@teamscala/service-boot 0.23.524 → 0.23.526

package/src/two-phase-minimal-app.ts

@@ -3,39 +3,6 @@
  * @status handwritten
  */
 
-/**
- * Build the minimal tool-only app. This excludes the expensive operations:
- * - Client asset building (Vite build)
- * - Boot hooks (may have expensive initialization)
- * - Scheduled jobs (can start later)
- * - pg-boss (can start later)
- *
- * CRITICAL: All route registration MUST happen here before serving, because
- * Hono's RegExpRouter compiles on the first request and becomes immutable.
- * Once compiled, no new routes can be added. So we include:
- * - Block discovery and page routes (registers all page paths)
- * - All other routes (API, WS, data, static assets)
- *
- * The minimal app includes everything needed for MCP tools and ORPC:
- * - Error handling, readiness gate, health check
- * - Security headers, CORS, compression, timing
- * - Content gate access, auth gates, static assets
- * - ORPC router, API routes, WS routes, data routes, page routes
- */
-
-	// Fire independent I/O + compilation NOW, overlapping with the gate chain
-	// below. These three touch NO app route and have no ordering dependency on
-	// the gate/mount sequence, so they run concurrently with it:
-	// - preloadServerPackages: warms Bun's module cache (CPU-bound compilation
-	//   that overlaps the gate chain's cross-internet DB I/O — same speculative
-	//   pattern as create-boot-pipeline's preloads). mountServerPackages later
-	//   hits the cache (instant imports), paying only the ~33ms of mount work.
-	// - initGateTtls: loads config rows into module-level vars. The TTL getters
-	//   are read at REQUEST time (inside route-handler closures), not at boot,
-	//   so this only needs to finish before serving — safe to run in parallel.
-	// - discoverBlocks: loads the page-manifest (no app mutation, no gate
-	//   dependency). Its result is consumed by registerPageRoutes much later.
-
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";
 import { createTimer } from "@teamscala/timing/create-timer";
@@ -55,7 +22,7 @@ import { attachPortalMembers } from "./attach-portal-members.ts";
 import { attachTransfersUpload } from "./attach-transfers-upload.ts";
 import { attachAuthGate } from "./auth-gate.ts";
 import { csrfProtection } from "./csrf-protection.ts";
-import { attachRequestLogger } from "./install-logging.ts";
+import { attachRequestLogger } from "@teamscala/logger/install-logging";
 import type { ServiceInstallConfig } from "./load-service-install-row.ts";
 import { mountOrpcRouter } from "./mount-orpc-router.ts";
 import { mountServerPackages, preloadServerPackages } from "./mount-server-packages.ts";
@@ -101,13 +68,6 @@ export async function buildMinimalApp(
 
 	const app = new Hono();
 
-	// Per-step instrumentation inside the boot-ui-service phase. Same
-	// createTimer + wall-clock convention as create-boot-pipeline's runPhase
-	// (timing-is-the-only-timing, per-phase-instrumentation) — NOT a second
-	// telemetry surface. The boot-ui-service phase is 60% of boot; this
-	// breakdown localises the cost so optimisation targets the real hotspot
-	// instead of guessing. Spans flow to GlitchTip (timing's trace-emitter is
-	// wired by the time we reach here); the breakdown line is `pm2 logs`-visible.
 	const stepTimings: Record<string, number> = {};
 	async function runStep<T>(step: string, fn: () => Promise<T>): Promise<T> {
 		const timer = createTimer(`${serviceSlug}:boot.minimal.${step}`);
@@ -119,7 +79,6 @@ export async function buildMinimalApp(
 		}
 	}
 
-	// Error handlers
 	app.onError(createRequestErrorHandler("service-boot:minimal"));
 
 	app.notFound(async (c) => {
@@ -131,7 +90,6 @@ export async function buildMinimalApp(
 		return c.json({ error: "Not Found" }, 404);
 	});
 
-	// Core middleware
 	app.use("*", readinessGate);
 	app.get("/health", healthHandler);
 	app.use("*", injectSecurityHeaders);
@@ -151,19 +109,7 @@ export async function buildMinimalApp(
 	);
 	app.use("*", compress());
 	app.use("*", timing());
-	// CSRF (`security-csrf-protection`): state-changing form-element requests
-	// must carry a trusted Origin — derived set (managed base domain +
-	// builda_websites custom domains via isTrustedAuthOrigin), never an
-	// allowlist beside better-auth's. Registered after security headers, before
-	// every route + gate.
 	app.use("*", csrfProtection());
-	// GLOBAL body limit (`security-body-limit`): every request body is bounded
-	// BEFORE any handler buffers it — a per-route file.size check AFTER
-	// formData() has buffered is a report, not a limit. 30MB sits above the
-	// 25MB transfers-upload maximum; routes wanting a smaller bound mount their
-	// own bodyLimit BEFORE this one (Hono runs matching middleware in
-	// registration order, and /api/rpc registers its 10MB limit in
-	// mount-orpc-router).
 	app.use(
 		"*",
 		bodyLimit({
@@ -180,20 +126,8 @@ export async function buildMinimalApp(
 	);
 	const ttlPromise = runStep("init-gate-ttls", () => initGateTtls());
 
-	// Public access endpoints — MUST be registered before the auth gate (Hono
-	// dispatches middleware + handlers in registration order; the content-gate
-	// POST routes and magic-link endpoints are public and must be reachable
-	// without a session, so they precede the auth gate's app.use("*") wildcard).
-	// These are mutually independent — distinct paths, no shared mutable state
-	// beyond the Hono app's synchronous route array — so they parallelise.
 	await runStep("public-routes", () =>
 		Promise.all([
-			// EVERY REGISTERED GATE'S ACCESS ENDPOINT (content-gate/catalog.ts).
-			// The same catalog the SSR gate sequence iterates, so the endpoint that
-			// MINTS a gate's token and the gate that VERIFIES it cannot disagree
-			// about which gates exist — this list and that one were two copies of
-			// one fact, and a gate added to one and missed in the other is a page
-			// that gates content with no way to unlock it.
 			...CONTENT_GATES.map((entry) =>
 				attachContentGateAccess(app, serviceSlug, entry.access),
 			),
@@ -205,27 +139,14 @@ export async function buildMinimalApp(
 		]),
 	);
 
-	// Auth gate — registers /api/auth/* + the session-check wildcard middleware.
-	// MUST follow the public routes above (load-bearing Hono registration order)
-	// and MUST precede mountServerPackages: server-package daemon routes (e.g.
-	// cli-session's /rpc/*) are subject to the session gate, which requires the
-	// gate's wildcard registered first to apply. Running these concurrently would
-	// make that ordering non-deterministic — so the gate stays serial here.
 	await runStep("attach-auth-gate", () =>
 		attachAuthGate(app, config, serviceSlug),
 	);
 	registerStaticAssets(app, serviceSlug, config.brand_org);
 
-	// Server packages — the cold imports were preloaded above and are now in
-	// Bun's module cache, so this pays only the mount work (~33ms, not ~2.8s of
-	// serial compilation). Route registration happens HERE (after the auth gate),
-	// preserving the gate-vs-daemon-route ordering.
 	const mountRegistry = await runStep("mount-server-packages", () =>
 		mountServerPackages(app, config, serviceSlug, getSharedDb),
 	);
-	// Ensure the speculative preload finished before proceeding (it populates
-	// the same cache mountServerPackages just consumed; awaiting now is a no-op
-	// if the preload already settled, and makes the ordering guarantee explicit).
 	await preloadPromise;
 	const apiRouteCount = registerApiRoutes(app, config, mountRegistry, serviceSlug);
 
@@ -233,17 +154,10 @@ export async function buildMinimalApp(
 		await runStep("mount-orpc-router", () => mountOrpcRouter(app, serviceSlug));
 	}
 
-	// Register the in-process ORPC server client BEFORE discoverBlocks — it
-	// calls getServerClient() which needs the client set here. Must follow
-	// mount-orpc-router (which builds the router getAppRouter uses).
-	// Previously ran inside register-page-routes (too late — discoverBlocks
-	// fired before it, hitting the empty-router fallback).
 	await runStep("register-page-server-client", () =>
 		registerPageServerClient(serviceSlug),
 	);
 
-	// NOW load the generated manifest (getServerClient is set). Awaited below
-	// before register-page-routes consumes the result.
 	const discoverPromise = runStep("load-page-manifest", () =>
 		loadPageManifest(serviceSlug),
 	);
@@ -252,14 +166,8 @@ export async function buildMinimalApp(
 		registerWsRoutes(app, config, mountRegistry, serviceSlug, upgradeWebSocket),
 	);
 
-	// Resolve the deferred TTL load (started at the top — should be long done,
-	// overlapped with the gate chain + mount work). The getters are read at
-	// request time, but the cache must be populated before the first request.
 	await ttlPromise;
 
-	// CRITICAL: Block discovery and page routes MUST be registered BEFORE serving,
-	// because Hono's RegExpRouter compiles on first request and becomes immutable.
-	// We defer only client asset building (expensive Vite build) to Phase 2.
 	let components: Awaited<ReturnType<typeof loadPageManifest>>;
 	try {
 		components = await discoverPromise;
@@ -276,15 +184,10 @@ export async function buildMinimalApp(
 	);
 
 
-	// Run boot hooks BEFORE serving - some hooks may register routes and must
-	// run before Hono's matcher is compiled by the first request
 	await runStep("run-boot-hooks", () =>
 		runBootHookList(config, mountRegistry, serviceSlug),
 	);
 
-	// Register page routes with a dynamic handler that delegates to the real handler once Phase 2 completes.
-	// All route paths must be registered before serving to avoid Hono
-	// RegExpRouter compilation issues (matcher becomes immutable).
 	const registeredPageRoutes = await runStep("register-page-routes", () =>
 		registerPageRoutes({
 			app,
@@ -299,10 +202,6 @@ export async function buildMinimalApp(
 	const steps = Object.entries(stepTimings)
 		.map(([step, ms]) => `${step}=${ms}ms`)
 		.join(" ");
-	// NOTE: several steps run concurrently (speculative preload, init-gate-ttls,
-	// discover-blocks overlap the gate chain), so the step sum exceeds the
-	// wall-clock buildMinimalApp duration. Compare to the boot-ui-service phase
-	// timing in the Boot complete line for the true wall-clock cost.
 	log.info(
 		`[two-phase-boot:${serviceSlug}] buildMinimalApp breakdown (steps overlap) — ${steps}`,
 	);
@@ -322,9 +221,6 @@ export async function buildMinimalApp(
 		databaseUrl,
 		blockPackages,
 		components,
-		// The generated manifest IS the loaded set — every entry it exports is a
-		// block this service renders, so there is no "skipped" half any more. A
-		// row that cannot produce a component fails codegen, not boot.
 		loaded: Object.keys(components),
 		skipped: [] as string[],
 	};

package/src/types.ts

@@ -8,9 +8,6 @@ type RendererComponent = (props: Record<string, unknown>) => unknown;
 export interface RendererComponentEntry {
 	render: RendererComponent;
 	fields?: Record<string, { type: string }>;
-	/** block_schema.defaults, carried onto the entry by discoverBlocks so
-	 *  buildPuckConfig merges them under authored props at SSR
-	 *  (blocks-fully-programmable). */
 	defaultProps?: Record<string, unknown>;
 }
 
@@ -31,18 +28,7 @@ export interface PageHandlerConfig {
 	providers?: string[];
 	loadData: (request: Request) => Promise<unknown>;
 	renderMode?: "public" | "portals" | "utility";
-	/**
-	 * Owning service slug — used by the page-server render catch to resolve
-	 * the branded logo on the render-error page. Mirrors service-runtime's
-	 * PageHandlerConfig.
-	 */
 	serviceSlug?: string;
-	/**
-	 * Redirect a signed-in user's `/` to their org-scoped portal dashboard.
-	 * Set only for services serving a `/*` catchall page_route (the portal);
-	 * single-site portal-mode services serve their real page at `/`.
-	 * Mirrors service-runtime's PageHandlerConfig (1.15.82).
-	 */
 	portalHomeRedirect?: boolean;
 }
 

package/src/ui-service.ts

@@ -17,32 +17,7 @@
  * place and is NOT undone.
  */
 
-	// Resolve the listen port through the SHARED resolver (`resolveServicePort`),
-	// the same one the backend branch uses. The registry wins wherever it has an
-	// opinion and a contradicting PORT env is reported, never silently obeyed —
-	// full reasoning in that file.
-	//
-	// This branch previously took `process.env.PORT` unconditionally, which is
-	// how scala-quiz (declared 5203) booted onto session-picker's 3021 from a
-	// leaked env and silently split that daemon's traffic (2026-07-31). On the
-	// dev host the registry wins a conflict (below). On Railway the injected PORT
-	// wins instead — Railway healthchecks exactly that port, and the row's port
-	// is the service's LOCAL dev port (e.g. portal 5200), so binding it on Railway
-	// makes the healthcheck probe a dead port and the deploy fails (`isRailway`
-	// path in the resolver).
-
-			// NO-SILENT-REVERTS — surface the failed client build to OBSERVABILITY
-			// (event-log → GlitchTip, per event-log-is-the-only-durable-event-log).
-			// The minimal-app fallback keeps serving SSR from the LAST-successful
-			// manifest (now a tombstone, see build-client-assets.ts), so the page
-			// looks "up" while the client bundle is stale. Without this signal the
-			// failure is buried in boot stderr and a published fix that reached
-			// node_modules but failed to bundle ships invisibly stale (the
-			// scala-agents 2026-07-18 incident: ui-foundation@3.4.5 installed but
-			// served pre-fix bytes across restarts while node_modules was
-			// mid-install). The boot.client-build-failed event routes into
-			// event-log's 7-day retention → surfaces in GlitchTip as an incident
-			// trail the operator actually watches.
+
 
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -91,7 +66,6 @@ export async function bootUiService(
 	const log = getAppLogger();
 	const startTime = Date.now();
 
-	// Phase 1: Build minimal tool-only app
 	const minimalAppResult = await buildMinimalApp(
 		config,
 		serviceSlug,
@@ -102,12 +76,6 @@ export async function bootUiService(
 
 	const isRailway = Boolean(process.env.RAILWAY_ENVIRONMENT);
 	const envPort = process.env.PORT ? Number(process.env.PORT) : undefined;
-	// The APP binds its PRIVATE port (app_port) when present — for scale-to-zero
-	// services `port` is the ACTIVATOR's ingress (what callers resolve), not the
-	// app's bind. Falling back to `port` keeps RESIDENT + unmigrated services
-	// unchanged. Without this, a migrated row (port=activator) would make the app
-	// bind the activator's port → SO_REUSEPORT silent load-balancing (the
-	// service-ports-from-registry trap: clean boot, two owners in ss -ltnp).
 	const declaredAppPort = config.app_port ?? config.port;
 	const resolution = resolveServicePort(envPort, declaredAppPort, isRailway);
 	if ("error" in resolution) {
@@ -129,21 +97,17 @@ export async function bootUiService(
 	}
 	const port = requireValidPort(resolution.port, serviceSlug);
 
-	// service-runtime owns the TCP listener. service-boot only composes the app
-	// and starts the two-phase build; the runtime binds the returned app.
 	const minimalReadyTime = Date.now();
 	const minimalDuration = minimalReadyTime - startTime;
 	log.info(
 		`[ui-service-boot:${serviceSlug}] Minimal app composed on port ${port} in ${minimalDuration}ms`,
 	);
 
-	// FLIP READY SWITCH: minimal app is ready, MCP tools can connect
 	setReady();
 	log.info(
 		`[ui-service-boot:${serviceSlug}] Ready gate flipped - MCP tools can now connect (full app building in background)`,
 	);
 
-	// Phase 2: Build full app in background (non-blocking)
 	;(async () => {
 		try {
 			const PHASE2_TIMEOUT_MS = 120_000;
@@ -159,7 +123,6 @@ export async function bootUiService(
 			const fullBuildTime = Date.now();
 			const fullDuration = fullBuildTime - startTime;
 
-			// Swap the app reference atomically
 			swapToFullApp(fullAppResult.app, serviceSlug);
 
 			log.info(
@@ -178,13 +141,9 @@ export async function bootUiService(
 					at: new Date().toISOString(),
 				},
 			});
-			// Continue with minimal app - better than crashing
 		}
 	})();
 
-	// Return result compatible with the existing UiServiceBootResult interface
-	// Note: blocks/routes will be empty initially since they're built in the background.
-	// The service is operational for MCP tools.
 	return {
 		kind: "ui",
 		blocks: [], // Will be populated when full app builds

package/src/content-gate/gate-entry-marker.test.ts

@@ -1,111 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Locks the OPT-IN gate-entry marker. A gate that does NOT declare
- * entryCookieName must behave exactly as before — a valid token authorizes on
- * any load and nothing is recorded for clearing (condition 1: every non-opting
- * service unchanged). An opting gate authorizes ONLY the request that carries
- * the marker (the identity submit's own redirect) and returns the marker name
- * so the page Response clears it — one view, then the gate is presented again.
- *
- * The clears are asserted from the CALL'S RETURN VALUE: the store lives only
- * inside the run() scope, and the first shipped version read it afterwards,
- * saw nothing, and left the marker in the browser (measured live 2026-09-14).
- *
- * Operator ruling 2026-09-14 (refresh must return to the identity gate),
- * mechanism measured live: the quiz_token cookie alone was the carrier that
- * skipped the gate on reload.
- */
-import { describe, expect, test } from "bun:test";
-import type { ContentGateConfig } from "./config-types.ts";
-import { runContentGate } from "./gate.ts";
-import { withGateEntryClears } from "./gate-entry-clears.ts";
-
-function makeConfig(entryCookieName?: string) {
-	const calls = { authorized: 0, unauthorized: 0 };
-	const cfg: ContentGateConfig = {
-		cookieName: "quiz_token",
-		entryCookieName,
-		getResourceId: () => "res-1",
-		verifyToken: (token) =>
-			token === "good" ? { email: "v@example.com", name: "V" } : null,
-		onAuthorized: () => {
-			calls.authorized++;
-		},
-		onUnauthorized: () => {
-			calls.unauthorized++;
-		},
-	};
-	return { cfg, calls };
-}
-
-describe("gate entry marker is opt-in and one-view", () => {
-	test("non-opting gate: a valid token authorizes on any load, nothing cleared — behaviour unchanged", async () => {
-		const { cfg, calls } = makeConfig();
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
-			expect(out.authorized).toBe(true);
-			expect(calls.authorized).toBe(1);
-		});
-		expect(clears).toEqual([]);
-	});
-
-	test("opting gate: token WITHOUT the marker is unauthorized — a refresh shows the gate", async () => {
-		const { cfg, calls } = makeConfig("quiz_token_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
-			expect(out.authorized).toBe(false);
-			expect(calls.unauthorized).toBe(1);
-			expect(calls.authorized).toBe(0);
-		});
-		expect(clears).toEqual([]);
-	});
-
-	test("opting gate: token + marker authorizes and RETURNS the marker for clearing — one view", async () => {
-		const { cfg, calls } = makeConfig("quiz_token_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate(
-				{},
-				"quiz_token=good; quiz_token_entered=1",
-				Date.now(),
-				cfg,
-			);
-			expect(out.authorized).toBe(true);
-			expect(calls.authorized).toBe(1);
-		});
-		expect(clears).toEqual(["quiz_token_entered"]);
-	});
-
-	test("opting gate: marker present but token invalid stays unauthorized and clears nothing", async () => {
-		const { cfg, calls } = makeConfig("quiz_token_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			const out = await runContentGate(
-				{},
-				"quiz_token=bad; quiz_token_entered=1",
-				Date.now(),
-				cfg,
-			);
-			expect(out.authorized).toBe(false);
-			expect(calls.unauthorized).toBe(1);
-		});
-		expect(clears).toEqual([]);
-	});
-
-	test("two gates in one request each report their own marker, drained once", async () => {
-		const first = makeConfig("gate_a_entered");
-		const second = makeConfig("gate_b_entered");
-		const { clears } = await withGateEntryClears(async () => {
-			await runContentGate({}, "quiz_token=good; gate_a_entered=1", Date.now(), first.cfg);
-			await runContentGate({}, "quiz_token=good; gate_b_entered=1", Date.now(), second.cfg);
-		});
-		expect(clears).toEqual(["gate_a_entered", "gate_b_entered"]);
-	});
-
-	test("the quiz gate and its access endpoint both opt in on the same marker name", async () => {
-		const { quizAccessConfig, quizGateConfig } = await import("../quiz-gate.ts");
-		expect(quizGateConfig.entryCookieName).toBe("quiz_token_entered");
-		expect(quizAccessConfig.entryCookieName).toBe("quiz_token_entered");
-	});
-});

package/src/content-gate/token.segmentation.test.ts

@@ -1,76 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Segmentation carriage in the content-gate token. The quiz's composed gate
- * screen captures company/linkedin_url/website/team_size alongside the
- * identity; the token carries them to the next render so the submit can put
- * all seven fields on the ONE response row with no client storage. The
- * generated `token.test.ts` owns the identity/binding suite; these are the
- * segmentation-specific cases (including the backward-compatibility contract:
- * a token minted before `s` existed verifies identically).
- */
-
-process.env.AUTH_SECRET = "local-test-fixture-entropy-0001";
-
-import { describe, expect, test } from "bun:test";
-import { signAccessToken, verifyAccessTokenIdentity } from "./token.ts";
-
-const NOW = 1_000_000_000_000;
-const TTL = 60_000;
-
-function decodePayload(token: string): Record<string, unknown> {
-	return JSON.parse(Buffer.from(token.split(".")[0], "base64url").toString());
-}
-
-describe("content-gate token — segmentation carriage", () => {
-	test("round-trips the four captured fields", () => {
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, "Ann", "+614", {
-			company: "Acme",
-			linkedinUrl: "https://www.linkedin.com/in/ann",
-			website: "https://acme.test",
-			teamSize: "Me + team of 2–5",
-		});
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id?.email).toBe("a@b.com");
-		expect(id?.name).toBe("Ann");
-		expect(id?.phone).toBe("+614");
-		expect(id?.segmentation).toEqual({
-			company: "Acme",
-			linkedinUrl: "https://www.linkedin.com/in/ann",
-			website: "https://acme.test",
-			teamSize: "Me + team of 2–5",
-		});
-	});
-
-	test("BACKWARD COMPATIBILITY: a pre-widening token (no s key) verifies with segmentation undefined — never an error", () => {
-		// Mint with the old shape by omitting segmentation entirely, then assert
-		// the exact contract a deploy-window survivor must satisfy.
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, "Ann", "+614");
-		expect(decodePayload(t as string).s).toBeUndefined();
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id).toEqual({ email: "a@b.com", name: "Ann", phone: "+614", segmentation: undefined });
-	});
-
-	test("empty/whitespace segmentation values produce no s key at all", () => {
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, undefined, undefined, {
-			company: "   ",
-			linkedinUrl: "",
-			website: undefined,
-			teamSize: undefined,
-		});
-		expect(decodePayload(t as string).s).toBeUndefined();
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id?.segmentation).toBeUndefined();
-	});
-
-	test("values are trimmed on sign", () => {
-		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, undefined, undefined, {
-			company: "  Acme  ",
-			teamSize: "Just me",
-		});
-		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
-		expect(id?.segmentation).toEqual({ company: "Acme", teamSize: "Just me" });
-	});
-});

package/src/content-gate/token.test.ts

@@ -1,65 +0,0 @@
-// @system codegen
-// @status generated
-// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-//
-// This suite's assertions are OWNED by the codegen band: the band module
-// carries them verbatim, this file is the emission, and hand edits here are
-// overwritten on the next run. The rationale each assertion carries moved
-// with it into the band.
-
-process.env.AUTH_SECRET = "test-secret-at-least-16-chars-long";
-
-import { describe, expect, test } from "bun:test";
-import {
-	signAccessToken,
-	verifyAccessToken,
-	verifyAccessTokenIdentity,
-} from "./token.ts";
-
-const NOW = 1_000_000_000_000;
-const TTL = 60_000;
-
-describe("content-gate token — identity", () => {
-	test("signs + verifies email AND name (GPT capture)", () => {
-		const t = signAccessToken("gpt_token", "gpt-1", "A@B.com", NOW, TTL, "Ann");
-		expect(t).toBeTruthy();
-		const id = verifyAccessTokenIdentity(t, "gpt_token", "gpt-1", NOW + 1);
-		expect(id).toEqual({ email: "a@b.com", name: "Ann" });
-	});
-
-	test("name omitted → identity has email, name undefined", () => {
-		const t = signAccessToken("gpt_token", "gpt-1", "a@b.com", NOW, TTL);
-		const id = verifyAccessTokenIdentity(t, "gpt_token", "gpt-1", NOW + 1);
-		expect(id).toEqual({ email: "a@b.com", name: undefined });
-	});
-
-	test("email-only verifyAccessToken still works (proposals/agreements)", () => {
-		const t = signAccessToken("prop_token", "p-1", "a@b.com", NOW, TTL);
-		expect(verifyAccessToken(t, "prop_token", "p-1", NOW + 1)).toBe("a@b.com");
-	});
-});
-
-describe("content-gate token — binding (withholds content)", () => {
-	const t = signAccessToken("gpt_token", "gpt-1", "a@b.com", NOW, TTL, "Ann");
-
-	test("wrong gate (cookieName) → null", () => {
-		expect(verifyAccessTokenIdentity(t, "prop_token", "gpt-1", NOW + 1)).toBeNull();
-	});
-
-	test("wrong resource → null", () => {
-		expect(verifyAccessTokenIdentity(t, "gpt_token", "gpt-2", NOW + 1)).toBeNull();
-	});
-
-	test("expired → null", () => {
-		expect(verifyAccessTokenIdentity(t, "gpt_token", "gpt-1", NOW + TTL + 1)).toBeNull();
-	});
-
-	test("tampered signature → null", () => {
-		const bad = `${t?.split(".")[0]}.deadbeef`;
-		expect(verifyAccessTokenIdentity(bad, "gpt_token", "gpt-1", NOW + 1)).toBeNull();
-	});
-
-	test("missing token → null", () => {
-		expect(verifyAccessTokenIdentity(undefined, "gpt_token", "gpt-1", NOW)).toBeNull();
-	});
-});