@teamscala/service-boot 0.23.524 → 0.23.525

package/src/content-gate/config-types.ts

@@ -3,63 +3,21 @@
  * @status handwritten
  */
 
+import type { GateSegmentation } from "@teamscala/agreement-generation/content-gate-token";
+
 type Resolved = Record<string, unknown>;
 
-/**
- * Optional prospect-segmentation a lead-capture gate may capture alongside the
- * identity. The quiz gate collects these on its composed identity screen; the
- * token carries them so the next render and the final submit know the visitor
- * fully, with NO client storage (same reasoning as the captured name/phone).
- */
-export interface GateSegmentation {
-	company?: string;
-	linkedinUrl?: string;
-	website?: string;
-	teamSize?: string;
-}
+export type { GateSegmentation };
 
-/** Drives the SSR-time gate (gate.ts / runContentGate). */
 export interface ContentGateConfig {
-	/** Cookie that carries this gate's access token (e.g. "ag_token"). */
 	cookieName: string;
-	/**
-	 * The gated resource id from the resolved graph, or "" when this gate does
-	 * not apply to the current page (the engine then no-ops). This is also how a
-	 * gate detects "is this my kind of page". Async to allow DB-backed resolution
-	 * (e.g. agreement gate resolving the UUID from the page→agreement association
-	 * when no pre-placed gate block exists).
-	 */
 	getResourceId(resolved: Resolved): string | Promise<string>;
-	/**
-	 * Verify the cookie's token for this resource → the verified identity
-	 * ({email, optional display name}), or null. Token-agnostic by design:
-	 * proposals use the shared content-gate token; agreements keep their existing
-	 * token (also minted by the signing ORPC), so the engine never assumes one
-	 * token format. Allow-list gates return just {email}; the GPT lead-capture
-	 * gate also returns the captured name (carried in its token).
-	 */
 	verifyToken(
 		token: string | undefined,
 		resourceId: string,
 		nowMs: number,
 	): { email: string; name?: string; phone?: string; segmentation?: GateSegmentation } | null;
-	/**
-	 * BAKED-IN unified auth. When a gate provides this resolver, the engine
-	 * AUTOMATICALLY releases a logged-in viewer whose session email is in the
-	 * authorized set — with no valid token and no per-gate code. This is the
-	 * platform default for EVERY gated resource: any application surface with
-	 * authentication gets "a signed-in, authorized viewer is never re-asked for
-	 * their email/OTP" for free, just by exposing its authorized-email set (the
-	 * same resolver its AccessConfig uses). Not called when the session is
-	 * anonymous. Omit only for open-capture gates that have no authorized set.
-	 */
 	resolveAuthorizedEmails?(resourceId: string): Promise<Set<string>>;
-	/**
-	 * OPTIONAL OVERRIDE of the baked-in session check above — for the rare gate
-	 * whose session→identity rule isn't simply "session email ∈ authorized set".
-	 * When present it wins; otherwise the engine uses `resolveAuthorizedEmails`.
-	 * Called only when no valid access token is present.
-	 */
 	sessionAuthorize?(
 		resolved: Resolved,
 		resourceId: string,
@@ -67,62 +25,23 @@ export interface ContentGateConfig {
 		| { email: string; name?: string }
 		| null
 		| Promise<{ email: string; name?: string } | null>;
-	/** Reveal + seed the verified viewer's identity/session (token was valid). */
 	onAuthorized(
 		resolved: Resolved,
 		resourceId: string,
 		identity: { email: string; name?: string; phone?: string; segmentation?: GateSegmentation },
 	): void | Promise<void>;
-	/** Withhold content (strip/inject the gate) — token absent/invalid. Async-
-	 *  capable so a gate can load its display/behaviour settings from a registry
-	 *  row (DB-driven, not hardcoded); sync implementations remain valid. */
 	onUnauthorized(resolved: Resolved, resourceId: string): void | Promise<void>;
-	/**
-	 * OPT-IN REQUIRED-GATE-ENTRY. When set, a valid token authorizes ONLY on a
-	 * request that also carries this marker cookie — set by the access endpoint
-	 * alongside the token and consumed (cleared) by the render it authorizes, so
-	 * the marker lives exactly one view: the submit's own redirect releases the
-	 * content, and every later load (a refresh) is unauthorized, showing the
-	 * gate again. Omit for gates whose token is session-scoped by design.
-	 */
 	entryCookieName?: string;
 }
 
-/** Drives the public access endpoint (access.ts / attachContentGateAccess). */
 export interface AccessConfig {
-	/** Route to mount, e.g. "/api/proposal-access". */
 	path: string;
-	/** Cookie to set on a match. */
 	cookieName: string;
-	/** Cookie lifetime in ms (Max-Age). */
 	ttlMs: number;
-	/**
-	 * Marker cookie set alongside the token on a match. The gate requires it
-	 * (ContentGateConfig.entryCookieName) and the render it authorizes clears
-	 * it, so it authorizes exactly the submit's own redirect.
-	 */
 	entryCookieName?: string;
-	/** Form field carrying the resource id, e.g. "proposalId". */
 	recordIdField: string;
-	/**
-	 * Open lead-capture gate: ANY non-empty email is accepted (no allow-list).
-	 * For surfaces whose "gate" captures a visitor rather than authorizing one
-	 * against a fixed set (the public GPT). When true, `resolveAuthorizedEmails`
-	 * is not called. Default/omitted = allow-list mode (proposals, agreements).
-	 */
 	openCapture?: boolean;
-	/**
-	 * The authorized email set for a resource (lowercased), checked server-side.
-	 * Not called when `openCapture` is true.
-	 */
 	resolveAuthorizedEmails(resourceId: string): Promise<Set<string>>;
-	/**
-	 * Mint the access token for a matched email (token-agnostic per gate).
-	 * `name` and `phone` are the optional captured identity, `segmentation` the
-	 * optional captured prospect fields (open-capture gates carry them in the
-	 * token; allow-list gates ignore them). They exist so a capture gate needs
-	 * no browser storage to remember who this is.
-	 */
 	signToken(
 		resourceId: string,
 		email: string,

package/src/content-gate/gate.ts

@@ -3,20 +3,6 @@
  * @status handwritten
  */
 
-/**
- * What a gate decided, so a caller can act on it without re-deriving it.
- *
- * THE ASSISTANT MUST NOT OUTRUN THE GATE. Its runtime context is the whole
- * document serialised, so injecting it for an unauthorized viewer would hand
- * the gated bytes to the chat -- the exact thing the gate exists to withhold.
- * The gate already knows the answer; returning it means the page-route
- * assistant setting reads ONE decision instead of inventing a second notion of
- * "is this viewer allowed" that could drift from this one.
- *
- * `applies: false` means the gate did not govern this page at all (a public
- * page), which is different from an unauthorized viewer and must not be
- * confused with one.
- */
 
 import type { ContentGateConfig } from "./config-types.ts";
 import { parseCookie } from "./parse-cookie.ts";
@@ -81,12 +67,6 @@ export async function runContentGate(
 	return { applies: true, authorized: false };
 }
 
-/**
- * The signed-in viewer's authorized identity for this resource, or null. The
- * default (used by every gate) is "session email ∈ the gate's authorized set";
- * a gate may supply a custom sessionAuthorize to override. Anonymous sessions
- * and gates with no authorized-email set return null (stay token-only).
- */
 async function resolveSessionIdentity(
 	resolved: Record<string, unknown>,
 	resourceId: string,

package/src/content-page-floor.ts

@@ -4,11 +4,6 @@
  */
 import { PrimaryResourceMissingError } from "./resource-not-found.ts";
 
-/**
- * A page ROW exists but its body has zero content blocks — a content gap, not a
- * dead link. True only when the row is present yet `puck_data` is absent or its
- * `content` array is empty. Handles string (raw) and object (normalized) puck_data.
- */
 export function pageBodyIsEmpty(page: unknown): boolean {
 	if (!page || typeof page !== "object") return false;
 	const obj = page as Record<string, unknown>;
@@ -27,12 +22,6 @@ export function pageBodyIsEmpty(page: unknown): boolean {
 	return !Array.isArray(data?.content) || (data.content as unknown[]).length === 0;
 }
 
-/**
- * Decide whether a content route should fall to the branded not-found floor.
- * Returns the error to throw (mapped to the floor by bind-page-handler), or null
- * to render normally. `hasResourceType` routes are handled by the existing
- * resource_type missing check (caller-side) — they return null here.
- */
 export function decideContentPageFloor(opts: {
 	hasResourceType: boolean;
 	hasPageContentSource: boolean;

package/src/error-page-logo.ts

@@ -9,7 +9,7 @@ import { registerCacheInvalidation } from "@teamscala/db/notify-listener/cache-i
 import { getServerClient } from "@teamscala/orpc/server-client-registry";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { ServiceInstallConfigSchema } from "./load-service-install-row.ts";
+import { ServiceInstallBootSchema } from "./load-service-install-row.ts";
 
 const logoCache = createCache<string | null>("service-boot:error-page-logo", {
 	ttlMs: 5 * 60_000,
@@ -25,7 +25,7 @@ export async function resolveErrorPageLogo(
 			const cfg = await loadRegistryConfig(
 				"service_install",
 				serviceSlug,
-				ServiceInstallConfigSchema,
+				ServiceInstallBootSchema,
 			);
 			const org = (cfg as { brand_org?: string }).brand_org;
 			if (!org) {
@@ -72,20 +72,10 @@ export async function resolveErrorPageLogo(
 	});
 }
 
-/** Above this byte size, inlining bloats the HTML more than it helps — fall
- * back to a logo-less page. Typical org logos are 5–30 KB, so this only
- * catches a genuinely oversized upload. */
 const MAX_INLINE_LOGO_BYTES = 100 * 1024;
 
 const ASSETS_PREFIX = "/api/assets/";
 
-/**
- * Inline a stored logo value as a `data:<mime>;base64,…` URI by fetching its
- * bytes from S3 (the same store `/api/assets/` proxies to). The stored value
- * IS the servable form — `/api/assets/<key>` — so the bucket key is the path
- * segment after that prefix (single-logo-pathway). Skew-tolerant: any miss →
- * null.
- */
 type LogoStorage = {
 	file(key: string): {
 		stat(): Promise<unknown>;

package/src/expand-roster.ts

@@ -31,7 +31,6 @@ function formatDate(iso: string | null): string {
 	}
 }
 
-/** Resolve a `{{field}}` token for one roster item. */
 function tokenValue(
 	field: string,
 	item: RosterItem,
@@ -55,7 +54,6 @@ function tokenValue(
 	}
 }
 
-/** Replace every `{{field}}` token in a string with the item's value. */
 function substitute(
 	value: string,
 	item: RosterItem,
@@ -66,7 +64,6 @@ function substitute(
 	);
 }
 
-/** The `content` slot arrays a block exposes (Container.props.content, …). */
 function slotArrays(block: Block): unknown[][] {
 	const out: unknown[][] = [];
 	const props = block.props;
@@ -79,7 +76,6 @@ function slotArrays(block: Block): unknown[][] {
 	return out;
 }
 
-/** Deep-clone a template block, binding it to one roster item. */
 function cloneForItem(template: Block, item: RosterItem): Block {
 	const labels = {
 		signed: String(template.props?.signedLabel ?? ""),
@@ -110,7 +106,6 @@ function cloneForItem(template: Block, item: RosterItem): Block {
 	return clone;
 }
 
-/** Is this block a per-party template to expand? */
 function isPartyTemplate(block: Block): boolean {
 	// Generic marker (any block that declares `dataRepeat`)…
 	if (block?.props?.dataRepeat === "parties") return true;
@@ -124,7 +119,6 @@ function isPartyTemplate(block: Block): boolean {
 	return false;
 }
 
-/** Expand every per-party template in a content array, recursing into slots. */
 function expandArray(content: unknown[], parties: RosterItem[]): unknown[] {
 	const out: unknown[] = [];
 	for (const raw of content) {
@@ -144,12 +138,10 @@ function expandArray(content: unknown[], parties: RosterItem[]): unknown[] {
 	return out;
 }
 
-/** Agreement-level tokens (one substitution, not per-party). */
 export interface RosterMeta {
 	[token: string]: string;
 }
 
-/** Substitute `{{agreement.token}}` placeholders in every string prop, in place. */
 function substituteMeta(node: unknown, meta: RosterMeta): unknown {
 	if (typeof node === "string") {
 		return node.replace(/\{\{\s*agreement\.(\w+)\s*\}\}/g, (_m, t) =>
@@ -166,7 +158,6 @@ function substituteMeta(node: unknown, meta: RosterMeta): unknown {
 	return node;
 }
 
-/** Expand roster templates + bind agreement-meta placeholders across regions. */
 export function expandRosterTemplates(
 	resolved: Record<string, unknown>,
 	parties: RosterItem[],

package/src/gpt-gate.ts

@@ -4,7 +4,7 @@
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-import { signAccessToken, verifyAccessTokenIdentity } from "./content-gate/token.ts";
+import { signAccessToken, verifyAccessTokenIdentity } from "@teamscala/agreement-generation/content-gate-token";
 import { gptTtlMs } from "./gate-ttls.ts";
 
 const GPT_COOKIE = "gpt_token";

package/src/hono-error-handler.ts

@@ -8,10 +8,6 @@ import { buildErrorReport } from "@teamscala/os/errors/error-report";
 import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
 
-/**
- * Returns an `app.onError` handler tagged with `label` (used in the log line so
- * the boot site that surfaced the error is identifiable).
- */
 export function createRequestErrorHandler(label: string) {
 	return (err: unknown, c: Context): Response => {
 		// Errors must never be swallowed (errors-always-logged): every unhandled

package/src/install-logging.ts

@@ -17,16 +17,9 @@ import { loadRegistryConfig as dbLoadRegistryConfig } from "@teamscala/db/regist
 import { configure as httpConfigure } from "@teamscala/http/configure";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { initSentry } from "@teamscala/logger/init-sentry";
-import { attachRequestLogger } from "@teamscala/logger/install-logging";
 import { getRequestContext } from "@teamscala/logger/request-context-async";
 import { configure as orpcConfigure } from "@teamscala/orpc/configure";
 
-// Re-exported from @teamscala/logger (the canonical home, per
-// vertical-dependency-only). service-boot consumers that previously
-// imported from service-boot/install-logging continue to work; the
-// implementation lives once in @teamscala/logger.
-export { attachRequestLogger };
-
 const CONSOLE_METHODS = [
 	"log",
 	"info",
@@ -51,29 +44,13 @@ export function installLogging(opts: InstallLoggingOptions): void {
 	installConsoleShim(serviceSlug);
 	installProcessHandlers(serviceSlug);
 
-	// Bootloader injection per `bootloader-injection-contract`. After
-	// initSentry + the console redirect, the logger surface is live; inject it
-	// into every configurable primitive that defaults to noop. The list is
-	// enumerated here; it becomes registry-driven once #57 lands.
 	const log = getAppLogger();
-	// Persisted last-known-good tier for registry config reads — created here
-	// (runtime tier) so host-path resolution stays out of the foundation-tier
-	// db package, which cannot import @teamscala/cache or resolve userHome itself.
-	// load-config serves this on a transient DB failure instead of crash-looping.
-	// The root is stateRoot(), not userHome(): a container that declares a
-	// read-only HOME (scala-sign prod: HOME=/var/empty) made this cache EACCES on
-	// every request — the tier died in exactly the outage class it exists for.
 	const registryConfigDiskCache = createDiskCache("db:registry-config", {
 		dir: join(stateRoot(), ".scala-db-cache", "registry-config"),
 		ttlMs: 24 * 60 * 60 * 1000,
 	});
 	dbConfigure({
 		logger: log,
-		// `as never` bridges the configured-primitives type gap: db holds
-		// structural approximations of these foundation factories (it cannot
-		// import @teamscala/cache/timing for the real CacheOptions/TimerOptions
-		// without re-creating the same-tier edge). The runtime values are the
-		// real factories; the cast only reconciles the approximate signatures.
 		ManagedCache: ManagedCache as never,
 		createCache: createCache as never,
 		createTimer: createTimer as never,
@@ -92,10 +69,6 @@ export function installLogging(opts: InstallLoggingOptions): void {
 		logger: log,
 		requestContextProvider: () => getRequestContext(),
 	});
-	// @teamscala/mcp-multi-session and @teamscala/tool-executor are MCP-only;
-	// their configure() calls moved to @teamscala/mcp-tool-runtime/mount.ts
-	// per `runtime-deps-universal-only`. MCP services declare mcp-tool-runtime
-	// in service_install.server_packages and pick up the configures there.
 }
 
 function installConsoleShim(serviceSlug: string): void {
@@ -149,8 +122,3 @@ function safeStringify(v: unknown): string {
 		return String(v);
 	}
 }
-// No event-driven invalidation subscription here: this module caches nothing.
-// The removed block opened a dedicated LISTEN connection whose handler was
-// empty `() => {}` — a connection held for the process lifetime to run no
-// code. Registering a no-op against the shared listener would be the same
-// defect one layer down, so it is deleted rather than migrated.

package/src/load-page-manifest.ts

@@ -10,12 +10,6 @@ interface PageManifestModule {
 	components?: Record<string, RendererComponentEntry>;
 }
 
-/**
- * Reads the generated manifest's `components` export. Throws when the file is
- * absent or exports nothing — an empty manifest means codegen has not run for
- * this service, which is a build problem the operator must see named, not a
- * degraded runtime state to paper over.
- */
 export async function loadPageManifest(
 	serviceSlug: string,
 ): Promise<Record<string, RendererComponentEntry>> {

package/src/load-service-install-row.ts

@@ -9,7 +9,6 @@ import {
 	RegistryValidationError,
 } from "@teamscala/db/registry/require";
 import { normalizeRegistryConfigObject } from "@teamscala/db/registry/validation";
-import type { ServiceInstallConfig } from "@teamscala/db-validation/registry-schemas/service-install";
 import {
 	enforceExplicitRenderMode,
 	ServiceInstallConfigSchema,
@@ -17,8 +16,32 @@ import {
 } from "@teamscala/db-validation/registry-schemas/service-install";
 import * as v from "valibot";
 
-export { ServiceInstallConfigSchema } from "@teamscala/db-validation/registry-schemas/service-install";
-export type { ServiceInstallConfig };
+const BOOT_ROW_KEYS = [
+	"access",
+	"api_routes",
+	"app_port",
+	"auth",
+	"block_packages",
+	"boot_hooks",
+	"brand_org",
+	"home_path",
+	"kind",
+	"orpc_router",
+	"portal_scoped",
+	"port",
+	"providers",
+	"render_mode",
+	"server_packages",
+	"websocket_routes",
+] as const;
+
+export const ServiceInstallBootSchema = v.object(
+	v.pick(ServiceInstallConfigSchema.pipe[0], BOOT_ROW_KEYS).entries,
+);
+
+export type ServiceInstallConfig = v.InferOutput<
+	typeof ServiceInstallBootSchema
+>;
 
 export interface LoadServiceInstallRowResult {
 	success: true;
@@ -49,9 +72,23 @@ export async function loadServiceInstallRow(
 			`service_install:${serviceSlug}`,
 		) as Record<string, unknown>;
 		enforceExplicitRenderMode(serviceSlug, rawConfig);
-		const config = v.parse(ServiceInstallConfigSchema, rawConfig);
+		const config = v.parse(ServiceInstallBootSchema, rawConfig);
 		return { success: true, config };
 	} catch (err) {
+		if (err instanceof v.ValiError) {
+			const issues = err.issues
+				.map((issue) => {
+					const path = v.getDotPath(issue);
+					return path ? `${path}: ${issue.message}` : issue.message;
+				})
+				.join("; ");
+			return {
+				success: false,
+				error: "validation_failed",
+				slug: serviceSlug,
+				message: `service_install row for "${serviceSlug}" has a key the boot reads missing or malformed: ${issues}`,
+			};
+		}
 		if (err instanceof RegistryMissingError) {
 			const sql = `INSERT INTO registry_entries (type, slug, config, is_active) VALUES ('service_install', '${serviceSlug}', '{"kind":"ui","render_mode":"public","port":null,"page_routes":[],"providers":[],"api_routes":[],"block_packages":[],"teamgbg_packages":[],"env_vars":[]}'::jsonb, true);`;
 			return {

package/src/module-not-found.ts

@@ -3,22 +3,11 @@
  * @status handwritten
  */
 
-/** `@scope/name/sub/path.ts` -> `@scope/name`; `name/sub` -> `name`. */
 export function barePackageOf(specifier: string): string {
 	const parts = specifier.split("/");
 	return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
 }
 
-/**
- * True when the import failed because `requestedPath` itself is absent.
- *
- * Bun reports an unexported SUBPATH as `Cannot find package '<bare>'`, naming
- * the package rather than the subpath, so the bare name of THIS candidate
- * counts as not-found. Without that the first candidate's miss is
- * misclassified as fatal and the fallbacks never run (measured 2026-08-24:
- * scala-agents-ui crash-looped because cli-session exports ./boot/mount.ts and
- * not ./mount.ts). A transitive miss naming a DIFFERENT module still surfaces.
- */
 export function isModuleNotFound(err: unknown, requestedPath: string): boolean {
 	const msg =
 		(err as { message?: string })?.message ??