@arcote.tech/arc-host 0.7.6 → 0.7.8

package/dist/src/context-handler.d.ts

@@ -27,8 +27,15 @@ export declare class ContextHandler {
      * Execute a command. When `telemetry` is wired, the entire dispatch is
      * traced as `command.<name>` with RPC semantic conventions, parented to
      * whatever context is active (HTTP request span, WS message span, etc.).
+     *
+     * Wire dispatchers (HTTP, WS) MUST omit `options.internal` or pass `false`
+     * so that private mutateMethod/command is rejected. Internal callers
+     * (cron-scheduler, server-side tasks) pass `{ internal: true }` to bypass
+     * the wire-only restriction.
      */
-    executeCommand(commandName: string, params: any, rawToken: string | null): Promise<any>;
+    executeCommand(commandName: string, params: any, rawToken: string | null, options?: {
+        internal?: boolean;
+    }): Promise<any>;
     /**
      * Persist events from a client and return with host IDs
      */

package/dist/src/context-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-handler.d.ts","sourceRoot":"","sources":["../../src/context-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EAGN,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE7E;;GAEG;AACH,qBAAa,cAAc;aASP,OAAO,EAAE,aAAa;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAV7B,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAAS;gBAGV,OAAO,EAAE,aAAa,EACtC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,EAClB,SAAS,CAAC,EAAE,YAAY,YAAA;IAqB3C;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B;;;OAGG;YACW,QAAQ;IA4BtB;;;;OAIG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EACX,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,GAAG,CAAC;IAuDf;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,GAAG,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACvC,CAAC,EACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IA8C3B;;OAEG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IAkD3B;;OAEG;IACH,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC;IAIhC;;OAEG;IACH,cAAc,IAAI,iBAAiB;IAInC;;OAEG;IACH,mBAAmB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAI/C;;OAEG;IACH,iBAAiB,IAAI,mBAAmB;CAGzC"}
+{"version":3,"file":"context-handler.d.ts","sourceRoot":"","sources":["../../src/context-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EAGN,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE7E;;GAEG;AACH,qBAAa,cAAc;aASP,OAAO,EAAE,aAAa;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAV7B,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAAS;gBAGV,OAAO,EAAE,aAAa,EACtC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,EAClB,SAAS,CAAC,EAAE,YAAY,YAAA;IAqB3C;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B;;;OAGG;YACW,QAAQ;IA4BtB;;;;;;;;;OASG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EACX,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC,GAAG,CAAC;IAiEf;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,GAAG,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACvC,CAAC,EACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IA8C3B;;OAEG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,KAAK,EAAE,YAAY,GAAG,IAAI,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IAkD3B;;OAEG;IACH,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC;IAIhC;;OAEG;IACH,cAAc,IAAI,iBAAiB;IAInC;;OAEG;IACH,mBAAmB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAI/C;;OAEG;IACH,iBAAiB,IAAI,mBAAmB;CAGzC"}

package/dist/src/create-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EACV,YAAY,EAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAOjD,OAAO,KAAK,EACV,cAAc,EAGd,YAAY,EACb,MAAM,oBAAoB,CAAC;AAG5B,KAAK,aAAa,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,SAAS,CAAC,CA4PpB"}
+{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAQ,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAOjD,OAAO,KAAK,EACV,cAAc,EAGd,YAAY,EACb,MAAM,oBAAoB,CAAC;AAG5B,KAAK,aAAa,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,SAAS,CAAC,CA0PpB"}

package/dist/src/cron-scheduler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cron-scheduler.d.ts","sourceRoot":"","sources":["../../src/cron-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAOxD,qBAAa,aAAa;IACxB,OAAO,CAAC,IAAI,CAAiB;IAC7B,OAAO,CAAC,cAAc,CAAiB;gBAE3B,cAAc,EAAE,cAAc;IAI1C;;OAEG;IACH,KAAK,IAAI,IAAI;IAuBb;;OAEG;IACH,IAAI,IAAI,IAAI;IAQZ;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;YACW,iBAAiB;CAwChC"}
+{"version":3,"file":"cron-scheduler.d.ts","sourceRoot":"","sources":["../../src/cron-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAOxD,qBAAa,aAAa;IACxB,OAAO,CAAC,IAAI,CAAiB;IAC7B,OAAO,CAAC,cAAc,CAAiB;gBAE3B,cAAc,EAAE,cAAc;IAI1C;;OAEG;IACH,KAAK,IAAI,IAAI;IAuBb;;OAEG;IACH,IAAI,IAAI,IAAI;IAQZ;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;YACW,iBAAiB;CAyChC"}

package/package.json

@@ -4,11 +4,11 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": false,
   "author": "Przemysław Krasiński [arcote.tech]",
   "dependencies": {
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.6",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.8",
     "croner": "^9.0.0",
     "jsonwebtoken": "^9.0.2"
   },
@@ -24,8 +24,8 @@
     "@types/bun": "^1.2.0"
   },
   "peerDependencies": {
-    "@arcote.tech/arc": "^0.7.6",
-    "@arcote.tech/arc-otel": "^0.7.6"
+    "@arcote.tech/arc": "^0.7.8",
+    "@arcote.tech/arc-otel": "^0.7.8"
   },
   "peerDependenciesMeta": {
     "@arcote.tech/arc-otel": {

package/src/context-handler.ts

@@ -93,11 +93,17 @@ export class ContextHandler {
    * Execute a command. When `telemetry` is wired, the entire dispatch is
    * traced as `command.<name>` with RPC semantic conventions, parented to
    * whatever context is active (HTTP request span, WS message span, etc.).
+   *
+   * Wire dispatchers (HTTP, WS) MUST omit `options.internal` or pass `false`
+   * so that private mutateMethod/command is rejected. Internal callers
+   * (cron-scheduler, server-side tasks) pass `{ internal: true }` to bypass
+   * the wire-only restriction.
    */
   async executeCommand(
     commandName: string,
     params: any,
     rawToken: string | null,
+    options?: { internal?: boolean },
   ): Promise<any> {
     const includePayloads = this.telemetry?.shouldIncludePayloads() ?? false;
     const baseAttrs = {
@@ -127,6 +133,16 @@ export class ContextHandler {
         throw new Error(`Command '${commandName}' not found`);
       }
 
+      // Private mutateMethod / command — server-internal only, never callable
+      // from a client over the wire. Server-side callers reach the handler
+      // directly through `ctx.mutate.*` (bypassing this dispatcher) or pass
+      // `{ internal: true }` (e.g. cron-scheduler).
+      if (!options?.internal && (command as any).__isPrivate) {
+        throw new Error(
+          `Command '${commandName}' is private and not callable from a client.`,
+        );
+      }
+
       try {
         return await command(params);
       } catch (error) {

package/src/create-server.ts

@@ -1,8 +1,5 @@
 import type { ArcContextAny, DatabaseAdapter } from "@arcote.tech/arc";
-import type {
-  ArcTelemetry,
-  Span,
-} from "@arcote.tech/arc-otel";
+import type { ArcTelemetry, Span } from "@arcote.tech/arc-otel";
 import type { Server } from "bun";
 import jwt from "jsonwebtoken";
 import { ConnectionManager } from "./connection-manager";
@@ -65,17 +62,15 @@ export async function createArcServer(
   const port = config.port || 5005;
 
   // Init context handler — telemetry (if any) flows through so executeCommand
-  // emits `command.<name>` spans parented to the active HTTP/WS span. The
-  // adapter is wrapped post-await so every transaction's find/set/remove/
-  // commit lands as a child span automatically.
-  const rawDbAdapter = config.dbAdapterFactory(config.context);
-  const dbAdapter = config.telemetry
-    ? rawDbAdapter.then(async (a) => {
-        const { wrapDbAdapter } = await import("@arcote.tech/arc-otel");
-        const dbSystem = process.env.DATABASE_URL ? "postgresql" : "sqlite";
-        return wrapDbAdapter(a, config.telemetry, dbSystem);
-      })
-    : rawDbAdapter;
+  // emits `command.<name>` spans parented to the active HTTP/WS span.
+  // DB adapter wrapping (per-transaction spans) is the caller's
+  // responsibility: pass an already-wrapped `dbAdapterFactory` if
+  // db spans are wanted. We don't `import()` arc-otel from here because
+  // doing so bundles its OTel SDK transitively into arc-host's dist,
+  // which then duplicates the @opentelemetry/api singleton when the CLI
+  // bundles arc-otel directly — leading to two global tracer providers
+  // and silent span loss.
+  const dbAdapter = config.dbAdapterFactory(config.context);
   const contextHandler = new ContextHandler(
     config.context,
     dbAdapter,

package/src/cron-scheduler.ts

@@ -109,6 +109,7 @@ export class CronScheduler {
             commandName,
             { _id: instance._id },
             null,
+            { internal: true },
           );
         } catch (error) {
           console.error(