@teamscala/service-boot 0.23.546 → 0.23.548

package/src/inject-declared-env.ts

@@ -0,0 +1,32 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ */
+
+import type { ServiceInstallConfig } from "./load-service-install-row";
+
+export type EnvSource = Record<string, string | undefined>;
+
+export interface DeclaredEnvResult {
+	config: ServiceInstallConfig;
+	injected: string[];
+}
+
+export function injectDeclaredEnv(
+	config: ServiceInstallConfig,
+	source: EnvSource = process.env,
+): DeclaredEnvResult {
+	const declared: unknown = (config as Record<string, unknown>).env_vars;
+	const injected: string[] = [];
+	if (!Array.isArray(declared)) return { config, injected };
+	for (const entry of declared) {
+		const name = (entry as { name?: unknown } | null)?.name;
+		if (typeof name !== "string" || name.length === 0) continue;
+		const value = source[name];
+		if (typeof value === "string" && value.length > 0) {
+			(config as Record<string, unknown>)[name] = value;
+			injected.push(name);
+		}
+	}
+	return { config, injected };
+}

package/src/load-service-install-row.ts

@@ -15,15 +15,16 @@ import {
 	ServiceInstallValidationError,
 } from "@teamscala/registry-schemas/registry-schemas/service-install";
 import * as v from "valibot";
+import { injectDeclaredEnv } from "./inject-declared-env";
 
 const BOOT_ROW_KEYS = [
 	"access",
-	"api_routes",
 	"app_port",
 	"auth",
 	"block_packages",
 	"boot_hooks",
 	"brand_org",
+	"env_vars",
 	"home_path",
 	"kind",
 	"orpc_router",
@@ -73,7 +74,8 @@ export async function loadServiceInstallRow(
 		) as Record<string, unknown>;
 		enforceExplicitRenderMode(serviceSlug, rawConfig);
 		const config = v.parse(ServiceInstallBootSchema, rawConfig);
-		return { success: true, config };
+		const declared = injectDeclaredEnv(config);
+		return { success: true, config: declared.config };
 	} catch (err) {
 		if (err instanceof v.ValiError) {
 			const issues = err.issues
@@ -90,7 +92,7 @@ export async function loadServiceInstallRow(
 			};
 		}
 		if (err instanceof RegistryMissingError) {
-			const sql = `INSERT INTO registry_entries (type, slug, config, is_active) VALUES ('service_install', '${serviceSlug}', '{"kind":"ui","render_mode":"public","port":null,"page_routes":[],"providers":[],"api_routes":[],"block_packages":[],"teamgbg_packages":[],"env_vars":[]}'::jsonb, true);`;
+			const sql = `INSERT INTO registry_entries (type, slug, config, is_active) VALUES ('service_install', '${serviceSlug}', '{"kind":"ui","render_mode":"public","port":null,"page_routes":[],"providers":[],"block_packages":[],"teamgbg_packages":[],"env_vars":[]}'::jsonb, true);`;
 			return {
 				success: false,
 				error: "row_not_found",

package/src/mount-orpc-router.test.ts

@@ -7,7 +7,7 @@
 // overwritten on the next run. The rationale each assertion carries moved
 // with it into the band.
 import * as __scalaReal_teamscala_event_log_record_event from "@teamscala/event-log/record-event";
-import * as __scalaReal_teamscala_tool_executor_configure from "@teamscala/tool-executor/configure";
+import * as __scalaReal_teamscala_tool_executor_configure from "@teamscala/tool-executor-substrate/configure";
 import * as __scalaReal_teamscala_orpc_configure from "@teamscala/orpc/configure";
 import * as __scalaReal_teamscala_orpc_app_router from "@teamscala/orpc/app-router";
 
@@ -85,7 +85,7 @@ describe("mountOrpcRouter generated-artifact seam", () => {
 	...__scalaReal_teamscala_orpc_configure,
 			getPrisma: () => ({}),
 		}));
-		mock.module("@teamscala/tool-executor/configure", () => ({
+		mock.module("@teamscala/tool-executor-substrate/configure", () => ({
 	...__scalaReal_teamscala_tool_executor_configure,
 			configure: (opts: Record<string, unknown>) => {
 				seenKeys = Object.keys(opts);

package/src/mount-orpc-router.ts

@@ -97,7 +97,7 @@ export async function mountOrpcRouter(
 		);
 
 		const { configure: configureToolExecutor } = await import(
-			"@teamscala/tool-executor/configure"
+			"@teamscala/tool-executor-substrate/configure"
 		);
 		const [{ getCallerContext }, { decryptSecretConfig }] =
 			await Promise.all([

package/src/orpc-contract-rows.json

@@ -314,6 +314,329 @@
       "suite_type": "function_call",
       "slug": "service-boot:absent-manifest-verdict-reserves-never-ran"
     },
+    {
+      "args": [
+        {
+          "kind": "backend",
+          "env_vars": [
+            {
+              "name": "ABSENT_VAR",
+              "required": true
+            }
+          ]
+        },
+        {}
+      ],
+      "note": "The deployed configureEnv contract says absence fails the JOB at use (required() throws, the hook answers 503), never the boot. Injection mirrors that: a declared name missing from the environment is skipped, leaving the consumer guard as the failure surface.",
+      "label": "a declared env var absent from the environment is not injected and boot is not fatal",
+      "expect": {
+        "config": {
+          "kind": "backend",
+          "env_vars": [
+            {
+              "name": "ABSENT_VAR",
+              "required": true
+            }
+          ]
+        },
+        "injected": []
+      },
+      "export": "injectDeclaredEnv",
+      "module": "src/inject-declared-env.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:an-absent-declared-var-is-left-to-the-consumer-guard"
+    },
+    {
+      "args": [
+        {
+          "kind": "backend",
+          "env_vars": [
+            {
+              "name": "EMPTY_VAR",
+              "required": true
+            }
+          ]
+        },
+        {
+          "EMPTY_VAR": ""
+        }
+      ],
+      "note": "The deployed raw() reader treats an empty string as absent. Injecting one would mask the consumer guard with a value that behaves as missing.",
+      "label": "an empty-string environment value is not injected",
+      "expect": {
+        "config": {
+          "kind": "backend",
+          "env_vars": [
+            {
+              "name": "EMPTY_VAR",
+              "required": true
+            }
+          ]
+        },
+        "injected": []
+      },
+      "export": "injectDeclaredEnv",
+      "module": "src/inject-declared-env.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:an-empty-env-value-is-not-injected"
+    },
+    {
+      "args": [
+        {
+          "kind": "backend",
+          "env_vars": [
+            {
+              "required": true
+            },
+            {
+              "name": ""
+            },
+            {
+              "name": "GOOD_VAR"
+            }
+          ]
+        },
+        {
+          "GOOD_VAR": "ok-value"
+        }
+      ],
+      "note": "The schema types env_vars items as v.unknown(), so the boot stage must not trust item shape: an entry carrying no name and an entry carrying an empty name are skipped and boot never throws, while the next well-formed declaration still lands on the config.",
+      "label": "env_vars entries without a usable name are skipped while the named one still lands",
+      "expect": {
+        "config": {
+          "kind": "backend",
+          "GOOD_VAR": "ok-value",
+          "env_vars": [
+            {
+              "required": true
+            },
+            {
+              "name": ""
+            },
+            {
+              "name": "GOOD_VAR"
+            }
+          ]
+        },
+        "injected": [
+          "GOOD_VAR"
+        ]
+      },
+      "export": "injectDeclaredEnv",
+      "module": "src/inject-declared-env.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:an-env-declaration-without-a-usable-name-is-skipped"
+    },
+    {
+      "args": [
+        [
+          {
+            "slug": "npm-registry-hook",
+            "config": {
+              "path": "/webhooks/npm/registry",
+              "method": "POST",
+              "handler": "npm-registry-hook",
+              "service": "scala-sync-worker",
+              "auth_required": false
+            }
+          },
+          {
+            "slug": "email.send",
+            "config": {
+              "path": "/api/rpc/email/send",
+              "method": "POST",
+              "service": "scala-email-sender",
+              "handler_slug": "email.send",
+              "auth_required": true
+            }
+          }
+        ],
+        "scala-sync-worker",
+        [
+          "npm-registry-hook"
+        ]
+      ],
+      "note": "Bug 01a15334 (Joe's Developer, delivery 01a15336): the shape of the row that was declared and never served - config.handler (not handler_slug) on POST /webhooks/npm/registry for scala-sync-worker.",
+      "label": "a row naming its mount handler in config.handler is selected for its own service and maps onto the handler registry",
+      "expect": [
+        {
+          "slug": "npm-registry-hook",
+          "mount": {
+            "path": "/webhooks/npm/registry",
+            "method": "post",
+            "handlerSlug": "npm-registry-hook"
+          },
+          "service": "scala-sync-worker",
+          "notMounted": null
+        }
+      ],
+      "export": "selectServiceApiRoutes",
+      "module": "src/select-service-api-routes.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:api-route-config-handler-maps-onto-the-mount-registry"
+    },
+    {
+      "args": [
+        [
+          {
+            "slug": "email.send",
+            "config": {
+              "path": "/api/rpc/email/send",
+              "method": "POST",
+              "service": "scala-email-sender",
+              "handler_slug": "email.send",
+              "auth_required": true
+            }
+          }
+        ],
+        "scala-email-sender",
+        [
+          "npm-registry-hook"
+        ]
+      ],
+      "note": "api_route/email.send names handler_slug email.send, but no server_package in the workspace registers it and service_install/scala-email-sender declares no server_packages. Boot reports it by name on every start instead of claiming the route is served.",
+      "label": "a row naming a handler no mounted package registered is named as unserved instead of silently 404ing or bricking the service",
+      "expect": [
+        {
+          "slug": "email.send",
+          "mount": null,
+          "service": "scala-email-sender",
+          "notMounted": "handler-not-mounted"
+        }
+      ],
+      "export": "selectServiceApiRoutes",
+      "module": "src/select-service-api-routes.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:api-route-row-naming-an-unmounted-handler-is-reported-unserved"
+    },
+    {
+      "args": [
+        [
+          {
+            "slug": "npm-registry-hook",
+            "config": {
+              "path": "/webhooks/npm/registry",
+              "method": "POST",
+              "handler": "npm-registry-hook",
+              "service": "scala-sync-worker",
+              "auth_required": false
+            }
+          }
+        ],
+        "scala-sync-worker-ts-dev",
+        [
+          "npm-registry-hook"
+        ]
+      ],
+      "note": "Raw string equality on the deployable name matched at most one lane and failed silently (capability-slug.ts incident): the row names the capability, the lane arrives as <capability>-<lang>-<tier>.",
+      "label": "a dev-lane service is served the rows its capability declares, the join select-service-routes.ts already makes for page_route",
+      "expect": [
+        {
+          "slug": "npm-registry-hook",
+          "mount": {
+            "path": "/webhooks/npm/registry",
+            "method": "post",
+            "handlerSlug": "npm-registry-hook"
+          },
+          "service": "scala-sync-worker",
+          "notMounted": null
+        }
+      ],
+      "export": "selectServiceApiRoutes",
+      "module": "src/select-service-api-routes.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:api-route-row-reaches-the-dev-lane-through-the-capability-slug"
+    },
+    {
+      "args": [
+        [
+          {
+            "slug": "fn-chat-complete",
+            "config": {
+              "path": "/api/rpc/fn/chat/complete",
+              "method": "POST",
+              "service": "scala-ai",
+              "handler_type": "orpc_fn",
+              "auth_required": true
+            }
+          }
+        ],
+        "scala-ai",
+        [
+          "chat-stream"
+        ]
+      ],
+      "note": "handler_type orpc_fn rows are served by the generated ORPC router (orpc-bundle.pkl), not by a mount handler; boot must not claim them or fail on them.",
+      "label": "a row that names no mount handler is reported as declared, never mounted onto the mount registry",
+      "expect": [
+        {
+          "slug": "fn-chat-complete",
+          "mount": null,
+          "service": "scala-ai",
+          "notMounted": "declares-no-mount-handler"
+        }
+      ],
+      "export": "selectServiceApiRoutes",
+      "module": "src/select-service-api-routes.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:api-route-row-without-a-mount-handler-is-declared-not-mounted"
+    },
+    {
+      "args": [
+        [
+          {
+            "slug": "npm-registry-hook",
+            "config": {
+              "path": "/webhooks/npm/registry",
+              "method": "POST",
+              "handler": "npm-registry-hook",
+              "service": "scala-sync-worker",
+              "auth_required": false
+            }
+          },
+          {
+            "slug": "scala-forms-get--api-places-autocomplete",
+            "config": {
+              "path": "/api/places/autocomplete",
+              "method": "GET",
+              "service": "scala-forms",
+              "handler_slug": "geocode-autocomplete",
+              "auth_required": false
+            }
+          }
+        ],
+        "scala-forms",
+        [
+          "geocode-autocomplete"
+        ]
+      ],
+      "note": "A row belonging to a different service must not leak into this service's route table or its boot log.",
+      "label": "another service's row is neither mounted nor reported - selection is by this service's capability alone",
+      "expect": [
+        {
+          "slug": "scala-forms-get--api-places-autocomplete",
+          "mount": {
+            "path": "/api/places/autocomplete",
+            "method": "get",
+            "handlerSlug": "geocode-autocomplete"
+          },
+          "service": "scala-forms",
+          "notMounted": null
+        }
+      ],
+      "export": "selectServiceApiRoutes",
+      "module": "src/select-service-api-routes.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:api-route-rows-of-another-service-are-not-selected"
+    },
     {
       "args": [
         "@teamscala/cli-session"
@@ -1396,6 +1719,52 @@
       "suite_type": "function_call",
       "slug": "service-boot:decide-content-page-floor-resource-type-route-is-null"
     },
+    {
+      "args": [
+        {
+          "kind": "backend",
+          "env_vars": [
+            {
+              "name": "NPM_HOOK_SECRET",
+              "required": true
+            },
+            {
+              "name": "ABSENT_VAR",
+              "required": false
+            }
+          ]
+        },
+        {
+          "NPM_HOOK_SECRET": "s3cret-value"
+        }
+      ],
+      "note": "Bug 01a15334 / subtask 01a153d0-f3b7. The deployed npm-registry-hook handler reads env.NPM_HOOK_SECRET through configureEnv(ctx.config), which stores the whole mount config and indexes it by bare top-level key (integration-sync-runtime/src/env.ts, read from the running scala-sync-worker container). The loader must therefore carry each declared name as a top-level string on the config it returns.",
+      "label": "a declared env var present in the process environment lands on the boot config under its own name",
+      "expect": {
+        "config": {
+          "kind": "backend",
+          "env_vars": [
+            {
+              "name": "NPM_HOOK_SECRET",
+              "required": true
+            },
+            {
+              "name": "ABSENT_VAR",
+              "required": false
+            }
+          ],
+          "NPM_HOOK_SECRET": "s3cret-value"
+        },
+        "injected": [
+          "NPM_HOOK_SECRET"
+        ]
+      },
+      "export": "injectDeclaredEnv",
+      "module": "src/inject-declared-env.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "service-boot:declared-env-vars-carry-their-process-values-into-the-mount-config"
+    },
     {
       "args": [
         {