@arcote.tech/arc-cli 0.6.2 → 0.7.0

package/dist/index.js

@@ -9744,9 +9744,9 @@ var require_verify_stream = __commonJS((exports, module) => {
   }
   function jwsVerify(jwsSig, algorithm, secretOrKey) {
     if (!algorithm) {
-      var err3 = new Error("Missing algorithm parameter for jws.verify");
-      err3.code = "MISSING_ALGORITHM";
-      throw err3;
+      var err2 = new Error("Missing algorithm parameter for jws.verify");
+      err2.code = "MISSING_ALGORITHM";
+      throw err2;
     }
     jwsSig = toString(jwsSig);
     var signature = signatureFromJWS(jwsSig);
@@ -11934,9 +11934,9 @@ var require_verify = __commonJS((exports, module) => {
     if (callback) {
       done = callback;
     } else {
-      done = function(err3, data) {
-        if (err3)
-          throw err3;
+      done = function(err2, data) {
+        if (err2)
+          throw err2;
         return data;
       };
     }
@@ -11963,8 +11963,8 @@ var require_verify = __commonJS((exports, module) => {
     let decodedToken;
     try {
       decodedToken = decode(jwtString, { complete: true });
-    } catch (err3) {
-      return done(err3);
+    } catch (err2) {
+      return done(err2);
     }
     if (!decodedToken) {
       return done(new JsonWebTokenError("invalid token"));
@@ -11981,9 +11981,9 @@ var require_verify = __commonJS((exports, module) => {
         return secretCallback(null, secretOrPublicKey);
       };
     }
-    return getSecret(header, function(err3, secretOrPublicKey2) {
-      if (err3) {
-        return done(new JsonWebTokenError("error in secret or public key callback: " + err3.message));
+    return getSecret(header, function(err2, secretOrPublicKey2) {
+      if (err2) {
+        return done(new JsonWebTokenError("error in secret or public key callback: " + err2.message));
       }
       const hasSignature = parts[2].trim() !== "";
       if (!hasSignature && secretOrPublicKey2) {
@@ -12619,11 +12619,11 @@ var require_sign = __commonJS((exports, module) => {
       typ: isObjectPayload ? "JWT" : undefined,
       kid: options.keyid
     }, options.header);
-    function failure(err3) {
+    function failure(err2) {
       if (callback) {
-        return callback(err3);
+        return callback(err2);
       }
-      throw err3;
+      throw err2;
     }
     if (!secretOrPrivateKey && options.algorithm !== "none") {
       return failure(new Error("secretOrPrivateKey must have a value"));
@@ -12695,8 +12695,8 @@ var require_sign = __commonJS((exports, module) => {
     if (typeof options.notBefore !== "undefined") {
       try {
         payload.nbf = timespan(options.notBefore, timestamp2);
-      } catch (err3) {
-        return failure(err3);
+      } catch (err2) {
+        return failure(err2);
       }
       if (typeof payload.nbf === "undefined") {
         return failure(new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));
@@ -12705,8 +12705,8 @@ var require_sign = __commonJS((exports, module) => {
     if (typeof options.expiresIn !== "undefined" && typeof payload === "object") {
       try {
         payload.exp = timespan(options.expiresIn, timestamp2);
-      } catch (err3) {
-        return failure(err3);
+      } catch (err2) {
+        return failure(err2);
       }
       if (typeof payload.exp === "undefined") {
         return failure(new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));
@@ -13764,8 +13764,8 @@ class EventWire {
         try {
           const message = JSON.parse(event.data);
           this.handleMessage(message);
-        } catch (err3) {
-          console.error("EventWire: Failed to parse message", err3);
+        } catch (err2) {
+          console.error("EventWire: Failed to parse message", err2);
         }
       };
       this.ws.onclose = (event) => {
@@ -13774,17 +13774,17 @@ class EventWire {
         console.log("EventWire disconnected");
         this.scheduleReconnect();
       };
-      this.ws.onerror = (err3) => {
-        console.error("EventWire error:", err3);
+      this.ws.onerror = (err2) => {
+        console.error("EventWire error:", err2);
         if (this.state === "connecting") {
           this.state = "disconnected";
           this.ws = null;
         }
       };
-    } catch (err3) {
+    } catch (err2) {
       this.state = "disconnected";
       this.ws = null;
-      console.error("EventWire: Failed to connect", err3);
+      console.error("EventWire: Failed to connect", err2);
       this.scheduleReconnect();
     }
   }
@@ -18135,7 +18135,7 @@ var {
 // ../../node_modules/.bun/find-up@7.0.0/node_modules/find-up/index.js
 import path2 from "path";
 
-// ../../node_modules/.bun/find-up@7.0.0/node_modules/find-up/node_modules/locate-path/index.js
+// ../../node_modules/.bun/locate-path@7.2.0/node_modules/locate-path/index.js
 import process2 from "process";
 import path from "path";
 import fs, { promises as fsPromises } from "fs";
@@ -21686,7 +21686,7 @@ var emitWarning = (msg, type, code, fn) => {
 var AC = globalThis.AbortController;
 var AS = globalThis.AbortSignal;
 if (typeof AC === "undefined") {
-  AS = class AbortSignal2 {
+  AS = class AbortSignal {
     onabort;
     _onabort = [];
     reason;
@@ -26129,110 +26129,9 @@ ${colors2.yellow}Type declaration errors:${colors2.reset}`);
   }
 }
 
-// src/commands/build-shell.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, rmSync } from "fs";
-import { join as join3 } from "path";
-var REACT_ENTRIES = [
-  ["react", `export * from "react";
-import * as React from "react";
-export default React;`],
-  ["react-dom", `export * from "react-dom";
-import * as ReactDOM from "react-dom";
-export default ReactDOM;`],
-  ["jsx-runtime", `export * from "react/jsx-runtime";`],
-  ["jsx-dev-runtime", `export * from "react/jsx-dev-runtime";`],
-  ["react-dom-client", `export { createRoot, hydrateRoot } from "react-dom/client";`]
-];
-var SHELL_BASE_EXTERNAL = [
-  "react",
-  "react-dom",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "react-dom/client"
-];
-async function buildShell(opts) {
-  const outDir = opts.out;
-  const fromDir = opts.from;
-  if (!existsSync3(fromDir)) {
-    console.error(`[_build-shell] --from not found: ${fromDir}`);
-    process.exit(1);
-  }
-  mkdirSync3(outDir, { recursive: true });
-  const tmpDir = join3(outDir, "_tmp");
-  mkdirSync3(tmpDir, { recursive: true });
-  try {
-    const arcPkgs = discoverArcPackages(fromDir);
-    if (arcPkgs.length === 0) {
-      console.warn("[_build-shell] no @arcote.tech/* packages discovered");
-    }
-    console.log(`[_build-shell] building shell for react + ${arcPkgs.length} @arcote.tech/* package(s)`);
-    await buildReactShell(outDir, tmpDir, fromDir);
-    for (const pkg of arcPkgs) {
-      await buildArcEntry(pkg, arcPkgs, outDir, tmpDir, fromDir);
-    }
-    console.log(`[_build-shell] done \u2192 ${outDir}`);
-  } finally {
-    rmSync(tmpDir, { recursive: true, force: true });
-  }
-}
-function discoverArcPackages(fromDir) {
-  const arcDir = join3(fromDir, "@arcote.tech");
-  if (!existsSync3(arcDir))
-    return [];
-  return readdirSync2(arcDir).filter((name) => existsSync3(join3(arcDir, name, "package.json"))).map((name) => `@arcote.tech/${name}`);
-}
-async function buildReactShell(outDir, tmpDir, fromDir) {
-  const eps = [];
-  for (const [name, code] of REACT_ENTRIES) {
-    const f = join3(tmpDir, `${name}.ts`);
-    await Bun.write(f, code);
-    eps.push(f);
-  }
-  const r = await Bun.build({
-    entrypoints: eps,
-    outdir: outDir,
-    splitting: true,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]",
-    root: fromDir
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error("React shell build failed");
-  }
-}
-async function buildArcEntry(pkg, allArcPkgs, outDir, tmpDir, fromDir) {
-  const shortName = pkg.replace("@arcote.tech/", "");
-  const otherExternals = allArcPkgs.filter((p) => p !== pkg);
-  const f = join3(tmpDir, `${shortName}.ts`);
-  await Bun.write(f, `export * from "${pkg}";
-`);
-  const r = await Bun.build({
-    entrypoints: [f],
-    outdir: outDir,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]",
-    root: fromDir,
-    external: [...SHELL_BASE_EXTERNAL, ...otherExternals],
-    define: {
-      ONLY_SERVER: "false",
-      ONLY_BROWSER: "true",
-      ONLY_CLIENT: "true"
-    }
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error(`Shell build failed for ${pkg}`);
-  }
-}
-
 // src/commands/dev.ts
 var import_chokidar = __toESM(require_chokidar(), 1);
-import { dirname as dirname3, join as join4, relative } from "path";
+import { dirname as dirname3, join as join3, relative } from "path";
 function getContextForFile(filePath, contexts, configDir) {
   const relativePath = relative(configDir, filePath);
   for (const context of contexts) {
@@ -26349,7 +26248,7 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
       } else {
         log("Initial build complete \u2713", "green");
       }
-      const watcher = import_chokidar.default.watch([join4(configDir, "**/*.ts"), join4(configDir, "**/*.tsx")], {
+      const watcher = import_chokidar.default.watch([join3(configDir, "**/*.ts"), join3(configDir, "**/*.tsx")], {
         ignored: [
           "**/node_modules/**",
           `**/${config.outDir}/**`,
@@ -26446,24 +26345,24 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname6, join as join12 } from "path";
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync10, readdirSync as readdirSync5, rmSync as rmSync2, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname7, join as join11 } from "path";
 
 // src/builder/module-builder.ts
 import { execSync } from "child_process";
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync8,
-  readdirSync as readdirSync5,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync7,
+  readdirSync as readdirSync4,
+  rmSync,
+  writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename2, dirname as dirname5, join as join9, relative as relative3 } from "path";
+import { basename as basename2, dirname as dirname5, join as join8, relative as relative3 } from "path";
 
 // src/i18n/index.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join6 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 
 // src/i18n/catalog.ts
 function hashMsgid(msgid) {
@@ -26634,10 +26533,10 @@ function quoteString(s) {
 }
 
 // src/i18n/compile.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
 function compileCatalog(poPath) {
-  const content = readFileSync4(poPath, "utf-8");
+  const content = readFileSync3(poPath, "utf-8");
   const entries = parsePo(content);
   const result = {};
   for (const entry of entries) {
@@ -26652,13 +26551,13 @@ function compileCatalog(poPath) {
   return sorted;
 }
 function compileAllCatalogs(localesDir, outDir) {
-  mkdirSync4(outDir, { recursive: true });
-  for (const file of readdirSync3(localesDir)) {
+  mkdirSync3(outDir, { recursive: true });
+  for (const file of readdirSync2(localesDir)) {
     if (!file.endsWith(".po"))
       continue;
     const locale = file.replace(".po", "");
-    const compiled = compileCatalog(join5(localesDir, file));
-    writeFileSync4(join5(outDir, `${locale}.json`), JSON.stringify(compiled));
+    const compiled = compileCatalog(join4(localesDir, file));
+    writeFileSync3(join4(outDir, `${locale}.json`), JSON.stringify(compiled));
   }
 }
 
@@ -26702,10 +26601,10 @@ function i18nExtractPlugin(collector, rootDir) {
 
 // src/i18n/index.ts
 function readTranslationsConfig(rootDir) {
-  const pkgPath = join6(rootDir, "package.json");
-  if (!existsSync5(pkgPath))
+  const pkgPath = join5(rootDir, "package.json");
+  if (!existsSync4(pkgPath))
     return null;
-  const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
   const config = pkg.arc?.translations;
   if (!config?.locales?.length)
     return null;
@@ -26718,34 +26617,34 @@ async function finalizeTranslations(rootDir, outDir, collector) {
   const config = readTranslationsConfig(rootDir);
   if (!config || collector.size === 0)
     return;
-  const localesJsonDir = join6(outDir, "locales");
-  mkdirSync5(localesJsonDir, { recursive: true });
+  const localesJsonDir = join5(outDir, "locales");
+  mkdirSync4(localesJsonDir, { recursive: true });
   console.log(`  Extracted ${collector.size} translatable string(s) for ${config.locales.length} locale(s)`);
   for (const locale of config.locales) {
-    const poPath = join6(rootDir, "locales", `${locale}.po`);
-    mkdirSync5(dirname4(poPath), { recursive: true });
-    const existing = existsSync5(poPath) ? parsePo(readFileSync5(poPath, "utf-8")) : [];
+    const poPath = join5(rootDir, "locales", `${locale}.po`);
+    mkdirSync4(dirname4(poPath), { recursive: true });
+    const existing = existsSync4(poPath) ? parsePo(readFileSync4(poPath, "utf-8")) : [];
     const merged = mergeCatalog(existing, collector);
-    writeFileSync5(poPath, writePo(merged));
+    writeFileSync4(poPath, writePo(merged));
     const compiled = compileCatalog(poPath);
-    writeFileSync5(join6(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
+    writeFileSync4(join5(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
   }
 }
 
 // src/builder/build-cache.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join7 } from "path";
-var CACHE_VERSION = 1;
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
+var CACHE_VERSION = 2;
 var CACHE_FILE = ".build-cache.json";
 function emptyCache() {
   return { version: CACHE_VERSION, units: {} };
 }
 function loadBuildCache(arcDir) {
-  const path4 = join7(arcDir, CACHE_FILE);
-  if (!existsSync6(path4))
+  const path4 = join6(arcDir, CACHE_FILE);
+  if (!existsSync5(path4))
     return emptyCache();
   try {
-    const raw = JSON.parse(readFileSync6(path4, "utf-8"));
+    const raw = JSON.parse(readFileSync5(path4, "utf-8"));
     if (raw?.version !== CACHE_VERSION || typeof raw.units !== "object") {
       return emptyCache();
     }
@@ -26755,15 +26654,15 @@ function loadBuildCache(arcDir) {
   }
 }
 function saveBuildCache(arcDir, cache) {
-  mkdirSync6(arcDir, { recursive: true });
-  writeFileSync6(join7(arcDir, CACHE_FILE), JSON.stringify(cache, null, 2));
+  mkdirSync5(arcDir, { recursive: true });
+  writeFileSync5(join6(arcDir, CACHE_FILE), JSON.stringify(cache, null, 2));
 }
 function isCacheHit(cache, unitId, inputHash, requiredOutputs = []) {
   const entry = cache.units[unitId];
   if (!entry || entry.inputHash !== inputHash)
     return false;
   for (const out of requiredOutputs) {
-    if (!existsSync6(out))
+    if (!existsSync5(out))
       return false;
   }
   return true;
@@ -26776,9 +26675,33 @@ function updateCache(cache, unitId, inputHash, output = {}) {
   };
 }
 
+// src/builder/framework-peers.ts
+var CORE_PEERS = [
+  "@arcote.tech/arc",
+  "@arcote.tech/arc-ds",
+  "@arcote.tech/arc-react",
+  "@arcote.tech/platform"
+];
+var BROWSER_FRAGMENT_PEERS = [
+  "@arcote.tech/arc-auth",
+  "@arcote.tech/arc-workspace",
+  "@arcote.tech/arc-utils",
+  "@arcote.tech/arc-chat"
+];
+var ARC_PEERS = [...CORE_PEERS, ...BROWSER_FRAGMENT_PEERS];
+var REACT_PEERS = ["react", "react-dom"];
+var FRAMEWORK_PEERS = [...ARC_PEERS, ...REACT_PEERS];
+var SHELL_EXTERNALS = [
+  ...FRAMEWORK_PEERS,
+  "react/jsx-runtime",
+  "react/jsx-dev-runtime"
+];
+var FRAMEWORK_PEER_SET = new Set(FRAMEWORK_PEERS);
+var SHELL_EXTERNAL_SET = new Set(SHELL_EXTERNALS);
+
 // src/builder/hash.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, readdirSync as readdirSync4, statSync } from "fs";
-import { join as join8, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync } from "fs";
+import { join as join7, relative as relative2, sep as sep2 } from "path";
 function sha256Hex(bytes) {
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(bytes);
@@ -26788,21 +26711,21 @@ function sha256OfFiles(paths) {
   const hasher = new Bun.CryptoHasher("sha256");
   const sorted = [...paths].sort();
   for (const p of sorted) {
-    if (!existsSync7(p))
+    if (!existsSync6(p))
       continue;
-    hasher.update(readFileSync7(p));
+    hasher.update(readFileSync6(p));
     hasher.update("\x00");
   }
   return hasher.digest("hex");
 }
 function sha256OfDir(dir, filter2) {
-  if (!existsSync7(dir))
+  if (!existsSync6(dir))
     return sha256Hex("");
   const hasher = new Bun.CryptoHasher("sha256");
   const entries = [];
   function walk(absDir) {
-    for (const entry of readdirSync4(absDir, { withFileTypes: true })) {
-      const abs = join8(absDir, entry.name);
+    for (const entry of readdirSync3(absDir, { withFileTypes: true })) {
+      const abs = join7(absDir, entry.name);
       const rel = relative2(dir, abs).split(sep2).join("/");
       if (filter2 && !filter2(rel))
         continue;
@@ -26817,7 +26740,7 @@ function sha256OfDir(dir, filter2) {
   for (const { rel, abs } of entries) {
     hasher.update(rel);
     hasher.update("\x00");
-    hasher.update(readFileSync7(abs));
+    hasher.update(readFileSync6(abs));
     hasher.update("\x00");
   }
   return hasher.digest("hex");
@@ -26836,17 +26759,17 @@ function stableStringify(value) {
   return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
 }
 function readInstalledVersion(rootDir, pkgName) {
-  const pkgJson = join8(rootDir, "node_modules", pkgName, "package.json");
-  if (!existsSync7(pkgJson))
+  const pkgJson = join7(rootDir, "node_modules", pkgName, "package.json");
+  if (!existsSync6(pkgJson))
     return null;
   try {
-    return JSON.parse(readFileSync7(pkgJson, "utf-8")).version ?? null;
+    return JSON.parse(readFileSync6(pkgJson, "utf-8")).version ?? null;
   } catch {
     return null;
   }
 }
 function mtimeOf(path4) {
-  if (!existsSync7(path4))
+  if (!existsSync6(path4))
     return 0;
   try {
     return statSync(path4).mtimeMs;
@@ -26876,58 +26799,64 @@ async function pAll(tasks, concurrency = DEFAULT_CONCURRENCY) {
 }
 
 // src/builder/module-builder.ts
+function jsxDevShimPlugin() {
+  return {
+    name: "jsx-dev-runtime-shim",
+    setup(build2) {
+      build2.onResolve({ filter: /^react\/jsx-dev-runtime$/ }, () => ({
+        path: "react-jsx-dev-runtime-shim",
+        namespace: "jsx-dev-shim"
+      }));
+      build2.onLoad({ filter: /.*/, namespace: "jsx-dev-shim" }, () => ({
+        contents: `import { jsx, jsxs, Fragment } from "react/jsx-runtime";
+export const jsxDEV = jsx;
+export const jsxsDEV = jsxs;
+export { Fragment };
+`,
+        loader: "ts"
+      }));
+    }
+  };
+}
 var CONTEXT_CLIENTS = [
   { name: "server", target: "bun", defines: { ONLY_SERVER: "true", ONLY_BROWSER: "false", ONLY_CLIENT: "false" } },
   { name: "browser", target: "browser", defines: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" } }
 ];
-var SHELL_EXTERNALS = [
-  "react",
-  "react-dom",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "@arcote.tech/arc",
-  "@arcote.tech/arc-ds",
-  "@arcote.tech/arc-react",
-  "@arcote.tech/arc-auth",
-  "@arcote.tech/arc-utils",
-  "@arcote.tech/arc-workspace",
-  "@arcote.tech/platform"
-];
 function discoverPackages(rootDir) {
-  const rootPkg = JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync7(join8(rootDir, "package.json"), "utf-8"));
   const workspaceGlobs = rootPkg.workspaces ?? [];
   const results = [];
   for (const glob2 of workspaceGlobs) {
     const base2 = glob2.replace("/*", "");
-    const baseDir = join9(rootDir, base2);
-    if (!existsSync8(baseDir))
+    const baseDir = join8(rootDir, base2);
+    if (!existsSync7(baseDir))
       continue;
     let entries;
     try {
-      entries = readdirSync5(baseDir);
+      entries = readdirSync4(baseDir);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const pkgPath = join9(baseDir, entry, "package.json");
-      if (!existsSync8(pkgPath))
+      const pkgPath = join8(baseDir, entry, "package.json");
+      if (!existsSync7(pkgPath))
         continue;
-      const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
       if (pkg.name?.startsWith("@arcote.tech/"))
         continue;
-      const pkgDir = join9(baseDir, entry);
+      const pkgDir = join8(baseDir, entry);
       const candidates = [
-        join9(pkgDir, "src", "index.ts"),
-        join9(pkgDir, "src", "index.tsx"),
-        join9(pkgDir, "index.ts"),
-        join9(pkgDir, "index.tsx")
+        join8(pkgDir, "src", "index.ts"),
+        join8(pkgDir, "src", "index.tsx"),
+        join8(pkgDir, "index.ts"),
+        join8(pkgDir, "index.tsx")
       ];
-      const entrypoint = candidates.find((c) => existsSync8(c)) ?? null;
+      const entrypoint = candidates.find((c) => existsSync7(c)) ?? null;
       if (!entrypoint)
         continue;
       results.push({
         name: pkg.name,
-        path: join9(baseDir, entry),
+        path: join8(baseDir, entry),
         entrypoint,
         packageJson: pkg
       });
@@ -26956,7 +26885,7 @@ var sourceFilter = (rel) => {
   return true;
 };
 function pkgSourceHash(pkg) {
-  return sha256OfDir(join9(pkg.path, "src"), sourceFilter);
+  return sha256OfDir(join8(pkg.path, "src"), sourceFilter);
 }
 function depVersionsHash(rootDir, pkg) {
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
@@ -26969,7 +26898,7 @@ function depVersionsHash(rootDir, pkg) {
 }
 async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const unitId = `context-pkg:${pkg.name}:${client.name}`;
-  const outDir = join9(pkg.path, "dist", client.name);
+  const outDir = join8(pkg.path, "dist", client.name);
   const inputHash = sha256OfJson({
     src: pkgSourceHash(pkg),
     pkg: pkg.packageJson,
@@ -26978,21 +26907,23 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
     target: client.target,
     defines: client.defines
   });
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(outDir, "main", "index.js")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(outDir, "main", "index.js")])) {
     console.log(`  \u2713 cached: ${pkg.name} (${client.name})`);
     return { pkgName: pkg.name, client: client.name, declarationErrors: [], cached: true };
   }
   console.log(`  building: ${pkg.name} (${client.name})`);
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
-  const deps = Object.keys(pkg.packageJson.dependencies ?? {});
-  const externals = [...peerDeps, ...deps];
+  const allDeps = pkg.packageJson.dependencies ?? {};
+  const npmDeps = Object.entries(allDeps).filter(([, spec]) => !spec.startsWith("workspace:")).map(([name]) => name);
+  const externals = [...peerDeps, ...npmDeps];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
-    outdir: join9(outDir, "main"),
+    outdir: join8(outDir, "main"),
     target: client.target,
     format: "esm",
     naming: "index.[ext]",
     external: externals,
+    plugins: [jsxDevShimPlugin()],
     define: client.defines
   });
   if (!result.success) {
@@ -27025,115 +26956,142 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
   }
   return { declarationErrors };
 }
-async function buildModulesBundle(rootDir, outDir, packages, cache, noCache) {
-  mkdirSync7(outDir, { recursive: true });
-  const unitId = "modules-bundle";
-  const pkgHashes = packages.map((p) => ({
-    name: p.name,
-    safeName: basename2(p.path),
-    srcHash: pkgSourceHash(p)
+async function buildModulesByChunks(rootDir, outDir, plan, cache, noCache) {
+  mkdirSync6(outDir, { recursive: true });
+  const i18nCollector = new Map;
+  const aggregateModules = [];
+  let allCached = true;
+  for (const chunk of plan.chunks) {
+    const members = plan.groups.get(chunk) ?? [];
+    if (members.length === 0)
+      continue;
+    const chunkOutDir = join8(outDir, chunk);
+    mkdirSync6(chunkOutDir, { recursive: true });
+    const result = await buildChunkGroup(rootDir, chunkOutDir, chunk, members, cache, noCache, i18nCollector);
+    aggregateModules.push(...result.modules);
+    if (!result.cached)
+      allCached = false;
+  }
+  await finalizeTranslations(rootDir, join8(outDir, ".."), i18nCollector);
+  return { modules: aggregateModules, cached: allCached };
+}
+async function buildChunkGroup(rootDir, chunkOutDir, chunk, members, cache, noCache, i18nCollector) {
+  const unitId = `modules-chunk:${chunk}`;
+  const pkgHashes = members.map((m) => ({
+    name: m.pkg.name,
+    safeName: m.safeName,
+    moduleName: m.moduleName,
+    srcHash: pkgSourceHash(m.pkg)
   }));
   const inputHash = sha256OfJson({
+    chunk,
     pkgHashes,
     externals: SHELL_EXTERNALS,
     define: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" }
   });
   if (!noCache && isCacheHit(cache, unitId, inputHash)) {
     const existing = cache.units[unitId]?.outputHashes ?? {};
-    const modules = [];
-    for (const { safeName, name } of pkgHashes) {
-      const file = `${safeName}.js`;
-      const filePath = join9(outDir, file);
-      if (!existsSync8(filePath)) {
-        console.log(`  rebuilding modules-bundle: output ${file} missing`);
-        return await actuallyBuild();
-      }
-      modules.push({ file, name, hash: existing[safeName] ?? sha256Hex(readFileSync8(filePath)) });
-    }
-    console.log(`  \u2713 cached: modules-bundle (${modules.length} module(s))`);
-    return { modules, cached: true };
-  }
-  return await actuallyBuild();
-  async function actuallyBuild() {
-    console.log(`  building: modules-bundle (${packages.length} package(s))`);
-    const tmpDir = join9(outDir, "_entries");
-    mkdirSync7(tmpDir, { recursive: true });
-    const entrypoints = [];
-    const fileToName = new Map;
-    for (const pkg of packages) {
-      const safeName = basename2(pkg.path);
-      const moduleName = pkg.name.includes("/") ? pkg.name.split("/").pop() : pkg.name;
-      fileToName.set(safeName, moduleName);
-      const wrapperFile = join9(tmpDir, `${safeName}.ts`);
-      writeFileSync7(wrapperFile, `export * from "${pkg.name}";
-`);
-      entrypoints.push(wrapperFile);
-    }
-    const i18nCollector = new Map;
-    const arcExternalPlugin = {
-      name: "arc-external",
-      setup(build2) {
-        build2.onResolve({ filter: /^@arcote\.tech\// }, (args) => {
-          return { path: args.path, external: true };
-        });
-      }
-    };
-    const result = await Bun.build({
-      entrypoints,
-      outdir: outDir,
-      splitting: true,
-      format: "esm",
-      target: "browser",
-      external: SHELL_EXTERNALS,
-      plugins: [arcExternalPlugin, i18nExtractPlugin(i18nCollector, rootDir)],
-      naming: "[name].[ext]",
-      define: {
-        ONLY_SERVER: "false",
-        ONLY_BROWSER: "true",
-        ONLY_CLIENT: "true"
+    const modules2 = [];
+    let missing = false;
+    for (const h of pkgHashes) {
+      const file = `${h.safeName}.js`;
+      const filePath = join8(chunkOutDir, file);
+      if (!existsSync7(filePath)) {
+        missing = true;
+        break;
       }
-    });
-    if (!result.success) {
-      console.error("Modules bundle build failed:");
-      for (const log2 of result.logs)
-        console.error(log2);
-      throw new Error("Module build failed");
-    }
-    await finalizeTranslations(rootDir, join9(outDir, ".."), i18nCollector);
-    rmSync2(tmpDir, { recursive: true, force: true });
-    const outputHashes = {};
-    const modules = result.outputs.filter((o) => o.kind === "entry-point").map((o) => {
-      const file = basename2(o.path);
-      const safeName = file.replace(/\.js$/, "");
-      const bytes = readFileSync8(o.path);
-      const hash = sha256Hex(bytes);
-      outputHashes[safeName] = hash;
-      return {
+      modules2.push({
         file,
-        name: fileToName.get(safeName) ?? safeName,
-        hash
-      };
-    });
-    updateCache(cache, unitId, inputHash, { outputHashes });
-    return { modules, cached: false };
+        name: h.moduleName,
+        chunk,
+        hash: existing[h.safeName] ?? sha256Hex(readFileSync7(filePath))
+      });
+    }
+    if (!missing) {
+      console.log(`  \u2713 cached: ${unitId} (${modules2.length} module(s))`);
+      return { modules: modules2, cached: true };
+    }
+    console.log(`  rebuilding ${unitId}: output file missing`);
+  }
+  console.log(`  building: ${unitId} (${members.length} module(s))`);
+  const tmpDir = join8(chunkOutDir, "_entries");
+  mkdirSync6(tmpDir, { recursive: true });
+  const entrypoints = [];
+  const fileToModuleName = new Map;
+  for (const m of members) {
+    fileToModuleName.set(m.safeName, m.moduleName);
+    const wrapperFile = join8(tmpDir, `${m.safeName}.ts`);
+    writeFileSync6(wrapperFile, `export * from "${m.pkg.name}";
+`);
+    entrypoints.push(wrapperFile);
   }
+  const arcExternalPlugin = {
+    name: "arc-external",
+    setup(build2) {
+      build2.onResolve({ filter: /^@arcote\.tech\// }, (args) => {
+        return { path: args.path, external: true };
+      });
+    }
+  };
+  const result = await Bun.build({
+    entrypoints,
+    outdir: chunkOutDir,
+    splitting: true,
+    format: "esm",
+    target: "browser",
+    external: [...SHELL_EXTERNALS],
+    plugins: [
+      arcExternalPlugin,
+      jsxDevShimPlugin(),
+      i18nExtractPlugin(i18nCollector, rootDir)
+    ],
+    naming: "[name].[ext]",
+    define: {
+      ONLY_SERVER: "false",
+      ONLY_BROWSER: "true",
+      ONLY_CLIENT: "true"
+    }
+  });
+  if (!result.success) {
+    console.error(`Chunk "${chunk}" build failed:`);
+    for (const log2 of result.logs)
+      console.error(log2);
+    throw new Error(`Module chunk build failed: ${chunk}`);
+  }
+  rmSync(tmpDir, { recursive: true, force: true });
+  const outputHashes = {};
+  const modules = result.outputs.filter((o) => o.kind === "entry-point").map((o) => {
+    const file = basename2(o.path);
+    const safeName = file.replace(/\.js$/, "");
+    const bytes = readFileSync7(o.path);
+    const hash = sha256Hex(bytes);
+    outputHashes[safeName] = hash;
+    return {
+      file,
+      name: fileToModuleName.get(safeName) ?? safeName,
+      chunk,
+      hash
+    };
+  });
+  updateCache(cache, unitId, inputHash, { outputHashes });
+  return { modules, cached: false };
 }
 async function buildTranslations(rootDir, arcDir, cache, noCache) {
-  const localesDir = join9(rootDir, "locales");
-  if (!existsSync8(localesDir))
+  const localesDir = join8(rootDir, "locales");
+  if (!existsSync7(localesDir))
     return;
   const unitId = "translations";
-  const poFiles = readdirSync5(localesDir).filter((f) => f.endsWith(".po")).map((f) => join9(localesDir, f));
+  const poFiles = readdirSync4(localesDir).filter((f) => f.endsWith(".po")).map((f) => join8(localesDir, f));
   if (poFiles.length === 0)
     return;
   const inputHash = sha256OfFiles(poFiles);
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(arcDir, "locales")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(arcDir, "locales")])) {
     console.log(`  \u2713 cached: translations`);
     return;
   }
   console.log(`  building: translations (${poFiles.length} catalog(s))`);
-  compileAllCatalogs(localesDir, join9(arcDir, "locales"));
-  const jsonFiles = readdirSync5(join9(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join9(arcDir, "locales", f));
+  compileAllCatalogs(localesDir, join8(arcDir, "locales"));
+  const jsonFiles = readdirSync4(join8(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join8(arcDir, "locales", f));
   const outputHash = sha256OfFiles(jsonFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
@@ -27197,10 +27155,10 @@ var TAILWIND_INPUT_TEMPLATE = (rootRel) => `@import "tailwindcss";
 }
 `;
 async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache) {
-  mkdirSync7(arcDir, { recursive: true });
-  const inputCss = join9(arcDir, "_input.css");
-  const outputCss = join9(arcDir, "styles.css");
-  const themeOutput = join9(arcDir, "theme.css");
+  mkdirSync6(arcDir, { recursive: true });
+  const inputCss = join8(arcDir, "_input.css");
+  const outputCss = join8(arcDir, "styles.css");
+  const themeOutput = join8(arcDir, "theme.css");
   const rootRel = relative3(arcDir, rootDir).replace(/\\/g, "/");
   const inputCssContent = TAILWIND_INPUT_TEMPLATE(rootRel);
   const tsxFilter = (rel) => {
@@ -27212,15 +27170,15 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
   };
   const wsHashes = {};
   for (const p of packages) {
-    wsHashes[p.name] = sha256OfDir(join9(p.path, "src"), tsxFilter);
+    wsHashes[p.name] = sha256OfDir(join8(p.path, "src"), tsxFilter);
   }
-  const platformSrc = join9(rootDir, "node_modules", "@arcote.tech", "platform", "src");
-  const arcDsSrc = join9(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
+  const platformSrc = join8(rootDir, "node_modules", "@arcote.tech", "platform", "src");
+  const arcDsSrc = join8(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
   const frameworkHashes = {
     platform: sha256OfDir(platformSrc, tsxFilter),
     arcDs: sha256OfDir(arcDsSrc, tsxFilter)
   };
-  const themeContent = themePath && existsSync8(join9(rootDir, themePath)) ? readFileSync8(join9(rootDir, themePath)) : null;
+  const themeContent = themePath && existsSync7(join8(rootDir, themePath)) ? readFileSync7(join8(rootDir, themePath)) : null;
   const themeHash = themeContent ? sha256Hex(themeContent) : null;
   const unitId = "styles";
   const inputHash = sha256OfJson({
@@ -27237,146 +27195,57 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
     return;
   }
   console.log(`  building: styles`);
-  writeFileSync7(inputCss, inputCssContent);
+  writeFileSync6(inputCss, inputCssContent);
   execSync(`bunx @tailwindcss/cli -i ${inputCss} -o ${outputCss} --minify`, {
     cwd: rootDir,
     stdio: "inherit"
   });
   if (themePath && themeContent) {
-    writeFileSync7(themeOutput, themeContent);
+    writeFileSync6(themeOutput, themeContent);
   }
   const outFiles = [outputCss];
-  if (themePath && existsSync8(themeOutput))
+  if (themePath && existsSync7(themeOutput))
     outFiles.push(themeOutput);
   const outputHash = sha256OfFiles(outFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
 
-// src/builder/dependency-collector.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename3, join as join10 } from "path";
-var FRAMEWORK_PEERS = [
-  "@arcote.tech/arc",
-  "@arcote.tech/arc-ds",
-  "@arcote.tech/arc-react",
-  "@arcote.tech/platform",
-  "react",
-  "react-dom"
-];
-function collectFrameworkDeps(arcDir, rootDir, packages) {
-  mkdirSync8(arcDir, { recursive: true });
-  const versions = resolveFrameworkVersions(rootDir, packages);
-  const manifest = {
-    name: "arc-platform-framework",
-    private: true,
-    type: "module",
-    dependencies: versions
-  };
-  const manifestPath = join10(arcDir, "package.json");
-  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
-`);
-  const targetLock = join10(arcDir, "bun.lock");
-  writeFileSync8(targetLock, "");
-  const hash = sha256ConcatHex([manifestPath, targetLock]);
-  writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
-`);
-  return { hash, manifestPath };
-}
-function sha256ConcatHex(paths) {
-  const hash = createHash("sha256");
-  for (const p of paths) {
-    if (existsSync9(p)) {
-      hash.update(readFileSync9(p));
-    }
-  }
-  return hash.digest("hex");
-}
-function collectModuleDeps(arcDir, pkg) {
-  const safeName = basename3(pkg.path);
-  const moduleDir = join10(arcDir, "modules", safeName);
-  mkdirSync8(moduleDir, { recursive: true });
-  const pkgDeps = pkg.packageJson.dependencies ?? {};
-  const filtered = {};
-  const frameworkSet = new Set(FRAMEWORK_PEERS);
-  for (const [name, spec] of Object.entries(pkgDeps)) {
-    if (frameworkSet.has(name))
-      continue;
-    if (spec.startsWith("workspace:"))
-      continue;
-    filtered[name] = spec;
-  }
-  const manifest = {
-    name: `arc-module-${safeName}`,
-    private: true,
-    type: "module",
-    dependencies: filtered
-  };
-  const manifestPath = join10(moduleDir, "package.json");
-  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
-`);
-  const hash = sha256OfFiles2([manifestPath]);
-  writeFileSync8(join10(moduleDir, ".deps-hash"), hash + `
-`);
-  return { hash, manifestPath };
-}
-function resolveFrameworkVersions(rootDir, packages) {
-  const rootPkg = JSON.parse(readFileSync9(join10(rootDir, "package.json"), "utf-8"));
-  const rootDeps = rootPkg.dependencies ?? {};
-  const out = {};
-  for (const name of FRAMEWORK_PEERS) {
-    const rootSpec = rootDeps[name];
-    if (rootSpec) {
-      out[name] = rootSpec;
-      continue;
-    }
-    let found;
-    for (const pkg of packages) {
-      const spec = (pkg.packageJson.dependencies ?? {})[name];
-      if (spec) {
-        found = spec;
-        break;
-      }
-    }
-    out[name] = found ?? "*";
-  }
-  return out;
-}
-function sha256OfFiles2(paths) {
-  const hash = createHash("sha256");
-  for (const p of paths.sort()) {
-    if (!existsSync9(p))
-      continue;
-    hash.update(p);
-    hash.update("\x00");
-    hash.update(readFileSync9(p));
-    hash.update("\x00");
-  }
-  return hash.digest("hex");
-}
-
 // src/builder/access-extractor.ts
 var {spawn: spawn2 } = globalThis.Bun;
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
-import { tmpdir } from "os";
-import { basename as basename4, join as join11 } from "path";
-async function extractAccessMap(arcDir, packages) {
-  const serverBundles = packages.filter((p) => isContextPackage(p.packageJson)).map((p) => {
-    const v06Path = join11(arcDir, "modules", basename4(p.path), "server.js");
-    const legacyPath = join11(p.path, "dist", "server", "main", "index.js");
-    return { name: p.name, path: v06Path, fallback: legacyPath };
-  });
-  const outPath = join11(arcDir, "access.json");
-  mkdirSync9(arcDir, { recursive: true });
-  const workerPath = join11(tmpdir(), `arc-access-extractor-${Date.now()}.mjs`);
-  writeFileSync9(workerPath, WORKER_SOURCE);
+import {
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync8,
+  realpathSync as realpathSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { dirname as dirname6, join as join9 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+function locatePlatformServerEntry() {
+  const here = fileURLToPath5(import.meta.url);
+  const arcRoot = realpathSync2(dirname6(dirname6(dirname6(dirname6(here)))));
+  return join9(arcRoot, "packages", "platform", "src", "index.server.ts");
+}
+async function extractAccessMap(rootDir, packages) {
+  const serverBundles = packages.filter((p) => isContextPackage(p.packageJson)).map((p) => ({
+    name: p.name,
+    path: join9(p.path, "dist", "server", "main", "index.js")
+  })).filter((b) => existsSync8(b.path));
+  const workerDir = join9(rootDir, ".arc", ".tmp");
+  mkdirSync7(workerDir, { recursive: true });
+  const workerPath = join9(workerDir, `access-extractor-${Date.now()}.mjs`);
+  const outPath = join9(workerDir, `access-${Date.now()}.json`);
+  writeFileSync7(workerPath, WORKER_SOURCE);
   try {
     const proc2 = spawn2({
       cmd: ["bun", "run", workerPath],
+      cwd: rootDir,
       env: {
         ...process.env,
         ARC_ACCESS_BUNDLES: JSON.stringify(serverBundles),
-        ARC_ACCESS_OUT: outPath
+        ARC_ACCESS_OUT: outPath,
+        ARC_PLATFORM_ENTRY: locatePlatformServerEntry()
       },
       stdout: "pipe",
       stderr: "inherit"
@@ -27385,17 +27254,20 @@ async function extractAccessMap(arcDir, packages) {
     if (exit !== 0) {
       throw new Error(`access-extractor subprocess exited with ${exit}`);
     }
-    return JSON.parse(readFileSync10(outPath, "utf-8"));
+    return JSON.parse(readFileSync8(outPath, "utf-8"));
   } finally {
     try {
       unlinkSync2(workerPath);
     } catch {}
+    try {
+      unlinkSync2(outPath);
+    } catch {}
   }
 }
 var WORKER_SOURCE = `
-import { existsSync } from "node:fs";
-
 globalThis.ONLY_SERVER = true;
+globalThis.ONLY_BROWSER = false;
+globalThis.ONLY_CLIENT = false;
 
 const bundles = JSON.parse(process.env.ARC_ACCESS_BUNDLES || "[]");
 const out = process.env.ARC_ACCESS_OUT;
@@ -27404,20 +27276,16 @@ if (!out) {
   process.exit(2);
 }
 
-const platform = await import("@arcote.tech/platform");
+// Direct file-path import \u2014 bypasses node_modules resolution entirely.
+// Avoids quirks with bun-link snapshots holding stale package.json exports.
+const platform = await import(process.env.ARC_PLATFORM_ENTRY);
 
-for (const { name, path, fallback } of bundles) {
-  const target = existsSync(path) ? path : fallback;
-  if (!target || !existsSync(target)) {
-    // No server bundle on either path \u2014 module has no protected access rules
-    // to discover. Skip silently rather than logging a misleading error.
-    continue;
-  }
+for (const { name, path } of bundles) {
   try {
-    await import(target);
+    await import(path);
   } catch (e) {
-    console.error("[access-extractor-worker] failed to import", name, "from", target, e);
-    // Continue \u2014 partial access map is better than total failure.
+    console.error("[access-extractor-worker] failed to import", name, ":", e.message);
+    // Partial map is better than total failure.
   }
 }
 
@@ -27435,6 +27303,123 @@ const { writeFileSync } = await import("node:fs");
 writeFileSync(out, JSON.stringify(result, null, 2) + "\\n");
 `.trim();
 
+// src/builder/chunk-planner.ts
+import { basename as basename3 } from "path";
+var PUBLIC_CHUNK = "public";
+function planChunks(packages, accessMap) {
+  const assignments = new Map;
+  const groups = new Map;
+  for (const pkg of packages) {
+    const moduleName = moduleNameOf(pkg.name);
+    const access = accessMap[moduleName];
+    const chunk = resolveChunk(moduleName, access);
+    const entry = {
+      pkg,
+      chunk,
+      moduleName,
+      safeName: basename3(pkg.path)
+    };
+    assignments.set(moduleName, entry);
+    const bucket = groups.get(chunk);
+    if (bucket) {
+      bucket.push(entry);
+    } else {
+      groups.set(chunk, [entry]);
+    }
+  }
+  const chunks = [...groups.keys()].sort((a, b) => {
+    if (a === PUBLIC_CHUNK)
+      return -1;
+    if (b === PUBLIC_CHUNK)
+      return 1;
+    return a.localeCompare(b);
+  });
+  return { assignments, groups, chunks };
+}
+function moduleNameOf(pkgName) {
+  return pkgName.includes("/") ? pkgName.split("/").pop() : pkgName;
+}
+function resolveChunk(moduleName, access) {
+  if (!access || access.rules.length === 0)
+    return PUBLIC_CHUNK;
+  const tokenNames = new Set(access.rules.map((r) => r.token.name));
+  if (tokenNames.size === 1) {
+    return [...tokenNames][0];
+  }
+  const list = [...tokenNames].sort().join(", ");
+  throw new Error(`Module "${moduleName}" has access rules for multiple tokens [${list}]. ` + `Multi-token modules are not supported \u2014 split the module or unify on a single token type.`);
+}
+
+// src/builder/dependency-collector.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename4, join as join10 } from "path";
+function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = []) {
+  mkdirSync8(arcDir, { recursive: true });
+  const versions = resolveFrameworkVersions(rootDir, packages);
+  for (const { name, version } of sharedDeps) {
+    versions[name] = version;
+  }
+  const manifest = {
+    name: "arc-platform-framework",
+    private: true,
+    type: "module",
+    dependencies: versions
+  };
+  const manifestPath = join10(arcDir, "package.json");
+  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
+`);
+  const hash = sha256Hex2(readFileSync9(manifestPath));
+  writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
+`);
+  return { hash, manifestPath };
+}
+function sha256Hex2(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function resolveFrameworkVersions(rootDir, packages) {
+  const rootPkg = JSON.parse(readFileSync9(join10(rootDir, "package.json"), "utf-8"));
+  const rootDeps = rootPkg.dependencies ?? {};
+  const rootDevDeps = rootPkg.devDependencies ?? {};
+  const required = new Set(FRAMEWORK_PEERS);
+  for (const pkg of packages) {
+    const peers = pkg.packageJson.peerDependencies ?? {};
+    const deps = pkg.packageJson.dependencies ?? {};
+    for (const name of Object.keys(peers)) {
+      if (name.startsWith("@arcote.tech/"))
+        required.add(name);
+    }
+    for (const [name, spec] of Object.entries(deps)) {
+      if (spec.startsWith("workspace:"))
+        continue;
+      if (name.startsWith("@arcote.tech/") || !isFrameworkExternal(name))
+        continue;
+      required.add(name);
+    }
+  }
+  const out = {};
+  for (const name of required) {
+    const rootSpec = rootDeps[name] ?? rootDevDeps[name];
+    if (rootSpec) {
+      out[name] = rootSpec;
+      continue;
+    }
+    let found;
+    for (const pkg of packages) {
+      const spec = (pkg.packageJson.dependencies ?? {})[name] ?? (pkg.packageJson.peerDependencies ?? {})[name];
+      if (spec) {
+        found = spec;
+        break;
+      }
+    }
+    out[name] = found ?? "*";
+  }
+  return out;
+}
+function isFrameworkExternal(_name) {
+  return true;
+}
+
 // src/platform/shared.ts
 var C = {
   reset: "\x1B[0m",
@@ -27451,23 +27436,23 @@ function resolveWorkspace() {
     err("No package.json found");
     process.exit(1);
   }
-  const rootDir = dirname6(packageJsonPath);
-  const rootPkg = JSON.parse(readFileSync11(packageJsonPath, "utf-8"));
+  const rootDir = dirname7(packageJsonPath);
+  const rootPkg = JSON.parse(readFileSync10(packageJsonPath, "utf-8"));
   const appName = rootPkg.name ?? "Arc App";
-  const arcDir = join12(rootDir, ".arc", "platform");
+  const arcDir = join11(rootDir, ".arc", "platform");
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
-  ok(`Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`);
-  if (packages.length === 0 && process.env.ARC_DEPLOY_API !== "1") {
-    err("No workspace packages found.");
-    process.exit(1);
+  if (packages.length > 0) {
+    ok(`Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`);
+  } else {
+    log2("No workspace packages found \u2014 assuming image runtime mode.");
   }
   let manifest;
   for (const name of ["manifest.json", "manifest.webmanifest"]) {
-    const manifestPath = join12(rootDir, name);
+    const manifestPath = join11(rootDir, name);
     if (existsSync10(manifestPath)) {
       try {
-        const data = JSON.parse(readFileSync11(manifestPath, "utf-8"));
+        const data = JSON.parse(readFileSync10(manifestPath, "utf-8"));
         const icons = data.icons;
         manifest = {
           path: manifestPath,
@@ -27486,10 +27471,10 @@ function resolveWorkspace() {
     rootPkg,
     appName,
     arcDir,
-    modulesDir: join12(arcDir, "modules"),
-    shellDir: join12(arcDir, "shell"),
-    assetsDir: join12(arcDir, "assets"),
-    publicDir: join12(rootDir, "public"),
+    modulesDir: join11(arcDir, "modules"),
+    shellDir: join11(arcDir, "shell"),
+    assetsDir: join11(arcDir, "assets"),
+    publicDir: join11(rootDir, "public"),
     packages,
     manifest
   };
@@ -27499,29 +27484,28 @@ async function buildAll(ws, opts = {}) {
   const noCache = opts.noCache ?? false;
   const themePath = ws.rootPkg.arc?.theme;
   log2(`Building (concurrency parallel${noCache ? ", no-cache" : ""})...`);
-  const [, modulesResult] = await Promise.all([
-    buildContextPackages(ws.rootDir, ws.packages, cache, noCache),
-    buildModulesBundle(ws.rootDir, ws.modulesDir, ws.packages, cache, noCache),
-    buildShell2(ws, cache, noCache),
+  await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
+  copyContextServerBundles(ws);
+  const accessMap = await extractAccessMap(ws.rootDir, ws.packages);
+  mkdirSync9(ws.arcDir, { recursive: true });
+  writeFileSync9(join11(ws.arcDir, "access.json"), JSON.stringify(accessMap, null, 2) + `
+`);
+  const plan = planChunks(ws.packages, accessMap);
+  ok(`Chunks: ${plan.chunks.map((c) => `${c}(${plan.groups.get(c)?.length ?? 0})`).join(", ")}`);
+  const [modulesResult] = await Promise.all([
+    buildModulesByChunks(ws.rootDir, ws.modulesDir, plan, cache, noCache),
+    buildShell(ws, cache, noCache),
     buildStyles(ws.rootDir, ws.arcDir, ws.packages, themePath, cache, noCache),
     copyBrowserAssets(ws, cache, noCache),
     buildTranslations(ws.rootDir, ws.arcDir, cache, noCache)
   ]);
-  saveBuildCache(ws.arcDir, cache);
   collectFrameworkDeps(ws.arcDir, ws.rootDir, ws.packages);
-  for (const pkg of ws.packages) {
-    collectModuleDeps(ws.arcDir, pkg);
-  }
-  try {
-    await extractAccessMap(ws.arcDir, ws.packages);
-  } catch (e) {
-    err(`access-extractor failed: ${e.message}`);
-  }
-  const finalManifest = assembleManifest(ws, modulesResult.modules, cache);
-  writeFileSync10(join12(ws.modulesDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
+  saveBuildCache(ws.arcDir, cache);
+  const finalManifest = assembleManifest(ws, modulesResult.modules, plan.chunks, cache);
+  writeFileSync9(join11(ws.modulesDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
   return finalManifest;
 }
-function assembleManifest(ws, modules, cache) {
+function assembleManifest(ws, modules, chunks, cache) {
   const shellEntries = {};
   for (const [unitId, entry] of Object.entries(cache.units)) {
     if (unitId.startsWith("shell:") && entry.outputHash) {
@@ -27532,30 +27516,47 @@ function assembleManifest(ws, modules, cache) {
   const stylesHash = cache.units["styles"]?.outputHash ?? "";
   return {
     modules,
+    chunks,
     shellHash,
     stylesHash,
     buildTime: new Date().toISOString()
   };
 }
+function copyContextServerBundles(ws) {
+  const outDir = join11(ws.arcDir, "server");
+  mkdirSync9(outDir, { recursive: true });
+  for (const pkg of ws.packages) {
+    if (!isContextPackage(pkg.packageJson))
+      continue;
+    const src = join11(pkg.path, "dist", "server", "main", "index.js");
+    if (!existsSync10(src)) {
+      err(`Server bundle missing for ${pkg.name}: ${src}`);
+      continue;
+    }
+    const safeName = pkg.path.split("/").pop();
+    const dst = join11(outDir, `${safeName}.js`);
+    copyFileSync(src, dst);
+  }
+}
 function resolveAssetSource(from, pkgDir, rootDir) {
   if (from.startsWith("./") || from.startsWith("../")) {
-    const resolved = join12(pkgDir, from);
+    const resolved = join11(pkgDir, from);
     return existsSync10(resolved) ? resolved : null;
   }
   const candidates = [
-    join12(rootDir, "node_modules", from),
-    join12(pkgDir, "node_modules", from)
+    join11(rootDir, "node_modules", from),
+    join11(pkgDir, "node_modules", from)
   ];
   for (const c of candidates) {
     if (existsSync10(c))
       return c;
   }
-  const bunCacheDir = join12(rootDir, "node_modules", ".bun");
+  const bunCacheDir = join11(rootDir, "node_modules", ".bun");
   if (existsSync10(bunCacheDir)) {
-    for (const entry of readdirSync6(bunCacheDir, { withFileTypes: true })) {
+    for (const entry of readdirSync5(bunCacheDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const candidate = join12(bunCacheDir, entry.name, "node_modules", from);
+      const candidate = join11(bunCacheDir, entry.name, "node_modules", from);
       if (existsSync10(candidate))
         return candidate;
     }
@@ -27563,11 +27564,11 @@ function resolveAssetSource(from, pkgDir, rootDir) {
   return null;
 }
 function readBrowserAssets(pkgDir) {
-  const pkgJsonPath = join12(pkgDir, "package.json");
+  const pkgJsonPath = join11(pkgDir, "package.json");
   if (!existsSync10(pkgJsonPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgJsonPath, "utf-8"));
     const assets = pkg.arc?.browserAssets;
     if (!Array.isArray(assets))
       return [];
@@ -27577,14 +27578,14 @@ function readBrowserAssets(pkgDir) {
   }
 }
 function discoverBrowserAssets(ws) {
-  const arcDir = join12(ws.rootDir, "node_modules", "@arcote.tech");
+  const arcDir = join11(ws.rootDir, "node_modules", "@arcote.tech");
   if (!existsSync10(arcDir))
     return [];
   const out = [];
-  for (const entry of readdirSync6(arcDir, { withFileTypes: true })) {
+  for (const entry of readdirSync5(arcDir, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const pkgDir = join12(arcDir, entry.name);
+    const pkgDir = join11(arcDir, entry.name);
     const assets = readBrowserAssets(pkgDir);
     for (const asset of assets) {
       const src = resolveAssetSource(asset.from, pkgDir, ws.rootDir);
@@ -27598,7 +27599,7 @@ function discoverBrowserAssets(ws) {
   return out;
 }
 async function copyBrowserAssets(ws, cache, noCache) {
-  mkdirSync10(ws.assetsDir, { recursive: true });
+  mkdirSync9(ws.assetsDir, { recursive: true });
   const assets = discoverBrowserAssets(ws);
   if (assets.length === 0)
     return;
@@ -27609,7 +27610,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
     to: a.to,
     mtime: mtimeOf(a.src)
   })));
-  const requiredOutputs = assets.map((a) => join12(ws.assetsDir, a.to));
+  const requiredOutputs = assets.map((a) => join11(ws.assetsDir, a.to));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: browser-assets (${assets.length})`);
     return;
@@ -27617,10 +27618,10 @@ async function copyBrowserAssets(ws, cache, noCache) {
   console.log(`  building: browser-assets (${assets.length})`);
   const outputHashes = {};
   for (const asset of assets) {
-    const dest = join12(ws.assetsDir, asset.to);
-    mkdirSync10(dirname6(dest), { recursive: true });
+    const dest = join11(ws.assetsDir, asset.to);
+    mkdirSync9(dirname7(dest), { recursive: true });
     copyFileSync(asset.src, dest);
-    outputHashes[asset.to] = sha256Hex(readFileSync11(dest));
+    outputHashes[asset.to] = sha256Hex(readFileSync10(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
 }
@@ -27641,7 +27642,7 @@ function collectArcPeerDeps(packages) {
     return [short, pkg];
   });
 }
-var REACT_ENTRIES2 = [
+var REACT_ENTRIES = [
   [
     "react",
     `import React from "react";
@@ -27671,8 +27672,8 @@ export const { createPortal, flushSync } = ReactDOM;`
     `export { createRoot, hydrateRoot } from "react-dom/client";`
   ]
 ];
-var REACT_OUTPUT_FILES = REACT_ENTRIES2.map(([n]) => `${n}.js`);
-var SHELL_BASE_EXTERNAL2 = [
+var REACT_OUTPUT_FILES = REACT_ENTRIES.map(([n]) => `${n}.js`);
+var SHELL_BASE_EXTERNAL = [
   "react",
   "react-dom",
   "react/jsx-runtime",
@@ -27689,27 +27690,27 @@ var sourceFilter2 = (rel) => {
   return true;
 };
 function arcPkgSrcHash(rootDir, pkg) {
-  const srcDir = join12(rootDir, "node_modules", pkg, "src");
+  const srcDir = join11(rootDir, "node_modules", pkg, "src");
   if (existsSync10(srcDir))
     return sha256OfDir(srcDir, sourceFilter2);
-  return sha256OfDir(join12(rootDir, "node_modules", pkg), sourceFilter2);
+  return sha256OfDir(join11(rootDir, "node_modules", pkg), sourceFilter2);
 }
 async function buildShellReact(shellDir, tmpDir, rootDir, cache, noCache) {
   const unitId = "shell:react";
   const inputHash = sha256OfJson({
     react: readInstalledVersion(rootDir, "react"),
     "react-dom": readInstalledVersion(rootDir, "react-dom"),
-    entries: REACT_ENTRIES2.map(([k, v]) => [k, v])
+    entries: REACT_ENTRIES.map(([k, v]) => [k, v])
   });
-  const requiredOutputs = REACT_OUTPUT_FILES.map((f) => join12(shellDir, f));
+  const requiredOutputs = REACT_OUTPUT_FILES.map((f) => join11(shellDir, f));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: shell:react`);
     return;
   }
   console.log(`  building: shell:react`);
   const reactEps = [];
-  for (const [name, code] of REACT_ENTRIES2) {
-    const f = join12(tmpDir, `${name}.ts`);
+  for (const [name, code] of REACT_ENTRIES) {
+    const f = join11(tmpDir, `${name}.ts`);
     await Bun.write(f, code);
     reactEps.push(f);
   }
@@ -27736,16 +27737,16 @@ async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir,
     pkg,
     version: readInstalledVersion(rootDir, pkg),
     src: arcPkgSrcHash(rootDir, pkg),
-    base: SHELL_BASE_EXTERNAL2,
+    base: SHELL_BASE_EXTERNAL,
     others: [...otherExternals].sort()
   });
-  const outputFile = join12(shellDir, `${shortName}.js`);
+  const outputFile = join11(shellDir, `${shortName}.js`);
   if (!noCache && isCacheHit(cache, unitId, inputHash, [outputFile])) {
     console.log(`  \u2713 cached: ${unitId}`);
     return;
   }
   console.log(`  building: ${unitId}`);
-  const f = join12(tmpDir, `${shortName}.ts`);
+  const f = join11(tmpDir, `${shortName}.ts`);
   await Bun.write(f, `export * from "${pkg}";
 `);
   const r = await Bun.build({
@@ -27754,7 +27755,7 @@ async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir,
     format: "esm",
     target: "browser",
     naming: "[name].[ext]",
-    external: [...SHELL_BASE_EXTERNAL2, ...otherExternals],
+    external: [...SHELL_BASE_EXTERNAL, ...otherExternals],
     define: {
       ONLY_SERVER: "false",
       ONLY_BROWSER: "true",
@@ -27769,10 +27770,10 @@ async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir,
   const outputHash = sha256OfFiles([outputFile]);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
-async function buildShell2(ws, cache, noCache) {
-  mkdirSync10(ws.shellDir, { recursive: true });
-  const tmpDir = join12(ws.shellDir, "_tmp");
-  mkdirSync10(tmpDir, { recursive: true });
+async function buildShell(ws, cache, noCache) {
+  mkdirSync9(ws.shellDir, { recursive: true });
+  const tmpDir = join11(ws.shellDir, "_tmp");
+  mkdirSync9(tmpDir, { recursive: true });
   const arcEntries = collectArcPeerDeps(ws.packages);
   const allArcPkgs = arcEntries.map(([, pkg]) => pkg);
   const tasks = [
@@ -27780,36 +27781,43 @@ async function buildShell2(ws, cache, noCache) {
     ...arcEntries.map(([short, pkg]) => () => buildShellArcEntry(short, pkg, allArcPkgs, ws.shellDir, tmpDir, ws.rootDir, cache, noCache))
   ];
   await pAll(tasks);
-  rmSync3(tmpDir, { recursive: true, force: true });
+  rmSync2(tmpDir, { recursive: true, force: true });
 }
-async function loadServerContext(packages) {
-  const ctxPackages = packages.filter((p) => isContextPackage(p.packageJson));
-  if (ctxPackages.length === 0)
-    return { context: null, moduleAccess: new Map };
+async function loadServerContext(ws) {
   globalThis.ONLY_SERVER = true;
   globalThis.ONLY_BROWSER = false;
   globalThis.ONLY_CLIENT = false;
-  const platformDir = join12(process.cwd(), "node_modules", "@arcote.tech", "platform");
-  const platformPkg = JSON.parse(readFileSync11(join12(platformDir, "package.json"), "utf-8"));
-  const platformEntry = join12(platformDir, platformPkg.main ?? "src/index.ts");
+  const platformDir = join11(process.cwd(), "node_modules", "@arcote.tech", "platform");
+  const platformPkg = JSON.parse(readFileSync10(join11(platformDir, "package.json"), "utf-8"));
+  const platformEntry = join11(platformDir, platformPkg.main ?? "src/index.ts");
   await import(platformEntry);
-  for (const ctx of ctxPackages) {
-    const serverDist = join12(ctx.path, "dist", "server", "main", "index.js");
-    if (!existsSync10(serverDist)) {
-      err(`Context server dist not found: ${serverDist}`);
-      continue;
+  const serverDir = join11(ws.arcDir, "server");
+  const bundles = existsSync10(serverDir) ? readdirSync5(serverDir).filter((f) => f.endsWith(".js")) : [];
+  if (bundles.length > 0) {
+    for (const file of bundles) {
+      const bundlePath = join11(serverDir, file);
+      try {
+        await import(bundlePath);
+      } catch (e) {
+        err(`Failed to load server bundle ${file}: ${e}`);
+      }
     }
-    try {
-      await import(serverDist);
-    } catch (e) {
-      err(`Failed to load server context from ${ctx.name}: ${e}`);
+  } else if (ws.packages.length > 0) {
+    const ctxPackages = ws.packages.filter((p) => isContextPackage(p.packageJson));
+    for (const ctx of ctxPackages) {
+      const serverDist = join11(ctx.path, "dist", "server", "main", "index.js");
+      if (!existsSync10(serverDist)) {
+        err(`Context server dist not found: ${serverDist}`);
+        continue;
+      }
+      try {
+        await import(serverDist);
+      } catch (e) {
+        err(`Failed to load server context from ${ctx.name}: ${e}`);
+      }
     }
-  }
-  const nonCtxPackages = packages.filter((p) => !isContextPackage(p.packageJson));
-  for (const pkg of nonCtxPackages) {
-    try {
-      await import(pkg.entrypoint);
-    } catch {}
+  } else {
+    return { context: null, moduleAccess: new Map };
   }
   const { getContext, getAllModuleAccess } = await import(platformEntry);
   return {
@@ -27826,19 +27834,21 @@ async function platformBuild(opts = {}) {
 }
 
 // src/commands/platform-deploy.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { dirname as dirname9, join as join17 } from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/deploy/bootstrap.ts
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync14 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join16 } from "path";
+var {spawn: spawn4 } = globalThis.Bun;
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync13 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join15 } from "path";
 
 // src/deploy/ansible.ts
 import { spawn as nodeSpawn } from "child_process";
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { tmpdir } from "os";
+import { join as join12 } from "path";
 
 // src/deploy/assets.ts
 var TERRAFORM_MAIN_TF = `terraform {
@@ -28095,18 +28105,18 @@ var ASSETS = {
   }
 };
 async function materializeAssets(targetDir, files) {
-  const { mkdirSync: mkdirSync11, writeFileSync: writeFileSync11 } = await import("fs");
-  const { join: join13 } = await import("path");
-  mkdirSync11(targetDir, { recursive: true });
+  const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync10 } = await import("fs");
+  const { join: join12 } = await import("path");
+  mkdirSync10(targetDir, { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    writeFileSync11(join13(targetDir, name), content);
+    writeFileSync10(join12(targetDir, name), content);
   }
 }
 
 // src/deploy/ansible.ts
 async function runAnsible(inputs) {
-  const workDir = join13(tmpdir2(), "arc-deploy", `ansible-${Date.now()}`);
-  mkdirSync11(workDir, { recursive: true });
+  const workDir = join12(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
+  mkdirSync10(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.ansible);
   const user = inputs.asRoot ? "root" : inputs.target.user;
   const port = inputs.ansible?.sshPort ?? inputs.target.port;
@@ -28120,7 +28130,7 @@ async function runAnsible(inputs) {
     ""
   ].join(`
 `);
-  writeFileSync11(join13(workDir, "inventory.ini"), inventory);
+  writeFileSync10(join12(workDir, "inventory.ini"), inventory);
   const extraVarsJson = JSON.stringify({
     username: inputs.target.user,
     ssh_port: port,
@@ -28159,22 +28169,17 @@ function generateCaddyfile(cfg) {
   lines.push("");
   for (const [name, env2] of Object.entries(cfg.envs)) {
     lines.push(`${env2.domain} {${tlsDirective}`);
-    lines.push("    @deploy path /api/deploy /api/deploy/*");
-    lines.push("    respond @deploy 404");
-    lines.push("");
     lines.push(`    reverse_proxy arc-${name}:5005`);
     lines.push("}");
     lines.push("");
   }
-  lines.push("# Loopback-only management listener (SSH tunnel access).");
-  lines.push("http://127.0.0.1:2019 {");
-  lines.push("    bind 127.0.0.1");
-  for (const [name] of Object.entries(cfg.envs)) {
-    lines.push(`    handle_path /env/${name}/* {`);
-    lines.push(`        reverse_proxy arc-${name}:5005`);
-    lines.push(`    }`);
-  }
-  lines.push("    respond 404");
+  lines.push(`${cfg.registry.domain} {${tlsDirective}`);
+  lines.push("    reverse_proxy registry:5000 {");
+  lines.push("        header_up Host {host}");
+  lines.push("    }");
+  lines.push("    request_body {");
+  lines.push("        max_size 5GB");
+  lines.push("    }");
   lines.push("}");
   return lines.join(`
 `) + `
@@ -28182,8 +28187,7 @@ function generateCaddyfile(cfg) {
 }
 
 // src/deploy/compose.ts
-var RESERVED_ENV = new Set(["PORT", "ARC_DEPLOY_API", "ARC_CLI_VERSION"]);
-function generateCompose({ cfg, cliVersion }) {
+function generateCompose({ cfg }) {
   const lines = [];
   lines.push("# Generated by `arc platform deploy` \u2014 do not edit by hand.");
   lines.push("");
@@ -28194,7 +28198,6 @@ function generateCompose({ cfg, cliVersion }) {
   lines.push("    ports:");
   lines.push('      - "80:80"');
   lines.push('      - "443:443"');
-  lines.push('      - "127.0.0.1:2019:2019"');
   lines.push("    volumes:");
   lines.push("      - ./Caddyfile:/etc/caddy/Caddyfile:ro");
   lines.push("      - caddy_data:/data");
@@ -28202,25 +28205,39 @@ function generateCompose({ cfg, cliVersion }) {
   lines.push("    networks:");
   lines.push("      - arc-net");
   lines.push("");
+  lines.push("  registry:");
+  lines.push("    image: registry:2");
+  lines.push("    restart: unless-stopped");
+  lines.push("    volumes:");
+  lines.push("      - registry_data:/var/lib/registry");
+  lines.push("      - ./registry-auth/htpasswd:/auth/htpasswd:ro");
+  lines.push("    environment:");
+  lines.push("      REGISTRY_AUTH: htpasswd");
+  lines.push('      REGISTRY_AUTH_HTPASSWD_REALM: "Arc Registry"');
+  lines.push("      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd");
+  lines.push('      REGISTRY_HTTP_HOST: "https://' + cfg.registry.domain + '"');
+  lines.push("    networks:");
+  lines.push("      - arc-net");
+  lines.push("    expose:");
+  lines.push('      - "5000"');
+  lines.push("");
   for (const [name, env2] of Object.entries(cfg.envs)) {
+    const upperName = name.toUpperCase().replace(/-/g, "_");
     lines.push(`  arc-${name}:`);
-    lines.push("    image: pkrasinski/arc-runtime:1");
+    lines.push(`    image: \${ARC_IMAGE_${upperName}:?Run \\\`arc platform deploy ${name}\\\` to publish an image first}`);
+    lines.push(`    container_name: arc-${name}`);
     lines.push("    restart: unless-stopped");
     lines.push("    volumes:");
-    lines.push(`      - arc-platform-${name}:/app/.arc/platform`);
     lines.push(`      - arc-data-${name}:/app/.arc/data`);
-    lines.push("      - arc-cli-cache:/app/.arc/cli");
-    lines.push("      - arc-bun-cache:/root/.bun/install/cache");
     lines.push("    environment:");
     lines.push("      PORT: 5005");
-    lines.push('      ARC_DEPLOY_API: "1"');
-    lines.push(`      ARC_CLI_VERSION: ${JSON.stringify(cliVersion)}`);
     const userEnv = env2.envVars ?? {};
     if (!("NODE_ENV" in userEnv)) {
       lines.push("      NODE_ENV: production");
     }
+    const reserved = new Set(["PORT"]);
     for (const [k, v] of Object.entries(userEnv)) {
-      if (RESERVED_ENV.has(k))
+      if (reserved.has(k))
         continue;
       lines.push(`      ${k}: ${JSON.stringify(v)}`);
     }
@@ -28236,10 +28253,8 @@ function generateCompose({ cfg, cliVersion }) {
   lines.push("volumes:");
   lines.push("  caddy_data:");
   lines.push("  caddy_config:");
-  lines.push("  arc-cli-cache:");
-  lines.push("  arc-bun-cache:");
+  lines.push("  registry_data:");
   for (const [name] of Object.entries(cfg.envs)) {
-    lines.push(`  arc-platform-${name}:`);
     lines.push(`  arc-data-${name}:`);
   }
   return lines.join(`
@@ -28247,16 +28262,29 @@ function generateCompose({ cfg, cliVersion }) {
 `;
 }
 
+// src/deploy/htpasswd.ts
+async function generateHtpasswd(user, password) {
+  if (!user || !password) {
+    throw new Error("htpasswd: user and password must both be non-empty");
+  }
+  const hash = await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+  return `${user}:${hash}
+`;
+}
+
 // src/deploy/terraform.ts
 import { spawn as nodeSpawn2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
 import { homedir } from "os";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 async function runTerraform(inputs) {
   const wsHash = createHash2("sha256").update(inputs.workspaceDir).digest("hex").slice(0, 16);
-  const workDir = join14(homedir(), ".arc-deploy", wsHash, "tf");
-  mkdirSync12(workDir, { recursive: true });
+  const workDir = join13(homedir(), ".arc-deploy", wsHash, "tf");
+  mkdirSync11(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.terraform);
   const sshPubKey = inputs.tf.sshPublicKey ?? expandHome("~/.ssh/id_ed25519.pub");
   if (!existsSync11(expandHome(sshPubKey))) {
@@ -28272,7 +28300,7 @@ async function runTerraform(inputs) {
   ].join(`
 `) + `
 `;
-  writeFileSync12(join14(workDir, "terraform.tfvars"), tfvars);
+  writeFileSync11(join13(workDir, "terraform.tfvars"), tfvars);
   await runTf(workDir, ["init", "-input=false", "-no-color"]);
   await runTf(workDir, [
     "apply",
@@ -28330,11 +28358,11 @@ function expandHome(p) {
 }
 
 // src/deploy/config.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync13 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync12 } from "fs";
+import { join as join14 } from "path";
 var DEPLOY_CONFIG_FILE = "deploy.arc.json";
 function deployConfigPath(rootDir) {
-  return join15(rootDir, DEPLOY_CONFIG_FILE);
+  return join14(rootDir, DEPLOY_CONFIG_FILE);
 }
 function deployConfigExists(rootDir) {
   return existsSync12(deployConfigPath(rootDir));
@@ -28344,7 +28372,7 @@ function loadDeployConfig(rootDir) {
   if (!existsSync12(path4)) {
     throw new Error(`Missing ${DEPLOY_CONFIG_FILE} at ${path4}`);
   }
-  const raw = readFileSync12(path4, "utf-8");
+  const raw = readFileSync11(path4, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -28356,9 +28384,9 @@ function loadDeployConfig(rootDir) {
 }
 function saveDeployConfig(rootDir, cfg) {
   const path4 = deployConfigPath(rootDir);
-  const raw = existsSync12(path4) ? JSON.parse(readFileSync12(path4, "utf-8")) : {};
+  const raw = existsSync12(path4) ? JSON.parse(readFileSync11(path4, "utf-8")) : {};
   raw.target = { ...raw.target, ...cfg.target };
-  writeFileSync13(path4, JSON.stringify(raw, null, 2) + `
+  writeFileSync12(path4, JSON.stringify(raw, null, 2) + `
 `);
 }
 var VAR_REGEX = /\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g;
@@ -28384,6 +28412,15 @@ function validateDeployConfig(input) {
   const target = requireObject(input, "target");
   const envs = requireObject(input, "envs");
   const caddy = requireObject(input, "caddy");
+  const registry = requireObject(input, "registry");
+  const registryDomain = requireString(registry, "registry.domain");
+  if (!/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(registryDomain)) {
+    throw new Error(`deploy.arc.json: registry.domain "${registryDomain}" doesn't look like a domain`);
+  }
+  const passwordEnv = requireString(registry, "registry.passwordEnv");
+  if (!/^[A-Z][A-Z0-9_]*$/.test(passwordEnv)) {
+    throw new Error(`deploy.arc.json: registry.passwordEnv "${passwordEnv}" must be an UPPER_SNAKE_CASE env var name`);
+  }
   const validated = {
     target: {
       host: requireString(target, "target.host"),
@@ -28395,6 +28432,11 @@ function validateDeployConfig(input) {
     envs: {},
     caddy: {
       email: requireString(caddy, "caddy.email")
+    },
+    registry: {
+      domain: registryDomain,
+      username: optionalString(registry, "registry.username") ?? "deploy",
+      passwordEnv
     }
   };
   const envKeys = Object.keys(envs);
@@ -28516,19 +28558,17 @@ async function streamToString(stream2) {
   return new Response(stream2).text();
 }
 function baseSshArgs(target) {
-  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
-  return [
+  const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
-    "-o",
-    "IdentitiesOnly=yes",
-    "-i",
-    key,
     "-p",
     String(target.port)
   ];
+  if (target.sshKey)
+    args.push("-i", target.sshKey);
+  return args;
 }
 async function sshExec(target, cmd, opts = {}) {
   const args = [
@@ -28582,19 +28622,16 @@ async function waitForSsh(target, opts = {}) {
   throw new Error(`Timed out waiting for SSH on ${target.user}@${target.host}`);
 }
 async function scpUpload(target, localPath, remotePath) {
-  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
-    "-o",
-    "IdentitiesOnly=yes",
-    "-i",
-    key,
     "-P",
     String(target.port)
   ];
+  if (target.sshKey)
+    args.push("-i", target.sshKey);
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
   const proc2 = spawn3({ cmd: ["scp", ...args], stderr: "pipe" });
   const [stderr, exitCode] = await Promise.all([
@@ -28605,52 +28642,6 @@ async function scpUpload(target, localPath, remotePath) {
     throw new Error(`scp failed (${exitCode}): ${stderr}`);
   }
 }
-async function openTunnel(target, localPort, remoteHost, remotePort) {
-  const args = [
-    ...baseSshArgs(target),
-    "-N",
-    "-L",
-    `${localPort}:${remoteHost}:${remotePort}`,
-    `${target.user}@${target.host}`
-  ];
-  const proc2 = spawn3({
-    cmd: ["ssh", ...args],
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const deadline = Date.now() + 1e4;
-  let lastErr;
-  while (Date.now() < deadline) {
-    if (proc2.exitCode !== null) {
-      const stderr = await streamToString(proc2.stderr);
-      throw new Error(`ssh tunnel exited early: ${stderr}`);
-    }
-    try {
-      const probe = await Bun.connect({
-        hostname: "127.0.0.1",
-        port: localPort,
-        socket: { data() {}, open() {}, close() {}, error() {} }
-      });
-      probe.end();
-      return {
-        localPort,
-        close() {
-          try {
-            proc2.kill();
-          } catch {}
-        }
-      };
-    } catch (e) {
-      lastErr = e;
-      await Bun.sleep(200);
-    }
-  }
-  try {
-    proc2.kill();
-  } catch {}
-  throw new Error(`Failed to establish SSH tunnel on localhost:${localPort}: ${String(lastErr)}`);
-}
 
 // src/deploy/remote-state.ts
 var STATE_MARKER_PATH = "/opt/arc/.arc-state.json";
@@ -28733,202 +28724,373 @@ async function bootstrap(inputs) {
     });
     ok("Host bootstrapped");
   }
-  if (state.kind !== "ready") {
-    await upStack(inputs);
-    ok("Docker stack up");
+  if (state.kind !== "ready") {
+    await upStack(inputs);
+    ok("Docker stack up");
+  }
+  await writeStateMarker(cfg.target, {
+    cliVersion: inputs.cliVersion,
+    configHash: inputs.configHash,
+    updatedAt: new Date().toISOString()
+  });
+}
+async function upStack(inputs) {
+  const { cfg } = inputs;
+  const workDir = join15(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
+  mkdirSync12(workDir, { recursive: true });
+  await assertRegistryDnsResolves(cfg);
+  const password = process.env[cfg.registry.passwordEnv];
+  if (!password) {
+    throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set. ` + `Set it (e.g. \`export ${cfg.registry.passwordEnv}=...\`) before bootstrap.`);
+  }
+  const htpasswdLine = await generateHtpasswd(cfg.registry.username, password);
+  writeFileSync13(join15(workDir, "htpasswd"), htpasswdLine);
+  writeFileSync13(join15(workDir, "Caddyfile"), generateCaddyfile(cfg));
+  writeFileSync13(join15(workDir, "docker-compose.yml"), generateCompose({ cfg }));
+  await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
+  for (const name of Object.keys(cfg.envs)) {
+    await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
+  }
+  await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/registry-auth`);
+  await scpUpload(cfg.target, join15(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
+  await scpUpload(cfg.target, join15(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
+  await scpUpload(cfg.target, join15(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
+  await assertExec(cfg.target, `touch ${cfg.target.remoteDir}/.env`);
+  await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose pull --ignore-pull-failures caddy registry && docker compose up -d caddy registry`);
+  await sshDockerLogin(cfg);
+  const knownEnvs = await listConfiguredEnvs(cfg);
+  if (knownEnvs.length > 0) {
+    await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose up -d ${knownEnvs.map((e) => `arc-${e}`).join(" ")}`);
+  }
+}
+async function sshDockerLogin(cfg) {
+  const password = process.env[cfg.registry.passwordEnv];
+  if (!password) {
+    throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set on the deploy host (CLI machine).`);
+  }
+  const cmd = `echo "$ARC_REGISTRY_PASSWORD_FORWARDED" | docker login ${cfg.registry.domain} -u ${cfg.registry.username} --password-stdin`;
+  const proc2 = spawn4({
+    cmd: [
+      "ssh",
+      ...baseSshArgs(cfg.target),
+      `${cfg.target.user}@${cfg.target.host}`,
+      "--",
+      `ARC_REGISTRY_PASSWORD_FORWARDED='${password.replace(/'/g, "'\\''")}' bash -c ${JSON.stringify(cmd)}`
+    ],
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    const stderr = await new Response(proc2.stderr).text();
+    throw new Error(`Server-side docker login failed (exit ${exit}): ${stderr.trim()}`);
+  }
+}
+async function listConfiguredEnvs(cfg) {
+  const res = await sshExec(cfg.target, `cat ${cfg.target.remoteDir}/.env 2>/dev/null || true`, { quiet: true });
+  const set = new Set;
+  for (const line of res.stdout.split(`
+`)) {
+    const m = line.match(/^ARC_IMAGE_([A-Z0-9_]+)=/);
+    if (!m)
+      continue;
+    const lowerName = m[1].toLowerCase().replace(/_/g, "-");
+    if (lowerName in cfg.envs)
+      set.add(lowerName);
   }
-  await writeStateMarker(cfg.target, {
-    cliVersion: inputs.cliVersion,
-    configHash: inputs.configHash,
-    updatedAt: new Date().toISOString()
+  return [...set];
+}
+async function assertRegistryDnsResolves(cfg) {
+  const proc2 = spawn4({
+    cmd: ["dig", "+short", "+time=3", "+tries=1", cfg.registry.domain],
+    stdout: "pipe",
+    stderr: "ignore"
   });
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    err(`\`dig\` is not available \u2014 skipping DNS pre-flight for ${cfg.registry.domain}.`);
+    return;
+  }
+  const resolved = (await new Response(proc2.stdout).text()).split(`
+`).map((s) => s.trim()).filter(Boolean);
+  if (resolved.length === 0) {
+    throw new Error(`Registry DNS not configured: ${cfg.registry.domain} doesn't resolve. ` + `Add an A record pointing to ${cfg.target.host} and re-run deploy.`);
+  }
+  if (!resolved.includes(cfg.target.host)) {
+    throw new Error(`Registry DNS mismatch: ${cfg.registry.domain} resolves to [${resolved.join(", ")}], ` + `but target host is ${cfg.target.host}. Update the A record before continuing.`);
+  }
+}
+
+// src/deploy/deploy-env.ts
+var HEALTH_RETRIES = 10;
+var HEALTH_DELAY_MS = 1000;
+async function updateEnvDeployment(opts) {
+  const { target, cfg, env: env2, fullRef } = opts;
+  const upperEnv = env2.toUpperCase().replace(/-/g, "_");
+  const envVarName = `ARC_IMAGE_${upperEnv}`;
+  const envPath = `${cfg.target.remoteDir}/.env`;
+  const escapedRef = fullRef.replace(/"/g, "\\\"");
+  const updateScript = [
+    `touch ${envPath}`,
+    `awk -v line="${envVarName}=${escapedRef}" -v key="${envVarName}=" '`,
+    `  BEGIN { replaced=0 } `,
+    `  $0 ~ "^"key { print line; replaced=1; next } `,
+    `  { print } `,
+    `  END { if (!replaced) print line } `,
+    `' ${envPath} > ${envPath}.tmp && mv ${envPath}.tmp ${envPath}`
+  ].join("");
+  await assertExec(target, updateScript);
+  await assertExec(target, `cd ${cfg.target.remoteDir} && docker compose pull arc-${env2}`);
+  await assertExec(target, `cd ${cfg.target.remoteDir} && docker compose up -d arc-${env2}`);
+  const retain = opts.retainImages ?? 3;
+  const imageBaseName = imageBaseFromRef(fullRef);
+  if (imageBaseName) {
+    const pruneScript = [
+      `docker images "${imageBaseName}" --format "{{.Repository}}:{{.Tag}} {{.CreatedAt}}" `,
+      `| grep -v ":latest " `,
+      `| sort -k2,3 -r `,
+      `| tail -n +${retain + 1} `,
+      `| awk '{print $1}' `,
+      `| xargs -r docker rmi 2>/dev/null || true`
+    ].join("");
+    await sshExec(target, pruneScript, { quiet: true });
+  }
+  const ok2 = await healthCheck(target, env2);
+  return { env: env2, fullRef, redeployed: ok2 };
+}
+function imageBaseFromRef(fullRef) {
+  const colonIdx = fullRef.lastIndexOf(":");
+  return colonIdx > 0 ? fullRef.slice(0, colonIdx) : null;
+}
+async function healthCheck(target, env2) {
+  for (let i = 0;i < HEALTH_RETRIES; i++) {
+    const res = await sshExec(target, `docker exec arc-${env2} wget -qO- http://localhost:5005/health 2>&1 || echo HEALTHCHECK_FAILED`, { quiet: true });
+    if (res.exitCode === 0 && !res.stdout.includes("HEALTHCHECK_FAILED")) {
+      return true;
+    }
+    await sleep(HEALTH_DELAY_MS);
+  }
+  return false;
 }
-async function upStack(inputs) {
-  const { cfg } = inputs;
-  const workDir = join16(tmpdir3(), "arc-deploy", `stack-${Date.now()}`);
-  mkdirSync13(workDir, { recursive: true });
-  writeFileSync14(join16(workDir, "Caddyfile"), generateCaddyfile(cfg));
-  writeFileSync14(join16(workDir, "docker-compose.yml"), generateCompose({ cfg, cliVersion: inputs.cliVersion }));
-  await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
-  for (const name of Object.keys(cfg.envs)) {
-    await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/deploy/image.ts
+var {spawn: spawn5 } = globalThis.Bun;
+import { createHash as createHash3 } from "crypto";
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync12,
+  realpathSync as realpathSync3,
+  writeFileSync as writeFileSync14
+} from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname8, join as join16 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
+
+// src/deploy/image-template.ts
+function generateDockerfile(inputs) {
+  const conditionalCopies = [];
+  if (inputs.hasPublicDir) {
+    conditionalCopies.push("COPY public/ /app/public/");
+  }
+  if (inputs.hasManifest && inputs.manifestPath) {
+    conditionalCopies.push(`COPY ${inputs.manifestPath} /app/${inputs.manifestPath}`);
+  }
+  if (inputs.hasLocales) {
+    conditionalCopies.push("COPY locales/ /app/locales/");
   }
-  await scpUpload(cfg.target, join16(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
-  await scpUpload(cfg.target, join16(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
-  await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose pull --ignore-pull-failures && docker compose up -d`);
+  return [
+    "# Generated by `arc platform deploy` \u2014 do not edit by hand.",
+    "FROM oven/bun:1-alpine",
+    "",
+    "RUN apk add --no-cache tini ca-certificates",
+    "",
+    "WORKDIR /app",
+    "",
+    "# Layer 1 \u2014 framework peers as /app/package.json + install into /app/node_modules.",
+    "# resolveWorkspace() walks up looking for the first package.json (finds /app/),",
+    "# loadServerContext resolves @arcote.tech/platform from /app/node_modules.",
+    "# Cached, invalidates only on .arc/platform/package.json change.",
+    "COPY .arc/platform/package.json /app/package.json",
+    "RUN cd /app && bun install --production --no-save",
+    "",
+    "# Layer 2 \u2014 user artifacts (chunks, shell, styles, server bundles, host.js).",
+    "# host.js IS the arc-cli bundle \u2014 `arc platform deploy` copied it here from",
+    "# whatever arc-cli was on the user's PATH. No npm dependency at runtime.",
+    "COPY .arc/platform/ /app/.arc/platform/",
+    ...conditionalCopies,
+    "",
+    "ENV PORT=5005",
+    "ENV NODE_ENV=production",
+    "EXPOSE 5005",
+    "",
+    'ENTRYPOINT ["tini", "--"]',
+    'CMD ["bun", "run", "/app/.arc/platform/host.js", "platform", "start"]',
+    ""
+  ].join(`
+`);
 }
 
-// src/deploy/remote-sync.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
-import { basename as basename5, join as join17 } from "path";
-function diffManifests(local, remote) {
-  const remoteByName = new Map(remote.modules.map((m) => [m.name, m]));
-  const changedModules = local.modules.filter((m) => remoteByName.get(m.name)?.hash !== m.hash);
-  return {
-    changedModules: [...changedModules],
-    stylesChanged: local.stylesHash !== remote.stylesHash
-  };
-}
-async function syncEnv(inputs) {
-  const { cfg, env: env2, ws } = inputs;
-  const envConfig = cfg.envs[env2];
-  if (!envConfig)
-    throw new Error(`Unknown env: ${env2}`);
-  const localManifestPath = join17(ws.modulesDir, "manifest.json");
-  if (!existsSync13(localManifestPath)) {
-    throw new Error(`Local build missing at ${localManifestPath}. Run arc platform build first.`);
-  }
-  const localManifest = JSON.parse(readFileSync13(localManifestPath, "utf-8"));
-  const pkgByName = new Map(ws.packages.map((p) => [p.name.includes("/") ? p.name.split("/").pop() : p.name, p]));
-  let tunnel = await openTunnel(cfg.target, 15500 + hashEnvToOffset(env2), "127.0.0.1", 2019);
-  let restarts = 0;
-  let frameworkChanged = false;
-  try {
-    const base2 = () => `http://127.0.0.1:${tunnel.localPort}/env/${env2}`;
-    const localFrameworkHash = readDepsHash(join17(ws.arcDir, ".deps-hash"));
-    const remoteFwRes = await fetch(`${base2()}/api/deploy/framework`);
-    const remoteFw = remoteFwRes.ok ? await remoteFwRes.json() : { depsHash: null };
-    if (localFrameworkHash && localFrameworkHash !== remoteFw.depsHash) {
-      console.log("[arc] Pushing framework deps...");
-      const form = new FormData;
-      form.append("package.json", new Blob([readFileSync13(join17(ws.arcDir, "package.json"))]), "package.json");
-      form.append("bun.lock", new Blob([""]), "bun.lock");
-      const res = await fetch(`${base2()}/api/deploy/framework`, {
-        method: "POST",
-        body: form
-      });
-      if (!res.ok) {
-        throw new Error(`framework push failed: ${res.status} ${await res.text()}`);
-      }
-      frameworkChanged = true;
-      const result = await res.json();
-      if (result.needsRestart) {
-        tunnel = await restartAndReopen(cfg, env2, tunnel);
-        restarts += 1;
-      }
-    }
-    const remoteManifestRes = await fetch(`${base2()}/api/deploy/manifest`);
-    const remoteManifest = remoteManifestRes.ok ? await remoteManifestRes.json() : {
-      modules: [],
-      shellHash: "",
-      stylesHash: "",
-      buildTime: ""
-    };
-    const diff = diffManifests(localManifest, remoteManifest);
-    for (const mod of diff.changedModules) {
-      const safeName = sanitizeName(mod.name);
-      const moduleDir = join17(ws.modulesDir, safeName);
-      const browserPath = join17(moduleDir, "browser.js");
-      const serverPath = join17(moduleDir, "server.js");
-      const pkgPath = join17(moduleDir, "package.json");
-      const accessPath = join17(moduleDir, "access.json");
-      const browserActual = existsSync13(browserPath) ? browserPath : join17(ws.modulesDir, `${safeName}.js`);
-      if (!existsSync13(browserActual)) {
-        throw new Error(`Missing browser bundle for module ${mod.name}`);
-      }
-      const form = new FormData;
-      form.append("browser.js", new Blob([readFileSync13(browserActual)]), "browser.js");
-      const pkg = pkgByName.get(safeName);
-      if (pkg && isContextPackage(pkg.packageJson) && existsSync13(serverPath)) {
-        form.append("server.js", new Blob([readFileSync13(serverPath)]), "server.js");
-      }
-      if (existsSync13(pkgPath)) {
-        form.append("package.json", new Blob([readFileSync13(pkgPath)]), "package.json");
-      }
-      if (existsSync13(accessPath)) {
-        form.append("access.json", new Blob([readFileSync13(accessPath)]), "access.json");
-      }
-      console.log(`[arc] Pushing module ${safeName}...`);
-      const res = await fetch(`${base2()}/api/deploy/modules/${safeName}`, {
-        method: "POST",
-        body: form
-      });
-      if (!res.ok) {
-        throw new Error(`module ${safeName} push failed: ${res.status} ${await res.text()}`);
-      }
-    }
-    if (diff.stylesChanged) {
-      console.log("[arc] Pushing styles...");
-      const form = new FormData;
-      for (const name of ["styles.css", "theme.css"]) {
-        const p = join17(ws.arcDir, name);
-        if (existsSync13(p)) {
-          form.append(name, new Blob([readFileSync13(p)]), name);
+// src/deploy/image.ts
+async function buildImage(ws, opts) {
+  await ensureDocker();
+  const manifestPath = join16(ws.modulesDir, "manifest.json");
+  if (!existsSync13(manifestPath)) {
+    throw new Error(`No build manifest at ${manifestPath}. Run \`arc platform build\` first or omit --skip-build.`);
+  }
+  embedCliBundle(ws);
+  const contentHash = computeContentHash(manifestPath);
+  const imageTag = `${opts.imageName}:${contentHash}`;
+  const fullRef = opts.registryDomain ? `${opts.registryDomain}/${imageTag}` : imageTag;
+  const dockerfileInputs = collectDockerfileInputs(ws);
+  const dockerfile = generateDockerfile(dockerfileInputs);
+  const buildContextDir = ws.rootDir;
+  const dockerfileDir = join16(tmpdir3(), `arc-image-${Date.now()}`);
+  mkdirSync13(dockerfileDir, { recursive: true });
+  const dockerfilePath = join16(dockerfileDir, "Dockerfile");
+  writeFileSync14(dockerfilePath, dockerfile);
+  const buildArgs = [
+    "build",
+    "-f",
+    dockerfilePath,
+    "-t",
+    fullRef,
+    "-t",
+    `${opts.imageName}:latest`,
+    buildContextDir
+  ];
+  const proc2 = spawn5({
+    cmd: ["docker", ...buildArgs],
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    throw new Error(`docker build failed (exit ${exit})`);
+  }
+  return { imageTag, fullRef, contentHash };
+}
+function embedCliBundle(ws) {
+  const source = locateCliBundle();
+  const target = join16(ws.arcDir, "host.js");
+  copyFileSync2(source, target);
+}
+function locateCliBundle() {
+  const here = fileURLToPath6(import.meta.url);
+  let cur = dirname8(here);
+  while (cur !== "/" && cur !== "") {
+    const candidate = join16(cur, "package.json");
+    if (existsSync13(candidate)) {
+      try {
+        const pkg = JSON.parse(readFileSync12(candidate, "utf-8"));
+        if (pkg.name === "@arcote.tech/arc-cli") {
+          const distIndex = join16(realpathSync3(cur), "dist", "index.js");
+          if (!existsSync13(distIndex)) {
+            throw new Error(`arc-cli bundle missing at ${distIndex}. Run \`bun run build\` in packages/cli/.`);
+          }
+          return distIndex;
         }
+      } catch (e) {
+        if (e instanceof Error && e.message.startsWith("arc-cli bundle"))
+          throw e;
       }
-      const res = await fetch(`${base2()}/api/deploy/styles`, {
-        method: "POST",
-        body: form
-      });
-      if (!res.ok) {
-        throw new Error(`styles push failed: ${res.status} ${await res.text()}`);
-      }
-    }
-    const commitRes = await fetch(`${base2()}/api/deploy/manifest`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(localManifest)
-    });
-    if (!commitRes.ok) {
-      throw new Error(`manifest commit failed: ${commitRes.status} ${await commitRes.text()}`);
     }
-    const commit = await commitRes.json();
-    if (commit.needsRestart) {
-      tunnel = await restartAndReopen(cfg, env2, tunnel);
-      restarts += 1;
-    }
-    return {
-      env: env2,
-      frameworkChanged,
-      changedModules: diff.changedModules.map((m) => m.name),
-      stylesChanged: diff.stylesChanged,
-      restarts
-    };
-  } finally {
-    tunnel.close();
+    const parent = dirname8(cur);
+    if (parent === cur)
+      break;
+    cur = parent;
   }
+  throw new Error("Could not locate @arcote.tech/arc-cli package.json walking up from " + here);
 }
-function readDepsHash(path4) {
-  if (!existsSync13(path4))
-    return null;
-  return readFileSync13(path4, "utf-8").trim() || null;
-}
-function sanitizeName(name) {
-  return basename5(name);
-}
-async function restartAndReopen(cfg, env2, oldTunnel) {
-  console.log(`[arc] Restarting arc-${env2}...`);
-  oldTunnel.close();
-  await assertExec(cfg.target, `docker restart arc-${env2}`);
-  const tunnel = await openTunnel(cfg.target, 15500 + hashEnvToOffset(env2), "127.0.0.1", 2019);
-  await waitForHealthy(`http://127.0.0.1:${tunnel.localPort}/env/${env2}`, 60000);
-  return tunnel;
-}
-async function waitForHealthy(baseUrl, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  let lastErr;
-  while (Date.now() < deadline) {
-    try {
-      const res = await fetch(`${baseUrl}/api/deploy/health`, {
-        signal: AbortSignal.timeout(2000)
-      });
-      if (res.ok)
-        return;
-      lastErr = `status ${res.status}`;
-    } catch (e) {
-      lastErr = e;
+async function ensureDocker() {
+  try {
+    const proc2 = spawn5({
+      cmd: ["docker", "--version"],
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exit = await proc2.exited;
+    if (exit !== 0)
+      throw new Error("docker --version exited non-zero");
+  } catch {
+    throw new Error("Docker is not available on PATH. Install Docker Desktop (or docker engine + buildx) before running deploy.");
+  }
+}
+function computeContentHash(manifestPath) {
+  const raw = JSON.parse(readFileSync12(manifestPath, "utf-8"));
+  delete raw.buildTime;
+  const canonical = JSON.stringify(raw);
+  return createHash3("sha256").update(canonical).digest("hex").slice(0, 12);
+}
+function collectDockerfileInputs(ws) {
+  const hasPublicDir = existsSync13(join16(ws.rootDir, "public"));
+  const hasLocales = existsSync13(join16(ws.rootDir, "locales"));
+  let manifestPath;
+  for (const name of ["manifest.webmanifest", "manifest.json"]) {
+    if (existsSync13(join16(ws.rootDir, name))) {
+      manifestPath = name;
+      break;
     }
-    await new Promise((r) => setTimeout(r, 1000));
   }
-  throw new Error(`Health check timeout: ${String(lastErr)}`);
+  return {
+    hasPublicDir,
+    hasManifest: !!manifestPath,
+    manifestPath,
+    hasLocales
+  };
+}
+function sanitizeImageName(name) {
+  const cleaned = name.toLowerCase().replace(/^@/, "").replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return cleaned || "arc-app";
+}
+
+// src/deploy/registry.ts
+var {spawn: spawn6 } = globalThis.Bun;
+async function dockerLogin(registry) {
+  const password = process.env[registry.passwordEnv];
+  if (!password) {
+    throw new Error(`Registry password env var ${registry.passwordEnv} is not set. ` + `Set it in your shell before running deploy.`);
+  }
+  const proc2 = spawn6({
+    cmd: [
+      "docker",
+      "login",
+      registry.domain,
+      "-u",
+      registry.username,
+      "--password-stdin"
+    ],
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  proc2.stdin.write(password);
+  await proc2.stdin.end();
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    const stderr = await new Response(proc2.stderr).text();
+    throw new Error(`docker login ${registry.domain} failed (exit ${exit}): ${stderr.trim()}`);
+  }
 }
-function hashEnvToOffset(env2) {
-  let h = 0;
-  for (const ch of env2)
-    h = h * 31 + ch.charCodeAt(0) >>> 0;
-  return h % 100;
+async function dockerPush(fullRef) {
+  const proc2 = spawn6({
+    cmd: ["docker", "push", fullRef],
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    throw new Error(`docker push ${fullRef} failed (exit ${exit})`);
+  }
 }
 
+// ../../node_modules/.bun/@clack+prompts@0.9.1/node_modules/@clack/prompts/dist/index.mjs
+import { stripVTControlCharacters as T2 } from "util";
+
 // ../../node_modules/.bun/@clack+core@0.4.1/node_modules/@clack/core/dist/index.mjs
 var import_sisteransi = __toESM(require_src(), 1);
 import { stdin as $, stdout as j } from "process";
@@ -29452,6 +29614,21 @@ ${import_picocolors2.default.cyan(m2)}
     }
   } }).prompt();
 };
+var ye = (s = "", n = "") => {
+  const t = `
+${s}
+`.split(`
+`), i = T2(n).length, r2 = Math.max(t.reduce((o, l2) => {
+    const $2 = T2(l2);
+    return $2.length > o ? $2.length : o;
+  }, 0), i) + 2, c2 = t.map((o) => `${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.dim(o)}${" ".repeat(r2 - T2(o).length)}${import_picocolors2.default.gray(a)}`).join(`
+`);
+  process.stdout.write(`${import_picocolors2.default.gray(a)}
+${import_picocolors2.default.green(S2)}  ${import_picocolors2.default.reset(n)} ${import_picocolors2.default.gray(N2.repeat(Math.max(r2 - i - 1, 1)) + re)}
+${c2}
+${import_picocolors2.default.gray(ie + N2.repeat(r2 + 2) + ne)}
+`);
+};
 var ve = (s = "") => {
   process.stdout.write(`${import_picocolors2.default.gray(m2)}  ${import_picocolors2.default.red(s)}
 
@@ -29593,6 +29770,45 @@ async function runSurvey() {
   });
   if (BD(email))
     cancel();
+  ye(`The host runs a private Docker registry behind Caddy.
+Create an A record for the registry domain pointing to your host before deploy.`, "Registry");
+  const registryDomain = await ue({
+    message: "Registry domain (full FQDN)",
+    placeholder: "registry.example.com",
+    validate: (v2) => /^[a-z0-9.-]+\.[a-z]{2,}$/i.test(v2) ? undefined : "Expected a domain"
+  });
+  if (BD(registryDomain))
+    cancel();
+  const registryUser = await ue({
+    message: "Registry username",
+    initialValue: "deploy",
+    validate: (v2) => /^[a-z_][a-z0-9_-]*$/.test(v2) ? undefined : "Invalid username"
+  });
+  if (BD(registryUser))
+    cancel();
+  const registryPasswordEnv = await ue({
+    message: "Env var holding the registry password",
+    initialValue: "ARC_REGISTRY_PASSWORD",
+    validate: (v2) => /^[A-Z][A-Z0-9_]*$/.test(v2) ? undefined : "Must be UPPER_SNAKE_CASE"
+  });
+  if (BD(registryPasswordEnv))
+    cancel();
+  const generatePassword = await me({
+    message: "Generate a random password now?",
+    initialValue: true
+  });
+  if (BD(generatePassword))
+    cancel();
+  if (generatePassword) {
+    const random = generateRandomPassword(32);
+    ye(`Save this password \u2014 you'll need it on every deploy.
+
+  export ${registryPasswordEnv}=${random}
+
+This prompt is the only time it's shown.`, "Registry password");
+  } else {
+    ye(`Set ${registryPasswordEnv} in your shell before running deploy.`, "Registry password");
+  }
   fe("Configuration ready \u2014 writing deploy.arc.json");
   return {
     target: {
@@ -29603,9 +29819,19 @@ async function runSurvey() {
     },
     envs,
     caddy: { email },
+    registry: {
+      domain: registryDomain,
+      username: registryUser,
+      passwordEnv: registryPasswordEnv
+    },
     provision
   };
 }
+function generateRandomPassword(bytes) {
+  const buf = new Uint8Array(bytes);
+  crypto.getRandomValues(buf);
+  return btoa(String.fromCharCode(...buf)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function cancel() {
   ve("Cancelled.");
   process.exit(0);
@@ -29626,15 +29852,43 @@ async function platformDeploy(envArg, options = {}) {
     err(`Unknown env "${envArg}". Known: ${Object.keys(cfg.envs).join(", ")}`);
     process.exit(1);
   })() : Object.keys(cfg.envs);
-  const manifestPath = join18(ws.modulesDir, "manifest.json");
-  const needBuild = options.rebuild || !existsSync14(manifestPath);
-  if (needBuild && !options.skipBuild) {
-    log2("Building platform...");
-    await buildAll(ws, { noCache: options.rebuild });
-    ok("Build complete");
-  } else if (!existsSync14(manifestPath)) {
-    err("No build found and --skip-build was set.");
-    process.exit(1);
+  const manifestPath = join17(ws.modulesDir, "manifest.json");
+  if (!options.imageTag) {
+    const needBuild = options.rebuild || !existsSync14(manifestPath);
+    if (needBuild && !options.skipBuild) {
+      log2("Building platform...");
+      await buildAll(ws, { noCache: options.rebuild });
+      ok("Build complete");
+    } else if (!existsSync14(manifestPath)) {
+      err("No build found and --skip-build was set.");
+      process.exit(1);
+    }
+  }
+  const imageName = sanitizeImageName(ws.rootPkg.name ?? ws.appName);
+  let fullRef;
+  let contentHash;
+  if (options.imageTag) {
+    contentHash = options.imageTag.includes(":") ? options.imageTag.split(":").pop() : options.imageTag;
+    fullRef = `${cfg.registry.domain}/${imageName}:${contentHash}`;
+    log2(`Pinning to existing image ${fullRef} (skipping build + push)`);
+  } else {
+    log2(`Building Docker image ${imageName}...`);
+    const result = await buildImage(ws, {
+      imageName,
+      registryDomain: cfg.registry.domain
+    });
+    fullRef = result.fullRef;
+    contentHash = result.contentHash;
+    ok(`Image built: ${fullRef}`);
+    if (options.buildOnly) {
+      log2(`contentHash: ${contentHash}`);
+      return;
+    }
+    log2(`Logging in to ${cfg.registry.domain}...`);
+    await dockerLogin(cfg.registry);
+    log2(`Pushing ${fullRef}...`);
+    await dockerPush(fullRef);
+    ok("Image pushed");
   }
   log2("Inspecting remote server...");
   const state = await detectRemoteState(cfg);
@@ -29651,58 +29905,53 @@ async function platformDeploy(envArg, options = {}) {
     });
   }
   for (const env2 of targetEnvs) {
-    log2(`Syncing env "${env2}"...`);
-    const outcome = await syncEnv({
+    log2(`Updating env "${env2}"...`);
+    const outcome = await updateEnvDeployment({
+      target: cfg.target,
       cfg,
       env: env2,
-      ws,
-      projectDir: ws.rootDir
+      fullRef
     });
-    if (outcome.changedModules.length === 0 && !outcome.shellChanged && !outcome.stylesChanged) {
-      ok(`${env2}: already up to date`);
+    if (outcome.redeployed) {
+      ok(`${env2}: live at ${fullRef}`);
     } else {
-      const parts = [];
-      if (outcome.changedModules.length > 0) {
-        parts.push(`${outcome.changedModules.length} module(s): ${outcome.changedModules.join(", ")}`);
-      }
-      if (outcome.shellChanged)
-        parts.push("shell");
-      if (outcome.stylesChanged)
-        parts.push("styles");
-      ok(`${env2}: updated ${parts.join(", ")}`);
+      err(`${env2}: deployed but health check did not pass within retries \u2014 check \`docker logs arc-${env2}\``);
     }
   }
 }
 function readCliVersion() {
-  const candidates = [];
-  const entry = process.argv[1];
-  if (entry) {
-    candidates.push(join18(dirname7(entry), "..", "package.json"));
-  }
   try {
-    candidates.push(join18(import.meta.dir, "..", "..", "package.json"));
-  } catch {}
-  for (const path4 of candidates) {
-    try {
-      const pkg = JSON.parse(readFileSync14(path4, "utf-8"));
-      if (pkg.name === "@arcote.tech/arc-cli" && pkg.version) {
-        return pkg.version;
-      }
-    } catch {}
+    let cur = dirname9(fileURLToPath7(import.meta.url));
+    const root = dirname9(cur).startsWith("/") ? "/" : ".";
+    while (cur !== root && cur !== "") {
+      const candidate = join17(cur, "package.json");
+      if (existsSync14(candidate)) {
+        const pkg = JSON.parse(readFileSync13(candidate, "utf-8"));
+        if (pkg.name === "@arcote.tech/arc-cli") {
+          return pkg.version ?? "unknown";
+        }
+      }
+      const parent = dirname9(cur);
+      if (parent === cur)
+        break;
+      cur = parent;
+    }
+    return "unknown";
+  } catch {
+    return "unknown";
   }
-  return "unknown";
 }
 async function hashDeployConfig(rootDir) {
-  const p2 = join18(rootDir, "deploy.arc.json");
-  const content = readFileSync14(p2);
+  const p2 = join17(rootDir, "deploy.arc.json");
+  const content = readFileSync13(p2);
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   return hasher.digest("hex").slice(0, 16);
 }
 
-// src/commands/platform-dev.ts
-import { existsSync as existsSync17, watch } from "fs";
-import { join as join21 } from "path";
+// src/platform/startup.ts
+import { existsSync as existsSync16, readFileSync as readFileSync14, watch } from "fs";
+import { join as join19 } from "path";
 
 // ../host/src/create-server.ts
 var import_jsonwebtoken = __toESM(require_jsonwebtoken(), 1);
@@ -30162,8 +30411,8 @@ var d2 = class {
       throw new TypeError("CronPattern: Syntax error, steps cannot be greater than maximum value of part (" + this[e2].length + ")");
     if (c2 > w2)
       throw new TypeError("CronPattern: From value is larger than to value: '" + t + "'");
-    for (let T2 = c2;T2 <= w2; T2 += C2)
-      this.setPart(e2, T2, i[1] || s);
+    for (let T3 = c2;T3 <= w2; T3 += C2)
+      this.setPart(e2, T3, i[1] || s);
   }
   extractNth(t, e2) {
     let r2 = t, s;
@@ -30948,8 +31197,8 @@ function querySubscriptionHandler() {
             subscriptionId,
             data: data ?? null
           });
-        } catch (err3) {
-          console.error(`[Arc] Query subscription error:`, err3);
+        } catch (err2) {
+          console.error(`[Arc] Query subscription error:`, err2);
         }
       };
       sendData();
@@ -31152,231 +31401,8 @@ async function createArcServer(config) {
   };
 }
 // src/platform/server.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync15 } from "fs";
-import { join as join20 } from "path";
-
-// src/platform/deploy-api.ts
-var {spawn: spawn4 } = globalThis.Bun;
-import {
-  cpSync,
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync14,
-  readFileSync as readFileSync15,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync15
-} from "fs";
-import { dirname as dirname8, join as join19, normalize as normalize2, resolve } from "path";
-function createDeployApiHandler(opts) {
-  return async (req, url, ctx) => {
-    const p3 = url.pathname;
-    if (!p3.startsWith("/api/deploy/"))
-      return null;
-    const cors = ctx.corsHeaders;
-    if (p3 === "/api/deploy/health" && req.method === "GET") {
-      return Response.json({ ok: true, modules: opts.getManifest().modules.length }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/framework" && req.method === "GET") {
-      const hashPath = join19(opts.ws.arcDir, ".deps-hash");
-      const depsHash = existsSync15(hashPath) ? readFileSync15(hashPath, "utf-8").trim() : null;
-      return Response.json({ depsHash }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/manifest" && req.method === "GET") {
-      return Response.json(opts.getManifest(), { headers: cors });
-    }
-    if (p3 === "/api/deploy/framework" && req.method === "POST") {
-      const form = await req.formData();
-      const pkgFile = form.get("package.json");
-      const lockFile = form.get("bun.lock");
-      if (!isFile(pkgFile) || !isFile(lockFile)) {
-        return badRequest("framework requires package.json + bun.lock", cors);
-      }
-      mkdirSync14(opts.ws.arcDir, { recursive: true });
-      writeFileSync15(join19(opts.ws.arcDir, "package.json"), Buffer.from(await pkgFile.arrayBuffer()));
-      writeFileSync15(join19(opts.ws.arcDir, "bun.lock"), Buffer.from(await lockFile.arrayBuffer()));
-      const start = Date.now();
-      const installOk = await runBun(["install", "--production"], opts.ws.arcDir);
-      if (!installOk) {
-        return Response.json({ error: "bun install failed" }, { status: 500, headers: cors });
-      }
-      const cliBin = process.argv[1] ?? "arc";
-      const shellOk = await runBun([
-        "run",
-        cliBin,
-        "_build-shell",
-        "--out",
-        opts.ws.shellDir,
-        "--from",
-        join19(opts.ws.arcDir, "node_modules")
-      ], opts.ws.arcDir);
-      if (!shellOk) {
-        return Response.json({ error: "shell build failed" }, { status: 500, headers: cors });
-      }
-      const newHash = sha256Hex(Buffer.concat([
-        readFileSync15(join19(opts.ws.arcDir, "package.json")),
-        readFileSync15(join19(opts.ws.arcDir, "bun.lock"))
-      ]));
-      writeFileSync15(join19(opts.ws.arcDir, ".deps-hash"), newHash + `
-`);
-      return Response.json({
-        changed: true,
-        tookMs: Date.now() - start,
-        needsRestart: true
-      }, { headers: cors });
-    }
-    const moduleMatch = p3.match(/^\/api\/deploy\/modules\/([^/]+)$/);
-    if (moduleMatch && req.method === "POST") {
-      const safeName = sanitizeName2(moduleMatch[1]);
-      if (!safeName)
-        return badRequest("invalid module name", cors);
-      const form = await req.formData();
-      const browser = form.get("browser.js");
-      if (!isFile(browser)) {
-        return badRequest("modules/<name> requires browser.js", cors);
-      }
-      const stagingDir = join19(opts.ws.arcDir, ".staging", "modules", safeName);
-      mkdirSync14(stagingDir, { recursive: true });
-      await writeField(stagingDir, "browser.js", browser);
-      const server = form.get("server.js");
-      if (isFile(server)) {
-        await writeField(stagingDir, "server.js", server);
-      }
-      const pkg = form.get("package.json");
-      if (isFile(pkg)) {
-        await writeField(stagingDir, "package.json", pkg);
-      }
-      const access = form.get("access.json");
-      if (isFile(access)) {
-        await writeField(stagingDir, "access.json", access);
-      }
-      const stagingPkgPath = join19(stagingDir, "package.json");
-      const livePkgPath = join19(opts.ws.arcDir, "modules", safeName, "package.json");
-      const stagingPkgBytes = existsSync15(stagingPkgPath) ? readFileSync15(stagingPkgPath) : Buffer.from("");
-      const livePkgBytes = existsSync15(livePkgPath) ? readFileSync15(livePkgPath) : Buffer.from("");
-      const depsChanged = sha256Hex(stagingPkgBytes) !== sha256Hex(livePkgBytes);
-      writeFileSync15(join19(stagingDir, ".deps-hash"), sha256Hex(stagingPkgBytes) + `
-`);
-      if (depsChanged && existsSync15(stagingPkgPath)) {
-        const ok2 = await runBun(["install", "--production"], stagingDir);
-        if (!ok2) {
-          rmSync4(stagingDir, { recursive: true, force: true });
-          return Response.json({ error: `bun install failed for module ${safeName}` }, { status: 500, headers: cors });
-        }
-      } else if (!depsChanged) {
-        const liveNodeModules = join19(opts.ws.arcDir, "modules", safeName, "node_modules");
-        if (existsSync15(liveNodeModules)) {
-          cpSync(liveNodeModules, join19(stagingDir, "node_modules"), {
-            recursive: true
-          });
-        }
-      }
-      return Response.json({
-        ok: true,
-        name: safeName,
-        depsChanged,
-        serverIncluded: isFile(server)
-      }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/styles" && req.method === "POST") {
-      const form = await req.formData();
-      const stagingDir = join19(opts.ws.arcDir, ".staging");
-      mkdirSync14(stagingDir, { recursive: true });
-      const written = [];
-      for (const name of ["styles.css", "theme.css"]) {
-        const f2 = form.get(name);
-        if (isFile(f2)) {
-          await writeField(stagingDir, name, f2);
-          written.push(name);
-        }
-      }
-      return Response.json({ ok: true, written }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/manifest" && req.method === "POST") {
-      const body = await req.json();
-      if (!validateManifest(body)) {
-        return badRequest("invalid manifest body", cors);
-      }
-      const stagingRoot = join19(opts.ws.arcDir, ".staging");
-      const stagingModules = join19(stagingRoot, "modules");
-      let serverSideChanged = false;
-      if (existsSync15(stagingModules)) {
-        const stagedNames = readDir(stagingModules);
-        for (const name of stagedNames) {
-          const src2 = join19(stagingModules, name);
-          const dst = join19(opts.ws.arcDir, "modules", name);
-          if (existsSync15(join19(src2, "server.js")))
-            serverSideChanged = true;
-          if (existsSync15(dst)) {
-            rmSync4(dst, { recursive: true, force: true });
-          }
-          mkdirSync14(dirname8(dst), { recursive: true });
-          cpSync(src2, dst, { recursive: true });
-        }
-      }
-      for (const name of ["styles.css", "theme.css"]) {
-        const src2 = join19(stagingRoot, name);
-        if (existsSync15(src2)) {
-          cpSync(src2, join19(opts.ws.arcDir, name));
-        }
-      }
-      writeFileSync15(join19(opts.ws.modulesDir, "manifest.json"), JSON.stringify(body, null, 2));
-      opts.setManifest(body);
-      rmSync4(stagingRoot, { recursive: true, force: true });
-      if (!serverSideChanged) {
-        opts.notifyReload(body);
-      }
-      return Response.json({
-        ok: true,
-        moduleCount: body.modules.length,
-        needsRestart: serverSideChanged
-      }, { headers: cors });
-    }
-    return new Response("Not Found", { status: 404, headers: cors });
-  };
-}
-function badRequest(msg, cors) {
-  return Response.json({ error: msg }, { status: 400, headers: cors });
-}
-function isFile(v3) {
-  return typeof v3 === "object" && v3 !== null && typeof v3.arrayBuffer === "function" && typeof v3.name === "string";
-}
-async function writeField(targetDir, name, file) {
-  const safe = normalize2(name);
-  const safeRoot = resolve(targetDir);
-  const full = resolve(safeRoot, safe);
-  if (!full.startsWith(safeRoot + "/") && full !== safeRoot) {
-    throw new Error(`Path traversal rejected: ${name}`);
-  }
-  mkdirSync14(dirname8(full), { recursive: true });
-  writeFileSync15(full, Buffer.from(await file.arrayBuffer()));
-}
-function sanitizeName2(name) {
-  if (!/^[a-zA-Z0-9_-]+$/.test(name))
-    return null;
-  return name;
-}
-function readDir(dir) {
-  if (!existsSync15(dir))
-    return [];
-  return __require("fs").readdirSync(dir);
-}
-async function runBun(args, cwd) {
-  const proc2 = spawn4({
-    cmd: ["bun", ...args],
-    cwd,
-    stdout: "inherit",
-    stderr: "inherit"
-  });
-  const exit = await proc2.exited;
-  return exit === 0;
-}
-function validateManifest(m4) {
-  if (!m4 || typeof m4 !== "object")
-    return false;
-  const cast = m4;
-  return Array.isArray(cast.modules) && typeof cast.shellHash === "string" && typeof cast.stylesHash === "string" && typeof cast.buildTime === "string";
-}
-
-// src/platform/server.ts
+import { existsSync as existsSync15, mkdirSync as mkdirSync14 } from "fs";
+import { join as join18 } from "path";
 function generateShellHtml(appName, manifest, arcEntries) {
   const arcImports = {};
   if (arcEntries) {
@@ -31440,7 +31466,7 @@ function getMime(path4) {
   return MIME[ext2] ?? "application/octet-stream";
 }
 function serveFile(filePath, headers = {}) {
-  if (!existsSync16(filePath))
+  if (!existsSync15(filePath))
     return new Response("Not Found", { status: 404 });
   return new Response(Bun.file(filePath), {
     headers: { "Content-Type": getMime(filePath), ...headers }
@@ -31448,20 +31474,20 @@ function serveFile(filePath, headers = {}) {
 }
 var MODULE_SIG_SECRET = process.env.ARC_MODULE_SECRET ?? crypto.randomUUID();
 var MODULE_SIG_TTL = 3600;
-function signModuleUrl(filename) {
+function signChunkUrl(chunk, file) {
   const exp = Math.floor(Date.now() / 1000) + MODULE_SIG_TTL;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${filename}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${chunk}/${file}:${exp}:${MODULE_SIG_SECRET}`);
   const sig = hasher.digest("hex").slice(0, 16);
-  return `/modules/${filename}?sig=${sig}&exp=${exp}`;
+  return `/modules/${chunk}/${file}?sig=${sig}&exp=${exp}`;
 }
-function verifyModuleSignature(filename, sig, exp) {
+function verifyChunkSignature(chunk, file, sig, exp) {
   if (!sig || !exp)
     return false;
   if (Number(exp) < Date.now() / 1000)
     return false;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${filename}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${chunk}/${file}:${exp}:${MODULE_SIG_SECRET}`);
   return hasher.digest("hex").slice(0, 16) === sig;
 }
 function decodeTokenPayload(jwt2) {
@@ -31496,70 +31522,90 @@ function parseArcTokensHeader(header) {
   return payloads;
 }
 async function filterManifestForTokens(manifest, moduleAccessMap, tokenPayloads) {
+  const allowedChunks = new Set(["public"]);
+  for (const t of tokenPayloads) {
+    if (t?.tokenType)
+      allowedChunks.add(t.tokenType);
+  }
   const filtered = [];
   for (const mod of manifest.modules) {
-    const access = moduleAccessMap.get(mod.name);
-    if (!access) {
+    if (!allowedChunks.has(mod.chunk))
+      continue;
+    if (mod.chunk === "public") {
       filtered.push(mod);
       continue;
     }
-    if (tokenPayloads.length === 0)
-      continue;
-    let granted = false;
-    for (const rule of access.rules) {
-      const matching = tokenPayloads.find((t) => t.tokenType === rule.token.name);
-      if (matching) {
+    const access = moduleAccessMap.get(mod.name);
+    let granted = true;
+    if (access && access.rules.length > 0) {
+      granted = false;
+      for (const rule of access.rules) {
+        if (rule.token.name !== mod.chunk)
+          continue;
+        const matching = tokenPayloads.find((t) => t.tokenType === rule.token.name);
+        if (!matching)
+          continue;
         granted = rule.check ? await rule.check(matching) : true;
         if (granted)
           break;
       }
     }
     if (granted) {
-      filtered.push({ ...mod, url: signModuleUrl(mod.file) });
+      filtered.push({ ...mod, url: signChunkUrl(mod.chunk, mod.file) });
     }
   }
   return {
     modules: filtered,
+    chunks: manifest.chunks,
     shellHash: manifest.shellHash,
     stylesHash: manifest.stylesHash,
     buildTime: manifest.buildTime
   };
 }
-function staticFilesHandler(ws, devMode, moduleAccessMap) {
+var CHUNK_NAME_RE = /^[A-Za-z0-9_-]+$/;
+var MODULE_FILE_RE = /^[A-Za-z0-9_.-]+\.js$/;
+function staticFilesHandler(ws, devMode) {
   return (_req, url, ctx) => {
     const path4 = url.pathname;
     if (path4.startsWith("/shell/"))
-      return serveFile(join20(ws.shellDir, path4.slice(7)), ctx.corsHeaders);
+      return serveFile(join18(ws.shellDir, path4.slice(7)), ctx.corsHeaders);
     if (path4.startsWith("/modules/")) {
-      const fileWithParams = path4.slice(9);
-      const filename = fileWithParams.split("?")[0];
-      const moduleName = filename.replace(/\.js$/, "");
-      if (moduleAccessMap.has(moduleName)) {
+      const rest = path4.slice(9);
+      const slash = rest.indexOf("/");
+      if (slash <= 0) {
+        return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+      }
+      const chunk = rest.slice(0, slash);
+      const file = rest.slice(slash + 1);
+      if (!CHUNK_NAME_RE.test(chunk) || !MODULE_FILE_RE.test(file)) {
+        return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+      }
+      if (chunk !== "public") {
         const sig = url.searchParams.get("sig");
         const exp = url.searchParams.get("exp");
-        if (!verifyModuleSignature(filename, sig, exp)) {
+        if (!verifyChunkSignature(chunk, file, sig, exp)) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join20(ws.modulesDir, filename), {
+      return serveFile(join18(ws.modulesDir, chunk, file), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     }
     if (path4.startsWith("/locales/"))
-      return serveFile(join20(ws.arcDir, path4.slice(1)), ctx.corsHeaders);
+      return serveFile(join18(ws.arcDir, path4.slice(1)), ctx.corsHeaders);
     if (path4.startsWith("/assets/"))
-      return serveFile(join20(ws.assetsDir, path4.slice(8)), ctx.corsHeaders);
+      return serveFile(join18(ws.assetsDir, path4.slice(8)), ctx.corsHeaders);
     if (path4 === "/styles.css")
-      return serveFile(join20(ws.arcDir, "styles.css"), ctx.corsHeaders);
+      return serveFile(join18(ws.arcDir, "styles.css"), ctx.corsHeaders);
     if (path4 === "/theme.css")
-      return serveFile(join20(ws.arcDir, "theme.css"), ctx.corsHeaders);
+      return serveFile(join18(ws.arcDir, "theme.css"), ctx.corsHeaders);
     if ((path4 === "/manifest.json" || path4 === "/manifest.webmanifest") && ws.manifest) {
       return serveFile(ws.manifest.path, ctx.corsHeaders);
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
-      const publicFile = join20(ws.publicDir, path4.slice(1));
-      if (existsSync16(publicFile))
+      const publicFile = join18(ws.publicDir, path4.slice(1));
+      if (existsSync15(publicFile))
         return serveFile(publicFile, ctx.corsHeaders);
     }
     return null;
@@ -31645,13 +31691,6 @@ async function startPlatformServer(opts) {
       }
     }
   };
-  const deployApiEnabled = opts.deployApi ?? process.env.ARC_DEPLOY_API === "1";
-  const deployApiHandler = deployApiEnabled ? createDeployApiHandler({
-    ws,
-    getManifest,
-    setManifest,
-    notifyReload
-  }) : null;
   if (!context) {
     const cors = {
       "Access-Control-Allow-Origin": "*",
@@ -31673,10 +31712,9 @@ async function startPlatformServer(opts) {
           corsHeaders: cors
         };
         const handlers = [
-          ...deployApiHandler ? [deployApiHandler] : [],
           apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
           devReloadHandler(sseClients),
-          staticFilesHandler(ws, !!devMode, moduleAccessMap),
+          staticFilesHandler(ws, !!devMode),
           spaFallbackHandler(shellHtml)
         ];
         for (const handler of handlers) {
@@ -31697,19 +31735,18 @@ async function startPlatformServer(opts) {
     };
   }
   const { createBunSQLiteAdapterFactory: createBunSQLiteAdapterFactory2 } = await Promise.resolve().then(() => (init_dist(), exports_dist2));
-  const dbPath = opts.dbPath || join20(ws.arcDir, "data", "arc.db");
+  const dbPath = opts.dbPath || join18(ws.arcDir, "data", "arc.db");
   const dbDir = dbPath.substring(0, dbPath.lastIndexOf("/"));
   if (dbDir)
-    mkdirSync15(dbDir, { recursive: true });
+    mkdirSync14(dbDir, { recursive: true });
   const arcServer = await createArcServer({
     context,
     dbAdapterFactory: createBunSQLiteAdapterFactory2(dbPath),
     port,
     httpHandlers: [
-      ...deployApiHandler ? [deployApiHandler] : [],
       apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
       devReloadHandler(sseClients),
-      staticFilesHandler(ws, !!devMode, moduleAccessMap),
+      staticFilesHandler(ws, !!devMode),
       spaFallbackHandler(shellHtml)
     ],
     onWsClose: (clientId) => cleanupClientSubs(clientId)
@@ -31724,13 +31761,24 @@ async function startPlatformServer(opts) {
   };
 }
 
-// src/commands/platform-dev.ts
-async function platformDev(opts = {}) {
-  const ws = resolveWorkspace();
-  const port = 5005;
-  let manifest = await buildAll(ws, { noCache: opts.noCache });
+// src/platform/startup.ts
+async function startPlatform(opts) {
+  const { ws, devMode } = opts;
+  const port = opts.port ?? parseInt(process.env.PORT || "5005", 10);
+  const dbPath = opts.dbPath ?? join19(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
+  let manifest;
+  if (devMode) {
+    manifest = await buildAll(ws);
+  } else {
+    const manifestPath = join19(ws.modulesDir, "manifest.json");
+    if (!existsSync16(manifestPath)) {
+      err("No build found. Run `arc platform build` first.");
+      process.exit(1);
+    }
+    manifest = JSON.parse(readFileSync14(manifestPath, "utf-8"));
+  }
   log2("Loading server context...");
-  const { context, moduleAccess } = await loadServerContext(ws.packages);
+  const { context, moduleAccess } = await loadServerContext(ws);
   if (context) {
     ok("Context loaded");
   } else {
@@ -31743,13 +31791,25 @@ async function platformDev(opts = {}) {
     manifest,
     context,
     moduleAccess,
-    dbPath: join21(ws.rootDir, ".arc", "data", "dev.db"),
-    devMode: true,
+    dbPath,
+    devMode,
     arcEntries
   });
   ok(`Server on http://localhost:${port}`);
-  if (platform3.contextHandler)
+  if (platform3.contextHandler) {
     ok("Commands, queries, WebSocket \u2014 all on same port");
+  }
+  if (devMode) {
+    attachDevWatcher(ws, platform3);
+  }
+  const cleanup = () => {
+    platform3.stop();
+    process.exit(0);
+  };
+  process.on("SIGTERM", cleanup);
+  process.on("SIGINT", cleanup);
+}
+function attachDevWatcher(ws, platform3) {
   log2("Watching for changes...");
   let rebuildTimer = null;
   let isRebuilding = false;
@@ -31762,10 +31822,10 @@ async function platformDev(opts = {}) {
       isRebuilding = true;
       log2("Rebuilding...");
       try {
-        manifest = await buildAll(ws);
-        platform3.setManifest(manifest);
-        platform3.notifyReload(manifest);
-        ok(`Rebuilt \u2014 ${manifest.modules.length} module(s)`);
+        const next = await buildAll(ws);
+        platform3.setManifest(next);
+        platform3.notifyReload(next);
+        ok(`Rebuilt \u2014 ${next.modules.length} module(s)`);
       } catch (e2) {
         console.error(`Rebuild failed: ${e2}`);
       } finally {
@@ -31774,8 +31834,8 @@ async function platformDev(opts = {}) {
     }, 300);
   };
   for (const pkg of ws.packages) {
-    const srcDir = join21(pkg.path, "src");
-    if (!existsSync17(srcDir))
+    const srcDir = join19(pkg.path, "src");
+    if (!existsSync16(srcDir))
       continue;
     watch(srcDir, { recursive: true }, (_event, filename) => {
       if (!filename || filename.includes(".arc") || filename.endsWith(".d.ts") || filename.includes("node_modules") || filename.includes("dist"))
@@ -31785,91 +31845,26 @@ async function platformDev(opts = {}) {
       triggerRebuild();
     });
   }
-  const localesDir = join21(ws.rootDir, "locales");
-  if (existsSync17(localesDir)) {
+  const localesDir = join19(ws.rootDir, "locales");
+  if (existsSync16(localesDir)) {
     watch(localesDir, { recursive: false }, (_event, filename) => {
       if (!filename?.endsWith(".po"))
         return;
       triggerRebuild();
     });
   }
-  const cleanup = () => {
-    platform3.stop();
-    process.exit(0);
-  };
-  process.on("SIGTERM", cleanup);
-  process.on("SIGINT", cleanup);
+}
+
+// src/commands/platform-dev.ts
+async function platformDev(opts = {}) {
+  const ws = resolveWorkspace();
+  await startPlatform({ ws, devMode: true });
 }
 
 // src/commands/platform-start.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { join as join22 } from "path";
 async function platformStart() {
   const ws = resolveWorkspace();
-  const port = parseInt(process.env.PORT || "5005", 10);
-  const deployApi = process.env.ARC_DEPLOY_API === "1";
-  const manifestPath = join22(ws.modulesDir, "manifest.json");
-  if (!existsSync18(manifestPath)) {
-    if (!deployApi) {
-      err("No build found. Run `arc platform build` first.");
-      process.exit(1);
-    }
-    log2("Pre-deploy mode \u2014 no manifest yet, awaiting first /api/deploy/*");
-    const emptyManifest = {
-      modules: [],
-      shellHash: "",
-      stylesHash: "",
-      buildTime: new Date().toISOString()
-    };
-    const platform4 = await startPlatformServer({
-      ws,
-      port,
-      manifest: emptyManifest,
-      context: null,
-      moduleAccess: new Map,
-      dbPath: join22(ws.rootDir, ".arc", "data", "prod.db"),
-      devMode: false,
-      deployApi: true,
-      arcEntries: []
-    });
-    ok(`Pre-deploy server on http://localhost:${port}`);
-    registerSignalCleanup(platform4);
-    return;
-  }
-  const manifest = JSON.parse(readFileSync16(manifestPath, "utf-8"));
-  log2("Loading server context...");
-  const { context, moduleAccess } = await loadServerContext(ws.packages);
-  if (context) {
-    ok("Context loaded");
-  } else {
-    log2("No context \u2014 server endpoints skipped");
-  }
-  const arcEntries = collectArcPeerDeps(ws.packages);
-  if (deployApi)
-    ok("Deploy API enabled (/api/deploy/*)");
-  const platform3 = await startPlatformServer({
-    ws,
-    port,
-    manifest,
-    context,
-    moduleAccess,
-    dbPath: join22(ws.rootDir, ".arc", "data", "prod.db"),
-    devMode: false,
-    deployApi,
-    arcEntries
-  });
-  ok(`Server on http://localhost:${port}`);
-  if (platform3.contextHandler)
-    ok("Commands, queries, WebSocket \u2014 all on same port");
-  registerSignalCleanup(platform3);
-}
-function registerSignalCleanup(platform3) {
-  const cleanup = () => {
-    platform3.stop();
-    process.exit(0);
-  };
-  process.on("SIGTERM", cleanup);
-  process.on("SIGINT", cleanup);
+  await startPlatform({ ws, devMode: false });
 }
 
 // src/index.ts
@@ -31881,8 +31876,7 @@ var platform3 = program2.command("platform").description("Platform commands \u20
 platform3.command("dev").description("Start platform in dev mode (Bun server + Vite HMR)").option("--no-cache", "Force full rebuild on startup").action((opts) => platformDev({ noCache: opts.cache === false }));
 platform3.command("build").description("Build platform for production").option("--no-cache", "Force full rebuild").action((opts) => platformBuild({ noCache: opts.cache === false }));
 platform3.command("start").description("Start platform in production mode (requires prior build)").action(platformStart);
-platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").action((env2, opts) => platformDeploy(env2, opts));
-program2.command("_build-shell", { hidden: true }).description("Build framework shell bundles from a node_modules dir").requiredOption("--out <dir>", "Output directory for shell .js bundles").requiredOption("--from <dir>", "node_modules directory to discover packages in").action((opts) => buildShell(opts));
+platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").option("--build-only", "Build the Docker image locally, then exit (no remote push)").option("--image-tag <hash>", "Roll back / pin to an existing image tag instead of building a new one").action((env2, opts) => platformDeploy(env2, opts));
 program2.parse(process.argv);
 if (process.argv.length === 2) {
   program2.help();