@teamscala/service-boot 0.23.524 → 0.23.526

package/src/register-registry-page-route/live-loader-config.ts

@@ -19,19 +19,3 @@ export async function readLiveLoaderConfig(
 		ResourceLoaderConfigSchema,
 	);
 }
-
-/** djb2 over the config's stable JSON — short, deterministic, SSR-safe. */
-export function fingerprintLoaderConfig(config: unknown): string {
-	const json = JSON.stringify(config, sortedTopLevelKeys(config));
-	let hash = 5381;
-	for (let i = 0; i < json.length; i++) {
-		hash = ((hash << 5) + hash + json.charCodeAt(i)) | 0;
-	}
-	return (hash >>> 0).toString(36);
-}
-
-function sortedTopLevelKeys(config: unknown): string[] {
-	return config != null && typeof config === "object"
-		? Object.keys(config).sort()
-		: [];
-}

package/src/register-registry-page-route/meta-title.ts

@@ -2,25 +2,6 @@
  * @system service-boot
  * @status handwritten
  */
-/**
- * THE ONE SUBJECT DERIVATION. What a page is ABOUT — the entity whose name the
- * browser tab should carry.
- *
- * This existed as THREE hand-written `||` chains, one per render branch in
- * resolve-page-data, and they had already diverged: two ordered form before
- * proposal, the third ordered proposal first. So which resource named the page
- * depended on which branch happened to render it, silently.
- *
- * The divergence is the cheap half of the cost. The expensive half is that a
- * correction has to be applied three times to work, and applying it twice looks
- * exactly like applying it correctly — measured 2026-08-17, when a fix to the
- * quiz subject was shipped, installed and verified present in the bundle while
- * the page kept its old title, because the branch that rendered it held the
- * second copy.
- *
- * One chain, one precedence, one place to change. Adding a resource type is an
- * edit here rather than a fourth branch in three files.
- */
 
 import { interpolateMeta } from "@teamscala/resolver-engine/loader-config/resolve-from-loader-config";
 
@@ -32,11 +13,6 @@ export function buildMetaFromContext(
 	return interpolateMeta(metaContext as Record<string, unknown>, resolved);
 }
 
-/**
- * The page's own meta_title row (loaderData.page first, resolved.page second)
- * — used only on /sign-in, where the org's sign-in page title overrides the
- * derived one. Moved from register-registry-page-route.ts.
- */
 export function resolvePageMetaTitle(
 	resolved: Record<string, unknown>,
 ): unknown {

package/src/register-registry-page-route/page-data-shared.ts

@@ -6,11 +6,6 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Data } from "@teamscala/puck-boundary/data";
 
-/**
- * The canonical identity from the generated boundary (the platform's one
- * declaration site for framework shapes) — never a hand-spelled structural
- * duplicate of it.
- */
 export type PuckData = Data;
 
 export const EMPTY_PUCK_DATA: PuckData = { root: { props: {} }, content: [] };
@@ -86,7 +81,6 @@ export function warnUnresolvedRegionSlot(slot: string): void {
 	);
 }
 
-/** The resolved brand tokens every branch reads (the old file's shared prologue). */
 export function readBrandTokens(resolved: Record<string, unknown>): {
 	brand: Record<string, unknown>;
 	primaryColor: string;

package/src/register-registry-page-route/prefetch-org-id.ts

@@ -3,23 +3,6 @@
  * @status handwritten
  */
 
-/**
- * Prefer segment 1; fall back to segment 0 only when segment 1 is not a
- * UUID (the single-UUID shape, which is live and supported — NOT
- * transitional). The fallback is deliberately kept
- * UNCHANGED-BEHAVIOUR rather than "fixed": a UUID in segment 0 is
- * genuinely ambiguous — of the 40 UUID-first page paths in builda_pages,
- * ZERO are websites and ZERO are organisations, so segment 0 can also be
- * an unrelated record id. Position alone cannot resolve that; only
- * validating the id against organisation_profile can, and that is a DB
- * read this hot prefetch path should not take without caching
- * (`hot-path-resolutions-are-cached`). Preferring segment 1 is strictly
- * better for the canonical shape and no worse for any other. Reading
- * segment 0 first captured the WEBSITE id and passed it as an
- * organisation id, which failed silently because both are well-formed
- * UUIDs: the prefetch simply warmed a session against the wrong tenant
- * (found 2026-07-21).
- */
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 

package/src/register-registry-page-route/proposal-approval-email-token.ts

@@ -2,17 +2,6 @@
  * @system service-boot
  * @status handwritten
  */
-/**
- * Resolve the `{{approvalEmail}}` placeholder in a proposal page's button props
- * (e.g. the Approve CTA) in place. Routing: the organisation's registered
- * company email FIRST (organisation_profile.contact_email, already resolved
- * into pageData.brand.contactEmail); the proposal creator's user email only as
- * a fallback when the org has none — so a cloned proposal can never carry a
- * stale hard-coded address. The creator lookup is null-safe and adds no user
- * exposure: it resolves only where the in-process ORPC client exposes `user`
- * (super-admin), degrading to the org email elsewhere. Called only for proposal
- * pages; other registry pages are untouched.
- */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";
 

package/src/register-registry-page-route/proposal-brand-stamping.ts

@@ -3,20 +3,6 @@
  * @status handwritten
  */
 
-/**
- * Stash a proposal's connected partner logo/colour on `pageData` from the
- * `partnerOrg` loader source (`crm_organisations` loaded by the proposal's
- * `partner_id`, via the SAME proven ORPC loader path that loads the proposal
- * itself). resolve-page-brand (service-runtime) prefers `pageData.partnerLogo`
- * over any inline body-Hero prop and fans it into the shared `/header` so a
- * `source: "partner"` OrgLogo fills automatically — the partner logo lives on
- * the CRM record, never duplicated per proposal. No partner → partnerOrg is
- * null → nothing set → the partner logo block renders blank. Reading the
- * already-resolved loader value (not a second hand-rolled getServerClient call)
- * is what makes this reliable: the earlier direct `crm_organisations.findFirst`
- * with a Prisma-style object `select` resolved intermittently/never against the
- * generated ORPC, leaving the header partner blank (2026-06-12).
- */
 export function applyPartnerBrand(
 	pageData: Record<string, unknown>,
 	partnerOrg:
@@ -30,12 +16,6 @@ export function applyPartnerBrand(
 		pageData.partnerBrandColor = partnerOrg.brand_primary_color;
 }
 
-/**
- * Auto-resolve the client's company logo from the `clientOrg` loader source
- * (contact_id → company_id → crm_organisations.logo_url). Injects into the
- * Hero block's clientLogo prop when it's empty — no manual logo URL needed
- * per proposal when the contact's company profile has a logo.
- */
 export function applyClientLogo(
 	pageData: Record<string, unknown>,
 	clientOrg:

package/src/register-registry-page-route/public-shell-page-data.ts

@@ -88,12 +88,6 @@ export function publicShellPageData(
 	const overrideHeading = pickRootProp<string>(regions, "headingFont");
 	const overrideBody = pickRootProp<string>(regions, "bodyFont");
 
-	// The page's own screenMode, threaded the same way Branch 1 threads it
-	// (single-page-data.ts). Dropping it here is not neutral: build-page-tree
-	// falls back to `fullScreen: renderMode === "public" || "gpts"`, and for a
-	// shell page that resolves false — which wraps the body in a centred card
-	// and puts the site header INSIDE that card instead of across the top of
-	// the page. A page that declares "full-screen" was rendering as a form.
 	const screenMode = pickRootProp<string>(regions, "screenMode");
 
 	const pageName = (page.name as string) || null;
@@ -108,22 +102,11 @@ export function publicShellPageData(
 	return {
 		puckData: { root: { props: {} }, content: [] } as PuckData,
 		regions,
-		// Region-shell blocks (e.g. the header Navigation deriving the body's
-		// document sections) read the resolved entity graph from
-		// pageData.loaderData — the same surface Branch 1 exposes. Without it a
-		// header/footer block serverLoader gets ctx.loaderData=undefined and
-		// cannot see the body page, so a server-derived nav produced no items
-		// and the menu was client-only (vanished on stale tabs / narrow views).
 		loaderData: resolved,
 		website: {
 			slug: website.slug as string,
 			name: website.name as string,
 			organisation_id: website.organisation_id as string | null,
-			// header_settings carries the DB-driven header config (e.g.
-			// backdropBlur) the public shell applies — PublicTemplate reads
-			// pageData.website.header_settings.backdropBlur. Dropping it here
-			// silently kills the header blur even though the DB switch is set
-			// (the 2026-06-17 regression). Pass it through verbatim.
 			header_settings:
 				(website.header_settings as Record<string, unknown> | null) ?? null,
 		},
@@ -132,10 +115,6 @@ export function publicShellPageData(
 			null,
 		brand: {
 			primaryColor: overrideColor ?? primaryColor,
-			// Thread the org brand's dark surface (brand_background_color /
-			// brand_dark_color) when the page sets no explicit override — so
-			// dark-mode pages use the brand's real dark colour, not a
-			// primary-derived tint. Uses the org brand's real dark colour.
 			backgroundColor:
 				overrideBg ?? (brand.backgroundColor as string | null) ?? null,
 			lightSurface: (brand.lightSurface as string | null) ?? null,
@@ -159,11 +138,6 @@ export function publicShellPageData(
 					pageMetaTitle: bodyMetaTitle,
 					templateTitle: (meta.title as string) || undefined,
 					websiteName: (website.name as string) || undefined,
-					// The FRIENDLY name is what the public sees — the trading brand,
-					// not the legal entity. Reading companyName here put "GMG APAC"
-					// in the title of every launcha page, which the operator has
-					// corrected repeatedly; the friendly name is "launcha". Falls
-					// back to companyName only where no friendly name is set.
 					organisationName:
 						(brand.companyFriendlyName as string) ||
 						(brand.companyName as string) ||

package/src/register-registry-page-route/resolve-request-graph.ts

@@ -5,104 +5,32 @@
 
 import type { PageRouteConfig } from "../register-registry-page-route.ts";
 import * as v from "valibot";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { ResourceLoaderConfigSchema } from "@teamscala/db-validation/registry-schemas/resource-loader";
 import { resolveFromLoaderConfig } from "../page-server-loader-graph.ts";
 import { decideContentPageFloor } from "../content-page-floor.ts";
 import { PrimaryResourceMissingError } from "../resource-not-found.ts";
-import {
-	staticShellGraphCache,
-	paramRouteGraphCache,
-	readCachedGraph,
-} from "./graph-cache.ts";
 
 export interface ResolveRequestGraphArgs {
 	pattern: string;
-	routeSlug: string;
 	routeConfig: PageRouteConfig;
 	loaderConfig: v.InferOutput<typeof ResourceLoaderConfigSchema>;
 	params: Record<string, string>;
-	isStaticShell: boolean;
-	serviceSlug: string;
-	/** Stable fingerprint of the LIVE loader config (fingerprintLoaderConfig).
-	 *  Appended to the graphKey so a registry row edit invalidates cached
-	 *  graphs for the route on the very next request — the graph is a
-	 *  function of the config, so the config belongs in the cache key. */
-	configFingerprint?: string;
-}
-
-/**
- * Clone a loader graph for the cache, degrading loudly rather than silently.
- *
- * ONE CLONE, TWO CALLERS. The cold path and the background-refresh path both
- * store a graph and both must survive a non-cloneable value in it — a function,
- * a Proxy, a live client handle. They previously had SEPARATE implementations:
- * the cold path carried this fallback ladder, the refresh path called
- * structuredClone bare. So a graph that the cold path stored happily threw on
- * every subsequent refresh, the cache never updated, and the entry aged out into
- * a full in-request resolve. Two copies of one decision, and the copy nobody
- * hardened is the one that fired.
- *
- * Returns undefined when the graph cannot be cloned at all; the caller then
- * declines to cache that key. Both fallbacks log, so the offending source stays
- * observable and fixable — never a silent fail-open
- * (`protective-layers-fail-explicitly`).
- */
-function cloneForCache(
-	graph: unknown,
-	graphKey: string,
-	serviceSlug: string,
-): unknown | undefined {
-	const log = getAppLogger();
-	try {
-		return structuredClone(graph);
-	} catch (err) {
-		log.warn(
-			`[scala-install:${serviceSlug}] graph-cache structuredClone failed for ${graphKey} — falling back to JSON-clone (non-cloneable value in loader graph): ${err instanceof Error ? err.message : err}`,
-		);
-		try {
-			// JSON-clone preserves the data graph, dropping the functions and
-			// undefined a loader graph should not be carrying anyway.
-			return JSON.parse(JSON.stringify(graph)) as unknown;
-		} catch (err2) {
-			log.warn(
-				`[scala-install:${serviceSlug}] graph-cache JSON-clone also failed for ${graphKey} — cache disabled for this key (observable): ${err2 instanceof Error ? err2.message : err2}`,
-			);
-			return undefined;
-		}
-	}
 }
 
 export async function resolveRequestGraph(
 	args: ResolveRequestGraphArgs,
 ): Promise<Record<string, unknown>> {
-	const { pattern, routeSlug, routeConfig, loaderConfig, params, isStaticShell, serviceSlug, configFingerprint } = args;
+	const { pattern, routeConfig, loaderConfig, params } = args;
 
-	// A bare root ("/") that declares a resource_type is a UUID-driven
-	// public site (proposals/forms/quiz) with no resource selected — it
-	// must render the branded holding/not-found page ("no <resource> at
-	// this link"), never fall through the shared public loader to the
-	// marketing site. PrimaryResourceMissingError is the existing signal
-	// the page binder maps to buildResourceNotFoundResponse. A "/" route
-	// WITHOUT a resource_type (e.g. scala-public's marketing root) is
-	// unaffected and still renders its content.
 	if (pattern === "/" && routeConfig.resource_type) {
-		// Status 200: the bare root is a valid "no <resource> selected"
-		// landing, not an error — and kind:ui services must answer GET /
-		// with 200 (verify-prod-persistent-slot). An invalid /:id keeps
-		// the default 404 (genuinely not found).
 		throw new PrimaryResourceMissingError(routeConfig.resource_type, 200);
 	}
-	const graphKey = `graph:${routeSlug}:${params.host}:${params.path}${configFingerprint ? `:${configFingerprint}` : ""}`;
 	const primaryType = routeConfig.resource_type;
 	const hasPrimarySource =
 		!!primaryType &&
 		!!(loaderConfig as { sources?: { key: string }[] }).sources?.some(
 			(s) => s.key === primaryType,
 		);
-	const graphCache = isStaticShell
-		? staticShellGraphCache
-		: paramRouteGraphCache;
 	const typedLoaderConfig = loaderConfig as v.InferOutput<
 		typeof ResourceLoaderConfigSchema
 	> & {
@@ -110,91 +38,10 @@ export async function resolveRequestGraph(
 			v.InferOutput<typeof ResourceLoaderConfigSchema>["sources"]
 		>;
 	};
-	let resolved: Record<string, unknown>;
-	// SWR read over @teamscala/cache: fresh hit serves the cached graph, stale
-	// hit serves it AND fires ONE background refresh (refreshInBackground,
-	// single-flight via the cache's in-flight map), miss returns undefined.
-	// The refresh callback re-resolves + stores a clone; a primary-missing
-	// (dead-link) graph THROWS so the cache is not updated — a dead link must
-	// stay per-request so a just-created record appears immediately
-	// (refreshInBackground catches, leaves the stale entry, logs one line).
-	const cachedGraph = readCachedGraph(
-		graphCache,
-		graphKey,
-		() =>
-			resolveFromLoaderConfig(typedLoaderConfig, params).then(
-				(freshGraph) => {
-					const freshPrimaryMissing =
-						hasPrimarySource &&
-						primaryType &&
-						freshGraph[primaryType] == null;
-					if (freshPrimaryMissing) {
-						throw new Error(
-							`primary resource "${primaryType}" missing — skip cache update for ${graphKey}`,
-						);
-					}
-					// SAME DEFENSIVE CLONE AS THE COLD PATH. This used to call
-					// structuredClone bare, so a non-cloneable value in the loader
-					// graph threw on EVERY background refresh: refreshInBackground
-					// caught it, kept the stale entry, and logged one line — so the
-					// cache could never update, expired at staleTtlMs, and the next
-					// request re-resolved the whole graph in-request. Measured
-					// 2026-09-03 on the live proposal page: "The object can not be
-					// cloned" every ~13 minutes on the same graphKey, indefinitely.
-					// The cold path was hardened for exactly this and the refresh
-					// path was not — one defect, two clone sites, one protected.
-					const refreshed = cloneForCache(freshGraph, graphKey, serviceSlug);
-					if (refreshed === undefined) {
-						throw new Error(
-							`graph for ${graphKey} is not cloneable — skip cache update`,
-						);
-					}
-					return refreshed;
-				},
-			),
-	);
-	if (cachedGraph !== undefined) {
-		// Clone-on-get: gateAgreementContent + block resolution MUTATE the
-		// graph in place, so each request gets its own copy.
-		resolved = structuredClone(cachedGraph) as Record<string, unknown>;
-	} else {
-		resolved = await resolveFromLoaderConfig(typedLoaderConfig, params);
-		const primaryMissing =
-			hasPrimarySource && primaryType && resolved[primaryType] == null;
-		if (!primaryMissing) {
-			// Defensive clone: structuredClone throws on non-cloneable loader
-			// graphs (functions/Proxies/Prisma instances). A swallowed throw
-			// here used to SILENTLY disable the graph cache for this key
-			// (fail-open-silent — forbidden by protective-layers-fail-explicitly),
-			// which left affected routes re-resolving the loader graph every
-			// request (measured ~1.2s on the projects utility shell). JSON-clone
-			// preserves the data graph (dropping functions/undefined a loader
-			// graph shouldn't carry) so the cache stays effective; both fallbacks
-			// are LOGGED so the offending non-cloneable source is observable +
-			// fixable, never silently disabling the cache again.
-			const cloned = cloneForCache(resolved, graphKey, serviceSlug);
-			if (cloned !== undefined) {
-				graphCache.set(graphKey, cloned);
-			}
-		}
-	}
-	// A route that declares resource_type is meaningless without that
-	// entity: a dead link (wrong id, deleted row) must 404 with the
-	// branded not-found page — never fall through to default content
-	// (the "Vision Toolbar" leak, operator-observed 2026-06-05).
+	const resolved = await resolveFromLoaderConfig(typedLoaderConfig, params);
 	if (hasPrimarySource && primaryType && resolved[primaryType] == null) {
 		throw new PrimaryResourceMissingError(primaryType);
 	}
-	// A CONTENT route (no resource_type) whose loader resolves a `page`
-	// body source must not synthesize an empty page for an unmatched path
-	// and serve a cacheable 200 — the generalized "Vision Toolbar" leak
-	// (operator-reported 5×: a deleted page, e.g. /roadmap, returned 200
-	// with an empty body instead of not-found). No page row → dead link →
-	// branded 404 floor. A page row that exists but has zero blocks → a
-	// content gap → the floor's empty-page surface (200). Both carry the
-	// "Take me home" action. The pure decision lives in content-page-floor.ts
-	// (unit-tested without the Hono/DB/graph machinery). Region-slot
-	// (utility/portal) shells without a `page` source are untouched.
 	const contentFloorError = decideContentPageFloor({
 		hasResourceType: !!primaryType,
 		hasPageContentSource: !!(loaderConfig as { sources?: { key: string }[] }).sources?.some(

package/src/register-registry-page-route/run-content-gates.ts

@@ -3,67 +3,15 @@
  * @status handwritten
  */
 
-import type { PageRouteConfig } from "../register-registry-page-route.ts";
 import { runContentGate } from "../content-gate/gate.ts";
-import type { ContentGateOutcome } from "../content-gate/gate.ts";
-import { CONTENT_GATES, withholdsContent } from "../content-gate/catalog.ts";
-import { injectResourceChatLauncher } from "../resource-chat-inject.ts";
+import { CONTENT_GATES } from "../content-gate/catalog.ts";
 
 export async function runContentGatesForPage(
 	resolved: Record<string, unknown>,
 	gateCookie: string | null,
 	gateNow: number,
-	assistant: PageRouteConfig["assistant"],
-	regionSlots: string[] | undefined,
 ): Promise<void> {
-	// EVERY REGISTERED GATE, IN CATALOG ORDER (content-gate/catalog.ts).
-	// This used to name proposalGateConfig, agreementGateConfig and
-	// gptGateConfig by hand, so a fourth gated resource type meant editing
-	// this file AND the second hand-written list in two-phase-boot.ts.
-	//
-	// SEQUENTIAL, NEVER PARALLEL. An authorized proposal viewer has their
-	// gate block removed from the resolved graph, and that removal is what
-	// makes the agreement gate find no resource and no-op on a page that
-	// carries both. Awaiting these together would race that dependency.
-	const gateOutcomes: ContentGateOutcome[] = [];
 	for (const entry of CONTENT_GATES) {
-		const outcome = await runContentGate(
-			resolved,
-			gateCookie,
-			gateNow,
-			entry.gate,
-		);
-		// A seed-only gate (open capture — the public GPT identity gate)
-		// withholds nothing, so its verdict is not evidence about whether
-		// this viewer may see the page and must not reach the assistant
-		// decision below. See withholdsContent, which derives that from the
-		// access config rather than restating it here.
-		if (withholdsContent(entry)) gateOutcomes.push(outcome);
-	}
-
-	// THE ASSISTANT IS A ROW, AND THIS IS THE ONE PLACE IT IS APPLIED. It used to be a call inside each gate's onAuthorized plus an entry
-	// in the hardcoded gate sequence above, so a third resource type meant editing this file. Now any page declaring `assistant` gets
-	// one and no page without the key does.
-	//
-	// GATED PAGES ONLY WHEN AUTHORIZED. The launcher's runtime context is
-	// the whole document serialised, so injecting past a closed gate
-	// would hand withheld bytes to the chat. A page no gate governs is
-	// public and gets the assistant unconditionally -- that is a
-	// different state from an unauthorized viewer, which is why the gate
-	// reports `applies` separately from `authorized`.
-	if (assistant) {
-		const governing = gateOutcomes.filter((outcome) => outcome.applies);
-		const authorized = governing.find((outcome) => outcome.authorized);
-		if (governing.length === 0 || authorized) {
-			await injectResourceChatLauncher(resolved, authorized?.email ?? "", {
-				resourceKey: assistant.resource_key,
-				agentConfigSlug: assistant.agent_config_slug as never,
-				launchLabel: assistant.launch_label,
-				placeholder: assistant.placeholder,
-				// From the loader row, so the injector never has to guess
-				// which resolved keys hold rendered content.
-				regionSlots,
-			});
-		}
+		await runContentGate(resolved, gateCookie, gateNow, entry.gate);
 	}
 }

package/src/register-registry-page-route/warn-uncovered-blocks.ts

@@ -6,16 +6,6 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { RendererComponentEntry } from "../types.ts";
 
-/**
- * A page that renders a block whose component is NOT registered — because
- * its package is missing from service_install.config.block_packages —
- * silently renders BLANK. That is the exact failure behind the 2026-06-04
- * scala-sign regression (sign-in-block dropped from block_packages → the
- * gate + signature fields vanished) which left only a benign boot WARN.
- * This turns that silent blank into a loud, GlitchTip-visible ERROR naming
- * the page + block, throttled to once per (service, block type) so a hot
- * path can never spam it.
- */
 const uncoveredBlocksLogged = new Set<string>();
 
 function collectBlockTypes(node: unknown, out: Set<string>): void {