@classytic/arc 2.32.0 → 2.33.0

package/dist/{createApp-Bv0m-Q6_.mjs → createApp-CLGegqiG.mjs}

@@ -1,11 +1,13 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import { arcLog, configureArcLogger, createPinoWriter } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-DXYX7dIR.mjs";
-import { t as createTenantKeyGenerator } from "./rateLimitKey-CccEFBfk.mjs";
-import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-5XnTa2uo.mjs";
-import { t as parseJsonBody } from "./jsonBody-DDSR2HFl.mjs";
-import { r as wrapWithBoundary } from "./subscribe-helpers-sp5xTDVA.mjs";
+import { n as PUBLIC_SCOPE } from "./types-CoqIRrkY.mjs";
+import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-Dm88DaTW.mjs";
+import { t as createTenantKeyGenerator } from "./rateLimitKey-XngqVNEV.mjs";
+import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-CasG2A28.mjs";
+import { t as parseJsonBody } from "./jsonBody-CfGH-GxO.mjs";
+import { r as wrapWithBoundary } from "./subscribe-helpers-CLIOHsOK.mjs";
+import { isProductionEnv } from "@classytic/primitives/environment";
 import Fastify from "fastify";
 import qs from "qs";
 //#region src/factory/security/pluginLoader.ts
@@ -799,9 +801,20 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-Dk_TyXeE.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-Dar8qRaj.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
+			/**
+			* An EXPLICIT `runtime: 'memory'` is the host's single-instance
+			* declaration (its JSDoc says exactly that), so it flows down as the
+			* event plugin's `singleProcess` flag — one topology axis, declared
+			* once, no second knob to keep in sync. The comparison is against the
+			* literal, not the resolved default: `runtime` UNSET also means memory
+			* stores, but an unstated topology must keep the forgotten-default
+			* warn. `eventOpts` spreads after, so a direct
+			* `arcPlugins.events.singleProcess` still wins either way.
+			*/
+			...config.runtime === "memory" ? { singleProcess: true } : {},
 			...eventOpts,
 			transport: config.stores?.events
 		});
@@ -847,15 +860,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-DFJqHyFs.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-BcGmvnHh.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-Dhps-Ldt.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-DhsZ0ZIc.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-DsuWnj4T.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-qYSB7rMQ.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -865,7 +878,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.sse) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 		else {
-			const { default: ssePlugin } = await import("./sse-B9P4Y-UI.mjs").then((n) => n.r);
+			const { default: ssePlugin } = await import("./sse-Cf0jUHsh.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 			await fastify.register(ssePlugin, opts);
 			trackPlugin("arc-sse", opts);
@@ -874,20 +887,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-DVvVZZFz.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-CTkv3O59.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);
 		}
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-DdQL8syd.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-D7uchLjN.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-CKv2jz_U.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-rZbyLVD-.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -895,6 +908,12 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 //#endregion
 //#region src/factory/registerAuth.ts
 /**
+* Authentication registration for createApp.
+*
+* Extracted from createApp step 9: scope decoration, auth strategy,
+* elevation plugin, and error handler.
+*/
+/**
 * Decorate request.scope with PUBLIC_SCOPE default.
 * Every request starts as public; auth hooks upgrade it.
 */
@@ -958,7 +977,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-DNXXxgjl.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-B0tlY8y1.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -973,8 +992,51 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-B2AZUJUj.mjs").then((n) => n.r);
-	let errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
+	const { errorHandlerPlugin } = await import("./errorHandler-C7xBqHsI.mjs").then((n) => n.r);
+	/**
+	* DISCLOSURE DEFAULTS MERGE — they used to be REPLACED, and that was two bugs.
+	*
+	* This was a ternary: an object from the host was used verbatim, otherwise
+	* `{ includeStack: config.preset !== "production" }`. Both branches leaked.
+	*
+	*   1. A host that passed ANY key — even just `errorMappers` — lost the preset-derived
+	*      `includeStack` and fell through to `errorHandlerPlugin`'s own default, which is
+	*      `!(process.env.NODE_ENV === "production")`. That comparison knows only the long
+	*      spelling, so under `NODE_ENV=prod` it yields `true` and stack traces ship to clients in
+	*      production. Nobody writing `errorHandler: { errorMappers: [...] }` could reasonably
+	*      expect it to change stack-trace exposure.
+	*   2. The derived branch never set `exposeInternalMessages` AT ALL, so that switch fell
+	*      through to the same raw read for EVERY arc app however it was configured. A truthy value
+	*      is what skips `wire.message = "Internal Server Error"` for a 500, putting the raw thrown
+	*      message — driver text, query fragments — on the wire.
+	*
+	* `preset` is the right source: it is the deployment's EXPLICIT declaration, and a specific
+	* setting must never be overridden by an ambient default. Host keys still win over `derived`,
+	* so an operator can widen deliberately; what they can no longer do is widen by accident.
+	*
+	*   3. And `preset` is OPTIONAL, so its ABSENCE must not read as "not production" either.
+	*      `config.preset !== "production"` is true for an unset preset, and plenty of hosts set
+	*      only `NODE_ENV` — which turns "the operator said nothing" into "the operator said
+	*      development", the widest possible reading of silence, on the two switches where being
+	*      wrong ships stack traces and raw driver text.
+	*
+	* So: an explicit `preset` wins; its absence falls back to the ENVIRONMENT rather than to a
+	* guess; and that fallback goes through `isProductionEnv` from the shared classifier, never a raw
+	* `process.env.NODE_ENV === "production"`. The raw form recognises only the long spelling, so a
+	* preset-less host on `NODE_ENV=prod` read as non-production and re-opened both switches — the
+	* same defect class this fallback exists to close, one layer in. Verified against a real 500 in
+	* every state, including a Mongo connection string reaching the response body before the fix
+	* (`tests/factory/error-disclosure-defaults.test.ts`).
+	*/
+	const productionEnv = config.preset !== void 0 ? config.preset === "production" : isProductionEnv(process.env.NODE_ENV);
+	const derived = {
+		includeStack: !productionEnv,
+		exposeInternalMessages: !productionEnv
+	};
+	let errorOpts = typeof config.errorHandler === "object" ? {
+		...derived,
+		...config.errorHandler
+	} : derived;
 	if (moduleErrorMappers && moduleErrorMappers.length > 0) errorOpts = {
 		...errorOpts,
 		errorMappers: [...errorOpts.errorMappers ?? [], ...moduleErrorMappers]
@@ -1096,7 +1158,10 @@ async function registerResources(fastify, config, preResolvedModules) {
 			teardown.markInitialized(m);
 			try {
 				const returned = await m.plugins(fastify, disposers.contextFor(m.name));
-				if (typeof returned === "function") disposers.contextFor(m.name).defer(returned);
+				if (typeof returned === "function") {
+					assertNotAReturnedPlugin(returned, m.name, fastify);
+					disposers.contextFor(m.name).defer(returned);
+				}
 			} catch (err) {
 				setModuleState(fastify, m.name, "failed");
 				const msg = err instanceof Error ? err.message : String(err);
@@ -1151,7 +1216,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 		let discoveryPath;
 		let discoveryYieldedZero = false;
 		if (resolvedResources === void 0 && config.resourceDir) {
-			const { loadResources } = await import("./loadResources-DisEAmkm.mjs").then((n) => n.n);
+			const { loadResources } = await import("./loadResources-Bj-aSsXi.mjs").then((n) => n.n);
 			const { resolve, dirname } = await import("node:path");
 			const { fileURLToPath } = await import("node:url");
 			const rawDir = config.resourceDir;
@@ -1257,13 +1322,27 @@ Resources supplied by "${m.name}": ${provided}.`);
 			}
 		}
 		const scheduleCounts = /* @__PURE__ */ new Map();
-		const scheduledJobs = await collectModuleScheduledJobs(fastify, modules, scheduleCounts);
+		const collectedJobs = await collectModuleScheduledJobs(fastify, modules, scheduleCounts);
+		/**
+		* ROLE gate (CreateAppOptions.role). Arms a role does not run are SKIPPED
+		* and logged by name, never fatal: a module legitimately declares arms
+		* that a different deployment of the same codebase executes. 'relay' runs
+		* only kind:'relay' arms (the outbox relays); 'api'/'worker' run none;
+		* 'scheduler'/'all' run everything.
+		*/
+		const role = config.role ?? "all";
+		const scheduledJobs = role === "scheduler" || role === "all" ? collectedJobs : role === "relay" ? collectedJobs.filter((j) => j.kind === "relay") : [];
+		const skipped = collectedJobs.filter((j) => !scheduledJobs.includes(j));
+		if (skipped.length > 0) fastify.log.info({
+			role,
+			skipped: skipped.map((j) => j.name)
+		}, `[arc] role '${role}': ${skipped.length} schedule arm(s) not mounted here — a deployment with the owning role runs them`);
 		if (scheduledJobs.length > 0) {
 			if (config.arcPlugins?.schedules === false) throw new Error("[arc] modules declare scheduledJobs but arcPlugins.schedules is false. Enable the scheduler or remove the declarations.");
 			if (fastify.hasDecorator("getScheduleStats")) throw new Error("[arc] modules declare scheduledJobs but schedulesPlugin was already registered manually. Configure their runner through arcPlugins.schedules so Arc can compose one schedule table.");
 			const frozenJobs = Object.freeze(scheduledJobs.map((job) => Object.freeze({ ...job })));
 			const scheduleOptions = typeof config.arcPlugins?.schedules === "object" ? config.arcPlugins.schedules : {};
-			const { default: schedulesPlugin } = await import("./schedules-C2Q3uv2d.mjs").then((n) => n.r);
+			const { default: schedulesPlugin } = await import("./schedules-CAcZgia0.mjs").then((n) => n.r);
 			await fastify.register(schedulesPlugin, {
 				...scheduleOptions,
 				schedules: frozenJobs
@@ -1319,6 +1398,22 @@ Resources supplied by "${m.name}": ${provided}.`);
 		if (closeErrors.length > 0) throw closeErrors[0];
 	});
 }
+/**
+* `plugins()` is CALLED by arc, never handed to `fastify.register()` — so a
+* module author who returns a Fastify plugin expecting arc to register it
+* gets silence: nothing is registered, and the "disposer" shorthand then
+* invokes their plugin at shutdown with no arguments.
+*
+* The `fastify-plugin` case is unambiguous (its marker symbols are only ever
+* set by `fp()`), so it throws. A bare `(fastify, opts)` function is a strong
+* but not certain signal — arc's disposer contract calls it with ZERO
+* arguments, so a 2-parameter disposer is meaningless either way — and warns.
+*/
+function assertNotAReturnedPlugin(returned, moduleName, fastify) {
+	const fn = returned;
+	if (fn[Symbol.for("skip-override")] !== void 0 || fn[Symbol.for("plugin-meta")] !== void 0 || fn[Symbol.for("fastify.display-name")] !== void 0) throw new Error(`[arc] module "${moduleName}" returned a fastify-plugin from plugins(). That slot is a SETUP function arc calls directly — it is never passed to fastify.register(), so the returned value is read as a disposer and your plugin would be invoked at shutdown instead of registered at boot. Register it yourself: \`plugins: async (fastify) => { await fastify.register(myPlugin) }\`.`);
+	if (returned.length >= 2) fastify.log?.warn?.(`[arc] module "${moduleName}" returned a ${returned.length}-argument function from plugins(). Arc calls disposers with NO arguments, so this looks like a Fastify plugin that was meant to be registered (\`await fastify.register(fn)\`) rather than a teardown callback. If it really is a disposer, declare it with no parameters.`);
+}
 //#endregion
 //#region src/factory/security/cors.ts
 /**
@@ -1710,6 +1805,14 @@ Missing:\n${lines}\n\nFix: pass durable adapters under \`stores\`, or use runtim
 * instance is closed before the error propagates — see the wrapper below.
 */
 async function createApp(options) {
+	/**
+	* ROLE contradiction check — before anything constructs. A relay/scheduler
+	* process declaring HTTP resources is a wiring error, not a preference:
+	* those roles exist to NOT serve traffic, and mounting routes anyway would
+	* hide the misdeployment behind a working endpoint.
+	*/
+	const declaredRole = options.role ?? "all";
+	if ((declaredRole === "relay" || declaredRole === "scheduler") && (options.resources !== void 0 || options.resourceDir !== void 0)) throw new Error(`createApp: role '${declaredRole}' declares HTTP resources — a ${declaredRole} process must not serve routes. Remove \`resources\`/\`resourceDir\`, or change the role.`);
 	let partial;
 	try {
 		return await buildApp(options, (instance) => {
@@ -1804,7 +1907,7 @@ async function buildApp(options, onInstance) {
 	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
 	await registerResources(fastify, config, resolvedModules);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-DS-P0b32.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-BSBVCwL3.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {
@@ -1821,6 +1924,7 @@ async function buildApp(options, onInstance) {
 		});
 	}
 	const authMode = config.auth === false ? "none" : config.auth ? config.auth.type : "none";
+	auditRuntimeCapabilities(fastify, config.runtime ?? "memory");
 	fastify.log.info({
 		preset: config.preset ?? "custom",
 		runtime: config.runtime ?? "memory",
@@ -1855,4 +1959,4 @@ const ArcFactory = {
 	}
 };
 //#endregion
-export { collectModuleWorkflows as _, edgePreset as a, testingPreset as c, hasModule as d, orderModules as f, collectModuleScheduledJobs as g, collectModuleHealthChecks as h, developmentPreset as i, workerPreset as l, describeResolvedModule as m, createApp as n, getPreset as o, subscribeModuleEventHandlers as p, createApp_exports as r, productionPreset as s, ArcFactory as t, getModuleState as u, resolveContribution as v, resolveModule as y };
+export { collectModuleScheduledJobs as _, developmentPreset as a, resolveModule as b, productionPreset as c, getModuleState as d, hasModule as f, collectModuleHealthChecks as g, describeResolvedModule as h, createApp_exports as i, testingPreset as l, subscribeModuleEventHandlers as m, DEFAULT_LOGGER_REDACT_PATHS as n, edgePreset as o, orderModules as p, createApp as r, getPreset as s, ArcFactory as t, workerPreset as u, collectModuleWorkflows as v, resolveContribution as y };

package/dist/{defineAggregation-gX4No1gt.mjs → defineAggregation-Nv-DwfOf.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/core/aggregation/defineAggregation.ts
 /**
 * Declare a single resource aggregation. Exported configs flow into