@arcote.tech/arc-cli 0.7.27 → 0.7.28

package/dist/index.js

@@ -9634,6 +9634,7 @@ var exports_dist2 = {};
 __export(exports_dist2, {
   createPostgreSQLAdapterFactoryFromUrl: () => createPostgreSQLAdapterFactoryFromUrl,
   createPostgreSQLAdapterFactory: () => createPostgreSQLAdapterFactory,
+  coercePgNumber: () => coercePgNumber,
   PostgreSQLAdapter: () => PostgreSQLAdapter
 });
 import os2 from "os";
@@ -10866,9 +10867,21 @@ class LocalEventPublisher2 {
   views = [];
   syncCallback;
   subscribers = new Map;
+  pending = new Set;
   constructor(dataStorage) {
     this.dataStorage = dataStorage;
   }
+  track(work) {
+    const wrapped = Promise.resolve(work).catch(() => {}).finally(() => {
+      this.pending.delete(wrapped);
+    });
+    this.pending.add(wrapped);
+  }
+  async whenIdle() {
+    while (this.pending.size > 0) {
+      await Promise.all([...this.pending]);
+    }
+  }
   onPublish(callback) {
     this.syncCallback = callback;
   }
@@ -10904,9 +10917,12 @@ class LocalEventPublisher2 {
       store: EVENT_TABLES.events,
       changes: [{ type: "set", data: storedEvent }]
     });
-    if (event.payload && typeof event.payload === "object") {
+    const tagFields = event.definition?.tagFields ?? [];
+    if (tagFields.length > 0 && event.payload && typeof event.payload === "object") {
+      const payload = event.payload;
       const tagChanges = [];
-      for (const [key, value] of Object.entries(event.payload)) {
+      for (const key of tagFields) {
+        const value = payload[key];
         if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
           tagChanges.push({
             type: "set",
@@ -11064,6 +11080,47 @@ class LocalEventPublisher2 {
     return allViewChanges;
   }
 }
+function murmurHash(key, seed = 0) {
+  let remainder, bytes, h1, h1b, c1, c2, k1, i;
+  remainder = key.length & 3;
+  bytes = key.length - remainder;
+  h1 = seed;
+  c1 = 3432918353;
+  c2 = 461845907;
+  i = 0;
+  while (i < bytes) {
+    k1 = key.charCodeAt(i) & 255 | (key.charCodeAt(++i) & 255) << 8 | (key.charCodeAt(++i) & 255) << 16 | (key.charCodeAt(++i) & 255) << 24;
+    ++i;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+    h1 = h1 << 13 | h1 >>> 19;
+    h1b = (h1 & 65535) * 5 + (((h1 >>> 16) * 5 & 65535) << 16) & 4294967295;
+    h1 = (h1b & 65535) + 27492 + (((h1b >>> 16) + 58964 & 65535) << 16);
+  }
+  k1 = 0;
+  if (remainder >= 3) {
+    k1 ^= (key.charCodeAt(i + 2) & 255) << 16;
+  }
+  if (remainder >= 2) {
+    k1 ^= (key.charCodeAt(i + 1) & 255) << 8;
+  }
+  if (remainder >= 1) {
+    k1 ^= key.charCodeAt(i) & 255;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+  }
+  h1 ^= key.length;
+  h1 ^= h1 >>> 16;
+  h1 = (h1 & 65535) * 2246822507 + (((h1 >>> 16) * 2246822507 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 13;
+  h1 = (h1 & 65535) * 3266489909 + (((h1 >>> 16) * 3266489909 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 16;
+  return h1 >>> 0;
+}
 
 class ArcOptional {
   parent;
@@ -11156,7 +11213,9 @@ class ArcDefault {
     this.defaultValueOrCallback = defaultValueOrCallback;
   }
   validate(value) {
-    throw new Error("Method not implemented.");
+    if (value === undefined || value === null)
+      return false;
+    return this.parent.validate(value);
   }
   parse(value) {
     if (value)
@@ -11393,6 +11452,25 @@ class ScopedStore {
     }
   }
 }
+function collectFieldPaths(errors, prefix = "") {
+  if (!errors || typeof errors !== "object")
+    return [];
+  const schema = errors.schema;
+  if (!schema || typeof schema !== "object")
+    return [];
+  const out = [];
+  for (const [field, fieldError] of Object.entries(schema)) {
+    if (!fieldError)
+      continue;
+    const path4 = prefix ? `${prefix}.${field}` : field;
+    const nested = collectFieldPaths(fieldError, path4);
+    if (nested.length > 0)
+      out.push(...nested);
+    else
+      out.push(path4);
+  }
+  return out;
+}
 function string() {
   return new ArcString;
 }
@@ -11527,6 +11605,27 @@ class ArcFunction {
   get results() {
     return this.data.results;
   }
+  validateParams(params) {
+    const schema = this.data.params;
+    if (!schema || typeof schema.validate !== "function")
+      return;
+    const errors = schema.validate(params ?? {});
+    if (errors)
+      throw new ArcValidationError2(errors);
+  }
+  async authorize(adapters) {
+    if (!this.hasProtections)
+      return;
+    const decoded = adapters.authAdapter?.getDecoded?.();
+    if (!decoded) {
+      throw new ArcAuthenticationError;
+    }
+    const instances = this.data.protections.filter((p3) => p3.token?.name === decoded.tokenName).map((p3) => p3.token.create(decoded.params, adapters));
+    const ok2 = await this.verifyProtections(instances);
+    if (!ok2) {
+      throw new ArcAuthorizationError2;
+    }
+  }
   async verifyProtections(tokens) {
     if (!this.data.protections || this.data.protections.length === 0) {
       return true;
@@ -11678,47 +11777,6 @@ function deepMerge(target, source) {
 function isPlainObject(item) {
   return item && typeof item === "object" && !Array.isArray(item) && !(item instanceof Date) && Object.prototype.toString.call(item) === "[object Object]";
 }
-function murmurHash(key, seed = 0) {
-  let remainder, bytes, h1, h1b, c1, c2, k1, i;
-  remainder = key.length & 3;
-  bytes = key.length - remainder;
-  h1 = seed;
-  c1 = 3432918353;
-  c2 = 461845907;
-  i = 0;
-  while (i < bytes) {
-    k1 = key.charCodeAt(i) & 255 | (key.charCodeAt(++i) & 255) << 8 | (key.charCodeAt(++i) & 255) << 16 | (key.charCodeAt(++i) & 255) << 24;
-    ++i;
-    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
-    k1 = k1 << 15 | k1 >>> 17;
-    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
-    h1 ^= k1;
-    h1 = h1 << 13 | h1 >>> 19;
-    h1b = (h1 & 65535) * 5 + (((h1 >>> 16) * 5 & 65535) << 16) & 4294967295;
-    h1 = (h1b & 65535) + 27492 + (((h1b >>> 16) + 58964 & 65535) << 16);
-  }
-  k1 = 0;
-  if (remainder >= 3) {
-    k1 ^= (key.charCodeAt(i + 2) & 255) << 16;
-  }
-  if (remainder >= 2) {
-    k1 ^= (key.charCodeAt(i + 1) & 255) << 8;
-  }
-  if (remainder >= 1) {
-    k1 ^= key.charCodeAt(i) & 255;
-    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
-    k1 = k1 << 15 | k1 >>> 17;
-    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
-    h1 ^= k1;
-  }
-  h1 ^= key.length;
-  h1 ^= h1 >>> 16;
-  h1 = (h1 & 65535) * 2246822507 + (((h1 >>> 16) * 2246822507 & 65535) << 16) & 4294967295;
-  h1 ^= h1 >>> 13;
-  h1 = (h1 & 65535) * 3266489909 + (((h1 >>> 16) * 3266489909 & 65535) << 16) & 4294967295;
-  h1 ^= h1 >>> 16;
-  return h1 >>> 0;
-}
 function resolveQueryChange(currentResult, event3, options) {
   const index = currentResult.findIndex((e2) => e2._id === event3.id);
   const isInCurrentResult = index !== -1;
@@ -11730,16 +11788,57 @@ function resolveQueryChange(currentResult, event3, options) {
   }
   const shouldBeInResult = checkItemMatchesWhere(event3.item, options.where);
   if (isInCurrentResult && shouldBeInResult) {
-    const newResult = currentResult.toSpliced(index, 1, event3.item);
-    return applyOrderByAndLimit(newResult, options);
+    if (!options.orderBy) {
+      return applyLimit(currentResult.toSpliced(index, 1, event3.item), options);
+    }
+    const cmp = compareByOrderBy(options.orderBy);
+    if (cmp(currentResult[index], event3.item) === 0) {
+      return applyLimit(currentResult.toSpliced(index, 1, event3.item), options);
+    }
+    const without = currentResult.toSpliced(index, 1);
+    const at = upperBound(without, event3.item, cmp);
+    return applyLimit(without.toSpliced(at, 0, event3.item), options);
   } else if (isInCurrentResult && !shouldBeInResult) {
     return currentResult.toSpliced(index, 1);
   } else if (!isInCurrentResult && shouldBeInResult) {
-    const newResult = [...currentResult, event3.item];
-    return applyOrderByAndLimit(newResult, options);
+    if (!options.orderBy) {
+      return applyLimit([...currentResult, event3.item], options);
+    }
+    const cmp = compareByOrderBy(options.orderBy);
+    const at = upperBound(currentResult, event3.item, cmp);
+    return applyLimit(currentResult.toSpliced(at, 0, event3.item), options);
   }
   return false;
 }
+function compareByOrderBy(orderBy) {
+  const entries = Object.entries(orderBy);
+  return (a2, b3) => {
+    for (const [key, direction] of entries) {
+      const aVal = a2[key];
+      const bVal = b3[key];
+      if (aVal < bVal)
+        return direction === "asc" ? -1 : 1;
+      if (aVal > bVal)
+        return direction === "asc" ? 1 : -1;
+    }
+    return 0;
+  };
+}
+function upperBound(arr, item, cmp) {
+  let lo = 0;
+  let hi = arr.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (cmp(arr[mid], item) <= 0)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo;
+}
+function applyLimit(result, options) {
+  return options.limit !== undefined && result.length > options.limit ? result.slice(0, options.limit) : result;
+}
 function checkItemMatchesWhere(item, where) {
   if (!where) {
     return true;
@@ -11775,26 +11874,6 @@ function checkItemMatchesWhere(item, where) {
     });
   });
 }
-function applyOrderByAndLimit(result, options) {
-  let sorted = result;
-  if (options.orderBy) {
-    sorted = [...result].sort((a2, b3) => {
-      for (const [key, direction] of Object.entries(options.orderBy)) {
-        const aVal = a2[key];
-        const bVal = b3[key];
-        if (aVal < bVal)
-          return direction === "asc" ? -1 : 1;
-        if (aVal > bVal)
-          return direction === "asc" ? 1 : -1;
-      }
-      return 0;
-    });
-  }
-  if (options.limit !== undefined) {
-    sorted = sorted.slice(0, options.limit);
-  }
-  return sorted;
-}
 
 class ObservableDataStorage {
   source;
@@ -12131,7 +12210,7 @@ class Model2 {
     return s;
   }
 }
-function applyQueryChanges(result, changes) {
+function applyQueryChanges2(result, changes) {
   const next = [...result];
   for (const change of changes) {
     if (change.type === "delete") {
@@ -12184,7 +12263,7 @@ class StreamingQueryCache {
           if (!newEntry.hasResult || !Array.isArray(newEntry.result)) {
             return;
           }
-          newEntry.result = applyQueryChanges(newEntry.result, changes);
+          newEntry.result = applyQueryChanges2(newEntry.result, changes);
           this.notify(newEntry);
         }
       });
@@ -14049,6 +14128,37 @@ function osUsername() {
     return process.env.USERNAME || process.env.USER || process.env.LOGNAME;
   }
 }
+function unsafeIntMessage(raw, columnName) {
+  const where = columnName ? ` w kolumnie "${columnName}"` : "";
+  return `[PostgreSQL] Warto\u015B\u0107 ca\u0142kowita ${raw}${where} przekracza bezpieczny zakres ` + `JS Number (\xB12^53-1). Odczyt jako number cicho straci\u0142by precyzj\u0119. ` + `U\u017Cyj kolumny TEXT/NUMERIC i obs\u0142u\u017C warto\u015B\u0107 jako string/BigInt.`;
+}
+function coercePgNumber(value, columnName) {
+  if (value === null || value === undefined)
+    return value;
+  if (typeof value === "number")
+    return value;
+  if (typeof value === "bigint") {
+    if (value > MAX_SAFE_INT || value < MIN_SAFE_INT) {
+      throw new Error(unsafeIntMessage(value.toString(), columnName));
+    }
+    return Number(value);
+  }
+  if (typeof value === "string") {
+    const s = value.trim();
+    if (s === "")
+      return value;
+    if (/^[+-]?\d+$/.test(s)) {
+      const big = BigInt(s);
+      if (big > MAX_SAFE_INT || big < MIN_SAFE_INT) {
+        throw new Error(unsafeIntMessage(s, columnName));
+      }
+      return Number(big);
+    }
+    const n2 = Number(s);
+    return Number.isNaN(n2) ? value : n2;
+  }
+  return value;
+}
 
 class PostgreSQLReadTransaction {
   db;
@@ -14071,7 +14181,27 @@ class PostgreSQLReadTransaction {
   deserializeValue(value, column) {
     if (value === null || value === undefined)
       return null;
-    switch (column.type.toLowerCase()) {
+    const type = column.type.toLowerCase().split("(")[0].trim();
+    switch (type) {
+      case "bigint":
+      case "int8":
+      case "bigserial":
+      case "serial8":
+      case "serial":
+      case "serial4":
+      case "integer":
+      case "int":
+      case "int4":
+      case "smallint":
+      case "int2":
+      case "numeric":
+      case "decimal":
+      case "real":
+      case "double precision":
+      case "float":
+      case "float4":
+      case "float8":
+        return coercePgNumber(value, column.name);
       case "json":
       case "jsonb":
         if (typeof value === "string") {
@@ -14667,7 +14797,7 @@ var Operation, PROXY_DRAFT, RAW_RETURN_SYMBOL, iteratorSymbol, dataTypes, intern
     }
     return returnValue(result);
   };
-}, create, constructorString, TOKEN_PREFIX = "arc:token:", DEFAULT_TIMEOUT_MS = 8000, provider = null, latestSync = null, syncSeq = 0, eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
+}, create, constructorString, TOKEN_PREFIX = "arc:token:", DEFAULT_TIMEOUT_MS = 8000, provider = null, latestSync = null, syncSeq = 0, eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcAuthenticationError, ArcAuthorizationError2, ArcValidationError2, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, _te, _td, originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
   const user = typeHandlers(types22 || {});
   return {
     serializers: Object.assign({}, serializers, user.serializers),
@@ -14707,7 +14837,7 @@ var Operation, PROXY_DRAFT, RAW_RETURN_SYMBOL, iteratorSymbol, dataTypes, intern
   for (let i = 1;i < x2.length; i++)
     str += x2[i] === "_" ? x2[++i].toUpperCase() : x2[i];
   return str;
-}, toKebab = (x2) => x2.replace(/_/g, "-"), fromCamel = (x2) => x2.replace(/([A-Z])/g, "_$1").toLowerCase(), fromPascal = (x2) => (x2.slice(0, 1) + x2.slice(1).replace(/([A-Z])/g, "_$1")).toLowerCase(), fromKebab = (x2) => x2.replace(/-/g, "_"), camel, pascal, kebab, Result, queue_default, size = 256, buffer, messages, b3, bytes_default, connection_default, uid = 1, Sync, Flush, SSLRequest, ExecuteUnnamed, DescribeUnnamed, noop = () => {}, retryRoutines, errorFields, noop2 = () => {}, src_default, PostgreSQLReadWriteTransaction, createPostgreSQLAdapterFactory = (db) => {
+}, toKebab = (x2) => x2.replace(/_/g, "-"), fromCamel = (x2) => x2.replace(/([A-Z])/g, "_$1").toLowerCase(), fromPascal = (x2) => (x2.slice(0, 1) + x2.slice(1).replace(/([A-Z])/g, "_$1")).toLowerCase(), fromKebab = (x2) => x2.replace(/-/g, "_"), camel, pascal, kebab, Result, queue_default, size = 256, buffer, messages, b3, bytes_default, connection_default, uid = 1, Sync, Flush, SSLRequest, ExecuteUnnamed, DescribeUnnamed, noop = () => {}, retryRoutines, errorFields, noop2 = () => {}, src_default, MAX_SAFE_INT, MIN_SAFE_INT, PostgreSQLReadWriteTransaction, createPostgreSQLAdapterFactory = (db) => {
   return async (context) => {
     const adapter = new PostgreSQLAdapter(db, context);
     await adapter.initialize();
@@ -14715,7 +14845,15 @@ var Operation, PROXY_DRAFT, RAW_RETURN_SYMBOL, iteratorSymbol, dataTypes, intern
   };
 }, createPostgreSQLAdapterFactoryFromUrl = (connectionString) => {
   const sql = src_default(connectionString, {
-    onnotice: () => {}
+    onnotice: () => {},
+    types: {
+      bigint: {
+        to: 20,
+        from: [20],
+        serialize: (v3) => v3.toString(),
+        parse: (v3) => coercePgNumber(v3)
+      }
+    }
   });
   const db = new PostgresJsDatabase(sql);
   return createPostgreSQLAdapterFactory(db);
@@ -15416,6 +15554,30 @@ var init_dist = __esm(() => {
       return this.#inner.getReadWriteTransaction();
     }
   };
+  ArcAuthenticationError = class ArcAuthenticationError extends Error {
+    arcCode = "AUTHENTICATION";
+    constructor(message = "Authentication required") {
+      super(message);
+      this.name = "ArcAuthenticationError";
+    }
+  };
+  ArcAuthorizationError2 = class ArcAuthorizationError2 extends Error {
+    arcCode = "AUTHORIZATION";
+    constructor(message = "Forbidden") {
+      super(message);
+      this.name = "ArcAuthorizationError";
+    }
+  };
+  ArcValidationError2 = class ArcValidationError2 extends Error {
+    arcCode = "VALIDATION";
+    fields;
+    constructor(errors, message = "Invalid parameters") {
+      super(message);
+      this.name = "ArcValidationError";
+      const paths = collectFieldPaths(errors);
+      this.fields = paths.length > 0 ? paths : errors && typeof errors === "object" ? Object.keys(errors) : [];
+    }
+  };
   ArcPrimitive = class ArcPrimitive extends ArcAbstract {
     serialize(value) {
       return value;
@@ -15577,6 +15739,8 @@ var init_dist = __esm(() => {
   ArcContextElement = class ArcContextElement extends ArcFragmentBase {
     name;
     types = ["context-element"];
+    __contextId;
+    __contextName;
     get id() {
       return this.name;
     }
@@ -15714,7 +15878,8 @@ var init_dist = __esm(() => {
             payload,
             id: this.eventId.generate(),
             createdAt: new Date,
-            authContext
+            authContext,
+            definition: this
           };
           await adapters.eventPublisher.publish(event);
         }
@@ -15767,8 +15932,8 @@ var init_dist = __esm(() => {
       const tagsSchema = new ArcObject({
         _id: new ArcString().primaryKey(),
         eventId: new ArcString().index(),
-        tagKey: new ArcString().index(),
-        tagValue: new ArcString().index()
+        tagKey: new ArcString,
+        tagValue: new ArcString
       });
       const syncStatusSchema = new ArcObject({
         _id: new ArcString().primaryKey(),
@@ -15884,6 +16049,8 @@ var init_dist = __esm(() => {
       if (!this.data.handler) {
         throw new Error(`Command "${this.data.name}" has no handler`);
       }
+      this.#fn.validateParams(params);
+      await this.#fn.authorize(adapters);
       const context2 = this.buildCommandContext(adapters);
       return await this.data.handler(context2, params);
     }
@@ -15994,9 +16161,10 @@ var init_dist = __esm(() => {
         }
       }
       if (this.data.isAsync) {
-        Promise.resolve(this.data.handler(context2, event2)).catch((error) => {
+        const work = Promise.resolve(this.data.handler(context2, event2)).catch((error) => {
           console.error(`Async listener "${this.data.name}" error:`, error);
         });
+        adapters.eventPublisher?.track?.(work);
       } else {
         await this.data.handler(context2, event2);
       }
@@ -16450,6 +16618,8 @@ var init_dist = __esm(() => {
     }
   };
   dateValidator = typeValidatorBuilder("Date", (value) => value instanceof Date);
+  _te = new TextEncoder;
+  _td = new TextDecoder;
   originCache = new Map;
   originStackCache = new Map;
   originError = Symbol("OriginError");
@@ -16821,6 +16991,8 @@ var init_dist = __esm(() => {
     }
   });
   src_default = Postgres;
+  MAX_SAFE_INT = BigInt(Number.MAX_SAFE_INTEGER);
+  MIN_SAFE_INT = BigInt(Number.MIN_SAFE_INTEGER);
   PostgreSQLReadWriteTransaction = class PostgreSQLReadWriteTransaction extends PostgreSQLReadTransaction {
     adapter;
     queries = [];
@@ -18237,9 +18409,21 @@ class LocalEventPublisher3 {
   views = [];
   syncCallback;
   subscribers = new Map;
+  pending = new Set;
   constructor(dataStorage) {
     this.dataStorage = dataStorage;
   }
+  track(work) {
+    const wrapped = Promise.resolve(work).catch(() => {}).finally(() => {
+      this.pending.delete(wrapped);
+    });
+    this.pending.add(wrapped);
+  }
+  async whenIdle() {
+    while (this.pending.size > 0) {
+      await Promise.all([...this.pending]);
+    }
+  }
   onPublish(callback) {
     this.syncCallback = callback;
   }
@@ -18435,6 +18619,47 @@ class LocalEventPublisher3 {
     return allViewChanges;
   }
 }
+function murmurHash2(key, seed = 0) {
+  let remainder, bytes, h1, h1b, c1, c2, k1, i;
+  remainder = key.length & 3;
+  bytes = key.length - remainder;
+  h1 = seed;
+  c1 = 3432918353;
+  c2 = 461845907;
+  i = 0;
+  while (i < bytes) {
+    k1 = key.charCodeAt(i) & 255 | (key.charCodeAt(++i) & 255) << 8 | (key.charCodeAt(++i) & 255) << 16 | (key.charCodeAt(++i) & 255) << 24;
+    ++i;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+    h1 = h1 << 13 | h1 >>> 19;
+    h1b = (h1 & 65535) * 5 + (((h1 >>> 16) * 5 & 65535) << 16) & 4294967295;
+    h1 = (h1b & 65535) + 27492 + (((h1b >>> 16) + 58964 & 65535) << 16);
+  }
+  k1 = 0;
+  if (remainder >= 3) {
+    k1 ^= (key.charCodeAt(i + 2) & 255) << 16;
+  }
+  if (remainder >= 2) {
+    k1 ^= (key.charCodeAt(i + 1) & 255) << 8;
+  }
+  if (remainder >= 1) {
+    k1 ^= key.charCodeAt(i) & 255;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+  }
+  h1 ^= key.length;
+  h1 ^= h1 >>> 16;
+  h1 = (h1 & 65535) * 2246822507 + (((h1 >>> 16) * 2246822507 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 13;
+  h1 = (h1 & 65535) * 3266489909 + (((h1 >>> 16) * 3266489909 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 16;
+  return h1 >>> 0;
+}
 
 class ArcOptional2 {
   parent;
@@ -18527,7 +18752,9 @@ class ArcDefault2 {
     this.defaultValueOrCallback = defaultValueOrCallback;
   }
   validate(value) {
-    throw new Error("Method not implemented.");
+    if (value === undefined || value === null)
+      return false;
+    return this.parent.validate(value);
   }
   parse(value) {
     if (value)
@@ -18898,6 +19125,27 @@ class ArcFunction2 {
   get results() {
     return this.data.results;
   }
+  validateParams(params) {
+    const schema = this.data.params;
+    if (!schema || typeof schema.validate !== "function")
+      return;
+    const errors = schema.validate(params ?? {});
+    if (errors)
+      throw new ArcValidationError3(errors);
+  }
+  async authorize(adapters) {
+    if (!this.hasProtections)
+      return;
+    const decoded = adapters.authAdapter?.getDecoded?.();
+    if (!decoded) {
+      throw new ArcAuthenticationError2;
+    }
+    const instances = this.data.protections.filter((p3) => p3.token?.name === decoded.tokenName).map((p3) => p3.token.create(decoded.params, adapters));
+    const ok2 = await this.verifyProtections(instances);
+    if (!ok2) {
+      throw new ArcAuthorizationError3;
+    }
+  }
   async verifyProtections(tokens) {
     if (!this.data.protections || this.data.protections.length === 0) {
       return true;
@@ -19049,47 +19297,6 @@ function deepMerge2(target, source) {
 function isPlainObject2(item) {
   return item && typeof item === "object" && !Array.isArray(item) && !(item instanceof Date) && Object.prototype.toString.call(item) === "[object Object]";
 }
-function murmurHash2(key, seed = 0) {
-  let remainder, bytes, h1, h1b, c1, c2, k1, i;
-  remainder = key.length & 3;
-  bytes = key.length - remainder;
-  h1 = seed;
-  c1 = 3432918353;
-  c2 = 461845907;
-  i = 0;
-  while (i < bytes) {
-    k1 = key.charCodeAt(i) & 255 | (key.charCodeAt(++i) & 255) << 8 | (key.charCodeAt(++i) & 255) << 16 | (key.charCodeAt(++i) & 255) << 24;
-    ++i;
-    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
-    k1 = k1 << 15 | k1 >>> 17;
-    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
-    h1 ^= k1;
-    h1 = h1 << 13 | h1 >>> 19;
-    h1b = (h1 & 65535) * 5 + (((h1 >>> 16) * 5 & 65535) << 16) & 4294967295;
-    h1 = (h1b & 65535) + 27492 + (((h1b >>> 16) + 58964 & 65535) << 16);
-  }
-  k1 = 0;
-  if (remainder >= 3) {
-    k1 ^= (key.charCodeAt(i + 2) & 255) << 16;
-  }
-  if (remainder >= 2) {
-    k1 ^= (key.charCodeAt(i + 1) & 255) << 8;
-  }
-  if (remainder >= 1) {
-    k1 ^= key.charCodeAt(i) & 255;
-    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
-    k1 = k1 << 15 | k1 >>> 17;
-    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
-    h1 ^= k1;
-  }
-  h1 ^= key.length;
-  h1 ^= h1 >>> 16;
-  h1 = (h1 & 65535) * 2246822507 + (((h1 >>> 16) * 2246822507 & 65535) << 16) & 4294967295;
-  h1 ^= h1 >>> 13;
-  h1 = (h1 & 65535) * 3266489909 + (((h1 >>> 16) * 3266489909 & 65535) << 16) & 4294967295;
-  h1 ^= h1 >>> 16;
-  return h1 >>> 0;
-}
 function resolveQueryChange2(currentResult, event3, options) {
   const index = currentResult.findIndex((e2) => e2._id === event3.id);
   const isInCurrentResult = index !== -1;
@@ -19102,12 +19309,12 @@ function resolveQueryChange2(currentResult, event3, options) {
   const shouldBeInResult = checkItemMatchesWhere2(event3.item, options.where);
   if (isInCurrentResult && shouldBeInResult) {
     const newResult = currentResult.toSpliced(index, 1, event3.item);
-    return applyOrderByAndLimit2(newResult, options);
+    return applyOrderByAndLimit(newResult, options);
   } else if (isInCurrentResult && !shouldBeInResult) {
     return currentResult.toSpliced(index, 1);
   } else if (!isInCurrentResult && shouldBeInResult) {
     const newResult = [...currentResult, event3.item];
-    return applyOrderByAndLimit2(newResult, options);
+    return applyOrderByAndLimit(newResult, options);
   }
   return false;
 }
@@ -19146,7 +19353,7 @@ function checkItemMatchesWhere2(item, where) {
     });
   });
 }
-function applyOrderByAndLimit2(result, options) {
+function applyOrderByAndLimit(result, options) {
   let sorted = result;
   if (options.orderBy) {
     sorted = [...result].sort((a2, b4) => {
@@ -19502,7 +19709,7 @@ class Model3 {
     return s;
   }
 }
-function applyQueryChanges2(result, changes) {
+function applyQueryChanges3(result, changes) {
   const next = [...result];
   for (const change of changes) {
     if (change.type === "delete") {
@@ -19555,7 +19762,7 @@ class StreamingQueryCache2 {
           if (!newEntry.hasResult || !Array.isArray(newEntry.result)) {
             return;
           }
-          newEntry.result = applyQueryChanges2(newEntry.result, changes);
+          newEntry.result = applyQueryChanges3(newEntry.result, changes);
           this.notify(newEntry);
         }
       });
@@ -20514,7 +20721,7 @@ var Operation2, PROXY_DRAFT2, RAW_RETURN_SYMBOL2, iteratorSymbol2, dataTypes2, i
     }
     return returnValue(result);
   };
-}, create2, constructorString2, TOKEN_PREFIX2 = "arc:token:", DEFAULT_TIMEOUT_MS2 = 8000, provider2 = null, latestSync2 = null, syncSeq2 = 0, eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
+}, create2, constructorString2, TOKEN_PREFIX2 = "arc:token:", DEFAULT_TIMEOUT_MS2 = 8000, provider2 = null, latestSync2 = null, syncSeq2 = 0, eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcAuthenticationError2, ArcAuthorizationError3, ArcValidationError3, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, _te2, _td2, SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
   return async (context) => {
     const adapter = new SQLiteAdapter(db, context);
     await adapter.initialize();
@@ -21222,6 +21429,29 @@ var init_dist2 = __esm(() => {
       return this.#inner.getReadWriteTransaction();
     }
   };
+  ArcAuthenticationError2 = class ArcAuthenticationError2 extends Error {
+    arcCode = "AUTHENTICATION";
+    constructor(message = "Authentication required") {
+      super(message);
+      this.name = "ArcAuthenticationError";
+    }
+  };
+  ArcAuthorizationError3 = class ArcAuthorizationError3 extends Error {
+    arcCode = "AUTHORIZATION";
+    constructor(message = "Forbidden") {
+      super(message);
+      this.name = "ArcAuthorizationError";
+    }
+  };
+  ArcValidationError3 = class ArcValidationError3 extends Error {
+    arcCode = "VALIDATION";
+    fields;
+    constructor(errors, message = "Invalid parameters") {
+      super(message);
+      this.name = "ArcValidationError";
+      this.fields = errors && typeof errors === "object" ? Object.keys(errors) : [];
+    }
+  };
   ArcPrimitive2 = class ArcPrimitive2 extends ArcAbstract2 {
     serialize(value) {
       return value;
@@ -21383,6 +21613,8 @@ var init_dist2 = __esm(() => {
   ArcContextElement2 = class ArcContextElement2 extends ArcFragmentBase2 {
     name;
     types = ["context-element"];
+    __contextId;
+    __contextName;
     get id() {
       return this.name;
     }
@@ -21690,6 +21922,8 @@ var init_dist2 = __esm(() => {
       if (!this.data.handler) {
         throw new Error(`Command "${this.data.name}" has no handler`);
       }
+      this.#fn.validateParams(params);
+      await this.#fn.authorize(adapters);
       const context2 = this.buildCommandContext(adapters);
       return await this.data.handler(context2, params);
     }
@@ -21800,9 +22034,10 @@ var init_dist2 = __esm(() => {
         }
       }
       if (this.data.isAsync) {
-        Promise.resolve(this.data.handler(context2, event2)).catch((error) => {
+        const work = Promise.resolve(this.data.handler(context2, event2)).catch((error) => {
           console.error(`Async listener "${this.data.name}" error:`, error);
         });
+        adapters.eventPublisher?.track?.(work);
       } else {
         await this.data.handler(context2, event2);
       }
@@ -22256,6 +22491,8 @@ var init_dist2 = __esm(() => {
     }
   };
   dateValidator2 = typeValidatorBuilder2("Date", (value) => value instanceof Date);
+  _te2 = new TextEncoder;
+  _td2 = new TextDecoder;
   SQLiteReadWriteTransaction = class SQLiteReadWriteTransaction extends SQLiteReadTransaction {
     adapter;
     queries = [];
@@ -36687,7 +36924,8 @@ class ContextHandler {
         type: event.type,
         payload: event.payload,
         createdAt: new Date(event.createdAt),
-        authContext: eventAuthContext
+        authContext: eventAuthContext,
+        definition: eventDef
       });
       persistedEvents.push(syncableEvent);
     }
@@ -37464,14 +37702,34 @@ function arcHttpHandlers(ch, cm) {
   ];
 }
 // ../host/src/middleware/ws.ts
-import { LiveQuery } from "@arcote.tech/arc";
-var clientQuerySubs = new Map;
-function cleanupClientSubs(clientId) {
-  const subs = clientQuerySubs.get(clientId);
+import { applyQueryChanges, LiveQuery } from "@arcote.tech/arc";
+var sharedQueries = new Map;
+var clientSubKeys = new Map;
+function sharedKeyFor(descriptor, scope, rawToken) {
+  return JSON.stringify([scope, rawToken, descriptor]);
+}
+function detachSub(clientId, subscriptionId, sharedKey) {
+  const entry = sharedQueries.get(sharedKey);
+  if (!entry)
+    return;
+  const subs = entry.subscribers.get(clientId);
   if (subs) {
-    for (const live of subs.values())
-      live.stop();
-    clientQuerySubs.delete(clientId);
+    subs.delete(subscriptionId);
+    if (subs.size === 0)
+      entry.subscribers.delete(clientId);
+  }
+  if (entry.subscribers.size === 0) {
+    entry.live.stop();
+    sharedQueries.delete(sharedKey);
+  }
+}
+function cleanupClientSubs(clientId) {
+  const keys = clientSubKeys.get(clientId);
+  if (keys) {
+    for (const [subscriptionId, sharedKey] of keys) {
+      detachSub(clientId, subscriptionId, sharedKey);
+    }
+    clientSubKeys.delete(clientId);
   }
 }
 function scopeAuthHandler() {
@@ -37580,37 +37838,90 @@ function querySubscriptionHandler() {
       if (!rawToken && client.scopeTokens.size > 0) {
         rawToken = client.scopeTokens.values().next().value.raw;
       }
-      clientQuerySubs.get(client.id)?.get(subscriptionId)?.stop();
-      const live = new LiveQuery(ctx.contextHandler.getModel(), descriptor, scope, rawToken, (update) => {
-        if (update.type === "changes") {
-          ctx.connectionManager.sendToClient(client.id, {
-            type: "query-changes",
-            subscriptionId,
-            changes: update.changes
-          });
-        } else {
-          ctx.connectionManager.sendToClient(client.id, {
-            type: "query-snapshot",
-            subscriptionId,
-            result: update.result ?? null
-          });
+      const prevKey = clientSubKeys.get(client.id)?.get(subscriptionId);
+      if (prevKey)
+        detachSub(client.id, subscriptionId, prevKey);
+      const sharedKey = sharedKeyFor(descriptor, scope, rawToken);
+      const attach = (entry2) => {
+        if (!entry2.subscribers.has(client.id)) {
+          entry2.subscribers.set(client.id, new Set);
         }
-      });
-      if (!clientQuerySubs.has(client.id)) {
-        clientQuerySubs.set(client.id, new Map);
-      }
-      clientQuerySubs.get(client.id).set(subscriptionId, live);
-      try {
-        const result = await live.start();
+        entry2.subscribers.get(client.id).add(subscriptionId);
+        if (!clientSubKeys.has(client.id)) {
+          clientSubKeys.set(client.id, new Map);
+        }
+        clientSubKeys.get(client.id).set(subscriptionId, sharedKey);
+      };
+      const existing = sharedQueries.get(sharedKey);
+      if (existing && existing.ready) {
+        attach(existing);
         ctx.connectionManager.sendToClient(client.id, {
           type: "query-snapshot",
           subscriptionId,
-          result: result ?? null
+          result: existing.lastResult ?? null
         });
-        live.flush();
+        return true;
+      }
+      if (existing) {
+        attach(existing);
+        return true;
+      }
+      const entry = {
+        live: null,
+        subscribers: new Map,
+        lastResult: null,
+        ready: false
+      };
+      entry.live = new LiveQuery(ctx.contextHandler.getModel(), descriptor, scope, rawToken, (update) => {
+        if (update.type === "changes") {
+          if (Array.isArray(entry.lastResult)) {
+            entry.lastResult = applyQueryChanges(entry.lastResult, update.changes);
+          }
+        } else {
+          entry.lastResult = update.result ?? null;
+        }
+        for (const [subClientId, subIds] of entry.subscribers) {
+          for (const subId of subIds) {
+            ctx.connectionManager.sendToClient(subClientId, update.type === "changes" ? {
+              type: "query-changes",
+              subscriptionId: subId,
+              changes: update.changes
+            } : {
+              type: "query-snapshot",
+              subscriptionId: subId,
+              result: update.result ?? null
+            });
+          }
+        }
+      });
+      sharedQueries.set(sharedKey, entry);
+      attach(entry);
+      try {
+        const result = await entry.live.start();
+        entry.lastResult = result ?? null;
+        entry.ready = true;
+        for (const [subClientId, subIds] of entry.subscribers) {
+          for (const subId of subIds) {
+            ctx.connectionManager.sendToClient(subClientId, {
+              type: "query-snapshot",
+              subscriptionId: subId,
+              result: result ?? null
+            });
+          }
+        }
+        entry.live.flush();
       } catch (err3) {
-        live.stop();
-        clientQuerySubs.get(client.id)?.delete(subscriptionId);
+        entry.live.stop();
+        sharedQueries.delete(sharedKey);
+        for (const subClientId of entry.subscribers.keys()) {
+          const keys = clientSubKeys.get(subClientId);
+          if (keys) {
+            for (const [subId, key] of keys) {
+              if (key === sharedKey)
+                keys.delete(subId);
+            }
+          }
+        }
         console.error(`[Arc] Query subscription error (${descriptor?.element}.${descriptor?.method}):`, err3);
         ctx.connectionManager.sendToClient(client.id, {
           type: "error",
@@ -37620,11 +37931,10 @@ function querySubscriptionHandler() {
       return true;
     }
     if (message.type === "unsubscribe-query") {
-      const subs = clientQuerySubs.get(client.id);
-      const live = subs?.get(message.subscriptionId);
-      if (live) {
-        live.stop();
-        subs.delete(message.subscriptionId);
+      const key = clientSubKeys.get(client.id)?.get(message.subscriptionId);
+      if (key) {
+        detachSub(client.id, message.subscriptionId, key);
+        clientSubKeys.get(client.id)?.delete(message.subscriptionId);
       }
       return true;
     }
@@ -37826,7 +38136,7 @@ async function createArcServer(config) {
     cronScheduler,
     stop: () => {
       cronScheduler.stop();
-      server.stop();
+      server.stop(true);
     }
   };
 }
@@ -37865,10 +38175,10 @@ function generateShellHtml(appName, manifest, initial, stylesHash) {
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
   <title>${manifest?.title ?? appName}</title>${manifest?.favicon ? `
   <link rel="icon" href="${manifest.favicon}">` : ""}${manifest ? `
-  <link rel="manifest" href="/manifest.json">` : ""}
+  <link rel="manifest" href="/manifest.json${stylesQs}">` : ""}
   <link rel="stylesheet" href="/styles.css${stylesQs}" />
   <link rel="stylesheet" href="/theme.css${stylesQs}" />
   <link rel="modulepreload" href="${initialUrl}" />${otelTag}
@@ -38046,7 +38356,10 @@ function staticFilesHandler(ws, devMode, getManifest) {
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     if ((path4 === "/manifest.json" || path4 === "/manifest.webmanifest") && ws.manifest) {
-      return serveFile(ws.manifest.path, ctx.corsHeaders);
+      return serveFile(ws.manifest.path, {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
+      });
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
       const publicFile = join21(ws.publicDir, path4.slice(1));
@@ -38064,7 +38377,12 @@ function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap, telemetry) {
       if (payloads.length === 0 && ctx.tokenPayload) {
         payloads = [ctx.tokenPayload];
       }
-      return filterManifestForTokens(getManifest(), moduleAccessMap, payloads).then((filtered) => Response.json(filtered, { headers: ctx.corsHeaders }));
+      return filterManifestForTokens(getManifest(), moduleAccessMap, payloads).then((filtered) => Response.json(filtered, {
+        headers: {
+          ...ctx.corsHeaders,
+          "Cache-Control": "no-cache, private"
+        }
+      }));
     }
     if (url.pathname === "/api/translations") {
       const config = readTranslationsConfig(ws.rootDir);
@@ -38114,7 +38432,11 @@ function devReloadHandler(sseClients) {
 function spaFallbackHandler(getShellHtml) {
   return (_req, _url, ctx) => {
     return new Response(getShellHtml(), {
-      headers: { ...ctx.corsHeaders, "Content-Type": "text/html" }
+      headers: {
+        ...ctx.corsHeaders,
+        "Content-Type": "text/html",
+        "Cache-Control": "no-cache, must-revalidate"
+      }
     });
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.7.27",
+  "version": "0.7.28",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,13 +12,13 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform --external @arcote.tech/arc-map --external '@opentelemetry/*' && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.7.27",
-    "@arcote.tech/arc-ds": "^0.7.27",
-    "@arcote.tech/arc-react": "^0.7.27",
-    "@arcote.tech/arc-host": "^0.7.27",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.27",
-    "@arcote.tech/arc-adapter-db-postgres": "^0.7.27",
-    "@arcote.tech/arc-otel": "^0.7.27",
+    "@arcote.tech/arc": "^0.7.28",
+    "@arcote.tech/arc-ds": "^0.7.28",
+    "@arcote.tech/arc-react": "^0.7.28",
+    "@arcote.tech/arc-host": "^0.7.28",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.28",
+    "@arcote.tech/arc-adapter-db-postgres": "^0.7.28",
+    "@arcote.tech/arc-otel": "^0.7.28",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.57.0",
     "@opentelemetry/core": "^1.30.0",
@@ -31,8 +31,8 @@
     "@opentelemetry/sdk-trace-base": "^1.30.0",
     "@opentelemetry/sdk-trace-node": "^1.30.0",
     "@opentelemetry/semantic-conventions": "^1.27.0",
-    "@arcote.tech/platform": "^0.7.27",
-    "@arcote.tech/arc-map": "^0.7.27",
+    "@arcote.tech/platform": "^0.7.28",
+    "@arcote.tech/arc-map": "^0.7.28",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/src/platform/server.ts

@@ -134,8 +134,8 @@ export function generateShellHtml(
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>${manifest?.title ?? appName}</title>${manifest?.favicon ? `\n  <link rel="icon" href="${manifest.favicon}">` : ""}${manifest ? `\n  <link rel="manifest" href="/manifest.json">` : ""}
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
+  <title>${manifest?.title ?? appName}</title>${manifest?.favicon ? `\n  <link rel="icon" href="${manifest.favicon}">` : ""}${manifest ? `\n  <link rel="manifest" href="/manifest.json${stylesQs}">` : ""}
   <link rel="stylesheet" href="/styles.css${stylesQs}" />
   <link rel="stylesheet" href="/theme.css${stylesQs}" />
   <link rel="modulepreload" href="${initialUrl}" />${otelTag}
@@ -403,9 +403,15 @@ function staticFilesHandler(
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable",
       });
 
-    // Serve manifest.json from root dir
+    // Serve manifest.json from root dir. Stable URL, content changes between
+    // builds — HTML references it with `?v=<stylesHash>` (generateShellHtml),
+    // so the URL changes on rebuild and immutable caching is safe. Handler
+    // ignores the query string itself (same pattern as /styles.css).
     if ((path === "/manifest.json" || path === "/manifest.webmanifest") && ws.manifest) {
-      return serveFile(ws.manifest.path, ctx.corsHeaders);
+      return serveFile(ws.manifest.path, {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable",
+      });
     }
 
     // Public files (files with extensions)
@@ -436,7 +442,18 @@ function apiEndpointsHandler(
         payloads = [ctx.tokenPayload];
       }
       return filterManifestForTokens(getManifest(), moduleAccessMap, payloads)
-        .then((filtered) => Response.json(filtered, { headers: ctx.corsHeaders }));
+        .then((filtered) =>
+          Response.json(filtered, {
+            headers: {
+              ...ctx.corsHeaders,
+              // Treść zależy od tokenu (filterManifestForTokens) i zmienia się
+              // co deploy. Nie jest artefaktem buildu — `private`, by pośredni
+              // cache nie podał manifestu jednego usera drugiemu, `no-cache`,
+              // by po deployu klient dostał świeże hashe/podpisy chunków.
+              "Cache-Control": "no-cache, private",
+            },
+          }),
+        );
     }
 
     if (url.pathname === "/api/translations") {
@@ -501,7 +518,15 @@ function devReloadHandler(
 function spaFallbackHandler(getShellHtml: () => string): ArcHttpHandler {
   return (_req, _url, ctx) => {
     return new Response(getShellHtml(), {
-      headers: { ...ctx.corsHeaders, "Content-Type": "text/html" },
+      headers: {
+        ...ctx.corsHeaders,
+        "Content-Type": "text/html",
+        // Stabilny URL, zmienna treść (embeduje initial.<hash>.js + styles ?v=).
+        // Kotwica całego łańcucha — musi być zawsze rewalidowana, inaczej po
+        // deployu przeglądarka/CDN podaje stary shell wskazujący na nieistniejące
+        // już bundle. Hash nie pomoże: to URL trasy, którego nie da się zahashować.
+        "Cache-Control": "no-cache, must-revalidate",
+      },
     });
   };
 }