@teamscala/service-boot 0.23.458 → 0.23.460

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.458",
+  "version": "0.23.460",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/discover-blocks.ts

@@ -23,6 +23,7 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { join } from "node:path";
 import { getPrisma } from "@teamscala/db/prisma-registry";
+import { queryActiveRegistryRows } from "@teamscala/db/registry/loader/query-rows";
 import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
 import * as v from "valibot";
 import { isReactElementType } from "./is-react-element-type.ts";
@@ -95,13 +96,27 @@ export async function discoverBlocks(
 	// service. The page-server ORPC client is intentionally service-scoped and
 	// therefore cannot expose registry_entries. Use the registered database
 	// client for this shared model, as every other registry reader does.
-	const prisma = getPrisma();
-	const rows: Array<{ slug: string; config: unknown }> =
-		await prisma.registry_entries.findMany({
-			where: { type: "block_schema", is_active: true },
-			select: { slug: true, config: true },
-			orderBy: { slug: "asc" },
-		});
+	// READ THROUGH THE SHARED HELPER, NOT A SECOND HAND-WRITTEN QUERY. This
+	// used to call prisma.registry_entries.findMany directly with its own
+	// where clause — a duplicate of a read that already exists once in
+	// queryActiveRegistryRows and is exercised by every other registry reader.
+	//
+	// The duplicate returned an EMPTY ARRAY. Measured 2026-09-03: 91 active
+	// block_schema rows in the database, ZERO loaded, and not a single skip
+	// line logged — so the loop below never ran once. The helper resolves the
+	// same rows correctly because it falls back to raw SQL when the v8
+	// accessor cannot answer; the hand-written copy had no such path and its
+	// silence was indistinguishable from "there are no blocks".
+	//
+	// Every UI service then hit the fail-closed at the call site and refused to
+	// boot, so the operator saw nothing at all rather than "0 of 91 blocks".
+	// Two copies of one read, and the copy nobody exercised is the one that
+	// broke — delete it rather than repair it.
+	const rows = (await queryActiveRegistryRows(
+		getPrisma() as never,
+		{ type: "block_schema" },
+	)) as Array<{ slug: string; config: unknown }>;
+	rows.sort((a, b) => a.slug.localeCompare(b.slug));
 
 	// Parallel block discovery (no-serial-per-unit-work-on-hot-paths: boot is a
 	// recurring cycle via the package-poller's restarts). Previously each block's

package/src/resolve-from-loader-config.ts

@@ -66,11 +66,39 @@ function resolveParamRef(
 	let current: unknown = resolved;
 	for (const part of parts) {
 		if (current == null || typeof current !== "object") return undefined;
-		current = (current as Record<string, unknown>)[part];
+		current = readField(current as Record<string, unknown>, part);
 	}
 	return current;
 }
 
+/**
+ * A resource_loader row spells DATABASE COLUMN NAMES — `page_id`,
+ * `organisation_id`, `prepared_for` — because that is what the schema calls
+ * them. The ORM hands back CAMELCASE keys — `pageId`, `organisationId`,
+ * `preparedFor`. Nothing reconciled the two, so a `:proposal.page_id` ref read
+ * a key the object does not have and returned undefined.
+ *
+ * MEASURED 2026-09-03, and the consequence is far worse than a missing value.
+ * `interpolateTemplate` DROPS a key whose value is undefined, so a dependent
+ * source declared `where: { id: ":proposal.page_id" }` was issued as
+ * `where: {}` — and findFirst with an empty filter returns AN ARBITRARY FIRST
+ * ROW. A client proposal page therefore loaded an unrelated builda_page,
+ * rendered a stranger's content under the correct brand chrome, and answered
+ * 200 throughout. Instrumenting the live resolver showed every dependent
+ * source doing it: page, website, contact, partnerOrg and clientOrg all with
+ * `where={}`; only `proposal` was correct, because its ref is the URL param
+ * `:id` rather than a sibling source.
+ *
+ * Read the spelled key first, then its camelCase equivalent. Column names stay
+ * the authoring vocabulary and a row never has to know what the ORM did to its
+ * keys.
+ */
+function readField(source: Record<string, unknown>, key: string): unknown {
+	if (key in source) return source[key];
+	const camel = key.replace(/_([a-z0-9])/g, (_m, c: string) => c.toUpperCase());
+	return camel === key ? undefined : source[camel];
+}
+
 function interpolateTemplate(
 	template: unknown,
 	params: Record<string, unknown>,
@@ -191,11 +219,33 @@ async function resolveSource(
 		case "orpc":
 		case "prisma": {
 			if (!source.model) return null;
-			if (!source.optional && source.where) {
+			// OPTIONAL MEANS THE SOURCE MAY BE ABSENT. It has never meant the
+			// source may be A STRANGER'S ROW, and that is what an unfiltered
+			// query returns. This check previously guarded only REQUIRED
+			// sources, so every optional one whose ref failed to resolve issued
+			// `where: {}` and findFirst handed back an arbitrary first row.
+			//
+			// Measured 2026-09-03 on a live client proposal: page, website,
+			// contact, partnerOrg and clientOrg ALL queried with an empty where
+			// and loaded unrelated records, which then rendered as the page. The
+			// only correct source was `proposal`, whose ref is the URL param
+			// rather than a sibling. Nothing errored and the page answered 200.
+			//
+			// A dropped filter is now refused for every source that declared
+			// one. Required sources still throw; an optional source resolves to
+			// null — absent, which is exactly what optional promises.
+			if (source.where) {
 				const broken = unresolvedTemplateRefs(source.where, params, resolved);
 				if (broken.length > 0) {
+					const refs = broken.map((ref) => `:${ref}`).join(", ");
+					if (source.optional) {
+						getAppLogger().warn(
+							`[resource_loader] optional source "${source.key}": where ref(s) ${refs} resolved to undefined — treating the source as ABSENT rather than querying without them (an unfiltered read returns an arbitrary row)`,
+						);
+						return null;
+					}
 					throw new Error(
-						`[resource_loader] required source "${source.key}": where ref(s) ${broken.map((ref) => `:${ref}`).join(", ")} resolved to undefined — refusing to query without them (a dropped filter silently matches an arbitrary row)`,
+						`[resource_loader] required source "${source.key}": where ref(s) ${refs} resolved to undefined — refusing to query without them (a dropped filter silently matches an arbitrary row)`,
 					);
 				}
 			}

package/src/two-phase-minimal-app.ts

@@ -281,13 +281,16 @@ export async function buildMinimalApp(
 	}
 
 	const { components, loaded, skipped } = discovered;
-	if (loaded.length === 0) {
-		throw new BootFatalError(
-			"ui-service.page-manifest",
-			serviceSlug,
-			"Zero Puck components loaded from src/page-manifest.ts. Fix service_install.block_packages or block_schema, regenerate the page manifest, then boot again.",
-		);
-	}
+	// REPORT THE DISCOVERY BEFORE JUDGING IT. This used to throw BootFatalError
+	// on `loaded.length === 0` ABOVE these two log lines, so the one boot that
+	// most needed the diagnosis was the only boot that printed none of it: the
+	// operator saw "Zero Puck components loaded" and nothing about WHICH rows
+	// were considered or WHY each was rejected. Measured 2026-09-03: 91 active
+	// block_schema rows, zero loaded, zero skip lines — and the absence of skip
+	// lines was itself unreadable, because "no candidate survived the install
+	// pre-filter" and "every candidate failed to import" are indistinguishable
+	// when neither prints. Hours went into re-deriving from outside the process
+	// what these lines already knew.
 	if (loaded.length > 0) {
 		log.info(
 			`[two-phase-boot:${serviceSlug}] Discovered ${loaded.length} block(s): ${loaded.join(", ")}`,
@@ -299,6 +302,23 @@ export async function buildMinimalApp(
 				`(missing componentPath/componentExport or import failed): ${skipped.join(", ")}`,
 		);
 	}
+	// SOFT-CRASH, NEVER HARD-CRASH (operator ruling 2026-09-03: "it's meant to
+	// soft crash with errors, so why the fuck is it hard crashing"). A service
+	// that refuses to start serves NOTHING — no page, no health endpoint, no
+	// error page — so a block-discovery problem presents to a client as a 502
+	// from a dead port, which is strictly less information than a served page
+	// with its blocks missing. The degraded state is loud (ERROR, both counts,
+	// every skip reason) and inspectable over HTTP, which is what makes it
+	// fixable; refusing the boot only hid the cause. `no-uncontrolled-repetition-
+	// or-cascade` is unaffected — nothing restarts, the process stays up.
+	if (loaded.length === 0) {
+		log.error(
+			`[two-phase-boot:${serviceSlug}] DEGRADED: zero Puck components loaded ` +
+				`from ${skipped.length} considered block_schema row(s). Pages will render ` +
+				`without blocks until this is fixed. Check service_install.block_packages, ` +
+				`the block_schema rows, and the skip reasons logged above.`,
+		);
+	}
 
 	// Run boot hooks BEFORE serving - some hooks may register routes and must
 	// run before Hono's matcher is compiled by the first request