * validatePackageDependencies (might) throw — they form one canonical
- * "install harness validation" unit (the validator + the failure-mode
- * class it produces).
  */
 
 import {

package/src/install-logging.ts

@@ -1,20 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * One-call install of the entire logging pipeline. After installLogging()
- * runs, every error in the service — process-level, HTTP middleware, Hono
- * handlers, Puck blocks, even third-party packages calling console.* — is
- * captured by @teamscala/logger and flows to Sentry/GlitchTip (prod) or
- * loga (dev) with full context. Application code never imports the logger
- * or wraps anything in try/catch for telemetry purposes.
- *
- * Two phases, two files (single-purpose-file: the guard counts them as two
- * export groups in one file): installLogging (early bootstrap, hardcoded
- * defaults) lives here; applyLoggerConfig (late-stage, DB-driven) lives in
- * apply-logger-config.ts. The service boot pipeline calls them in sequence
- * with the same serviceSlug.
  */
 
 import { ManagedCache } from "@teamscala/cache/cache";
@@ -31,16 +17,9 @@ import { loadRegistryConfig as dbLoadRegistryConfig } from "@teamscala/db/regist
 import { configure as httpConfigure } from "@teamscala/http/configure";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { initSentry } from "@teamscala/logger/init-sentry";
-import { attachRequestLogger } from "@teamscala/logger/install-logging";
 import { getRequestContext } from "@teamscala/logger/request-context-async";
 import { configure as orpcConfigure } from "@teamscala/orpc/configure";
 
-// Re-exported from @teamscala/logger (the canonical home, per
-// vertical-dependency-only). service-boot consumers that previously
-// imported from service-boot/install-logging continue to work; the
-// implementation lives once in @teamscala/logger.
-export { attachRequestLogger };
-
 const CONSOLE_METHODS = [
 	"log",
 	"info",
@@ -65,29 +44,13 @@ export function installLogging(opts: InstallLoggingOptions): void {
 	installConsoleShim(serviceSlug);
 	installProcessHandlers(serviceSlug);
 
-	// Bootloader injection per `bootloader-injection-contract`. After
-	// initSentry + the console redirect, the logger surface is live; inject it
-	// into every configurable primitive that defaults to noop. The list is
-	// enumerated here; it becomes registry-driven once #57 lands.
 	const log = getAppLogger();
-	// Persisted last-known-good tier for registry config reads — created here
-	// (runtime tier) so host-path resolution stays out of the foundation-tier
-	// db package, which cannot import @teamscala/cache or resolve userHome itself.
-	// load-config serves this on a transient DB failure instead of crash-looping.
-	// The root is stateRoot(), not userHome(): a container that declares a
-	// read-only HOME (scala-sign prod: HOME=/var/empty) made this cache EACCES on
-	// every request — the tier died in exactly the outage class it exists for.
 	const registryConfigDiskCache = createDiskCache("db:registry-config", {
 		dir: join(stateRoot(), ".scala-db-cache", "registry-config"),
 		ttlMs: 24 * 60 * 60 * 1000,
 	});
 	dbConfigure({
 		logger: log,
-		// `as never` bridges the configured-primitives type gap: db holds
-		// structural approximations of these foundation factories (it cannot
-		// import @teamscala/cache/timing for the real CacheOptions/TimerOptions
-		// without re-creating the same-tier edge). The runtime values are the
-		// real factories; the cast only reconciles the approximate signatures.
 		ManagedCache: ManagedCache as never,
 		createCache: createCache as never,
 		createTimer: createTimer as never,
@@ -106,10 +69,6 @@ export function installLogging(opts: InstallLoggingOptions): void {
 		logger: log,
 		requestContextProvider: () => getRequestContext(),
 	});
-	// @teamscala/mcp-multi-session and @teamscala/tool-executor are MCP-only;
-	// their configure() calls moved to @teamscala/mcp-tool-runtime/mount.ts
-	// per `runtime-deps-universal-only`. MCP services declare mcp-tool-runtime
-	// in service_install.server_packages and pick up the configures there.
 }
 
 function installConsoleShim(serviceSlug: string): void {
@@ -163,8 +122,3 @@ function safeStringify(v: unknown): string {
 		return String(v);
 	}
 }
-// No event-driven invalidation subscription here: this module caches nothing.
-// The removed block opened a dedicated LISTEN connection whose handler was
-// empty `() => {}` — a connection held for the process lifetime to run no
-// code. Registering a no-op against the shared listener would be the same
-// defect one layer down, so it is deleted rather than migrated.