@arcote.tech/arc-cli 0.6.1 → 0.7.0

package/src/builder/module-builder.ts

@@ -17,6 +17,8 @@ import {
   updateCache,
   type BuildCache,
 } from "./build-cache";
+import type { ChunkPlan, PackageChunk } from "./chunk-planner";
+import { SHELL_EXTERNALS } from "./framework-peers";
 import {
   readInstalledVersion,
   sha256Hex,
@@ -28,8 +30,42 @@ import { pAll } from "./parallel";
 
 /** Re-export for internal CLI consumers (avoid direct platform dependency in consumers). */
 export type { BuildManifest, ModuleDescriptor };
-/** Re-export hash helpers for backward compatibility (deploy/remote-sync uses sha256OfFiles). */
+/** Re-export hash helpers for backward compatibility (deploy code uses sha256OfFiles). */
 export { sha256Hex, sha256OfFiles };
+/** Re-export externals so callers (shell builder) stay decoupled from framework-peers. */
+export { SHELL_EXTERNALS };
+
+/**
+ * Bun's automatic JSX transform emits `import { jsxDEV } from "react/jsx-dev-runtime"`
+ * regardless of NODE_ENV. React's production module exports `jsxDEV` as undefined
+ * (it's a debug-only symbol). At runtime in a production container this crashes
+ * the moment a JSX call is reached. The plugin redirects `react/jsx-dev-runtime`
+ * imports to a synthetic module that re-exports `jsx` as `jsxDEV` from the
+ * production jsx-runtime — semantically equivalent at runtime, no debug data.
+ *
+ * Applied to BOTH browser and server bundles. Server bundles may import
+ * JSX-typed Trans/translation components from workspace deps; without the
+ * shim, loadServerContext fails on any server bundle that touches them.
+ */
+function jsxDevShimPlugin(): import("bun").BunPlugin {
+  return {
+    name: "jsx-dev-runtime-shim",
+    setup(build) {
+      build.onResolve({ filter: /^react\/jsx-dev-runtime$/ }, () => ({
+        path: "react-jsx-dev-runtime-shim",
+        namespace: "jsx-dev-shim",
+      }));
+      build.onLoad({ filter: /.*/, namespace: "jsx-dev-shim" }, () => ({
+        contents: `import { jsx, jsxs, Fragment } from "react/jsx-runtime";
+export const jsxDEV = jsx;
+export const jsxsDEV = jsxs;
+export { Fragment };
+`,
+        loader: "ts",
+      }));
+    },
+  };
+}
 
 /** Clients that a context package is built for. */
 const CONTEXT_CLIENTS = [
@@ -37,21 +73,6 @@ const CONTEXT_CLIENTS = [
   { name: "browser", target: "browser" as const, defines: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" } },
 ];
 
-/** Packages that shell provides — modules import them but don't bundle them. */
-export const SHELL_EXTERNALS = [
-  "react",
-  "react-dom",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "@arcote.tech/arc",
-  "@arcote.tech/arc-ds",
-  "@arcote.tech/arc-react",
-  "@arcote.tech/arc-auth",
-  "@arcote.tech/arc-utils",
-  "@arcote.tech/arc-workspace",
-  "@arcote.tech/platform",
-];
-
 export interface WorkspacePackage {
   name: string;
   path: string;
@@ -206,9 +227,16 @@ async function buildContextClient(
 
   console.log(`  building: ${pkg.name} (${client.name})`);
 
+  // Externals: framework peers + npm dependencies. Workspace deps (value
+  // starts with `workspace:`) are bundled inline — the deploy image has no
+  // workspace symlinks, so any cross-package import not bundled here would
+  // fail to resolve at runtime in the container.
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
-  const deps = Object.keys(pkg.packageJson.dependencies ?? {});
-  const externals = [...peerDeps, ...deps];
+  const allDeps = (pkg.packageJson.dependencies ?? {}) as Record<string, string>;
+  const npmDeps = Object.entries(allDeps)
+    .filter(([, spec]) => !spec.startsWith("workspace:"))
+    .map(([name]) => name);
+  const externals = [...peerDeps, ...npmDeps];
 
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
@@ -217,6 +245,7 @@ async function buildContextClient(
     format: "esm",
     naming: "index.[ext]",
     external: externals,
+    plugins: [jsxDevShimPlugin()],
     define: client.defines,
   });
 
@@ -279,7 +308,7 @@ export async function buildContextPackages(
 }
 
 // ---------------------------------------------------------------------------
-// Modules bundle — single Bun.build of all wrapper re-exports
+// Modules bundles — one Bun.build per chunk group (public + per-token-name)
 // ---------------------------------------------------------------------------
 
 interface ModulesBundleResult {
@@ -288,130 +317,177 @@ interface ModulesBundleResult {
 }
 
 /**
- * Bundle all workspace packages into ESM chunks for the platform shell.
- * Cached as a single unit — any source change in any package invalidates.
+ * Build each chunk group as an independent Bun.build. Chunks NEVER share
+ * code across groups — a public chunk file can be served unauthenticated;
+ * per-token chunk files are signed and require the matching token to fetch.
+ *
+ * Layout: `<outDir>/<chunk>/<safeName>.js` (+ Bun's shared chunk files
+ * `chunk-<hash>.js` inside the same chunk dir).
+ *
+ * i18n strings extracted from all groups are merged into a single workspace
+ * translation catalog (extraction is build-input metadata, not bundle output).
  */
-export async function buildModulesBundle(
+export async function buildModulesByChunks(
   rootDir: string,
   outDir: string,
-  packages: WorkspacePackage[],
+  plan: ChunkPlan,
   cache: BuildCache,
   noCache: boolean,
 ): Promise<ModulesBundleResult> {
   mkdirSync(outDir, { recursive: true });
 
-  const unitId = "modules-bundle";
+  const i18nCollector = new Map<string, Set<string>>();
+  const aggregateModules: ModuleDescriptor[] = [];
+  let allCached = true;
+
+  for (const chunk of plan.chunks) {
+    const members = plan.groups.get(chunk) ?? [];
+    if (members.length === 0) continue;
+
+    const chunkOutDir = join(outDir, chunk);
+    mkdirSync(chunkOutDir, { recursive: true });
+
+    const result = await buildChunkGroup(
+      rootDir,
+      chunkOutDir,
+      chunk,
+      members,
+      cache,
+      noCache,
+      i18nCollector,
+    );
+
+    aggregateModules.push(...result.modules);
+    if (!result.cached) allCached = false;
+  }
+
+  // Single workspace-wide i18n write — keeps msgid bookkeeping atomic.
+  await finalizeTranslations(rootDir, join(outDir, ".."), i18nCollector);
+
+  return { modules: aggregateModules, cached: allCached };
+}
+
+async function buildChunkGroup(
+  rootDir: string,
+  chunkOutDir: string,
+  chunk: string,
+  members: readonly PackageChunk[],
+  cache: BuildCache,
+  noCache: boolean,
+  i18nCollector: Map<string, Set<string>>,
+): Promise<ModulesBundleResult> {
+  const unitId = `modules-chunk:${chunk}`;
 
-  // Per-package source hash — gives us deterministic input identity even though
-  // we run a single Bun.build for the whole bundle (chunk sharing wins).
-  const pkgHashes = packages.map((p) => ({
-    name: p.name,
-    safeName: basename(p.path),
-    srcHash: pkgSourceHash(p),
+  const pkgHashes = members.map((m) => ({
+    name: m.pkg.name,
+    safeName: m.safeName,
+    moduleName: m.moduleName,
+    srcHash: pkgSourceHash(m.pkg),
   }));
 
   const inputHash = sha256OfJson({
+    chunk,
     pkgHashes,
     externals: SHELL_EXTERNALS,
     define: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" },
   });
 
-  // Cache hit → reconstruct module descriptors from existing files in outDir.
   if (!noCache && isCacheHit(cache, unitId, inputHash)) {
     const existing = cache.units[unitId]?.outputHashes ?? {};
     const modules: ModuleDescriptor[] = [];
-    for (const { safeName, name } of pkgHashes) {
-      const file = `${safeName}.js`;
-      const filePath = join(outDir, file);
+    let missing = false;
+    for (const h of pkgHashes) {
+      const file = `${h.safeName}.js`;
+      const filePath = join(chunkOutDir, file);
       if (!existsSync(filePath)) {
-        // Output missing despite hash match — fall through to rebuild.
-        console.log(`  rebuilding modules-bundle: output ${file} missing`);
-        return await actuallyBuild();
+        missing = true;
+        break;
       }
-      modules.push({ file, name, hash: existing[safeName] ?? sha256Hex(readFileSync(filePath)) });
+      modules.push({
+        file,
+        name: h.moduleName,
+        chunk,
+        hash: existing[h.safeName] ?? sha256Hex(readFileSync(filePath)),
+      });
+    }
+    if (!missing) {
+      console.log(`  ✓ cached: ${unitId} (${modules.length} module(s))`);
+      return { modules, cached: true };
     }
-    console.log(`  ✓ cached: modules-bundle (${modules.length} module(s))`);
-    return { modules, cached: true };
+    console.log(`  rebuilding ${unitId}: output file missing`);
   }
 
-  return await actuallyBuild();
-
-  async function actuallyBuild(): Promise<ModulesBundleResult> {
-    console.log(`  building: modules-bundle (${packages.length} package(s))`);
+  console.log(`  building: ${unitId} (${members.length} module(s))`);
 
-    const tmpDir = join(outDir, "_entries");
-    mkdirSync(tmpDir, { recursive: true });
+  const tmpDir = join(chunkOutDir, "_entries");
+  mkdirSync(tmpDir, { recursive: true });
 
-    const entrypoints: string[] = [];
-    const fileToName = new Map<string, string>();
+  const entrypoints: string[] = [];
+  const fileToModuleName = new Map<string, string>();
 
-    for (const pkg of packages) {
-      const safeName = basename(pkg.path);
-      const moduleName = pkg.name.includes("/") ? pkg.name.split("/").pop()! : pkg.name;
-      fileToName.set(safeName, moduleName);
+  for (const m of members) {
+    fileToModuleName.set(m.safeName, m.moduleName);
+    const wrapperFile = join(tmpDir, `${m.safeName}.ts`);
+    writeFileSync(wrapperFile, `export * from "${m.pkg.name}";\n`);
+    entrypoints.push(wrapperFile);
+  }
 
-      const wrapperFile = join(tmpDir, `${safeName}.ts`);
-      writeFileSync(wrapperFile, `export * from "${pkg.name}";\n`);
-      entrypoints.push(wrapperFile);
-    }
+  const arcExternalPlugin: import("bun").BunPlugin = {
+    name: "arc-external",
+    setup(build) {
+      build.onResolve({ filter: /^@arcote\.tech\// }, (args) => {
+        return { path: args.path, external: true };
+      });
+    },
+  };
 
-    const i18nCollector = new Map<string, Set<string>>();
-
-    const arcExternalPlugin: import("bun").BunPlugin = {
-      name: "arc-external",
-      setup(build) {
-        build.onResolve({ filter: /^@arcote\.tech\// }, (args) => {
-          return { path: args.path, external: true };
-        });
-      },
-    };
-
-    const result = await Bun.build({
-      entrypoints,
-      outdir: outDir,
-      splitting: true,
-      format: "esm",
-      target: "browser",
-      external: SHELL_EXTERNALS,
-      plugins: [arcExternalPlugin, i18nExtractPlugin(i18nCollector, rootDir)],
-      naming: "[name].[ext]",
-      define: {
-        ONLY_SERVER: "false",
-        ONLY_BROWSER: "true",
-        ONLY_CLIENT: "true",
-      },
-    });
+  const result = await Bun.build({
+    entrypoints,
+    outdir: chunkOutDir,
+    splitting: true,
+    format: "esm",
+    target: "browser",
+    external: [...SHELL_EXTERNALS],
+    plugins: [
+      arcExternalPlugin,
+      jsxDevShimPlugin(),
+      i18nExtractPlugin(i18nCollector, rootDir),
+    ],
+    naming: "[name].[ext]",
+    define: {
+      ONLY_SERVER: "false",
+      ONLY_BROWSER: "true",
+      ONLY_CLIENT: "true",
+    },
+  });
 
-    if (!result.success) {
-      console.error("Modules bundle build failed:");
-      for (const log of result.logs) console.error(log);
-      throw new Error("Module build failed");
-    }
+  if (!result.success) {
+    console.error(`Chunk "${chunk}" build failed:`);
+    for (const log of result.logs) console.error(log);
+    throw new Error(`Module chunk build failed: ${chunk}`);
+  }
 
-    // i18n extraction → write/update .po files (compileAllCatalogs handles .json).
-    await finalizeTranslations(rootDir, join(outDir, ".."), i18nCollector);
-
-    rmSync(tmpDir, { recursive: true, force: true });
-
-    const outputHashes: Record<string, string> = {};
-    const modules: ModuleDescriptor[] = result.outputs
-      .filter((o) => o.kind === "entry-point")
-      .map((o) => {
-        const file = basename(o.path);
-        const safeName = file.replace(/\.js$/, "");
-        const bytes = readFileSync(o.path);
-        const hash = sha256Hex(bytes);
-        outputHashes[safeName] = hash;
-        return {
-          file,
-          name: fileToName.get(safeName) ?? safeName,
-          hash,
-        };
-      });
+  rmSync(tmpDir, { recursive: true, force: true });
+
+  const outputHashes: Record<string, string> = {};
+  const modules: ModuleDescriptor[] = result.outputs
+    .filter((o) => o.kind === "entry-point")
+    .map((o) => {
+      const file = basename(o.path);
+      const safeName = file.replace(/\.js$/, "");
+      const bytes = readFileSync(o.path);
+      const hash = sha256Hex(bytes);
+      outputHashes[safeName] = hash;
+      return {
+        file,
+        name: fileToModuleName.get(safeName) ?? safeName,
+        chunk,
+        hash,
+      };
+    });
 
-    updateCache(cache, unitId, inputHash, { outputHashes });
-    return { modules, cached: false };
-  }
+  updateCache(cache, unitId, inputHash, { outputHashes });
+  return { modules, cached: false };
 }
 
 // ---------------------------------------------------------------------------

package/src/commands/platform-deploy.ts

@@ -1,13 +1,16 @@
 import { existsSync, readFileSync } from "fs";
 import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 import { bootstrap } from "../deploy/bootstrap";
 import {
   deployConfigExists,
   loadDeployConfig,
   saveDeployConfig,
 } from "../deploy/config";
+import { updateEnvDeployment } from "../deploy/deploy-env";
+import { buildImage, sanitizeImageName } from "../deploy/image";
 import { detectRemoteState } from "../deploy/remote-state";
-import { syncEnv } from "../deploy/remote-sync";
+import { dockerLogin, dockerPush } from "../deploy/registry";
 import { runSurvey } from "../deploy/survey";
 import {
   buildAll,
@@ -15,6 +18,7 @@ import {
   log,
   ok,
   resolveWorkspace,
+  type WorkspaceInfo,
 } from "../platform/shared";
 
 interface PlatformDeployOptions {
@@ -24,17 +28,27 @@ interface PlatformDeployOptions {
   skipBuild?: boolean;
   /** Force rebuild before deploy. */
   rebuild?: boolean;
+  /** Build the Docker image locally, then exit. Does NOT touch the remote. */
+  buildOnly?: boolean;
+  /**
+   * Rollback / pin to a specific image tag. Skips build + push, only updates
+   * /opt/arc/.env on the host and triggers `docker compose pull/up`.
+   * Format: bare content hash (e.g. `abc123def456`) or full ref.
+   */
+  imageTag?: string;
 }
 
 // ---------------------------------------------------------------------------
-// Entry point for `arc platform deploy [env] [--skip-build] [--rebuild]`.
+// Entry point for `arc platform deploy [env]`.
 //
-// High-level flow:
+// Flow:
 //   1. resolveWorkspace
-//   2. load or survey deploy.arc.json
-//   3. ensure local build (buildAll unless --skip-build)
-//   4. detectRemoteState → bootstrap if needed
-//   5. for each env (or the one passed as arg): syncEnv
+//   2. Load or survey deploy.arc.json
+//   3. Ensure local build (buildAll unless --skip-build)
+//   4. Build Docker image (or accept --image-tag for rollback)
+//   5. dockerLogin + dockerPush
+//   6. Detect remote state → bootstrap if needed
+//   7. For each env: updateEnvDeployment (atomic .env line + pull + up + health)
 // ---------------------------------------------------------------------------
 
 export async function platformDeploy(
@@ -63,24 +77,63 @@ export async function platformDeploy(
         })()
     : Object.keys(cfg.envs);
 
-  // 2. Ensure local build
+  // 2. Ensure local build (unless --image-tag rollback skips build+push entirely)
   const manifestPath = join(ws.modulesDir, "manifest.json");
-  const needBuild = options.rebuild || !existsSync(manifestPath);
-  if (needBuild && !options.skipBuild) {
-    log("Building platform...");
-    await buildAll(ws, { noCache: options.rebuild });
-    ok("Build complete");
-  } else if (!existsSync(manifestPath)) {
-    err("No build found and --skip-build was set.");
-    process.exit(1);
+  if (!options.imageTag) {
+    const needBuild = options.rebuild || !existsSync(manifestPath);
+    if (needBuild && !options.skipBuild) {
+      log("Building platform...");
+      await buildAll(ws, { noCache: options.rebuild });
+      ok("Build complete");
+    } else if (!existsSync(manifestPath)) {
+      err("No build found and --skip-build was set.");
+      process.exit(1);
+    }
   }
 
-  // 3. Detect remote state
+  // 3. Resolve the full image ref. Two paths:
+  //    a) --image-tag <hash> — rollback / pin. No build, no push.
+  //    b) Default — buildImage locally, push to private registry.
+  const imageName = sanitizeImageName(ws.rootPkg.name ?? ws.appName);
+  let fullRef: string;
+  let contentHash: string;
+
+  if (options.imageTag) {
+    contentHash = options.imageTag.includes(":")
+      ? options.imageTag.split(":").pop()!
+      : options.imageTag;
+    fullRef = `${cfg.registry.domain}/${imageName}:${contentHash}`;
+    log(`Pinning to existing image ${fullRef} (skipping build + push)`);
+  } else {
+    log(`Building Docker image ${imageName}...`);
+    const result = await buildImage(ws, {
+      imageName,
+      registryDomain: cfg.registry.domain,
+    });
+    fullRef = result.fullRef;
+    contentHash = result.contentHash;
+    ok(`Image built: ${fullRef}`);
+
+    // 3b. --build-only: produce image, log, exit before push/deploy.
+    if (options.buildOnly) {
+      log(`contentHash: ${contentHash}`);
+      return;
+    }
+
+    // 4. Push to the private registry. dockerLogin reads password from the
+    // env var named in cfg.registry.passwordEnv.
+    log(`Logging in to ${cfg.registry.domain}...`);
+    await dockerLogin(cfg.registry);
+    log(`Pushing ${fullRef}...`);
+    await dockerPush(fullRef);
+    ok("Image pushed");
+  }
+
+  // 5. Detect remote state, bootstrap if needed
   log("Inspecting remote server...");
   const state = await detectRemoteState(cfg);
   log(`Remote state: ${state.kind}`);
 
-  // 4. Bootstrap if needed
   const cliVersion = readCliVersion();
   const configHash = await hashDeployConfig(ws.rootDir);
   if (state.kind !== "ready") {
@@ -93,29 +146,21 @@ export async function platformDeploy(
     });
   }
 
-  // 5. Sync each env
+  // 6. Update each env — atomic /opt/arc/.env line + pull + up + health
   for (const env of targetEnvs) {
-    log(`Syncing env "${env}"...`);
-    const outcome = await syncEnv({
+    log(`Updating env "${env}"...`);
+    const outcome = await updateEnvDeployment({
+      target: cfg.target,
       cfg,
       env,
-      ws,
-      projectDir: ws.rootDir,
+      fullRef,
     });
-    if (
-      outcome.changedModules.length === 0 &&
-      !outcome.shellChanged &&
-      !outcome.stylesChanged
-    ) {
-      ok(`${env}: already up to date`);
+    if (outcome.redeployed) {
+      ok(`${env}: live at ${fullRef}`);
     } else {
-      const parts: string[] = [];
-      if (outcome.changedModules.length > 0) {
-        parts.push(`${outcome.changedModules.length} module(s): ${outcome.changedModules.join(", ")}`);
-      }
-      if (outcome.shellChanged) parts.push("shell");
-      if (outcome.stylesChanged) parts.push("styles");
-      ok(`${env}: updated ${parts.join(", ")}`);
+      err(
+        `${env}: deployed but health check did not pass within retries — check \`docker logs arc-${env}\``,
+      );
     }
   }
 }
@@ -124,30 +169,33 @@ export async function platformDeploy(
 // Helpers
 // ---------------------------------------------------------------------------
 
+/**
+ * Read the arc-cli package version by walking up from this file until we
+ * find a package.json with `name: "@arcote.tech/arc-cli"`. Source and
+ * bundled layouts have different depths (source: src/commands/, bundle:
+ * dist/), so a fixed `..` count doesn't work — walk until we hit the
+ * canonical manifest.
+ */
 function readCliVersion(): string {
-  // import.meta.dir gets mangled by `bun build` — derive from process.argv[1]
-  // (the bundled dist/index.js path) which is stable across run modes.
-  const candidates: string[] = [];
-  const entry = process.argv[1];
-  if (entry) {
-    candidates.push(join(dirname(entry), "..", "package.json"));
-  }
   try {
-    candidates.push(join(import.meta.dir, "..", "..", "package.json"));
-  } catch {
-    // import.meta.dir unavailable
-  }
-  for (const path of candidates) {
-    try {
-      const pkg = JSON.parse(readFileSync(path, "utf-8"));
-      if (pkg.name === "@arcote.tech/arc-cli" && pkg.version) {
-        return pkg.version as string;
+    let cur = dirname(fileURLToPath(import.meta.url));
+    const root = dirname(cur).startsWith("/") ? "/" : ".";
+    while (cur !== root && cur !== "") {
+      const candidate = join(cur, "package.json");
+      if (existsSync(candidate)) {
+        const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
+        if (pkg.name === "@arcote.tech/arc-cli") {
+          return pkg.version ?? "unknown";
+        }
       }
-    } catch {
-      // Try next
+      const parent = dirname(cur);
+      if (parent === cur) break;
+      cur = parent;
     }
+    return "unknown";
+  } catch {
+    return "unknown";
   }
-  return "unknown";
 }
 
 async function hashDeployConfig(rootDir: string): Promise<string> {