@teamscala/service-boot 0.23.458 → 0.23.459

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.458",
+  "version": "0.23.459",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/discover-blocks.ts

@@ -23,6 +23,7 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { join } from "node:path";
 import { getPrisma } from "@teamscala/db/prisma-registry";
+import { queryActiveRegistryRows } from "@teamscala/db/registry/loader/query-rows";
 import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
 import * as v from "valibot";
 import { isReactElementType } from "./is-react-element-type.ts";
@@ -95,13 +96,27 @@ export async function discoverBlocks(
 	// service. The page-server ORPC client is intentionally service-scoped and
 	// therefore cannot expose registry_entries. Use the registered database
 	// client for this shared model, as every other registry reader does.
-	const prisma = getPrisma();
-	const rows: Array<{ slug: string; config: unknown }> =
-		await prisma.registry_entries.findMany({
-			where: { type: "block_schema", is_active: true },
-			select: { slug: true, config: true },
-			orderBy: { slug: "asc" },
-		});
+	// READ THROUGH THE SHARED HELPER, NOT A SECOND HAND-WRITTEN QUERY. This
+	// used to call prisma.registry_entries.findMany directly with its own
+	// where clause — a duplicate of a read that already exists once in
+	// queryActiveRegistryRows and is exercised by every other registry reader.
+	//
+	// The duplicate returned an EMPTY ARRAY. Measured 2026-09-03: 91 active
+	// block_schema rows in the database, ZERO loaded, and not a single skip
+	// line logged — so the loop below never ran once. The helper resolves the
+	// same rows correctly because it falls back to raw SQL when the v8
+	// accessor cannot answer; the hand-written copy had no such path and its
+	// silence was indistinguishable from "there are no blocks".
+	//
+	// Every UI service then hit the fail-closed at the call site and refused to
+	// boot, so the operator saw nothing at all rather than "0 of 91 blocks".
+	// Two copies of one read, and the copy nobody exercised is the one that
+	// broke — delete it rather than repair it.
+	const rows = (await queryActiveRegistryRows(
+		getPrisma() as never,
+		{ type: "block_schema" },
+	)) as Array<{ slug: string; config: unknown }>;
+	rows.sort((a, b) => a.slug.localeCompare(b.slug));
 
 	// Parallel block discovery (no-serial-per-unit-work-on-hot-paths: boot is a
 	// recurring cycle via the package-poller's restarts). Previously each block's

package/src/resolve-from-loader-config.ts

@@ -66,11 +66,39 @@ function resolveParamRef(
 	let current: unknown = resolved;
 	for (const part of parts) {
 		if (current == null || typeof current !== "object") return undefined;
-		current = (current as Record<string, unknown>)[part];
+		current = readField(current as Record<string, unknown>, part);
 	}
 	return current;
 }
 
+/**
+ * A resource_loader row spells DATABASE COLUMN NAMES — `page_id`,
+ * `organisation_id`, `prepared_for` — because that is what the schema calls
+ * them. The ORM hands back CAMELCASE keys — `pageId`, `organisationId`,
+ * `preparedFor`. Nothing reconciled the two, so a `:proposal.page_id` ref read
+ * a key the object does not have and returned undefined.
+ *
+ * MEASURED 2026-09-03, and the consequence is far worse than a missing value.
+ * `interpolateTemplate` DROPS a key whose value is undefined, so a dependent
+ * source declared `where: { id: ":proposal.page_id" }` was issued as
+ * `where: {}` — and findFirst with an empty filter returns AN ARBITRARY FIRST
+ * ROW. A client proposal page therefore loaded an unrelated builda_page,
+ * rendered a stranger's content under the correct brand chrome, and answered
+ * 200 throughout. Instrumenting the live resolver showed every dependent
+ * source doing it: page, website, contact, partnerOrg and clientOrg all with
+ * `where={}`; only `proposal` was correct, because its ref is the URL param
+ * `:id` rather than a sibling source.
+ *
+ * Read the spelled key first, then its camelCase equivalent. Column names stay
+ * the authoring vocabulary and a row never has to know what the ORM did to its
+ * keys.
+ */
+function readField(source: Record<string, unknown>, key: string): unknown {
+	if (key in source) return source[key];
+	const camel = key.replace(/_([a-z0-9])/g, (_m, c: string) => c.toUpperCase());
+	return camel === key ? undefined : source[camel];
+}
+
 function interpolateTemplate(
 	template: unknown,
 	params: Record<string, unknown>,
@@ -191,11 +219,33 @@ async function resolveSource(
 		case "orpc":
 		case "prisma": {
 			if (!source.model) return null;
-			if (!source.optional && source.where) {
+			// OPTIONAL MEANS THE SOURCE MAY BE ABSENT. It has never meant the
+			// source may be A STRANGER'S ROW, and that is what an unfiltered
+			// query returns. This check previously guarded only REQUIRED
+			// sources, so every optional one whose ref failed to resolve issued
+			// `where: {}` and findFirst handed back an arbitrary first row.
+			//
+			// Measured 2026-09-03 on a live client proposal: page, website,
+			// contact, partnerOrg and clientOrg ALL queried with an empty where
+			// and loaded unrelated records, which then rendered as the page. The
+			// only correct source was `proposal`, whose ref is the URL param
+			// rather than a sibling. Nothing errored and the page answered 200.
+			//
+			// A dropped filter is now refused for every source that declared
+			// one. Required sources still throw; an optional source resolves to
+			// null — absent, which is exactly what optional promises.
+			if (source.where) {
 				const broken = unresolvedTemplateRefs(source.where, params, resolved);
 				if (broken.length > 0) {
+					const refs = broken.map((ref) => `:${ref}`).join(", ");
+					if (source.optional) {
+						getAppLogger().warn(
+							`[resource_loader] optional source "${source.key}": where ref(s) ${refs} resolved to undefined — treating the source as ABSENT rather than querying without them (an unfiltered read returns an arbitrary row)`,
+						);
+						return null;
+					}
 					throw new Error(
-						`[resource_loader] required source "${source.key}": where ref(s) ${broken.map((ref) => `:${ref}`).join(", ")} resolved to undefined — refusing to query without them (a dropped filter silently matches an arbitrary row)`,
+						`[resource_loader] required source "${source.key}": where ref(s) ${refs} resolved to undefined — refusing to query without them (a dropped filter silently matches an arbitrary row)`,
 					);
 				}
 			}