@teamscala/service-boot 0.23.457 → 0.23.459

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.457",
+  "version": "0.23.459",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/discover-blocks.ts

@@ -23,6 +23,7 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { join } from "node:path";
 import { getPrisma } from "@teamscala/db/prisma-registry";
+import { queryActiveRegistryRows } from "@teamscala/db/registry/loader/query-rows";
 import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
 import * as v from "valibot";
 import { isReactElementType } from "./is-react-element-type.ts";
@@ -95,13 +96,27 @@ export async function discoverBlocks(
 	// service. The page-server ORPC client is intentionally service-scoped and
 	// therefore cannot expose registry_entries. Use the registered database
 	// client for this shared model, as every other registry reader does.
-	const prisma = getPrisma();
-	const rows: Array<{ slug: string; config: unknown }> =
-		await prisma.registry_entries.findMany({
-			where: { type: "block_schema", is_active: true },
-			select: { slug: true, config: true },
-			orderBy: { slug: "asc" },
-		});
+	// READ THROUGH THE SHARED HELPER, NOT A SECOND HAND-WRITTEN QUERY. This
+	// used to call prisma.registry_entries.findMany directly with its own
+	// where clause — a duplicate of a read that already exists once in
+	// queryActiveRegistryRows and is exercised by every other registry reader.
+	//
+	// The duplicate returned an EMPTY ARRAY. Measured 2026-09-03: 91 active
+	// block_schema rows in the database, ZERO loaded, and not a single skip
+	// line logged — so the loop below never ran once. The helper resolves the
+	// same rows correctly because it falls back to raw SQL when the v8
+	// accessor cannot answer; the hand-written copy had no such path and its
+	// silence was indistinguishable from "there are no blocks".
+	//
+	// Every UI service then hit the fail-closed at the call site and refused to
+	// boot, so the operator saw nothing at all rather than "0 of 91 blocks".
+	// Two copies of one read, and the copy nobody exercised is the one that
+	// broke — delete it rather than repair it.
+	const rows = (await queryActiveRegistryRows(
+		getPrisma() as never,
+		{ type: "block_schema" },
+	)) as Array<{ slug: string; config: unknown }>;
+	rows.sort((a, b) => a.slug.localeCompare(b.slug));
 
 	// Parallel block discovery (no-serial-per-unit-work-on-hot-paths: boot is a
 	// recurring cycle via the package-poller's restarts). Previously each block's

package/src/resolve-from-loader-config.test.ts

@@ -104,6 +104,116 @@ describe("resource-loader model capability", () => {
 	});
 });
 
+describe("resource_loader refs read both the snake and the camelCase spelling", () => {
+	// Loader rows author snake_case column names (page_id, organisation_id,
+	// prepared_for) while the v8 ORM hands back camelCase keys (pageId,
+	// organisationId, preparedFor). readField reads the spelled key first
+	// then its camelCase equivalent so neither side has to know the other.
+	// Measured through the ORPC branch: what the dependent source's findFirst
+	// RECEIVES as its where IS the resolution of `:proposal.page_id`.
+	const original = isServerClientRegistered() ? getServerClient() : null;
+
+	test("a snake_case ref resolves against a camelCase parent record", async () => {
+		const captured: { where: unknown } = { where: null };
+		const calls: string[] = [];
+		setServerClient({
+			builda_pages: {
+				findFirst: async (args: { where: Record<string, unknown> }) => {
+					calls.push(JSON.stringify(args.where));
+					// First call: the proposal source (id lookup) returns a
+					// camelCase row, exactly what the v8 chain hands back.
+					if (calls.length === 1) {
+						return {
+							id: "p1",
+							pageId: "page-uuid",
+							organisationId: "org-uuid",
+							preparedFor: "Klavdia Vainshtein",
+						};
+					}
+					// Second call: the dependent page source.
+					captured.where = args.where;
+					return { id: "page-uuid" };
+				},
+			},
+		} as never);
+		try {
+			await resolveFromLoaderConfig(
+				{
+					sources: [
+						{
+							key: "proposal",
+							source: "orpc",
+							model: "builda_pages",
+							where: { id: ":id" },
+							optional: false,
+						},
+						{
+							key: "page",
+							source: "orpc",
+							model: "builda_pages",
+							where: { id: ":proposal.page_id" },
+							optional: false,
+							depends_on: ["proposal"],
+						},
+					],
+				},
+				{ id: "p1" },
+			);
+		} finally {
+			setServerClient(original as never);
+		}
+		// The dependent source queried WITH the resolved page id, not an
+		// emptied filter matching an arbitrary row.
+		expect(captured.where).toEqual({ id: "page-uuid" });
+	});
+
+	test("identity-name fields resolve unchanged (id, path, slug)", async () => {
+		const captured: { where: unknown } = { where: null };
+		const calls: string[] = [];
+		setServerClient({
+			builda_pages: {
+				findFirst: async (args: { where: Record<string, unknown> }) => {
+					calls.push(JSON.stringify(args.where));
+					if (calls.length === 1) {
+						return { id: "p1", path: "/header", websiteId: "w-1" };
+					}
+					captured.where = args.where;
+					return { id: "p1" };
+				},
+			},
+		} as never);
+		try {
+			await resolveFromLoaderConfig(
+				{
+					sources: [
+						{
+							key: "page",
+							source: "orpc",
+							model: "builda_pages",
+							where: { id: ":id" },
+							optional: false,
+						},
+						{
+							key: "footer",
+							source: "orpc",
+							model: "builda_pages",
+							where: { path: ":page.path", website_id: ":page.website_id" },
+							optional: false,
+							depends_on: ["page"],
+						},
+					],
+				},
+				{ id: "p1" },
+			);
+		} finally {
+			setServerClient(original as never);
+		}
+		// path (identity) and website_id (snake → camel websiteId) both
+		// resolve through the same readField walk.
+		expect(captured.where).toEqual({ path: "/header", website_id: "w-1" });
+	});
+});
+
 describe("required sources refuse unresolvable where refs", () => {
 	// The 2026-09-03 proposal outage class: interpolateTemplate DROPS a key
 	// whose ref resolves undefined, so a required source queries with a

package/src/resolve-from-loader-config.ts

@@ -66,11 +66,39 @@ function resolveParamRef(
 	let current: unknown = resolved;
 	for (const part of parts) {
 		if (current == null || typeof current !== "object") return undefined;
-		current = (current as Record<string, unknown>)[part];
+		current = readField(current as Record<string, unknown>, part);
 	}
 	return current;
 }
 
+/**
+ * A resource_loader row spells DATABASE COLUMN NAMES — `page_id`,
+ * `organisation_id`, `prepared_for` — because that is what the schema calls
+ * them. The ORM hands back CAMELCASE keys — `pageId`, `organisationId`,
+ * `preparedFor`. Nothing reconciled the two, so a `:proposal.page_id` ref read
+ * a key the object does not have and returned undefined.
+ *
+ * MEASURED 2026-09-03, and the consequence is far worse than a missing value.
+ * `interpolateTemplate` DROPS a key whose value is undefined, so a dependent
+ * source declared `where: { id: ":proposal.page_id" }` was issued as
+ * `where: {}` — and findFirst with an empty filter returns AN ARBITRARY FIRST
+ * ROW. A client proposal page therefore loaded an unrelated builda_page,
+ * rendered a stranger's content under the correct brand chrome, and answered
+ * 200 throughout. Instrumenting the live resolver showed every dependent
+ * source doing it: page, website, contact, partnerOrg and clientOrg all with
+ * `where={}`; only `proposal` was correct, because its ref is the URL param
+ * `:id` rather than a sibling source.
+ *
+ * Read the spelled key first, then its camelCase equivalent. Column names stay
+ * the authoring vocabulary and a row never has to know what the ORM did to its
+ * keys.
+ */
+function readField(source: Record<string, unknown>, key: string): unknown {
+	if (key in source) return source[key];
+	const camel = key.replace(/_([a-z0-9])/g, (_m, c: string) => c.toUpperCase());
+	return camel === key ? undefined : source[camel];
+}
+
 function interpolateTemplate(
 	template: unknown,
 	params: Record<string, unknown>,
@@ -191,11 +219,33 @@ async function resolveSource(
 		case "orpc":
 		case "prisma": {
 			if (!source.model) return null;
-			if (!source.optional && source.where) {
+			// OPTIONAL MEANS THE SOURCE MAY BE ABSENT. It has never meant the
+			// source may be A STRANGER'S ROW, and that is what an unfiltered
+			// query returns. This check previously guarded only REQUIRED
+			// sources, so every optional one whose ref failed to resolve issued
+			// `where: {}` and findFirst handed back an arbitrary first row.
+			//
+			// Measured 2026-09-03 on a live client proposal: page, website,
+			// contact, partnerOrg and clientOrg ALL queried with an empty where
+			// and loaded unrelated records, which then rendered as the page. The
+			// only correct source was `proposal`, whose ref is the URL param
+			// rather than a sibling. Nothing errored and the page answered 200.
+			//
+			// A dropped filter is now refused for every source that declared
+			// one. Required sources still throw; an optional source resolves to
+			// null — absent, which is exactly what optional promises.
+			if (source.where) {
 				const broken = unresolvedTemplateRefs(source.where, params, resolved);
 				if (broken.length > 0) {
+					const refs = broken.map((ref) => `:${ref}`).join(", ");
+					if (source.optional) {
+						getAppLogger().warn(
+							`[resource_loader] optional source "${source.key}": where ref(s) ${refs} resolved to undefined — treating the source as ABSENT rather than querying without them (an unfiltered read returns an arbitrary row)`,
+						);
+						return null;
+					}
 					throw new Error(
-						`[resource_loader] required source "${source.key}": where ref(s) ${broken.map((ref) => `:${ref}`).join(", ")} resolved to undefined — refusing to query without them (a dropped filter silently matches an arbitrary row)`,
+						`[resource_loader] required source "${source.key}": where ref(s) ${refs} resolved to undefined — refusing to query without them (a dropped filter silently matches an arbitrary row)`,
 					);
 				}
 			}

package/src/resolve-service-context.ts

@@ -27,13 +27,34 @@ export async function resolveServiceContext(
 	serviceSlug: string,
 	databaseUrl: string,
 ): Promise<ServiceContext> {
+	// THE V8 CLIENT REGISTERS FIRST — before any registry read. getPrisma()
+	// serves the v8 model-indexed adapter (a81b9f0a), so an early registry
+	// read (getCookieDomain in buildMinimalApp, loadRegistryEntries) that ran
+	// against a v7-only registration found no `.orm` surface: 43695 threw
+	// "model not in the v8 client" (fleet-wide boot crash) and 43696+ degraded
+	// to EMPTY rows ("Config entry cookie-domain not found" on a row that has
+	// existed since July). Registering the real v8 client HERE — the earliest
+	// boot step — makes every later read resolve against the client the
+	// adapter expects. Measured 2026-09-03: this ordering gap took down every
+	// UI service for the second half of the Prisma 8 migration night.
+	const { createDbClientV8 } = await import("@teamscala/db/create-db-client-v8");
+	const db8 = await createDbClientV8({
+		connectionString: databaseUrl,
+		serviceName: serviceSlug,
+	});
+	const { registerDb8 } = await import("@teamscala/db/db8-registry");
+	registerDb8(db8 as never);
+	registerPrismaClient(db8 as never);
+
 	const PrismaClientConstructor = await loadServicePrismaClient(serviceSlug);
 	const dbClient = await createDbClient({
 		connectionString: databaseUrl,
 		serviceName: serviceSlug,
 		PrismaClientConstructor: PrismaClientConstructor as never,
 	});
-	registerPrismaClient(dbClient.prisma as never as PrismaClient);
+	// The v7 client stays ONLY as the explicit per-call client (loadRegistry-
+	// Entries below, callers' disconnect) — it must NOT re-register, or the
+	// v7 registration overwrites the v8 one and the reads break again.
 	await loadRegistryEntries(dbClient.prisma as never);
 
 	const rowResult = await loadServiceInstallRow(serviceSlug);