@teamscala/service-boot 0.23.284

package/src/resolve-from-loader-config.ts

@@ -0,0 +1,291 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Walks a resource_loader.sources[] graph and resolves each source in
+ * dependency order. Returns an assembled data object keyed by source key.
+ *
+ * Source types: "orpc", "prisma", "resolver_fn".
+ * Each source may declare depends_on for ordering.
+ * Params are interpolated from URL params and prior resolved data.
+ */
+
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { ResolverFnConfigSchema } from "@teamscala/db-validation/registry-schemas/resolver-fn";
+import { getServerClient } from "@teamscala/service-boot/page-server-orpc/server-client";
+
+interface SourceConfig {
+	key: string;
+	source: "orpc" | "prisma" | "resolver_fn";
+	model?: string;
+	where?: Record<string, unknown>;
+	select?: string[];
+	depends_on?: string[];
+	optional?: boolean;
+	resolver_fn?: string;
+	resolver_input?: Record<string, unknown>;
+	registry_filter?: Record<string, unknown>;
+	transforms?: string[];
+}
+
+interface LoaderConfig {
+	sources: SourceConfig[];
+	merge_strategy?: Record<string, unknown>;
+}
+
+function resolveParamRef(
+	ref: string,
+	params: Record<string, unknown>,
+	resolved: Record<string, unknown>,
+): unknown {
+	const parts = ref.split(".");
+	// A bare (no-dot) ref can name either a resolved source key (e.g. `:response`
+	// passes the whole resolved source object to a resolver_fn) or a URL param
+	// (e.g. `:id`). Prefer the resolved source key, then fall back to the param.
+	// Dotted refs (`:response.total_score`) always read from `resolved`.
+	if (parts.length === 1) {
+		if (resolved != null && typeof resolved === "object" && ref in resolved) {
+			return (resolved as Record<string, unknown>)[ref];
+		}
+		if (params != null && typeof params === "object" && ref in params) {
+			return (params as Record<string, unknown>)[ref];
+		}
+		return undefined;
+	}
+	let current: unknown = resolved;
+	for (const part of parts) {
+		if (current == null || typeof current !== "object") return undefined;
+		current = (current as Record<string, unknown>)[part];
+	}
+	return current;
+}
+
+function interpolateTemplate(
+	template: unknown,
+	params: Record<string, unknown>,
+	resolved: Record<string, unknown>,
+): unknown {
+	if (typeof template === "string") {
+		const exactMatch = template.match(/^:([a-zA-Z0-9_.]+)$/);
+		if (exactMatch) {
+			return resolveParamRef(exactMatch[1], params, resolved);
+		}
+		if (template.includes(":")) {
+			return template.replace(
+				/:([a-zA-Z0-9_]+(?:\.[a-zA-Z0-9_]+)*)/g,
+				(_match, ref: string) => {
+					const value = resolveParamRef(ref, params, resolved);
+					return value != null ? String(value) : _match;
+				},
+			);
+		}
+		return template;
+	}
+	if (Array.isArray(template)) {
+		return template.map((v) => interpolateTemplate(v, params, resolved));
+	}
+	if (template != null && typeof template === "object") {
+		const out: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(template)) {
+			const result = interpolateTemplate(v, params, resolved);
+			if (result !== undefined) out[k] = result;
+		}
+		return out;
+	}
+	return template;
+}
+
+function toSelectMap(
+	fields: string[] | undefined,
+): Record<string, boolean> | undefined {
+	if (!fields || fields.length === 0) return undefined;
+	const map: Record<string, boolean> = {};
+	for (const f of fields) map[f] = true;
+	return map;
+}
+
+/**
+ * resolver_fn executor — registry-driven dispatch (business-logic-is-rows-plus-executors).
+ * Reads the resolver_fn row (module+export) + dynamic-imports + calls it. Replaces the
+ * hardcoded if(resolver_fn==='X') chain — adding a resolver is now a registry_edit row.
+ */
+async function resolveByResolverFn(
+	slug: string,
+	input: Record<string, unknown>,
+	params: Record<string, unknown>,
+): Promise<unknown> {
+	if (!slug) throw new Error("[resource_loader] resolver_fn source missing resolver_fn slug");
+	const row = await loadRegistryConfig("resolver_fn", slug, ResolverFnConfigSchema);
+	if (!row) {
+		throw new Error(
+			`[resource_loader] resolver_fn "${slug}" has no resolver_fn registry row — create one (module+export) or fix the resource_loader row`,
+		);
+	}
+	const mod = await import(row.module);
+	const fn = (mod as Record<string, unknown>)[row.export] as (args: {
+		input: Record<string, unknown>;
+		client: unknown;
+		params: Record<string, unknown>;
+	}) => Promise<unknown> | unknown;
+	if (typeof fn !== "function") {
+		throw new Error(
+			`[resource_loader] resolver_fn "${slug}": export "${row.export}" not a function in ${row.module}`,
+		);
+	}
+	return fn({ input, client: await getServerClient(), params });
+}
+
+async function resolveSource(
+	source: SourceConfig,
+	params: Record<string, unknown>,
+	resolved: Record<string, unknown>,
+): Promise<unknown> {
+	const client = await getServerClient();
+
+	switch (source.source) {
+		case "orpc":
+		case "prisma": {
+			if (!source.model) return null;
+			const where = source.where
+				? (interpolateTemplate(source.where, params, resolved) as Record<
+						string,
+						unknown
+					>)
+				: ({} as Record<string, unknown>);
+			const model = client[source.model as keyof typeof client] as
+				| {
+						findFirst?: (args: {
+							where: unknown;
+							select: unknown;
+						}) => Promise<unknown>;
+				  }
+				| undefined;
+			if (!model?.findFirst) return null;
+			return model.findFirst({
+				where,
+				select: toSelectMap(source.select),
+			});
+		}
+		case "resolver_fn": {
+			const input = source.resolver_input
+				? (interpolateTemplate(
+						source.resolver_input,
+						params,
+						resolved,
+					) as Record<string, unknown>)
+				: {};
+
+			return resolveByResolverFn(source.resolver_fn ?? "", input, params);
+		}
+		default:
+			throw new Error(
+				`[resource_loader] Unknown source type "${source.source}" on source "${source.key}".`,
+			);
+	}
+}
+
+/**
+ * Dependencies a source has on sibling sources, beyond its declared
+ * `depends_on`: any `:key.field` template ref whose head names another source
+ * resolves from `resolved` (see resolveParamRef), so it is a real ordering
+ * edge even when the row forgot to declare it. Inferring these keeps the
+ * parallel waves safe against under-declared rows — under the old serial
+ * loop, row order silently masked missing declarations.
+ */
+function sourceDeps(source: SourceConfig, sourceKeys: Set<string>): string[] {
+	const deps = new Set<string>(source.depends_on ?? []);
+	const scan = (template: unknown): void => {
+		if (typeof template === "string") {
+			for (const m of template.matchAll(
+				/:([a-zA-Z0-9_]+)\.[a-zA-Z0-9_.]+/g,
+			)) {
+				const head = m[1];
+				if (head && sourceKeys.has(head)) deps.add(head);
+			}
+		} else if (Array.isArray(template)) {
+			for (const v of template) scan(v);
+		} else if (template != null && typeof template === "object") {
+			for (const v of Object.values(template)) scan(v);
+		}
+	};
+	scan(source.where);
+	scan(source.resolver_input);
+	scan(source.registry_filter);
+	deps.delete(source.key);
+	return [...deps];
+}
+
+export async function resolveFromLoaderConfig(
+	config: LoaderConfig,
+	params: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+	const sources = config.sources ?? [];
+	const resolved: Record<string, unknown> = {};
+	const resolvedKeys = new Set<string>();
+
+	// Wave-parallel resolution per `loading-shape` (unrelated roots resolve
+	// concurrently): each wave gathers every source whose deps are satisfied
+	// and resolves them via Promise.allSettled — wall-clock per wave is the
+	// slowest source, not the sum. The previous strictly-serial loop cost
+	// N × DB-round-trip per page (~2.3s for a 5-source loader from the dev
+	// host); waves cut it to the dependency depth (typically 2).
+	const sourceKeys = new Set(sources.map((s) => s.key));
+	const depsByKey = new Map(
+		sources.map((s) => [s.key, sourceDeps(s, sourceKeys)]),
+	);
+
+	const maxIterations = sources.length + 1;
+	for (let iteration = 0; iteration < maxIterations; iteration++) {
+		const wave = sources.filter(
+			(s) =>
+				!resolvedKeys.has(s.key) &&
+				(depsByKey.get(s.key) ?? []).every((d) => resolvedKeys.has(d)),
+		);
+		if (wave.length === 0) {
+			if (resolvedKeys.size === sources.length) break;
+			const unresolved = sources
+				.filter((s) => !resolvedKeys.has(s.key))
+				.map((s) => s.key);
+			throw new Error(
+				`Circular or unresolvable dependency in resource_loader: ${unresolved.join(", ")}`,
+			);
+		}
+
+		const results = await Promise.allSettled(
+			wave.map((source) => resolveSource(source, params, resolved)),
+		);
+		for (let i = 0; i < wave.length; i++) {
+			const source = wave[i];
+			const result = results[i];
+			if (!source || !result) continue;
+			if (result.status === "fulfilled") {
+				resolved[source.key] = result.value;
+			} else if (source.optional) {
+				resolved[source.key] = null;
+			} else {
+				throw result.reason;
+			}
+			resolvedKeys.add(source.key);
+		}
+		if (resolvedKeys.size === sources.length) break;
+	}
+
+	return resolved;
+}
+
+export function interpolateMeta(
+	template: Record<string, unknown>,
+	data: Record<string, unknown>,
+): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const [k, v] of Object.entries(template)) {
+		if (v != null && typeof v === "object" && !Array.isArray(v)) {
+			out[k] = interpolateMeta(v as Record<string, unknown>, data);
+		} else {
+			const result = interpolateTemplate(v, {}, data);
+			out[k] = result ?? v;
+		}
+	}
+	return out;
+}

package/src/resolve-service-context.ts

@@ -0,0 +1,67 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Resolves the minimum service context the bin needs to choose its launch
+ * path: connect DB, load registry, read service_install row, return kind +
+ * port. Caller is responsible for disconnecting.
+ */
+
+import { createDbClient } from "@teamscala/db/create-db-client";
+import type { PrismaClient } from "@teamscala/db/client";
+import { loadServicePrismaClient } from "@teamscala/db/load-service-prisma-client";
+import { registerPrismaClient } from "@teamscala/db/prisma-registry";
+import { loadRegistryEntries } from "@teamscala/db/registry/loader/load-entries";
+import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import { loadServiceInstallRow } from "@teamscala/db/registry/loader/load-service-install-row";
+
+export interface ServiceContext {
+	kind: "ui" | "backend" | "runtime";
+	port: number;
+	config: ServiceInstallConfig;
+	disconnect: () => Promise<void>;
+}
+
+export async function resolveServiceContext(
+	serviceSlug: string,
+	databaseUrl: string,
+): Promise<ServiceContext> {
+	const PrismaClientConstructor = await loadServicePrismaClient(serviceSlug);
+	const dbClient = await createDbClient({
+		connectionString: databaseUrl,
+		serviceName: serviceSlug,
+		PrismaClientConstructor: PrismaClientConstructor as never,
+	});
+	registerPrismaClient(dbClient.prisma as never as PrismaClient);
+	await loadRegistryEntries(dbClient.prisma as never);
+
+	const rowResult = await loadServiceInstallRow(serviceSlug);
+	if (!rowResult.success) {
+		throw new Error(`[scala-install:${serviceSlug}] ${rowResult.message}`);
+	}
+	const cfg = rowResult.config;
+	const port = Number(cfg.port);
+	if (!Number.isFinite(port) || port <= 0) {
+		throw new Error(
+			`[scala-install:${serviceSlug}] invalid port "${cfg.port}" in service_install row`,
+		);
+	}
+	// Export the resolved port to process.env so loopback code reads the REAL
+	// port without a separate PORT injection. The central-tool-forwarder (the
+	// chat tool dispatch) falls back to http://localhost:${PORT} for the
+	// co-located /mcp; without this export every chat tool call fails with
+	// "cannot resolve the /mcp base URL" (the highlight-ring end-to-end blocker,
+	// 2026-07-02). Railway's $PORT (when present) is respected — only set when
+	// unset so prod's Railway-assigned port wins.
+	if (!process.env.PORT) process.env.PORT = String(port);
+
+	return {
+		kind: cfg.kind,
+		port,
+		config: cfg,
+		disconnect: async () => {
+			await dbClient.disconnect?.();
+		},
+	};
+}

package/src/resolve-theme-mode.ts

@@ -0,0 +1,61 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The ONE theme-mode decider for every page render, across every UI app
+ * (portal, proposals, sign, forms, quiz, gpt, public). Every route handler in service-boot
+ * resolves light/dark through this single function — never its own inline
+ * `(... === "dark" ? "dark" : "light")` chain. That inline form was duplicated
+ * across every route branch, so flipping one app's theme required editing
+ * every copy (the heavy lifting this removes).
+ *
+ * Resolution order (first match wins):
+ *   1. ?theme=light|dark on the URL — the embed override. Set when a page is
+ *      framed inside another shell (a form in a GPT tool panel) so the framed
+ *      page matches the host's scheme. Also marks the render `embedded` so the
+ *      page can drop its own brand page-surface and render the host's clean
+ *      surface.
+ *   2. candidates[] — page rootProps.theme, brand theme, website default, in
+ *      whatever priority the caller passes them.
+ *   3. "light".
+ *
+ * Pairs with the brand/token decider (resolveBrand → computeThemeVars,
+ * `unified-brand-theme`): that owns the SURFACE, this owns the MODE.
+ */
+
+export interface ResolvedThemeMode {
+	theme: "light" | "dark";
+	/** True iff the mode came from the ?theme= embed override. */
+	embedded: boolean;
+}
+
+function asMode(value: unknown): "light" | "dark" | undefined {
+	return value === "light" || value === "dark" ? value : undefined;
+}
+
+export function resolveThemeMode(opts: {
+	/** Request URL (or its href) — read for the ?theme= embed override. */
+	url?: URL | string | null;
+	/**
+	 * Explicit embed override, when the caller already extracted ?theme= from
+	 * the URL upstream (e.g. a pure data-shaper that has no Request). Same
+	 * effect and priority as the URL form.
+	 */
+	override?: unknown;
+	/** Theme candidates in priority order: rootTheme, brandTheme, websiteTheme. */
+	candidates?: Array<unknown>;
+}): ResolvedThemeMode {
+	let override = asMode(opts.override);
+	if (!override && opts.url) {
+		const u = typeof opts.url === "string" ? new URL(opts.url) : opts.url;
+		override = asMode(u.searchParams.get("theme"));
+	}
+	if (override) return { theme: override, embedded: true };
+
+	for (const candidate of opts.candidates ?? []) {
+		const mode = asMode(candidate);
+		if (mode) return { theme: mode, embedded: false };
+	}
+	return { theme: "light", embedded: false };
+}

package/src/resolvers/fetch-org-brand.ts

@@ -0,0 +1,28 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * fetch-org-brand.ts — org brand resolver with page-org-first fallback.
+ *
+ * Wraps @teamscala/resolver-engine's fetchOrgBrand with the page-org-first
+ * fallback (portal-branding-resolves-page-org-first): if the page (center) org
+ * carried no brand row, fall back to the website owning-org so pages with no
+ * tenant org render the website's brand, not a blank. Extracted from the
+ * hardcoded `fetchOrgBrand` arm in resolve-from-loader-config.ts.
+ */
+import { fetchOrgBrand } from "@teamscala/resolver-engine/data-resolvers/fetch-org-brand";
+import type { ResolverArgs } from "./portal-route-paths.ts";
+
+export async function fetchOrgBrandWithFallback({ input, client }: ResolverArgs): Promise<unknown> {
+	const orgId = input.orgId as string | undefined;
+	if (orgId) {
+		const result = await fetchOrgBrand(client as Parameters<typeof fetchOrgBrand>[0], orgId);
+		if (result) return result;
+	}
+	const fallbackOrgId = input.fallbackOrgId as string | undefined;
+	if (fallbackOrgId && fallbackOrgId !== orgId) {
+		return fetchOrgBrand(client as Parameters<typeof fetchOrgBrand>[0], fallbackOrgId);
+	}
+	return null;
+}

package/src/resolvers/portal-route-paths.test.ts

@@ -0,0 +1,102 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * portal-route-paths.test.ts — locks the portal-path shape contract that both
+ * the route resolver and the /sign-in brand extractor (bind-page-handler) share:
+ * the canonical portal URL is /<websiteId>/<orgId>/<path>, so the ORG is segment
+ * 1, never segment 0. The fixture pairs below are the regression guard for the
+ * two cross-tenant defects this centralises (found 2026-07-21): reading segment 0
+ * fed a website id into brand resolution and silently rendered org-less portal
+ * URLs unscoped.
+ */
+
+import { describe, expect, test } from "bun:test";
+import {
+	extractOrgIdFromCallbackPath,
+	resolvePortalRoutePaths,
+} from "./portal-route-paths";
+
+const WEBSITE = "a9a28515-4ad5-405c-a74d-bb83fed079d0"; // scala Portal
+const ORG = "5b742740-0f37-494c-a059-d8399ae4b350"; // GMG APAC (tenant)
+const RESOURCE = "019e9124-af4c-7000-bfaf-2ae97fb64772"; // a non-org resource id
+
+describe("extractOrgIdFromCallbackPath (portal-branding-resolves-page-org-first)", () => {
+	test("canonical portal shape /<websiteId>/<orgId>/<path> → ORG at segment 1 (not the website id at segment 0)", () => {
+		// CLEAN: returns the org. The violating behaviour this locks out returned
+		// WEBSITE (segment 0) → brand resolved no org → fell back to super-admin.
+		expect(extractOrgIdFromCallbackPath(`/${WEBSITE}/${ORG}/dashboard`)).toBe(ORG);
+		expect(extractOrgIdFromCallbackPath(`/${WEBSITE}/${ORG}/dashboard`)).not.toBe(WEBSITE);
+	});
+
+	test("scala-projects single-UUID shape /<orgId>/<path> → segment 0 (unchanged)", () => {
+		expect(extractOrgIdFromCallbackPath(`/${ORG}/projects`)).toBe(ORG);
+	});
+
+	test("proposal/form/quiz resource host /<resourceId> → segment 0 (non-org, resolves no brand, falls back)", () => {
+		expect(extractOrgIdFromCallbackPath(`/${RESOURCE}`)).toBe(RESOURCE);
+	});
+
+	test("query string is ignored", () => {
+		expect(extractOrgIdFromCallbackPath(`/${WEBSITE}/${ORG}/dashboard?right=chat`)).toBe(ORG);
+	});
+
+	test("non-UUID path → undefined (no brand override, falls back as before)", () => {
+		expect(extractOrgIdFromCallbackPath("/sign-in")).toBeUndefined();
+		expect(extractOrgIdFromCallbackPath("/dashboard")).toBeUndefined();
+	});
+
+	test("empty / malformed → undefined", () => {
+		expect(extractOrgIdFromCallbackPath("")).toBeUndefined();
+		expect(extractOrgIdFromCallbackPath("/")).toBeUndefined();
+	});
+});
+
+describe("resolvePortalRoutePaths", () => {
+	test("canonical two-UUID shape → strips portal+org, center_path is the builda path", () => {
+		const out = resolvePortalRoutePaths({
+			input: { path: `/${WEBSITE}/${ORG}/hub/portal-integrations` },
+			client: undefined,
+			params: {},
+		});
+		expect(out.portal_id).toBe(WEBSITE);
+		expect(out.org_id).toBe(ORG);
+		expect(out.center_path).toBe("/hub/portal-integrations");
+		expect(out.toolbar_path).toBe("/portal-integrations-toolbar");
+	});
+
+	test("org-less portal shape /<websiteId>/<path> → portal_id populated, org_id null, center_path is the real path", () => {
+		// CLEAN: portal_id is the website, center_path strips it. The violating
+		// behaviour this locks out left portal_id null and center_path as the
+		// literal "/<websiteId>/dashboard" (so it silently rendered unscoped).
+		const out = resolvePortalRoutePaths({
+			input: { path: `/${WEBSITE}/dashboard` },
+			client: undefined,
+			params: {},
+		});
+		expect(out.portal_id).toBe(WEBSITE);
+		expect(out.org_id).toBeNull();
+		expect(out.center_path).toBe("/dashboard");
+	});
+
+	test("bare path (no UUID prefix) → portal_id/org_id null, path untouched", () => {
+		const out = resolvePortalRoutePaths({
+			input: { path: "/hub/portal-integrations" },
+			client: undefined,
+			params: {},
+		});
+		expect(out.portal_id).toBeNull();
+		expect(out.org_id).toBeNull();
+		expect(out.center_path).toBe("/hub/portal-integrations");
+	});
+
+	test('"/" falls back to the home path', () => {
+		const out = resolvePortalRoutePaths({
+			input: { path: `/${WEBSITE}/${ORG}/`, home_path: "/dashboard" },
+			client: undefined,
+			params: {},
+		});
+		expect(out.center_path).toBe("/dashboard");
+	});
+});

package/src/resolvers/portal-route-paths.ts

@@ -0,0 +1,83 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * portal-route-paths.ts — pure path mapper for portal region routing.
+ *
+ * Extracted from resolve-from-loader-config.ts (the hardcoded
+ * `resolvePortalRoutePaths` arm) so it can be invoked via a resolver_fn
+ * registry row instead of an if-chain. Faithful extraction — no logic change.
+ * The request path is the center page's builda path ("/" falls back to
+ * home_path), and the per-route toolbar page follows the flat naming convention
+ * `/<last-segment>-toolbar`. Pages without a matching toolbar page simply
+ * resolve an empty toolbar region (the source is declared optional).
+ */
+export interface ResolverArgs {
+	input: Record<string, unknown>;
+	client: unknown;
+	params: Record<string, unknown>;
+}
+
+// Canonical portal URL shape: /<websiteId>/<organisationId>/<builda path...>.
+// Segment 0 is the portal WEBSITE id; segment 1 is the ORG id. Shared by the
+// resolver below and by extractOrgIdFromCallbackPath (the /sign-in brand path).
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Extract the organisation id from a portal-shaped callback/path — the single
+ * authority for "which segment is the org" so the sign-in brand resolver and the
+ * route resolver cannot drift on the answer (portal-branding-resolves-page-org-first).
+ *
+ * The canonical portal shape is `/<websiteId>/<orgId>/<path>` — the org is
+ * segment 1, NOT segment 0. Reading segment 0 fed the WEBSITE id into brand
+ * resolution, which resolved no org and fell back to the super-admin org — the
+ * exact cross-tenant mis-branding this exists to prevent (bind-page-handler.ts,
+ * found 2026-07-21).
+ *
+ * Single-UUID hosts keep segment 0 unchanged: scala-projects routes `/<orgId>/…`
+ * and proposal/form/quiz hosts route `/<resourceId>/…` (a non-org first segment
+ * that resolves to no brand and falls back as before — no regression, only the
+ * correct-org improvement for the two-UUID portal shape). Returns undefined when
+ * neither leading segment is a UUID.
+ */
+export function extractOrgIdFromCallbackPath(callbackUrl: string): string | undefined {
+	const segs = callbackUrl.split("?")[0].split("/").filter(Boolean);
+	if (UUID_RE.test(segs[1] ?? "")) return segs[1];
+	if (UUID_RE.test(segs[0] ?? "")) return segs[0];
+	return undefined;
+}
+
+export function resolvePortalRoutePaths({ input, params }: ResolverArgs): Record<string, unknown> {
+	const rawPath = (input.path as string | undefined) ?? ":path";
+	let path = rawPath === ":path" ? ((params.path as string) || "/") : rawPath;
+	// Canonical portal URL shape: /<websiteId>/<orgId>/<builda path...>. Segment 0
+	// is the portal website id; segment 1 is the org id. Two cases:
+	//  - both leading segments UUID → canonical scoped URL, strip both.
+	//  - segment 0 UUID, segment 1 NOT → ORG-LESS portal URL (/<websiteId>/<path>).
+	//    portal_id is still populated (it IS the requested portal) and the website
+	//    id is stripped so center_path is the real builda path; org_id stays null
+	//    as the signal. The org-less shape is gated to redirect/404 upstream in
+	//    resolve-page-state (portalHomeRedirect) so it never silently renders.
+	const segments = path.split("/").filter(Boolean);
+	let portalId: string | null = null;
+	let orgId: string | null = null;
+	if (UUID_RE.test(segments[0] ?? "")) {
+		portalId = segments[0] ?? null;
+		if (UUID_RE.test(segments[1] ?? "")) {
+			orgId = segments[1] ?? null;
+			path = `/${segments.slice(2).join("/")}`;
+		} else {
+			path = `/${segments.slice(1).join("/")}`;
+		}
+	}
+	const homePath = (input.home_path as string | undefined) || "/dashboard";
+	const centerPath = path === "/" ? homePath : path;
+	const lastSegment = centerPath.split("/").filter(Boolean).pop() ?? "";
+	return {
+		center_path: centerPath,
+		toolbar_path: `/${lastSegment}-toolbar`,
+		portal_id: portalId,
+		org_id: orgId,
+	};
+}

package/src/resolvers/website-by-host-map.ts

@@ -0,0 +1,49 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * website-by-host-map.ts — resolves the website + body path for a host.
+ *
+ * Extracted from resolve-from-loader-config.ts (the hardcoded
+ * `resolveWebsiteByHostMap` arm). Faithful extraction — no logic change.
+ */
+import type { ResolverArgs } from "./portal-route-paths.ts";
+
+type BrandWebsite = {
+	id: string;
+	name: string | null;
+	slug: string;
+	organisation_id: string | null;
+	layout_settings: unknown;
+	header_settings: unknown;
+	footer_settings: unknown;
+};
+
+export async function resolveWebsiteByHostMap({ input, client, params }: ResolverArgs): Promise<Record<string, unknown> | null> {
+	const host = input.host as string | undefined;
+	const hostsMap = input.hosts_map as Record<string, { website: string; body_path?: string }> | null;
+	const defaultWebsite = input.default_website as string | undefined;
+	if (!host || !hostsMap) return null;
+	const entry = hostsMap[host];
+	const websiteSlug = entry?.website ?? defaultWebsite;
+	if (!websiteSlug) return null;
+	const rawBodyPath = entry?.body_path ?? (input.default_body_path as string | undefined) ?? ":path";
+	const bodyPath = rawBodyPath === ":path" ? ((params.path as string) || "/") : rawBodyPath;
+	const website = await (client as never as {
+		builda_websites: { findFirst: (args: Record<string, unknown>) => Promise<BrandWebsite | null> };
+	}).builda_websites.findFirst({
+		where: { slug: websiteSlug },
+		select: {
+			id: true,
+			name: true,
+			slug: true,
+			organisation_id: true,
+			layout_settings: true,
+			header_settings: true,
+			footer_settings: true,
+		},
+	});
+	if (!website) return null;
+	return { ...website, body_path: bodyPath, host };
+}