@arcote.tech/arc-cli 0.7.7 → 0.7.9

package/dist/index.js

@@ -14860,10 +14860,11 @@ class ArcFunction {
       params: schema instanceof ArcObject ? schema : new ArcObject(schema)
     });
   }
-  withResult(schema) {
+  withResult(...schemas) {
+    const results = schemas.map((s) => s instanceof ArcObject ? s : new ArcObject(s));
     return new ArcFunction({
       ...this.data,
-      result: schema instanceof ArcObject ? schema : new ArcObject(schema)
+      results
     });
   }
   query(elements) {
@@ -14891,6 +14892,12 @@ class ArcFunction {
       description: desc
     });
   }
+  private() {
+    return new ArcFunction({
+      ...this.data,
+      isPrivate: true
+    });
+  }
   handle(handler) {
     return new ArcFunction({
       ...this.data,
@@ -14912,8 +14919,8 @@ class ArcFunction {
   get params() {
     return this.data.params;
   }
-  get result() {
-    return this.data.result;
+  get results() {
+    return this.data.results;
   }
   async verifyProtections(tokens) {
     if (!this.data.protections || this.data.protections.length === 0) {
@@ -14937,7 +14944,7 @@ class ArcFunction {
   toJsonSchema() {
     return {
       params: this.data.params?.toJsonSchema?.() ?? null,
-      result: this.data.result?.toJsonSchema?.() ?? null
+      results: this.data.results.map((r2) => r2.toJsonSchema())
     };
   }
 }
@@ -15294,19 +15301,26 @@ function buildContextAccessor(context2, adapters, contextMethod, onCall) {
     if (typeof ctxFn !== "function")
       continue;
     const methods = ctxFn.call(element2, adapters);
-    if (!methods || typeof methods !== "object")
+    if (!methods)
+      continue;
+    const elementName = element2.name;
+    if (typeof methods === "function") {
+      result[elementName] = (...args) => onCall({ element: elementName, method: "", args }, () => methods(...args));
+      continue;
+    }
+    if (typeof methods !== "object")
       continue;
     const wrapped = {};
     for (const [methodName, method] of Object.entries(methods)) {
       if (typeof method !== "function")
         continue;
-      wrapped[methodName] = (...args) => onCall({ element: element2.name, method: methodName, args }, () => method(...args));
+      wrapped[methodName] = (...args) => onCall({ element: elementName, method: methodName, args }, () => method(...args));
     }
-    result[element2.name] = wrapped;
+    result[elementName] = wrapped;
   }
   return result;
 }
-function executeDescriptor(descriptor, context2, adapters, contextMethod) {
+function executeDescriptor(descriptor, context2, adapters, contextMethod, options) {
   const element2 = context2.get(descriptor.element);
   if (!element2) {
     throw new Error(`Element '${descriptor.element}' not found in context`);
@@ -15316,10 +15330,19 @@ function executeDescriptor(descriptor, context2, adapters, contextMethod) {
     throw new Error(`Element '${descriptor.element}' has no ${contextMethod}`);
   }
   const methods = ctxFn.call(element2, adapters);
+  if (typeof methods === "function") {
+    if (options?.fromWire && methods.__isPrivate) {
+      throw new Error(`Element "${descriptor.element}" is private and not callable from a client.`);
+    }
+    return methods(...descriptor.args);
+  }
   const method = methods?.[descriptor.method];
   if (typeof method !== "function") {
     throw new Error(`Method '${descriptor.method}' not found on '${descriptor.element}'`);
   }
+  if (options?.fromWire && method.__isPrivate) {
+    throw new Error(`Method "${descriptor.element}.${descriptor.method}" is private and not callable from a client.`);
+  }
   return method(...descriptor.args);
 }
 
@@ -19202,7 +19225,7 @@ var init_dist = __esm(() => {
       this.data = data;
       this.#fn = fn ?? new ArcFunction({
         params: data.params,
-        result: null,
+        results: data.results,
         queryElements: data.queryElements,
         mutationElements: data.mutationElements,
         protections: data.protections || [],
@@ -19233,7 +19256,8 @@ var init_dist = __esm(() => {
       }, newFn);
     }
     withResult(...schemas) {
-      return new ArcCommand({ ...this.data, results: schemas }, this.#fn);
+      const newFn = this.#fn.withResult(...schemas);
+      return new ArcCommand({ ...this.data, results: newFn.data.results }, newFn);
     }
     handle(handler) {
       const newFn = new ArcFunction({
@@ -19324,7 +19348,7 @@ var init_dist = __esm(() => {
       this.data = data;
       this.#fn = fn ?? new ArcFunction({
         params: null,
-        result: null,
+        results: [],
         queryElements: data.queryElements,
         mutationElements: data.mutationElements,
         protections: [],
@@ -19430,7 +19454,7 @@ var init_dist = __esm(() => {
       this.data = data;
       this.#fn = fn ?? new ArcFunction({
         params: null,
-        result: null,
+        results: [],
         queryElements: data.queryElements,
         mutationElements: data.mutationElements,
         protections: data.protections || [],
@@ -22193,10 +22217,11 @@ class ArcFunction2 {
       params: schema instanceof ArcObject2 ? schema : new ArcObject2(schema)
     });
   }
-  withResult(schema) {
+  withResult(...schemas) {
+    const results = schemas.map((s) => s instanceof ArcObject2 ? s : new ArcObject2(s));
     return new ArcFunction2({
       ...this.data,
-      result: schema instanceof ArcObject2 ? schema : new ArcObject2(schema)
+      results
     });
   }
   query(elements) {
@@ -22224,6 +22249,12 @@ class ArcFunction2 {
       description: desc
     });
   }
+  private() {
+    return new ArcFunction2({
+      ...this.data,
+      isPrivate: true
+    });
+  }
   handle(handler) {
     return new ArcFunction2({
       ...this.data,
@@ -22245,8 +22276,8 @@ class ArcFunction2 {
   get params() {
     return this.data.params;
   }
-  get result() {
-    return this.data.result;
+  get results() {
+    return this.data.results;
   }
   async verifyProtections(tokens) {
     if (!this.data.protections || this.data.protections.length === 0) {
@@ -22270,7 +22301,7 @@ class ArcFunction2 {
   toJsonSchema() {
     return {
       params: this.data.params?.toJsonSchema?.() ?? null,
-      result: this.data.result?.toJsonSchema?.() ?? null
+      results: this.data.results.map((r2) => r2.toJsonSchema())
     };
   }
 }
@@ -22627,19 +22658,26 @@ function buildContextAccessor2(context2, adapters, contextMethod, onCall) {
     if (typeof ctxFn !== "function")
       continue;
     const methods = ctxFn.call(element2, adapters);
-    if (!methods || typeof methods !== "object")
+    if (!methods)
+      continue;
+    const elementName = element2.name;
+    if (typeof methods === "function") {
+      result[elementName] = (...args) => onCall({ element: elementName, method: "", args }, () => methods(...args));
+      continue;
+    }
+    if (typeof methods !== "object")
       continue;
     const wrapped = {};
     for (const [methodName, method] of Object.entries(methods)) {
       if (typeof method !== "function")
         continue;
-      wrapped[methodName] = (...args) => onCall({ element: element2.name, method: methodName, args }, () => method(...args));
+      wrapped[methodName] = (...args) => onCall({ element: elementName, method: methodName, args }, () => method(...args));
     }
-    result[element2.name] = wrapped;
+    result[elementName] = wrapped;
   }
   return result;
 }
-function executeDescriptor2(descriptor, context2, adapters, contextMethod) {
+function executeDescriptor2(descriptor, context2, adapters, contextMethod, options) {
   const element2 = context2.get(descriptor.element);
   if (!element2) {
     throw new Error(`Element '${descriptor.element}' not found in context`);
@@ -22649,10 +22687,19 @@ function executeDescriptor2(descriptor, context2, adapters, contextMethod) {
     throw new Error(`Element '${descriptor.element}' has no ${contextMethod}`);
   }
   const methods = ctxFn.call(element2, adapters);
+  if (typeof methods === "function") {
+    if (options?.fromWire && methods.__isPrivate) {
+      throw new Error(`Element "${descriptor.element}" is private and not callable from a client.`);
+    }
+    return methods(...descriptor.args);
+  }
   const method = methods?.[descriptor.method];
   if (typeof method !== "function") {
     throw new Error(`Method '${descriptor.method}' not found on '${descriptor.element}'`);
   }
+  if (options?.fromWire && method.__isPrivate) {
+    throw new Error(`Method "${descriptor.element}.${descriptor.method}" is private and not callable from a client.`);
+  }
   return method(...descriptor.args);
 }
 
@@ -24970,7 +25017,7 @@ var init_dist2 = __esm(() => {
       this.data = data;
       this.#fn = fn ?? new ArcFunction2({
         params: data.params,
-        result: null,
+        results: data.results,
         queryElements: data.queryElements,
         mutationElements: data.mutationElements,
         protections: data.protections || [],
@@ -25001,7 +25048,8 @@ var init_dist2 = __esm(() => {
       }, newFn);
     }
     withResult(...schemas) {
-      return new ArcCommand2({ ...this.data, results: schemas }, this.#fn);
+      const newFn = this.#fn.withResult(...schemas);
+      return new ArcCommand2({ ...this.data, results: newFn.data.results }, newFn);
     }
     handle(handler) {
       const newFn = new ArcFunction2({
@@ -25092,7 +25140,7 @@ var init_dist2 = __esm(() => {
       this.data = data;
       this.#fn = fn ?? new ArcFunction2({
         params: null,
-        result: null,
+        results: [],
         queryElements: data.queryElements,
         mutationElements: data.mutationElements,
         protections: [],
@@ -25198,7 +25246,7 @@ var init_dist2 = __esm(() => {
       this.data = data;
       this.#fn = fn ?? new ArcFunction2({
         params: null,
-        result: null,
+        results: [],
         queryElements: data.queryElements,
         mutationElements: data.mutationElements,
         protections: data.protections || [],
@@ -25770,6 +25818,7 @@ __export(exports_init_server, {
   wrapDbAdapter: () => wrapDbAdapter,
   initServerTelemetry: () => initServerTelemetry
 });
+import { diag, DiagConsoleLogger, DiagLogLevel } from "@opentelemetry/api";
 import { OTLPLogExporter } from "@opentelemetry/exporter-logs-otlp-http";
 import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-http";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
@@ -26083,6 +26132,9 @@ function wrapDbAdapter(adapter, telemetry, dbSystem) {
 }
 function initServerTelemetry(config) {
   const telemetry = new ArcTelemetry({ ...config, environment: "server" });
+  if (telemetry.config.debug) {
+    diag.setLogger(new DiagConsoleLogger, DiagLogLevel.ALL);
+  }
   if (!telemetry.config.enabled) {
     return { telemetry, shutdown: async () => {} };
   }
@@ -26131,7 +26183,8 @@ function initServerTelemetry(config) {
       serviceName: config.serviceName,
       endpoint,
       sampleRate: telemetry.config.sampleRate,
-      mode: telemetry.config.mode
+      mode: telemetry.config.mode,
+      active: telemetry.active
     });
   }
   const shutdown = async () => {
@@ -34965,8 +35018,11 @@ var TAILWIND_INPUT_TEMPLATE = (rootRel) => `@import "tailwindcss";
 
 @source "${rootRel}/packages/*/*.{ts,tsx}";
 @source "${rootRel}/packages/*/src/**/*.{ts,tsx}";
-@source "${rootRel}/node_modules/@arcote.tech/platform/src/**/*.{ts,tsx}";
-@source "${rootRel}/node_modules/@arcote.tech/arc-ds/src/**/*.{ts,tsx}";
+/* Skanuj wszystkie framework packages \u2014 fragmenty (arc-chat, arc-ai-voice\u2026)
+   wnosz\u0105 w\u0142asne komponenty React z klasami Tailwind, kt\xF3re musz\u0105 trafi\u0107 do
+   CSS. Bez tego absolute positioning, color/border klasy w nowych fragmentach
+   s\u0105 ignorowane \u2014 komponent renderuje si\u0119 bez styl\xF3w. */
+@source "${rootRel}/node_modules/@arcote.tech/*/src/**/*.{ts,tsx}";
 
 @custom-variant dark (&:is(.dark *));
 
@@ -35233,11 +35289,21 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = []) {
   } catch (e) {
     console.warn(`[arc-otel] could not resolve @arcote.tech/arc-otel \u2014 image will run without telemetry deps: ${e.message}`);
   }
+  let rootArc;
+  const rootPkgPath = join10(rootDir, "package.json");
+  if (existsSync9(rootPkgPath)) {
+    try {
+      const rootPkg = JSON.parse(readFileSync9(rootPkgPath, "utf-8"));
+      if (rootPkg.arc && typeof rootPkg.arc === "object")
+        rootArc = rootPkg.arc;
+    } catch {}
+  }
   const manifest = {
     name: "arc-platform-framework",
     private: true,
     type: "module",
-    dependencies: versions
+    dependencies: versions,
+    ...rootArc ? { arc: rootArc } : {}
   };
   const manifestPath = join10(arcDir, "package.json");
   writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
@@ -36066,6 +36132,10 @@ function generateCompose({ cfg }) {
     lines.push("      retries: 20");
     lines.push("    networks:");
     lines.push("      - arc-net");
+    if (env2.db.exposeOnLoopback !== undefined) {
+      lines.push("    ports:");
+      lines.push(`      - "127.0.0.1:${env2.db.exposeOnLoopback}:5432"`);
+    }
     lines.push("");
   }
   if (cfg.observability?.enabled) {
@@ -36255,7 +36325,10 @@ processors:
     send_batch_max_size: 1024
 
   # Tail-based sampling \u2014 applied after a full trace has been assembled.
-  # Errors and slow traces are kept 100%, everything else at 10%.
+  # Errors + slow traces zachowywane w 100%, normalne traces r\xF3wnie\u017C 100%
+  # przy obecnej skali (boostrap produkcji). Tail sampling matchuje OR po
+  # policies \u2014 bez "always" policy WSZYSTKIE OK traces by\u0142yby droppowane.
+  # Obni\u017C 'random_100pct' do np. 10% gdy ruch eksploduje.
   tail_sampling:
     decision_wait: 10s
     num_traces: 50000
@@ -36267,9 +36340,9 @@ processors:
       - name: slow
         type: latency
         latency: { threshold_ms: 500 }
-      - name: random_10pct
+      - name: random_100pct
         type: probabilistic
-        probabilistic: { sampling_percentage: 10 }
+        probabilistic: { sampling_percentage: 100 }
 
   # Drop high-cardinality / PII attributes that might slip past app-side
   # sanitization. Belt-and-suspenders before they hit long-term storage.
@@ -37188,7 +37261,8 @@ function validateDeployConfig(input) {
       } else if (dbType === "postgres") {
         db = {
           type: "postgres",
-          image: optionalString(dbRaw, `envs.${name}.db.image`)
+          image: optionalString(dbRaw, `envs.${name}.db.image`),
+          exposeOnLoopback: optionalNumber(dbRaw, `envs.${name}.db.exposeOnLoopback`)
         };
       } else {
         throw new Error(`deploy.arc.json: envs.${name}.db.type must be "sqlite" or "postgres" (got "${dbType}")`);
@@ -39069,7 +39143,7 @@ class ContextHandler {
       console.log(`[ARC:Seed] Seeded ${data.length} row(s) into ${tableName}`);
     }
   }
-  async executeCommand(commandName, params, rawToken) {
+  async executeCommand(commandName, params, rawToken, options) {
     const includePayloads = this.telemetry?.shouldIncludePayloads() ?? false;
     const baseAttrs = {
       "rpc.system": "arc",
@@ -39094,6 +39168,9 @@ class ContextHandler {
       if (!command) {
         throw new Error(`Command '${commandName}' not found`);
       }
+      if (!options?.internal && command.__isPrivate) {
+        throw new Error(`Command '${commandName}' is private and not callable from a client.`);
+      }
       try {
         return await command(params);
       } catch (error) {
@@ -39701,7 +39778,7 @@ class CronScheduler {
       console.log(`[ARC:Cron] ${commandName}: executing for ${instances.length} instance(s)...`);
       for (const instance of instances) {
         try {
-          await this.contextHandler.executeCommand(commandName, { _id: instance._id }, null);
+          await this.contextHandler.executeCommand(commandName, { _id: instance._id }, null, { internal: true });
         } catch (error) {
           console.error(`[ARC:Cron] ${commandName} failed for instance ${instance._id}:`, error);
         }
@@ -40585,7 +40662,7 @@ function staticFilesHandler(ws, devMode, getManifest) {
     return null;
   };
 }
-function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap) {
+function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap, telemetry) {
   return (req, url, ctx) => {
     if (url.pathname === "/api/modules") {
       const arcTokensHeader = req.headers.get("X-Arc-Tokens");
@@ -40605,7 +40682,11 @@ function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap) {
       return Response.json({
         status: "ok",
         groups: Object.keys(getManifest().groups).length,
-        clients: cm?.clientCount ?? 0
+        clients: cm?.clientCount ?? 0,
+        otel: {
+          enabled: telemetry?.config.enabled ?? false,
+          active: telemetry?.active ?? false
+        }
       }, { headers: ctx.corsHeaders });
     }
     return null;
@@ -40656,7 +40737,8 @@ async function startPlatformServer(opts) {
         environment: "server",
         endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
         mode: devMode ? "development" : "production",
-        sampleRate: devMode ? 1 : 1
+        sampleRate: devMode ? 1 : 1,
+        debug: process.env.ARC_OTEL_DEBUG === "true"
       });
       telemetry = init2.telemetry;
       telemetryShutdown = init2.shutdown;
@@ -40706,7 +40788,7 @@ async function startPlatformServer(opts) {
           corsHeaders: cors
         };
         const handlers = [
-          apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
+          apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry),
           devReloadHandler(sseClients),
           staticFilesHandler(ws, !!devMode, getManifest),
           spaFallbackHandler(getShellHtml)
@@ -40744,7 +40826,7 @@ async function startPlatformServer(opts) {
     dbAdapterFactory,
     port,
     httpHandlers: [
-      apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
+      apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry),
       devReloadHandler(sseClients),
       staticFilesHandler(ws, !!devMode, getManifest),
       spaFallbackHandler(getShellHtml)
@@ -40788,16 +40870,35 @@ async function startPlatform(opts) {
   } else {
     log2("No context \u2014 server endpoints skipped");
   }
-  const platform3 = await startPlatformServer({
-    ws,
-    port,
-    manifest,
-    context: context2,
-    moduleAccess,
-    dbPath,
-    devMode
-  });
-  ok(`Server on http://localhost:${port}`);
+  const MAX_PORT_ATTEMPTS = devMode ? 20 : 1;
+  let platform3 = null;
+  let actualPort = port;
+  for (let i = 0;i < MAX_PORT_ATTEMPTS; i++) {
+    try {
+      platform3 = await startPlatformServer({
+        ws,
+        port: actualPort,
+        manifest,
+        context: context2,
+        moduleAccess,
+        dbPath,
+        devMode
+      });
+      break;
+    } catch (e2) {
+      const msg = e2.message || "";
+      const inUse = msg.includes("EADDRINUSE") || msg.includes("address already in use") || msg.includes("in use");
+      if (!inUse || i === MAX_PORT_ATTEMPTS - 1)
+        throw e2;
+      log2(`Port ${actualPort} in use, trying ${actualPort + 1}...`);
+      actualPort++;
+    }
+  }
+  if (!platform3) {
+    err(`Failed to bind a free port starting from ${port}`);
+    process.exit(1);
+  }
+  ok(`Server on http://localhost:${actualPort}`);
   if (platform3.contextHandler) {
     ok("Commands, queries, WebSocket \u2014 all on same port");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,13 +12,13 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform --external '@opentelemetry/*' && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.7.7",
-    "@arcote.tech/arc-ds": "^0.7.7",
-    "@arcote.tech/arc-react": "^0.7.7",
-    "@arcote.tech/arc-host": "^0.7.7",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.7",
-    "@arcote.tech/arc-adapter-db-postgres": "^0.7.7",
-    "@arcote.tech/arc-otel": "^0.7.7",
+    "@arcote.tech/arc": "^0.7.9",
+    "@arcote.tech/arc-ds": "^0.7.9",
+    "@arcote.tech/arc-react": "^0.7.9",
+    "@arcote.tech/arc-host": "^0.7.9",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.9",
+    "@arcote.tech/arc-adapter-db-postgres": "^0.7.9",
+    "@arcote.tech/arc-otel": "^0.7.9",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.57.0",
     "@opentelemetry/core": "^1.30.0",
@@ -31,7 +31,7 @@
     "@opentelemetry/sdk-trace-base": "^1.30.0",
     "@opentelemetry/sdk-trace-node": "^1.30.0",
     "@opentelemetry/semantic-conventions": "^1.27.0",
-    "@arcote.tech/platform": "^0.7.7",
+    "@arcote.tech/platform": "^0.7.9",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/src/builder/dependency-collector.ts

@@ -79,11 +79,27 @@ export function collectFrameworkDeps(
       `[arc-otel] could not resolve @arcote.tech/arc-otel — image will run without telemetry deps: ${(e as Error).message}`,
     );
   }
+  // Pole `arc` z root package.json (translations, theme, manifest...) musi
+  // trafić do obrazu runtime — `readTranslationsConfig` w server.ts czyta je
+  // z `ws.rootDir/package.json` (czyli /app/package.json w obrazie). Bez
+  // przepisania `/api/translations` zwraca pustą listę locale, `useI18nConfig`
+  // w PlatformApp nie ustawia stanu, `I18nProvider` nie zostaje mountowany
+  // i każde `useI18n()` wyrzuca błąd na produkcji.
+  let rootArc: unknown;
+  const rootPkgPath = join(rootDir, "package.json");
+  if (existsSync(rootPkgPath)) {
+    try {
+      const rootPkg = JSON.parse(readFileSync(rootPkgPath, "utf-8")) as Record<string, unknown>;
+      if (rootPkg.arc && typeof rootPkg.arc === "object") rootArc = rootPkg.arc;
+    } catch {}
+  }
+
   const manifest = {
     name: "arc-platform-framework",
     private: true,
     type: "module" as const,
     dependencies: versions,
+    ...(rootArc ? { arc: rootArc } : {}),
   };
   const manifestPath = join(arcDir, "package.json");
   writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");

package/src/builder/module-builder.ts

@@ -722,8 +722,11 @@ const TAILWIND_INPUT_TEMPLATE = (rootRel: string) => `@import "tailwindcss";
 
 @source "${rootRel}/packages/*/*.{ts,tsx}";
 @source "${rootRel}/packages/*/src/**/*.{ts,tsx}";
-@source "${rootRel}/node_modules/@arcote.tech/platform/src/**/*.{ts,tsx}";
-@source "${rootRel}/node_modules/@arcote.tech/arc-ds/src/**/*.{ts,tsx}";
+/* Skanuj wszystkie framework packages — fragmenty (arc-chat, arc-ai-voice…)
+   wnoszą własne komponenty React z klasami Tailwind, które muszą trafić do
+   CSS. Bez tego absolute positioning, color/border klasy w nowych fragmentach
+   są ignorowane — komponent renderuje się bez stylów. */
+@source "${rootRel}/node_modules/@arcote.tech/*/src/**/*.{ts,tsx}";
 
 @custom-variant dark (&:is(.dark *));
 

package/src/deploy/compose.ts

@@ -164,8 +164,15 @@ export function generateCompose({ cfg }: ComposeOptions): string {
     lines.push("      retries: 20");
     lines.push("    networks:");
     lines.push("      - arc-net");
-    // No `ports:` — the database is only reachable from other containers
-    // on `arc-net`. Exposing 5432 to the host would defeat the isolation.
+    // `ports:` is omitted by default — the database is only reachable from
+    // other containers on `arc-net`. When `exposeOnLoopback` is set in
+    // deploy.arc.json, bind to `127.0.0.1:<n>:5432` on the host so SSH
+    // tunneling (DBeaver/psql via `ssh -L`) works without exposing the
+    // port to the public internet (ufw only opens 22/80/443).
+    if (env.db.exposeOnLoopback !== undefined) {
+      lines.push("    ports:");
+      lines.push(`      - "127.0.0.1:${env.db.exposeOnLoopback}:5432"`);
+    }
     lines.push("");
   }
 

package/src/deploy/config.ts

@@ -31,7 +31,21 @@ export interface DeployTarget {
  */
 export type DeployEnvDb =
   | { type: "sqlite" }
-  | { type: "postgres"; image?: string };
+  | {
+      type: "postgres";
+      image?: string;
+      /**
+       * Bind the postgres port to `127.0.0.1:<n>` on the host. Container
+       * pozostaje niewystawiony do internetu (ufw przepuszcza tylko
+       * 22/80/443), ale staje się dostępny przez SSH tunnel
+       * (`ssh -L <n>:localhost:<n> deploy@host`) np. dla DBeavera.
+       *
+       * Per-env różne porty unikają kolizji gdy kilka środowisk dzieli
+       * jeden VPS. Pomiń pole żeby zachować pełną izolację (tylko docker
+       * network).
+       */
+      exposeOnLoopback?: number;
+    };
 
 export interface DeployEnv {
   /** Subdomain or full domain routed by Caddy. */
@@ -301,6 +315,10 @@ export function validateDeployConfig(input: unknown): DeployConfig {
         db = {
           type: "postgres",
           image: optionalString(dbRaw, `envs.${name}.db.image`),
+          exposeOnLoopback: optionalNumber(
+            dbRaw,
+            `envs.${name}.db.exposeOnLoopback`,
+          ),
         };
       } else {
         throw new Error(

package/src/deploy/observability-configs.ts

@@ -13,9 +13,11 @@ import type { DeployConfig, DeployObservability } from "./config";
 //   - logs:    7d  retention (Loki chunks on local disk)
 //   - metrics: 30d retention (Prometheus TSDB on local disk)
 //
-// Tail sampling: every error + every span >500ms + 10% random. Decided in
-// the collector so per-service SDKs can be left at always-on without
-// flooding the backend.
+// Tail sampling: every error + every span >500ms + 100% random przy obecnej
+// skali. Tail_sampling matchuje OR po policies — bez "always" policy WSZYSTKIE
+// OK traces byłyby droppowane (errors + slow nie obejmują happy path).
+// Obniż `random_100pct` w `tail_sampling.policies` gdy backend zacznie się
+// zatkać; do tego momentu lepiej widzieć wszystko.
 // ---------------------------------------------------------------------------
 
 const DEFAULT_RETENTION = {
@@ -60,7 +62,10 @@ processors:
     send_batch_max_size: 1024
 
   # Tail-based sampling — applied after a full trace has been assembled.
-  # Errors and slow traces are kept 100%, everything else at 10%.
+  # Errors + slow traces zachowywane w 100%, normalne traces również 100%
+  # przy obecnej skali (boostrap produkcji). Tail sampling matchuje OR po
+  # policies — bez "always" policy WSZYSTKIE OK traces byłyby droppowane.
+  # Obniż 'random_100pct' do np. 10% gdy ruch eksploduje.
   tail_sampling:
     decision_wait: 10s
     num_traces: 50000
@@ -72,9 +77,9 @@ processors:
       - name: slow
         type: latency
         latency: { threshold_ms: 500 }
-      - name: random_10pct
+      - name: random_100pct
         type: probabilistic
-        probabilistic: { sampling_percentage: 10 }
+        probabilistic: { sampling_percentage: 100 }
 
   # Drop high-cardinality / PII attributes that might slip past app-side
   # sanitization. Belt-and-suspenders before they hit long-term storage.

package/src/platform/server.ts

@@ -415,6 +415,7 @@ function apiEndpointsHandler(
   getManifest: () => BuildManifest,
   cm: ConnectionManager | null,
   moduleAccessMap: Map<string, ModuleAccess>,
+  telemetry?: import("@arcote.tech/arc-otel").ArcTelemetry,
 ): ArcHttpHandler {
   return (req, url, ctx) => {
     if (url.pathname === "/api/modules") {
@@ -442,6 +443,16 @@ function apiEndpointsHandler(
           status: "ok",
           groups: Object.keys(getManifest().groups).length,
           clients: cm?.clientCount ?? 0,
+          otel: {
+            // `enabled` — `ARC_OTEL_ENABLED` w env i init przeszedł
+            // (telemetry obiekt istnieje, config.enabled === true).
+            // `active` — to samo + `attach()` wywołane (tracer ustawiony).
+            // Rozjazd między tymi flagami zwykle oznacza że
+            // `initServerTelemetry` przeszło na wczesny return z
+            // `config.enabled === false`.
+            enabled: telemetry?.config.enabled ?? false,
+            active: telemetry?.active ?? false,
+          },
         },
         { headers: ctx.corsHeaders },
       );
@@ -510,6 +521,7 @@ export async function startPlatformServer(
         endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
         mode: devMode ? "development" : "production",
         sampleRate: devMode ? 1.0 : 1.0, // head-based 100%, collector tail-samples
+        debug: process.env.ARC_OTEL_DEBUG === "true",
       });
       telemetry = init.telemetry;
       telemetryShutdown = init.shutdown;
@@ -572,7 +584,7 @@ export async function startPlatformServer(
 
         // Platform handlers only
         const handlers: ArcHttpHandler[] = [
-          apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
+          apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry),
           devReloadHandler(sseClients),
           staticFilesHandler(ws, !!devMode, getManifest),
           spaFallbackHandler(getShellHtml),
@@ -626,7 +638,7 @@ export async function startPlatformServer(
     port,
     httpHandlers: [
       // Platform-specific handlers (checked AFTER arc handlers)
-      apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
+      apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry),
       devReloadHandler(sseClients),
       staticFilesHandler(ws, !!devMode, getManifest),
       spaFallbackHandler(getShellHtml),

package/src/platform/startup.ts

@@ -74,17 +74,39 @@ export async function startPlatform(
 
   // 3. Start the platform server. Cache headers + SSE behaviour are
   // controlled inside the server by `devMode`; we just pass the flag.
-  const platform = await startPlatformServer({
-    ws,
-    port,
-    manifest,
-    context,
-    moduleAccess,
-    dbPath,
-    devMode,
-  });
+  // In dev mode, if the port is busy, try incrementing up to 20 times.
+  const MAX_PORT_ATTEMPTS = devMode ? 20 : 1;
+  let platform: PlatformServer | null = null;
+  let actualPort = port;
+  for (let i = 0; i < MAX_PORT_ATTEMPTS; i++) {
+    try {
+      platform = await startPlatformServer({
+        ws,
+        port: actualPort,
+        manifest,
+        context,
+        moduleAccess,
+        dbPath,
+        devMode,
+      });
+      break;
+    } catch (e) {
+      const msg = (e as Error).message || "";
+      const inUse =
+        msg.includes("EADDRINUSE") ||
+        msg.includes("address already in use") ||
+        msg.includes("in use");
+      if (!inUse || i === MAX_PORT_ATTEMPTS - 1) throw e;
+      log(`Port ${actualPort} in use, trying ${actualPort + 1}...`);
+      actualPort++;
+    }
+  }
+  if (!platform) {
+    err(`Failed to bind a free port starting from ${port}`);
+    process.exit(1);
+  }
 
-  ok(`Server on http://localhost:${port}`);
+  ok(`Server on http://localhost:${actualPort}`);
   if (platform.contextHandler) {
     ok("Commands, queries, WebSocket — all on same port");
   }