fix(server): bundle the esign ZAP server layer + resilient migrate

Two post-#7 runtime bugs (image never built before, so never exercised):
1. ERR_MODULE_NOT_FOUND @hanzo/esign-trpc/zap/server: the raw-copied
   server/main.js imported serveZap/serveZapHttpApi that rollup never
   bundled (input was only router.ts). Add zap/http-api.ts as a rollup
   input, re-export serveZap through it, point main.js at the bundled
   ./hono path. First-party ZAP layer is now bundled; @zap-proto/web stays
   an external registry dep (resolves at runtime).
2. SQLite 'database is locked' during prisma migrate (replicate sidecar
   streams the WAL): retry the migrate with backoff.

apps/remix/rollup.config.mjs

@@ -9,10 +9,19 @@ import path from 'node:path';
 /** @type {import('rollup').RollupOptions} */
 const config = {
   /**
-   * We specifically target the router.ts instead of the entry point so the rollup doesn't go through the
-   * already prebuilt RR7 server files.
+   * We specifically target router.ts (the Hono app) instead of the entry point
+   * so rollup doesn't go through the already-prebuilt RR7 server files.
+   *
+   * zap/http-api.ts is a SECOND input: the raw-copied server/main.js imports
+   * `serveZapHttpApi` (and, via its re-export, `serveZap`) from the bundled
+   * ./hono/server/zap/http-api.js — but router.ts never references http-api, so
+   * without listing it here it never lands in the bundle (the runtime
+   * ERR_MODULE_NOT_FOUND for @hanzo/esign-trpc/zap/server). Listing it makes
+   * rollup bundle the whole esign ZAP server layer (resolveOnly @hanzo/esign-*)
+   * into build/server/hono/server/zap/http-api.js, leaving only real registry
+   * deps (@zap-proto/web, @hono/node-server) external — those resolve at runtime.
    */
-  input: 'server/router.ts',
+  input: ['server/router.ts', 'server/zap/http-api.ts'],
   output: {
     dir: 'build/server/hono',
     format: 'esm',

apps/remix/server/main.js

@@ -10,9 +10,11 @@ import { serve } from '@hono/node-server';
 import { serveStatic } from '@hono/node-server/serve-static';
 import handle from 'hono-react-router-adapter/node';
 
-import { serveZap } from '@hanzo/esign-trpc/zap/server';
-
-import { serveZapHttpApi } from './hono/server/zap/http-api.js';
+// serveZap (WebSocket) + serveZapHttpApi (JSON-over-HTTP) both come from the
+// rollup-bundled http-api module — the first-party esign ZAP server layer is
+// bundled there (it's .ts workspace source that can't resolve at runtime as a
+// package subpath). See rollup.config.mjs (http-api.ts is a build input).
+import { serveZap, serveZapHttpApi } from './hono/server/zap/http-api.js';
 import server from './hono/server/router.js';
 import * as build from './index.js';
 

apps/remix/server/zap/http-api.ts

@@ -30,6 +30,13 @@ import { ZapReply, newZapRequest } from '@hanzo/esign-trpc/zap/gen/transport_zap
 
 import openapi from '@hanzo/esign-trpc/zap/gen/openapi.json';
 
+// Re-export the WebSocket ZAP server (serveZap) through this module so the
+// raw-copied server/main.js imports BOTH serveZap and serveZapHttpApi from the
+// single rollup-bundled ./hono/server/zap/http-api.js — keeping the first-party
+// esign ZAP server layer fully bundled (it can't resolve as a .ts workspace
+// subpath at runtime). @zap-proto/web stays an external registry dep.
+export { serveZap } from '@hanzo/esign-trpc/zap/server';
+
 interface OpenApiPaths {
   paths: Record<string, { post?: { operationId?: string } }>;
 }

docker/start.sh

@@ -25,7 +25,19 @@ printf "📊 Certificate status: http://localhost:3000/api/certificate-status\n"
 printf "👥 Community: https://github.com/hanzo-sign/hanzo-sign\n\n"
 
 printf "🗄️  Running database migrations...\n"
-npx prisma migrate deploy --schema ../../packages/prisma/schema.prisma
+# The replicate sidecar streams the SQLite WAL concurrently, so the first
+# migrate can hit a transient "database is locked". Retry with backoff — SQLite
+# locks clear in milliseconds once the checkpoint completes.
+migrate_attempt=1
+until npx prisma migrate deploy --schema ../../packages/prisma/schema.prisma; do
+    if [ "$migrate_attempt" -ge 6 ]; then
+        printf "❌ Migrations failed after %d attempts\n" "$migrate_attempt"
+        exit 1
+    fi
+    printf "⏳ Migrate attempt %d hit a lock; retrying in %ds...\n" "$migrate_attempt" "$migrate_attempt"
+    sleep "$migrate_attempt"
+    migrate_attempt=$((migrate_attempt + 1))
+done
 
 printf "🌟 Starting Hanzo eSign server...\n"
 HOSTNAME=0.0.0.0 node build/server/main.js