@teamscala/service-boot 0.23.433 → 0.23.435

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.433",
+  "version": "0.23.435",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/build-client-assets/input-hashing.ts

@@ -21,8 +21,6 @@
  * changes (`migrations-copy-not-rewrite`).
  */
 
-import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { firstPartyScopeAlternation } from "@teamscala/os/workspace-topology/first-party-scopes";
 
@@ -32,7 +30,7 @@ import { firstPartyScopeAlternation } from "@teamscala/os/workspace-topology/fir
 // blk-utilities changes undetected → stale bundle). Cycle-safe via `seen`.
 export async function hashResolvedPackageStylesheets(
 	cwd: string,
-	h: ReturnType<typeof createHash>,
+	h: Bun.CryptoHasher,
 ): Promise<void> {
 	let appCss: string;
 	try {
@@ -120,12 +118,15 @@ async function readInstalledPkgVersion(
 
 export async function hashTeamgbgJsGraph(
 	cwd: string,
-	h: ReturnType<typeof createHash>,
+	h: Bun.CryptoHasher,
 ): Promise<void> {
-	const roots = [
+	const roots = [];
+	for (const p of [
 		join(cwd, "src", "entry-client.ts"),
 		join(cwd, "src", "page-manifest.ts"),
-	].filter((p) => existsSync(p));
+	]) {
+		if (await Bun.file(p).exists()) roots.push(p);
+	}
 	if (roots.length === 0) return; // backend service — no client bundle to guard
 
 	const seen = new Set<string>();
@@ -147,7 +148,7 @@ export async function hashTeamgbgJsGraph(
 				const nmIdx = file.indexOf("/node_modules/@teamscala/");
 				if (nmIdx >= 0) {
 					const rel = file.slice(nmIdx + "/node_modules/".length); // @teamscala/pkg/...
-					fileHashes.set(rel, createHash("sha256").update(text).digest("hex"));
+					fileHashes.set(rel, new Bun.CryptoHasher("sha256").update(text).digest("hex"));
 				}
 				const next: string[] = [];
 				for (const m of text.matchAll(JS_IMPORT_SPEC_RE)) {

package/src/csrf-protection.ts

@@ -32,14 +32,19 @@
 
 import { getManagedBaseDomain } from "@teamscala/auth/auth-env-resolution";
 import { isTrustedAuthOrigin } from "@teamscala/auth/is-trusted-auth-origin";
+import { createCache } from "@teamscala/cache/create-cache";
 import { csrf } from "hono/csrf";
 import type { Context, MiddlewareHandler } from "hono";
 
 const POSITIVE_TTL_MS = 5 * 60_000;
 const NEGATIVE_TTL_MS = 10_000;
 
-type CacheEntry = { trusted: boolean; expiresAt: number };
-const customDomainCache = new Map<string, CacheEntry>();
+// Positive and negative lookups expire on different clocks; the per-entry
+// ttlMs override on set() carries that, the primitive owns eviction.
+const customDomainCache = createCache<boolean>("service-boot:csrf-custom-domains", {
+	ttlMs: POSITIVE_TTL_MS,
+	maxSize: 512,
+});
 
 function isPlatformOrigin(origin: string, baseDomain: string): boolean {
 	let host: string;
@@ -61,9 +66,8 @@ async function isTrustedCustomOrigin(origin: string): Promise<boolean> {
 	}
 	if (!host) return false;
 
-	const now = Date.now();
 	const cached = customDomainCache.get(host);
-	if (cached && cached.expiresAt > now) return cached.trusted;
+	if (cached !== undefined) return cached;
 
 	const trusted = await (async () => {
 		try {
@@ -81,11 +85,7 @@ async function isTrustedCustomOrigin(origin: string): Promise<boolean> {
 		}
 	})();
 
-	customDomainCache.set(host, {
-		trusted,
-		expiresAt: now + (trusted ? POSITIVE_TTL_MS : NEGATIVE_TTL_MS),
-	});
-	if (customDomainCache.size > 512) customDomainCache.clear();
+	customDomainCache.set(host, trusted, trusted ? POSITIVE_TTL_MS : NEGATIVE_TTL_MS);
 	return trusted;
 }
 

package/src/discover-blocks.ts

@@ -21,7 +21,6 @@
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { getPrisma } from "@teamscala/db/prisma-registry";
 import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
@@ -56,17 +55,20 @@ export async function discoverBlocks(
 	// so the 2026-05-29 empty-list-scans-everything incident cannot recur either.
 	const serviceModules = join(process.cwd(), "node_modules");
 	const installedCache = new Map<string, boolean>();
-	const isInstalled = (pkg: string): boolean => {
+	const isInstalled = async (pkg: string): Promise<boolean> => {
 		const cached = installedCache.get(pkg);
 		if (cached !== undefined) return cached;
-		const ok = existsSync(join(serviceModules, ...pkg.split("/")));
+		const ok = await Bun.file(join(serviceModules, ...pkg.split("/"))).exists();
 		installedCache.set(pkg, ok);
 		return ok;
 	};
 	// `blockPackages` is retained only to surface authored-vs-installed drift to
 	// the operator; it no longer gates discovery, so it can never blank a block.
 	if (blockPackages.length > 0) {
-		const stale = blockPackages.filter((p) => !isInstalled(p));
+		const installed = await Promise.all(
+			blockPackages.map(async (p) => ({ p, ok: await isInstalled(p) })),
+		);
+		const stale = installed.filter((x) => !x.ok).map((x) => x.p);
 		if (stale.length > 0) {
 			getAppLogger().warn(
 				`[discover-blocks] block_packages lists ${stale.length} package(s) that are not installed (ignored): ${stale.join(", ")}`,
@@ -105,7 +107,7 @@ export async function discoverBlocks(
 		const rawPackage = rawComponentPath
 			? rawComponentPath.split("/").slice(0, 2).join("/")
 			: null;
-		if (!rawPackage || !isInstalled(rawPackage)) {
+		if (!rawPackage || !(await isInstalled(rawPackage))) {
 			skipped.push(
 				`${row.slug} (${rawPackage ?? "missing componentPath"} not installed)`,
 			);
@@ -131,7 +133,7 @@ export async function discoverBlocks(
 		// Scope to installed packages: each block_schema's componentPath must
 		// start with a package present in the service's node_modules.
 		const pkgPrefix = componentPath.split("/").slice(0, 2).join("/");
-		if (!isInstalled(pkgPrefix)) {
+		if (!(await isInstalled(pkgPrefix))) {
 			skipped.push(`${row.slug} (${pkgPrefix} not installed)`);
 			return;
 		}
@@ -176,12 +178,16 @@ export async function discoverBlocks(
 	// missing componentPath are kept so `loadBlock` still flags them (real data
 	// signal); `skipped` thus catches only genuine failures (installed package
 	// but import/config/export failed) and the call-site WARN becomes signal.
-	const candidateRows = rows.filter((row) => {
+	const candidateRows = [];
+	for (const row of rows) {
 		const cp = getStringProperty(parseConfig(row.config), "componentPath");
-		if (!cp) return true;
+		if (!cp) {
+			candidateRows.push(row);
+			continue;
+		}
 		const pkg = cp.split("/").slice(0, 2).join("/");
-		return isInstalled(pkg);
-	});
+		if (await isInstalled(pkg)) candidateRows.push(row);
+	}
 	// All blocks concurrent (module imports are in-process I/O + V8 compile — no
 	// fork tax, so bounded concurrency isn't needed here; the chunk-of-8 was
 	// needlessly serializing 44 imports into 6 waves when 1 wave suffices).

package/src/fn-routers/index.ts

@@ -13,10 +13,24 @@
  * RegionPageSwap can fetch a region's Puck page on demand and render it into a
  * slot — the no-reload half of `region-views-are-pages` (every region is a Puck
  * page; switching a view loads a different page's content).
+ *
+ * `resolvePanelData` WAS RESTORED 2026-08-31. `72ac1a7` ("Retire unoffered page
+ * ORPC procedures") deleted it three weeks earlier as unoffered, but its
+ * consumer is live and in ANOTHER REPO: `use-region-page.ts` in
+ * @teamscala/ui-foundation calls `regions.resolvePanelData` on every panel
+ * open. Only the comment describing it was left behind — the shape
+ * `a-deleted-producer-leaves-its-consumers-executing` names, where deleting a
+ * producer leaves its consumers demanding something that can no longer exist.
+ *
+ * It failed SILENTLY for three weeks because the client treats a failure as
+ * best-effort and maps it to null, so the 404 rendered an empty panel with no
+ * error anywhere. Observed live as `POST /api/rpc/regions/resolvePanelData 404`
+ * on every panel open on projects-dev.
  */
 
 import { registerCustomRouter } from "@teamscala/orpc/app-router";
 import { puckPagesRouter } from "../page-server-orpc/puck-pages-router";
+import { resolvePanelDataHandler } from "./panel-data-router.ts";
 import { watchDataChange } from "@teamscala/realtime-utils/data-change-procedure";
 import { watchPresence } from "@teamscala/realtime-utils/presence-procedure";
 import { agreementSendRouter } from "./agreement-send-router.ts";
@@ -51,6 +65,8 @@ export function registerFnRouters(): void {
 		loadPage: puckPagesRouter.loadFromWebsite,
 		// Resolve a page-kind panel's OWN loaderData (panel_view.loader_slug) so a
 		// panel region renders against the panel page's data, not the host's.
+		//
+		resolvePanelData: resolvePanelDataHandler,
 	});
 	registerCustomRouter("realtime", {
 		watchDataChange,

package/src/fn-routers/panel-data-router.ts

@@ -0,0 +1,104 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * `regions.resolvePanelData` — resolves a page-kind panel's OWN loaderData so a
+ * panel region renders blocks against the panel page's data, not the host
+ * page's. RegionPageSwap calls this on panel-open + injects the result via
+ * LiveDataProvider("page-data"), making panel-embedded data blocks (e.g. the
+ * workload Chart) self-sufficient: each panel carries its own data, no host
+ * coupling + no preloading the host route.
+ *
+ * Flow (registry reads via the loadRegistryConfig helper — registry-via-helper):
+ * panel_view.content.loader_slug → resource_loader config → orgId derived from
+ * the serving website (builda_websites.organisation_id) → resolveFromLoaderConfig
+ * → the loader's resolved sources. Panels without a loader_slug (e.g. the AI
+ * panel, whose block self-loads) return null — no extra round-trip, no behavior
+ * change.
+ */
+import { os } from "@orpc/server";
+import * as v from "valibot";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import type { PanelViewKey } from "@teamscala/db/registry/generated/panel-view";
+import type { ResourceLoaderKey } from "@teamscala/db/registry/generated/resource-loader";
+import { resolveFromLoaderConfig } from "../resolve-from-loader-config.ts";
+
+interface Context {
+	prisma: {
+		builda_websites: {
+			findFirst: (args: unknown) => Promise<{
+				organisation_id?: string | null;
+			} | null>;
+		};
+	};
+}
+
+const panelViewSchema = v.looseObject({
+	content: v.looseObject({ loader_slug: v.optional(v.string()) }),
+});
+
+export const resolvePanelDataHandler = os
+	.$context<Context>()
+	.input(
+		v.object({
+			panelSlug: v.string(),
+			websiteSlug: v.string(),
+			/** Tenant orgId (preferred over the website's organisation_id, which is
+			 * the platform org on a multi-tenant portal — not the tenant). The
+			 * caller (RegionPageSwap) threads this from __PAGE_DATA__.orgId. */
+			orgId: v.optional(v.string()),
+		}),
+	)
+	.handler(async ({ input, context }) => {
+		// panel_view → loader_slug (null when missing or the panel has no loader).
+		let loaderSlug: string | undefined;
+		try {
+			// THE SLUG IS RUNTIME-SUPPLIED, so it cannot be statically a
+			// PanelViewKey: it arrives from the browser as the opened panel's
+			// name. The lookup itself is the validation — loadRegistryConfig
+			// throws when no such row exists, and the catch below turns that into
+			// the documented null. Narrowing here states that contract rather
+			// than asserting the value is known good.
+			const pv = await loadRegistryConfig(
+				"panel_view",
+				input.panelSlug as PanelViewKey,
+				panelViewSchema,
+			);
+			loaderSlug = pv.content?.loader_slug;
+		} catch {
+			return null;
+		}
+		if (!loaderSlug) return null;
+		// resource_loader → its config (loose schema; resolveFromLoaderConfig owns
+		// the typed LoaderConfig contract).
+		let loader: unknown;
+		try {
+			loader = await loadRegistryConfig(
+				"resource_loader",
+				// Same contract: loader_slug is read from the panel row's loose
+				// content schema as a plain string, and a missing row throws into
+				// the catch below.
+				loaderSlug as ResourceLoaderKey,
+				v.unknown(),
+			);
+		} catch {
+			return null;
+		}
+		// Tenant orgId: prefer the caller-provided value (the route's tenant org,
+		// threaded from __PAGE_DATA__.orgId); fall back to the website's
+		// organisation_id (the platform org — wrong for multi-tenant portals, but
+		// the only derivable value when the caller omits it).
+		let orgId = input.orgId;
+		if (!orgId) {
+			const site = await context.prisma.builda_websites.findFirst({
+				where: { OR: [{ slug: input.websiteSlug }, { id: input.websiteSlug }] },
+				select: { organisation_id: true },
+			});
+			orgId = site?.organisation_id ?? undefined;
+		}
+		return await resolveFromLoaderConfig(
+			loader as Parameters<typeof resolveFromLoaderConfig>[0],
+			{ orgId },
+		);
+	});

package/src/register-static-assets.ts

@@ -14,13 +14,18 @@ import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Hono } from "hono";
 import { etag } from "hono/etag";
+import { FALLBACK_PRIMARY_COLOR } from "@teamscala/os/brand/fallback-primary-color";
 import { buildErrorReport } from "@teamscala/os/errors/error-report";
 import { collectHeapReport } from "@teamscala/os/observability/heap-report";
 import { isLoopbackHost } from "@teamscala/os/observability/loopback-host";
 import { handleAssetProxy } from "./asset-proxy";
 import { resolveBrandFaviconPath, warmBrandFaviconCache } from "./resolve-brand-favicon";
 
-const FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="6" fill="#6366f1"/><text x="16" y="23" text-anchor="middle" font-size="20" font-family="system-ui" fill="white">S</text></svg>`;
+// Served ONLY when the org has no brand favicon, so the correct colour is the
+// platform brand default rather than a literal. This changes the generic
+// fallback mark from indigo to the canonical slate; any org with its own
+// favicon is unaffected (resolveBrandFaviconPath wins before this is reached).
+const FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="6" fill="${FALLBACK_PRIMARY_COLOR}"/><text x="16" y="23" text-anchor="middle" font-size="20" font-family="system-ui" fill="white">S</text></svg>`;
 
 export async function registerStaticAssets(
 	app: Hono,