@teamscala/service-boot 0.23.481 → 0.23.492

package/src/fn-routers/email-defaults.ts

@@ -1,28 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Hot snapshot of `email-defaults.default_sender` (outbound transactional
- * from-address). Replaces the former process.env.DEFAULT_EMAIL_SENDER read.
- * Invalidated by NOTIFY on `registry_config_changed`; `staleAfterMs` is the
- * safety ceiling for an upstream regression that drops notifications.
- */
-import { createNotifyCache } from "@teamscala/notify-cache/create-notify-cache";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import * as v from "valibot";
-
-const FALLBACK_SENDER = "noreply@gateway.scala.business";
-const defaultSenderCache = createNotifyCache<string>({
-	name: "service-boot:default-email-sender",
-	load: async () => {
-		const row = await loadRegistryConfig("config", "email-defaults", v.looseObject({}));
-		return (row?.default_sender as string | undefined) ?? FALLBACK_SENDER;
-	},
-	invalidateOn: ["registry_config_changed"],
-	staleAfterMs: 5 * 60 * 1000,
-});
-
-export async function getDefaultEmailSender(): Promise<string> {
-	return defaultSenderCache.get();
-}

package/src/fn-routers/email-link-ttl.ts

@@ -1,28 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Hot snapshot of `email-links.email_link_ttl_ms` (magic-link validity
- * window, dedup'd across the 3 fn-routers that mint them). Replaces the
- * former per-file EMAIL_LINK_TTL_MS constant. Invalidated by NOTIFY on
- * `registry_config_changed`.
- */
-import { createNotifyCache } from "@teamscala/notify-cache/create-notify-cache";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import * as v from "valibot";
-
-const DEFAULT_EMAIL_LINK_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-const emailLinkTtlCache = createNotifyCache<number>({
-	name: "service-boot:email-link-ttl",
-	load: async () => {
-		const row = await loadRegistryConfig("config", "email-links", v.looseObject({}));
-		return (row?.email_link_ttl_ms as number | undefined) ?? DEFAULT_EMAIL_LINK_TTL_MS;
-	},
-	invalidateOn: ["registry_config_changed"],
-	staleAfterMs: 5 * 60 * 1000,
-});
-
-export async function getEmailLinkTtlMs(): Promise<number> {
-	return emailLinkTtlCache.get();
-}

package/src/fn-routers/index.ts

@@ -1,76 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Composes auth, tasks, work-items, plans, chat-session, public-gpt-session,
- * public-agreement, and user-preferences routers into the `fn` namespace and
- * registers it via registerCustomRouter.
- * Called at boot by registerFnRouters() — invoked before any ORPC dispatch.
- *
- * Also exposes the `regions` namespace on the client /api/rpc mount: a single
- * `loadPage` procedure (reusing puckPagesRouter.loadFromWebsite) so a client
- * RegionPageSwap can fetch a region's Puck page on demand and render it into a
- * slot — the no-reload half of `region-views-are-pages` (every region is a Puck
- * page; switching a view loads a different page's content).
- *
- * `resolvePanelData` WAS RESTORED 2026-08-31. `72ac1a7` ("Retire unoffered page
- * ORPC procedures") deleted it three weeks earlier as unoffered, but its
- * consumer is live and in ANOTHER REPO: `use-region-page.ts` in
- * @teamscala/ui-foundation calls `regions.resolvePanelData` on every panel
- * open. Only the comment describing it was left behind — the shape
- * `a-deleted-producer-leaves-its-consumers-executing` names, where deleting a
- * producer leaves its consumers demanding something that can no longer exist.
- *
- * It failed SILENTLY for three weeks because the client treats a failure as
- * best-effort and maps it to null, so the 404 rendered an empty panel with no
- * error anywhere. Observed live as `POST /api/rpc/regions/resolvePanelData 404`
- * on every panel open on projects-dev.
- */
-
-import { registerCustomRouter } from "@teamscala/orpc/app-router";
-import { puckPagesRouter } from "../page-server-orpc/puck-pages-router";
-import { resolvePanelDataHandler } from "./panel-data-router.ts";
-import { watchDataChange } from "@teamscala/realtime-utils/data-change-procedure";
-import { watchPresence } from "@teamscala/realtime-utils/presence-procedure";
-import { agreementSendRouter } from "./agreement-send-router.ts";
-import { chatSessionRouter } from "./chat-session-router.ts";
-import { proposalSendRouter } from "./proposal-send-router.ts";
-import { publicAgreementRouter } from "./public-agreement-router.ts";
-import { publicAssessmentRouter } from "./public-assessment-router.ts";
-import { publicGptSessionRouter } from "./public-gpt-session-router.ts";
-import { signInFlowRouter } from "./sign-in-flow-router.ts";
-import { userPreferencesRouter } from "./user-preferences-router.ts";
-import { workItemsRouter } from "./work-items-router.ts";
-import { messagingWhatsappRouter } from "./messaging-whatsapp-router.ts";
-
-// fn.cacheAdmin.* and fn.auth.* are ROW-COMPOSED now: api_route rows
-// (handler_type "orpc_fn") are rendered into the service's generated ORPC
-// bundle (routers/fn.ts) by orpc-bundle@1.0.0 and merged into the app router
-// by getAppRouter. Register them by editing ROWS, never by re-adding
-// handwritten routers here. Convert the remaining families the same way.
-export function registerFnRouters(): void {
-	registerCustomRouter("fn", {
-		agreementSend: agreementSendRouter,
-		proposalSend: proposalSendRouter,
-		chatSession: chatSessionRouter,
-		messagingWhatsappSend: messagingWhatsappRouter.messagingWhatsappSend,
-		publicAgreement: publicAgreementRouter,
-		publicAssessment: publicAssessmentRouter,
-		publicGptSession: publicGptSessionRouter,
-		signInFlow: signInFlowRouter,
-		workItems: workItemsRouter,
-		userPreferences: userPreferencesRouter,
-	});
-	registerCustomRouter("regions", {
-		loadPage: puckPagesRouter.loadFromWebsite,
-		// Resolve a page-kind panel's OWN loaderData (panel_view.loader_slug) so a
-		// panel region renders against the panel page's data, not the host's.
-		//
-		resolvePanelData: resolvePanelDataHandler,
-	});
-	registerCustomRouter("realtime", {
-		watchDataChange,
-		watchPresence,
-	});
-}

package/src/fn-routers/linkedin-identity.test.ts

@@ -1,27 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { normaliseLinkedinIdentity } from "./linkedin-identity.ts";
-
-describe("normaliseLinkedinIdentity", () => {
-	test("collapses every spelling of the same profile to one key", () => {
-		expect(normaliseLinkedinIdentity("https://www.linkedin.com/in/annaosherov/")).toBe(
-			"linkedin.com/in/annaosherov",
-		);
-		expect(normaliseLinkedinIdentity("linkedin.com/in/AnnaOsherov")).toBe(
-			"linkedin.com/in/annaosherov",
-		);
-		expect(normaliseLinkedinIdentity("  LinkedIn.com/in/annaosherov/ ")).toBe(
-			"linkedin.com/in/annaosherov",
-		);
-		expect(normaliseLinkedinIdentity("http://www.linkedin.com/in/annaosherov")).toBe(
-			"linkedin.com/in/annaosherov",
-		);
-	});
-
-	test("refuses non-linkedin, empty and absent input rather than guessing a key", () => {
-		expect(normaliseLinkedinIdentity("https://example.com/in/someone")).toBeNull();
-		expect(normaliseLinkedinIdentity("   ")).toBeNull();
-		expect(normaliseLinkedinIdentity("")).toBeNull();
-		expect(normaliseLinkedinIdentity(null)).toBeNull();
-		expect(normaliseLinkedinIdentity(undefined)).toBeNull();
-	});
-});

package/src/fn-routers/linkedin-identity.ts

@@ -1,36 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten @indivisible-unit owner=lane/unified-authority-index-report reason="one identity normalisation shared by the research writer and the report pairing lookup — a second spelling of the rule is the drift the pairing exists to prevent"
- * @edit edit directly
- *
- * linkedin-identity.ts — the ONE normalisation from a LinkedIn profile URL to
- * the pairing key that joins research passes to quiz responses.
- *
- * WHY IT EXISTS AS A SHARED UNIT (operator pin, 2026-09-04): the same person
- * arrives as `https://www.linkedin.com/in/annaosherov/` on a quiz response and
- * as `linkedin.com/in/AnnaOsherov` in a research note. Both sides MUST
- * collapse to the same `identity_key` or the report renders one half of the
- * person. The normalisation therefore lives here, exported once, and every
- * surface that writes or looks up an identity key calls THIS function — a
- * second local copy of the rule is the drift the pairing exists to prevent.
- *
- * Rule: trim; lowercase; strip the scheme (http/https); strip a leading
- * `www.`; strip one trailing slash. Everything else is kept verbatim, so
- * `linkedin.com/in/annaosherov` and a custom slug both survive intact.
- * Non-LinkedIn or empty input returns null — callers refuse rather than pair
- * on a guessed key.
- */
-
-export function normaliseLinkedinIdentity(
-	rawUrl: string | null | undefined,
-): string | null {
-	if (typeof rawUrl !== "string") return null;
-	let value = rawUrl.trim().toLowerCase();
-	if (value.length === 0) return null;
-	value = value.replace(/^https?:\/\//, "");
-	value = value.replace(/^www\./, "");
-	value = value.replace(/\/+$/, "");
-	if (value.length === 0) return null;
-	if (!value.includes("linkedin.com")) return null;
-	return value;
-}

package/src/fn-routers/messaging-whatsapp-router.test.ts

@@ -1,121 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Proves fn.messagingWhatsappSend routes through scala-messaging-service: the
- * URL is DERIVED from the service_install row (never spelled), the sealed-row
- * credential is passed through the decrypt mock (identity, matching the
- * public-assessment-router test pattern), the request carries the internal
- * auth header, and the caller receives WhatsApp's message_id — the only thing
- * that makes delivery provable. Failure modes (401, blank input) fail loudly
- * with named causes, never a generic send error.
- */
-
-import { createRouterClient } from "@orpc/server";
-import { afterAll, describe, expect, mock, test } from "bun:test";
-
-const SEND_CALLS: Array<{ url: string; headers: Record<string, string>; body: unknown }> = [];
-
-mock.module("@teamscala/db/registry/load-config", () => ({
-	loadRegistryConfig: async (type: string, slug: string) => {
-		if (type === "config" && slug === "messaging-service-internal-url") {
-			return { internalBaseUrl: "http://scala-messaging-rust.railway.internal:8080" };
-		}
-		if (type === "secret" && slug === "railway-scala-messaging-whatsapp-webhook-secret") {
-			return { token: "test-token" };
-		}
-		throw new Error(`unexpected loadRegistryConfig(${type}, ${slug})`);
-	},
-}));
-
-// Identity decrypt (the public-assessment-router test pattern).
-mock.module("@teamscala/encryption/crypto/secret-config", () => ({
-	decryptSecretConfig: (raw: unknown) => raw,
-}));
-
-mock.module("@teamscala/logger/app-loggers", () => ({
-	getAppLogger: () => ({
-		info: () => {},
-		warn: () => {},
-		error: () => {},
-		debug: () => {},
-	}),
-}));
-
-const originalFetch = globalThis.fetch;
-(globalThis as { fetch: unknown }).fetch = async (url: string, init: RequestInit) => {
-	SEND_CALLS.push({
-		url,
-		headers: init.headers as Record<string, string>,
-		body: JSON.parse(init.body as string),
-	});
-	const body = JSON.parse(init.body as string) as { phone?: string };
-	if (body.phone === "0-0-1-refuse") {
-		return new Response("no", { status: 401 });
-	}
-	return Response.json({ ok: true, sent: true, messageId: "3EB07EE8TESTID" });
-};
-
-const { messagingWhatsappRouter } = await import("./messaging-whatsapp-router.ts");
-
-// Invoke through a real ORPC client so the authed middleware runs too —
-// calling the DecoratedProcedure directly is not a round trip.
-const client = createRouterClient(
-	{ messagingWhatsappSend: messagingWhatsappRouter.messagingWhatsappSend } as never,
-	{
-		context: {
-			user: { id: "system", organisationId: null },
-			headers: new Headers(),
-			// The authed base now sets the RLS/audit context per request; the
-			// mock only needs to accept the SET statements.
-			prisma: { $executeRawUnsafe: async () => [] },
-		} as never,
-	},
-) as { messagingWhatsappSend: (a: unknown) => Promise<unknown> };
-
-describe("fn.messagingWhatsappSend", () => {
-	test("derives the URL from the config row, sends with the decrypted header value, returns the message_id", async () => {
-		SEND_CALLS.length = 0;
-		const result = await client.messagingWhatsappSend({
-			phone: "61428193498",
-			message: "migration probe",
-		});
-
-		expect(SEND_CALLS).toHaveLength(1);
-		expect(SEND_CALLS[0]?.url).toBe(
-			"http://scala-messaging-rust.railway.internal:8080/api/messaging/whatsapp/send",
-		);
-		expect(SEND_CALLS[0]?.headers["x-webhook-secret"]).toBe("test-token");
-		expect(SEND_CALLS[0]?.body).toEqual({ phone: "61428193498", message: "migration probe" });
-		expect(result).toEqual({ ok: true, message_id: "3EB07EE8TESTID" });
-	});
-
-	test("a 401 from the messaging service names the credential, not a generic failure", async () => {
-		SEND_CALLS.length = 0;
-		const result = await client.messagingWhatsappSend({
-			phone: "0-0-1-refuse",
-			message: "x",
-		});
-		expect(result).toEqual({
-			ok: false,
-			error: "messaging service refused the webhook secret (401)",
-		});
-	});
-
-	test("blank phone or message is refused before any request is made", async () => {
-		SEND_CALLS.length = 0;
-		const blank = await client.messagingWhatsappSend({
-			phone: "   ",
-			message: "x",
-		});
-		expect(blank).toEqual({ ok: false, error: "phone and message are required" });
-		expect(SEND_CALLS).toHaveLength(0);
-	});
-});
-
-// Restore INSIDE afterAll — a top-level restore would run before the tests
-// (all top-level code executes first) and hand the router back the real fetch.
-afterAll(() => {
-	(globalThis as { fetch: unknown }).fetch = originalFetch;
-});

package/src/fn-routers/messaging-whatsapp-router.ts

@@ -1,200 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * fn.messagingWhatsappSend — the agent-facing WhatsApp send that routes through
- * scala-messaging-service (the Rust owner of the channel), replacing the
- * retired TS @teamscala/api-gowa SDK send path (operator ruling 2026-08-26:
- * "make sure the migration is finished, i cant have half ts and half rust").
- *
- * The messaging service's POST /api/messaging/whatsapp/send is the single send
- * surface: it resolves the sending device, returns WhatsApp's message_id for
- * delivery correlation, and records the send in messaging_logs itself (Rust,
- * `write_outbound_tracked`) — better than the deleted TS recorder, which only
- * ran when the send happened to flow through tool-executor.
- *
- * Both facts this procedure needs are DERIVED at call time, never spelled:
- * - the service URL comes from the service_install row (slug + port +
- *   deploy_target → Railway private DNS <slug>.railway.internal:<port>), the
- *   same derivation every *.railway.internal consumer uses;
- * - the auth credential is the existing sealed secret row
- *   railway-scala-messaging-whatsapp-webhook-secret, decrypted per
- *   registry-via-helper + the agreement-send precedent.
- *
- * Registered flat under the `fn` namespace (two-segment procedure
- * "fn.messagingWhatsappSend") because the tool-executor ORPC dispatch resolves
- * "model.method" — nested routers would not be reachable as a tool procedure.
- */
-
-import { os } from "@orpc/server";
-import * as v from "valibot";
-import {
-	decryptSecretConfig,
-	type SecretConfigLike,
-} from "@teamscala/encryption/crypto/secret-config";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import type { PrismaClient } from "@teamscala/db/client";
-import { resetRlsContext, setRlsContext } from "@teamscala/db/rls-context";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-
-interface User {
-	id: string;
-	organisationId: string | null;
-}
-
-interface Context {
-	user: User | null | undefined;
-	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<User | null>;
-	prisma: PrismaClient;
-}
-
-const authed = os.$context<Context>().use(async (opt) => {
-	const { context } = opt;
-	let user = context.user;
-	if (!user && context.headers && context.resolveUser) {
-		user = await context.resolveUser(context.headers, context.prisma);
-	}
-	if (!user) {
-		const { ORPCError } = await import("@orpc/server");
-		throw new ORPCError("UNAUTHORIZED", { message: "Authentication required" });
-	}
-	// Audit attribution: writes through this base must record the actor in
-	// audit_trail (app.current_user_name), not an empty actor (the 'by .' bug).
-	const u = user as { id: string; name?: string | null; organisationId: string | null };
-	await setRlsContext(context.prisma, {
-		userId: u.id,
-		userName: u.name || u.id,
-		organisationId: u.organisationId,
-	});
-	try {
-		return await opt.next({ context: { ...context, user } });
-	} finally {
-		await resetRlsContext(context.prisma);
-	}
-});
-
-/**
- * Derive the messaging service base URL. The single source is the
- * config/messaging-service-internal-url row (the Railway private domain is a
- * Railway fact — the registry slug and the Railway service name differ, e.g.
- * scala-messaging-service vs scala-messaging-rust — so the resolved URL lives
- * in ONE registry row instead of being spelled per-caller).
- */
-const MessagingUrlSchema = v.looseObject({
-	internalBaseUrl: v.string(),
-});
-
-/** The sealed webhook-secret row shape (value is decryptSecretConfig input). */
-const MessagingSecretSchema = v.looseObject({});
-
-async function resolveMessagingBaseUrl(): Promise<string> {
-	const row = await loadRegistryConfig(
-		"config",
-		"messaging-service-internal-url",
-		MessagingUrlSchema,
-	);
-	const url = row.internalBaseUrl.trim().replace(/\/+$/, "");
-	if (!url.startsWith("http")) {
-		throw new Error(
-			"config/messaging-service-internal-url.internalBaseUrl must be an http(s) URL — " +
-				"the fn router refuses to guess a messaging service address.",
-		);
-	}
-	return url;
-}
-
-const sendSchema = v.object({
-	/** Destination phone number in E.164 (e.g. 61428193498). */
-	phone: v.string(),
-	/** Text body to send. */
-	message: v.string(),
-});
-
-export const messagingWhatsappRouter = {
-	messagingWhatsappSend: authed
-		.input(sendSchema)
-		.handler(async ({ input }) => {
-			const log = getAppLogger();
-			const phone = input.phone.trim();
-			const message = input.message;
-			if (!phone || !message) {
-				return { ok: false as const, error: "phone and message are required" };
-			}
-
-			try {
-				const [baseUrl, rawSecret] = await Promise.all([
-					resolveMessagingBaseUrl(),
-					loadRegistryConfig(
-						"secret",
-						"railway-scala-messaging-whatsapp-webhook-secret",
-						MessagingSecretSchema,
-					).catch(() => {
-						throw new Error(
-							"secret row railway-scala-messaging-whatsapp-webhook-secret is missing — " +
-								"the messaging service send endpoint cannot be authenticated",
-						);
-					}),
-				]);
-				const decrypted = decryptSecretConfig(
-					rawSecret as SecretConfigLike,
-				) as { token?: string };
-				if (!decrypted.token) {
-					return {
-						ok: false as const,
-						error: "whatsapp webhook secret row has no token",
-					};
-				}
-
-				const response = await fetch(
-					`${baseUrl}/api/messaging/whatsapp/send`,
-					{
-						method: "POST",
-						headers: {
-							"Content-Type": "application/json",
-							// The Rust handler accepts x-webhook-secret (or
-							// x-api-key) against WHATSAPP_WEBHOOK_SECRET.
-							"x-webhook-secret": decrypted.token,
-						},
-						body: JSON.stringify({ phone, message }),
-						signal: AbortSignal.timeout(30_000),
-					},
-				);
-				if (response.status === 401) {
-					return {
-						ok: false as const,
-						error: "messaging service refused the webhook secret (401)",
-					};
-				}
-				const body = (await response.json().catch(() => null)) as {
-					// The Rust handler answers { ok, sent, messageId } (camelCase).
-					messageId?: string;
-					error?: string;
-				} | null;
-				if (!response.ok) {
-					return {
-						ok: false as const,
-						error:
-							body?.error ??
-							`messaging service send failed: ${response.status}`,
-					};
-				}
-				// The message_id is the only thing that makes delivery provable —
-				// hand it back so the caller can correlate the ack (gowa.rs
-				// parse_message_id contract).
-				log.info("[fn.messagingWhatsappSend] sent", {
-					phone,
-					message_id: body?.messageId ?? null,
-				});
-				return {
-					ok: true as const,
-					message_id: body?.messageId ?? null,
-				};
-			} catch (err) {
-				const errorMessage = err instanceof Error ? err.message : String(err);
-				log.error(`[fn.messagingWhatsappSend] failed: ${errorMessage}`);
-				return { ok: false as const, error: errorMessage };
-			}
-		}),
-};

package/src/fn-routers/panel-data-router.ts

@@ -1,104 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * `regions.resolvePanelData` — resolves a page-kind panel's OWN loaderData so a
- * panel region renders blocks against the panel page's data, not the host
- * page's. RegionPageSwap calls this on panel-open + injects the result via
- * LiveDataProvider("page-data"), making panel-embedded data blocks (e.g. the
- * workload Chart) self-sufficient: each panel carries its own data, no host
- * coupling + no preloading the host route.
- *
- * Flow (registry reads via the loadRegistryConfig helper — registry-via-helper):
- * panel_view.content.loader_slug → resource_loader config → orgId derived from
- * the serving website (builda_websites.organisation_id) → resolveFromLoaderConfig
- * → the loader's resolved sources. Panels without a loader_slug (e.g. the AI
- * panel, whose block self-loads) return null — no extra round-trip, no behavior
- * change.
- */
-import { os } from "@orpc/server";
-import * as v from "valibot";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import type { PanelViewKey } from "@teamscala/db/registry/generated/panel-view";
-import type { ResourceLoaderKey } from "@teamscala/db/registry/generated/resource-loader";
-import { resolveFromLoaderConfig } from "../resolve-from-loader-config.ts";
-
-interface Context {
-	prisma: {
-		builda_websites: {
-			findFirst: (args: unknown) => Promise<{
-				organisation_id?: string | null;
-			} | null>;
-		};
-	};
-}
-
-const panelViewSchema = v.looseObject({
-	content: v.looseObject({ loader_slug: v.optional(v.string()) }),
-});
-
-export const resolvePanelDataHandler = os
-	.$context<Context>()
-	.input(
-		v.object({
-			panelSlug: v.string(),
-			websiteSlug: v.string(),
-			/** Tenant orgId (preferred over the website's organisation_id, which is
-			 * the platform org on a multi-tenant portal — not the tenant). The
-			 * caller (RegionPageSwap) threads this from __PAGE_DATA__.orgId. */
-			orgId: v.optional(v.string()),
-		}),
-	)
-	.handler(async ({ input, context }) => {
-		// panel_view → loader_slug (null when missing or the panel has no loader).
-		let loaderSlug: string | undefined;
-		try {
-			// THE SLUG IS RUNTIME-SUPPLIED, so it cannot be statically a
-			// PanelViewKey: it arrives from the browser as the opened panel's
-			// name. The lookup itself is the validation — loadRegistryConfig
-			// throws when no such row exists, and the catch below turns that into
-			// the documented null. Narrowing here states that contract rather
-			// than asserting the value is known good.
-			const pv = await loadRegistryConfig(
-				"panel_view",
-				input.panelSlug as PanelViewKey,
-				panelViewSchema,
-			);
-			loaderSlug = pv.content?.loader_slug;
-		} catch {
-			return null;
-		}
-		if (!loaderSlug) return null;
-		// resource_loader → its config (loose schema; resolveFromLoaderConfig owns
-		// the typed LoaderConfig contract).
-		let loader: unknown;
-		try {
-			loader = await loadRegistryConfig(
-				"resource_loader",
-				// Same contract: loader_slug is read from the panel row's loose
-				// content schema as a plain string, and a missing row throws into
-				// the catch below.
-				loaderSlug as ResourceLoaderKey,
-				v.unknown(),
-			);
-		} catch {
-			return null;
-		}
-		// Tenant orgId: prefer the caller-provided value (the route's tenant org,
-		// threaded from __PAGE_DATA__.orgId); fall back to the website's
-		// organisation_id (the platform org — wrong for multi-tenant portals, but
-		// the only derivable value when the caller omits it).
-		let orgId = input.orgId;
-		if (!orgId) {
-			const site = await context.prisma.builda_websites.findFirst({
-				where: { OR: [{ slug: input.websiteSlug }, { id: input.websiteSlug }] },
-				select: { organisation_id: true },
-			});
-			orgId = site?.organisation_id ?? undefined;
-		}
-		return await resolveFromLoaderConfig(
-			loader as Parameters<typeof resolveFromLoaderConfig>[0],
-			{ orgId },
-		);
-	});