@arcote.tech/arc-cli 0.5.8 → 0.6.0

package/dist/index.js

@@ -21686,7 +21686,7 @@ var emitWarning = (msg, type, code, fn) => {
 var AC = globalThis.AbortController;
 var AS = globalThis.AbortSignal;
 if (typeof AC === "undefined") {
-  AS = class AbortSignal {
+  AS = class AbortSignal2 {
     onabort;
     _onabort = [];
     reason;
@@ -26129,9 +26129,110 @@ ${colors2.yellow}Type declaration errors:${colors2.reset}`);
   }
 }
 
+// src/commands/build-shell.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, rmSync } from "fs";
+import { join as join3 } from "path";
+var REACT_ENTRIES = [
+  ["react", `export * from "react";
+import * as React from "react";
+export default React;`],
+  ["react-dom", `export * from "react-dom";
+import * as ReactDOM from "react-dom";
+export default ReactDOM;`],
+  ["jsx-runtime", `export * from "react/jsx-runtime";`],
+  ["jsx-dev-runtime", `export * from "react/jsx-dev-runtime";`],
+  ["react-dom-client", `export { createRoot, hydrateRoot } from "react-dom/client";`]
+];
+var SHELL_BASE_EXTERNAL = [
+  "react",
+  "react-dom",
+  "react/jsx-runtime",
+  "react/jsx-dev-runtime",
+  "react-dom/client"
+];
+async function buildShell(opts) {
+  const outDir = opts.out;
+  const fromDir = opts.from;
+  if (!existsSync3(fromDir)) {
+    console.error(`[_build-shell] --from not found: ${fromDir}`);
+    process.exit(1);
+  }
+  mkdirSync3(outDir, { recursive: true });
+  const tmpDir = join3(outDir, "_tmp");
+  mkdirSync3(tmpDir, { recursive: true });
+  try {
+    const arcPkgs = discoverArcPackages(fromDir);
+    if (arcPkgs.length === 0) {
+      console.warn("[_build-shell] no @arcote.tech/* packages discovered");
+    }
+    console.log(`[_build-shell] building shell for react + ${arcPkgs.length} @arcote.tech/* package(s)`);
+    await buildReactShell(outDir, tmpDir, fromDir);
+    for (const pkg of arcPkgs) {
+      await buildArcEntry(pkg, arcPkgs, outDir, tmpDir, fromDir);
+    }
+    console.log(`[_build-shell] done \u2192 ${outDir}`);
+  } finally {
+    rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+function discoverArcPackages(fromDir) {
+  const arcDir = join3(fromDir, "@arcote.tech");
+  if (!existsSync3(arcDir))
+    return [];
+  return readdirSync2(arcDir).filter((name) => existsSync3(join3(arcDir, name, "package.json"))).map((name) => `@arcote.tech/${name}`);
+}
+async function buildReactShell(outDir, tmpDir, fromDir) {
+  const eps = [];
+  for (const [name, code] of REACT_ENTRIES) {
+    const f = join3(tmpDir, `${name}.ts`);
+    await Bun.write(f, code);
+    eps.push(f);
+  }
+  const r = await Bun.build({
+    entrypoints: eps,
+    outdir: outDir,
+    splitting: true,
+    format: "esm",
+    target: "browser",
+    naming: "[name].[ext]",
+    root: fromDir
+  });
+  if (!r.success) {
+    for (const l of r.logs)
+      console.error(l);
+    throw new Error("React shell build failed");
+  }
+}
+async function buildArcEntry(pkg, allArcPkgs, outDir, tmpDir, fromDir) {
+  const shortName = pkg.replace("@arcote.tech/", "");
+  const otherExternals = allArcPkgs.filter((p) => p !== pkg);
+  const f = join3(tmpDir, `${shortName}.ts`);
+  await Bun.write(f, `export * from "${pkg}";
+`);
+  const r = await Bun.build({
+    entrypoints: [f],
+    outdir: outDir,
+    format: "esm",
+    target: "browser",
+    naming: "[name].[ext]",
+    root: fromDir,
+    external: [...SHELL_BASE_EXTERNAL, ...otherExternals],
+    define: {
+      ONLY_SERVER: "false",
+      ONLY_BROWSER: "true",
+      ONLY_CLIENT: "true"
+    }
+  });
+  if (!r.success) {
+    for (const l of r.logs)
+      console.error(l);
+    throw new Error(`Shell build failed for ${pkg}`);
+  }
+}
+
 // src/commands/dev.ts
 var import_chokidar = __toESM(require_chokidar(), 1);
-import { dirname as dirname3, join as join3, relative } from "path";
+import { dirname as dirname3, join as join4, relative } from "path";
 function getContextForFile(filePath, contexts, configDir) {
   const relativePath = relative(configDir, filePath);
   for (const context of contexts) {
@@ -26248,7 +26349,7 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
       } else {
         log("Initial build complete \u2713", "green");
       }
-      const watcher = import_chokidar.default.watch([join3(configDir, "**/*.ts"), join3(configDir, "**/*.tsx")], {
+      const watcher = import_chokidar.default.watch([join4(configDir, "**/*.ts"), join4(configDir, "**/*.tsx")], {
         ignored: [
           "**/node_modules/**",
           `**/${config.outDir}/**`,
@@ -26345,24 +26446,24 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync8, readdirSync as readdirSync5, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
 
 // src/builder/module-builder.ts
 import { execSync } from "child_process";
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync7,
-  readdirSync as readdirSync4,
-  rmSync,
-  writeFileSync as writeFileSync6
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync8,
+  readdirSync as readdirSync5,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { basename as basename2, dirname as dirname5, join as join8, relative as relative3 } from "path";
+import { basename as basename2, dirname as dirname5, join as join9, relative as relative3 } from "path";
 
 // src/i18n/index.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
 
 // src/i18n/catalog.ts
 function hashMsgid(msgid) {
@@ -26533,10 +26634,10 @@ function quoteString(s) {
 }
 
 // src/i18n/compile.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
 function compileCatalog(poPath) {
-  const content = readFileSync3(poPath, "utf-8");
+  const content = readFileSync4(poPath, "utf-8");
   const entries = parsePo(content);
   const result = {};
   for (const entry of entries) {
@@ -26551,13 +26652,13 @@ function compileCatalog(poPath) {
   return sorted;
 }
 function compileAllCatalogs(localesDir, outDir) {
-  mkdirSync3(outDir, { recursive: true });
-  for (const file of readdirSync2(localesDir)) {
+  mkdirSync4(outDir, { recursive: true });
+  for (const file of readdirSync3(localesDir)) {
     if (!file.endsWith(".po"))
       continue;
     const locale = file.replace(".po", "");
-    const compiled = compileCatalog(join4(localesDir, file));
-    writeFileSync3(join4(outDir, `${locale}.json`), JSON.stringify(compiled));
+    const compiled = compileCatalog(join5(localesDir, file));
+    writeFileSync4(join5(outDir, `${locale}.json`), JSON.stringify(compiled));
   }
 }
 
@@ -26601,10 +26702,10 @@ function i18nExtractPlugin(collector, rootDir) {
 
 // src/i18n/index.ts
 function readTranslationsConfig(rootDir) {
-  const pkgPath = join5(rootDir, "package.json");
-  if (!existsSync4(pkgPath))
+  const pkgPath = join6(rootDir, "package.json");
+  if (!existsSync5(pkgPath))
     return null;
-  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
   const config = pkg.arc?.translations;
   if (!config?.locales?.length)
     return null;
@@ -26617,34 +26718,34 @@ async function finalizeTranslations(rootDir, outDir, collector) {
   const config = readTranslationsConfig(rootDir);
   if (!config || collector.size === 0)
     return;
-  const localesJsonDir = join5(outDir, "locales");
-  mkdirSync4(localesJsonDir, { recursive: true });
+  const localesJsonDir = join6(outDir, "locales");
+  mkdirSync5(localesJsonDir, { recursive: true });
   console.log(`  Extracted ${collector.size} translatable string(s) for ${config.locales.length} locale(s)`);
   for (const locale of config.locales) {
-    const poPath = join5(rootDir, "locales", `${locale}.po`);
-    mkdirSync4(dirname4(poPath), { recursive: true });
-    const existing = existsSync4(poPath) ? parsePo(readFileSync4(poPath, "utf-8")) : [];
+    const poPath = join6(rootDir, "locales", `${locale}.po`);
+    mkdirSync5(dirname4(poPath), { recursive: true });
+    const existing = existsSync5(poPath) ? parsePo(readFileSync5(poPath, "utf-8")) : [];
     const merged = mergeCatalog(existing, collector);
-    writeFileSync4(poPath, writePo(merged));
+    writeFileSync5(poPath, writePo(merged));
     const compiled = compileCatalog(poPath);
-    writeFileSync4(join5(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
+    writeFileSync5(join6(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
   }
 }
 
 // src/builder/build-cache.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join7 } from "path";
 var CACHE_VERSION = 1;
 var CACHE_FILE = ".build-cache.json";
 function emptyCache() {
   return { version: CACHE_VERSION, units: {} };
 }
 function loadBuildCache(arcDir) {
-  const path4 = join6(arcDir, CACHE_FILE);
-  if (!existsSync5(path4))
+  const path4 = join7(arcDir, CACHE_FILE);
+  if (!existsSync6(path4))
     return emptyCache();
   try {
-    const raw = JSON.parse(readFileSync5(path4, "utf-8"));
+    const raw = JSON.parse(readFileSync6(path4, "utf-8"));
     if (raw?.version !== CACHE_VERSION || typeof raw.units !== "object") {
       return emptyCache();
     }
@@ -26654,15 +26755,15 @@ function loadBuildCache(arcDir) {
   }
 }
 function saveBuildCache(arcDir, cache) {
-  mkdirSync5(arcDir, { recursive: true });
-  writeFileSync5(join6(arcDir, CACHE_FILE), JSON.stringify(cache, null, 2));
+  mkdirSync6(arcDir, { recursive: true });
+  writeFileSync6(join7(arcDir, CACHE_FILE), JSON.stringify(cache, null, 2));
 }
 function isCacheHit(cache, unitId, inputHash, requiredOutputs = []) {
   const entry = cache.units[unitId];
   if (!entry || entry.inputHash !== inputHash)
     return false;
   for (const out of requiredOutputs) {
-    if (!existsSync5(out))
+    if (!existsSync6(out))
       return false;
   }
   return true;
@@ -26676,8 +26777,8 @@ function updateCache(cache, unitId, inputHash, output = {}) {
 }
 
 // src/builder/hash.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync } from "fs";
-import { join as join7, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, readdirSync as readdirSync4, statSync } from "fs";
+import { join as join8, relative as relative2, sep as sep2 } from "path";
 function sha256Hex(bytes) {
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(bytes);
@@ -26687,21 +26788,21 @@ function sha256OfFiles(paths) {
   const hasher = new Bun.CryptoHasher("sha256");
   const sorted = [...paths].sort();
   for (const p of sorted) {
-    if (!existsSync6(p))
+    if (!existsSync7(p))
       continue;
-    hasher.update(readFileSync6(p));
+    hasher.update(readFileSync7(p));
     hasher.update("\x00");
   }
   return hasher.digest("hex");
 }
 function sha256OfDir(dir, filter2) {
-  if (!existsSync6(dir))
+  if (!existsSync7(dir))
     return sha256Hex("");
   const hasher = new Bun.CryptoHasher("sha256");
   const entries = [];
   function walk(absDir) {
-    for (const entry of readdirSync3(absDir, { withFileTypes: true })) {
-      const abs = join7(absDir, entry.name);
+    for (const entry of readdirSync4(absDir, { withFileTypes: true })) {
+      const abs = join8(absDir, entry.name);
       const rel = relative2(dir, abs).split(sep2).join("/");
       if (filter2 && !filter2(rel))
         continue;
@@ -26716,7 +26817,7 @@ function sha256OfDir(dir, filter2) {
   for (const { rel, abs } of entries) {
     hasher.update(rel);
     hasher.update("\x00");
-    hasher.update(readFileSync6(abs));
+    hasher.update(readFileSync7(abs));
     hasher.update("\x00");
   }
   return hasher.digest("hex");
@@ -26735,17 +26836,17 @@ function stableStringify(value) {
   return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
 }
 function readInstalledVersion(rootDir, pkgName) {
-  const pkgJson = join7(rootDir, "node_modules", pkgName, "package.json");
-  if (!existsSync6(pkgJson))
+  const pkgJson = join8(rootDir, "node_modules", pkgName, "package.json");
+  if (!existsSync7(pkgJson))
     return null;
   try {
-    return JSON.parse(readFileSync6(pkgJson, "utf-8")).version ?? null;
+    return JSON.parse(readFileSync7(pkgJson, "utf-8")).version ?? null;
   } catch {
     return null;
   }
 }
 function mtimeOf(path4) {
-  if (!existsSync6(path4))
+  if (!existsSync7(path4))
     return 0;
   try {
     return statSync(path4).mtimeMs;
@@ -26793,40 +26894,40 @@ var SHELL_EXTERNALS = [
   "@arcote.tech/platform"
 ];
 function discoverPackages(rootDir) {
-  const rootPkg = JSON.parse(readFileSync7(join8(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf-8"));
   const workspaceGlobs = rootPkg.workspaces ?? [];
   const results = [];
   for (const glob2 of workspaceGlobs) {
     const base2 = glob2.replace("/*", "");
-    const baseDir = join8(rootDir, base2);
-    if (!existsSync7(baseDir))
+    const baseDir = join9(rootDir, base2);
+    if (!existsSync8(baseDir))
       continue;
     let entries;
     try {
-      entries = readdirSync4(baseDir);
+      entries = readdirSync5(baseDir);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const pkgPath = join8(baseDir, entry, "package.json");
-      if (!existsSync7(pkgPath))
+      const pkgPath = join9(baseDir, entry, "package.json");
+      if (!existsSync8(pkgPath))
         continue;
-      const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
       if (pkg.name?.startsWith("@arcote.tech/"))
         continue;
-      const pkgDir = join8(baseDir, entry);
+      const pkgDir = join9(baseDir, entry);
       const candidates = [
-        join8(pkgDir, "src", "index.ts"),
-        join8(pkgDir, "src", "index.tsx"),
-        join8(pkgDir, "index.ts"),
-        join8(pkgDir, "index.tsx")
+        join9(pkgDir, "src", "index.ts"),
+        join9(pkgDir, "src", "index.tsx"),
+        join9(pkgDir, "index.ts"),
+        join9(pkgDir, "index.tsx")
       ];
-      const entrypoint = candidates.find((c) => existsSync7(c)) ?? null;
+      const entrypoint = candidates.find((c) => existsSync8(c)) ?? null;
       if (!entrypoint)
         continue;
       results.push({
         name: pkg.name,
-        path: join8(baseDir, entry),
+        path: join9(baseDir, entry),
         entrypoint,
         packageJson: pkg
       });
@@ -26855,7 +26956,7 @@ var sourceFilter = (rel) => {
   return true;
 };
 function pkgSourceHash(pkg) {
-  return sha256OfDir(join8(pkg.path, "src"), sourceFilter);
+  return sha256OfDir(join9(pkg.path, "src"), sourceFilter);
 }
 function depVersionsHash(rootDir, pkg) {
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
@@ -26868,7 +26969,7 @@ function depVersionsHash(rootDir, pkg) {
 }
 async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const unitId = `context-pkg:${pkg.name}:${client.name}`;
-  const outDir = join8(pkg.path, "dist", client.name);
+  const outDir = join9(pkg.path, "dist", client.name);
   const inputHash = sha256OfJson({
     src: pkgSourceHash(pkg),
     pkg: pkg.packageJson,
@@ -26877,7 +26978,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
     target: client.target,
     defines: client.defines
   });
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(outDir, "main", "index.js")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(outDir, "main", "index.js")])) {
     console.log(`  \u2713 cached: ${pkg.name} (${client.name})`);
     return { pkgName: pkg.name, client: client.name, declarationErrors: [], cached: true };
   }
@@ -26887,7 +26988,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const externals = [...peerDeps, ...deps];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
-    outdir: join8(outDir, "main"),
+    outdir: join9(outDir, "main"),
     target: client.target,
     format: "esm",
     naming: "index.[ext]",
@@ -26925,7 +27026,7 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
   return { declarationErrors };
 }
 async function buildModulesBundle(rootDir, outDir, packages, cache, noCache) {
-  mkdirSync6(outDir, { recursive: true });
+  mkdirSync7(outDir, { recursive: true });
   const unitId = "modules-bundle";
   const pkgHashes = packages.map((p) => ({
     name: p.name,
@@ -26942,12 +27043,12 @@ async function buildModulesBundle(rootDir, outDir, packages, cache, noCache) {
     const modules = [];
     for (const { safeName, name } of pkgHashes) {
       const file = `${safeName}.js`;
-      const filePath = join8(outDir, file);
-      if (!existsSync7(filePath)) {
+      const filePath = join9(outDir, file);
+      if (!existsSync8(filePath)) {
         console.log(`  rebuilding modules-bundle: output ${file} missing`);
         return await actuallyBuild();
       }
-      modules.push({ file, name, hash: existing[safeName] ?? sha256Hex(readFileSync7(filePath)) });
+      modules.push({ file, name, hash: existing[safeName] ?? sha256Hex(readFileSync8(filePath)) });
     }
     console.log(`  \u2713 cached: modules-bundle (${modules.length} module(s))`);
     return { modules, cached: true };
@@ -26955,16 +27056,16 @@ async function buildModulesBundle(rootDir, outDir, packages, cache, noCache) {
   return await actuallyBuild();
   async function actuallyBuild() {
     console.log(`  building: modules-bundle (${packages.length} package(s))`);
-    const tmpDir = join8(outDir, "_entries");
-    mkdirSync6(tmpDir, { recursive: true });
+    const tmpDir = join9(outDir, "_entries");
+    mkdirSync7(tmpDir, { recursive: true });
     const entrypoints = [];
     const fileToName = new Map;
     for (const pkg of packages) {
       const safeName = basename2(pkg.path);
       const moduleName = pkg.name.includes("/") ? pkg.name.split("/").pop() : pkg.name;
       fileToName.set(safeName, moduleName);
-      const wrapperFile = join8(tmpDir, `${safeName}.ts`);
-      writeFileSync6(wrapperFile, `export * from "${pkg.name}";
+      const wrapperFile = join9(tmpDir, `${safeName}.ts`);
+      writeFileSync7(wrapperFile, `export * from "${pkg.name}";
 `);
       entrypoints.push(wrapperFile);
     }
@@ -26998,13 +27099,13 @@ async function buildModulesBundle(rootDir, outDir, packages, cache, noCache) {
         console.error(log2);
       throw new Error("Module build failed");
     }
-    await finalizeTranslations(rootDir, join8(outDir, ".."), i18nCollector);
-    rmSync(tmpDir, { recursive: true, force: true });
+    await finalizeTranslations(rootDir, join9(outDir, ".."), i18nCollector);
+    rmSync2(tmpDir, { recursive: true, force: true });
     const outputHashes = {};
     const modules = result.outputs.filter((o) => o.kind === "entry-point").map((o) => {
       const file = basename2(o.path);
       const safeName = file.replace(/\.js$/, "");
-      const bytes = readFileSync7(o.path);
+      const bytes = readFileSync8(o.path);
       const hash = sha256Hex(bytes);
       outputHashes[safeName] = hash;
       return {
@@ -27018,21 +27119,21 @@ async function buildModulesBundle(rootDir, outDir, packages, cache, noCache) {
   }
 }
 async function buildTranslations(rootDir, arcDir, cache, noCache) {
-  const localesDir = join8(rootDir, "locales");
-  if (!existsSync7(localesDir))
+  const localesDir = join9(rootDir, "locales");
+  if (!existsSync8(localesDir))
     return;
   const unitId = "translations";
-  const poFiles = readdirSync4(localesDir).filter((f) => f.endsWith(".po")).map((f) => join8(localesDir, f));
+  const poFiles = readdirSync5(localesDir).filter((f) => f.endsWith(".po")).map((f) => join9(localesDir, f));
   if (poFiles.length === 0)
     return;
   const inputHash = sha256OfFiles(poFiles);
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(arcDir, "locales")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(arcDir, "locales")])) {
     console.log(`  \u2713 cached: translations`);
     return;
   }
   console.log(`  building: translations (${poFiles.length} catalog(s))`);
-  compileAllCatalogs(localesDir, join8(arcDir, "locales"));
-  const jsonFiles = readdirSync4(join8(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join8(arcDir, "locales", f));
+  compileAllCatalogs(localesDir, join9(arcDir, "locales"));
+  const jsonFiles = readdirSync5(join9(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join9(arcDir, "locales", f));
   const outputHash = sha256OfFiles(jsonFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
@@ -27096,10 +27197,10 @@ var TAILWIND_INPUT_TEMPLATE = (rootRel) => `@import "tailwindcss";
 }
 `;
 async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache) {
-  mkdirSync6(arcDir, { recursive: true });
-  const inputCss = join8(arcDir, "_input.css");
-  const outputCss = join8(arcDir, "styles.css");
-  const themeOutput = join8(arcDir, "theme.css");
+  mkdirSync7(arcDir, { recursive: true });
+  const inputCss = join9(arcDir, "_input.css");
+  const outputCss = join9(arcDir, "styles.css");
+  const themeOutput = join9(arcDir, "theme.css");
   const rootRel = relative3(arcDir, rootDir).replace(/\\/g, "/");
   const inputCssContent = TAILWIND_INPUT_TEMPLATE(rootRel);
   const tsxFilter = (rel) => {
@@ -27111,15 +27212,15 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
   };
   const wsHashes = {};
   for (const p of packages) {
-    wsHashes[p.name] = sha256OfDir(join8(p.path, "src"), tsxFilter);
+    wsHashes[p.name] = sha256OfDir(join9(p.path, "src"), tsxFilter);
   }
-  const platformSrc = join8(rootDir, "node_modules", "@arcote.tech", "platform", "src");
-  const arcDsSrc = join8(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
+  const platformSrc = join9(rootDir, "node_modules", "@arcote.tech", "platform", "src");
+  const arcDsSrc = join9(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
   const frameworkHashes = {
     platform: sha256OfDir(platformSrc, tsxFilter),
     arcDs: sha256OfDir(arcDsSrc, tsxFilter)
   };
-  const themeContent = themePath && existsSync7(join8(rootDir, themePath)) ? readFileSync7(join8(rootDir, themePath)) : null;
+  const themeContent = themePath && existsSync8(join9(rootDir, themePath)) ? readFileSync8(join9(rootDir, themePath)) : null;
   const themeHash = themeContent ? sha256Hex(themeContent) : null;
   const unitId = "styles";
   const inputHash = sha256OfJson({
@@ -27136,21 +27237,198 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
     return;
   }
   console.log(`  building: styles`);
-  writeFileSync6(inputCss, inputCssContent);
+  writeFileSync7(inputCss, inputCssContent);
   execSync(`bunx @tailwindcss/cli -i ${inputCss} -o ${outputCss} --minify`, {
     cwd: rootDir,
     stdio: "inherit"
   });
   if (themePath && themeContent) {
-    writeFileSync6(themeOutput, themeContent);
+    writeFileSync7(themeOutput, themeContent);
   }
   const outFiles = [outputCss];
-  if (themePath && existsSync7(themeOutput))
+  if (themePath && existsSync8(themeOutput))
     outFiles.push(themeOutput);
   const outputHash = sha256OfFiles(outFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
 
+// src/builder/dependency-collector.ts
+import { createHash } from "crypto";
+import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename3, join as join10 } from "path";
+var FRAMEWORK_PEERS = [
+  "@arcote.tech/arc",
+  "@arcote.tech/arc-ds",
+  "@arcote.tech/arc-react",
+  "@arcote.tech/platform",
+  "react",
+  "react-dom"
+];
+function collectFrameworkDeps(arcDir, rootDir, packages) {
+  mkdirSync8(arcDir, { recursive: true });
+  const versions = resolveFrameworkVersions(rootDir, packages);
+  const manifest = {
+    name: "arc-platform-framework",
+    private: true,
+    type: "module",
+    dependencies: versions
+  };
+  const manifestPath = join10(arcDir, "package.json");
+  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
+`);
+  const rootLock = join10(rootDir, "bun.lock");
+  const targetLock = join10(arcDir, "bun.lock");
+  if (existsSync9(rootLock)) {
+    copyFileSync(rootLock, targetLock);
+  }
+  const hash = sha256OfFiles2([manifestPath, targetLock]);
+  writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
+`);
+  return { hash, manifestPath };
+}
+function collectModuleDeps(arcDir, pkg) {
+  const safeName = basename3(pkg.path);
+  const moduleDir = join10(arcDir, "modules", safeName);
+  mkdirSync8(moduleDir, { recursive: true });
+  const pkgDeps = pkg.packageJson.dependencies ?? {};
+  const filtered = {};
+  const frameworkSet = new Set(FRAMEWORK_PEERS);
+  for (const [name, spec] of Object.entries(pkgDeps)) {
+    if (frameworkSet.has(name))
+      continue;
+    if (spec.startsWith("workspace:"))
+      continue;
+    filtered[name] = spec;
+  }
+  const manifest = {
+    name: `arc-module-${safeName}`,
+    private: true,
+    type: "module",
+    dependencies: filtered
+  };
+  const manifestPath = join10(moduleDir, "package.json");
+  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
+`);
+  const hash = sha256OfFiles2([manifestPath]);
+  writeFileSync8(join10(moduleDir, ".deps-hash"), hash + `
+`);
+  return { hash, manifestPath };
+}
+function resolveFrameworkVersions(rootDir, packages) {
+  const rootPkg = JSON.parse(readFileSync9(join10(rootDir, "package.json"), "utf-8"));
+  const rootDeps = rootPkg.dependencies ?? {};
+  const out = {};
+  for (const name of FRAMEWORK_PEERS) {
+    const rootSpec = rootDeps[name];
+    if (rootSpec) {
+      out[name] = rootSpec;
+      continue;
+    }
+    let found;
+    for (const pkg of packages) {
+      const spec = (pkg.packageJson.dependencies ?? {})[name];
+      if (spec) {
+        found = spec;
+        break;
+      }
+    }
+    out[name] = found ?? "*";
+  }
+  return out;
+}
+function sha256OfFiles2(paths) {
+  const hash = createHash("sha256");
+  for (const p of paths.sort()) {
+    if (!existsSync9(p))
+      continue;
+    hash.update(p);
+    hash.update("\x00");
+    hash.update(readFileSync9(p));
+    hash.update("\x00");
+  }
+  return hash.digest("hex");
+}
+
+// src/builder/access-extractor.ts
+var {spawn: spawn2 } = globalThis.Bun;
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
+import { tmpdir } from "os";
+import { basename as basename4, join as join11 } from "path";
+async function extractAccessMap(arcDir, packages) {
+  const serverBundles = packages.filter((p) => isContextPackage(p.packageJson)).map((p) => {
+    const v06Path = join11(arcDir, "modules", basename4(p.path), "server.js");
+    const legacyPath = join11(p.path, "dist", "server", "main", "index.js");
+    return { name: p.name, path: v06Path, fallback: legacyPath };
+  });
+  const outPath = join11(arcDir, "access.json");
+  mkdirSync9(arcDir, { recursive: true });
+  const workerPath = join11(tmpdir(), `arc-access-extractor-${Date.now()}.mjs`);
+  writeFileSync9(workerPath, WORKER_SOURCE);
+  try {
+    const proc2 = spawn2({
+      cmd: ["bun", "run", workerPath],
+      env: {
+        ...process.env,
+        ARC_ACCESS_BUNDLES: JSON.stringify(serverBundles),
+        ARC_ACCESS_OUT: outPath
+      },
+      stdout: "pipe",
+      stderr: "inherit"
+    });
+    const exit = await proc2.exited;
+    if (exit !== 0) {
+      throw new Error(`access-extractor subprocess exited with ${exit}`);
+    }
+    return JSON.parse(readFileSync10(outPath, "utf-8"));
+  } finally {
+    try {
+      unlinkSync2(workerPath);
+    } catch {}
+  }
+}
+var WORKER_SOURCE = `
+import { existsSync } from "node:fs";
+
+globalThis.ONLY_SERVER = true;
+
+const bundles = JSON.parse(process.env.ARC_ACCESS_BUNDLES || "[]");
+const out = process.env.ARC_ACCESS_OUT;
+if (!out) {
+  console.error("[access-extractor-worker] ARC_ACCESS_OUT not set");
+  process.exit(2);
+}
+
+const platform = await import("@arcote.tech/platform");
+
+for (const { name, path, fallback } of bundles) {
+  const target = existsSync(path) ? path : fallback;
+  if (!target || !existsSync(target)) {
+    // No server bundle on either path \u2014 module has no protected access rules
+    // to discover. Skip silently rather than logging a misleading error.
+    continue;
+  }
+  try {
+    await import(target);
+  } catch (e) {
+    console.error("[access-extractor-worker] failed to import", name, "from", target, e);
+    // Continue \u2014 partial access map is better than total failure.
+  }
+}
+
+const result = {};
+for (const [name, access] of platform.getAllModuleAccess()) {
+  result[name] = {
+    rules: (access.rules ?? []).map((r) => ({
+      token: { name: r.token?.name ?? "" },
+      hasCheck: typeof r.check === "function",
+    })),
+  };
+}
+
+const { writeFileSync } = await import("node:fs");
+writeFileSync(out, JSON.stringify(result, null, 2) + "\\n");
+`.trim();
+
 // src/platform/shared.ts
 var C = {
   reset: "\x1B[0m",
@@ -27168,9 +27446,9 @@ function resolveWorkspace() {
     process.exit(1);
   }
   const rootDir = dirname6(packageJsonPath);
-  const rootPkg = JSON.parse(readFileSync8(packageJsonPath, "utf-8"));
+  const rootPkg = JSON.parse(readFileSync11(packageJsonPath, "utf-8"));
   const appName = rootPkg.name ?? "Arc App";
-  const arcDir = join9(rootDir, ".arc", "platform");
+  const arcDir = join12(rootDir, ".arc", "platform");
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
   ok(`Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`);
@@ -27180,10 +27458,10 @@ function resolveWorkspace() {
   }
   let manifest;
   for (const name of ["manifest.json", "manifest.webmanifest"]) {
-    const manifestPath = join9(rootDir, name);
-    if (existsSync8(manifestPath)) {
+    const manifestPath = join12(rootDir, name);
+    if (existsSync10(manifestPath)) {
       try {
-        const data = JSON.parse(readFileSync8(manifestPath, "utf-8"));
+        const data = JSON.parse(readFileSync11(manifestPath, "utf-8"));
         const icons = data.icons;
         manifest = {
           path: manifestPath,
@@ -27202,10 +27480,10 @@ function resolveWorkspace() {
     rootPkg,
     appName,
     arcDir,
-    modulesDir: join9(arcDir, "modules"),
-    shellDir: join9(arcDir, "shell"),
-    assetsDir: join9(arcDir, "assets"),
-    publicDir: join9(rootDir, "public"),
+    modulesDir: join12(arcDir, "modules"),
+    shellDir: join12(arcDir, "shell"),
+    assetsDir: join12(arcDir, "assets"),
+    publicDir: join12(rootDir, "public"),
     packages,
     manifest
   };
@@ -27218,14 +27496,23 @@ async function buildAll(ws, opts = {}) {
   const [, modulesResult] = await Promise.all([
     buildContextPackages(ws.rootDir, ws.packages, cache, noCache),
     buildModulesBundle(ws.rootDir, ws.modulesDir, ws.packages, cache, noCache),
-    buildShell(ws, cache, noCache),
+    buildShell2(ws, cache, noCache),
     buildStyles(ws.rootDir, ws.arcDir, ws.packages, themePath, cache, noCache),
     copyBrowserAssets(ws, cache, noCache),
     buildTranslations(ws.rootDir, ws.arcDir, cache, noCache)
   ]);
   saveBuildCache(ws.arcDir, cache);
+  collectFrameworkDeps(ws.arcDir, ws.rootDir, ws.packages);
+  for (const pkg of ws.packages) {
+    collectModuleDeps(ws.arcDir, pkg);
+  }
+  try {
+    await extractAccessMap(ws.arcDir, ws.packages);
+  } catch (e) {
+    err(`access-extractor failed: ${e.message}`);
+  }
   const finalManifest = assembleManifest(ws, modulesResult.modules, cache);
-  writeFileSync7(join9(ws.modulesDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
+  writeFileSync10(join12(ws.modulesDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
   return finalManifest;
 }
 function assembleManifest(ws, modules, cache) {
@@ -27246,35 +27533,35 @@ function assembleManifest(ws, modules, cache) {
 }
 function resolveAssetSource(from, pkgDir, rootDir) {
   if (from.startsWith("./") || from.startsWith("../")) {
-    const resolved = join9(pkgDir, from);
-    return existsSync8(resolved) ? resolved : null;
+    const resolved = join12(pkgDir, from);
+    return existsSync10(resolved) ? resolved : null;
   }
   const candidates = [
-    join9(rootDir, "node_modules", from),
-    join9(pkgDir, "node_modules", from)
+    join12(rootDir, "node_modules", from),
+    join12(pkgDir, "node_modules", from)
   ];
   for (const c of candidates) {
-    if (existsSync8(c))
+    if (existsSync10(c))
       return c;
   }
-  const bunCacheDir = join9(rootDir, "node_modules", ".bun");
-  if (existsSync8(bunCacheDir)) {
-    for (const entry of readdirSync5(bunCacheDir, { withFileTypes: true })) {
+  const bunCacheDir = join12(rootDir, "node_modules", ".bun");
+  if (existsSync10(bunCacheDir)) {
+    for (const entry of readdirSync6(bunCacheDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const candidate = join9(bunCacheDir, entry.name, "node_modules", from);
-      if (existsSync8(candidate))
+      const candidate = join12(bunCacheDir, entry.name, "node_modules", from);
+      if (existsSync10(candidate))
         return candidate;
     }
   }
   return null;
 }
 function readBrowserAssets(pkgDir) {
-  const pkgJsonPath = join9(pkgDir, "package.json");
-  if (!existsSync8(pkgJsonPath))
+  const pkgJsonPath = join12(pkgDir, "package.json");
+  if (!existsSync10(pkgJsonPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync8(pkgJsonPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
     const assets = pkg.arc?.browserAssets;
     if (!Array.isArray(assets))
       return [];
@@ -27284,14 +27571,14 @@ function readBrowserAssets(pkgDir) {
   }
 }
 function discoverBrowserAssets(ws) {
-  const arcDir = join9(ws.rootDir, "node_modules", "@arcote.tech");
-  if (!existsSync8(arcDir))
+  const arcDir = join12(ws.rootDir, "node_modules", "@arcote.tech");
+  if (!existsSync10(arcDir))
     return [];
   const out = [];
-  for (const entry of readdirSync5(arcDir, { withFileTypes: true })) {
+  for (const entry of readdirSync6(arcDir, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const pkgDir = join9(arcDir, entry.name);
+    const pkgDir = join12(arcDir, entry.name);
     const assets = readBrowserAssets(pkgDir);
     for (const asset of assets) {
       const src = resolveAssetSource(asset.from, pkgDir, ws.rootDir);
@@ -27305,7 +27592,7 @@ function discoverBrowserAssets(ws) {
   return out;
 }
 async function copyBrowserAssets(ws, cache, noCache) {
-  mkdirSync7(ws.assetsDir, { recursive: true });
+  mkdirSync10(ws.assetsDir, { recursive: true });
   const assets = discoverBrowserAssets(ws);
   if (assets.length === 0)
     return;
@@ -27316,7 +27603,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
     to: a.to,
     mtime: mtimeOf(a.src)
   })));
-  const requiredOutputs = assets.map((a) => join9(ws.assetsDir, a.to));
+  const requiredOutputs = assets.map((a) => join12(ws.assetsDir, a.to));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: browser-assets (${assets.length})`);
     return;
@@ -27324,10 +27611,10 @@ async function copyBrowserAssets(ws, cache, noCache) {
   console.log(`  building: browser-assets (${assets.length})`);
   const outputHashes = {};
   for (const asset of assets) {
-    const dest = join9(ws.assetsDir, asset.to);
-    mkdirSync7(dirname6(dest), { recursive: true });
-    copyFileSync(asset.src, dest);
-    outputHashes[asset.to] = sha256Hex(readFileSync8(dest));
+    const dest = join12(ws.assetsDir, asset.to);
+    mkdirSync10(dirname6(dest), { recursive: true });
+    copyFileSync2(asset.src, dest);
+    outputHashes[asset.to] = sha256Hex(readFileSync11(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
 }
@@ -27348,7 +27635,7 @@ function collectArcPeerDeps(packages) {
     return [short, pkg];
   });
 }
-var REACT_ENTRIES = [
+var REACT_ENTRIES2 = [
   [
     "react",
     `import React from "react";
@@ -27378,8 +27665,8 @@ export const { createPortal, flushSync } = ReactDOM;`
     `export { createRoot, hydrateRoot } from "react-dom/client";`
   ]
 ];
-var REACT_OUTPUT_FILES = REACT_ENTRIES.map(([n]) => `${n}.js`);
-var SHELL_BASE_EXTERNAL = [
+var REACT_OUTPUT_FILES = REACT_ENTRIES2.map(([n]) => `${n}.js`);
+var SHELL_BASE_EXTERNAL2 = [
   "react",
   "react-dom",
   "react/jsx-runtime",
@@ -27396,27 +27683,27 @@ var sourceFilter2 = (rel) => {
   return true;
 };
 function arcPkgSrcHash(rootDir, pkg) {
-  const srcDir = join9(rootDir, "node_modules", pkg, "src");
-  if (existsSync8(srcDir))
+  const srcDir = join12(rootDir, "node_modules", pkg, "src");
+  if (existsSync10(srcDir))
     return sha256OfDir(srcDir, sourceFilter2);
-  return sha256OfDir(join9(rootDir, "node_modules", pkg), sourceFilter2);
+  return sha256OfDir(join12(rootDir, "node_modules", pkg), sourceFilter2);
 }
 async function buildShellReact(shellDir, tmpDir, rootDir, cache, noCache) {
   const unitId = "shell:react";
   const inputHash = sha256OfJson({
     react: readInstalledVersion(rootDir, "react"),
     "react-dom": readInstalledVersion(rootDir, "react-dom"),
-    entries: REACT_ENTRIES.map(([k, v]) => [k, v])
+    entries: REACT_ENTRIES2.map(([k, v]) => [k, v])
   });
-  const requiredOutputs = REACT_OUTPUT_FILES.map((f) => join9(shellDir, f));
+  const requiredOutputs = REACT_OUTPUT_FILES.map((f) => join12(shellDir, f));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: shell:react`);
     return;
   }
   console.log(`  building: shell:react`);
   const reactEps = [];
-  for (const [name, code] of REACT_ENTRIES) {
-    const f = join9(tmpDir, `${name}.ts`);
+  for (const [name, code] of REACT_ENTRIES2) {
+    const f = join12(tmpDir, `${name}.ts`);
     await Bun.write(f, code);
     reactEps.push(f);
   }
@@ -27443,16 +27730,16 @@ async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir,
     pkg,
     version: readInstalledVersion(rootDir, pkg),
     src: arcPkgSrcHash(rootDir, pkg),
-    base: SHELL_BASE_EXTERNAL,
+    base: SHELL_BASE_EXTERNAL2,
     others: [...otherExternals].sort()
   });
-  const outputFile = join9(shellDir, `${shortName}.js`);
+  const outputFile = join12(shellDir, `${shortName}.js`);
   if (!noCache && isCacheHit(cache, unitId, inputHash, [outputFile])) {
     console.log(`  \u2713 cached: ${unitId}`);
     return;
   }
   console.log(`  building: ${unitId}`);
-  const f = join9(tmpDir, `${shortName}.ts`);
+  const f = join12(tmpDir, `${shortName}.ts`);
   await Bun.write(f, `export * from "${pkg}";
 `);
   const r = await Bun.build({
@@ -27461,7 +27748,7 @@ async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir,
     format: "esm",
     target: "browser",
     naming: "[name].[ext]",
-    external: [...SHELL_BASE_EXTERNAL, ...otherExternals],
+    external: [...SHELL_BASE_EXTERNAL2, ...otherExternals],
     define: {
       ONLY_SERVER: "false",
       ONLY_BROWSER: "true",
@@ -27476,10 +27763,10 @@ async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir,
   const outputHash = sha256OfFiles([outputFile]);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
-async function buildShell(ws, cache, noCache) {
-  mkdirSync7(ws.shellDir, { recursive: true });
-  const tmpDir = join9(ws.shellDir, "_tmp");
-  mkdirSync7(tmpDir, { recursive: true });
+async function buildShell2(ws, cache, noCache) {
+  mkdirSync10(ws.shellDir, { recursive: true });
+  const tmpDir = join12(ws.shellDir, "_tmp");
+  mkdirSync10(tmpDir, { recursive: true });
   const arcEntries = collectArcPeerDeps(ws.packages);
   const allArcPkgs = arcEntries.map(([, pkg]) => pkg);
   const tasks = [
@@ -27487,7 +27774,7 @@ async function buildShell(ws, cache, noCache) {
     ...arcEntries.map(([short, pkg]) => () => buildShellArcEntry(short, pkg, allArcPkgs, ws.shellDir, tmpDir, ws.rootDir, cache, noCache))
   ];
   await pAll(tasks);
-  rmSync2(tmpDir, { recursive: true, force: true });
+  rmSync3(tmpDir, { recursive: true, force: true });
 }
 async function loadServerContext(packages) {
   const ctxPackages = packages.filter((p) => isContextPackage(p.packageJson));
@@ -27496,13 +27783,13 @@ async function loadServerContext(packages) {
   globalThis.ONLY_SERVER = true;
   globalThis.ONLY_BROWSER = false;
   globalThis.ONLY_CLIENT = false;
-  const platformDir = join9(process.cwd(), "node_modules", "@arcote.tech", "platform");
-  const platformPkg = JSON.parse(readFileSync8(join9(platformDir, "package.json"), "utf-8"));
-  const platformEntry = join9(platformDir, platformPkg.main ?? "src/index.ts");
+  const platformDir = join12(process.cwd(), "node_modules", "@arcote.tech", "platform");
+  const platformPkg = JSON.parse(readFileSync11(join12(platformDir, "package.json"), "utf-8"));
+  const platformEntry = join12(platformDir, platformPkg.main ?? "src/index.ts");
   await import(platformEntry);
   for (const ctx of ctxPackages) {
-    const serverDist = join9(ctx.path, "dist", "server", "main", "index.js");
-    if (!existsSync8(serverDist)) {
+    const serverDist = join12(ctx.path, "dist", "server", "main", "index.js");
+    if (!existsSync10(serverDist)) {
       err(`Context server dist not found: ${serverDist}`);
       continue;
     }
@@ -27533,19 +27820,19 @@ async function platformBuild(opts = {}) {
 }
 
 // src/commands/platform-deploy.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
+import { join as join18 } from "path";
 
 // src/deploy/bootstrap.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync14 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join13 } from "path";
+import { join as join16 } from "path";
 
 // src/deploy/ansible.ts
-var {spawn: spawn2 } = globalThis.Bun;
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { tmpdir } from "os";
-import { join as join10 } from "path";
+import { spawn as nodeSpawn } from "child_process";
+import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join13 } from "path";
 
 // src/deploy/assets.ts
 var TERRAFORM_MAIN_TF = `terraform {
@@ -27802,18 +28089,18 @@ var ASSETS = {
   }
 };
 async function materializeAssets(targetDir, files) {
-  const { mkdirSync: mkdirSync8, writeFileSync: writeFileSync8 } = await import("fs");
-  const { join: join10 } = await import("path");
-  mkdirSync8(targetDir, { recursive: true });
+  const { mkdirSync: mkdirSync11, writeFileSync: writeFileSync11 } = await import("fs");
+  const { join: join13 } = await import("path");
+  mkdirSync11(targetDir, { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    writeFileSync8(join10(targetDir, name), content);
+    writeFileSync11(join13(targetDir, name), content);
   }
 }
 
 // src/deploy/ansible.ts
 async function runAnsible(inputs) {
-  const workDir = join10(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
-  mkdirSync8(workDir, { recursive: true });
+  const workDir = join13(tmpdir2(), "arc-deploy", `ansible-${Date.now()}`);
+  mkdirSync11(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.ansible);
   const user = inputs.asRoot ? "root" : inputs.target.user;
   const port = inputs.ansible?.sshPort ?? inputs.target.port;
@@ -27827,29 +28114,23 @@ async function runAnsible(inputs) {
     ""
   ].join(`
 `);
-  writeFileSync8(join10(workDir, "inventory.ini"), inventory);
-  const extraVars = [
-    `username=${inputs.target.user}`,
-    `ssh_port=${port}`
-  ];
-  if (inputs.ansible?.extraAllowedIps?.length) {
-    extraVars.push(`extra_allowed_ips=${JSON.stringify(inputs.ansible.extraAllowedIps)}`);
-  }
-  const proc2 = spawn2({
-    cmd: [
-      "ansible-playbook",
-      "-i",
-      "inventory.ini",
-      "site.yml",
-      "-e",
-      extraVars.join(" ")
-    ],
-    cwd: workDir,
-    stdout: "inherit",
-    stderr: "inherit",
-    env: { ...process.env, ANSIBLE_HOST_KEY_CHECKING: "False" }
+  writeFileSync11(join13(workDir, "inventory.ini"), inventory);
+  const extraVarsJson = JSON.stringify({
+    username: inputs.target.user,
+    ssh_port: port,
+    extra_allowed_ips: inputs.ansible?.extraAllowedIps ?? []
+  });
+  const exit = await new Promise((resolve, reject) => {
+    const proc2 = nodeSpawn("ansible-playbook", ["-i", "inventory.ini", "site.yml", "-e", extraVarsJson], {
+      cwd: workDir,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, ANSIBLE_HOST_KEY_CHECKING: "False" }
+    });
+    proc2.stdout?.on("data", (chunk) => process.stdout.write(chunk));
+    proc2.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+    proc2.on("error", reject);
+    proc2.on("exit", (code) => resolve(code ?? 1));
   });
-  const exit = await proc2.exited;
   if (exit !== 0) {
     throw new Error(`ansible-playbook failed (exit ${exit})`);
   }
@@ -27895,7 +28176,8 @@ function generateCaddyfile(cfg) {
 }
 
 // src/deploy/compose.ts
-function generateCompose({ cfg }) {
+var RESERVED_ENV = new Set(["PORT", "ARC_DEPLOY_API", "ARC_CLI_VERSION"]);
+function generateCompose({ cfg, cliVersion }) {
   const lines = [];
   lines.push("# Generated by `arc platform deploy` \u2014 do not edit by hand.");
   lines.push("");
@@ -27916,20 +28198,26 @@ function generateCompose({ cfg }) {
   lines.push("");
   for (const [name, env2] of Object.entries(cfg.envs)) {
     lines.push(`  arc-${name}:`);
-    lines.push("    image: oven/bun:1-alpine");
+    lines.push("    image: pkrasinski/arc-runtime:1");
     lines.push("    restart: unless-stopped");
-    lines.push(`    working_dir: /app`);
     lines.push("    volumes:");
-    lines.push(`      - ${cfg.target.remoteDir}/${name}:/app`);
+    lines.push(`      - arc-platform-${name}:/app/.arc/platform`);
     lines.push(`      - arc-data-${name}:/app/.arc/data`);
+    lines.push("      - arc-cli-cache:/app/.arc/cli");
+    lines.push("      - arc-bun-cache:/root/.bun/install/cache");
     lines.push("    environment:");
     lines.push("      PORT: 5005");
     lines.push('      ARC_DEPLOY_API: "1"');
-    lines.push("      NODE_ENV: production");
-    for (const [k, v] of Object.entries(env2.envVars ?? {})) {
+    lines.push(`      ARC_CLI_VERSION: ${JSON.stringify(cliVersion)}`);
+    const userEnv = env2.envVars ?? {};
+    if (!("NODE_ENV" in userEnv)) {
+      lines.push("      NODE_ENV: production");
+    }
+    for (const [k, v] of Object.entries(userEnv)) {
+      if (RESERVED_ENV.has(k))
+        continue;
       lines.push(`      ${k}: ${JSON.stringify(v)}`);
     }
-    lines.push('    command: ["node_modules/.bin/arc", "platform", "start"]');
     lines.push("    networks:");
     lines.push("      - arc-net");
     lines.push("    expose:");
@@ -27942,7 +28230,10 @@ function generateCompose({ cfg }) {
   lines.push("volumes:");
   lines.push("  caddy_data:");
   lines.push("  caddy_config:");
+  lines.push("  arc-cli-cache:");
+  lines.push("  arc-bun-cache:");
   for (const [name] of Object.entries(cfg.envs)) {
+    lines.push(`  arc-platform-${name}:`);
     lines.push(`  arc-data-${name}:`);
   }
   return lines.join(`
@@ -27951,16 +28242,18 @@ function generateCompose({ cfg }) {
 }
 
 // src/deploy/terraform.ts
-var {spawn: spawn3 } = globalThis.Bun;
-import { existsSync as existsSync9, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join11 } from "path";
+import { spawn as nodeSpawn2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync11, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
+import { homedir } from "os";
+import { join as join14 } from "path";
 async function runTerraform(inputs) {
-  const workDir = join11(tmpdir2(), "arc-deploy", `tf-${Date.now()}`);
-  mkdirSync9(workDir, { recursive: true });
+  const wsHash = createHash2("sha256").update(inputs.workspaceDir).digest("hex").slice(0, 16);
+  const workDir = join14(homedir(), ".arc-deploy", wsHash, "tf");
+  mkdirSync12(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.terraform);
   const sshPubKey = inputs.tf.sshPublicKey ?? expandHome("~/.ssh/id_ed25519.pub");
-  if (!existsSync9(expandHome(sshPubKey))) {
+  if (!existsSync11(expandHome(sshPubKey))) {
     throw new Error(`SSH public key not found at ${sshPubKey}. Set provision.terraform.sshPublicKey in deploy.arc.json.`);
   }
   const tfvars = [
@@ -27973,7 +28266,7 @@ async function runTerraform(inputs) {
   ].join(`
 `) + `
 `;
-  writeFileSync9(join11(workDir, "terraform.tfvars"), tfvars);
+  writeFileSync12(join14(workDir, "terraform.tfvars"), tfvars);
   await runTf(workDir, ["init", "-input=false", "-no-color"]);
   await runTf(workDir, [
     "apply",
@@ -27990,28 +28283,34 @@ async function runTerraform(inputs) {
   return { serverIp: ip.trim(), serverName: inputs.serverName, workDir };
 }
 async function runTf(workDir, args) {
-  const proc2 = spawn3({
-    cmd: ["terraform", ...args],
-    cwd: workDir,
-    stdout: "inherit",
-    stderr: "inherit"
+  const exit = await new Promise((resolve, reject) => {
+    const proc2 = nodeSpawn2("terraform", args, {
+      cwd: workDir,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    proc2.stdout?.on("data", (chunk) => process.stdout.write(chunk));
+    proc2.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+    proc2.on("error", reject);
+    proc2.on("exit", (code) => resolve(code ?? 1));
   });
-  const exit = await proc2.exited;
   if (exit !== 0) {
     throw new Error(`terraform ${args[0]} failed (exit ${exit})`);
   }
 }
 async function runTfCapture(workDir, args) {
-  const proc2 = spawn3({
-    cmd: ["terraform", ...args],
-    cwd: workDir,
-    stdout: "pipe",
-    stderr: "pipe"
+  let stdout = "";
+  const exit = await new Promise((resolve, reject) => {
+    const proc2 = nodeSpawn2("terraform", args, {
+      cwd: workDir,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    proc2.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+    });
+    proc2.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+    proc2.on("error", reject);
+    proc2.on("exit", (code) => resolve(code ?? 1));
   });
-  const [stdout, exit] = await Promise.all([
-    new Response(proc2.stdout).text(),
-    proc2.exited
-  ]);
   if (exit !== 0) {
     throw new Error(`terraform ${args[0]} failed (exit ${exit})`);
   }
@@ -28025,21 +28324,21 @@ function expandHome(p) {
 }
 
 // src/deploy/config.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync13 } from "fs";
+import { join as join15 } from "path";
 var DEPLOY_CONFIG_FILE = "deploy.arc.json";
 function deployConfigPath(rootDir) {
-  return join12(rootDir, DEPLOY_CONFIG_FILE);
+  return join15(rootDir, DEPLOY_CONFIG_FILE);
 }
 function deployConfigExists(rootDir) {
-  return existsSync10(deployConfigPath(rootDir));
+  return existsSync12(deployConfigPath(rootDir));
 }
 function loadDeployConfig(rootDir) {
   const path4 = deployConfigPath(rootDir);
-  if (!existsSync10(path4)) {
+  if (!existsSync12(path4)) {
     throw new Error(`Missing ${DEPLOY_CONFIG_FILE} at ${path4}`);
   }
-  const raw = readFileSync9(path4, "utf-8");
+  const raw = readFileSync12(path4, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -28050,7 +28349,10 @@ function loadDeployConfig(rootDir) {
   return validateDeployConfig(expanded);
 }
 function saveDeployConfig(rootDir, cfg) {
-  writeFileSync10(deployConfigPath(rootDir), JSON.stringify(cfg, null, 2) + `
+  const path4 = deployConfigPath(rootDir);
+  const raw = existsSync12(path4) ? JSON.parse(readFileSync12(path4, "utf-8")) : {};
+  raw.target = { ...raw.target, ...cfg.target };
+  writeFileSync13(path4, JSON.stringify(raw, null, 2) + `
 `);
 }
 var VAR_REGEX = /\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g;
@@ -28201,7 +28503,7 @@ function cfgErr(path4, expected) {
 }
 
 // src/deploy/ssh.ts
-var {spawn: spawn4 } = globalThis.Bun;
+var {spawn: spawn3 } = globalThis.Bun;
 async function streamToString(stream2) {
   if (!stream2 || typeof stream2 === "number")
     return "";
@@ -28227,7 +28529,7 @@ async function sshExec(target, cmd, opts = {}) {
     "--",
     cmd
   ];
-  const proc2 = spawn4({
+  const proc2 = spawn3({
     cmd: ["ssh", ...args],
     stdin: opts.stdin ? "pipe" : "ignore",
     stdout: "pipe",
@@ -28283,7 +28585,7 @@ async function scpUpload(target, localPath, remotePath) {
   if (target.sshKey)
     args.push("-i", target.sshKey);
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
-  const proc2 = spawn4({ cmd: ["scp", ...args], stderr: "pipe" });
+  const proc2 = spawn3({ cmd: ["scp", ...args], stderr: "pipe" });
   const [stderr, exitCode] = await Promise.all([
     streamToString(proc2.stderr),
     proc2.exited
@@ -28292,29 +28594,6 @@ async function scpUpload(target, localPath, remotePath) {
     throw new Error(`scp failed (${exitCode}): ${stderr}`);
   }
 }
-async function rsyncDir(target, localDir, remoteDir, opts = {}) {
-  const sshCmdParts = ["ssh", "-p", String(target.port)];
-  if (target.sshKey)
-    sshCmdParts.push("-i", target.sshKey);
-  const sshCmd = sshCmdParts.join(" ");
-  const args = ["-azL", "-e", sshCmd];
-  if (opts.delete)
-    args.push("--delete");
-  const src = localDir.endsWith("/") ? localDir : `${localDir}/`;
-  args.push(src, `${target.user}@${target.host}:${remoteDir}`);
-  const proc2 = spawn4({
-    cmd: ["rsync", ...args],
-    stderr: "pipe",
-    stdout: "pipe"
-  });
-  const [stderr, exitCode] = await Promise.all([
-    streamToString(proc2.stderr),
-    proc2.exited
-  ]);
-  if (exitCode !== 0) {
-    throw new Error(`rsync failed (${exitCode}): ${stderr}`);
-  }
-}
 async function openTunnel(target, localPort, remoteHost, remotePort) {
   const args = [
     ...baseSshArgs(target),
@@ -28323,7 +28602,7 @@ async function openTunnel(target, localPort, remoteHost, remotePort) {
     `${localPort}:${remoteHost}:${remotePort}`,
     `${target.user}@${target.host}`
   ];
-  const proc2 = spawn4({
+  const proc2 = spawn3({
     cmd: ["ssh", ...args],
     stdin: "ignore",
     stdout: "pipe",
@@ -28369,6 +28648,9 @@ async function detectRemoteState(cfg) {
     return { kind: "unreachable", reason: "target.host not yet set" };
   }
   if (!await canSsh(cfg.target)) {
+    if (await canSsh({ ...cfg.target, user: "root" })) {
+      return { kind: "no-docker" };
+    }
     return { kind: "unreachable", reason: "ssh connection failed" };
   }
   const dockerCheck = await sshExec(cfg.target, "command -v docker", {
@@ -28419,7 +28701,8 @@ async function bootstrap(inputs) {
     const tfOut = await runTerraform({
       tf: cfg.provision.terraform,
       token,
-      serverName: `arc-${Object.keys(cfg.envs)[0] ?? "host"}`
+      serverName: `arc-${Object.keys(cfg.envs)[0] ?? "host"}`,
+      workspaceDir: rootDir
     });
     ok(`Server provisioned: ${tfOut.serverIp}`);
     cfg.target.host = tfOut.serverIp;
@@ -28430,7 +28713,8 @@ async function bootstrap(inputs) {
   }
   if (state.kind === "unreachable" || state.kind === "no-docker") {
     log2("Running Ansible bootstrap (Docker + firewall + SSH hardening)...");
-    const asRoot = state.kind === "unreachable";
+    const deployUserWorks = state.kind === "no-docker" && await canSsh(cfg.target);
+    const asRoot = !deployUserWorks;
     await runAnsible({
       target: cfg.target,
       ansible: cfg.provision?.ansible,
@@ -28450,125 +28734,185 @@ async function bootstrap(inputs) {
 }
 async function upStack(inputs) {
   const { cfg } = inputs;
-  const workDir = join13(tmpdir3(), "arc-deploy", `stack-${Date.now()}`);
-  mkdirSync10(workDir, { recursive: true });
-  writeFileSync11(join13(workDir, "Caddyfile"), generateCaddyfile(cfg));
-  writeFileSync11(join13(workDir, "docker-compose.yml"), generateCompose({ cfg }));
+  const workDir = join16(tmpdir3(), "arc-deploy", `stack-${Date.now()}`);
+  mkdirSync13(workDir, { recursive: true });
+  writeFileSync14(join16(workDir, "Caddyfile"), generateCaddyfile(cfg));
+  writeFileSync14(join16(workDir, "docker-compose.yml"), generateCompose({ cfg, cliVersion: inputs.cliVersion }));
   await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
   for (const name of Object.keys(cfg.envs)) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
   }
-  await scpUpload(cfg.target, join13(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
-  await scpUpload(cfg.target, join13(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
+  await scpUpload(cfg.target, join16(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
+  await scpUpload(cfg.target, join16(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
   await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose pull --ignore-pull-failures && docker compose up -d`);
 }
 
 // src/deploy/remote-sync.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join14, relative as relative4 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
+import { basename as basename5, join as join17 } from "path";
 function diffManifests(local, remote) {
   const remoteByName = new Map(remote.modules.map((m) => [m.name, m]));
   const changedModules = local.modules.filter((m) => remoteByName.get(m.name)?.hash !== m.hash);
   return {
     changedModules: [...changedModules],
-    shellChanged: local.shellHash !== remote.shellHash,
     stylesChanged: local.stylesHash !== remote.stylesHash
   };
 }
 async function syncEnv(inputs) {
-  const { cfg, env: env2, ws, projectDir } = inputs;
+  const { cfg, env: env2, ws } = inputs;
   const envConfig = cfg.envs[env2];
   if (!envConfig)
     throw new Error(`Unknown env: ${env2}`);
-  const remotePath = `${cfg.target.remoteDir}/${env2}`;
-  await rsyncDir(cfg.target, projectDir, remotePath);
-  const localManifestPath = join14(ws.modulesDir, "manifest.json");
-  if (!existsSync11(localManifestPath)) {
+  const localManifestPath = join17(ws.modulesDir, "manifest.json");
+  if (!existsSync13(localManifestPath)) {
     throw new Error(`Local build missing at ${localManifestPath}. Run arc platform build first.`);
   }
-  const localManifest = JSON.parse(readFileSync10(localManifestPath, "utf-8"));
-  const localPort = 15500 + hashEnvToOffset(env2);
-  const tunnel = await openTunnel(cfg.target, localPort, "127.0.0.1", 2019);
+  const localManifest = JSON.parse(readFileSync13(localManifestPath, "utf-8"));
+  const pkgByName = new Map(ws.packages.map((p) => [p.name.includes("/") ? p.name.split("/").pop() : p.name, p]));
+  let tunnel = await openTunnel(cfg.target, 15500 + hashEnvToOffset(env2), "127.0.0.1", 2019);
+  let restarts = 0;
+  let frameworkChanged = false;
   try {
-    const base2 = `http://127.0.0.1:${localPort}/env/${env2}`;
-    const remoteManifestRes = await fetch(`${base2}/api/deploy/manifest`);
-    if (!remoteManifestRes.ok) {
-      throw new Error(`Failed to fetch remote manifest: ${remoteManifestRes.status}`);
-    }
-    const remoteManifest = await remoteManifestRes.json();
-    const diff = diffManifests(localManifest, remoteManifest);
-    if (diff.shellChanged) {
-      const shellFiles = collectFiles(ws.shellDir);
+    const base2 = () => `http://127.0.0.1:${tunnel.localPort}/env/${env2}`;
+    const localFrameworkHash = readDepsHash(join17(ws.arcDir, ".deps-hash"));
+    const remoteFwRes = await fetch(`${base2()}/api/deploy/framework`);
+    const remoteFw = remoteFwRes.ok ? await remoteFwRes.json() : { depsHash: null };
+    if (localFrameworkHash && localFrameworkHash !== remoteFw.depsHash) {
+      console.log("[arc] Pushing framework deps...");
       const form = new FormData;
-      for (const absPath of shellFiles) {
-        const rel = relative4(ws.shellDir, absPath);
-        form.append(rel, new Blob([readFileSync10(absPath)]), rel);
+      form.append("package.json", new Blob([readFileSync13(join17(ws.arcDir, "package.json"))]), "package.json");
+      const lockPath = join17(ws.arcDir, "bun.lock");
+      if (existsSync13(lockPath)) {
+        form.append("bun.lock", new Blob([readFileSync13(lockPath)]), "bun.lock");
       }
-      const res2 = await fetch(`${base2}/api/deploy/shell`, {
+      const res = await fetch(`${base2()}/api/deploy/framework`, {
         method: "POST",
         body: form
       });
-      if (!res2.ok)
-        throw new Error(`Shell upload failed: ${res2.status} ${await res2.text()}`);
-    }
-    if (diff.stylesChanged) {
+      if (!res.ok) {
+        throw new Error(`framework push failed: ${res.status} ${await res.text()}`);
+      }
+      frameworkChanged = true;
+      const result = await res.json();
+      if (result.needsRestart) {
+        tunnel = await restartAndReopen(cfg, env2, tunnel);
+        restarts += 1;
+      }
+    }
+    const remoteManifestRes = await fetch(`${base2()}/api/deploy/manifest`);
+    const remoteManifest = remoteManifestRes.ok ? await remoteManifestRes.json() : {
+      modules: [],
+      shellHash: "",
+      stylesHash: "",
+      buildTime: ""
+    };
+    const diff = diffManifests(localManifest, remoteManifest);
+    for (const mod of diff.changedModules) {
+      const safeName = sanitizeName(mod.name);
+      const moduleDir = join17(ws.modulesDir, safeName);
+      const browserPath = join17(moduleDir, "browser.js");
+      const serverPath = join17(moduleDir, "server.js");
+      const pkgPath = join17(moduleDir, "package.json");
+      const accessPath = join17(moduleDir, "access.json");
+      const browserActual = existsSync13(browserPath) ? browserPath : join17(ws.modulesDir, `${safeName}.js`);
+      if (!existsSync13(browserActual)) {
+        throw new Error(`Missing browser bundle for module ${mod.name}`);
+      }
       const form = new FormData;
-      for (const name of ["styles.css", "theme.css"]) {
-        const p = join14(ws.arcDir, name);
-        if (existsSync11(p)) {
-          form.append(name, new Blob([readFileSync10(p)]), name);
-        }
+      form.append("browser.js", new Blob([readFileSync13(browserActual)]), "browser.js");
+      const pkg = pkgByName.get(safeName);
+      if (pkg && isContextPackage(pkg.packageJson) && existsSync13(serverPath)) {
+        form.append("server.js", new Blob([readFileSync13(serverPath)]), "server.js");
+      }
+      if (existsSync13(pkgPath)) {
+        form.append("package.json", new Blob([readFileSync13(pkgPath)]), "package.json");
       }
-      const res2 = await fetch(`${base2}/api/deploy/shell`, {
+      if (existsSync13(accessPath)) {
+        form.append("access.json", new Blob([readFileSync13(accessPath)]), "access.json");
+      }
+      console.log(`[arc] Pushing module ${safeName}...`);
+      const res = await fetch(`${base2()}/api/deploy/modules/${safeName}`, {
         method: "POST",
         body: form
       });
-      if (!res2.ok)
-        throw new Error(`Styles upload failed: ${res2.status} ${await res2.text()}`);
+      if (!res.ok) {
+        throw new Error(`module ${safeName} push failed: ${res.status} ${await res.text()}`);
+      }
     }
-    if (diff.changedModules.length > 0) {
+    if (diff.stylesChanged) {
+      console.log("[arc] Pushing styles...");
       const form = new FormData;
-      for (const mod of diff.changedModules) {
-        const p = join14(ws.modulesDir, mod.file);
-        form.append(mod.file, new Blob([readFileSync10(p)]), mod.file);
+      for (const name of ["styles.css", "theme.css"]) {
+        const p = join17(ws.arcDir, name);
+        if (existsSync13(p)) {
+          form.append(name, new Blob([readFileSync13(p)]), name);
+        }
       }
-      const res2 = await fetch(`${base2}/api/deploy/modules`, {
+      const res = await fetch(`${base2()}/api/deploy/styles`, {
         method: "POST",
         body: form
       });
-      if (!res2.ok)
-        throw new Error(`Modules upload failed: ${res2.status} ${await res2.text()}`);
+      if (!res.ok) {
+        throw new Error(`styles push failed: ${res.status} ${await res.text()}`);
+      }
     }
-    const res = await fetch(`${base2}/api/deploy/manifest`, {
+    const commitRes = await fetch(`${base2()}/api/deploy/manifest`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(localManifest)
     });
-    if (!res.ok)
-      throw new Error(`Manifest update failed: ${res.status} ${await res.text()}`);
+    if (!commitRes.ok) {
+      throw new Error(`manifest commit failed: ${commitRes.status} ${await commitRes.text()}`);
+    }
+    const commit = await commitRes.json();
+    if (commit.needsRestart) {
+      tunnel = await restartAndReopen(cfg, env2, tunnel);
+      restarts += 1;
+    }
     return {
       env: env2,
+      frameworkChanged,
       changedModules: diff.changedModules.map((m) => m.name),
-      shellChanged: diff.shellChanged,
-      stylesChanged: diff.stylesChanged
+      stylesChanged: diff.stylesChanged,
+      restarts
     };
   } finally {
     tunnel.close();
   }
 }
-function collectFiles(dir) {
-  if (!existsSync11(dir))
-    return [];
-  const { readdirSync: readdirSync6 } = __require("fs");
-  const out = [];
-  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
-    const p = join14(dir, entry.name);
-    if (entry.isDirectory())
-      out.push(...collectFiles(p));
-    else if (entry.isFile())
-      out.push(p);
+function readDepsHash(path4) {
+  if (!existsSync13(path4))
+    return null;
+  return readFileSync13(path4, "utf-8").trim() || null;
+}
+function sanitizeName(name) {
+  return basename5(name);
+}
+async function restartAndReopen(cfg, env2, oldTunnel) {
+  console.log(`[arc] Restarting arc-${env2}...`);
+  oldTunnel.close();
+  await assertExec(cfg.target, `docker restart arc-${env2}`);
+  const tunnel = await openTunnel(cfg.target, 15500 + hashEnvToOffset(env2), "127.0.0.1", 2019);
+  await waitForHealthy(`http://127.0.0.1:${tunnel.localPort}/env/${env2}`, 60000);
+  return tunnel;
+}
+async function waitForHealthy(baseUrl, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  let lastErr;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`${baseUrl}/api/deploy/health`, {
+        signal: AbortSignal.timeout(2000)
+      });
+      if (res.ok)
+        return;
+      lastErr = `status ${res.status}`;
+    } catch (e) {
+      lastErr = e;
+    }
+    await new Promise((r) => setTimeout(r, 1000));
   }
-  return out;
+  throw new Error(`Health check timeout: ${String(lastErr)}`);
 }
 function hashEnvToOffset(env2) {
   let h = 0;
@@ -29274,13 +29618,13 @@ async function platformDeploy(envArg, options = {}) {
     err(`Unknown env "${envArg}". Known: ${Object.keys(cfg.envs).join(", ")}`);
     process.exit(1);
   })() : Object.keys(cfg.envs);
-  const manifestPath = join15(ws.modulesDir, "manifest.json");
-  const needBuild = options.rebuild || !existsSync12(manifestPath);
+  const manifestPath = join18(ws.modulesDir, "manifest.json");
+  const needBuild = options.rebuild || !existsSync14(manifestPath);
   if (needBuild && !options.skipBuild) {
     log2("Building platform...");
     await buildAll(ws, { noCache: options.rebuild });
     ok("Build complete");
-  } else if (!existsSync12(manifestPath)) {
+  } else if (!existsSync14(manifestPath)) {
     err("No build found and --skip-build was set.");
     process.exit(1);
   }
@@ -29323,24 +29667,24 @@ async function platformDeploy(envArg, options = {}) {
 }
 function readCliVersion() {
   try {
-    const pkgPath = join15(import.meta.dir, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
+    const pkgPath = join18(import.meta.dir, "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
     return pkg.version ?? "unknown";
   } catch {
     return "unknown";
   }
 }
 async function hashDeployConfig(rootDir) {
-  const p2 = join15(rootDir, "deploy.arc.json");
-  const content = readFileSync11(p2);
+  const p2 = join18(rootDir, "deploy.arc.json");
+  const content = readFileSync14(p2);
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   return hasher.digest("hex").slice(0, 16);
 }
 
 // src/commands/platform-dev.ts
-import { existsSync as existsSync15, watch } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync17, watch } from "fs";
+import { join as join21 } from "path";
 
 // ../host/src/create-server.ts
 var import_jsonwebtoken = __toESM(require_jsonwebtoken(), 1);
@@ -30790,92 +31134,222 @@ async function createArcServer(config) {
   };
 }
 // src/platform/server.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync12 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync15 } from "fs";
+import { join as join20 } from "path";
 
 // src/platform/deploy-api.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname7, join as join16, normalize as normalize2, relative as relative5, resolve } from "path";
+var {spawn: spawn4 } = globalThis.Bun;
+import {
+  cpSync,
+  existsSync as existsSync15,
+  mkdirSync as mkdirSync14,
+  readFileSync as readFileSync15,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync15
+} from "fs";
+import { dirname as dirname7, join as join19, normalize as normalize2, resolve } from "path";
 function createDeployApiHandler(opts) {
   return async (req, url, ctx) => {
     const p3 = url.pathname;
     if (!p3.startsWith("/api/deploy/"))
       return null;
+    const cors = ctx.corsHeaders;
     if (p3 === "/api/deploy/health" && req.method === "GET") {
-      return Response.json({ ok: true, modules: opts.getManifest().modules.length }, { headers: ctx.corsHeaders });
+      return Response.json({ ok: true, modules: opts.getManifest().modules.length }, { headers: cors });
+    }
+    if (p3 === "/api/deploy/framework" && req.method === "GET") {
+      const hashPath = join19(opts.ws.arcDir, ".deps-hash");
+      const depsHash = existsSync15(hashPath) ? readFileSync15(hashPath, "utf-8").trim() : null;
+      return Response.json({ depsHash }, { headers: cors });
     }
     if (p3 === "/api/deploy/manifest" && req.method === "GET") {
-      return Response.json(opts.getManifest(), { headers: ctx.corsHeaders });
+      return Response.json(opts.getManifest(), { headers: cors });
     }
-    if (p3 === "/api/deploy/manifest" && req.method === "POST") {
-      const body = await req.json();
-      if (!validateManifest(body)) {
-        return Response.json({ error: "Invalid manifest body" }, { status: 400, headers: ctx.corsHeaders });
+    if (p3 === "/api/deploy/framework" && req.method === "POST") {
+      const form = await req.formData();
+      const pkgFile = form.get("package.json");
+      const lockFile = form.get("bun.lock");
+      if (!isFile(pkgFile) || !isFile(lockFile)) {
+        return badRequest("framework requires package.json + bun.lock", cors);
+      }
+      mkdirSync14(opts.ws.arcDir, { recursive: true });
+      writeFileSync15(join19(opts.ws.arcDir, "package.json"), Buffer.from(await pkgFile.arrayBuffer()));
+      writeFileSync15(join19(opts.ws.arcDir, "bun.lock"), Buffer.from(await lockFile.arrayBuffer()));
+      const start = Date.now();
+      const installOk = await runBun(["install", "--production", "--frozen-lockfile"], opts.ws.arcDir);
+      if (!installOk) {
+        return Response.json({ error: "bun install failed" }, { status: 500, headers: cors });
+      }
+      const cliBin = process.argv[1] ?? "arc";
+      const shellOk = await runBun([
+        "run",
+        cliBin,
+        "_build-shell",
+        "--out",
+        opts.ws.shellDir,
+        "--from",
+        join19(opts.ws.arcDir, "node_modules")
+      ], opts.ws.arcDir);
+      if (!shellOk) {
+        return Response.json({ error: "shell build failed" }, { status: 500, headers: cors });
+      }
+      const newHash = sha256Hex(Buffer.concat([
+        readFileSync15(join19(opts.ws.arcDir, "package.json")),
+        readFileSync15(join19(opts.ws.arcDir, "bun.lock"))
+      ]));
+      writeFileSync15(join19(opts.ws.arcDir, ".deps-hash"), newHash + `
+`);
+      return Response.json({
+        changed: true,
+        tookMs: Date.now() - start,
+        needsRestart: true
+      }, { headers: cors });
+    }
+    const moduleMatch = p3.match(/^\/api\/deploy\/modules\/([^/]+)$/);
+    if (moduleMatch && req.method === "POST") {
+      const safeName = sanitizeName2(moduleMatch[1]);
+      if (!safeName)
+        return badRequest("invalid module name", cors);
+      const form = await req.formData();
+      const browser = form.get("browser.js");
+      if (!isFile(browser)) {
+        return badRequest("modules/<name> requires browser.js", cors);
+      }
+      const stagingDir = join19(opts.ws.arcDir, ".staging", "modules", safeName);
+      mkdirSync14(stagingDir, { recursive: true });
+      await writeField(stagingDir, "browser.js", browser);
+      const server = form.get("server.js");
+      if (isFile(server)) {
+        await writeField(stagingDir, "server.js", server);
+      }
+      const pkg = form.get("package.json");
+      if (isFile(pkg)) {
+        await writeField(stagingDir, "package.json", pkg);
+      }
+      const access = form.get("access.json");
+      if (isFile(access)) {
+        await writeField(stagingDir, "access.json", access);
+      }
+      const stagingPkgPath = join19(stagingDir, "package.json");
+      const livePkgPath = join19(opts.ws.arcDir, "modules", safeName, "package.json");
+      const stagingPkgBytes = existsSync15(stagingPkgPath) ? readFileSync15(stagingPkgPath) : Buffer.from("");
+      const livePkgBytes = existsSync15(livePkgPath) ? readFileSync15(livePkgPath) : Buffer.from("");
+      const depsChanged = sha256Hex(stagingPkgBytes) !== sha256Hex(livePkgBytes);
+      writeFileSync15(join19(stagingDir, ".deps-hash"), sha256Hex(stagingPkgBytes) + `
+`);
+      if (depsChanged && existsSync15(stagingPkgPath)) {
+        const ok2 = await runBun(["install", "--production"], stagingDir);
+        if (!ok2) {
+          rmSync4(stagingDir, { recursive: true, force: true });
+          return Response.json({ error: `bun install failed for module ${safeName}` }, { status: 500, headers: cors });
+        }
+      } else if (!depsChanged) {
+        const liveNodeModules = join19(opts.ws.arcDir, "modules", safeName, "node_modules");
+        if (existsSync15(liveNodeModules)) {
+          cpSync(liveNodeModules, join19(stagingDir, "node_modules"), {
+            recursive: true
+          });
+        }
       }
-      writeFileSync12(join16(opts.ws.modulesDir, "manifest.json"), JSON.stringify(body, null, 2));
-      opts.setManifest(body);
-      opts.notifyReload(body);
-      return Response.json({ ok: true, moduleCount: body.modules.length }, { headers: ctx.corsHeaders });
+      return Response.json({
+        ok: true,
+        name: safeName,
+        depsChanged,
+        serverIncluded: isFile(server)
+      }, { headers: cors });
     }
-    if (p3 === "/api/deploy/modules" && req.method === "POST") {
+    if (p3 === "/api/deploy/styles" && req.method === "POST") {
       const form = await req.formData();
-      const written = await writeUploadedFiles(form, opts.ws.modulesDir);
-      return Response.json({ ok: true, written }, { headers: ctx.corsHeaders });
+      const stagingDir = join19(opts.ws.arcDir, ".staging");
+      mkdirSync14(stagingDir, { recursive: true });
+      const written = [];
+      for (const name of ["styles.css", "theme.css"]) {
+        const f2 = form.get(name);
+        if (isFile(f2)) {
+          await writeField(stagingDir, name, f2);
+          written.push(name);
+        }
+      }
+      return Response.json({ ok: true, written }, { headers: cors });
     }
-    if (p3 === "/api/deploy/shell" && req.method === "POST") {
-      const form = await req.formData();
-      const shellFiles = [];
-      const rootFiles = [];
-      for (const [name, value] of form.entries()) {
-        if (!isFile(value))
-          continue;
-        if (name === "styles.css" || name === "theme.css") {
-          rootFiles.push({ name, file: value });
-        } else {
-          shellFiles.push(value);
+    if (p3 === "/api/deploy/manifest" && req.method === "POST") {
+      const body = await req.json();
+      if (!validateManifest(body)) {
+        return badRequest("invalid manifest body", cors);
+      }
+      const stagingRoot = join19(opts.ws.arcDir, ".staging");
+      const stagingModules = join19(stagingRoot, "modules");
+      let serverSideChanged = false;
+      if (existsSync15(stagingModules)) {
+        const stagedNames = readDir(stagingModules);
+        for (const name of stagedNames) {
+          const src2 = join19(stagingModules, name);
+          const dst = join19(opts.ws.arcDir, "modules", name);
+          if (existsSync15(join19(src2, "server.js")))
+            serverSideChanged = true;
+          if (existsSync15(dst)) {
+            rmSync4(dst, { recursive: true, force: true });
+          }
+          mkdirSync14(dirname7(dst), { recursive: true });
+          cpSync(src2, dst, { recursive: true });
         }
       }
-      const writtenShell = await writeUploadedFileList(shellFiles, opts.ws.shellDir);
-      const writtenRoot = [];
-      for (const { name, file } of rootFiles) {
-        const target = join16(opts.ws.arcDir, name);
-        writeFileSync12(target, Buffer.from(await file.arrayBuffer()));
-        writtenRoot.push(name);
+      for (const name of ["styles.css", "theme.css"]) {
+        const src2 = join19(stagingRoot, name);
+        if (existsSync15(src2)) {
+          cpSync(src2, join19(opts.ws.arcDir, name));
+        }
+      }
+      writeFileSync15(join19(opts.ws.modulesDir, "manifest.json"), JSON.stringify(body, null, 2));
+      opts.setManifest(body);
+      rmSync4(stagingRoot, { recursive: true, force: true });
+      if (!serverSideChanged) {
+        opts.notifyReload(body);
       }
-      return Response.json({ ok: true, written: [...writtenShell, ...writtenRoot] }, { headers: ctx.corsHeaders });
+      return Response.json({
+        ok: true,
+        moduleCount: body.modules.length,
+        needsRestart: serverSideChanged
+      }, { headers: cors });
     }
-    return new Response("Not Found", {
-      status: 404,
-      headers: ctx.corsHeaders
-    });
+    return new Response("Not Found", { status: 404, headers: cors });
   };
 }
-async function writeUploadedFiles(form, targetDir) {
-  const files = [];
-  for (const [, value] of form.entries()) {
-    if (isFile(value))
-      files.push(value);
-  }
-  return writeUploadedFileList(files, targetDir);
+function badRequest(msg, cors) {
+  return Response.json({ error: msg }, { status: 400, headers: cors });
 }
 function isFile(v3) {
   return typeof v3 === "object" && v3 !== null && typeof v3.arrayBuffer === "function" && typeof v3.name === "string";
 }
-async function writeUploadedFileList(files, targetDir) {
-  const written = [];
+async function writeField(targetDir, name, file) {
+  const safe = normalize2(name);
   const safeRoot = resolve(targetDir);
-  mkdirSync11(safeRoot, { recursive: true });
-  for (const file of files) {
-    const rel = normalize2(file.name);
-    const full = resolve(safeRoot, rel);
-    if (!full.startsWith(safeRoot + "/") && full !== safeRoot) {
-      throw new Error(`Path traversal rejected: ${file.name}`);
-    }
-    mkdirSync11(dirname7(full), { recursive: true });
-    writeFileSync12(full, Buffer.from(await file.arrayBuffer()));
-    written.push(relative5(safeRoot, full) || rel);
+  const full = resolve(safeRoot, safe);
+  if (!full.startsWith(safeRoot + "/") && full !== safeRoot) {
+    throw new Error(`Path traversal rejected: ${name}`);
   }
-  return written;
+  mkdirSync14(dirname7(full), { recursive: true });
+  writeFileSync15(full, Buffer.from(await file.arrayBuffer()));
+}
+function sanitizeName2(name) {
+  if (!/^[a-zA-Z0-9_-]+$/.test(name))
+    return null;
+  return name;
+}
+function readDir(dir) {
+  if (!existsSync15(dir))
+    return [];
+  return __require("fs").readdirSync(dir);
+}
+async function runBun(args, cwd) {
+  const proc2 = spawn4({
+    cmd: ["bun", ...args],
+    cwd,
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  const exit = await proc2.exited;
+  return exit === 0;
 }
 function validateManifest(m4) {
   if (!m4 || typeof m4 !== "object")
@@ -30948,7 +31422,7 @@ function getMime(path4) {
   return MIME[ext2] ?? "application/octet-stream";
 }
 function serveFile(filePath, headers = {}) {
-  if (!existsSync14(filePath))
+  if (!existsSync16(filePath))
     return new Response("Not Found", { status: 404 });
   return new Response(Bun.file(filePath), {
     headers: { "Content-Type": getMime(filePath), ...headers }
@@ -31037,7 +31511,7 @@ function staticFilesHandler(ws, devMode, moduleAccessMap) {
   return (_req, url, ctx) => {
     const path4 = url.pathname;
     if (path4.startsWith("/shell/"))
-      return serveFile(join17(ws.shellDir, path4.slice(7)), ctx.corsHeaders);
+      return serveFile(join20(ws.shellDir, path4.slice(7)), ctx.corsHeaders);
     if (path4.startsWith("/modules/")) {
       const fileWithParams = path4.slice(9);
       const filename = fileWithParams.split("?")[0];
@@ -31049,25 +31523,25 @@ function staticFilesHandler(ws, devMode, moduleAccessMap) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join17(ws.modulesDir, filename), {
+      return serveFile(join20(ws.modulesDir, filename), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     }
     if (path4.startsWith("/locales/"))
-      return serveFile(join17(ws.arcDir, path4.slice(1)), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, path4.slice(1)), ctx.corsHeaders);
     if (path4.startsWith("/assets/"))
-      return serveFile(join17(ws.assetsDir, path4.slice(8)), ctx.corsHeaders);
+      return serveFile(join20(ws.assetsDir, path4.slice(8)), ctx.corsHeaders);
     if (path4 === "/styles.css")
-      return serveFile(join17(ws.arcDir, "styles.css"), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, "styles.css"), ctx.corsHeaders);
     if (path4 === "/theme.css")
-      return serveFile(join17(ws.arcDir, "theme.css"), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, "theme.css"), ctx.corsHeaders);
     if ((path4 === "/manifest.json" || path4 === "/manifest.webmanifest") && ws.manifest) {
       return serveFile(ws.manifest.path, ctx.corsHeaders);
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
-      const publicFile = join17(ws.publicDir, path4.slice(1));
-      if (existsSync14(publicFile))
+      const publicFile = join20(ws.publicDir, path4.slice(1));
+      if (existsSync16(publicFile))
         return serveFile(publicFile, ctx.corsHeaders);
     }
     return null;
@@ -31205,10 +31679,10 @@ async function startPlatformServer(opts) {
     };
   }
   const { createBunSQLiteAdapterFactory: createBunSQLiteAdapterFactory2 } = await Promise.resolve().then(() => (init_dist(), exports_dist2));
-  const dbPath = opts.dbPath || join17(ws.arcDir, "data", "arc.db");
+  const dbPath = opts.dbPath || join20(ws.arcDir, "data", "arc.db");
   const dbDir = dbPath.substring(0, dbPath.lastIndexOf("/"));
   if (dbDir)
-    mkdirSync12(dbDir, { recursive: true });
+    mkdirSync15(dbDir, { recursive: true });
   const arcServer = await createArcServer({
     context,
     dbAdapterFactory: createBunSQLiteAdapterFactory2(dbPath),
@@ -31251,7 +31725,7 @@ async function platformDev(opts = {}) {
     manifest,
     context,
     moduleAccess,
-    dbPath: join18(ws.rootDir, ".arc", "data", "dev.db"),
+    dbPath: join21(ws.rootDir, ".arc", "data", "dev.db"),
     devMode: true,
     arcEntries
   });
@@ -31282,8 +31756,8 @@ async function platformDev(opts = {}) {
     }, 300);
   };
   for (const pkg of ws.packages) {
-    const srcDir = join18(pkg.path, "src");
-    if (!existsSync15(srcDir))
+    const srcDir = join21(pkg.path, "src");
+    if (!existsSync17(srcDir))
       continue;
     watch(srcDir, { recursive: true }, (_event, filename) => {
       if (!filename || filename.includes(".arc") || filename.endsWith(".d.ts") || filename.includes("node_modules") || filename.includes("dist"))
@@ -31293,8 +31767,8 @@ async function platformDev(opts = {}) {
       triggerRebuild();
     });
   }
-  const localesDir = join18(ws.rootDir, "locales");
-  if (existsSync15(localesDir)) {
+  const localesDir = join21(ws.rootDir, "locales");
+  if (existsSync17(localesDir)) {
     watch(localesDir, { recursive: false }, (_event, filename) => {
       if (!filename?.endsWith(".po"))
         return;
@@ -31310,17 +31784,41 @@ async function platformDev(opts = {}) {
 }
 
 // src/commands/platform-start.ts
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join22 } from "path";
 async function platformStart() {
   const ws = resolveWorkspace();
   const port = parseInt(process.env.PORT || "5005", 10);
-  const manifestPath = join19(ws.modulesDir, "manifest.json");
-  if (!existsSync16(manifestPath)) {
-    err("No build found. Run `arc platform build` first.");
-    process.exit(1);
+  const deployApi = process.env.ARC_DEPLOY_API === "1";
+  const manifestPath = join22(ws.modulesDir, "manifest.json");
+  if (!existsSync18(manifestPath)) {
+    if (!deployApi) {
+      err("No build found. Run `arc platform build` first.");
+      process.exit(1);
+    }
+    log2("Pre-deploy mode \u2014 no manifest yet, awaiting first /api/deploy/*");
+    const emptyManifest = {
+      modules: [],
+      shellHash: "",
+      stylesHash: "",
+      buildTime: new Date().toISOString()
+    };
+    const platform4 = await startPlatformServer({
+      ws,
+      port,
+      manifest: emptyManifest,
+      context: null,
+      moduleAccess: new Map,
+      dbPath: join22(ws.rootDir, ".arc", "data", "prod.db"),
+      devMode: false,
+      deployApi: true,
+      arcEntries: []
+    });
+    ok(`Pre-deploy server on http://localhost:${port}`);
+    registerSignalCleanup(platform4);
+    return;
   }
-  const manifest = JSON.parse(readFileSync13(manifestPath, "utf-8"));
+  const manifest = JSON.parse(readFileSync16(manifestPath, "utf-8"));
   log2("Loading server context...");
   const { context, moduleAccess } = await loadServerContext(ws.packages);
   if (context) {
@@ -31329,7 +31827,6 @@ async function platformStart() {
     log2("No context \u2014 server endpoints skipped");
   }
   const arcEntries = collectArcPeerDeps(ws.packages);
-  const deployApi = process.env.ARC_DEPLOY_API === "1";
   if (deployApi)
     ok("Deploy API enabled (/api/deploy/*)");
   const platform3 = await startPlatformServer({
@@ -31338,7 +31835,7 @@ async function platformStart() {
     manifest,
     context,
     moduleAccess,
-    dbPath: join19(ws.rootDir, ".arc", "data", "prod.db"),
+    dbPath: join22(ws.rootDir, ".arc", "data", "prod.db"),
     devMode: false,
     deployApi,
     arcEntries
@@ -31346,6 +31843,9 @@ async function platformStart() {
   ok(`Server on http://localhost:${port}`);
   if (platform3.contextHandler)
     ok("Commands, queries, WebSocket \u2014 all on same port");
+  registerSignalCleanup(platform3);
+}
+function registerSignalCleanup(platform3) {
   const cleanup = () => {
     platform3.stop();
     process.exit(0);
@@ -31364,6 +31864,7 @@ platform3.command("dev").description("Start platform in dev mode (Bun server + V
 platform3.command("build").description("Build platform for production").option("--no-cache", "Force full rebuild").action((opts) => platformBuild({ noCache: opts.cache === false }));
 platform3.command("start").description("Start platform in production mode (requires prior build)").action(platformStart);
 platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").action((env2, opts) => platformDeploy(env2, opts));
+program2.command("_build-shell", { hidden: true }).description("Build framework shell bundles from a node_modules dir").requiredOption("--out <dir>", "Output directory for shell .js bundles").requiredOption("--from <dir>", "node_modules directory to discover packages in").action((opts) => buildShell(opts));
 program2.parse(process.argv);
 if (process.argv.length === 2) {
   program2.help();