@teamscala/service-boot 0.23.413 → 0.23.414

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.413",
+  "version": "0.23.414",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -886,6 +886,62 @@
       "types": "./src/register-registry-page-route/resolve-page-data.d.ts",
       "default": "./src/register-registry-page-route/resolve-page-data.ts"
     },
+    "./register-registry-page-route/resolve-request-graph": {
+      "types": "./src/register-registry-page-route/resolve-request-graph.d.ts",
+      "default": "./src/register-registry-page-route/resolve-request-graph.ts"
+    },
+    "./register-registry-page-route/resolve-request-graph.ts": {
+      "types": "./src/register-registry-page-route/resolve-request-graph.d.ts",
+      "default": "./src/register-registry-page-route/resolve-request-graph.ts"
+    },
+    "./register-registry-page-route/resolve-panel-page": {
+      "types": "./src/register-registry-page-route/resolve-panel-page.d.ts",
+      "default": "./src/register-registry-page-route/resolve-panel-page.ts"
+    },
+    "./register-registry-page-route/resolve-panel-page.ts": {
+      "types": "./src/register-registry-page-route/resolve-panel-page.d.ts",
+      "default": "./src/register-registry-page-route/resolve-panel-page.ts"
+    },
+    "./register-registry-page-route/stamp-session-context": {
+      "types": "./src/register-registry-page-route/stamp-session-context.d.ts",
+      "default": "./src/register-registry-page-route/stamp-session-context.ts"
+    },
+    "./register-registry-page-route/stamp-session-context.ts": {
+      "types": "./src/register-registry-page-route/stamp-session-context.d.ts",
+      "default": "./src/register-registry-page-route/stamp-session-context.ts"
+    },
+    "./register-registry-page-route/run-content-gates": {
+      "types": "./src/register-registry-page-route/run-content-gates.d.ts",
+      "default": "./src/register-registry-page-route/run-content-gates.ts"
+    },
+    "./register-registry-page-route/run-content-gates.ts": {
+      "types": "./src/register-registry-page-route/run-content-gates.d.ts",
+      "default": "./src/register-registry-page-route/run-content-gates.ts"
+    },
+    "./register-registry-page-route/apply-page-branding": {
+      "types": "./src/register-registry-page-route/apply-page-branding.d.ts",
+      "default": "./src/register-registry-page-route/apply-page-branding.ts"
+    },
+    "./register-registry-page-route/apply-page-branding.ts": {
+      "types": "./src/register-registry-page-route/apply-page-branding.d.ts",
+      "default": "./src/register-registry-page-route/apply-page-branding.ts"
+    },
+    "./register-registry-page-route/warn-uncovered-blocks": {
+      "types": "./src/register-registry-page-route/warn-uncovered-blocks.d.ts",
+      "default": "./src/register-registry-page-route/warn-uncovered-blocks.ts"
+    },
+    "./register-registry-page-route/warn-uncovered-blocks.ts": {
+      "types": "./src/register-registry-page-route/warn-uncovered-blocks.d.ts",
+      "default": "./src/register-registry-page-route/warn-uncovered-blocks.ts"
+    },
+    "./register-registry-page-route/prefetch-org-id": {
+      "types": "./src/register-registry-page-route/prefetch-org-id.d.ts",
+      "default": "./src/register-registry-page-route/prefetch-org-id.ts"
+    },
+    "./register-registry-page-route/prefetch-org-id.ts": {
+      "types": "./src/register-registry-page-route/prefetch-org-id.d.ts",
+      "default": "./src/register-registry-page-route/prefetch-org-id.ts"
+    },
     "./register-static-assets": {
       "types": "./src/register-static-assets.d.ts",
       "default": "./src/register-static-assets.ts"

package/src/register-registry-page-route/apply-page-branding.ts

@@ -0,0 +1,207 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The three brand-override paths of a registered page route: the /sign-in
+ * callback-org override, the signed-in session-org personalisation
+ * (platform pages only), and the brand_org_path resource-owner override.
+ *
+ * Split out of register-registry-page-route.ts (924 lines) — the loadData
+ * closure segments moved byte-identical; only the closure variables became
+ * explicit parameters.
+ */
+
+import { fetchOrganisationPageBranding } from "@teamscala/db/fetch-organisation-page-branding";
+import { getPlatformOrgId } from "@teamscala/db/registry/platform";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { getServerClient } from "../page-server-orpc/server-client.ts";
+import { extractOrgIdFromCallbackPath } from "../resolvers/portal-route-paths.ts";
+
+function spreadBranding(
+	existing: Record<string, unknown> | undefined,
+	branding: NonNullable<Awaited<ReturnType<typeof fetchOrganisationPageBranding>>>,
+): Record<string, unknown> {
+	const existingLogo =
+		((existing as Record<string, unknown> | undefined)?.logo as Record<string, unknown> | undefined) ?? {};
+	return {
+		...existing,
+		companyName: branding.company_name,
+		// Friendly name is the customer-facing one; falling back to the
+		// legal entity fed "GMG APAC" to every consumer that correctly
+		// read companyFriendlyName (e.g. logoAlt in the Puck host codegen).
+		companyFriendlyName:
+			branding.company_friendly_name ?? branding.company_name,
+		primaryColor: branding.brand_primary_color ?? existing?.primaryColor,
+		headingFont: branding.brand_heading_font ?? existing?.headingFont,
+		bodyFont: branding.brand_body_font ?? existing?.bodyFont,
+		logo: {
+			light: branding.company_logo_for_light_theme,
+			dark: branding.company_logo_for_dark_theme,
+			brand: existingLogo.brand ?? null,
+		},
+	};
+}
+
+/**
+ * /sign-in brand override: a shared org-scoped link 302→/sign-in for the
+ * unauthed crawler (WhatsApp), which saw the service's default website
+ * brand (the platform owner). The callbackURL carries the destination org
+ * — override resolved.brand (before the title/meta/og are built from it)
+ * so the page reflects the org the visitor is signing in to. Scoped to
+ * /sign-in; resource pages keep their own brand.
+ *
+ * The org is segment 1 of the canonical portal shape /<websiteId>/<orgId>/
+ * <path>, NOT segment 0 (the website id): reading segment 0 fed a website id
+ * into fetchOrganisationPageBranding, which resolved no org and left the
+ * default (super-admin) brand — the cross-tenant mis-branding this override
+ * exists to prevent (portal-branding-resolves-page-org-first, 2026-07-21).
+ * Shared helper so this and bind-page-handler cannot drift on the answer.
+ */
+export async function applySignInBrandOverride(
+	resolved: Record<string, unknown>,
+	request: Request,
+): Promise<void> {
+	try {
+		const reqUrl = new URL(request.url);
+		if (reqUrl.pathname === "/sign-in") {
+			const cb = reqUrl.searchParams.get("callbackURL") ?? "";
+			const cbOrgId = extractOrgIdFromCallbackPath(cb);
+			const currentBrandOrgId =
+				(resolved.brand as { orgId?: string } | undefined)?.orgId ??
+				(resolved as { orgId?: string }).orgId;
+			if (cbOrgId && cbOrgId !== currentBrandOrgId) {
+				const branding = await fetchOrganisationPageBranding(
+					getServerClient() as never,
+					cbOrgId,
+				);
+				if (branding) {
+					const existing = (resolved.brand as Record<string, unknown>) ?? {};
+					resolved.brand = spreadBranding(existing, branding);
+				}
+			}
+		}
+	} catch {
+		// Branding fetch failed — keep the default brand (no regression).
+	}
+}
+
+/**
+ * brand-is-org-owned-full-scheme, reconciled with page-org-first
+ * (portal-branding-resolves-page-org-first): the session override now
+ * personalizes ONLY platform pages (page org === website owning-org).
+ * Tenant pages keep their resolved page-org brand — the page is
+ * authoritative, the menu switcher changes which tenant's pages you
+ * view. Anonymous/public (no session) keeps the resolved brand. Same
+ * fetchOrganisationPageBranding pattern as the /sign-in brand override.
+ *
+ * A PUBLIC PAGE IS NEVER PERSONALISED TO THE READER'S ORG. Personalising
+ * the brand is right for a portal — you are looking at your own
+ * workspace. It is wrong for a public document, which belongs to the org
+ * that PUBLISHED it and must look identical to every reader.
+ *
+ * Measured 2026-08-17: the Launcha Authority Blueprint, owned by GMG
+ * APAC, rendered correctly for an anonymous customer and in GBG Indo's
+ * navy with the scala logo for any signed-in staff member — so the two
+ * people checking it before it went to clients were the only two who
+ * could not see what a client sees. Silent, and inverted: the reviewers
+ * got the wrong page.
+ */
+export async function applySessionOrgBranding(
+	pageData: Record<string, unknown>,
+	renderMode: string | undefined,
+	sessionOrgId: string | undefined,
+): Promise<void> {
+	if (
+		renderMode !== "public" &&
+		sessionOrgId &&
+		sessionOrgId !== (pageData.orgId as string | undefined) &&
+		// Page-org-first (portal-branding-resolves-page-org-first): the
+		// session override personalizes ONLY the shared PLATFORM website
+		// (super-admin org). A TENANT-owned site (a customer GPT/quiz/portal)
+		// keeps its page-org brand regardless of the viewer session org. The
+		// old pageData.orgId===website.org mis-fired for a tenant whose page org equals their own website org.
+		getPlatformOrgId() ===
+			((pageData.website as { organisation_id?: string | null } | undefined)
+				?.organisation_id ?? undefined)
+	) {
+		try {
+			const branding = await fetchOrganisationPageBranding(
+				getServerClient() as never,
+				sessionOrgId,
+			);
+			if (branding) {
+				pageData.orgId = sessionOrgId;
+				const existing = (pageData.brand as Record<string, unknown>) ?? {};
+				pageData.brand = spreadBranding(existing, branding);
+			}
+		} catch {
+			// Branding fetch failed — keep the default brand (no regression).
+		}
+	}
+}
+
+/**
+ * BRAND FROM THE ORG THAT OWNS THE RESOURCE, not the website's owner.
+ * A public resource page (an assessment report, a shared document) is
+ * hosted on a shared website but BELONGS to a tenant. resolvePageBrand
+ * reads pageData.orgId, which is the WEBSITE's org, so every tenant's
+ * report rendered the host org's logo and palette.
+ *
+ * Measured 2026-08-17: the Launcha Authority Blueprint is owned by GMG
+ * APAC (#FF4500, launcha logo) and rendered with GBG Indo's navy and
+ * scala mark, because both pages live on the shared "Public Pages"
+ * site. The loader had already resolved the right org — nothing
+ * consumed it.
+ *
+ * `brand_org_path` names where the owning org id lives in the resolved
+ * loader data (e.g. "quiz.organisation_id"), so which resource owns the
+ * brand is a ROW, never a per-service branch
+ * (`business-logic-is-rows-plus-executors`). Absent or unresolvable,
+ * the website's org stands — this can only ever narrow the brand to a
+ * more specific owner, never blank it.
+ */
+export async function applyBrandOrgPath(
+	pageData: Record<string, unknown>,
+	resolved: Record<string, unknown>,
+	brandOrgPath: string | undefined,
+	params: { path?: string },
+	serviceSlug: string,
+): Promise<void> {
+	const log = getAppLogger();
+	if (brandOrgPath) {
+		let cursor: unknown = resolved;
+		for (const key of brandOrgPath.split(".")) {
+			if (cursor == null || typeof cursor !== "object") {
+				cursor = undefined;
+				break;
+			}
+			cursor = (cursor as Record<string, unknown>)[key];
+		}
+		if (typeof cursor === "string" && cursor.length > 0) {
+			pageData.orgId = cursor;
+			// orgId alone is not enough. resolvePageBrand fills only the
+			// accent/secondary/muted gaps from the org; primaryColor, logo and
+			// companyName come from pageData.brand, which was built from the
+			// website's org. Replace those too, the same way the session
+			// override above does, or the page keeps the host's logo while
+			// claiming the tenant's org.
+			try {
+				const owner = await fetchOrganisationPageBranding(
+					getServerClient() as never,
+					cursor,
+				);
+				if (owner) {
+					const existing = (pageData.brand as Record<string, unknown>) ?? {};
+					pageData.brand = spreadBranding(existing, owner);
+				}
+			} catch {
+				// Branding fetch failed — keep the website brand (no regression).
+			}
+		} else {
+			log.warn(
+				`[scala-install:${serviceSlug}] brand_org_path "${brandOrgPath}" resolved no org id for ${params.path}; keeping the website org brand`,
+			);
+		}
+	}
+}

package/src/register-registry-page-route/meta-title.ts

@@ -23,6 +23,21 @@ export function buildMetaFromContext(
 	return interpolateMeta(metaContext as Record<string, unknown>, resolved);
 }
 
+/**
+ * The page's own meta_title row (loaderData.page first, resolved.page second)
+ * — used only on /sign-in, where the org's sign-in page title overrides the
+ * derived one. Moved from register-registry-page-route.ts.
+ */
+export function resolvePageMetaTitle(
+	resolved: Record<string, unknown>,
+): unknown {
+	return (
+		(resolved.loaderData as { page?: { meta_title?: unknown } } | undefined)
+			?.page?.meta_title ??
+		(resolved.page as { meta_title?: unknown } | undefined)?.meta_title
+	);
+}
+
 /**
  * THE ONE SUBJECT DERIVATION. What a page is ABOUT — the entity whose name the
  * browser tab should carry.

package/src/register-registry-page-route/prefetch-org-id.ts

@@ -0,0 +1,38 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Resolves the organisation id for the background AI-chat session prefetch
+ * from the request path. A canonical portal URL is /<websiteId>/<orgId>/
+ * <path> — the org is segment 1, NOT segment 0. Moved from
+ * register-registry-page-route.ts.
+ */
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Prefer segment 1; fall back to segment 0 only when segment 1 is not a
+ * UUID (the single-UUID shape, which is live and supported — NOT
+ * transitional). The fallback is deliberately kept
+ * UNCHANGED-BEHAVIOUR rather than "fixed": a UUID in segment 0 is
+ * genuinely ambiguous — of the 40 UUID-first page paths in builda_pages,
+ * ZERO are websites and ZERO are organisations, so segment 0 can also be
+ * an unrelated record id. Position alone cannot resolve that; only
+ * validating the id against organisation_profile can, and that is a DB
+ * read this hot prefetch path should not take without caching
+ * (`hot-path-resolutions-are-cached`). Preferring segment 1 is strictly
+ * better for the canonical shape and no worse for any other. Reading
+ * segment 0 first captured the WEBSITE id and passed it as an
+ * organisation id, which failed silently because both are well-formed
+ * UUIDs: the prefetch simply warmed a session against the wrong tenant
+ * (found 2026-07-21).
+ */
+export function resolveAiOrgId(pathname: string): string | undefined {
+	const pathSegments = pathname.split("/").filter(Boolean);
+	return UUID_RE.test(pathSegments[1] ?? "")
+		? pathSegments[1]
+		: UUID_RE.test(pathSegments[0] ?? "")
+			? pathSegments[0]
+			: undefined;
+}

package/src/register-registry-page-route/resolve-panel-page.ts

@@ -0,0 +1,45 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ?panel=<slug> resolution: reads the panel_view row, follows its
+ * content.page_slug to the builda_pages row, and stashes the panel page
+ * data + active panel slug on pageData.
+ *
+ * Split out of register-registry-page-route.ts (924 lines) — the loadData
+ * closure segment moved byte-identical; only the closure variables became
+ * explicit parameters.
+ */
+
+import { getServerClient } from "../page-server-orpc/server-client.ts";
+
+export async function attachPanelPage(
+	pageData: Record<string, unknown>,
+	panelSlug: string | null,
+): Promise<void> {
+	if (!panelSlug) return;
+	try {
+		const dbReg = getServerClient() as unknown as {
+			registry_entries: { findFirst: (a: { where: unknown; select: unknown }) => Promise<{ config: Record<string, unknown> } | null> };
+		};
+		const pv = await dbReg.registry_entries.findFirst({
+			where: { type: "panel_view", slug: panelSlug, is_active: true },
+			select: { config: true },
+		});
+		const pageSlug = (pv?.config?.content as { page_slug?: string })?.page_slug;
+		if (pageSlug) {
+			const dbPages = getServerClient() as unknown as {
+				builda_pages: { findFirst: (a: { where: unknown; select: unknown }) => Promise<{ puck_data: unknown } | null> };
+			};
+			const panelPage = await dbPages.builda_pages.findFirst({
+				where: { path: `/${pageSlug}`, is_active: true },
+				select: { puck_data: true },
+			});
+			if (panelPage?.puck_data) {
+				pageData.panelPageData = panelPage.puck_data;
+				pageData.activePanel = panelSlug;
+			}
+		}
+	} catch { /* non-critical */ }
+}

package/src/register-registry-page-route/resolve-request-graph.ts

@@ -0,0 +1,170 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Per-request loader-graph resolution for a registered page route: SWR cache
+ * read (static-shell vs param-route cache), clone-on-get, defensive clone
+ * with logged fallbacks, primary-resource-missing dead-link 404s, and the
+ * content-page floor.
+ *
+ * Split out of register-registry-page-route.ts (924 lines) — the loadData
+ * closure segments moved byte-identical; only the closure variables became
+ * explicit parameters.
+ */
+
+import type { PageRouteConfig } from "../register-registry-page-route.ts";
+import * as v from "valibot";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import type { ResourceLoaderConfigSchema } from "@teamscala/db-validation/registry-schemas/resource-loader";
+import { resolveFromLoaderConfig } from "../resolve-from-loader-config.ts";
+import { decideContentPageFloor } from "../content-page-floor.ts";
+import { PrimaryResourceMissingError } from "../resource-not-found.ts";
+import {
+	staticShellGraphCache,
+	paramRouteGraphCache,
+	readCachedGraph,
+} from "./graph-cache.ts";
+
+export interface ResolveRequestGraphArgs {
+	pattern: string;
+	routeSlug: string;
+	routeConfig: PageRouteConfig;
+	loaderConfig: v.InferOutput<typeof ResourceLoaderConfigSchema>;
+	params: Record<string, string>;
+	isStaticShell: boolean;
+	serviceSlug: string;
+}
+
+export async function resolveRequestGraph(
+	args: ResolveRequestGraphArgs,
+): Promise<Record<string, unknown>> {
+	const { pattern, routeSlug, routeConfig, loaderConfig, params, isStaticShell, serviceSlug } = args;
+	const log = getAppLogger();
+
+	// A bare root ("/") that declares a resource_type is a UUID-driven
+	// public site (proposals/forms/quiz) with no resource selected — it
+	// must render the branded holding/not-found page ("no <resource> at
+	// this link"), never fall through the shared public loader to the
+	// marketing site. PrimaryResourceMissingError is the existing signal
+	// the page binder maps to buildResourceNotFoundResponse. A "/" route
+	// WITHOUT a resource_type (e.g. scala-public's marketing root) is
+	// unaffected and still renders its content.
+	if (pattern === "/" && routeConfig.resource_type) {
+		// Status 200: the bare root is a valid "no <resource> selected"
+		// landing, not an error — and kind:ui services must answer GET /
+		// with 200 (verify-prod-persistent-slot). An invalid /:id keeps
+		// the default 404 (genuinely not found).
+		throw new PrimaryResourceMissingError(routeConfig.resource_type, 200);
+	}
+	const graphKey = `graph:${routeSlug}:${params.host}:${params.path}`;
+	const primaryType = routeConfig.resource_type;
+	const hasPrimarySource =
+		!!primaryType &&
+		!!(loaderConfig as { sources?: { key: string }[] }).sources?.some(
+			(s) => s.key === primaryType,
+		);
+	const graphCache = isStaticShell
+		? staticShellGraphCache
+		: paramRouteGraphCache;
+	const typedLoaderConfig = loaderConfig as v.InferOutput<
+		typeof ResourceLoaderConfigSchema
+	> & {
+		sources: NonNullable<
+			v.InferOutput<typeof ResourceLoaderConfigSchema>["sources"]
+		>;
+	};
+	let resolved: Record<string, unknown>;
+	// SWR read over @teamscala/cache: fresh hit serves the cached graph, stale
+	// hit serves it AND fires ONE background refresh (refreshInBackground,
+	// single-flight via the cache's in-flight map), miss returns undefined.
+	// The refresh callback re-resolves + stores a clone; a primary-missing
+	// (dead-link) graph THROWS so the cache is not updated — a dead link must
+	// stay per-request so a just-created record appears immediately
+	// (refreshInBackground catches, leaves the stale entry, logs one line).
+	const cachedGraph = readCachedGraph(
+		graphCache,
+		graphKey,
+		() =>
+			resolveFromLoaderConfig(typedLoaderConfig, params).then(
+				(freshGraph) => {
+					const freshPrimaryMissing =
+						hasPrimarySource &&
+						primaryType &&
+						freshGraph[primaryType] == null;
+					if (freshPrimaryMissing) {
+						throw new Error(
+							`primary resource "${primaryType}" missing — skip cache update for ${graphKey}`,
+						);
+					}
+					return structuredClone(freshGraph);
+				},
+			),
+	);
+	if (cachedGraph !== undefined) {
+		// Clone-on-get: gateAgreementContent + block resolution MUTATE the
+		// graph in place, so each request gets its own copy.
+		resolved = structuredClone(cachedGraph) as Record<string, unknown>;
+	} else {
+		resolved = await resolveFromLoaderConfig(typedLoaderConfig, params);
+		const primaryMissing =
+			hasPrimarySource && primaryType && resolved[primaryType] == null;
+		if (!primaryMissing) {
+			// Defensive clone: structuredClone throws on non-cloneable loader
+			// graphs (functions/Proxies/Prisma instances). A swallowed throw
+			// here used to SILENTLY disable the graph cache for this key
+			// (fail-open-silent — forbidden by protective-layers-fail-explicitly),
+			// which left affected routes re-resolving the loader graph every
+			// request (measured ~1.2s on the projects utility shell). JSON-clone
+			// preserves the data graph (dropping functions/undefined a loader
+			// graph shouldn't carry) so the cache stays effective; both fallbacks
+			// are LOGGED so the offending non-cloneable source is observable +
+			// fixable, never silently disabling the cache again.
+			let cloned: unknown;
+			try {
+				cloned = structuredClone(resolved);
+			} catch (err) {
+				log.warn(
+					`[scala-install:${serviceSlug}] graph-cache structuredClone failed for ${graphKey} — falling back to JSON-clone (non-cloneable value in loader graph): ${err instanceof Error ? err.message : err}`,
+				);
+				try {
+					cloned = JSON.parse(JSON.stringify(resolved));
+				} catch (err2) {
+					log.warn(
+						`[scala-install:${serviceSlug}] graph-cache JSON-clone also failed for ${graphKey} — cache disabled for this key (observable): ${err2 instanceof Error ? err2.message : err2}`,
+					);
+					cloned = undefined;
+				}
+			}
+			if (cloned !== undefined) {
+				graphCache.set(graphKey, cloned);
+			}
+		}
+	}
+	// A route that declares resource_type is meaningless without that
+	// entity: a dead link (wrong id, deleted row) must 404 with the
+	// branded not-found page — never fall through to default content
+	// (the "Vision Toolbar" leak, operator-observed 2026-06-05).
+	if (hasPrimarySource && primaryType && resolved[primaryType] == null) {
+		throw new PrimaryResourceMissingError(primaryType);
+	}
+	// A CONTENT route (no resource_type) whose loader resolves a `page`
+	// body source must not synthesize an empty page for an unmatched path
+	// and serve a cacheable 200 — the generalized "Vision Toolbar" leak
+	// (operator-reported 5×: a deleted page, e.g. /roadmap, returned 200
+	// with an empty body instead of not-found). No page row → dead link →
+	// branded 404 floor. A page row that exists but has zero blocks → a
+	// content gap → the floor's empty-page surface (200). Both carry the
+	// "Take me home" action. The pure decision lives in content-page-floor.ts
+	// (unit-tested without the Hono/DB/graph machinery). Region-slot
+	// (utility/portal) shells without a `page` source are untouched.
+	const contentFloorError = decideContentPageFloor({
+		hasResourceType: !!primaryType,
+		hasPageContentSource: !!(loaderConfig as { sources?: { key: string }[] }).sources?.some(
+			(s) => s.key === "page",
+		),
+		page: resolved.page,
+	});
+	if (contentFloorError) throw contentFloorError;
+	return resolved;
+}

package/src/register-registry-page-route/run-content-gates.ts

@@ -0,0 +1,80 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Runs every registered content gate in catalog order (sequential, never
+ * parallel — gates depend on prior gates' graph mutations) and applies the
+ * page's declared assistant where authorized.
+ *
+ * Split out of register-registry-page-route.ts (924 lines) — the loadData
+ * closure segment moved byte-identical; only the closure variables became
+ * explicit parameters.
+ */
+
+import type { PageRouteConfig } from "../register-registry-page-route.ts";
+import { runContentGate } from "../content-gate/gate.ts";
+import type { ContentGateOutcome } from "../content-gate/gate.ts";
+import { CONTENT_GATES, withholdsContent } from "../content-gate/catalog.ts";
+import { injectResourceChatLauncher } from "../resource-chat-inject.ts";
+
+export async function runContentGatesForPage(
+	resolved: Record<string, unknown>,
+	gateCookie: string | null,
+	gateNow: number,
+	assistant: PageRouteConfig["assistant"],
+	regionSlots: string[] | undefined,
+): Promise<void> {
+	// EVERY REGISTERED GATE, IN CATALOG ORDER (content-gate/catalog.ts).
+	// This used to name proposalGateConfig, agreementGateConfig and
+	// gptGateConfig by hand, so a fourth gated resource type meant editing
+	// this file AND the second hand-written list in two-phase-boot.ts.
+	//
+	// SEQUENTIAL, NEVER PARALLEL. An authorized proposal viewer has their
+	// gate block removed from the resolved graph, and that removal is what
+	// makes the agreement gate find no resource and no-op on a page that
+	// carries both. Awaiting these together would race that dependency.
+	const gateOutcomes: ContentGateOutcome[] = [];
+	for (const entry of CONTENT_GATES) {
+		const outcome = await runContentGate(
+			resolved,
+			gateCookie,
+			gateNow,
+			entry.gate,
+		);
+		// A seed-only gate (open capture — the public GPT identity gate)
+		// withholds nothing, so its verdict is not evidence about whether
+		// this viewer may see the page and must not reach the assistant
+		// decision below. See withholdsContent, which derives that from the
+		// access config rather than restating it here.
+		if (withholdsContent(entry)) gateOutcomes.push(outcome);
+	}
+
+	// THE ASSISTANT IS A ROW, AND THIS IS THE ONE PLACE IT IS APPLIED.
+	// It used to be a call inside each gate's onAuthorized plus an entry
+	// in the hardcoded gate sequence above, so a third resource type
+	// meant editing this file. Now any page declaring `assistant` gets
+	// one and no page without the key does.
+	//
+	// GATED PAGES ONLY WHEN AUTHORIZED. The launcher's runtime context is
+	// the whole document serialised, so injecting past a closed gate
+	// would hand withheld bytes to the chat. A page no gate governs is
+	// public and gets the assistant unconditionally -- that is a
+	// different state from an unauthorized viewer, which is why the gate
+	// reports `applies` separately from `authorized`.
+	if (assistant) {
+		const governing = gateOutcomes.filter((outcome) => outcome.applies);
+		const authorized = governing.find((outcome) => outcome.authorized);
+		if (governing.length === 0 || authorized) {
+			await injectResourceChatLauncher(resolved, authorized?.email ?? "", {
+				resourceKey: assistant.resource_key,
+				agentConfigSlug: assistant.agent_config_slug as never,
+				launchLabel: assistant.launch_label,
+				placeholder: assistant.placeholder,
+				// From the loader row, so the injector never has to guess
+				// which resolved keys hold rendered content.
+				regionSlots,
+			});
+		}
+	}
+}