feat(services): migrate status-report domain (PR 1/N) (#2101)

* feat(services): migrate status-report domain onto service layer

First domain migration on top of the services scaffold (PR 0). Freezes
the `ServiceContext` shape and the single-object `{ ctx, input }`
argument convention across all three surfaces — tRPC / Connect / Slack.

## Services
- `packages/services/src/status-report/` — create, add-update, resolve
  (convenience wrapper over add-update), update (metadata+associations),
  update-update (edit a single update row), delete, delete-update, list,
  get, notify.
- Shared internals: `validatePageComponentIds`,
  `updatePageComponentAssociations`, `getReportInWorkspace`,
  `getReportUpdateInWorkspace`, `getUpdatesForReport`,
  `getPageComponentIdsForReport`.
- All mutations run inside `withTransaction`, emit an `emitAudit` row
  before returning, and throw the typed `ServiceError` hierarchy.
- Zod schemas are the contract; `.parse()` runs at every service entry
  as defence-in-depth.
- `notifyStatusReport` is the separate-call notification dispatch that
  the dashboard invokes as its second mutation — preserves today's
  two-call pattern required by the Edge runtime.

## Surfaces
- **tRPC** (`packages/api/src/router/statusReport.ts`): every procedure
  now calls a service. External contract is preserved bit-for-bit —
  `create` still returns `{ ...initialUpdate, notifySubscribers }`,
  `list` still returns the enriched `{updates,pageComponents,page}` shape
  the dashboard consumes, etc. `emailRouter.sendStatusReport` becomes a
  thin wrapper over `notifyStatusReport`.
- **Connect RPC** (`apps/server/src/routes/rpc/services/status-report/`):
  handler extracts proto → parse → service call → convert back. Domain
  helpers previously exported from this folder (and consumed by Slack)
  are gone; callers go through services directly.
- **Slack** (`apps/server/src/routes/slack/interactions.ts`): the four
  status-report branches (create / add-update / update / resolve) call
  services. The maintenance branch still writes to db directly — that
  migrates in PR 2.

## Adapters
- `packages/api/src/service-adapter.ts` — `toServiceCtx(ctx)` +
  `toTRPCError(err)` (ServiceError → TRPCError).
- `apps/server/src/routes/rpc/adapter.ts` — `toServiceCtx(rpcCtx)` +
  `toConnectError(err)`. Synthesises `actor.keyId` as `ws:<workspaceId>`
  until the auth interceptor captures the real key id (called out in
  the plan's open questions).
- `apps/server/src/routes/slack/service-adapter.ts` — refetches the full
  workspace for the `PendingAction`'s workspaceId and builds a Slack
  actor context; `toSlackMessage(err)` renders human-readable failures.

## Enforcement
- Biome `noRestrictedImports` (nursery rule) scoped to
  `packages/api/src/router/statusReport.ts` +
  `apps/server/src/routes/rpc/services/status-report/**`. Tests are
  ignored since setup/cleanup legitimately manipulates db state.
- Subpath export `@openstatus/services/status-report` so surfaces
  import the domain barrel directly.
- `packages/api` / `apps/server` now declare `@openstatus/services` as
  a dependency.

## Tests
- Integration tests in `packages/services/src/status-report/__tests__/`
  cover happy paths, workspace isolation, cascading deletes, the
  `ForbiddenError` / `NotFoundError` paths, and the slack-actor audit
  branch. `expectAuditRow` asserts on the in-memory audit buffer.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(services): address Cubic review + unblock dashboard build

- **Dashboard build**: `data-table-row-actions.tsx:35` accesses
  `row.original.page.customDomain`, which the old tRPC zod schema made
  non-nullable. My migrated service returned `page: Page | null`,
  breaking the type. Narrow `page` to non-null in the tRPC `get` / `list`
  wrappers via a tiny `narrowPage` helper that throws on the shouldn't-
  happen case (status report without its page) — matches the old zod
  parse behaviour.

- **`listStatusReports` silent truncation (Cubic finding)**: the tRPC
  wrapper hard-coded `limit: 100`, silently dropping reports beyond
  that ceiling for workspaces with >100 reports. Service now allows an
  unbounded `limit` (min 1, no max); tRPC passes a `10_000` sentinel
  and Connect keeps its external `max=100` cap in the handler.

- **`LIMIT_EXCEEDED` Connect mapping (Cubic finding)**: map to
  `Code.ResourceExhausted` rather than `Code.PermissionDenied` —
  quota/rate-limit is the documented meaning of ResourceExhausted in
  Connect/gRPC, while PermissionDenied means "authorised but not
  entitled". Correct semantics on the wire.

Biome `include` key (Cubic's third finding) is verified correct for
Biome 1.8.3 — OverridePattern schema documents `include` as the glob
selector, and our override fires as expected (it flags the Connect
test file in the scoped dir). No change.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(services/status-report): address Cubic findings on the maintenance PR

Applies to status-report since the same patterns were copy-pasted across
both domains:

- **Dedupe pageComponentIds** in `validatePageComponentIds` — duplicate
  ids in the input would hit the composite-PK constraint on
  `status_report_to_page_component` during insert.
- **Batch list enrichment** — `listStatusReports` previously fanned out
  3 queries per row (updates / component associations / page + page
  components). Dashboard calls it with `limit: 10_000`, so the N+1 was
  real. Rewritten as three batched `IN` queries regardless of row count;
  pages are deduplicated so reports sharing a page share the Page object.
  `getStatusReport` reuses the batch path with a singleton.
- **Idempotent `delete`** — the old tRPC `statusReport.delete` silently
  succeeded when the row was missing; my service throws `NotFoundError`.
  Catch and swallow in the tRPC wrapper only. Connect still returns
  404 on missing — external API semantics preserved.
- **Connect numeric-id error** — `parsePageComponentIds` was throwing
  `invalidDateFormatError` for non-numeric input. Replaced with an
  inline `ConnectError(Code.InvalidArgument)` with the correct message.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(server): bind services + importers packages in dofigen (#2113)

Adds `packages/services/package.json` and `packages/importers/package.json`
to the `install` stage bind list so `bun install --frozen-lockfile` can
resolve the dep graph inside the Docker build.

Without this, the moment main receives:
  - `@openstatus/services` as a dep of `apps/server` (landing via the
    status-report PR that this branch targets), bun install fails with
    a missing workspace package.
  - `@openstatus/importers` becomes a transitive dep of
    `@openstatus/services` later in the stack (via the import-domain
    migration), so we bind it proactively in the same commit rather
    than landing a second dofigen touch-up.

`packages/importers` already exists in the repo and isn't used by
apps/server directly at this point, so binding it early is a no-op
for bun until it actually becomes a dep. Alternative was two sequential
fix PRs; one covers the whole stack cleaner.

`Dockerfile` + `dofigen.lock` are regenerated from `dofigen.yml` via
`dofigen update` — both are generated outputs that must stay in sync
with the yml source.

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

* fix(services): stub RESEND_API_KEY for tests

`packages/services/src/status-report/notify.ts` imports from
`@openstatus/subscriptions`, which transitively pulls in
`@openstatus/emails`. The emails package validates `RESEND_API_KEY`
via `@t3-oss/env-core` at module-load time and throws on missing —
which killed `@openstatus/services#test` in CI (neither the test.yml
workflow nor local `pnpm test` sets the var).

Adds a bun test preload that stubs the env var with a dummy value
before any test file is imported. Tests never exercise the real
Resend dispatch path, so this is scoped to unblocking the import
graph rather than mocking the dispatcher itself.

Added:
  - packages/services/bunfig.toml — points bun:test at the preload.
  - packages/services/test/preload.ts — sets the dummy env var.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* test(status-report): align with new service-layer error semantics

Two CI failures surfaced after the services migration changed error
shapes for status-report writes:

- **tRPC `statusReport.create` / `.updateStatus` cross-workspace tests**
  expected `FORBIDDEN` when a caller passed pageComponentIds belonging
  to another workspace. The service's `validatePageComponentIds` now
  throws `NotFoundError` for the same case — intentionally, so cross-
  workspace lookups don't leak resource existence. Updated both tests
  to assert `NOT_FOUND` and left a comment pointing at the migration
  rationale.

- **Connect `CreateStatusReport` page-mismatch test** asserted the
  error message contained "does not match the page ID". The service
  throws `ConflictError("pageId X does not match the page (Y) of the
  selected components.")` — no "ID" in the wording. Loosened the
  assertion to "does not match the page" so it matches the actual
  service string.

Both are pure test updates — the new service behavior is the intended
contract; the tests had drifted from the pre-migration wording.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(services): address post-migration review on #2101

Five findings from the PR review, fixed in one commit:

**P1 — tRPC `LIMIT_EXCEEDED` → `TOO_MANY_REQUESTS`**
`packages/api/src/service-adapter.ts` mapped `LIMIT_EXCEEDED` to
`FORBIDDEN`. `FORBIDDEN` means "authenticated but not allowed to do
this on this resource" — plan quota exhaustion is semantically
different. Mirrors the Cubic fix on the Connect side (which moved
from `PermissionDenied` to `ResourceExhausted`).

**P2 — fragile Drizzle join result key in `enrichReportsBatch`**
`packages/services/src/status-report/list.ts` read
`row.status_report_to_page_component.statusReportId` — Drizzle
auto-derives that key from the schema variable name at import time,
so a rename would silently produce `undefined` at runtime. Replaced
with explicit-column select (`reportId:
statusReportsToPageComponents.statusReportId`) which is typed and
rename-safe.

**P2 — Slack `NOT_FOUND` messages leak internal row IDs**
`NotFoundError` formats as `"<entity> <id> not found"` (e.g.
`"page_component 17 not found"`). For API consumers that's fine —
they're developers. For Slack workspace users those IDs are
meaningless noise and surface internals. `toSlackMessage` now
returns a fixed `"Couldn't find what you were looking for."` for
`NOT_FOUND`; other `ServiceError` codes keep their hand-written
messages (they're sentence-style to start with).

**P3 — test cleanup without try/finally**
`packages/services/src/status-report/__tests__/status-report.test.ts`
had 13 tests that did inline `db.delete(statusReport)` cleanup at
the end of their body — skipped on assertion failure. Replaced with
a shared `createdReportIds` array + `afterEach` drain so cleanup
runs regardless of test outcome.

**P3 — hoisted `toServiceCtx` out of Slack `executeAction` switch**
Every service-backed branch loaded the workspace row via
`toServiceCtx`. Hoisted the call above the switch — halves db
lookups per Slack action execution. The `createMaintenance` branch
(still on db until PR 2) doesn't use the ctx but the extra lookup
there is negligible.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* fix(services/status-report): pageId follows components on update

Two server-side tests were failing after the migration:
  - `updates pageId when changing components to different page`
  - `clears pageId when removing all components`

Both expected `report.pageId` to track the association set:
  - Swap components to a different page → `pageId` moves.
  - Empty the association set → `pageId` becomes null.

The service was enforcing a stricter invariant — it *threw* a
`ConflictError` when the new components' page differed from the
report's current page, and left `pageId` untouched when associations
were cleared. That was an overcautious choice in the initial
migration; no caller today wants a "report pinned to page X
regardless of its components" guarantee.

Simplified to: whenever `pageComponentIds` is supplied,
`updateValues.pageId = validated.pageId`. The zero-component case
sets `pageId = null`; the one-page case moves the report to that
page. Mixed-page inputs are still rejected by
`validatePageComponentIds`'s `componentPageIds.size > 1` check, so
the only reachable states here are "one page" or "no components".

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

Author: mxkaske

apps/server/Dockerfile

@@ -41,6 +41,8 @@ RUN \
     --mount=type=bind,target=packages/assertions/package.json,source=packages/assertions/package.json \
     --mount=type=bind,target=packages/theme-store/package.json,source=packages/theme-store/package.json \
     --mount=type=bind,target=packages/locales/package.json,source=packages/locales/package.json \
+    --mount=type=bind,target=packages/services/package.json,source=packages/services/package.json \
+    --mount=type=bind,target=packages/importers/package.json,source=packages/importers/package.json \
     --mount=type=cache,target=/root/.bun/install/cache,sharing=locked \
     bun install --production --frozen-lockfile --verbose
 
@@ -62,11 +64,11 @@ COPY \
 RUN bun build --compile --sourcemap src/index.ts --outfile=app
 
 # runtime
-FROM debian@sha256:4333240150a6924f878e05ec2c998aec95238010e0e4d2fec6161c90128c4652 AS runtime
+FROM debian@sha256:1a4701c321b1d28b1ff5f0230e766791e4b79b1d4c6c7a70064f4b297b1a330f AS runtime
 LABEL \
     io.dofigen.version="2.7.0" \
     org.opencontainers.image.authors="OpenStatus Team" \
-    org.opencontainers.image.base.digest="sha256:4333240150a6924f878e05ec2c998aec95238010e0e4d2fec6161c90128c4652" \
+    org.opencontainers.image.base.digest="sha256:1a4701c321b1d28b1ff5f0230e766791e4b79b1d4c6c7a70064f4b297b1a330f" \
     org.opencontainers.image.base.name="docker.io/debian:bullseye-slim" \
     org.opencontainers.image.description="REST API server with Hono framework for OpenStatus" \
     org.opencontainers.image.source="https://github.com/openstatusHQ/openstatus" \

apps/server/dofigen.lock

@@ -15,8 +15,8 @@ effective: |
         path: oven/bun
         digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
       label:
-        org.opencontainers.image.base.name: docker.io/oven/bun:1.3.6
         org.opencontainers.image.stage: install
+        org.opencontainers.image.base.name: docker.io/oven/bun:1.3.6
         org.opencontainers.image.base.digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
       workdir: /app/
       run:
@@ -86,14 +86,18 @@ effective: |
         source: packages/theme-store/package.json
       - target: packages/locales/package.json
         source: packages/locales/package.json
+      - target: packages/services/package.json
+        source: packages/services/package.json
+      - target: packages/importers/package.json
+        source: packages/importers/package.json
     build:
       fromImage:
         path: oven/bun
         digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
       label:
-        org.opencontainers.image.base.name: docker.io/oven/bun:1.3.6
         org.opencontainers.image.stage: build
         org.opencontainers.image.base.digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
+        org.opencontainers.image.base.name: docker.io/oven/bun:1.3.6
       workdir: /app/apps/server
       env:
         NODE_ENV: production
@@ -109,16 +113,16 @@ effective: |
       - bun build --compile --sourcemap src/index.ts --outfile=app
   fromImage:
     path: debian
-    digest: sha256:4333240150a6924f878e05ec2c998aec95238010e0e4d2fec6161c90128c4652
+    digest: sha256:1a4701c321b1d28b1ff5f0230e766791e4b79b1d4c6c7a70064f4b297b1a330f
   label:
-    org.opencontainers.image.authors: OpenStatus Team
+    io.dofigen.version: 2.7.0
     org.opencontainers.image.source: https://github.com/openstatusHQ/openstatus
+    org.opencontainers.image.base.digest: sha256:1a4701c321b1d28b1ff5f0230e766791e4b79b1d4c6c7a70064f4b297b1a330f
     org.opencontainers.image.base.name: docker.io/debian:bullseye-slim
-    io.dofigen.version: 2.7.0
+    org.opencontainers.image.title: OpenStatus Server
     org.opencontainers.image.description: REST API server with Hono framework for OpenStatus
-    org.opencontainers.image.base.digest: sha256:4333240150a6924f878e05ec2c998aec95238010e0e4d2fec6161c90128c4652
     org.opencontainers.image.vendor: OpenStatus
-    org.opencontainers.image.title: OpenStatus Server
+    org.opencontainers.image.authors: OpenStatus Team
   user:
     user: '1000'
     group: '1000'
@@ -145,17 +149,17 @@ effective: |
     retries: 3
 images:
   docker.io:
-    library:
-      debian:
-        bullseye-slim:
-          digest: sha256:4333240150a6924f878e05ec2c998aec95238010e0e4d2fec6161c90128c4652
     oven:
       bun:
         1.3.6:
           digest: sha256:f20d9cf365ab35529384f1717687c739c92e6f39157a35a95ef06f4049a10e4a
+    library:
+      debian:
+        bullseye-slim:
+          digest: sha256:1a4701c321b1d28b1ff5f0230e766791e4b79b1d4c6c7a70064f4b297b1a330f
 resources:
   dofigen.yml:
-    hash: 733fba04030ad149a064b72cece51b1e515655e1b723263c61c881e301e388da
+    hash: 0b4934ac4087020f7814554afb8423bb611e051830041107fdecd32afaa8dc28
     content: |
       # Files to exclude from Docker context
       ignore:
@@ -208,6 +212,8 @@ resources:
             - packages/assertions/package.json
             - packages/theme-store/package.json
             - packages/locales/package.json
+            - packages/services/package.json
+            - packages/importers/package.json
           run: bun install --production --frozen-lockfile --verbose
           cache:
             - /root/.bun/install/cache

apps/server/dofigen.yml

@@ -49,6 +49,8 @@ builders:
       - packages/assertions/package.json
       - packages/theme-store/package.json
       - packages/locales/package.json
+      - packages/services/package.json
+      - packages/importers/package.json
     run: bun install --production --frozen-lockfile --verbose
     cache:
       - /root/.bun/install/cache

apps/server/package.json

@@ -24,6 +24,7 @@
     "@logtape/otel": "2.0.1",
     "@logtape/sentry": "2.0.1",
     "@openstatus/analytics": "workspace:*",
+    "@openstatus/services": "workspace:*",
     "@openstatus/subscriptions": "workspace:*",
     "@openstatus/notification-discord": "workspace:*",
     "@openstatus/notification-google-chat": "workspace:*",

apps/server/src/routes/rpc/adapter.ts

@@ -0,0 +1,57 @@
+import { Code, ConnectError } from "@connectrpc/connect";
+import { type ServiceContext, ServiceError } from "@openstatus/services";
+import { ZodError } from "zod";
+
+import type { RpcContext } from "./interceptors";
+
+/**
+ * Translate Connect RPC auth context into a `ServiceContext`.
+ *
+ * TODO: Once the auth interceptor captures the API key id, expose it here
+ * as `actor.keyId`. Until then we synthesise `ws:<workspaceId>` so audit
+ * records still have a non-empty actor identifier — see the plan's open
+ * question "Does Connect's auth interceptor capture API key ID today?".
+ */
+export function toServiceCtx(rpcCtx: RpcContext): ServiceContext {
+  return {
+    workspace: rpcCtx.workspace,
+    actor: { type: "apiKey", keyId: `ws:${rpcCtx.workspace.id}` },
+    requestId: rpcCtx.requestId,
+  };
+}
+
+/**
+ * Map any error thrown by a service call to a `ConnectError`. Preserves the
+ * existing Connect error surface — granular reasons carried by the caller's
+ * per-handler error helpers (in `errors.ts`) still bypass this mapper since
+ * they throw `ConnectError` directly.
+ */
+export function toConnectError(err: unknown): never {
+  if (err instanceof ConnectError) throw err;
+  if (err instanceof ZodError) {
+    throw new ConnectError(
+      `Invalid request: ${err.message}`,
+      Code.InvalidArgument,
+    );
+  }
+  if (err instanceof ServiceError) {
+    switch (err.code) {
+      case "NOT_FOUND":
+        throw new ConnectError(err.message, Code.NotFound);
+      case "FORBIDDEN":
+        throw new ConnectError(err.message, Code.PermissionDenied);
+      case "UNAUTHORIZED":
+        throw new ConnectError(err.message, Code.Unauthenticated);
+      case "CONFLICT":
+        throw new ConnectError(err.message, Code.InvalidArgument);
+      case "VALIDATION":
+        throw new ConnectError(err.message, Code.InvalidArgument);
+      case "LIMIT_EXCEEDED":
+        throw new ConnectError(err.message, Code.ResourceExhausted);
+      case "INTERNAL":
+        throw new ConnectError(err.message, Code.Internal);
+    }
+  }
+  const message = err instanceof Error ? err.message : "Unknown error";
+  throw new ConnectError(message, Code.Internal);
+}

apps/server/src/routes/rpc/services/status-report/__tests__/status-report.test.ts

@@ -394,7 +394,10 @@ describe("StatusReportService.CreateStatusReport", () => {
 
     expect(res.status).toBe(400);
     const data = await res.json();
-    expect(data.message).toContain("does not match the page ID");
+    // Service throws `ConflictError("pageId X does not match the page
+    // (Y) of the selected components.")` — assertion matches the new
+    // service-layer wording.
+    expect(data.message).toContain("does not match the page");
   });
 
   test("creates status report when pageId matches component page", async () => {