@teamscala/service-boot 0.23.295 → 0.23.297

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.295",
+  "version": "0.23.297",
   "sideEffects": false,
   "files": [
     "src"

package/src/handlers/scala-tools-currency-watch.ts

@@ -97,7 +97,10 @@ async function scalaToolsCurrencyWatch(_ctx: { config: ScheduledJobConfig }): Pr
 		);
 		const install = await spawn({
 			name: "scala-tools-currency-watch:deps-install",
-			command: ["scala-tools", "deps", "install", "--force-resolve"],
+			// A plain install fetches the current version, which is the whole point
+			// of this watch. Re-resolving the entire tree is an emergency hatch, not
+			// a currency step (operator ruling 2026-07-31).
+			command: ["scala-tools", "deps", "install"],
 			cwd: SENTINEL_DIR,
 			timeoutMs: 300_000,
 		});

package/src/register-static-assets.ts

@@ -14,6 +14,8 @@ import { join } from "node:path";
 import type { Hono } from "hono";
 import { etag } from "hono/etag";
 import { buildErrorReport } from "@teamscala/os/errors/error-report";
+import { collectHeapReport } from "@teamscala/os/observability/heap-report";
+import { isLoopbackHost } from "@teamscala/os/observability/loopback-host";
 import { handleAssetProxy } from "./asset-proxy";
 import { resolveBrandFaviconPath, warmBrandFaviconCache } from "./resolve-brand-favicon";
 
@@ -37,41 +39,20 @@ export async function registerStaticAssets(
 		}),
 	);
 
-	// Localhost-gated heap-attribution probe — restores the object-composition
-	// data the removed /_healthz surface exposed: the heapSize-vs-RSS split
-	// (JS heap vs native — OTel/Prisma-engine/buffers/compiled code) plus the
-	// top object types by count. Read-only, no secrets; gated to a localhost
-	// Host so it never answers over the public domain. Registered here (before
-	// auth + page routes) so it is reachable on every service kind, like
-	// /health (`verify-via-127.0.0.1`, sibling of `runtime-metrics-via-railway-cli`).
+	// Localhost-gated heap-attribution probe — the heapSize-vs-RSS split (JS heap
+	// vs native: OTel/Prisma-engine/buffers/compiled code) plus the top object
+	// types by count. Read-only, no secrets; gated to a localhost Host so it never
+	// answers over the public domain. Registered here (before auth + page routes)
+	// so it is reachable on every service kind, like /health
+	// (`verify-via-127.0.0.1`, sibling of `runtime-metrics-via-railway-cli`).
+	//
+	// The payload shape lives in @teamscala/os so standalone `Bun.serve` daemons
+	// (scala-guard) answer this probe identically — `scala-tools heap <slug>` must
+	// not mean different things depending on which process replied.
 	app.get("/_heap", async (c) => {
-		const host = c.req.header("host") ?? "";
-		const isLocal =
-			host.startsWith("127.0.0.1") || host.startsWith("localhost") || host.startsWith("[::1]");
-		if (!isLocal) return c.json({ error: "localhost only" }, 403);
+		if (!isLoopbackHost(c.req.header("host"))) return c.json({ error: "localhost only" }, 403);
 		try {
-			const { heapStats } = await import("bun:jsc");
-			const s = heapStats() as unknown as {
-				heapSize: number;
-				heapCapacity: number;
-				objectCount: number;
-				objectTypeCounts?: Record<string, number>;
-			};
-			const rss = process.memoryUsage.rss();
-			const topObjectTypes = Object.fromEntries(
-				Object.entries(s.objectTypeCounts ?? {})
-					.sort((a, b) => b[1] - a[1])
-					.slice(0, 40),
-			);
-			return c.json({
-				service: serviceSlug,
-				rss,
-				heapSize: s.heapSize,
-				heapCapacity: s.heapCapacity,
-				objectCount: s.objectCount,
-				nativeApprox: Math.max(0, rss - s.heapSize),
-				topObjectTypes,
-			});
+			return c.json(await collectHeapReport(serviceSlug));
 		} catch (err) {
 			const report = buildErrorReport(err, { service: serviceSlug, url: c.req.url });
 			return new Response(JSON.stringify(report.http.body), {

package/src/scala-tools-currency-watchdog.ts

@@ -113,7 +113,11 @@ async function checkCurrency(): Promise<{ healthy: boolean; details?: Record<str
 	});
 	const result = await spawn({
 		name: "scala-tools-currency-repair",
-		command: ["node_modules/.bin/scala-tools", "deps", "install", "--dir", cwd, "--force-resolve"],
+		// A stale installed version needs the current one fetched, which a plain
+		// install does. Re-resolving the whole tree to achieve that is an emergency
+		// escape hatch, not a currency step, and running it automatically burns host
+		// resources for no gain (operator ruling 2026-07-31).
+		command: ["node_modules/.bin/scala-tools", "deps", "install", "--dir", cwd],
 		cwd,
 		timeoutMs: cfg.command_timeout_ms,
 		captureStderr: true,