@arcote.tech/arc-cli 0.8.0 → 0.8.1

package/dist/index.js

@@ -10204,11 +10204,18 @@ function notifyTokenChange(scope) {
 
 class AuthAdapter {
   scopes = new Map;
+  namespace;
+  constructor(options) {
+    this.namespace = options?.storageNamespace || undefined;
+  }
+  storageKey(scope) {
+    return this.namespace ? `${TOKEN_PREFIX}${this.namespace}:${scope}` : TOKEN_PREFIX + scope;
+  }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
       if (hasLocalStorage()) {
-        localStorage.removeItem(TOKEN_PREFIX + scope);
+        localStorage.removeItem(this.storageKey(scope));
         notifyTokenChange(scope);
       }
       return;
@@ -10218,7 +10225,7 @@ class AuthAdapter {
       if (parts.length !== 3) {
         this.scopes.delete(scope);
         if (hasLocalStorage())
-          localStorage.removeItem(TOKEN_PREFIX + scope);
+          localStorage.removeItem(this.storageKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -10232,13 +10239,13 @@ class AuthAdapter {
         }
       });
       if (hasLocalStorage()) {
-        localStorage.setItem(TOKEN_PREFIX + scope, token);
+        localStorage.setItem(this.storageKey(scope), token);
         notifyTokenChange(scope);
       }
     } catch {
       this.scopes.delete(scope);
       if (hasLocalStorage())
-        localStorage.removeItem(TOKEN_PREFIX + scope);
+        localStorage.removeItem(this.storageKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
@@ -10247,10 +10254,13 @@ class AuthAdapter {
   loadPersisted() {
     if (!hasLocalStorage())
       return;
+    const prefix = this.namespace ? `${TOKEN_PREFIX}${this.namespace}:` : TOKEN_PREFIX;
     for (let i = 0;i < localStorage.length; i++) {
       const key = localStorage.key(i);
-      if (key?.startsWith(TOKEN_PREFIX)) {
-        const scope = key.slice(TOKEN_PREFIX.length);
+      if (key?.startsWith(prefix)) {
+        const scope = key.slice(prefix.length);
+        if (!this.namespace && scope.includes(":"))
+          continue;
         const raw = localStorage.getItem(key);
         if (raw) {
           try {
@@ -10304,7 +10314,7 @@ class AuthAdapter {
   clear() {
     if (hasLocalStorage()) {
       for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(TOKEN_PREFIX + scope);
+        localStorage.removeItem(this.storageKey(scope));
       }
     }
     this.scopes.clear();
@@ -11393,6 +11403,8 @@ class ArcFunction {
       if (!tokenInstance) {
         return false;
       }
+      if (!protection.check)
+        continue;
       const result = await protection.check(tokenInstance);
       if (result === false) {
         return false;
@@ -17839,11 +17851,18 @@ function notifyTokenChange2(scope) {
 
 class AuthAdapter2 {
   scopes = new Map;
+  namespace;
+  constructor(options) {
+    this.namespace = options?.storageNamespace || undefined;
+  }
+  storageKey(scope) {
+    return this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:${scope}` : TOKEN_PREFIX2 + scope;
+  }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
       if (hasLocalStorage2()) {
-        localStorage.removeItem(TOKEN_PREFIX2 + scope);
+        localStorage.removeItem(this.storageKey(scope));
         notifyTokenChange2(scope);
       }
       return;
@@ -17853,7 +17872,7 @@ class AuthAdapter2 {
       if (parts.length !== 3) {
         this.scopes.delete(scope);
         if (hasLocalStorage2())
-          localStorage.removeItem(TOKEN_PREFIX2 + scope);
+          localStorage.removeItem(this.storageKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -17867,13 +17886,13 @@ class AuthAdapter2 {
         }
       });
       if (hasLocalStorage2()) {
-        localStorage.setItem(TOKEN_PREFIX2 + scope, token);
+        localStorage.setItem(this.storageKey(scope), token);
         notifyTokenChange2(scope);
       }
     } catch {
       this.scopes.delete(scope);
       if (hasLocalStorage2())
-        localStorage.removeItem(TOKEN_PREFIX2 + scope);
+        localStorage.removeItem(this.storageKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
@@ -17882,10 +17901,13 @@ class AuthAdapter2 {
   loadPersisted() {
     if (!hasLocalStorage2())
       return;
+    const prefix = this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:` : TOKEN_PREFIX2;
     for (let i = 0;i < localStorage.length; i++) {
       const key = localStorage.key(i);
-      if (key?.startsWith(TOKEN_PREFIX2)) {
-        const scope = key.slice(TOKEN_PREFIX2.length);
+      if (key?.startsWith(prefix)) {
+        const scope = key.slice(prefix.length);
+        if (!this.namespace && scope.includes(":"))
+          continue;
         const raw = localStorage.getItem(key);
         if (raw) {
           try {
@@ -17939,7 +17961,7 @@ class AuthAdapter2 {
   clear() {
     if (hasLocalStorage2()) {
       for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(TOKEN_PREFIX2 + scope);
+        localStorage.removeItem(this.storageKey(scope));
       }
     }
     this.scopes.clear();
@@ -19028,6 +19050,8 @@ class ArcFunction2 {
       if (!tokenInstance) {
         return false;
       }
+      if (!protection.check)
+        continue;
       const result = await protection.check(tokenInstance);
       if (result === false) {
         return false;
@@ -36633,6 +36657,7 @@ async function platformDeploy(envArg, options = {}) {
       ensurePersistedSecret(ws.rootDir, name, "ARC_APP_SECRET", () => randomBytes(32).toString("base64url"));
       ensurePersistedSecret(ws.rootDir, name, "ARC_PAIRING_TOKEN", () => randomBytes(16).toString("base64url"));
     }
+    cfg = loadDeployConfig(ws.rootDir);
   }
   if (cfg.observability?.enabled) {
     const key = cfg.observability.adminPasswordEnv ?? "ARC_OBSERVABILITY_PASSWORD";
@@ -38379,7 +38404,6 @@ init_i18n();
 import { timingSafeEqual } from "crypto";
 import { existsSync as existsSync19, mkdirSync as mkdirSync15 } from "fs";
 import { join as join22 } from "path";
-import { MAP_SCHEMA_VERSION } from "@arcote.tech/arc-map/types";
 async function resolveDbAdapterFactory(dbPath) {
   const databaseUrl = process.env.DATABASE_URL;
   if (databaseUrl && databaseUrl.length > 0) {
@@ -38648,6 +38672,7 @@ function parseCorsOrigins(raw) {
   const list = raw.split(",").map((s) => s.trim()).filter(Boolean);
   return list.length > 0 ? list : undefined;
 }
+var DISCOVERY_SCHEMA_VERSION = 1;
 function safeEqual(a2, b4) {
   const ab = Buffer.from(a2);
   const bb = Buffer.from(b4);
@@ -38670,7 +38695,7 @@ function handleDiscovery(req, ctx, ws, manifest, federation, mapUrl) {
   const platformUrl = process.env.ARC_PUBLIC_URL || new URL(req.url).origin;
   return Response.json({
     meta: {
-      schemaVersion: MAP_SCHEMA_VERSION,
+      schemaVersion: DISCOVERY_SCHEMA_VERSION,
       name: ws.appName,
       version: ws.rootPkg?.version ?? undefined
     },
@@ -39085,11 +39110,11 @@ async function startPlatform(opts) {
 }
 async function startMapTool(ws, port, authToken, platformServer, platform3) {
   try {
-    const { startMapServer, MAP_SCHEMA_VERSION: MAP_SCHEMA_VERSION2 } = await import("@arcote.tech/arc-map");
+    const { startMapServer, MAP_SCHEMA_VERSION } = await import("@arcote.tech/arc-map");
     const { getContext } = await import("@arcote.tech/platform");
     const globs = ws.packages.map((p3) => join23(p3.path, "src", "**", "*.{ts,tsx}"));
     const packageOf = (absFile) => ws.packages.find((p3) => absFile.startsWith(join23(p3.path, "src")))?.name;
-    const meta = readAppMeta(ws.rootDir, MAP_SCHEMA_VERSION2);
+    const meta = readAppMeta(ws.rootDir, MAP_SCHEMA_VERSION);
     const map = await startMapServer({
       getContext: () => getContext(),
       scan: { globs, workspaceRoot: ws.rootDir, packageOf },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,13 +12,13 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform --external @arcote.tech/arc-map --external '@opentelemetry/*' && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.8.0",
-    "@arcote.tech/arc-ds": "^0.8.0",
-    "@arcote.tech/arc-react": "^0.8.0",
-    "@arcote.tech/arc-host": "^0.8.0",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.8.0",
-    "@arcote.tech/arc-adapter-db-postgres": "^0.8.0",
-    "@arcote.tech/arc-otel": "^0.8.0",
+    "@arcote.tech/arc": "^0.8.1",
+    "@arcote.tech/arc-ds": "^0.8.1",
+    "@arcote.tech/arc-react": "^0.8.1",
+    "@arcote.tech/arc-host": "^0.8.1",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.8.1",
+    "@arcote.tech/arc-adapter-db-postgres": "^0.8.1",
+    "@arcote.tech/arc-otel": "^0.8.1",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.57.0",
     "@opentelemetry/core": "^1.30.0",
@@ -31,8 +31,8 @@
     "@opentelemetry/sdk-trace-base": "^1.30.0",
     "@opentelemetry/sdk-trace-node": "^1.30.0",
     "@opentelemetry/semantic-conventions": "^1.27.0",
-    "@arcote.tech/platform": "^0.8.0",
-    "@arcote.tech/arc-map": "^0.8.0",
+    "@arcote.tech/platform": "^0.8.1",
+    "@arcote.tech/arc-map": "^0.8.1",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/src/commands/platform-deploy.ts

@@ -119,6 +119,14 @@ export async function platformDeploy(
         randomBytes(16).toString("base64url"),
       );
     }
+    // Przeładowanie jest KONIECZNE: `loadDeployConfig` wczytał sidecar i scalił
+    // go do `cfg.envs[].envVars` ZANIM powyższe dopisało do pliku, a compose
+    // renderuje `environment` właśnie z `envVars`. Bez tego kontener startuje
+    // bez sekretów i pada na fail-fascie — przy czym DRUGI deploy by przeszedł
+    // (sidecar ma już klucze), co daje błąd zależny od historii, najgorszy do
+    // zdiagnozowania. Inaczej niż hasło Postgresa, które trafia do compose
+    // przez `${ARC_PG_PASSWORD_*}` z `/opt/arc/.env`, nie przez `envVars`.
+    cfg = loadDeployConfig(ws.rootDir);
   }
 
   // Observability stack — one Grafana password per deployment (stack-wide,

package/src/platform/server.ts

@@ -10,9 +10,6 @@ import {
 import { timingSafeEqual } from "crypto";
 import { existsSync, mkdirSync } from "fs";
 import { join } from "path";
-// Subpath `/types` jest bezzależnościowy — import z korzenia arc-map wciągnąłby
-// ts-morph do każdego startu platformy (startup.ts importuje mapę leniwie).
-import { MAP_SCHEMA_VERSION } from "@arcote.tech/arc-map/types";
 import { readTranslationsConfig } from "../i18n";
 import { err, ok, type BuildManifest, type WorkspaceInfo } from "./shared";
 import type { BuildManifestGroup, ModuleAccess } from "@arcote.tech/platform";
@@ -532,6 +529,19 @@ function parseCorsOrigins(raw: string | undefined): string[] | undefined {
   return list.length > 0 ? list : undefined;
 }
 
+/**
+ * Wersja kontraktu discovery — MUSI odpowiadać `MAP_SCHEMA_VERSION`
+ * z `@arcote.tech/arc-map/src/types.ts`.
+ *
+ * Świadomie ZDUPLIKOWANA, nie zaimportowana: `arc-map` to narzędzie DEV, którego
+ * w obrazie produkcyjnym NIE MA (`bun install --production` pomija devDeps, a
+ * CLI trzyma go jako `--external`). Import — nawet z bezzależnościowego subpatha
+ * — zostawał w `host.js` i wywalał kontener w pętli restartów:
+ * `Cannot find module '@arcote.tech/arc-map/types'`. Bezzależnościowość PLIKU
+ * nie pomaga, gdy brakuje całego PAKIETU.
+ */
+const DISCOVERY_SCHEMA_VERSION = 1;
+
 /** Porównanie sekretów w czasie stałym (bez wycieku długości prefiksu). */
 function safeEqual(a: string, b: string): boolean {
   const ab = Buffer.from(a);
@@ -581,7 +591,7 @@ function handleDiscovery(
   return Response.json(
     {
       meta: {
-        schemaVersion: MAP_SCHEMA_VERSION,
+        schemaVersion: DISCOVERY_SCHEMA_VERSION,
         name: ws.appName,
         version: (ws.rootPkg?.version as string | undefined) ?? undefined,
       },