@teamscala/service-boot 0.23.434 → 0.23.436

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.434",
+  "version": "0.23.436",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/build-client-assets/input-hashing.ts

@@ -21,8 +21,6 @@
  * changes (`migrations-copy-not-rewrite`).
  */
 
-import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { firstPartyScopeAlternation } from "@teamscala/os/workspace-topology/first-party-scopes";
 
@@ -32,7 +30,7 @@ import { firstPartyScopeAlternation } from "@teamscala/os/workspace-topology/fir
 // blk-utilities changes undetected → stale bundle). Cycle-safe via `seen`.
 export async function hashResolvedPackageStylesheets(
 	cwd: string,
-	h: ReturnType<typeof createHash>,
+	h: Bun.CryptoHasher,
 ): Promise<void> {
 	let appCss: string;
 	try {
@@ -120,12 +118,15 @@ async function readInstalledPkgVersion(
 
 export async function hashTeamgbgJsGraph(
 	cwd: string,
-	h: ReturnType<typeof createHash>,
+	h: Bun.CryptoHasher,
 ): Promise<void> {
-	const roots = [
+	const roots = [];
+	for (const p of [
 		join(cwd, "src", "entry-client.ts"),
 		join(cwd, "src", "page-manifest.ts"),
-	].filter((p) => existsSync(p));
+	]) {
+		if (await Bun.file(p).exists()) roots.push(p);
+	}
 	if (roots.length === 0) return; // backend service — no client bundle to guard
 
 	const seen = new Set<string>();
@@ -147,7 +148,7 @@ export async function hashTeamgbgJsGraph(
 				const nmIdx = file.indexOf("/node_modules/@teamscala/");
 				if (nmIdx >= 0) {
 					const rel = file.slice(nmIdx + "/node_modules/".length); // @teamscala/pkg/...
-					fileHashes.set(rel, createHash("sha256").update(text).digest("hex"));
+					fileHashes.set(rel, new Bun.CryptoHasher("sha256").update(text).digest("hex"));
 				}
 				const next: string[] = [];
 				for (const m of text.matchAll(JS_IMPORT_SPEC_RE)) {

package/src/csrf-protection.ts

@@ -32,14 +32,19 @@
 
 import { getManagedBaseDomain } from "@teamscala/auth/auth-env-resolution";
 import { isTrustedAuthOrigin } from "@teamscala/auth/is-trusted-auth-origin";
+import { createCache } from "@teamscala/cache/create-cache";
 import { csrf } from "hono/csrf";
 import type { Context, MiddlewareHandler } from "hono";
 
 const POSITIVE_TTL_MS = 5 * 60_000;
 const NEGATIVE_TTL_MS = 10_000;
 
-type CacheEntry = { trusted: boolean; expiresAt: number };
-const customDomainCache = new Map<string, CacheEntry>();
+// Positive and negative lookups expire on different clocks; the per-entry
+// ttlMs override on set() carries that, the primitive owns eviction.
+const customDomainCache = createCache<boolean>("service-boot:csrf-custom-domains", {
+	ttlMs: POSITIVE_TTL_MS,
+	maxSize: 512,
+});
 
 function isPlatformOrigin(origin: string, baseDomain: string): boolean {
 	let host: string;
@@ -61,9 +66,8 @@ async function isTrustedCustomOrigin(origin: string): Promise<boolean> {
 	}
 	if (!host) return false;
 
-	const now = Date.now();
 	const cached = customDomainCache.get(host);
-	if (cached && cached.expiresAt > now) return cached.trusted;
+	if (cached !== undefined) return cached;
 
 	const trusted = await (async () => {
 		try {
@@ -81,11 +85,7 @@ async function isTrustedCustomOrigin(origin: string): Promise<boolean> {
 		}
 	})();
 
-	customDomainCache.set(host, {
-		trusted,
-		expiresAt: now + (trusted ? POSITIVE_TTL_MS : NEGATIVE_TTL_MS),
-	});
-	if (customDomainCache.size > 512) customDomainCache.clear();
+	customDomainCache.set(host, trusted, trusted ? POSITIVE_TTL_MS : NEGATIVE_TTL_MS);
 	return trusted;
 }
 

package/src/discover-blocks.ts

@@ -21,7 +21,6 @@
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { getPrisma } from "@teamscala/db/prisma-registry";
 import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
@@ -56,17 +55,30 @@ export async function discoverBlocks(
 	// so the 2026-05-29 empty-list-scans-everything incident cannot recur either.
 	const serviceModules = join(process.cwd(), "node_modules");
 	const installedCache = new Map<string, boolean>();
-	const isInstalled = (pkg: string): boolean => {
+	const isInstalled = async (pkg: string): Promise<boolean> => {
 		const cached = installedCache.get(pkg);
 		if (cached !== undefined) return cached;
-		const ok = existsSync(join(serviceModules, ...pkg.split("/")));
+		// Probe the package's package.json, NOT its directory. Bun.file() on a
+		// DIRECTORY reports exists() === false, so the previous directory probe
+		// answered "not installed" for every package that was in fact installed
+		// — and because this predicate gates every block below, that skipped
+		// every block and booted the service with zero Puck components. Measured
+		// 2026-09-01: scala-portal, scala-public, scala-forms and scala-projects
+		// all FATAL at ui-service.page-manifest with their packages present on
+		// disk at the expected versions. A file probe is the correct shape.
+		const ok = await Bun.file(
+			join(serviceModules, ...pkg.split("/"), "package.json"),
+		).exists();
 		installedCache.set(pkg, ok);
 		return ok;
 	};
 	// `blockPackages` is retained only to surface authored-vs-installed drift to
 	// the operator; it no longer gates discovery, so it can never blank a block.
 	if (blockPackages.length > 0) {
-		const stale = blockPackages.filter((p) => !isInstalled(p));
+		const installed = await Promise.all(
+			blockPackages.map(async (p) => ({ p, ok: await isInstalled(p) })),
+		);
+		const stale = installed.filter((x) => !x.ok).map((x) => x.p);
 		if (stale.length > 0) {
 			getAppLogger().warn(
 				`[discover-blocks] block_packages lists ${stale.length} package(s) that are not installed (ignored): ${stale.join(", ")}`,
@@ -105,7 +117,7 @@ export async function discoverBlocks(
 		const rawPackage = rawComponentPath
 			? rawComponentPath.split("/").slice(0, 2).join("/")
 			: null;
-		if (!rawPackage || !isInstalled(rawPackage)) {
+		if (!rawPackage || !(await isInstalled(rawPackage))) {
 			skipped.push(
 				`${row.slug} (${rawPackage ?? "missing componentPath"} not installed)`,
 			);
@@ -131,7 +143,7 @@ export async function discoverBlocks(
 		// Scope to installed packages: each block_schema's componentPath must
 		// start with a package present in the service's node_modules.
 		const pkgPrefix = componentPath.split("/").slice(0, 2).join("/");
-		if (!isInstalled(pkgPrefix)) {
+		if (!(await isInstalled(pkgPrefix))) {
 			skipped.push(`${row.slug} (${pkgPrefix} not installed)`);
 			return;
 		}
@@ -176,12 +188,16 @@ export async function discoverBlocks(
 	// missing componentPath are kept so `loadBlock` still flags them (real data
 	// signal); `skipped` thus catches only genuine failures (installed package
 	// but import/config/export failed) and the call-site WARN becomes signal.
-	const candidateRows = rows.filter((row) => {
+	const candidateRows = [];
+	for (const row of rows) {
 		const cp = getStringProperty(parseConfig(row.config), "componentPath");
-		if (!cp) return true;
+		if (!cp) {
+			candidateRows.push(row);
+			continue;
+		}
 		const pkg = cp.split("/").slice(0, 2).join("/");
-		return isInstalled(pkg);
-	});
+		if (await isInstalled(pkg)) candidateRows.push(row);
+	}
 	// All blocks concurrent (module imports are in-process I/O + V8 compile — no
 	// fork tax, so bounded concurrency isn't needed here; the chunk-of-8 was
 	// needlessly serializing 44 imports into 6 waves when 1 wave suffices).

package/src/register-static-assets.ts

@@ -14,13 +14,18 @@ import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Hono } from "hono";
 import { etag } from "hono/etag";
+import { FALLBACK_PRIMARY_COLOR } from "@teamscala/os/brand/fallback-primary-color";
 import { buildErrorReport } from "@teamscala/os/errors/error-report";
 import { collectHeapReport } from "@teamscala/os/observability/heap-report";
 import { isLoopbackHost } from "@teamscala/os/observability/loopback-host";
 import { handleAssetProxy } from "./asset-proxy";
 import { resolveBrandFaviconPath, warmBrandFaviconCache } from "./resolve-brand-favicon";
 
-const FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="6" fill="#6366f1"/><text x="16" y="23" text-anchor="middle" font-size="20" font-family="system-ui" fill="white">S</text></svg>`;
+// Served ONLY when the org has no brand favicon, so the correct colour is the
+// platform brand default rather than a literal. This changes the generic
+// fallback mark from indigo to the canonical slate; any org with its own
+// favicon is unaffected (resolveBrandFaviconPath wins before this is reached).
+const FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="6" fill="${FALLBACK_PRIMARY_COLOR}"/><text x="16" y="23" text-anchor="middle" font-size="20" font-family="system-ui" fill="white">S</text></svg>`;
 
 export async function registerStaticAssets(
 	app: Hono,