@teamscala/service-boot 0.23.460 → 0.23.462

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.460",
+  "version": "0.23.462",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -372,14 +372,6 @@
       "types": "./src/csrf-protection.d.ts",
       "default": "./src/csrf-protection.ts"
     },
-    "./discover-blocks": {
-      "types": "./src/discover-blocks.d.ts",
-      "default": "./src/discover-blocks.ts"
-    },
-    "./discover-blocks.ts": {
-      "types": "./src/discover-blocks.d.ts",
-      "default": "./src/discover-blocks.ts"
-    },
     "./expand-roster": {
       "types": "./src/expand-roster.d.ts",
       "default": "./src/expand-roster.ts"
@@ -800,6 +792,14 @@
       "types": "./src/is-react-element-type.d.ts",
       "default": "./src/is-react-element-type.ts"
     },
+    "./load-page-manifest": {
+      "types": "./src/load-page-manifest.d.ts",
+      "default": "./src/load-page-manifest.ts"
+    },
+    "./load-page-manifest.ts": {
+      "types": "./src/load-page-manifest.d.ts",
+      "default": "./src/load-page-manifest.ts"
+    },
     "./load-service-install-row": {
       "types": "./src/load-service-install-row.d.ts",
       "default": "./src/load-service-install-row.ts"

package/src/load-page-manifest.ts

@@ -0,0 +1,64 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Loads the service's GENERATED `src/page-manifest.ts` — the codegen output of
+ * the `page-manifest` transform, emitted from `block_schema` rows. That file is
+ * the single artefact describing which Puck components this service renders.
+ *
+ * This REPLACES `discover-blocks.ts`, a hand-written runtime scan that queried
+ * block_schema at boot and dynamic-imported each row. Deleting it is the point.
+ * The scan was introduced to survive one dead row, and it bought that by moving
+ * a build-time, deterministic, generated fact into a runtime path with four
+ * independent ways to silently resolve nothing: a registry read that answers
+ * with an empty array instead of failing, an install probe that reports "not
+ * installed" for installed packages, a `node_modules` lookup relative to
+ * `process.cwd()`, and a per-block try/catch that swallows each failure into a
+ * string nobody reads when the boot dies first. Measured 2026-09-03: 91 active
+ * block_schema rows, a generated manifest carrying 63 blocks sitting on disk,
+ * and the scan loading ZERO — for hours, across every UI service.
+ *
+ * Generation is the platform's answer to exactly this (`one-generator-pattern`,
+ * `business-logic-is-rows-plus-executors`): a bad row fails codegen loudly, at
+ * build time, with the file in front of you. It cannot present as a service
+ * that boots and renders nothing.
+ */
+
+import { join } from "node:path";
+import type { RendererComponentEntry } from "./types.ts";
+
+interface PageManifestModule {
+	components?: Record<string, RendererComponentEntry>;
+}
+
+/**
+ * Reads the generated manifest's `components` export. Throws when the file is
+ * absent or exports nothing — an empty manifest means codegen has not run for
+ * this service, which is a build problem the operator must see named, not a
+ * degraded runtime state to paper over.
+ */
+export async function loadPageManifest(
+	serviceSlug: string,
+): Promise<Record<string, RendererComponentEntry>> {
+	const manifestPath = join(process.cwd(), "src", "page-manifest.ts");
+	let mod: PageManifestModule;
+	try {
+		mod = (await import(manifestPath)) as PageManifestModule;
+	} catch (err) {
+		throw new Error(
+			`[${serviceSlug}] could not import the generated manifest at ${manifestPath}: ` +
+				`${err instanceof Error ? err.message : String(err)}. ` +
+				`Run \`scala-tools codegen run --output ${serviceSlug}-page-manifest --force\`.`,
+		);
+	}
+
+	const components = mod.components;
+	if (!components || Object.keys(components).length === 0) {
+		throw new Error(
+			`[${serviceSlug}] the generated manifest at ${manifestPath} exports no components. ` +
+				`Regenerate it: \`scala-tools codegen run --output ${serviceSlug}-page-manifest --force\`.`,
+		);
+	}
+	return components;
+}

package/src/resolve-from-loader-config.ts

@@ -11,6 +11,7 @@
  * Params are interpolated from URL params and prior resolved data.
  */
 
+import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import type { ResolverFnKey } from "@teamscala/db/registry/generated/resolver-fn";
 import { ResolverFnConfigSchema } from "@teamscala/db-validation/registry-schemas/resolver-fn";

package/src/two-phase-minimal-app.ts

@@ -77,7 +77,7 @@ import {
 import { injectSecurityHeaders } from "./security-headers.ts";
 import { registerPageRoutes } from "./register-page-routes.ts";
 import { runBootHookList } from "./run-boot-hook-list.ts";
-import { discoverBlocks } from "./discover-blocks.ts";
+import { loadPageManifest } from "./load-page-manifest.ts";
 import { registerPageServerClient } from "./register-page-server-client.ts";
 import { createPhase1PageHandler, healthHandler } from "./two-phase-readiness.ts";
 
@@ -250,10 +250,10 @@ export async function buildMinimalApp(
 		registerPageServerClient(serviceSlug),
 	);
 
-	// NOW fire discoverBlocks (getServerClient is set). Awaited below before
-	// register-page-routes consumes the result.
-	const discoverPromise = runStep("discover-blocks", () =>
-		discoverBlocks(blockPackages),
+	// NOW load the generated manifest (getServerClient is set). Awaited below
+	// before register-page-routes consumes the result.
+	const discoverPromise = runStep("load-page-manifest", () =>
+		loadPageManifest(serviceSlug),
 	);
 
 	const wsRouteCount = await runStep("register-ws-routes", () =>
@@ -268,9 +268,9 @@ export async function buildMinimalApp(
 	// CRITICAL: Block discovery and page routes MUST be registered BEFORE serving,
 	// because Hono's RegExpRouter compiles on first request and becomes immutable.
 	// We defer only client asset building (expensive Vite build) to Phase 2.
-	let discovered: Awaited<ReturnType<typeof discoverBlocks>>;
+	let components: Awaited<ReturnType<typeof loadPageManifest>>;
 	try {
-		discovered = await discoverPromise;
+		components = await discoverPromise;
 	} catch (err) {
 		throw new BootFatalError(
 			"ui-service.page-manifest",
@@ -279,46 +279,10 @@ export async function buildMinimalApp(
 			err,
 		);
 	}
+	log.info(
+		`[two-phase-boot:${serviceSlug}] Loaded ${Object.keys(components).length} block(s) from the generated manifest`,
+	);
 
-	const { components, loaded, skipped } = discovered;
-	// REPORT THE DISCOVERY BEFORE JUDGING IT. This used to throw BootFatalError
-	// on `loaded.length === 0` ABOVE these two log lines, so the one boot that
-	// most needed the diagnosis was the only boot that printed none of it: the
-	// operator saw "Zero Puck components loaded" and nothing about WHICH rows
-	// were considered or WHY each was rejected. Measured 2026-09-03: 91 active
-	// block_schema rows, zero loaded, zero skip lines — and the absence of skip
-	// lines was itself unreadable, because "no candidate survived the install
-	// pre-filter" and "every candidate failed to import" are indistinguishable
-	// when neither prints. Hours went into re-deriving from outside the process
-	// what these lines already knew.
-	if (loaded.length > 0) {
-		log.info(
-			`[two-phase-boot:${serviceSlug}] Discovered ${loaded.length} block(s): ${loaded.join(", ")}`,
-		);
-	}
-	if (skipped.length > 0) {
-		log.warn(
-			`[two-phase-boot:${serviceSlug}] Skipped ${skipped.length} block_schema row(s) ` +
-				`(missing componentPath/componentExport or import failed): ${skipped.join(", ")}`,
-		);
-	}
-	// SOFT-CRASH, NEVER HARD-CRASH (operator ruling 2026-09-03: "it's meant to
-	// soft crash with errors, so why the fuck is it hard crashing"). A service
-	// that refuses to start serves NOTHING — no page, no health endpoint, no
-	// error page — so a block-discovery problem presents to a client as a 502
-	// from a dead port, which is strictly less information than a served page
-	// with its blocks missing. The degraded state is loud (ERROR, both counts,
-	// every skip reason) and inspectable over HTTP, which is what makes it
-	// fixable; refusing the boot only hid the cause. `no-uncontrolled-repetition-
-	// or-cascade` is unaffected — nothing restarts, the process stays up.
-	if (loaded.length === 0) {
-		log.error(
-			`[two-phase-boot:${serviceSlug}] DEGRADED: zero Puck components loaded ` +
-				`from ${skipped.length} considered block_schema row(s). Pages will render ` +
-				`without blocks until this is fixed. Check service_install.block_packages, ` +
-				`the block_schema rows, and the skip reasons logged above.`,
-		);
-	}
 
 	// Run boot hooks BEFORE serving - some hooks may register routes and must
 	// run before Hono's matcher is compiled by the first request
@@ -366,7 +330,10 @@ export async function buildMinimalApp(
 		databaseUrl,
 		blockPackages,
 		components,
-		loaded,
-		skipped,
+		// The generated manifest IS the loaded set — every entry it exports is a
+		// block this service renders, so there is no "skipped" half any more. A
+		// row that cannot produce a component fails codegen, not boot.
+		loaded: Object.keys(components),
+		skipped: [] as string[],
 	};
 }

package/src/discover-blocks.test.ts

@@ -1,20 +0,0 @@
-import { expect, test } from "bun:test";
-import { registerPrismaClient } from "@teamscala/db/prisma-registry";
-import type { PrismaClient } from "@teamscala/db/client";
-import { discoverBlocks } from "./discover-blocks.ts";
-
-test("block discovery reads the global registry through the registered database client", async () => {
-	let calls = 0;
-	registerPrismaClient({
-		registry_entries: {
-			findMany: async () => {
-				calls += 1;
-				return [];
-			},
-		},
-	} as unknown as PrismaClient);
-
-	const result = await discoverBlocks([]);
-	expect(calls).toBe(1);
-	expect(result).toEqual({ components: {}, loaded: [], skipped: [] });
-});

package/src/discover-blocks.ts

@@ -1,250 +0,0 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Surgical block discovery: at boot, queries every block_schema row in the
- * registry whose componentPath starts with one of the service's declared
- * block_packages, then dynamic-imports each one. Per-block try/catch — one
- * dead componentPath logs and skips, the rest still register and the page
- * renders the surviving blocks. This replaces the static
- * `.scala-install/page-manifest.ts` codegen output, which had the failure
- * mode of a single dead block_schema row crashing the whole manifest at
- * compile time.
- *
- * Empty block_packages is NOT fatal here: it falls back to scanning all
- * active block_schema (uninstalled packages skip via the per-block try/catch),
- * so a service whose row is unpopulated but whose blocks are installed still
- * renders. The real "booted with zero blocks" fail-closed is at the call site
- * (loaded.length === 0 → BootFatalError). A DB-unreachable error still throws —
- * no fallback to a package-side puckBlocks scan, which masked blockless boots.
- */
-
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { join } from "node:path";
-import { getPrisma } from "@teamscala/db/prisma-registry";
-import { queryActiveRegistryRows } from "@teamscala/db/registry/loader/query-rows";
-import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
-import * as v from "valibot";
-import { isReactElementType } from "./is-react-element-type.ts";
-import type { RendererComponentEntry } from "./types.ts";
-
-export interface DiscoveredBlocks {
-	components: Record<string, RendererComponentEntry>;
-	loaded: string[];
-	skipped: string[];
-}
-
-interface BlockSchemaConfig {
-	componentPath?: string;
-	componentExport?: string;
-	fields?: Record<string, unknown>;
-	defaults?: Record<string, unknown>;
-}
-
-export async function discoverBlocks(
-	blockPackages: string[],
-): Promise<DiscoveredBlocks> {
-	// Scope discovery to what is ACTUALLY INSTALLED, never the authored `block_packages` list. That list was an authored hint that silently
-	// DRIFTED: a page-used package missing from it caused its blocks to be skipped and rendered BLANK with only a warning (scala-sign, 2026-06-04 —
-	// SignIn / SignatureField / ScrollProgress all blanked because sign-in-block had fallen out of the list). The filesystem is the source of truth: a page
-	// can only compose blocks from packages installed as the service's
-	// dependencies, so "installed @teamgbg package" is always a correct superset
-	// of "packages the pages need". A block_schema whose package is installed is
-	// imported; an uninstalled one is skipped (its import would fail anyway).
-	// This makes an authored-list mistake STRUCTURALLY UNABLE to blank a
-	// page-used block. The install dir is also narrower than "all block_schema",
-	// so the 2026-05-29 empty-list-scans-everything incident cannot recur either.
-	const serviceModules = join(process.cwd(), "node_modules");
-	const installedCache = new Map<string, boolean>();
-	const isInstalled = async (pkg: string): Promise<boolean> => {
-		const cached = installedCache.get(pkg);
-		if (cached !== undefined) return cached;
-		// Probe the package's package.json, NOT its directory. Bun.file() on a
-		// DIRECTORY reports exists() === false, so the previous directory probe
-		// answered "not installed" for every package that was in fact installed
-		// — and because this predicate gates every block below, that skipped
-		// every block and booted the service with zero Puck components. Measured
-		// 2026-09-01: scala-portal, scala-public, scala-forms and scala-projects
-		// all FATAL at ui-service.page-manifest with their packages present on
-		// disk at the expected versions. A file probe is the correct shape.
-		const ok = await Bun.file(
-			join(serviceModules, ...pkg.split("/"), "package.json"),
-		).exists();
-		installedCache.set(pkg, ok);
-		return ok;
-	};
-	// `blockPackages` is retained only to surface authored-vs-installed drift to
-	// the operator; it no longer gates discovery, so it can never blank a block.
-	if (blockPackages.length > 0) {
-		const installed = await Promise.all(
-			blockPackages.map(async (p) => ({ p, ok: await isInstalled(p) })),
-		);
-		const stale = installed.filter((x) => !x.ok).map((x) => x.p);
-		if (stale.length > 0) {
-			getAppLogger().warn(
-				`[discover-blocks] block_packages lists ${stale.length} package(s) that are not installed (ignored): ${stale.join(", ")}`,
-			);
-		}
-	}
-
-	const components: Record<string, RendererComponentEntry> = {};
-	const loaded: string[] = [];
-	const skipped: string[] = [];
-
-	// Block schemas are global registry data, not a model owned by this UI
-	// service. The page-server ORPC client is intentionally service-scoped and
-	// therefore cannot expose registry_entries. Use the registered database
-	// client for this shared model, as every other registry reader does.
-	// READ THROUGH THE SHARED HELPER, NOT A SECOND HAND-WRITTEN QUERY. This
-	// used to call prisma.registry_entries.findMany directly with its own
-	// where clause — a duplicate of a read that already exists once in
-	// queryActiveRegistryRows and is exercised by every other registry reader.
-	//
-	// The duplicate returned an EMPTY ARRAY. Measured 2026-09-03: 91 active
-	// block_schema rows in the database, ZERO loaded, and not a single skip
-	// line logged — so the loop below never ran once. The helper resolves the
-	// same rows correctly because it falls back to raw SQL when the v8
-	// accessor cannot answer; the hand-written copy had no such path and its
-	// silence was indistinguishable from "there are no blocks".
-	//
-	// Every UI service then hit the fail-closed at the call site and refused to
-	// boot, so the operator saw nothing at all rather than "0 of 91 blocks".
-	// Two copies of one read, and the copy nobody exercised is the one that
-	// broke — delete it rather than repair it.
-	const rows = (await queryActiveRegistryRows(
-		getPrisma() as never,
-		{ type: "block_schema" },
-	)) as Array<{ slug: string; config: unknown }>;
-	rows.sort((a, b) => a.slug.localeCompare(b.slug));
-
-	// Parallel block discovery (no-serial-per-unit-work-on-hot-paths: boot is a
-	// recurring cycle via the package-poller's restarts). Previously each block's
-	// component was imported SERIALLY (sum of ~44 import times) under a 3s
-	// timeout — heavy blocks (e.g. AiChat with Plate) exceeded 3s, were SKIPPED
-	// at boot, and paid their full import at first render (cold-start cost).
-	// Bounded-parallel (chunks of 8) collapses boot to ceil(N/8) waves of the
-	// max import time, and the raised 8s timeout lets heavy blocks import at
-	// boot (shifted off the first render). `skipped`/`loaded`/`components`
-	// mutations are safe concurrently (single-threaded; atomic at await points).
-	const loadBlock = async (row: { slug: string; config: unknown }) => {
-		const rawConfig = parseConfig(row.config);
-		const rawComponentPath = getStringProperty(rawConfig, "componentPath");
-		const rawPackage = rawComponentPath
-			? rawComponentPath.split("/").slice(0, 2).join("/")
-			: null;
-		if (!rawPackage || !(await isInstalled(rawPackage))) {
-			skipped.push(
-				`${row.slug} (${rawPackage ?? "missing componentPath"} not installed)`,
-			);
-			return;
-		}
-
-		let cfg: BlockSchemaConfig;
-		try {
-			cfg = v.parse(BlockSchemaConfigSchema, rawConfig) as BlockSchemaConfig;
-		} catch (err) {
-			skipped.push(
-				`${row.slug} (invalid block_schema config: ${formatValidationError(err)})`,
-			);
-			return;
-		}
-
-		const componentPath = cfg.componentPath;
-		const componentExport = cfg.componentExport;
-		if (!componentPath || !componentExport) {
-			skipped.push(`${row.slug} (missing componentPath/componentExport)`);
-			return;
-		}
-		// Scope to installed packages: each block_schema's componentPath must
-		// start with a package present in the service's node_modules.
-		const pkgPrefix = componentPath.split("/").slice(0, 2).join("/");
-		if (!(await isInstalled(pkgPrefix))) {
-			skipped.push(`${row.slug} (${pkgPrefix} not installed)`);
-			return;
-		}
-		try {
-			const TIMEOUT_MS = 8_000;
-			const mod = (await Promise.race([
-				import(componentPath),
-				new Promise<never>((_, rej) =>
-					setTimeout(
-						() => rej(new Error(`import timeout >${TIMEOUT_MS}ms`)),
-						TIMEOUT_MS,
-					),
-				),
-			])) as Record<string, unknown>;
-			const component = mod[componentExport] ?? mod.default;
-			if (!isReactElementType(component)) {
-				skipped.push(
-					`${row.slug} (${componentExport} not a component in ${componentPath})`,
-				);
-				return;
-			}
-			components[row.slug] = {
-				render: component as RendererComponentEntry["render"],
-				fields: (cfg.fields ?? {}) as never,
-				// block_schema.defaults → the SSR component entry, so buildPuckConfig
-				// merges them UNDER authored props at render (blocks-fully-programmable:
-				// DB-declared defaults reach render, never a component parameter
-				// constant). Puck's RSC <Render> ignores defaultProps itself.
-				defaultProps: (cfg.defaults ?? {}) as never,
-			};
-			loaded.push(row.slug);
-		} catch (err) {
-			skipped.push(`${row.slug} (${(err as Error).message})`);
-		}
-	};
-	// Pre-filter to rows the service can actually import, so expected-absent
-	// blocks don't pollute the boot log as "skipped". A service (e.g.
-	// scala-projects) installs only a subset of the platform's ~45 blocks; the
-	// rest are expected-absent (their imports would fail anyway), not warnings.
-	// The filesystem remains the source of truth (block-discovery-scopes-by-
-	// install): an uninstalled block is simply not considered. Rows with a
-	// missing componentPath are kept so `loadBlock` still flags them (real data
-	// signal); `skipped` thus catches only genuine failures (installed package
-	// but import/config/export failed) and the call-site WARN becomes signal.
-	const candidateRows = [];
-	for (const row of rows) {
-		const cp = getStringProperty(parseConfig(row.config), "componentPath");
-		if (!cp) {
-			candidateRows.push(row);
-			continue;
-		}
-		const pkg = cp.split("/").slice(0, 2).join("/");
-		if (await isInstalled(pkg)) candidateRows.push(row);
-	}
-	// All blocks concurrent (module imports are in-process I/O + V8 compile — no
-	// fork tax, so bounded concurrency isn't needed here; the chunk-of-8 was
-	// needlessly serializing 44 imports into 6 waves when 1 wave suffices).
-	await Promise.all(candidateRows.map(loadBlock));
-
-	return { components, loaded, skipped };
-}
-
-function parseConfig(config: unknown): unknown {
-	if (typeof config !== "string") return config;
-	try {
-		return JSON.parse(config) as unknown;
-	} catch {
-		// Malformed JSON string → absent signal, never the raw string: the caller's
-		// valibot parse then fails and the block is skipped (fail-closed), rather
-		// than a non-object masquerading as config (protective-layers-fail-explicitly).
-		return null;
-	}
-}
-
-function getStringProperty(value: unknown, key: string): string | null {
-	if (!value || typeof value !== "object") return null;
-	const maybe = (value as Record<string, unknown>)[key];
-	return typeof maybe === "string" ? maybe : null;
-}
-
-function formatValidationError(err: unknown): string {
-	if (err && typeof err === "object" && "issues" in err) {
-		const issues = (err as { issues?: Array<{ message?: string }> }).issues;
-		const first = Array.isArray(issues) ? issues[0]?.message : undefined;
-		if (first) return first;
-	}
-	return err instanceof Error ? err.message : String(err);
-}