@vtex/faststore 0.0.7 → 0.0.10

package/dist/cli/server-runtime.js

@@ -6261,6 +6261,17 @@ function cloneObject(object) {
 	return Object.assign(Object.create(Object.getPrototypeOf(object)), object);
 }
 //#endregion
+//#region ../../node_modules/.pnpm/@apollo+server@5.5.0_graphql@16.13.1/node_modules/@apollo/server/dist/esm/plugin/disabled/index.js
+function disabledPlugin(id) {
+	return {
+		__internal_plugin_id__: id,
+		__is_disabled_plugin__: true
+	};
+}
+function ApolloServerPluginInlineTraceDisabled() {
+	return disabledPlugin("InlineTrace");
+}
+//#endregion
 //#region ../../node_modules/.pnpm/@apollo+server@5.5.0_graphql@16.13.1/node_modules/@apollo/server/dist/esm/plugin/drainHttpServer/stoppable.js
 var Stopper = class {
 	server;
@@ -34052,18 +34063,20 @@ var require_express = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var import_lib = /* @__PURE__ */ __toESM(require_lib$2(), 1);
 var import_express = /* @__PURE__ */ __toESM(require_express(), 1);
 /**
-* Declared-secret handling, shared by the two verbs that run resolvers: `dev`
-* and `serve`. Kept in its own dependency-free module because the scrub used to
-* live in `capability-lint.ts`, which imports the TypeScript compiler at module
-* load — reusing it from `serve` would have put `typescript` on the production
-* runtime path (see `docs/storefront-api-core/reference-extension-sdk.md`, "Running the artifact: serve").
+* Declared-secret handling for the two verbs that run resolvers. `dev` only
+* captures, from the environment the host passed; the scrub is `server.mjs`'s
+* alone, because the runner never touches `process.env` (ADR-0026). Kept in its
+* own dependency-free module because the scrub used to live in
+* `capability-lint.ts`, which imports the TypeScript compiler at module load —
+* reusing it from `serve` would have put `typescript` on the production runtime
+* path (see `docs/storefront-api-core/reference-extension-sdk.md`, "Running the artifact: serve").
 */
 /**
-* Captures the declared secrets' values from an environment snapshot. Reading
-* from a snapshot — not the live `process.env` — is what lets the caller scrub
-* `process.env` after boot without emptying `ctx.secrets` on a later watch
-* reload. A declared-but-unset name is simply absent from the returned map
-* (never `''`) — absent means absent (ADR-0003).
+* Captures the declared secrets' values from an environment snapshot. `dev`
+* passes its boot snapshot (`RunnerEnv.variables`) on boot and on every watch
+* reload, so `ctx.secrets` never empties mid-session; `serve` passes the map it
+* scrubs afterwards. A declared-but-unset name is simply absent from the
+* returned map (never `''`) — absent means absent (ADR-0003).
 */
 function captureSecrets(secretNames, source) {
 	const captured = {};
@@ -34074,19 +34087,21 @@ function captureSecrets(secretNames, source) {
 	return captured;
 }
 /**
-* Loud, non-blocking warning for any declared secret missing from the
+* One loud, non-blocking warning line per declared secret missing from the
 * environment. Lives here, not in `buildContext`, so the factory stays pure.
 * The server still starts; the secret is just absent from `ctx.secrets`.
 */
-function warnOnUnsetSecrets(secretNames, secrets, verb) {
-	for (const name of secretNames) if (secrets[name] === void 0) console.warn(`storefront ${verb}: ⚠ declared secret ${name} is unset in the environment. ctx.secrets.${name} will be undefined. Set it in the environment before shipping.`);
+function unsetSecretWarnings(secretNames, secrets, verb) {
+	const lines = [];
+	for (const name of secretNames) if (secrets[name] === void 0) lines.push(`storefront ${verb}: ⚠ declared secret ${name} is unset in the environment. ctx.secrets.${name} will be undefined. Set it in the environment before shipping.`);
+	return lines;
 }
 /**
-* Defense in depth: removes the declared secret names from the environment once
-* their values are captured, so no resolver can read them off `process.env` even
-* if the capability lint was bypassed.
+* Defense in depth for `server.mjs`: removes the declared secret names from the
+* environment once their values are captured, so no resolver can read them off
+* `process.env` even if the capability lint was bypassed.
 */
-function scrubDeclaredSecrets(secretNames, env = process.env) {
+function scrubDeclaredSecrets(secretNames, env) {
 	for (const name of secretNames) delete env[name];
 }
 //#endregion
@@ -49699,17 +49714,20 @@ const BODY_LIMIT = "50mb";
 * probes with `httpGet`, which cannot carry the header Apollo's CSRF prevention
 * demands, so the probe needs a route of its own. See
 * docs/storefront-api-core/reference-extension-sdk.md, "Running the artifact".
+*
+* `onError` receives a listener error after boot. The default prints, which is
+* `server.mjs`'s to do; `dev` passes its log sink instead.
 */
 async function startSubgraphServer(definition, port, contextInputs = {
 	secretNames: [],
 	secrets: {}
-}) {
+}, onError = (error) => console.error("storefront: subgraph server error after startup.", error)) {
 	const schema = buildSubgraph(definition);
 	const app = (0, import_express.default)();
 	const httpServer = createServer(app);
 	const server = new ApolloServer({
 		schema,
-		plugins: [ApolloServerPluginDrainHttpServer({ httpServer })],
+		plugins: [ApolloServerPluginDrainHttpServer({ httpServer }), ApolloServerPluginInlineTraceDisabled()],
 		stopOnTerminationSignals: false
 	});
 	await server.start();
@@ -49733,12 +49751,14 @@ async function startSubgraphServer(definition, port, contextInputs = {
 			resolve();
 		});
 	});
-	httpServer.on("error", (error) => {
-		console.error("storefront: subgraph server error after startup.", error);
-	});
+	httpServer.on("error", onError);
 	return {
 		url: `http://localhost:${boundPort(httpServer)}/`,
-		stop: () => server.stop()
+		stop: () => server.stop().catch((error) => {
+			httpServer.closeAllConnections();
+			httpServer.close();
+			throw error;
+		})
 	};
 }
 /** The port the listener actually bound, read off its address. */
@@ -49798,7 +49818,7 @@ async function serveDeclaration(definition, { name, env = process.env }) {
 	const port = resolvePort(env);
 	const secretNames = definition.secrets ?? [];
 	const secrets = captureSecrets(secretNames, env);
-	warnOnUnsetSecrets(secretNames, secrets, "server");
+	for (const line of unsetSecretWarnings(secretNames, secrets, "server")) console.warn(line);
 	const server = await startSubgraphServer(definition, port, {
 		secretNames,
 		secrets