@teamscala/service-boot 0.23.453 → 0.23.456

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.453",
+  "version": "0.23.456",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -43,7 +43,6 @@
     "@teamscala/orpc": "*",
     "@teamscala/os": "*",
     "@teamscala/publish-registry": "*",
-    "@teamscala/puck-boundary": "*",
     "@teamscala/realtime-utils": "*",
     "@teamscala/resolver-engine": "*",
     "@teamscala/safe-fallback": "*",
@@ -1033,6 +1032,14 @@
       "types": "./src/register-registry-page-route/graph-cache.d.ts",
       "default": "./src/register-registry-page-route/graph-cache.ts"
     },
+    "./register-registry-page-route/live-loader-config": {
+      "types": "./src/register-registry-page-route/live-loader-config.d.ts",
+      "default": "./src/register-registry-page-route/live-loader-config.ts"
+    },
+    "./register-registry-page-route/live-loader-config.ts": {
+      "types": "./src/register-registry-page-route/live-loader-config.d.ts",
+      "default": "./src/register-registry-page-route/live-loader-config.ts"
+    },
     "./register-registry-page-route/meta-title": {
       "types": "./src/register-registry-page-route/meta-title.d.ts",
       "default": "./src/register-registry-page-route/meta-title.ts"

package/src/agreement-gate/signing-shell.test.ts

@@ -0,0 +1,168 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavioural pins for the agreement signing-shell units. The load-bearing
+ * cases: the gate block carries the OTP switch as the STRING the renderer
+ * validates against (a boolean is stripped before the block reaches the
+ * component — the same coercion that bit the pre-placed gate), an empty
+ * registry title falls back to the DB-driven default, the signing shell
+ * ALWAYS renders (registry failure falls back to the hardcoded shell), the
+ * shell is deep-cloned per call (injection mutates the tree in place), and
+ * the pre-placed-gate probe recognises an agreement gate by its context
+ * field — a PROPOSAL gate in the same region must not read as an agreement.
+ */
+import { describe, expect, mock, test } from "bun:test";
+
+let registryBlocks: unknown = undefined;
+let registryThrows = false;
+mock.module("@teamscala/db/registry/load-config", () => {
+	class RegistryConfigMissingError extends Error {}
+	return {
+		RegistryConfigMissingError,
+		loadRegistryConfig: async () => {
+			if (registryThrows) throw new RegistryConfigMissingError("missing");
+			if (registryBlocks === undefined)
+				throw new RegistryConfigMissingError("missing");
+			return { blocks: registryBlocks };
+		},
+	};
+});
+
+import {
+	AGREEMENT_META_KEY,
+	buildGateBlock,
+	buildSigningShellBlocks,
+	hasPrePlacedGate,
+	stashAgreementMeta,
+} from "./signing-shell.ts";
+import type { AgreementGateSettings } from "./settings.ts";
+
+const SETTINGS: AgreementGateSettings = {
+	title: "DB title",
+	subtitle: "Sign to continue",
+	submitLabel: "Sign now",
+	requireOtp: true,
+};
+
+describe("buildGateBlock", () => {
+	test("carries the agreement uuid as the gate context", () => {
+		const block = buildGateBlock("agreement-uuid-1", "Custom title", SETTINGS);
+		expect(block.type).toBe("SignIn");
+		expect(block.props?.mode).toBe("gate");
+		expect(block.props?.gateContextField).toBe("agreementId");
+		expect(block.props?.gateContextValue).toBe("agreement-uuid-1");
+	});
+
+	test("requireOtp is the STRING the renderer validates, never a boolean", () => {
+		expect(buildGateBlock("u", "t", SETTINGS).props?.gateRequireOtp).toBe("true");
+		expect(
+			buildGateBlock("u", "t", { ...SETTINGS, requireOtp: false }).props
+				?.gateRequireOtp,
+		).toBe("false");
+	});
+
+	test("a blank per-agreement title falls back to the DB-driven default", () => {
+		expect(buildGateBlock("u", "", SETTINGS).props?.title).toBe("DB title");
+	});
+});
+
+describe("buildSigningShellBlocks", () => {
+	test("an unreadable registry row still renders — the hardcoded shell is the fallback", async () => {
+		registryThrows = true;
+		const blocks = await buildSigningShellBlocks();
+		expect(blocks.length).toBeGreaterThanOrEqual(3);
+		expect(
+			blocks.some(
+				(b) => b.type === "SignatureField" || b.type === "Container",
+			),
+		).toBe(true);
+	});
+
+	test("registry-configured blocks replace the default, deep-cloned per call", async () => {
+		registryThrows = false;
+		registryBlocks = [
+			{
+				type: "Text",
+				props: { id: "custom-clause", text: "Custom clause" },
+			},
+		];
+		const first = await buildSigningShellBlocks();
+		expect(first).toHaveLength(1);
+		expect((first[0].props as { text?: string }).text).toBe("Custom clause");
+
+		// Injection mutates the tree in place: the mutation must not leak into
+		// the NEXT call's blocks (the registry value or default stays intact).
+		first.pop();
+		const second = await buildSigningShellBlocks();
+		expect(second).toHaveLength(1);
+	});
+
+	test("an EMPTY registry block list falls back to the default shell", async () => {
+		registryBlocks = [];
+		const blocks = await buildSigningShellBlocks();
+		expect(blocks.length).toBeGreaterThanOrEqual(3);
+		registryBlocks = undefined;
+	});
+});
+
+describe("stashAgreementMeta + hasPrePlacedGate", () => {
+	test("stashed meta round-trips under the module's own key", () => {
+		const resolved: Record<string, unknown> = {};
+		stashAgreementMeta(resolved, "uuid-77", "Q3 Agreement");
+		expect(resolved[AGREEMENT_META_KEY]).toEqual({
+			id: "uuid-77",
+			name: "Q3 Agreement",
+		});
+	});
+
+	test("a pre-placed SignIn gate block reads as an agreement gate", () => {
+		const resolved: Record<string, unknown> = {
+			page: {
+				puck_data: {
+					content: [
+						{
+							type: "SignIn",
+							props: {
+								mode: "gate",
+								gateContextField: "agreementId",
+								gateContextValue: "uuid-77",
+							},
+						},
+					],
+				},
+			},
+		};
+		expect(hasPrePlacedGate(resolved)).toBe(true);
+	});
+
+	test("a PROPOSAL gate (proposalId context) is not an agreement gate", () => {
+		const resolved: Record<string, unknown> = {
+			page: {
+				puck_data: {
+					content: [
+						{
+							type: "SignIn",
+							props: {
+								mode: "gate",
+								gateContextField: "proposalId",
+								gateContextValue: "p1",
+							},
+						},
+					],
+				},
+			},
+		};
+		expect(hasPrePlacedGate(resolved)).toBe(false);
+	});
+
+	test("a page with no gate block reads as new-flow (no pre-placed gate)", () => {
+		const resolved: Record<string, unknown> = {
+			page: {
+				puck_data: { content: [{ type: "Text", props: { id: "t1" } }] },
+			},
+		};
+		expect(hasPrePlacedGate(resolved)).toBe(false);
+	});
+});

package/src/agreement-gate/signing-shell.ts

@@ -28,9 +28,6 @@
  * identified, not heuristically guessed.
  */
 
-// Why: The body content array for the agreement. The public shell c…
-// (full note hoisted to this file's leading header — kept out of the body per
-// no-inline-prose-blocks / prose-stays-in-docs)
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 import { findAgreementGate } from "./signing-session.ts";

package/src/attach-portal-members.test.ts

@@ -0,0 +1,124 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavioural pins for the portal member directory endpoint. The load-bearing
+ * cases: org-scoped reads bind the orgId as a PARAMETER (never interpolated —
+ * the orgId arrives from the query string), the all-orgs "View As" mode is
+ * gated to admin/super_admin sessions (any other caller without an orgId is
+ * a 400, and an unauthenticated caller never reaches the probe query at
+ * all), and a database fault is reported as resolve-failed rather than a
+ * 500 leaking driver detail.
+ */
+import { describe, expect, mock, test } from "bun:test";
+import { Hono } from "hono";
+
+type QueryRowsCall = { sql: string; values: unknown[] };
+
+let session: { user?: { id?: string } } | null = null;
+let probeRows: Array<{ id: string }> = [];
+let memberRows: Array<Record<string, unknown>> = [];
+let failMemberQuery = false;
+const queryCalls: QueryRowsCall[] = [];
+
+mock.module("@teamscala/auth/get-session", () => ({
+	getSession: async () => session,
+}));
+
+mock.module("@teamscala/db/query-rows", () => ({
+	queryRows: (strings: TemplateStringsArray, ...values: unknown[]) => {
+		const sql = strings.join("?");
+		queryCalls.push({ sql, values });
+		if (sql.includes("role IN")) {
+			if (failMemberQuery) return Promise.reject(new Error("probe down"));
+			return Promise.resolve(probeRows);
+		}
+		if (failMemberQuery) return Promise.reject(new Error("connection reset"));
+		return Promise.resolve(memberRows);
+	},
+}));
+
+import { attachPortalMembers } from "./attach-portal-members.ts";
+
+function makeApp(): Hono {
+	const app = new Hono();
+	return app;
+}
+
+async function get(app: Hono, url: string): Promise<Response> {
+	return app.request(url, { headers: new Headers({ cookie: "s=1" }) });
+}
+
+describe("GET /api/portal/members", () => {
+	test("an orgId read binds the orgId as a parameter and returns the joined rows", async () => {
+		const app = makeApp();
+		await attachPortalMembers(app);
+		memberRows = [
+			{
+				id: "m1",
+				user_id: "u1",
+				organization_id: "org-9",
+				role: "admin",
+				email: "a@x.test",
+				name: "A",
+				image: null,
+			},
+		];
+		const res = await get(app, "/api/portal/members?orgId=org-9");
+		expect(res.status).toBe(200);
+		const body = (await res.json()) as { members: Array<{ id: string }> };
+		expect(body.members).toHaveLength(1);
+		expect(body.members[0].id).toBe("m1");
+		const memberCall = queryCalls.at(-1);
+		expect(memberCall?.values).toContain("org-9");
+	});
+
+	test("a session without an admin role gets 400 on the org-less (all-orgs) mode", async () => {
+		const app = makeApp();
+		await attachPortalMembers(app);
+		session = { user: { id: "u-viewer" } };
+		probeRows = [];
+		const res = await get(app, "/api/portal/members");
+		expect(res.status).toBe(400);
+		const body = (await res.json()) as { error: string; members: string[] };
+		expect(body.error).toContain("orgId query parameter required");
+		// The probe DID run (the role check is the only thing that refused) —
+		// assert the probe SQL is the role-scoped one, parameterised by user id.
+		const probe = queryCalls.at(-1);
+		expect(probe?.sql).toContain("role IN");
+		expect(probe?.values).toContain("u-viewer");
+	});
+
+	test("an admin session unlocks the all-orgs mode", async () => {
+		const app = makeApp();
+		await attachPortalMembers(app);
+		session = { user: { id: "u-admin" } };
+		probeRows = [{ id: "u-admin" }];
+		memberRows = [{ id: "m-all", organization_id: "org-1" }];
+		const res = await get(app, "/api/portal/members");
+		expect(res.status).toBe(200);
+		const body = (await res.json()) as { members: Array<{ id: string }> };
+		expect(body.members[0].id).toBe("m-all");
+	});
+
+	test("no session never reaches the member query and answers 400", async () => {
+		const app = makeApp();
+		await attachPortalMembers(app);
+		session = null;
+		const callsBefore = queryCalls.length;
+		const res = await get(app, "/api/portal/members");
+		expect(res.status).toBe(400);
+		expect(queryCalls.length).toBe(callsBefore);
+	});
+
+	test("a database fault reports resolve-failed instead of leaking driver detail", async () => {
+		const app = makeApp();
+		await attachPortalMembers(app);
+		failMemberQuery = true;
+		const res = await get(app, "/api/portal/members?orgId=org-9");
+		const body = (await res.json()) as { error: string };
+		expect(body.error).toBe("resolve-failed");
+		failMemberQuery = false;
+	});
+});

package/src/attach-portal-members.ts

@@ -42,14 +42,17 @@ export async function attachPortalMembers(app: Hono): Promise<void> {
 			// View As switcher): user.role is "admin" OR "super_admin".
 			const session = await getSession(c.req.raw.headers);
 			const userId = session?.user?.id;
-			const { getPrisma } = await import("@teamscala/db/prisma-registry");
-			const superAdminUser = userId
-				? await getPrisma().user.findFirst({
-						where: { id: userId, role: { in: ["admin", "super_admin"] } },
-						select: { id: true },
-					})
-				: null;
-			if (!superAdminUser) {
+			// Same data-access shape as the member query below (queryRows, the
+			// sanctioned raw-SQL runner): the super-admin probe is a scalar
+			// lookup, not a Prisma model call (no-direct-prisma-outside-orpc).
+			const superAdminRows = userId
+				? await queryRows`
+						SELECT id FROM "user"
+						WHERE id = ${userId} AND role IN ('admin', 'super_admin')
+						LIMIT 1
+					` as Array<{ id: string }>
+				: [];
+			if (superAdminRows.length === 0) {
 				return c.json({ error: "orgId query parameter required", members: [] }, 400);
 			}
 			try {
@@ -78,7 +81,6 @@ export async function attachPortalMembers(app: Hono): Promise<void> {
 		}
 
 		try {
-			const { getPrisma } = await import("@teamscala/db/prisma-registry");
 			const rows = await queryRows`
 				SELECT m.id, m.user_id, m.organization_id, m.role,
 				       u.email, u.name, u.image

package/src/auth-gate.ts

@@ -73,6 +73,7 @@
 import type { ServiceInstallConfig } from "./load-service-install-row";
 import { getPrisma } from "@teamscala/db/prisma-registry";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import type { ConfigKey } from "@teamscala/db/registry/generated/config";
 import { resolveAccess } from "@teamscala/auth/resolve-access";
 import * as v from "valibot";
 import { configure as configureEventLog } from "@teamscala/event-log/configure";
@@ -276,9 +277,14 @@ export async function attachAuthGate(
 		const accessCfg = (config as { access?: { allowlist_config_slug?: string } })
 			.access;
 		if (accessCfg?.allowlist_config_slug && session?.user && !onSignInPath) {
+			// allowlist_config_slug is service_install runtime config: a config row
+			// created after this build is a legitimate value, so the generated slug
+			// union (a build-time snapshot) is asserted, never enforced. An unknown
+			// slug still fails closed — loadRegistryConfig throws on a missing row
+			// and the gate below treats an unread allowlist as not-allowed.
 			const allowRow = await loadRegistryConfig(
 				"config",
-				accessCfg.allowlist_config_slug,
+				accessCfg.allowlist_config_slug as ConfigKey,
 				v.looseObject({}),
 			);
 			const allowed =

package/src/build-client-assets/source-candidates.test.ts

@@ -0,0 +1,62 @@
+/**
+ * @system server-handlers
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Fixtures for the @source candidate scan. The load-bearing case is the
+ * DIRECTORY probe: sources are directories, and a Bun.file(dir).exists()
+ * probe answers false for them — which silently skipped every source,
+ * zeroed the candidate set, and stripped all Tailwind utilities from every
+ * kind:ui service's stylesheet (2026-09-01, operator-visible).
+ */
+import { describe, expect, test } from "bun:test";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { scanSourceCandidates } from "./source-candidates.ts";
+
+const noopLog = { warn: () => {}, info: () => {}, error: () => {} } as never;
+
+async function makeSourceTree(tag: string, files: Record<string, string>) {
+	const root = join(tmpdir(), `source-candidates-${tag}-${process.pid}`);
+	await rm(root, { recursive: true, force: true });
+	for (const [rel, content] of Object.entries(files)) {
+		const p = join(root, rel);
+		await mkdir(p.slice(0, p.lastIndexOf("/")), { recursive: true });
+		await writeFile(p, content);
+	}
+	return root;
+}
+
+describe("scanSourceCandidates", () => {
+	test("scans a DIRECTORY source and extracts utility candidates", async () => {
+		const root = await makeSourceTree("dir-src", {
+			"src/Button.tsx": 'export const k = "h-12 px-6 text-base rounded-md";',
+		});
+		const candidates = await scanSourceCandidates(
+			[{ base: root, pattern: "src" }],
+			noopLog,
+		);
+		expect(candidates).toContain("h-12");
+		expect(candidates).toContain("px-6");
+		expect(candidates).toContain("text-base");
+		expect(candidates).toContain("rounded-md");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("skips an absent source silently instead of zeroing the scan", async () => {
+		const root = await makeSourceTree("absent-src", {
+			"src/Keep.tsx": "flex gap-2",
+		});
+		const candidates = await scanSourceCandidates(
+			[
+				{ base: root, pattern: "src" },
+				{ base: root, pattern: "does-not-exist" },
+			],
+			noopLog,
+		);
+		expect(candidates).toContain("flex");
+		expect(candidates).toContain("gap-2");
+		await rm(root, { recursive: true, force: true });
+	});
+});

package/src/build-client-assets/source-candidates.ts

@@ -21,8 +21,21 @@
  */
 
 import { resolve } from "node:path";
+import { stat } from "node:fs/promises";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 
+// Directory-capable existence probe. Bun.file().exists() answers false for
+// directories, so the @source roots (directories by construction) were all
+// "absent" and the candidate scan returned nothing.
+async function existsStat(path: string): Promise<boolean> {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 // Tailwind v4's low-level `compile()` does NOT scan content — `compiler.build( candidates)` only emits utilities for the candidate class names it is GIVEN.
 // `build([])` therefore emits ZERO content-driven utilities (only the static theme/base + @utility/@layer + imported package CSS). The workspace's own
 // blocks mostly use inline styles + hand-written `blk-*` package classes (no-tailwind-in-blocks / layout-properties-inline), so the missing utility
@@ -67,7 +80,14 @@ export async function scanSourceCandidates(
 		// that package resolves to a non-existent dir. Skip silently rather than
 		// warn on every UI-service boot (the log-flood class — the ENOENT whose
 		// path rendered with a trailing null byte). Real errors below still warn.
-		if (!await Bun.file(root).exists()) continue;
+		// The probe MUST be a stat, never Bun.file(root).exists(): root is a
+		// DIRECTORY and Bun.file() on a directory reports exists() === false
+		// (the same defect discover-blocks.ts measured 2026-09-01). That probe
+		// skipped EVERY source, collapsed the candidate set to zero, and
+		// `build([])` stripped every Tailwind utility from every kind:ui
+		// service's stylesheet at once — the operator's "the css is totally
+		// fucked" with a stylesheet that loads and 15k package rules intact.
+		if (!await existsStat(root)) continue;
 		// A root INSIDE node_modules is an explicit `@source` into an installed
 		// block package (the app-css transform emits one per package) — scan it
 		// fully. A root OUTSIDE node_modules is the service's own tree — scan it

package/src/build-client-assets/styles-build.test.ts

@@ -0,0 +1,157 @@
+/**
+ * @system server-handlers
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavioural pins for the stylesheet resolver (operator ruling 2026-09-03:
+ * the fallback chain IS the drift — a bare id resolved via Bun.resolve
+ * returned whatever the package's main was (a .js for a normal package),
+ * the resolve(base, id) tail invented nonexistent paths whose ENOENT
+ * surfaced as misleading downstream CSS errors, and inlineCssImports
+ * SWALLOWED unresolved imports, leaving literals that failed downstream
+ * instead of at the build. Every case below pins the ruled contract:
+ * resolve or THROW naming the specifier; remote https imports are skipped
+ * explicitly, never resolved and never thrown on.
+ */
+import { describe, expect, test } from "bun:test";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { bunResolveStylesheet } from "./styles-build.ts";
+
+async function makeTree(tag: string, files: Record<string, string>) {
+	const root = join(tmpdir(), `styles-build-${tag}-${process.pid}`);
+	await rm(root, { recursive: true, force: true });
+	for (const [rel, content] of Object.entries(files)) {
+		const p = join(root, rel);
+		await mkdir(p.slice(0, p.lastIndexOf("/")), { recursive: true });
+		await writeFile(p, content);
+	}
+	return root;
+}
+
+describe("bunResolveStylesheet — relative ids", () => {
+	test("a relative import that exists resolves and inlines its nested @imports", async () => {
+		const root = await makeTree("rel-ok", {
+			"src/entry.css": '@import "./leaf.css";\n.body { color: red; }\n',
+			"src/leaf.css": ".leaf { color: blue; }\n",
+		});
+		const r = await bunResolveStylesheet("./entry.css", join(root, "src"), root);
+		expect(r.content).toContain(".body");
+		expect(r.content).toContain(".leaf");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a relative import that does NOT exist throws naming the specifier and the path", async () => {
+		const root = await makeTree("rel-missing", {
+			"src/entry.css": ".body { color: red; }\n",
+		});
+		const err = await bunResolveStylesheet(
+			"./nope.css",
+			join(root, "src"),
+			root,
+		).catch((e) => e);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"./nope.css"');
+		expect((err as Error).message).toContain("not found");
+		await rm(root, { recursive: true, force: true });
+	});
+});
+
+describe("bunResolveStylesheet — bare ids", () => {
+	test("a CSS-only package resolves via its declared style entry", async () => {
+		const root = await makeTree("bare-style", {
+			"node_modules/tw-animate-css/package.json": JSON.stringify({
+				name: "tw-animate-css",
+				exports: { ".": { style: "./dist/tw-animate.css" } },
+			}),
+			"node_modules/tw-animate-css/dist/tw-animate.css":
+				".tw-animate { animation: none; }\n",
+			"src/app.css": '.x { color: red; }\n',
+		});
+		const r = await bunResolveStylesheet(
+			"tw-animate-css",
+			join(root, "src"),
+			root,
+		);
+		expect(r.content).toContain(".tw-animate");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a normal JS package (no style entry) THROWS naming the specifier — never its .js main", async () => {
+		const root = await makeTree("bare-js-main", {
+			"node_modules/lodash/package.json": JSON.stringify({
+				name: "lodash",
+				main: "lodash.js",
+			}),
+			"node_modules/lodash/lodash.js": "module.exports = {};\n",
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const err = await bunResolveStylesheet(
+			"lodash",
+			join(root, "src"),
+			root,
+		).catch((e) => e);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"lodash"');
+		expect((err as Error).message).toContain("no style entry");
+		expect((err as Error).message).not.toContain("lodash.js");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a bare id with no package anywhere THROWS naming the specifier and both roots", async () => {
+		const root = await makeTree("bare-missing", {
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const src = join(root, "src");
+		const err = await bunResolveStylesheet("no-such-pkg", src, root).catch(
+			(e) => e,
+		);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"no-such-pkg"');
+		expect((err as Error).message).toContain("unresolved");
+		expect((err as Error).message).toContain(src);
+		await rm(root, { recursive: true, force: true });
+	});
+});
+
+describe("bunResolveStylesheet — remote @imports", () => {
+	test("a remote https @import is kept verbatim (stripped later by stripRemoteImports), never resolved", async () => {
+		const root = await makeTree("remote-skip", {
+			"node_modules/cdn-fonts/package.json": JSON.stringify({
+				name: "cdn-fonts",
+				exports: { ".": { style: "./index.css" } },
+			}),
+			"node_modules/cdn-fonts/index.css":
+				'@import "https://rsms.me/inter/inter.css";\n.cdn { font-family: inter; }\n',
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const r = await bunResolveStylesheet(
+			"cdn-fonts",
+			join(root, "src"),
+			root,
+		);
+		expect(r.content).toContain("https://rsms.me/inter/inter.css");
+		expect(r.content).toContain(".cdn");
+		await rm(root, { recursive: true, force: true });
+	});
+
+	test("a LOCAL @import of a missing file THROWS at the build instead of leaving a literal", async () => {
+		const root = await makeTree("local-missing-nested", {
+			"node_modules/broken-pkg/package.json": JSON.stringify({
+				name: "broken-pkg",
+				exports: { ".": { style: "./index.css" } },
+			}),
+			"node_modules/broken-pkg/index.css": '@import "./gone.css";\n.real { color: red; }\n',
+			"src/app.css": ".x { color: red; }\n",
+		});
+		const err = await bunResolveStylesheet(
+			"broken-pkg",
+			join(root, "src"),
+			root,
+		).catch((e) => e);
+		expect(err).toBeInstanceOf(Error);
+		expect((err as Error).message).toContain('"./gone.css"');
+		await rm(root, { recursive: true, force: true });
+	});
+});

package/src/build-client-assets/styles-build.ts

@@ -31,31 +31,52 @@ async function resolveStylesheetRaw(
 		const r = await Bun.resolve("tailwindcss/index.css", cwd);
 		return { path: r, base: dirname(r), content: await Bun.file(r).text() };
 	}
-	try {
-		const r = await Bun.resolve(id, base);
-		return { path: r, base: dirname(r), content: await Bun.file(r).text() };
-	} catch (error) {
-		getAppLogger().warn("style import resolve failed — trying package fallback", error);
+	if (id.startsWith(".")) {
+		// Relative import: resolve against the importing file's directory and
+		// REQUIRE existence — a missing leaf is a build-breaking error naming
+		// the specifier, never a silently-dropped subtree.
+		const p = resolve(base, id);
+		if (!(await Bun.file(p).exists())) {
+			throw new Error(
+				`style import "${id}" not found at ${p} (resolved relative to ${base})`,
+			);
+		}
+		return { path: p, base: dirname(p), content: await Bun.file(p).text() };
 	}
-	if (!id.startsWith(".")) {
-		try {
-			const pkgPath = await Bun.resolve(id + "/package.json", cwd);
-			const pkg = JSON.parse(await Bun.file(pkgPath).text());
-			const entry =
-				pkg.exports?.["."]?.style || pkg.style || pkg.main;
-			if (entry) {
+	// Bare specifier: find node_modules/<id>/package.json by walking upward
+	// from the importing file's dir then cwd, and read the DECLARED STYLE
+	// entry (exports["."].style / style). Bun.resolve is not used here: it
+	// hands back whatever the package's main is — for a normal JS package
+	// that is a .js entry, not the declared stylesheet. A package with no
+	// style entry is not a stylesheet import: that is a build-breaking
+	// error naming the specifier, never an invented path whose ENOENT
+	// surfaces as a misleading downstream CSS error.
+	const tried: string[] = [];
+	for (const root of [base, cwd]) {
+		let dir = root;
+		for (;;) {
+			const pkgPath = join(dir, "node_modules", id, "package.json");
+			if (await Bun.file(pkgPath).exists()) {
+				const pkg = await Bun.file(pkgPath).json();
+				const entry: string | undefined =
+					pkg.exports?.["."]?.style ?? pkg.style;
+				if (!entry) {
+					throw new Error(
+						`style import "${id}" resolved to ${pkgPath} but the package declares no style entry (exports["."].style / style) — not a stylesheet package`,
+					);
+				}
 				const r = resolve(dirname(pkgPath), entry);
 				return { path: r, base: dirname(r), content: await Bun.file(r).text() };
 			}
-		} catch (error) {
-			getAppLogger().warn(
-				"package style entry resolve failed — falling back to bare resolve",
-				error,
-			);
+			tried.push(pkgPath);
+			const parent = dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
 		}
 	}
-	const r = resolve(base, id);
-	return { path: r, base: dirname(r), content: await Bun.file(r).text() };
+	throw new Error(
+		`style import "${id}" unresolved — no node_modules/${id}/package.json found walking up from ${base} or ${cwd} (${tried.length} location(s) tried)`,
+	);
 }
 
 // Tailwind v4's compile() invokes `loadStylesheet` for DIRECT @imports in the entry (app.css) but does NOT re-invoke it for @imports WITHIN the loaded
@@ -87,14 +108,18 @@ async function inlineCssImports(
 			result += m[0];
 			continue;
 		}
+		// Remote @imports are CSP-forbidden and stripped by
+		// stripRemoteImports AFTER the compile: skip them here EXPLICITLY —
+		// they must never reach resolveStylesheetRaw, and an unresolved
+		// LOCAL import below is a throw, not a swallow.
+		if (spec.startsWith("http://") || spec.startsWith("https://")) {
+			result += m[0];
+			continue;
+		}
 		if (seen.has(spec)) continue; // cycle guard
 		seen.add(spec);
-		try {
-			const resolved = await resolveStylesheetRaw(spec, base, cwd);
-			result += await inlineCssImports(resolved.content, resolved.base, cwd, seen);
-		} catch {
-			result += m[0]; // unresolved — keep literal; CSS/Tailwind will surface it
-		}
+		const resolved = await resolveStylesheetRaw(spec, base, cwd);
+		result += await inlineCssImports(resolved.content, resolved.base, cwd, seen);
 	}
 	result += css.slice(lastIdx);
 	return result;
@@ -111,6 +136,8 @@ async function bunResolveStylesheet(
 	return { ...resolved, content };
 }
 
+export { bunResolveStylesheet };
+
 // The app owns its fonts via an explicit, CSP-allowlisted <link> in index.html (Google Fonts — `style-src ... fonts.googleapis.com`, `font-src ...
 // fonts.gstatic.com`). Third-party package CSS MUST NOT inject its own remote `@import url(http…)`: @puckeditor/core/dist/index.css opens with
 // `@import "https://rsms.me/inter/inter.css"`, an arbitrary CDN our CSP does NOT allow. The Tailwind compile inlines that mid-output, where it was either

package/src/fn-routers/assessment-report-email.ts

@@ -56,7 +56,8 @@ export async function sendAuthorityReportEmail(opts: {
 	const decrypted = rawSecret
 		? (decryptSecretConfig(rawSecret as never) as { token?: string })
 		: null;
-	if (!decrypted?.token) {
+	const resendToken = decrypted?.token;
+	if (!resendToken) {
 		log.warn("[authority-report-email] Resend token unavailable — skipping");
 		return;
 	}
@@ -189,7 +190,7 @@ export async function sendAuthorityReportEmail(opts: {
 	});
 
 	const sendOnce = async (fromHeader: string, replyToHeader: string | undefined) =>
-		sendResendEmail(decrypted.token, {
+		sendResendEmail(resendToken, {
 			from: fromHeader,
 			to: opts.to,
 			subject: tpl.subject,

package/src/proposal-authorized-emails.ts

@@ -33,8 +33,6 @@ export async function resolveProposalAuthorizedEmails(
 	proposalId: string,
 ): Promise<Set<string>> {
 	try {
-		const { getPrisma } = await import("@teamscala/db/prisma-registry");
-		const prisma = getPrisma();
 		const rows = await queryRows`
 			SELECT lower(u.email) AS email
 			  FROM better_auth_member m

package/src/register-registry-page-route/page-data-shared.test.ts

@@ -0,0 +1,164 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavioural pins for the shared page-data helpers. The load-bearing cases:
+ * layout defaults FILL missing root props and never clobber existing values
+ * (a theme row must not overwrite page-authored props), pickRootProp takes
+ * the FIRST region carrying a usable value, brand tokens degrade to nulls —
+ * never throw — on a missing brand row, and the unresolved-region-slot warn
+ * fires ONCE per slot per process (the hot-path throttle).
+ */
+import { describe, expect, mock, test } from "bun:test";
+
+const warns: string[] = [];
+mock.module("@teamscala/logger/app-loggers", () => ({
+	getAppLogger: () => ({
+		warn: (message: string) => warns.push(message),
+		info: () => {},
+		error: () => {},
+	}),
+}));
+
+import {
+	applyLayoutDefaults,
+	EMPTY_PUCK_DATA,
+	pickRootProp,
+	readBrandTokens,
+	warnUnresolvedRegionSlot,
+	type RegionEntry,
+} from "./page-data-shared.ts";
+
+function region(
+	slot: string,
+	puckData: { root?: { props?: Record<string, unknown> }; content: unknown[] } | null,
+): RegionEntry {
+	return {
+		slot,
+		puckData: (puckData ?? {}) as RegionEntry["puckData"],
+		pageId: `${slot}-page`,
+	};
+}
+
+describe("EMPTY_PUCK_DATA", () => {
+	test("is the documented empty render: no props, no content", () => {
+		expect(EMPTY_PUCK_DATA).toEqual({ root: { props: {} }, content: [] });
+	});
+});
+
+describe("applyLayoutDefaults", () => {
+	test("fills a missing root and props object when absent", () => {
+		const data = { content: [] } as unknown as Parameters<
+			typeof applyLayoutDefaults
+		>[0];
+		applyLayoutDefaults(data, { orgId: "org-1" });
+		expect((data as { root?: { props?: Record<string, unknown> } }).root?.props).toEqual({
+			orgId: "org-1",
+		});
+	});
+
+	test("fills ONLY nullish props — an authored value is never clobbered", () => {
+		const data = {
+			root: { props: { orgId: "authored", empty: "", zero: 0 } },
+			content: [],
+		} as unknown as Parameters<typeof applyLayoutDefaults>[0];
+		applyLayoutDefaults(data, {
+			orgId: "default",
+			missing: "filled",
+			empty: "filled",
+			zero: "filled",
+		});
+		expect(data.root?.props).toEqual({
+			orgId: "authored",
+			empty: "",
+			zero: 0,
+			missing: "filled",
+		});
+	});
+
+	test("an empty defaults map is a no-op", () => {
+		const data = { content: [] } as unknown as Parameters<
+			typeof applyLayoutDefaults
+		>[0];
+		applyLayoutDefaults(data, {});
+		expect((data as { root?: unknown }).root).toBeUndefined();
+	});
+});
+
+describe("pickRootProp", () => {
+	test("returns the FIRST region carrying a non-empty value", () => {
+		const regions = [
+			region("a", { root: { props: { title: "" } }, content: [] }),
+			region("b", { root: { props: { title: "winner" } }, content: [] }),
+			region("c", { root: { props: { title: "loser" } }, content: [] }),
+		];
+		expect(pickRootProp<string>(regions, "title")).toBe("winner");
+	});
+
+	test("skips regions without root props and returns undefined when nothing carries the key", () => {
+		const regions = [
+			region("a", null),
+			region("b", { content: [] }),
+			region("c", { root: { props: { other: 1 } }, content: [] }),
+		];
+		expect(pickRootProp<string>(regions, "title")).toBeUndefined();
+	});
+});
+
+describe("readBrandTokens", () => {
+	test("maps a full brand row to every token the render branches read", () => {
+		const tokens = readBrandTokens({
+			brand: {
+				primaryColor: "#0055ff",
+				headingFont: "Serif A",
+				bodyFont: "Sans B",
+				logo: { light: "/l.svg", dark: "/d.svg", brand: "/b.svg" },
+				theme: "dark",
+			},
+		});
+		expect(tokens).toEqual({
+			brand: {
+				primaryColor: "#0055ff",
+				headingFont: "Serif A",
+				bodyFont: "Sans B",
+				logo: { light: "/l.svg", dark: "/d.svg", brand: "/b.svg" },
+				theme: "dark",
+			},
+			primaryColor: "#0055ff",
+			headingFont: "Serif A",
+			bodyFont: "Sans B",
+			logo: { light: "/l.svg", dark: "/d.svg", brand: "/b.svg" },
+			brandTheme: "dark",
+		});
+	});
+
+	test("a missing brand row degrades to nulls instead of throwing", () => {
+		const tokens = readBrandTokens({});
+		expect(tokens.primaryColor).toBe("");
+		expect(tokens.headingFont).toBeNull();
+		expect(tokens.bodyFont).toBeNull();
+		expect(tokens.logo).toEqual({ light: null, dark: null, brand: null });
+		expect(tokens.brandTheme).toBeUndefined();
+	});
+
+	test("a non-string theme is ignored rather than passed through", () => {
+		const tokens = readBrandTokens({ brand: { theme: 7 } });
+		expect(tokens.brandTheme).toBeUndefined();
+	});
+});
+
+describe("warnUnresolvedRegionSlot", () => {
+	test("warns once per slot and stays silent on repeat calls", () => {
+		const slot = `test-unresolved-slot-${process.pid}-${Date.now()}`;
+		const before = warns.length;
+		warnUnresolvedRegionSlot(slot);
+		const afterFirst = warns.length;
+		expect(afterFirst).toBe(before + 1);
+		warnUnresolvedRegionSlot(slot);
+		warnUnresolvedRegionSlot(slot);
+		expect(warns.length).toBe(afterFirst);
+		// The warn names the slot so the operator can find the loader row.
+		expect(warns[afterFirst - 1]).toContain(slot);
+	});
+});

package/src/register-registry-page-route/resolve-request-graph.test.ts

@@ -0,0 +1,165 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavioural pins for the per-request loader-graph resolution. The load-
+ * bearing cases: a bare root with a resource_type throws the 200 holding-page
+ * signal (never falls through to the marketing site), a dead link (declared
+ * primary source that resolves to nothing) throws the branded 404, a content
+ * route with no page row throws the dead-link floor, and a content route with
+ * an EMPTY page row throws the 200 empty-page floor — the three distinct
+ * surfaces the page binder maps to three distinct responses.
+ */
+import { describe, expect, mock, test } from "bun:test";
+
+let loaderGraph: Record<string, unknown> = {};
+const resolveCalls: Array<{ params: Record<string, string> }> = [];
+
+mock.module("@teamscala/logger/app-loggers", () => ({
+	getAppLogger: () => ({
+		warn: () => {},
+		info: () => {},
+		error: () => {},
+	}),
+}));
+
+mock.module("../resolve-from-loader-config.ts", () => ({
+	resolveFromLoaderConfig: async (_cfg: unknown, params: Record<string, string>) => {
+		resolveCalls.push({ params });
+		return structuredClone(loaderGraph);
+	},
+}));
+
+mock.module("../content-page-floor.ts", () => ({
+	pageBodyIsEmpty: (page: unknown) =>
+		page != null &&
+		typeof page === "object" &&
+		Array.isArray((page as { content?: unknown }).content) &&
+		((page as { content: unknown[] }).content.length === 0),
+	decideContentPageFloor: (opts: {
+		hasResourceType: boolean;
+		hasPageContentSource: boolean;
+		page: unknown;
+	}) => {
+		if (opts.hasResourceType || !opts.hasPageContentSource) return null;
+		if (opts.page == null) {
+			const e = new Error("page missing") as Error & { resourceType: string; httpStatus: number; empty: boolean };
+			e.resourceType = "page";
+			e.httpStatus = 404;
+			e.empty = false;
+			return e;
+		}
+		if (
+			Array.isArray((opts.page as { content?: unknown }).content) &&
+			(opts.page as { content: unknown[] }).content.length === 0
+		) {
+			const e = new Error("page empty") as Error & { resourceType: string; httpStatus: number; empty: boolean };
+			e.resourceType = "page";
+			e.httpStatus = 200;
+			e.empty = true;
+			return e;
+		}
+		return null;
+	},
+}));
+
+mock.module("./graph-cache.ts", () => ({
+	staticShellGraphCache: { getWithMeta: () => undefined, set: () => {}, refreshInBackground: () => {} },
+	paramRouteGraphCache: { getWithMeta: () => undefined, set: () => {}, refreshInBackground: () => {} },
+	readCachedGraph: () => undefined,
+}));
+
+import { resolveRequestGraph, type ResolveRequestGraphArgs } from "./resolve-request-graph.ts";
+import type { PageRouteConfig } from "../register-registry-page-route.ts";
+
+type LoaderConfig = ResolveRequestGraphArgs["loaderConfig"];
+
+function route(overrides: Partial<PageRouteConfig> = {}): PageRouteConfig {
+	return {
+		pattern: "/:id",
+		service: "scala-proposals",
+		loader_slug: "proposal-with-brand",
+		...overrides,
+	};
+}
+
+function loader(sources: Array<{ key: string }>): LoaderConfig {
+	return { description: "test", loader_type: "shell", sources } as LoaderConfig;
+}
+
+describe("resolveRequestGraph", () => {
+	test("a bare root with a resource_type throws the 200 holding-page signal", async () => {
+		const err = (await resolveRequestGraph({
+			pattern: "/",
+			routeSlug: "proposal",
+			routeConfig: route({ pattern: "/", resource_type: "proposal" }),
+			loaderConfig: loader([{ key: "proposal" }]),
+			params: { host: "proposals.scala.business", path: "/" },
+			isStaticShell: false,
+			serviceSlug: "scala-proposals",
+		}).catch((e) => e)) as Error & { httpStatus: number; resourceType: string };
+		expect(err).toBeInstanceOf(Error);
+		expect((err as { httpStatus?: number }).httpStatus).toBe(200);
+		expect((err as { resourceType?: string }).resourceType).toBe("proposal");
+	});
+
+	test("a dead link (declared primary source resolving to nothing) throws the 404", async () => {
+		loaderGraph = { proposal: null };
+		const err = (await resolveRequestGraph({
+			pattern: "/:id",
+			routeSlug: "proposal",
+			routeConfig: route({ resource_type: "proposal" }),
+			loaderConfig: loader([{ key: "proposal" }]),
+			params: { host: "proposals.scala.business", path: "/missing" },
+			isStaticShell: false,
+			serviceSlug: "scala-proposals",
+		}).catch((e) => e)) as Error & { httpStatus: number; resourceType: string };
+		expect((err as { httpStatus?: number }).httpStatus).toBe(404);
+		expect((err as { resourceType?: string }).resourceType).toBe("proposal");
+	});
+
+	test("a content route with no page row throws the dead-link floor", async () => {
+		loaderGraph = { page: null };
+		const err = (await resolveRequestGraph({
+			pattern: "/:id",
+			routeSlug: "public-page",
+			routeConfig: route({ resource_type: undefined }),
+			loaderConfig: loader([{ key: "page" }]),
+			params: { host: "public.scala.business", path: "/deleted" },
+			isStaticShell: false,
+			serviceSlug: "scala-public",
+		}).catch((e) => e)) as Error & { httpStatus: number; empty: boolean };
+		expect((err as { httpStatus?: number }).httpStatus).toBe(404);
+		expect((err as { empty?: boolean }).empty).toBe(false);
+	});
+
+	test("a content route with an EMPTY page row throws the 200 empty-page floor", async () => {
+		loaderGraph = { page: { content: [] } };
+		const err = (await resolveRequestGraph({
+			pattern: "/:id",
+			routeSlug: "public-page",
+			routeConfig: route({ resource_type: undefined }),
+			loaderConfig: loader([{ key: "page" }]),
+			params: { host: "public.scala.business", path: "/empty" },
+			isStaticShell: false,
+			serviceSlug: "scala-public",
+		}).catch((e) => e)) as Error & { httpStatus: number; empty: boolean };
+		expect((err as { httpStatus?: number }).httpStatus).toBe(200);
+		expect((err as { empty?: boolean }).empty).toBe(true);
+	});
+
+	test("a resolved graph with the primary present returns it", async () => {
+		loaderGraph = { proposal: { id: "p1", name: "Q3" } };
+		const resolved = await resolveRequestGraph({
+			pattern: "/:id",
+			routeSlug: "proposal",
+			routeConfig: route({ resource_type: "proposal" }),
+			loaderConfig: loader([{ key: "proposal" }]),
+			params: { host: "proposals.scala.business", path: "/p1" },
+			isStaticShell: false,
+			serviceSlug: "scala-proposals",
+		});
+		expect((resolved.proposal as { id: string }).id).toBe("p1");
+	});
+});

package/src/register-registry-page-route.ts

@@ -60,7 +60,9 @@ import type { CreatePageHandler, RendererComponentEntry } from "./types.ts";
 import {
 	fingerprintLoaderConfig,
 	readLiveLoaderConfig,
+	type LoaderConfig,
 } from "./register-registry-page-route/live-loader-config.ts";
+import type { ResourceLoaderKey } from "@teamscala/db/registry/generated/resource-loader";
 
 export interface PageRouteConfig {
 	pattern: string;
@@ -160,12 +162,15 @@ export async function registerRegistryPageRoute(
 	for (const routeRow of serviceRoutes) {
 		const routeConfig = routeRow.config;
 		const pattern = routeConfig.pattern;
-		const loaderSlug = routeConfig.loader_slug;
+		// loader_slug is a page_route runtime value and resource_loader is runtime
+		// data: a row created after this build is exactly the live-edit case this
+		// module serves, so the generated slug union (a build-time snapshot) can
+		// only be asserted, never enforced, here. An unknown slug still fails
+		// closed below (RegistryConfigMissingError skips the route).
+		const loaderSlug = routeConfig.loader_slug as ResourceLoaderKey;
 		const routeProviders = routeConfig.providers ?? baseProviders;
 
-		let loaderConfig: Awaited<
-			ReturnType<typeof loadRegistryConfig<typeof ResourceLoaderConfigSchema>>
-		> | null = null;
+		let loaderConfig: LoaderConfig | null = null;
 		try {
 			// Boot-time warm + validate: a missing row skips the route (warn),
 			// an invalid row fails closed. resource_loader is NOT on the