@teamscala/service-boot 0.23.449 → 0.23.451

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.449",
+  "version": "0.23.451",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -27,6 +27,7 @@
     "@teamscala/document-signing": "*",
     "@teamscala/email": "*",
     "@teamscala/email-client": "*",
+    "@teamscala/email-template": "*",
     "@teamscala/encryption": "*",
     "@teamscala/event-log": "*",
     "@teamscala/file-lock": "*",
@@ -42,6 +43,7 @@
     "@teamscala/orpc": "*",
     "@teamscala/os": "*",
     "@teamscala/publish-registry": "*",
+    "@teamscala/puck-boundary": "*",
     "@teamscala/realtime-utils": "*",
     "@teamscala/resolver-engine": "*",
     "@teamscala/safe-fallback": "*",
@@ -1207,6 +1209,14 @@
       "types": "./src/resolve-theme-mode.d.ts",
       "default": "./src/resolve-theme-mode.ts"
     },
+    "./resolvers/app-header": {
+      "types": "./src/resolvers/app-header.d.ts",
+      "default": "./src/resolvers/app-header.ts"
+    },
+    "./resolvers/app-header.ts": {
+      "types": "./src/resolvers/app-header.d.ts",
+      "default": "./src/resolvers/app-header.ts"
+    },
     "./resolvers/fetch-org-brand": {
       "types": "./src/resolvers/fetch-org-brand.d.ts",
       "default": "./src/resolvers/fetch-org-brand.ts"
@@ -1287,6 +1297,14 @@
       "types": "./src/server-error-page.d.ts",
       "default": "./src/server-error-page.ts"
     },
+    "./theme-fonts-link": {
+      "types": "./src/theme-fonts-link.d.ts",
+      "default": "./src/theme-fonts-link.ts"
+    },
+    "./theme-fonts-link.ts": {
+      "types": "./src/theme-fonts-link.d.ts",
+      "default": "./src/theme-fonts-link.ts"
+    },
     "./two-phase-full-app": {
       "types": "./src/two-phase-full-app.d.ts",
       "default": "./src/two-phase-full-app.ts"

package/src/auth-gate.ts

@@ -70,7 +70,7 @@
 		// service-to-service auth still flows through the cookie/secret on the
 		// request, never the source IP.
 
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import { getPrisma } from "@teamscala/db/prisma-registry";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { resolveAccess } from "@teamscala/auth/resolve-access";

package/src/fn-routers/agreement-completion-email.ts

@@ -18,7 +18,7 @@ import type { PrismaClient } from "@teamscala/db/client";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
 import { sendResendEmail } from "./resend-client.ts";
-import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
+import { applyTemplateVars, lookupTemplate } from "@teamscala/email-template/lookup";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { signAgreementAccessToken } from "@teamscala/document-signing/agreement-access-token";
 import { parseAgreementParties } from "@teamscala/document-signing/agreement-parties";

package/src/fn-routers/agreement-send-router.ts

@@ -30,7 +30,7 @@ import {
 	type SecretConfigLike,
 } from "@teamscala/encryption/crypto/secret-config";
 import { sendResendEmail } from "./resend-client.ts";
-import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
+import { applyTemplateVars, lookupTemplate } from "@teamscala/email-template/lookup";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import type { PrismaClient } from "@teamscala/db/client";
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/fn-routers/assessment-report-email.ts

@@ -15,7 +15,7 @@
 import * as v from "valibot";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { sendResendEmail } from "./resend-client.ts";
-import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
+import { applyTemplateVars, lookupTemplate } from "@teamscala/email-template/lookup";
 import { resolveEmailSender } from "@teamscala/email/identity/resolve-email-sender";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";

package/src/fn-routers/proposal-send-router.ts

@@ -13,7 +13,7 @@ import { os } from "@orpc/server";
 import * as v from "valibot";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
 import { sendResendEmail } from "./resend-client.ts";
-import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
+import { applyTemplateVars, lookupTemplate } from "@teamscala/email-template/lookup";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { signAccessToken } from "../content-gate/token.ts";

package/src/fn-routers/public-assessment-router.test.ts

@@ -13,7 +13,7 @@
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
-import { applyTemplateVars } from "@teamscala/email/templates/lookup";
+import { applyTemplateVars } from "@teamscala/email-template/lookup";
 
 interface CapturedEmail {
 	to: string;
@@ -58,7 +58,7 @@ mock.module("@teamscala/api-resend", () => ({
 // The row owns copy + layout; the test mirrors the authority-index-report
 // row's merge tokens so the substitution surface exercised is the real one.
 // applyTemplateVars stays the REAL implementation — only lookup is stubbed.
-mock.module("@teamscala/email/templates/lookup", () => ({
+mock.module("@teamscala/email-template/lookup", () => ({
 	lookupTemplate: async () => ({
 		// Mirrors the live authority-index-report row, which leads with {{orgName}}
 		// — a stub without it cannot catch a wrong org name in the subject.

package/src/handlers/upstream-issue-sync.ts

@@ -25,6 +25,7 @@
  */
 import { getAllEntries } from "@teamscala/db/registry/accessors";
 import { persistRegistryEntryConfig } from "@teamscala/db/registry/persist-entry-config";
+import { validateRow } from "@teamscala/db-validation/validate-row";
 import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -181,7 +182,7 @@ async function upstreamIssueSync(_ctx: { config: ScheduledJobConfig }): Promise<
 		};
 
 		try {
-			await persistRegistryEntryConfig("upstream_issue", row.slug, nextConfig);
+			await persistRegistryEntryConfig("upstream_issue", row.slug, nextConfig, validateRow);
 		} catch (err) {
 			log.warn(
 				`[upstream-issue-sync] row ${row.slug} write failed (validation or db): ${err instanceof Error ? err.message : String(err)}`,

package/src/mount-server-packages.ts

@@ -24,7 +24,7 @@
  * only warms the cache, never gates boot.
  */
 
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";
 import {

package/src/register-api-routes.ts

@@ -13,7 +13,7 @@
  * walking when explicit caller headers are absent.
  */
 
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";
 import type { MountRegistry } from "@teamscala/os/runtime-contracts/mount-context";

package/src/register-registry-page-route/live-loader-config.test.ts

@@ -0,0 +1,219 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit extend the regression set for the live loader-config contract
+ *
+ * Behavioural tests for the per-request resource_loader read (the fix for the
+ * boot-baked-loader defect): resource_loader is NOT on the deploy-time bake
+ * list, so a registry row edit must reach the running service WITHOUT a
+ * restart. The registration loop's boot read is warm/validate only.
+ *
+ *  1. Two requests to the same route with the row edited between them — the
+ *     SECOND request's graph resolution receives the NEW source set, and the
+ *     live read ran once per request (not once per boot).
+ *  2. A row that vanishes (or stops validating) between requests — the second
+ *     request FAILS CLOSED (the read throws into the branded error path;
+ *     the boot snapshot never silently outlives its row).
+ *  3. The graphKey fingerprint changes when the config changes — a row edit
+ *     invalidates the per-route SWR graph cache immediately instead of
+ *     serving the old graph until the fresh window lapses.
+ *
+ * Only the registry reader and the heavy graph collaborators are mocked; the
+ * real registrar, real Hono app, real loadData pipeline and the real
+ * live-loader-config unit are under test.
+ */
+
+import { GlobalRegistrator } from "@happy-dom/global-registrator";
+import { afterEach, describe, expect, mock, test } from "bun:test";
+
+if (!globalThis.document) GlobalRegistrator.register();
+
+// ── The mutable registry ────────────────────────────────────────────────
+const calls: { slug: string; type: string }[] = [];
+const store: {
+	routeRows: { slug: string; config: Record<string, unknown> }[];
+	loaderConfig: Record<string, unknown> | null;
+} = {
+	routeRows: [],
+	loaderConfig: null,
+};
+
+mock.module("@teamscala/db/registry/load-config", () => {
+	class RegistryConfigMissingError extends Error {}
+	return {
+		RegistryConfigMissingError,
+		loadRegistryConfig: async (
+			type: string,
+			slug: string,
+			_schema: unknown,
+		) => {
+			calls.push({ type, slug });
+			if (type === "resource_loader") {
+				if (!store.loaderConfig) throw new RegistryConfigMissingError(slug);
+				return store.loaderConfig;
+			}
+			// feature_flag rows absent — the registrar's legacy catch.
+			throw new RegistryConfigMissingError(slug);
+		},
+		loadRegistryConfigsByType: async () => store.routeRows,
+	};
+});
+
+// ── The heavy collaborators (recorded, not executed) ───────────────────
+const graphCalls: { loaderConfig: Record<string, unknown>; configFingerprint?: string }[] = [];
+
+mock.module("./resolve-request-graph.ts", () => ({
+	resolveRequestGraph: async (args: {
+		loaderConfig: Record<string, unknown>;
+		configFingerprint?: string;
+	}) => {
+		graphCalls.push({
+			loaderConfig: args.loaderConfig,
+			configFingerprint: args.configFingerprint,
+		});
+		return {};
+	},
+}));
+mock.module("./stamp-session-context.ts", () => ({
+	stampSessionContext: async () => ({ sessionUserId: null, sessionOrgId: null }),
+}));
+mock.module("./run-content-gates.ts", () => ({
+	runContentGatesForPage: async () => {},
+}));
+mock.module("./apply-page-branding.ts", () => ({
+	applyBrandOrgPath: async () => {},
+	applySessionOrgBranding: async () => {},
+	applySignInBrandOverride: async () => {},
+}));
+mock.module("./resolve-panel-page.ts", () => ({
+	attachPanelPage: async () => {},
+}));
+mock.module("./warn-uncovered-blocks.ts", () => ({
+	warnUncoveredBlocks: () => {},
+}));
+mock.module("./resolve-page-data.ts", () => ({
+	resolvedToPageData: () => ({ puckData: { content: [] } }),
+}));
+mock.module("./ai-chat-prefetch.ts", () => ({
+	prefetchAiChatSession: async () => {},
+}));
+mock.module("./proposal-approval-email-token.ts", () => ({
+	applyApprovalEmailToken: async () => {},
+}));
+// bindPageHandler → run the captured loadData directly so the test drives
+// the per-request path end to end.
+mock.module("../bind-page-handler.ts", () => ({
+	bindPageHandler: async (
+		c: { req: { raw: Request }; json: (body: unknown) => Response },
+		handler: { loadData: (req: Request) => Promise<unknown> },
+		_request: Request,
+	) => c.json(await handler.loadData(c.req.raw)),
+}));
+mock.module("@teamscala/logger/app-loggers", () => ({
+	getAppLogger: () => ({ info: () => {}, warn: () => {} }),
+}));
+
+const { registerRegistryPageRoute } = await import(
+	"../register-registry-page-route.ts"
+);
+const { fingerprintLoaderConfig } = await import("./live-loader-config.ts");
+const { Hono } = await import("hono");
+
+afterEach(() => {
+	calls.length = 0;
+	graphCalls.length = 0;
+	store.routeRows = [];
+	store.loaderConfig = null;
+});
+
+async function registerRoute(): Promise<InstanceType<typeof Hono>> {
+	const app = new Hono();
+	await registerRegistryPageRoute({
+		app: app as never,
+		serviceSlug: "test-svc",
+		components: {},
+		createPageHandler: (args: { loadData: unknown }) =>
+			({ loadData: args.loadData }) as never,
+		authMode: "none",
+		renderMode: "public" as never,
+		providers: [],
+		portalScoped: false,
+	} as never);
+	return app;
+}
+
+function seedRouteRow() {
+	store.routeRows = [
+		{
+			slug: "test-route",
+			config: {
+				pattern: "/:id",
+				service: "test-svc",
+				loader_slug: "test-loader",
+				render_mode: "public",
+			},
+		},
+	];
+}
+
+const requestRoute = (app: InstanceType<typeof Hono>) =>
+	app.request("/abc", { headers: { host: "test.local" } });
+
+describe("live loader config — per-request read (boot-baked-loader fix)", () => {
+	test("a row edit between two requests reaches the second request without a restart", async () => {
+		seedRouteRow();
+		store.loaderConfig = { sources: [{ key: "page" }] };
+		const app = await registerRoute();
+
+		await requestRoute(app);
+		expect(graphCalls[0]?.loaderConfig).toEqual({
+			sources: [{ key: "page" }],
+		});
+
+		// THE EDIT — no restart, no redeploy.
+		store.loaderConfig = {
+			sources: [{ key: "page" }, { key: "agreement" }],
+		};
+
+		await requestRoute(app);
+		const loaderReads = calls.filter(
+			(c) => c.type === "resource_loader" && c.slug === "test-loader",
+		);
+		// Boot warm/validate counts once; per-request reads add one per request.
+		// The fix's contract is that the count GROWS past the boot read — a
+		// single boot-time capture would read once total, never three.
+		expect(loaderReads.length).toBeGreaterThanOrEqual(3);
+		// The second request's graph resolution received the new source set.
+		const second = graphCalls.at(-1)?.loaderConfig as {
+			sources: { key: string }[];
+		};
+		expect(
+			second.sources.some((s) => s.key === "agreement"),
+		).toBe(true);
+	});
+
+	test("a row that vanishes between requests fails closed", async () => {
+		seedRouteRow();
+		store.loaderConfig = { sources: [{ key: "page" }] };
+		const app = await registerRoute();
+		await requestRoute(app);
+
+		store.loaderConfig = null;
+
+		// Fail closed = the request ERORS (Hono maps the thrown read to a 500),
+		// never a 200 served from the boot-time snapshot of a dead row.
+		const res = await requestRoute(app);
+		expect(res.status).toBe(500);
+	});
+
+	test("the graphKey fingerprint changes with the config and is key-order stable", () => {
+		const a = fingerprintLoaderConfig({ sources: [{ key: "page" }] });
+		const b = fingerprintLoaderConfig({
+			sources: [{ key: "page" }, { key: "agreement" }],
+		});
+		expect(a).not.toBe(b);
+		expect(fingerprintLoaderConfig({ a: 1, b: 2 })).toBe(
+			fingerprintLoaderConfig({ b: 2, a: 1 }),
+		);
+	});
+});

package/src/register-registry-page-route/live-loader-config.ts

@@ -0,0 +1,58 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * live-loader-config.ts — the per-request resource_loader read.
+ *
+ * The constitution's deploy-time bake list (installer-and-runtime) names
+ * service_install, service_manifest, block_schema, page_route, api_route and
+ * scheduled_job — resource_loader is NOT among it, so a loader row is runtime
+ * data: a registry edit must reach the running service on a subsequent request
+ * without a restart. This module is that contract: `readLiveLoaderConfig`
+ * re-reads the row through `loadRegistryConfig` on EVERY request (its SWR
+ * cache makes the fresh-window hit a memory read, not a DB round trip) and
+ * FAILS CLOSED — a row that vanished or stopped validating mid-flight throws
+ * into the branded error path rather than silently serving the boot-time
+ * snapshot of a row that no longer exists.
+ *
+ * `fingerprintLoaderConfig` gives the per-request graph cache a key component
+ * derived from the LIVE config, so a row edit invalidates cached graphs for
+ * that route immediately (the graph cache keys on route+host+path alone would
+ * otherwise serve a stale graph until its SWR window lapsed — right cache,
+ * wrong key: the graph is a function of the config, so the config belongs in
+ * the key).
+ */
+
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { ResourceLoaderConfigSchema } from "@teamscala/db-validation/registry-schemas/resource-loader";
+import type { ResourceLoaderKey } from "@teamscala/db/registry/generated/resource-loader";
+import * as v from "valibot";
+
+export type LoaderConfig = v.InferOutput<typeof ResourceLoaderConfigSchema>;
+
+export async function readLiveLoaderConfig(
+	loaderSlug: ResourceLoaderKey,
+): Promise<LoaderConfig> {
+	return loadRegistryConfig(
+		"resource_loader",
+		loaderSlug,
+		ResourceLoaderConfigSchema,
+	);
+}
+
+/** djb2 over the config's stable JSON — short, deterministic, SSR-safe. */
+export function fingerprintLoaderConfig(config: unknown): string {
+	const json = JSON.stringify(config, sortedTopLevelKeys(config));
+	let hash = 5381;
+	for (let i = 0; i < json.length; i++) {
+		hash = ((hash << 5) + hash + json.charCodeAt(i)) | 0;
+	}
+	return (hash >>> 0).toString(36);
+}
+
+function sortedTopLevelKeys(config: unknown): string[] {
+	return config != null && typeof config === "object"
+		? Object.keys(config).sort()
+		: [];
+}

package/src/register-registry-page-route/resolve-request-graph.ts

@@ -34,12 +34,17 @@ export interface ResolveRequestGraphArgs {
 	params: Record<string, string>;
 	isStaticShell: boolean;
 	serviceSlug: string;
+	/** Stable fingerprint of the LIVE loader config (fingerprintLoaderConfig).
+	 *  Appended to the graphKey so a registry row edit invalidates cached
+	 *  graphs for the route on the very next request — the graph is a
+	 *  function of the config, so the config belongs in the cache key. */
+	configFingerprint?: string;
 }
 
 export async function resolveRequestGraph(
 	args: ResolveRequestGraphArgs,
 ): Promise<Record<string, unknown>> {
-	const { pattern, routeSlug, routeConfig, loaderConfig, params, isStaticShell, serviceSlug } = args;
+	const { pattern, routeSlug, routeConfig, loaderConfig, params, isStaticShell, serviceSlug, configFingerprint } = args;
 	const log = getAppLogger();
 
 	// A bare root ("/") that declares a resource_type is a UUID-driven
@@ -57,7 +62,7 @@ export async function resolveRequestGraph(
 		// the default 404 (genuinely not found).
 		throw new PrimaryResourceMissingError(routeConfig.resource_type, 200);
 	}
-	const graphKey = `graph:${routeSlug}:${params.host}:${params.path}`;
+	const graphKey = `graph:${routeSlug}:${params.host}:${params.path}${configFingerprint ? `:${configFingerprint}` : ""}`;
 	const primaryType = routeConfig.resource_type;
 	const hasPrimarySource =
 		!!primaryType &&

package/src/register-registry-page-route.ts

@@ -57,6 +57,10 @@ import {
 	applyClientLogo,
 } from "./register-registry-page-route/proposal-brand-stamping.ts";
 import type { CreatePageHandler, RendererComponentEntry } from "./types.ts";
+import {
+	fingerprintLoaderConfig,
+	readLiveLoaderConfig,
+} from "./register-registry-page-route/live-loader-config.ts";
 
 export interface PageRouteConfig {
 	pattern: string;
@@ -163,6 +167,12 @@ export async function registerRegistryPageRoute(
 			ReturnType<typeof loadRegistryConfig<typeof ResourceLoaderConfigSchema>>
 		> | null = null;
 		try {
+			// Boot-time warm + validate: a missing row skips the route (warn),
+			// an invalid row fails closed. resource_loader is NOT on the
+			// deploy-time bake list (constitution installer-and-runtime) — it
+			// is re-read per request via readLiveLoaderConfig below — so this
+			// boot read exists ONLY to catch a misconfigured row early, never
+			// as the source of truth for live rendering.
 			loaderConfig = await loadRegistryConfig(
 				"resource_loader",
 				loaderSlug,
@@ -188,6 +198,16 @@ export async function registerRegistryPageRoute(
 			!pattern.includes("*");
 
 		const loadData = async (request: Request) => {
+			// resource_loader is runtime data, not deploy-time baked. Re-read it
+			// per request — loadRegistryConfig's SWR cache makes the fresh-window
+			// hit a memory read, not a DB round trip. Throws into the branded
+			// error path on a vanished or invalid row: the boot-time snapshot
+			// must NEVER silently outlive the row it captured. This is the fix
+			// for the loader-row-edits-look-like-they-don't-work defect (every
+			// edit used to need a service restart; the sign-page-with-brand
+			// `agreement` source added at 22:16 still hadn't reached
+			// __PAGE_DATA__.loaderData at 22:29 — 13 minutes, and never).
+			const liveLoaderConfig = await readLiveLoaderConfig(loaderSlug);
 			const url = new URL(request.url);
 			const params = extractUrlParams(pattern, url.pathname);
 			params.host = request.headers.get("host")?.split(":")[0] || url.hostname;
@@ -196,10 +216,15 @@ export async function registerRegistryPageRoute(
 				pattern,
 				routeSlug: routeRow.slug,
 				routeConfig,
-				loaderConfig: loaderConfig as never,
+				loaderConfig: liveLoaderConfig as never,
 				params,
 				isStaticShell,
 				serviceSlug,
+				// Folds the live config into the per-route graphKey so a row edit
+				// invalidates the cached graph immediately (the graph is a
+				// function of the config; without this the SWR graph cache
+				// would still hold the old shape until its fresh window lapsed).
+				configFingerprint: fingerprintLoaderConfig(liveLoaderConfig),
 			});
 			const { sessionUserId, sessionOrgId } = await stampSessionContext(
 				resolved,
@@ -207,7 +232,7 @@ export async function registerRegistryPageRoute(
 			);
 			const gateCookie = request.headers.get("cookie");
 			const regionSlots = (
-				loaderConfig as { region_slots?: string[] }
+				liveLoaderConfig as { region_slots?: string[] }
 			).region_slots;
 			await runContentGatesForPage(
 				resolved,
@@ -375,12 +400,12 @@ export async function registerRegistryPageRoute(
 		});
 
 		registeredPatterns.push(pattern);
-		// The loader config was captured at boot into the loadData closure — name
-		// the captured shape + the restart contract so a row edit that "doesn't
-		// work" on a running service is answered by this line, not an evening of
-		// bisecting (measured 2026-08-18).
+		// Boot-validated snapshot (the LIVE read is per request — see
+		// readLiveLoaderConfig); name the shape so a misconfigured row is
+		// visible at boot, and note the live contract so "my loader edit
+		// didn't take effect" routes to the graph SWR window, not a restart.
 		log.info(
-			`[scala-install:${serviceSlug}] registered registry page route "${pattern}" → resource_loader "${loaderSlug}" (${describeCapturedLoaderConfig(loaderConfig)})`,
+			`[scala-install:${serviceSlug}] registered registry page route "${pattern}" → resource_loader "${loaderSlug}" (boot-validated: ${describeCapturedLoaderConfig(loaderConfig)}; re-read live per request)`,
 		);
 	}
 

package/src/register-ws-routes.ts

@@ -25,7 +25,7 @@
 
 import { getAppRouter } from "@teamscala/orpc/app-router";
 import { mountOrpcWs } from "@teamscala/orpc/ws/server";
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";

package/src/resolve-service-context.ts

@@ -13,8 +13,8 @@ import type { PrismaClient } from "@teamscala/db/client";
 import { loadServicePrismaClient } from "@teamscala/db/load-service-prisma-client";
 import { registerPrismaClient } from "@teamscala/db/prisma-registry";
 import { loadRegistryEntries } from "@teamscala/db/registry/loader/load-entries";
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
-import { loadServiceInstallRow } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
+import { loadServiceInstallRow } from "./load-service-install-row";
 
 export interface ServiceContext {
 	kind: "ui" | "backend" | "runtime";

package/src/resolvers/app-header.test.ts

@@ -0,0 +1,65 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ */
+import { describe, expect, test } from "bun:test";
+import { resolveAppHeader } from "./app-header.ts";
+
+const ARGS = { client: null, params: {} } as const;
+
+describe("resolveAppHeader", () => {
+	test("passes interpolated values through as strings", () => {
+		const out = resolveAppHeader({
+			...ARGS,
+			input: {
+				title: "Anna's Proposal",
+				row1Label: "Prepared for",
+				row1Value: "Joe Bellissimo",
+				row2Label: "Organisation",
+				row2Value: "GMG APAC",
+				row3Label: "Date",
+				row3Value: "2026-09-03T00:00:00.000Z",
+			},
+		});
+		expect(out.title).toBe("Anna's Proposal");
+		expect(out.row1Label).toBe("Prepared for");
+		expect(out.row1Value).toBe("Joe Bellissimo");
+		expect(out.row3Value).toBe("2026-09-03T00:00:00.000Z");
+	});
+
+	test("coerces Prisma Date values to ISO strings", () => {
+		const out = resolveAppHeader({
+			...ARGS,
+			input: {
+				title: "Report",
+				row3Value: new Date("2026-08-25T15:46:58.698Z"),
+			},
+		});
+		expect(out.row3Value).toBe("2026-08-25T15:46:58.698Z");
+	});
+
+	test("expands the today directive to a noon-UTC instant of the AEST date", () => {
+		const out = resolveAppHeader({ ...ARGS, input: { row3Value: "today" } });
+		const value = out.row3Value as string;
+		// Noon UTC keeps the calendar date stable in every timezone.
+		expect(value.endsWith("T12:00:00.000Z")).toBe(true);
+		const [isoDate] = value.split("T");
+		const aestDate = new Intl.DateTimeFormat("en-CA", {
+			timeZone: "Australia/Sydney",
+			year: "numeric",
+			month: "2-digit",
+			day: "2-digit",
+		}).format(new Date());
+		expect(isoDate).toBe(aestDate);
+	});
+
+	test("maps absent fields to null (the resource-not-blank contract: null, never a stale value)", () => {
+		const out = resolveAppHeader({ ...ARGS, input: { title: "Only a title" } });
+		expect(out.title).toBe("Only a title");
+		expect(out.row1Label).toBeNull();
+		expect(out.row1Value).toBeNull();
+		expect(out.row2Value).toBeNull();
+		expect(out.row3Value).toBeNull();
+	});
+});

package/src/resolvers/app-header.ts

@@ -0,0 +1,77 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * app-header.ts — shared application header resolver_fn.
+ *
+ * Shapes an app's per-row resolver_input into the canonical header-data object
+ * the ONE shared header Puck page (`/shared-app-header`) binds through the
+ * unified page-data surface (`dataSource:"page-data"` + `fieldPath:"headerData.<key>"`).
+ * The loader row owns the mapping (title field path, label/value pairs — the
+ * per-app variation); this executor owns the shape and the two coercions the
+ * rows cannot express:
+ *
+ * - `Date` values (Prisma returns Date objects) → ISO strings, so
+ *   __PAGE_DATA__ serialises them the same way the client reads them
+ *   (server-serializes-client-reads-verbatim).
+ * - the literal `"today"` → a noon-UTC ISO instant of the AEST calendar date.
+ *   Noon keeps the calendar date stable under every timezone offset, so the
+ *   header shows the same day on the server and on any visitor's client —
+ *   the deterministic replacement for the old `format:"today"` clock block.
+ */
+
+/** AEST calendar date (the operator timezone) as `YYYY-MM-DD`. */
+function aestCalendarDate(now: Date): string {
+	return new Intl.DateTimeFormat("en-CA", {
+		timeZone: "Australia/Sydney",
+		year: "numeric",
+		month: "2-digit",
+		day: "2-digit",
+	}).format(now);
+}
+
+function coerceValue(value: unknown): string | null {
+	if (value == null) return null;
+	if (value instanceof Date) return value.toISOString();
+	if (value === "today") return `${aestCalendarDate(new Date())}T12:00:00.000Z`;
+	return String(value);
+}
+
+export interface AppHeaderInput {
+	title?: unknown;
+	row1Label?: unknown;
+	row1Value?: unknown;
+	row2Label?: unknown;
+	row2Value?: unknown;
+	row3Label?: unknown;
+	row3Value?: unknown;
+}
+
+export interface AppHeaderData {
+	title: string | null;
+	row1Label: string | null;
+	row1Value: string | null;
+	row2Label: string | null;
+	row2Value: string | null;
+	row3Label: string | null;
+	row3Value: string | null;
+}
+
+export function resolveAppHeader({
+	input,
+}: {
+	input: AppHeaderInput;
+	client: unknown;
+	params: Record<string, unknown>;
+}): AppHeaderData {
+	return {
+		title: coerceValue(input.title),
+		row1Label: coerceValue(input.row1Label),
+		row1Value: coerceValue(input.row1Value),
+		row2Label: coerceValue(input.row2Label),
+		row2Value: coerceValue(input.row2Value),
+		row3Label: coerceValue(input.row3Label),
+		row3Value: coerceValue(input.row3Value),
+	};
+}

package/src/run-boot-hook-list.ts

@@ -15,7 +15,7 @@
  * relay never started (2026-06-29).
  */
 
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";
 import type { BootHookHandler, MountRegistry } from "@teamscala/os/runtime-contracts/mount-context";

package/src/run-boot-hooks.ts

@@ -21,7 +21,7 @@
  * top-level boot-error handler.
  */
 
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";
 
 export interface BootHookContext {

package/src/types.ts

@@ -49,4 +49,4 @@ export interface PageHandlerConfig {
 	portalHomeRedirect?: boolean;
 }
 
-export type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+export type { ServiceInstallConfig } from "./load-service-install-row";

package/src/ws-boot-self-test.ts

@@ -16,7 +16,7 @@
  * reports healthy.
  */
 
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";