refactor(web): replace global aria state with app resources and Foldkit overlays

.oxlintrc.json

@@ -105,14 +105,6 @@
 				"foldkit/wrap-child-output-in-got-message": "off"
 			}
 		},
-		{
-			// ui/aria ports React Aria's document-wide state (global input modality, scroll locks, the live
-			// announcer) as module state on purpose; see docs/foldkit-decisions/s5-primitives.md.
-			"files": ["apps/web-foldkit/src/ui/aria/**"],
-			"rules": {
-				"foldkit/no-module-level-mutable-state": "off"
-			}
-		},
 		{
 			// Framework-free modules carried over from the React app: imperative singletons and
 			// helpers, not Foldkit programs, so the Foldkit architecture rules do not apply.

CLAUDE.md

@@ -7,7 +7,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 This is a monorepo with the following structure:
 
 - `apps/web-foldkit/` - Web frontend built with Foldkit (Effect-based Elm architecture), Vite and TailwindCSS. Also the desktop app's webview
-- `apps/backendv2/` - Backend API using Bun runtime and Effect-TS
+- `apps/backend/` - Backend API and RPC (Effect-TS); runs on Bun locally and as a Cloudflare Worker
 - `apps/cluster/` - Effect Cluster service for distributed workflows and background jobs
 - `packages/db/` - Shared database package: effect-orm table definitions, the `Database` service, and migrations
 - `packages/domain/` - Shared domain types, RPC contracts, and cluster definitions
@@ -80,10 +80,12 @@ When working with Effect, Effect Atom, or TanStack DB, refer to these directorie
 - `bun run typecheck` - TypeScript checking without emitting files
 - `bun run test` - Run the app's Vitest suite
 
-### Backend (apps/backendv2)
+### Backend (apps/backend)
 
 - `bun run dev` - Start backend with hot reload using Bun (DO NOT USE - already running)
-- `bun run typecheck` - TypeScript checking
+- `bun run typecheck` - TypeScript checking (Bun entry and the Worker's `tsconfig.worker.json`)
+- `bun run test` - Run the backend's Vitest suite (Postgres-backed tests start a Docker container; set `AUTH_TEST_DATABASE_URL` to use an existing database)
+- `bun run test:sync` / `bun run test:policies` - Chat-sync and outbox, or policy, tests only
 
 ### Cluster (apps/cluster)
 
@@ -115,7 +117,7 @@ When working with Effect, Effect Atom, or TanStack DB, refer to these directorie
 - **Runtime**: Bun
 - **Framework**: Effect-TS for functional programming
 - **Database**: PostgreSQL with effect-orm (`@maple-dev/effect-orm`) over `@effect/sql-pg`
-- **Auth**: Clerk (`@clerk/backend` JWT verification + webhook sync)
+- **Auth**: Hazel auth (`@hazel/auth`, on `@yielded/auth`): GitHub/Google sign-in, passkeys, cookie sessions; Clerk is only used to verify Maple's OAuth tokens (`services/oauth-bearer-auth.ts`)
 - **API**: RPC-style endpoints via Effect Http Api
 
 ### Cluster Service
@@ -212,7 +214,7 @@ yield *
 
 - Backend follows Effect-TS patterns for error handling and dependency injection
 - Real-time features implemented via Cloudflare Realtimekit
-- Authentication handled by Clerk; backend verifies Clerk-issued JWTs and syncs users/orgs via webhook
+- Authentication handled by Hazel auth (`packages/auth`); the RPC and HttpApi middlewares resolve the session cookie, a session bearer credential (native clients) or a bot token to `CurrentUser`
 - Shared database package ensures type safety between frontend and backend
 - Domain package (`packages/domain/`) contains shared contracts:
     - RPC definitions for client-server communication

apps/backend/.artifacts/chat-sync/chat-sync-diagnostics.jsonl

@@ -9,3 +9,6 @@
 {"timestamp":"2026-06-23T01:00:51.380Z","suite":"discord-gateway-dispatch","testCase":"message-create-routing","workerMethod":"ingestMessageCreate","action":"dispatch","dedupeKey":"discord:gateway:create:223456789012345678","syncConnectionId":"00000000-0000-4000-8000-000000000001","expected":"one inbound dispatch for both-direction link","actual":"1 dispatches"}
 {"timestamp":"2026-06-23T01:00:58.637Z","suite":"chat-sync-core-worker.integration","testCase":"hazel-message-create-update-delete","workerMethod":"syncHazelMessageToProvider","action":"create","syncConnectionId":"f280ff9c-f164-4a1f-974f-baa1d94a2911","expected":"synced","actual":"synced"}
 {"timestamp":"2026-06-23T01:01:00.427Z","suite":"chat-sync-core-worker.integration","testCase":"direction-inactive-webhook-origin-guards","workerMethod":"syncHazelMessageCreateToAllConnections","action":"direction_gate","expected":"1 synced","actual":"1 synced"}
+{"timestamp":"2026-10-15T13:52:47.847Z","suite":"discord-gateway-dispatch","testCase":"message-create-routing","workerMethod":"ingestMessageCreate","action":"dispatch","dedupeKey":"discord:gateway:create:223456789012345678","syncConnectionId":"00000000-0000-4000-8000-000000000001","expected":"one inbound dispatch for both-direction link","actual":"1 dispatches"}
+{"timestamp":"2026-10-15T13:52:53.829Z","suite":"chat-sync-core-worker.integration","testCase":"hazel-message-create-update-delete","workerMethod":"syncHazelMessageToProvider","action":"create","syncConnectionId":"c52e9350-a742-464a-b6df-1722eb33157e","expected":"synced","actual":"synced"}
+{"timestamp":"2026-10-15T13:52:55.547Z","suite":"chat-sync-core-worker.integration","testCase":"direction-inactive-webhook-origin-guards","workerMethod":"syncHazelMessageCreateToAllConnections","action":"direction_gate","expected":"1 synced","actual":"1 synced"}

apps/backend/.env.example

@@ -9,13 +9,10 @@ DATABASE_URL=postgresql://user:password@localhost:5432/app
 # Local cluster service (Docker)
 CLUSTER_URL=http://localhost:3020
 
-# Clerk Authentication
-# Get these from: https://dashboard.clerk.com/ → API Keys
-CLERK_SECRET_KEY=sk_test_your_clerk_secret_here
-CLERK_PUBLISHABLE_KEY=pk_test_your_clerk_publishable_here
-CLERK_WEBHOOK_SECRET=whsec_your_clerk_webhook_secret_here
+# Optional: verifies Maple's Clerk-issued OAuth tokens for the public API v1 (the last Clerk use).
+# CLERK_SECRET_KEY=sk_test_your_clerk_secret_here
 
-# Hazel sign-in (replacing Clerk). Off until AUTH_GITHUB_CLIENT_ID is set.
+# Hazel sign-in. Off until AUTH_GITHUB_CLIENT_ID is set.
 # GitHub OAuth App callback URL: {API_BASE_URL}/auth/github/callback
 # Google OAuth client redirect URI: {API_BASE_URL}/auth/google/callback
 # Generate the keys with: bun run --cwd packages/auth generate-keys

apps/backend/README.md

@@ -12,7 +12,7 @@ See the [root README](../../README.md) for development setup instructions.
 - **Effect-TS** for functional programming and dependency injection
 - **Effect RPC** for type-safe APIs
 - **Drizzle ORM** with PostgreSQL
-- **Clerk** for authentication
+- **Hazel auth** (`@hazel/auth`) for sign-in and sessions
 
 ## Development
 

apps/backend/src/app.ts

@@ -40,13 +40,12 @@ import {
 	TypingIndicatorRepo,
 	UserPresenceStatusRepo,
 	UserRepo,
-	ClerkSync,
 } from "@hazel/backend-core"
-import { ClerkClient } from "@hazel/auth"
 import { GitHub } from "@hazel/integrations"
 import { Layer } from "effect"
 import { HazelApi } from "./api"
 import { HttpApiRoutes } from "./http"
+import { ServerFailureReporterLive } from "./lib/error-reporter"
 import { AttachmentPolicy } from "./policies/attachment-policy"
 import { BotPolicy } from "./policies/bot-policy"
 import { InvitationPolicy } from "./policies/invitation-policy"
@@ -81,7 +80,6 @@ import { ObjectStorage } from "./services/object-storage"
 import { OAuthProviderRegistry } from "./services/oauth"
 import { HazelAuthInstance, HazelAuthRoutes, HazelAuthServicesLive } from "./services/hazel-auth"
 import { HazelSession } from "./services/hazel-session"
-import { SessionManager } from "./services/session-manager"
 import { WebhookBotService } from "./services/webhook-bot-service"
 import { BotGatewayService } from "./services/bot-gateway-service"
 import { ChannelAccessSyncService } from "./services/channel-access-sync"
@@ -129,6 +127,8 @@ export const AllRoutes = Layer.mergeAll(
 			credentials: true,
 		}),
 	),
+	// RpcServer and HttpApiBuilder report failed requests here; server failures get logged.
+	Layer.provide(ServerFailureReporterLive),
 )
 
 /**
@@ -208,8 +208,6 @@ export const AppServicesLive = Layer.mergeAll(
 	RepoLive,
 	PolicyLive,
 	MockDataGenerator.layer,
-	ClerkClient.layer,
-	ClerkSync.layer,
 	ObjectStorage.layer,
 	GitHub.GitHubAppJWTService.layer,
 	GitHub.GitHubApiClient.layer,
@@ -224,8 +222,6 @@ export const AppServicesLive = Layer.mergeAll(
 	ChannelAccessSyncService.layer,
 	ConnectConversationService.layer,
 	Invitations.layer,
-	// SessionManager.layer includes BackendAuth.layer via dependencies
-	SessionManager.layer,
 	OAuthBearerAuth.layer,
 ).pipe(Layer.provideMerge(FetchHttpClient.layer))
 
@@ -234,7 +230,4 @@ export const AppServicesLive = Layer.mergeAll(
  * HTTP entry points build this; the Durable Objects never authenticate. Requires `Database`
  * and the auth SQL connection from the platform.
  */
-export const AppAuthorizationLive = AuthorizationLive.pipe(
-	Layer.provideMerge(SessionManager.layer),
-	Layer.provideMerge(HazelAuthLive),
-)
+export const AppAuthorizationLive = AuthorizationLive.pipe(Layer.provideMerge(HazelAuthLive))

apps/backend/src/lib/create-transactionId.ts

@@ -7,17 +7,10 @@ const TxidRow = Schema.Struct({ txid: Schema.String })
 /**
  * The id of the open transaction, for Electric to confirm the client's optimistic write against.
  * Must run inside `db.transaction`, which pins this statement to the transaction's connection.
+ * Fails with the typed DatabaseError / SchemaError, which callers remap with `withRemapDbErrors`.
  */
 export const generateTransactionId = Effect.fn("generateTransactionId")(function* () {
 	const db = yield* Database.Database
-	const rows = yield* db
-		.query(Database.sql`SELECT pg_current_xact_id()::xid::text AS txid`, TxidRow)
-		.pipe(
-			Effect.catchTag("DatabaseError", (err) =>
-				Effect.die(`Database error generating transaction ID: ${err}`),
-			),
-		)
-	return yield* Schema.decodeEffect(TransactionIdFromString)(rows[0]?.txid ?? "").pipe(
-		Effect.catchTag("SchemaError", (err) => Effect.die(`Failed to parse transaction ID: ${err}`)),
-	)
+	const rows = yield* db.query(Database.sql`SELECT pg_current_xact_id()::xid::text AS txid`, TxidRow)
+	return yield* Schema.decodeEffect(TransactionIdFromString)(rows[0]?.txid ?? "")
 }, Database.requireTransaction)

apps/backend/src/lib/error-reporter.test.ts

@@ -0,0 +1,60 @@
+import { NodeHttpPlatform, NodeServices } from "@effect/platform-node"
+import { describe, expect, it } from "@effect/vitest"
+import { InternalServerError } from "@hazel/domain"
+import { Cause, Context, Effect, Layer, Logger, Schema } from "effect"
+import { Etag, HttpRouter } from "effect/http"
+import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup } from "effect/http-api"
+import { ServerFailureReporterLive } from "./error-reporter"
+
+class ProbeGroup extends HttpApiGroup.make("probe").add(
+	HttpApiEndpoint.get("boom", "/boom", { success: Schema.String, error: InternalServerError }),
+) {}
+
+const api = HttpApi.make("Probe").add(ProbeGroup)
+
+const driverText = 'relation "users" does not exist'
+
+const ProbeLive = HttpApiBuilder.group(api, "probe", (handlers) =>
+	handlers.handle("boom", () =>
+		Effect.fail(
+			new InternalServerError({ message: "Error selecting user", cause: new Error(driverText) }),
+		),
+	),
+)
+
+const serve = (logged: Array<string>) => {
+	const captureLogger = Logger.make<unknown, void>(({ cause }) => {
+		logged.push(Cause.pretty(cause))
+	})
+	const appLayer = HttpApiBuilder.layer(api).pipe(
+		Layer.provide(ProbeLive),
+		Layer.provide(ServerFailureReporterLive),
+		Layer.provide(Logger.layer([captureLogger])),
+		Layer.provideMerge(HttpRouter.layer),
+		Layer.provideMerge(Etag.layer),
+		Layer.provideMerge(NodeServices.layer),
+		Layer.provideMerge(NodeHttpPlatform.layer),
+	)
+	return HttpRouter.toWebHandler(appLayer as never, { disableLogger: true })
+}
+
+describe("ServerFailureReporterLive", () => {
+	it("logs an InternalServerError with its cause, and keeps the cause out of the response", async () => {
+		const logged: Array<string> = []
+		const { handler, dispose } = serve(logged)
+		try {
+			const response = await handler(
+				new Request("http://localhost/boom"),
+				Context.empty() as Context.Context<any>,
+			)
+			const body = await response.text()
+
+			expect(response.status).toBe(500)
+			expect(body).toContain("Error selecting user")
+			expect(body).not.toContain(driverText)
+			expect(logged.some((line) => line.includes(driverText))).toBe(true)
+		} finally {
+			await dispose()
+		}
+	})
+})

apps/backend/src/lib/error-reporter.ts

@@ -0,0 +1,40 @@
+import { type Cause, Effect, ErrorReporter, Predicate } from "effect"
+
+/**
+ * Failures that mean the server, not the caller, went wrong. Their client-facing form is a
+ * stable message; the underlying `cause` (kept off the wire) is what this reporter logs.
+ * `SessionLoadError` is left out: the auth middlewares log its cause where they raise it.
+ */
+const SERVER_FAILURE_TAGS: ReadonlySet<string> = new Set([
+	"InternalServerError",
+	"WorkflowInitializationError",
+	"WorkflowServiceUnavailableError",
+	"UploadError",
+	// Escaped the remapping to InternalServerError; still a server failure.
+	"DatabaseError",
+	"SchemaError",
+])
+
+const isServerFailure = (reason: Cause.Reason<unknown>): boolean =>
+	reason._tag === "Die" ||
+	(reason._tag === "Fail" &&
+		Predicate.hasProperty(reason.error, "_tag") &&
+		typeof reason.error._tag === "string" &&
+		SERVER_FAILURE_TAGS.has(reason.error._tag))
+
+/**
+ * Logs every RPC and HttpApi failure that is the server's fault (5xx tags and defects) with its
+ * full `Cause`, including the `cause` chain clients never see. Expected 4xx failures are not
+ * logged. Both RpcServer and HttpApiBuilder report failed requests to `CurrentErrorReporters`.
+ */
+const serverFailureReporter: ErrorReporter.ErrorReporter = {
+	[ErrorReporter.TypeId]: ErrorReporter.TypeId,
+	report: ({ cause, fiber }) => {
+		if (!cause.reasons.some(isServerFailure)) return
+		Effect.runSyncWith(fiber.context)(Effect.logError("Request failed", cause))
+	},
+}
+
+export const ServerFailureReporterLive = ErrorReporter.layer([serverFailureReporter], {
+	mergeWithExisting: true,
+})

apps/backend/src/lib/policy-utils.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest"
-import { UnauthorizedError } from "@hazel/domain"
+import { InternalServerError, UnauthorizedError } from "@hazel/domain"
 import { Effect, Result } from "effect"
 import { makePolicy, withPolicyUnauthorized } from "./policy-utils.ts"
 import { makeActor } from "../policies/policy-test-helpers.ts"
@@ -37,7 +37,7 @@ describe("policy-utils", () => {
 		it("maps non-unauthorized errors to UnauthorizedError", async () => {
 			const authorize = makePolicy("Widget")
 			const result = await Effect.runPromise(
-				authorize("read", () => Effect.fail({ _tag: "DatabaseError" as const })).pipe(
+				authorize("read", () => Effect.fail({ _tag: "EntityNotFound" as const })).pipe(
 					Effect.provideService(CurrentUser.Context, makeActor()),
 					Effect.result,
 				),
@@ -48,6 +48,21 @@ describe("policy-utils", () => {
 				expect(UnauthorizedError.is(result.failure)).toBe(true)
 			}
 		})
+
+		it("maps database failures to InternalServerError, never a 401", async () => {
+			const authorize = makePolicy("Widget")
+			const result = await Effect.runPromise(
+				authorize("read", () => Effect.fail({ _tag: "DatabaseError" as const })).pipe(
+					Effect.provideService(CurrentUser.Context, makeActor()),
+					Effect.result,
+				),
+			)
+
+			expect(Result.isFailure(result)).toBe(true)
+			if (Result.isFailure(result)) {
+				expect(InternalServerError.is(result.failure)).toBe(true)
+			}
+		})
 	})
 
 	describe("withPolicyUnauthorized", () => {

apps/backend/src/routes/api-v1/integrations.http.ts

@@ -93,7 +93,7 @@ export const HttpApiV1IntegrationsLive = HttpApiBuilder.group(HazelApi, "api-v1-
 								Effect.fail(
 									new InternalServerError({
 										message: "Failed to list organizations",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),
@@ -120,7 +120,7 @@ export const HttpApiV1IntegrationsLive = HttpApiBuilder.group(HazelApi, "api-v1-
 								Effect.fail(
 									new InternalServerError({
 										message: "Failed to verify organization membership",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),
@@ -149,7 +149,7 @@ export const HttpApiV1IntegrationsLive = HttpApiBuilder.group(HazelApi, "api-v1-
 								Effect.fail(
 									new InternalServerError({
 										message: "Failed to list channels",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),
@@ -240,14 +240,14 @@ export const HttpApiV1IntegrationsLive = HttpApiBuilder.group(HazelApi, "api-v1-
 										Effect.fail(
 											new InternalServerError({
 												message: "Failed to create channel webhook",
-												detail: String(err),
+												cause: err,
 											}),
 										),
 									SchemaError: (err) =>
 										Effect.fail(
 											new InternalServerError({
 												message: "Schema validation failed",
-												detail: String(err),
+												cause: err,
 											}),
 										),
 								}),

apps/backend/src/routes/api-v1/messages.http.ts

@@ -201,7 +201,7 @@ export const HttpMessagesApiLive = HttpApiBuilder.group(HazelApi, "api-v1-messag
 								Effect.fail(
 									new InternalServerError({
 										message: "Database error while listing messages",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),
@@ -291,7 +291,7 @@ export const HttpMessagesApiLive = HttpApiBuilder.group(HazelApi, "api-v1-messag
 								Effect.fail(
 									new InternalServerError({
 										message: "Database error while creating message",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),
@@ -358,7 +358,7 @@ export const HttpMessagesApiLive = HttpApiBuilder.group(HazelApi, "api-v1-messag
 								Effect.fail(
 									new InternalServerError({
 										message: "Database error while updating message",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),
@@ -427,7 +427,7 @@ export const HttpMessagesApiLive = HttpApiBuilder.group(HazelApi, "api-v1-messag
 								Effect.fail(
 									new InternalServerError({
 										message: "Database error while deleting message",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),
@@ -534,7 +534,7 @@ export const HttpMessagesApiLive = HttpApiBuilder.group(HazelApi, "api-v1-messag
 								Effect.fail(
 									new InternalServerError({
 										message: "Database error while toggling reaction",
-										detail: String(err),
+										cause: err,
 									}),
 								),
 							),