@arcote.tech/arc-cli 0.6.1 → 0.7.0

package/src/platform/shared.ts

@@ -3,7 +3,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync,
 import { dirname, join } from "path";
 import {
   buildContextPackages,
-  buildModulesBundle,
+  buildModulesByChunks,
   buildStyles,
   buildTranslations,
   discoverPackages,
@@ -19,6 +19,9 @@ import {
   updateCache,
   type BuildCache,
 } from "../builder/build-cache";
+import { extractAccessMap } from "../builder/access-extractor";
+import { planChunks } from "../builder/chunk-planner";
+import { collectFrameworkDeps } from "../builder/dependency-collector";
 import {
   mtimeOf,
   readInstalledVersion,
@@ -28,14 +31,9 @@ import {
   sha256OfJson,
 } from "../builder/hash";
 import { pAll } from "../builder/parallel";
-import {
-  collectFrameworkDeps,
-  collectModuleDeps,
-} from "../builder/dependency-collector";
-import { extractAccessMap } from "../builder/access-extractor";
 
 // Re-export for convenience
-export { buildContextPackages, buildModulesBundle, buildStyles, isContextPackage };
+export { buildContextPackages, buildModulesByChunks, buildStyles, isContextPackage };
 export type { BuildManifest, ModuleDescriptor, WorkspacePackage };
 
 // ---------------------------------------------------------------------------
@@ -93,16 +91,15 @@ export function resolveWorkspace(): WorkspaceInfo {
 
   log("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
-  ok(
-    `Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`,
-  );
-
-  // Empty package list is allowed in pre-deploy runtime mode (container with
-  // freshly-mounted volume, no user code pushed yet). The CLI entry that
-  // forbids this (arc platform build/dev) checks explicitly.
-  if (packages.length === 0 && process.env.ARC_DEPLOY_API !== "1") {
-    err("No workspace packages found.");
-    process.exit(1);
+  if (packages.length > 0) {
+    ok(
+      `Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`,
+    );
+  } else {
+    // Zero packages is valid for `platform start` in image runtime mode —
+    // the workspace tree isn't shipped, only `.arc/platform/` is. Build
+    // commands enforce non-empty packages where they need them.
+    log("No workspace packages found — assuming image runtime mode.");
   }
 
   // Detect manifest.json or manifest.webmanifest in root dir
@@ -163,36 +160,55 @@ export async function buildAll(
 
   log(`Building (concurrency parallel${noCache ? ", no-cache" : ""})...`);
 
-  // Promise.all over independent units. buildModulesBundle is the only one
-  // that returns data we need (the manifest). The rest update the cache.
-  const [, modulesResult] = await Promise.all([
-    buildContextPackages(ws.rootDir, ws.packages, cache, noCache),
-    buildModulesBundle(ws.rootDir, ws.modulesDir, ws.packages, cache, noCache),
+  // Phase 1 — context packages must finish FIRST. The access-extractor
+  // subprocess imports workspace packages by name, which resolve through
+  // node_modules to packages' `main` field (typically `dist/server/main/`).
+  await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
+
+  // Phase 1b — relocate per-package server bundles into `.arc/platform/server/`
+  // so the deploy image can be self-contained (image COPY needs everything
+  // server-side under one root). loadServerContext reads from here in prod.
+  copyContextServerBundles(ws);
+
+  // Phase 2 — extract access metadata (token name + hasCheck per module) in
+  // an isolated subprocess. This MUST run before chunk planning so we know
+  // which token group each module belongs to.
+  const accessMap = await extractAccessMap(ws.rootDir, ws.packages);
+
+  // Persist access map for the runtime host (server.ts reads at startup to
+  // wire up moduleAccessMap for filterManifestForTokens / signed URLs).
+  mkdirSync(ws.arcDir, { recursive: true });
+  writeFileSync(
+    join(ws.arcDir, "access.json"),
+    JSON.stringify(accessMap, null, 2) + "\n",
+  );
+
+  // Phase 3 — group modules into chunks (one Bun.build per group).
+  const plan = planChunks(ws.packages, accessMap);
+  ok(
+    `Chunks: ${plan.chunks
+      .map((c) => `${c}(${plan.groups.get(c)?.length ?? 0})`)
+      .join(", ")}`,
+  );
+
+  // Phase 4 — independent parallel build units. Module chunks are the only
+  // unit whose output we need for the manifest; others update the cache.
+  const [modulesResult] = await Promise.all([
+    buildModulesByChunks(ws.rootDir, ws.modulesDir, plan, cache, noCache),
     buildShell(ws, cache, noCache),
     buildStyles(ws.rootDir, ws.arcDir, ws.packages, themePath, cache, noCache),
     copyBrowserAssets(ws, cache, noCache),
     buildTranslations(ws.rootDir, ws.arcDir, cache, noCache),
   ]);
 
-  saveBuildCache(ws.arcDir, cache);
-
-  // v0.6 deploy artifacts: framework + per-module dependency manifests + access
-  // map. Generated unconditionally — runtime container needs them to bun-install
-  // and to enforce protectBy rules. Order matters: deps before access (access
-  // extraction subprocess imports server bundles whose own deps may matter).
+  // Phase 5 — framework peer manifest at `<arcDir>/package.json`. Used by
+  // the deploy image build (single `bun install` for all peers, one copy
+  // shared across module bundles).
   collectFrameworkDeps(ws.arcDir, ws.rootDir, ws.packages);
-  for (const pkg of ws.packages) {
-    collectModuleDeps(ws.arcDir, pkg);
-  }
-  try {
-    await extractAccessMap(ws.arcDir, ws.packages);
-  } catch (e) {
-    err(`access-extractor failed: ${(e as Error).message}`);
-    // Don't fail the build — protection rules will be empty server-side but
-    // the rest of the deploy can still proceed.
-  }
 
-  const finalManifest = assembleManifest(ws, modulesResult.modules, cache);
+  saveBuildCache(ws.arcDir, cache);
+
+  const finalManifest = assembleManifest(ws, modulesResult.modules, plan.chunks, cache);
   writeFileSync(
     join(ws.modulesDir, "manifest.json"),
     JSON.stringify(finalManifest, null, 2),
@@ -206,6 +222,7 @@ export async function buildAll(
 function assembleManifest(
   ws: WorkspaceInfo,
   modules: ModuleDescriptor[],
+  chunks: readonly string[],
   cache: BuildCache,
 ): BuildManifest {
   // Aggregate shellHash from all shell:* unit output hashes.
@@ -220,12 +237,41 @@ function assembleManifest(
 
   return {
     modules,
+    chunks,
     shellHash,
     stylesHash,
     buildTime: new Date().toISOString(),
   };
 }
 
+// ---------------------------------------------------------------------------
+// Context server bundles — flatten to `<arcDir>/server/<safeName>.js`
+// ---------------------------------------------------------------------------
+
+/**
+ * Copy each context package's compiled server bundle from
+ * `packages/<pkg>/dist/server/main/index.js` to a flat location at
+ * `<arcDir>/server/<safeName>.js`. The flat layout makes the deploy image
+ * self-contained — `COPY .arc/platform/` pulls everything server-side, no
+ * need to drag the entire `packages/` tree into the image.
+ */
+function copyContextServerBundles(ws: WorkspaceInfo): void {
+  const outDir = join(ws.arcDir, "server");
+  mkdirSync(outDir, { recursive: true });
+
+  for (const pkg of ws.packages) {
+    if (!isContextPackage(pkg.packageJson)) continue;
+    const src = join(pkg.path, "dist", "server", "main", "index.js");
+    if (!existsSync(src)) {
+      err(`Server bundle missing for ${pkg.name}: ${src}`);
+      continue;
+    }
+    const safeName = pkg.path.split("/").pop()!;
+    const dst = join(outDir, `${safeName}.js`);
+    copyFileSync(src, dst);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Browser assets — @arcote.tech/* deps deklarują w `arc.browserAssets` jakie
 // pliki muszą być dostępne w przeglądarce (np. SQLite WASM worker + .wasm).
@@ -564,47 +610,60 @@ export async function buildShell(
 // ---------------------------------------------------------------------------
 
 export async function loadServerContext(
-  packages: WorkspacePackage[],
+  ws: WorkspaceInfo,
 ): Promise<{ context: any | null; moduleAccess: Map<string, any> }> {
-  const ctxPackages = packages.filter((p) => isContextPackage(p.packageJson));
-  if (ctxPackages.length === 0) return { context: null, moduleAccess: new Map() };
-
   // Set globals for server context — framework packages (arc-auth etc.)
   // use these at runtime to tree-shake browser/server code paths.
   (globalThis as any).ONLY_SERVER = true;
   (globalThis as any).ONLY_BROWSER = false;
   (globalThis as any).ONLY_CLIENT = false;
 
-  // Resolve platform from the project's node_modules using an absolute path
-  // (see comment in original implementation for why).
+  // Resolve platform from the project's node_modules. Bun picks the `bun`
+  // export condition from package.json, which points at `index.server.ts`
+  // (server-safe, no React/JSX at top level).
   const platformDir = join(process.cwd(), "node_modules", "@arcote.tech", "platform");
   const platformPkg = JSON.parse(readFileSync(join(platformDir, "package.json"), "utf-8"));
   const platformEntry = join(platformDir, platformPkg.main ?? "src/index.ts");
 
   await import(platformEntry);
 
-  for (const ctx of ctxPackages) {
-    const serverDist = join(ctx.path, "dist", "server", "main", "index.js");
-    if (!existsSync(serverDist)) {
-      err(`Context server dist not found: ${serverDist}`);
-      continue;
-    }
-
-    try {
-      await import(serverDist);
-    } catch (e) {
-      err(`Failed to load server context from ${ctx.name}: ${e}`);
+  // Primary source: flattened server bundles at `<arcDir>/server/<safeName>.js`.
+  // The deploy image only has this directory — there's no workspace `packages/`
+  // tree. In dev, `copyContextServerBundles` populates this same location, so
+  // both modes go through the same code path.
+  const serverDir = join(ws.arcDir, "server");
+  const bundles = existsSync(serverDir)
+    ? readdirSync(serverDir).filter((f) => f.endsWith(".js"))
+    : [];
+
+  if (bundles.length > 0) {
+    for (const file of bundles) {
+      const bundlePath = join(serverDir, file);
+      try {
+        await import(bundlePath);
+      } catch (e) {
+        err(`Failed to load server bundle ${file}: ${e}`);
+      }
     }
-  }
-
-  const nonCtxPackages = packages.filter((p) => !isContextPackage(p.packageJson));
-  for (const pkg of nonCtxPackages) {
-    try {
-      await import(pkg.entrypoint);
-    } catch {
-      // Non-context packages may fail on server (React components etc.) — that's OK,
-      // module().protectedBy().build() runs synchronously before any rendering
+  } else if (ws.packages.length > 0) {
+    // Fallback for the "no .arc/platform/server/ yet" case (e.g. somebody
+    // wired up loadServerContext before running the build). This path goes
+    // through workspace packages directly — only meaningful in dev.
+    const ctxPackages = ws.packages.filter((p) => isContextPackage(p.packageJson));
+    for (const ctx of ctxPackages) {
+      const serverDist = join(ctx.path, "dist", "server", "main", "index.js");
+      if (!existsSync(serverDist)) {
+        err(`Context server dist not found: ${serverDist}`);
+        continue;
+      }
+      try {
+        await import(serverDist);
+      } catch (e) {
+        err(`Failed to load server context from ${ctx.name}: ${e}`);
+      }
     }
+  } else {
+    return { context: null, moduleAccess: new Map() };
   }
 
   const { getContext, getAllModuleAccess } = await import(platformEntry);

package/src/platform/startup.ts

@@ -0,0 +1,160 @@
+import { existsSync, readFileSync, watch } from "fs";
+import { join } from "path";
+import { startPlatformServer, type PlatformServer } from "./server";
+import type { BuildManifest } from "./shared";
+import {
+  buildAll,
+  collectArcPeerDeps,
+  err,
+  loadServerContext,
+  log,
+  ok,
+  type WorkspaceInfo,
+} from "./shared";
+
+// ---------------------------------------------------------------------------
+// startup — single entry point for `arc platform start` and `arc platform dev`.
+//
+// The runtime host code path is IDENTICAL in both modes. Only two things
+// differ:
+//   - dev mode runs `buildAll` on startup (and rebuilds on file changes)
+//   - dev mode wires up the file watcher + SSE notify on rebuild
+//
+// Production mode reads a pre-built manifest from disk (in the deploy image,
+// that manifest was baked in at image build time) and never rebuilds.
+//
+// Module access map and signed URL semantics, chunk-aware static serving,
+// /api/modules filtering — all identical. This is the "dev↔prod parity"
+// promise that the v0.7 refactor was built around.
+// ---------------------------------------------------------------------------
+
+export interface StartPlatformOptions {
+  ws: WorkspaceInfo;
+  /** Listening port. Defaults to PORT env var or 5005. */
+  port?: number;
+  /** SQLite database path. Defaults to `<ws.rootDir>/.arc/data/<mode>.db`. */
+  dbPath?: string;
+  /** Dev mode: rebuild on startup, watch for changes, SSE-notify clients on rebuild. */
+  devMode: boolean;
+}
+
+export async function startPlatform(
+  opts: StartPlatformOptions,
+): Promise<void> {
+  const { ws, devMode } = opts;
+  const port = opts.port ?? parseInt(process.env.PORT || "5005", 10);
+  const dbPath =
+    opts.dbPath ??
+    join(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
+
+  // 1. Acquire the manifest. In dev we always rebuild (fast — cache makes
+  // subsequent passes incremental). In prod we read the pre-built one;
+  // missing manifest is a hard error.
+  let manifest: BuildManifest;
+  if (devMode) {
+    manifest = await buildAll(ws);
+  } else {
+    const manifestPath = join(ws.modulesDir, "manifest.json");
+    if (!existsSync(manifestPath)) {
+      err("No build found. Run `arc platform build` first.");
+      process.exit(1);
+    }
+    manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+  }
+
+  // 2. Server context — same code path in both modes; loadServerContext
+  // prefers .arc/platform/server/*.js (the canonical location after the
+  // copyContextServerBundles step in buildAll).
+  log("Loading server context...");
+  const { context, moduleAccess } = await loadServerContext(ws);
+  if (context) {
+    ok("Context loaded");
+  } else {
+    log("No context — server endpoints skipped");
+  }
+
+  // 3. Start the platform server. Cache headers + SSE behaviour are
+  // controlled inside the server by `devMode`; we just pass the flag.
+  const arcEntries = collectArcPeerDeps(ws.packages);
+  const platform = await startPlatformServer({
+    ws,
+    port,
+    manifest,
+    context,
+    moduleAccess,
+    dbPath,
+    devMode,
+    arcEntries,
+  });
+
+  ok(`Server on http://localhost:${port}`);
+  if (platform.contextHandler) {
+    ok("Commands, queries, WebSocket — all on same port");
+  }
+
+  // 4. Dev-only: file watcher + debounced rebuild + SSE notify.
+  if (devMode) {
+    attachDevWatcher(ws, platform);
+  }
+
+  // 5. Graceful shutdown for both modes.
+  const cleanup = () => {
+    platform.stop();
+    process.exit(0);
+  };
+  process.on("SIGTERM", cleanup);
+  process.on("SIGINT", cleanup);
+}
+
+function attachDevWatcher(ws: WorkspaceInfo, platform: PlatformServer): void {
+  log("Watching for changes...");
+  let rebuildTimer: ReturnType<typeof setTimeout> | null = null;
+  let isRebuilding = false;
+
+  const triggerRebuild = () => {
+    if (rebuildTimer) clearTimeout(rebuildTimer);
+    rebuildTimer = setTimeout(async () => {
+      if (isRebuilding) return;
+      isRebuilding = true;
+      log("Rebuilding...");
+      try {
+        const next = await buildAll(ws);
+        platform.setManifest(next);
+        platform.notifyReload(next);
+        ok(`Rebuilt — ${next.modules.length} module(s)`);
+      } catch (e) {
+        console.error(`Rebuild failed: ${e}`);
+      } finally {
+        isRebuilding = false;
+      }
+    }, 300);
+  };
+
+  for (const pkg of ws.packages) {
+    const srcDir = join(pkg.path, "src");
+    if (!existsSync(srcDir)) continue;
+
+    watch(srcDir, { recursive: true }, (_event, filename) => {
+      if (
+        !filename ||
+        filename.includes(".arc") ||
+        filename.endsWith(".d.ts") ||
+        filename.includes("node_modules") ||
+        filename.includes("dist")
+      )
+        return;
+      if (!filename.endsWith(".ts") && !filename.endsWith(".tsx")) return;
+      triggerRebuild();
+    });
+  }
+
+  // .po files — translations are a separate cache unit, but buildAll picks
+  // them up via finalizeTranslations after extraction. Treat the same as src.
+  const localesDir = join(ws.rootDir, "locales");
+  if (existsSync(localesDir)) {
+    watch(localesDir, { recursive: false }, (_event, filename) => {
+      if (!filename?.endsWith(".po")) return;
+      triggerRebuild();
+    });
+  }
+}

package/runtime/Dockerfile

@@ -1,29 +0,0 @@
-# arcote/runtime — generic Arc platform runtime container.
-#
-# Image is intentionally version-agnostic. CLI version comes from the
-# ARC_CLI_VERSION env var set by docker-compose (generated per-deploy by
-# `arc platform deploy`), so a single `arcote/runtime:1` tag serves every
-# CLI release. Bumping CLI only requires `bun publish` — no image rebuild.
-#
-# Layout in container:
-#   /app/.arc/cli/<ARC_CLI_VERSION>/   ← arc-cli + direct deps (installed by entrypoint, cached)
-#   /app/.arc/platform/                ← user volume: code, framework + per-module deps
-#   /app/.arc/data/                    ← user volume: sqlite
-#   /root/.bun/install/cache/          ← shared bun store (volume)
-
-FROM oven/bun:1-alpine
-
-# tini for proper signal handling. build-base/python3/git in case any user dep
-# has a native postinstall step (e.g. better-sqlite3). curl for healthchecks.
-RUN apk add --no-cache tini ca-certificates build-base python3 git curl
-
-WORKDIR /app
-
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-EXPOSE 5005
-ENV PORT=5005 \
-    ARC_DEPLOY_API=1
-
-ENTRYPOINT ["tini", "--", "/entrypoint.sh"]

package/runtime/build-and-push.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# build-and-push.sh — manual multi-arch publish of pkrasinski/arc-runtime to Docker Hub.
-#
-# Image is generic (no CLI version baked in) — one tag covers every CLI release.
-# Re-run only when the entrypoint script or base image needs to change.
-#
-# Prereqs: docker buildx + multi-arch builder configured, `docker login` done.
-#
-# Usage: bash build-and-push.sh [tag=1]
-
-set -euo pipefail
-
-TAG="${1:-1}"
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-docker buildx build \
-  --platform linux/amd64,linux/arm64 \
-  --tag "pkrasinski/arc-runtime:${TAG}" \
-  --tag "pkrasinski/arc-runtime:latest" \
-  --push \
-  "${SCRIPT_DIR}"
-
-echo "✓ Published pkrasinski/arc-runtime:${TAG} (multi-arch)"

package/runtime/entrypoint.sh

@@ -1,58 +0,0 @@
-#!/bin/sh
-# entrypoint.sh — installs arc-cli at ARC_CLI_VERSION (cached per version),
-# then hands off to `arc platform start`. The CLI itself decides between
-# pre-deploy mode (no manifest yet) and full mode based on volume state —
-# no logic for that lives here.
-#
-# bun install of framework peers and per-module deps is done by the CLI in
-# response to /api/deploy/framework and /api/deploy/modules/:name — this
-# script only ensures the CLI binary itself is present.
-
-set -e
-
-: "${ARC_CLI_VERSION:?ARC_CLI_VERSION env var required (set by docker-compose)}"
-
-CLI_DIR="/app/.arc/cli/${ARC_CLI_VERSION}"
-CLI_BIN="${CLI_DIR}/node_modules/@arcote.tech/arc-cli/dist/index.js"
-
-if [ ! -f "$CLI_BIN" ]; then
-  echo "[entrypoint] installing @arcote.tech/arc-cli@${ARC_CLI_VERSION}..."
-  mkdir -p "$CLI_DIR"
-  cd "$CLI_DIR"
-  echo '{"name":"arc-runtime-cli","private":true,"type":"module"}' > package.json
-  bun add "@arcote.tech/arc-cli@${ARC_CLI_VERSION}"
-fi
-
-# resolveWorkspace() in arc platform start exits hard if /app has no
-# package.json. In runtime mode the workspace lives in /app/.arc/platform/
-# but the CLI still walks up from cwd. Drop a stub manifest here so the
-# walk-up resolves to /app/.arc/platform (or to a stable "no workspace"
-# state in pre-deploy).
-if [ ! -f /app/package.json ]; then
-  cat > /app/package.json <<'EOF'
-{
-  "name": "arc-runtime",
-  "private": true,
-  "type": "module",
-  "workspaces": []
-}
-EOF
-fi
-
-# Make /app/.arc/platform the working directory — that's where deployed user
-# code, deps and node_modules live (volume mount).
-mkdir -p /app/.arc/platform
-cd /app/.arc/platform
-if [ ! -f package.json ]; then
-  cat > package.json <<'EOF'
-{
-  "name": "arc-platform-runtime",
-  "private": true,
-  "type": "module",
-  "workspaces": []
-}
-EOF
-fi
-
-echo "[entrypoint] starting arc platform (cli=${ARC_CLI_VERSION})"
-exec bun run "$CLI_BIN" platform start