@arcote.tech/arc-cli 0.6.2 → 0.7.1

package/dist/index.js

@@ -8974,6 +8974,285 @@ var require_chokidar = __commonJS((exports) => {
   exports.watch = watch;
 });
 
+// src/i18n/catalog.ts
+function hashMsgid(msgid) {
+  const hasher = new Bun.CryptoHasher("md5");
+  hasher.update(msgid);
+  return hasher.digest("hex").slice(0, 8);
+}
+function parsePo(content) {
+  const entries = [];
+  const lines = content.split(`
+`);
+  let locations = [];
+  let hash = "";
+  let msgid = "";
+  let msgstr = "";
+  let obsolete = false;
+  let inManual = false;
+  const flush = () => {
+    if (msgid) {
+      entries.push({
+        msgid,
+        msgstr,
+        locations,
+        hash: hash || hashMsgid(msgid),
+        obsolete,
+        ...inManual ? { manual: true } : {}
+      });
+    }
+    locations = [];
+    hash = "";
+    msgid = "";
+    msgstr = "";
+    obsolete = false;
+  };
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "# manual") {
+      inManual = true;
+      continue;
+    }
+    if (trimmed === "# end manual") {
+      if (msgid)
+        flush();
+      inManual = false;
+      continue;
+    }
+    if (trimmed === "" || trimmed.startsWith("#,")) {
+      if (msgid)
+        flush();
+      continue;
+    }
+    if (trimmed.startsWith("#:")) {
+      if (msgid)
+        flush();
+      locations.push(trimmed.slice(3).trim());
+      continue;
+    }
+    if (trimmed.startsWith("#.")) {
+      const hashMatch = trimmed.match(/hash:(\w+)/);
+      if (hashMatch)
+        hash = hashMatch[1];
+      continue;
+    }
+    if (trimmed.startsWith("#~")) {
+      const rest = trimmed.slice(3).trim();
+      if (rest.startsWith("msgid")) {
+        if (msgid)
+          flush();
+        obsolete = true;
+        msgid = extractQuoted(rest.slice(5));
+      } else if (rest.startsWith("msgstr")) {
+        msgstr = extractQuoted(rest.slice(6));
+      }
+      continue;
+    }
+    if (trimmed.startsWith("msgid")) {
+      if (msgid)
+        flush();
+      msgid = extractQuoted(trimmed.slice(5));
+    } else if (trimmed.startsWith("msgstr")) {
+      msgstr = extractQuoted(trimmed.slice(6));
+    }
+  }
+  flush();
+  return entries;
+}
+function writePo(entries) {
+  const lines = [];
+  const manual = entries.filter((e) => e.manual);
+  const active = entries.filter((e) => !e.obsolete && !e.manual);
+  const obsolete = entries.filter((e) => e.obsolete);
+  if (manual.length > 0) {
+    lines.push("# manual");
+    for (const entry of manual) {
+      lines.push(`msgid ${quoteString(entry.msgid)}`);
+      lines.push(`msgstr ${quoteString(entry.msgstr)}`);
+      lines.push("");
+    }
+    lines.push("# end manual");
+    lines.push("");
+  }
+  for (const entry of active) {
+    for (const loc of entry.locations) {
+      lines.push(`#: ${loc}`);
+    }
+    lines.push(`#. hash:${entry.hash}`);
+    lines.push(`msgid ${quoteString(entry.msgid)}`);
+    lines.push(`msgstr ${quoteString(entry.msgstr)}`);
+    lines.push("");
+  }
+  if (obsolete.length > 0) {
+    lines.push("# Obsolete entries");
+    lines.push("");
+    for (const entry of obsolete) {
+      lines.push(`#~ msgid ${quoteString(entry.msgid)}`);
+      lines.push(`#~ msgstr ${quoteString(entry.msgstr)}`);
+      lines.push("");
+    }
+  }
+  return lines.join(`
+`);
+}
+function mergeCatalog(existing, extracted) {
+  const existingMap = new Map;
+  for (const entry of existing) {
+    existingMap.set(entry.msgid, entry);
+  }
+  const manualEntries = existing.filter((e) => e.manual);
+  const manualIds = new Set(manualEntries.map((e) => e.msgid));
+  const result = [];
+  const seen = new Set;
+  for (const [msgid, locations] of extracted) {
+    seen.add(msgid);
+    if (manualIds.has(msgid))
+      continue;
+    const prev = existingMap.get(msgid);
+    result.push({
+      msgid,
+      msgstr: prev?.msgstr ?? "",
+      locations: [...locations].sort(),
+      hash: hashMsgid(msgid),
+      obsolete: false
+    });
+  }
+  for (const entry of existing) {
+    if (!seen.has(entry.msgid) && !entry.obsolete && !entry.manual && entry.msgstr) {
+      result.push({
+        ...entry,
+        obsolete: true,
+        locations: []
+      });
+    }
+  }
+  result.sort((a, b) => a.msgid.localeCompare(b.msgid));
+  return [...manualEntries, ...result];
+}
+function extractQuoted(s) {
+  const trimmed = s.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    return trimmed.slice(1, -1).replace(/\\n/g, `
+`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+  }
+  return trimmed;
+}
+function quoteString(s) {
+  const escaped = s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+  return `"${escaped}"`;
+}
+
+// src/i18n/compile.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+function compileCatalog(poPath) {
+  const content = readFileSync3(poPath, "utf-8");
+  const entries = parsePo(content);
+  const result = {};
+  for (const entry of entries) {
+    if (!entry.obsolete && entry.msgstr) {
+      result[entry.msgid] = entry.msgstr;
+    }
+  }
+  const sorted = {};
+  for (const key of Object.keys(result).sort()) {
+    sorted[key] = result[key];
+  }
+  return sorted;
+}
+function compileAllCatalogs(localesDir, outDir) {
+  mkdirSync3(outDir, { recursive: true });
+  for (const file of readdirSync2(localesDir)) {
+    if (!file.endsWith(".po"))
+      continue;
+    const locale = file.replace(".po", "");
+    const compiled = compileCatalog(join4(localesDir, file));
+    writeFileSync3(join4(outDir, `${locale}.json`), JSON.stringify(compiled));
+  }
+}
+var init_compile = () => {};
+
+// src/i18n/plugin.ts
+function i18nExtractPlugin(collector, rootDir) {
+  return {
+    name: "arc-i18n-extract",
+    setup(build2) {
+      build2.onLoad({ filter: /\.tsx?$/ }, async (args) => {
+        const source = await Bun.file(args.path).text();
+        const relPath = args.path.startsWith(rootDir) ? args.path.slice(rootDir.length + 1) : args.path;
+        const transRegex = /<Trans>\s*([^<{]+?)\s*<\/Trans>/g;
+        for (const match2 of source.matchAll(transRegex)) {
+          const msgid = match2[1].trim();
+          if (!msgid)
+            continue;
+          const line = source.substring(0, match2.index).split(`
+`).length;
+          const loc = `${relPath}:${line}`;
+          if (!collector.has(msgid))
+            collector.set(msgid, new Set);
+          collector.get(msgid).add(loc);
+        }
+        const tRegex = /\bt`([^`]+)`/g;
+        for (const match2 of source.matchAll(tRegex)) {
+          const msgid = match2[1];
+          if (!msgid)
+            continue;
+          const line = source.substring(0, match2.index).split(`
+`).length;
+          const loc = `${relPath}:${line}`;
+          if (!collector.has(msgid))
+            collector.set(msgid, new Set);
+          collector.get(msgid).add(loc);
+        }
+        return;
+      });
+    }
+  };
+}
+
+// src/i18n/index.ts
+var exports_i18n = {};
+__export(exports_i18n, {
+  readTranslationsConfig: () => readTranslationsConfig,
+  i18nExtractPlugin: () => i18nExtractPlugin,
+  finalizeTranslations: () => finalizeTranslations
+});
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
+function readTranslationsConfig(rootDir) {
+  const pkgPath = join5(rootDir, "package.json");
+  if (!existsSync4(pkgPath))
+    return null;
+  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
+  const config = pkg.arc?.translations;
+  if (!config?.locales?.length)
+    return null;
+  return {
+    locales: config.locales,
+    sourceLocale: config.sourceLocale ?? config.locales[0]
+  };
+}
+async function finalizeTranslations(rootDir, outDir, collector) {
+  const config = readTranslationsConfig(rootDir);
+  if (!config || collector.size === 0)
+    return;
+  const localesJsonDir = join5(outDir, "locales");
+  mkdirSync4(localesJsonDir, { recursive: true });
+  console.log(`  Extracted ${collector.size} translatable string(s) for ${config.locales.length} locale(s)`);
+  for (const locale of config.locales) {
+    const poPath = join5(rootDir, "locales", `${locale}.po`);
+    mkdirSync4(dirname4(poPath), { recursive: true });
+    const existing = existsSync4(poPath) ? parsePo(readFileSync4(poPath, "utf-8")) : [];
+    const merged = mergeCatalog(existing, collector);
+    writeFileSync4(poPath, writePo(merged));
+    const compiled = compileCatalog(poPath);
+    writeFileSync4(join5(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
+  }
+}
+var init_i18n = __esm(() => {
+  init_compile();
+});
+
 // ../../node_modules/.bun/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
 var require_src = __commonJS((exports, module) => {
   var ESC2 = "\x1B";
@@ -18135,7 +18414,7 @@ var {
 // ../../node_modules/.bun/find-up@7.0.0/node_modules/find-up/index.js
 import path2 from "path";
 
-// ../../node_modules/.bun/find-up@7.0.0/node_modules/find-up/node_modules/locate-path/index.js
+// ../../node_modules/.bun/locate-path@7.2.0/node_modules/locate-path/index.js
 import process2 from "process";
 import path from "path";
 import fs, { promises as fsPromises } from "fs";
@@ -21686,7 +21965,7 @@ var emitWarning = (msg, type, code, fn) => {
 var AC = globalThis.AbortController;
 var AS = globalThis.AbortSignal;
 if (typeof AC === "undefined") {
-  AS = class AbortSignal2 {
+  AS = class AbortSignal {
     onabort;
     _onabort = [];
     reason;
@@ -26129,110 +26408,9 @@ ${colors2.yellow}Type declaration errors:${colors2.reset}`);
   }
 }
 
-// src/commands/build-shell.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, rmSync } from "fs";
-import { join as join3 } from "path";
-var REACT_ENTRIES = [
-  ["react", `export * from "react";
-import * as React from "react";
-export default React;`],
-  ["react-dom", `export * from "react-dom";
-import * as ReactDOM from "react-dom";
-export default ReactDOM;`],
-  ["jsx-runtime", `export * from "react/jsx-runtime";`],
-  ["jsx-dev-runtime", `export * from "react/jsx-dev-runtime";`],
-  ["react-dom-client", `export { createRoot, hydrateRoot } from "react-dom/client";`]
-];
-var SHELL_BASE_EXTERNAL = [
-  "react",
-  "react-dom",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "react-dom/client"
-];
-async function buildShell(opts) {
-  const outDir = opts.out;
-  const fromDir = opts.from;
-  if (!existsSync3(fromDir)) {
-    console.error(`[_build-shell] --from not found: ${fromDir}`);
-    process.exit(1);
-  }
-  mkdirSync3(outDir, { recursive: true });
-  const tmpDir = join3(outDir, "_tmp");
-  mkdirSync3(tmpDir, { recursive: true });
-  try {
-    const arcPkgs = discoverArcPackages(fromDir);
-    if (arcPkgs.length === 0) {
-      console.warn("[_build-shell] no @arcote.tech/* packages discovered");
-    }
-    console.log(`[_build-shell] building shell for react + ${arcPkgs.length} @arcote.tech/* package(s)`);
-    await buildReactShell(outDir, tmpDir, fromDir);
-    for (const pkg of arcPkgs) {
-      await buildArcEntry(pkg, arcPkgs, outDir, tmpDir, fromDir);
-    }
-    console.log(`[_build-shell] done \u2192 ${outDir}`);
-  } finally {
-    rmSync(tmpDir, { recursive: true, force: true });
-  }
-}
-function discoverArcPackages(fromDir) {
-  const arcDir = join3(fromDir, "@arcote.tech");
-  if (!existsSync3(arcDir))
-    return [];
-  return readdirSync2(arcDir).filter((name) => existsSync3(join3(arcDir, name, "package.json"))).map((name) => `@arcote.tech/${name}`);
-}
-async function buildReactShell(outDir, tmpDir, fromDir) {
-  const eps = [];
-  for (const [name, code] of REACT_ENTRIES) {
-    const f = join3(tmpDir, `${name}.ts`);
-    await Bun.write(f, code);
-    eps.push(f);
-  }
-  const r = await Bun.build({
-    entrypoints: eps,
-    outdir: outDir,
-    splitting: true,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]",
-    root: fromDir
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error("React shell build failed");
-  }
-}
-async function buildArcEntry(pkg, allArcPkgs, outDir, tmpDir, fromDir) {
-  const shortName = pkg.replace("@arcote.tech/", "");
-  const otherExternals = allArcPkgs.filter((p) => p !== pkg);
-  const f = join3(tmpDir, `${shortName}.ts`);
-  await Bun.write(f, `export * from "${pkg}";
-`);
-  const r = await Bun.build({
-    entrypoints: [f],
-    outdir: outDir,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]",
-    root: fromDir,
-    external: [...SHELL_BASE_EXTERNAL, ...otherExternals],
-    define: {
-      ONLY_SERVER: "false",
-      ONLY_BROWSER: "true",
-      ONLY_CLIENT: "true"
-    }
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error(`Shell build failed for ${pkg}`);
-  }
-}
-
 // src/commands/dev.ts
 var import_chokidar = __toESM(require_chokidar(), 1);
-import { dirname as dirname3, join as join4, relative } from "path";
+import { dirname as dirname3, join as join3, relative } from "path";
 function getContextForFile(filePath, contexts, configDir) {
   const relativePath = relative(configDir, filePath);
   for (const context of contexts) {
@@ -26349,7 +26527,7 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
       } else {
         log("Initial build complete \u2713", "green");
       }
-      const watcher = import_chokidar.default.watch([join4(configDir, "**/*.ts"), join4(configDir, "**/*.tsx")], {
+      const watcher = import_chokidar.default.watch([join3(configDir, "**/*.ts"), join3(configDir, "**/*.tsx")], {
         ignored: [
           "**/node_modules/**",
           `**/${config.outDir}/**`,
@@ -26446,306 +26624,37 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname6, join as join12 } from "path";
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname6, join as join11 } from "path";
 
 // src/builder/module-builder.ts
 import { execSync } from "child_process";
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync8,
-  readdirSync as readdirSync5,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync7,
+  readdirSync as readdirSync4,
+  rmSync,
+  writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename2, dirname as dirname5, join as join9, relative as relative3 } from "path";
-
-// src/i18n/index.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join6 } from "path";
-
-// src/i18n/catalog.ts
-function hashMsgid(msgid) {
-  const hasher = new Bun.CryptoHasher("md5");
-  hasher.update(msgid);
-  return hasher.digest("hex").slice(0, 8);
-}
-function parsePo(content) {
-  const entries = [];
-  const lines = content.split(`
-`);
-  let locations = [];
-  let hash = "";
-  let msgid = "";
-  let msgstr = "";
-  let obsolete = false;
-  let inManual = false;
-  const flush = () => {
-    if (msgid) {
-      entries.push({
-        msgid,
-        msgstr,
-        locations,
-        hash: hash || hashMsgid(msgid),
-        obsolete,
-        ...inManual ? { manual: true } : {}
-      });
-    }
-    locations = [];
-    hash = "";
-    msgid = "";
-    msgstr = "";
-    obsolete = false;
-  };
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed === "# manual") {
-      inManual = true;
-      continue;
-    }
-    if (trimmed === "# end manual") {
-      if (msgid)
-        flush();
-      inManual = false;
-      continue;
-    }
-    if (trimmed === "" || trimmed.startsWith("#,")) {
-      if (msgid)
-        flush();
-      continue;
-    }
-    if (trimmed.startsWith("#:")) {
-      if (msgid)
-        flush();
-      locations.push(trimmed.slice(3).trim());
-      continue;
-    }
-    if (trimmed.startsWith("#.")) {
-      const hashMatch = trimmed.match(/hash:(\w+)/);
-      if (hashMatch)
-        hash = hashMatch[1];
-      continue;
-    }
-    if (trimmed.startsWith("#~")) {
-      const rest = trimmed.slice(3).trim();
-      if (rest.startsWith("msgid")) {
-        if (msgid)
-          flush();
-        obsolete = true;
-        msgid = extractQuoted(rest.slice(5));
-      } else if (rest.startsWith("msgstr")) {
-        msgstr = extractQuoted(rest.slice(6));
-      }
-      continue;
-    }
-    if (trimmed.startsWith("msgid")) {
-      if (msgid)
-        flush();
-      msgid = extractQuoted(trimmed.slice(5));
-    } else if (trimmed.startsWith("msgstr")) {
-      msgstr = extractQuoted(trimmed.slice(6));
-    }
-  }
-  flush();
-  return entries;
-}
-function writePo(entries) {
-  const lines = [];
-  const manual = entries.filter((e) => e.manual);
-  const active = entries.filter((e) => !e.obsolete && !e.manual);
-  const obsolete = entries.filter((e) => e.obsolete);
-  if (manual.length > 0) {
-    lines.push("# manual");
-    for (const entry of manual) {
-      lines.push(`msgid ${quoteString(entry.msgid)}`);
-      lines.push(`msgstr ${quoteString(entry.msgstr)}`);
-      lines.push("");
-    }
-    lines.push("# end manual");
-    lines.push("");
-  }
-  for (const entry of active) {
-    for (const loc of entry.locations) {
-      lines.push(`#: ${loc}`);
-    }
-    lines.push(`#. hash:${entry.hash}`);
-    lines.push(`msgid ${quoteString(entry.msgid)}`);
-    lines.push(`msgstr ${quoteString(entry.msgstr)}`);
-    lines.push("");
-  }
-  if (obsolete.length > 0) {
-    lines.push("# Obsolete entries");
-    lines.push("");
-    for (const entry of obsolete) {
-      lines.push(`#~ msgid ${quoteString(entry.msgid)}`);
-      lines.push(`#~ msgstr ${quoteString(entry.msgstr)}`);
-      lines.push("");
-    }
-  }
-  return lines.join(`
-`);
-}
-function mergeCatalog(existing, extracted) {
-  const existingMap = new Map;
-  for (const entry of existing) {
-    existingMap.set(entry.msgid, entry);
-  }
-  const manualEntries = existing.filter((e) => e.manual);
-  const manualIds = new Set(manualEntries.map((e) => e.msgid));
-  const result = [];
-  const seen = new Set;
-  for (const [msgid, locations] of extracted) {
-    seen.add(msgid);
-    if (manualIds.has(msgid))
-      continue;
-    const prev = existingMap.get(msgid);
-    result.push({
-      msgid,
-      msgstr: prev?.msgstr ?? "",
-      locations: [...locations].sort(),
-      hash: hashMsgid(msgid),
-      obsolete: false
-    });
-  }
-  for (const entry of existing) {
-    if (!seen.has(entry.msgid) && !entry.obsolete && !entry.manual && entry.msgstr) {
-      result.push({
-        ...entry,
-        obsolete: true,
-        locations: []
-      });
-    }
-  }
-  result.sort((a, b) => a.msgid.localeCompare(b.msgid));
-  return [...manualEntries, ...result];
-}
-function extractQuoted(s) {
-  const trimmed = s.trim();
-  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
-    return trimmed.slice(1, -1).replace(/\\n/g, `
-`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-  }
-  return trimmed;
-}
-function quoteString(s) {
-  const escaped = s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
-  return `"${escaped}"`;
-}
-
-// src/i18n/compile.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
-function compileCatalog(poPath) {
-  const content = readFileSync4(poPath, "utf-8");
-  const entries = parsePo(content);
-  const result = {};
-  for (const entry of entries) {
-    if (!entry.obsolete && entry.msgstr) {
-      result[entry.msgid] = entry.msgstr;
-    }
-  }
-  const sorted = {};
-  for (const key of Object.keys(result).sort()) {
-    sorted[key] = result[key];
-  }
-  return sorted;
-}
-function compileAllCatalogs(localesDir, outDir) {
-  mkdirSync4(outDir, { recursive: true });
-  for (const file of readdirSync3(localesDir)) {
-    if (!file.endsWith(".po"))
-      continue;
-    const locale = file.replace(".po", "");
-    const compiled = compileCatalog(join5(localesDir, file));
-    writeFileSync4(join5(outDir, `${locale}.json`), JSON.stringify(compiled));
-  }
-}
-
-// src/i18n/plugin.ts
-function i18nExtractPlugin(collector, rootDir) {
-  return {
-    name: "arc-i18n-extract",
-    setup(build2) {
-      build2.onLoad({ filter: /\.tsx?$/ }, async (args) => {
-        const source = await Bun.file(args.path).text();
-        const relPath = args.path.startsWith(rootDir) ? args.path.slice(rootDir.length + 1) : args.path;
-        const transRegex = /<Trans>\s*([^<{]+?)\s*<\/Trans>/g;
-        for (const match2 of source.matchAll(transRegex)) {
-          const msgid = match2[1].trim();
-          if (!msgid)
-            continue;
-          const line = source.substring(0, match2.index).split(`
-`).length;
-          const loc = `${relPath}:${line}`;
-          if (!collector.has(msgid))
-            collector.set(msgid, new Set);
-          collector.get(msgid).add(loc);
-        }
-        const tRegex = /\bt`([^`]+)`/g;
-        for (const match2 of source.matchAll(tRegex)) {
-          const msgid = match2[1];
-          if (!msgid)
-            continue;
-          const line = source.substring(0, match2.index).split(`
-`).length;
-          const loc = `${relPath}:${line}`;
-          if (!collector.has(msgid))
-            collector.set(msgid, new Set);
-          collector.get(msgid).add(loc);
-        }
-        return;
-      });
-    }
-  };
-}
-
-// src/i18n/index.ts
-function readTranslationsConfig(rootDir) {
-  const pkgPath = join6(rootDir, "package.json");
-  if (!existsSync5(pkgPath))
-    return null;
-  const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
-  const config = pkg.arc?.translations;
-  if (!config?.locales?.length)
-    return null;
-  return {
-    locales: config.locales,
-    sourceLocale: config.sourceLocale ?? config.locales[0]
-  };
-}
-async function finalizeTranslations(rootDir, outDir, collector) {
-  const config = readTranslationsConfig(rootDir);
-  if (!config || collector.size === 0)
-    return;
-  const localesJsonDir = join6(outDir, "locales");
-  mkdirSync5(localesJsonDir, { recursive: true });
-  console.log(`  Extracted ${collector.size} translatable string(s) for ${config.locales.length} locale(s)`);
-  for (const locale of config.locales) {
-    const poPath = join6(rootDir, "locales", `${locale}.po`);
-    mkdirSync5(dirname4(poPath), { recursive: true });
-    const existing = existsSync5(poPath) ? parsePo(readFileSync5(poPath, "utf-8")) : [];
-    const merged = mergeCatalog(existing, collector);
-    writeFileSync5(poPath, writePo(merged));
-    const compiled = compileCatalog(poPath);
-    writeFileSync5(join6(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
-  }
-}
+import { basename as basename2, dirname as dirname5, join as join8, relative as relative3 } from "path";
+init_i18n();
+init_compile();
 
 // src/builder/build-cache.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join7 } from "path";
-var CACHE_VERSION = 1;
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
+var CACHE_VERSION = 2;
 var CACHE_FILE = ".build-cache.json";
 function emptyCache() {
   return { version: CACHE_VERSION, units: {} };
 }
 function loadBuildCache(arcDir) {
-  const path4 = join7(arcDir, CACHE_FILE);
-  if (!existsSync6(path4))
+  const path4 = join6(arcDir, CACHE_FILE);
+  if (!existsSync5(path4))
     return emptyCache();
   try {
-    const raw = JSON.parse(readFileSync6(path4, "utf-8"));
+    const raw = JSON.parse(readFileSync5(path4, "utf-8"));
     if (raw?.version !== CACHE_VERSION || typeof raw.units !== "object") {
       return emptyCache();
     }
@@ -26755,15 +26664,15 @@ function loadBuildCache(arcDir) {
   }
 }
 function saveBuildCache(arcDir, cache) {
-  mkdirSync6(arcDir, { recursive: true });
-  writeFileSync6(join7(arcDir, CACHE_FILE), JSON.stringify(cache, null, 2));
+  mkdirSync5(arcDir, { recursive: true });
+  writeFileSync5(join6(arcDir, CACHE_FILE), JSON.stringify(cache, null, 2));
 }
 function isCacheHit(cache, unitId, inputHash, requiredOutputs = []) {
   const entry = cache.units[unitId];
   if (!entry || entry.inputHash !== inputHash)
     return false;
   for (const out of requiredOutputs) {
-    if (!existsSync6(out))
+    if (!existsSync5(out))
       return false;
   }
   return true;
@@ -26776,9 +26685,33 @@ function updateCache(cache, unitId, inputHash, output = {}) {
   };
 }
 
+// src/builder/framework-peers.ts
+var CORE_PEERS = [
+  "@arcote.tech/arc",
+  "@arcote.tech/arc-ds",
+  "@arcote.tech/arc-react",
+  "@arcote.tech/platform"
+];
+var BROWSER_FRAGMENT_PEERS = [
+  "@arcote.tech/arc-auth",
+  "@arcote.tech/arc-workspace",
+  "@arcote.tech/arc-utils",
+  "@arcote.tech/arc-chat"
+];
+var ARC_PEERS = [...CORE_PEERS, ...BROWSER_FRAGMENT_PEERS];
+var REACT_PEERS = ["react", "react-dom"];
+var FRAMEWORK_PEERS = [...ARC_PEERS, ...REACT_PEERS];
+var SHELL_EXTERNALS = [
+  ...FRAMEWORK_PEERS,
+  "react/jsx-runtime",
+  "react/jsx-dev-runtime"
+];
+var FRAMEWORK_PEER_SET = new Set(FRAMEWORK_PEERS);
+var SHELL_EXTERNAL_SET = new Set(SHELL_EXTERNALS);
+
 // src/builder/hash.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, readdirSync as readdirSync4, statSync } from "fs";
-import { join as join8, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync } from "fs";
+import { join as join7, relative as relative2, sep as sep2 } from "path";
 function sha256Hex(bytes) {
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(bytes);
@@ -26788,21 +26721,21 @@ function sha256OfFiles(paths) {
   const hasher = new Bun.CryptoHasher("sha256");
   const sorted = [...paths].sort();
   for (const p of sorted) {
-    if (!existsSync7(p))
+    if (!existsSync6(p))
       continue;
-    hasher.update(readFileSync7(p));
+    hasher.update(readFileSync6(p));
     hasher.update("\x00");
   }
   return hasher.digest("hex");
 }
 function sha256OfDir(dir, filter2) {
-  if (!existsSync7(dir))
+  if (!existsSync6(dir))
     return sha256Hex("");
   const hasher = new Bun.CryptoHasher("sha256");
   const entries = [];
   function walk(absDir) {
-    for (const entry of readdirSync4(absDir, { withFileTypes: true })) {
-      const abs = join8(absDir, entry.name);
+    for (const entry of readdirSync3(absDir, { withFileTypes: true })) {
+      const abs = join7(absDir, entry.name);
       const rel = relative2(dir, abs).split(sep2).join("/");
       if (filter2 && !filter2(rel))
         continue;
@@ -26817,7 +26750,7 @@ function sha256OfDir(dir, filter2) {
   for (const { rel, abs } of entries) {
     hasher.update(rel);
     hasher.update("\x00");
-    hasher.update(readFileSync7(abs));
+    hasher.update(readFileSync6(abs));
     hasher.update("\x00");
   }
   return hasher.digest("hex");
@@ -26836,17 +26769,17 @@ function stableStringify(value) {
   return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
 }
 function readInstalledVersion(rootDir, pkgName) {
-  const pkgJson = join8(rootDir, "node_modules", pkgName, "package.json");
-  if (!existsSync7(pkgJson))
+  const pkgJson = join7(rootDir, "node_modules", pkgName, "package.json");
+  if (!existsSync6(pkgJson))
     return null;
   try {
-    return JSON.parse(readFileSync7(pkgJson, "utf-8")).version ?? null;
+    return JSON.parse(readFileSync6(pkgJson, "utf-8")).version ?? null;
   } catch {
     return null;
   }
 }
 function mtimeOf(path4) {
-  if (!existsSync7(path4))
+  if (!existsSync6(path4))
     return 0;
   try {
     return statSync(path4).mtimeMs;
@@ -26876,58 +26809,82 @@ async function pAll(tasks, concurrency = DEFAULT_CONCURRENCY) {
 }
 
 // src/builder/module-builder.ts
+function singleReactPlugin(rootDir) {
+  const reactPkgs = ["react", "react-dom", "react-dom/client", "react/jsx-runtime"];
+  return {
+    name: "single-react",
+    setup(build2) {
+      const resolved = new Map;
+      for (const spec of reactPkgs) {
+        try {
+          resolved.set(spec, Bun.resolveSync(spec, rootDir));
+        } catch {}
+      }
+      build2.onResolve({ filter: /^(react|react-dom|react-dom\/client|react\/jsx-runtime)$/ }, (args) => {
+        const path4 = resolved.get(args.path);
+        return path4 ? { path: path4 } : null;
+      });
+    }
+  };
+}
+function jsxDevShimPlugin() {
+  return {
+    name: "jsx-dev-runtime-shim",
+    setup(build2) {
+      build2.onResolve({ filter: /^react\/jsx-dev-runtime$/ }, () => ({
+        path: "react-jsx-dev-runtime-shim",
+        namespace: "jsx-dev-shim"
+      }));
+      build2.onLoad({ filter: /.*/, namespace: "jsx-dev-shim" }, () => ({
+        contents: `import { jsx, jsxs, Fragment } from "react/jsx-runtime";
+export const jsxDEV = jsx;
+export const jsxsDEV = jsxs;
+export { Fragment };
+`,
+        loader: "ts"
+      }));
+    }
+  };
+}
 var CONTEXT_CLIENTS = [
   { name: "server", target: "bun", defines: { ONLY_SERVER: "true", ONLY_BROWSER: "false", ONLY_CLIENT: "false" } },
   { name: "browser", target: "browser", defines: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" } }
 ];
-var SHELL_EXTERNALS = [
-  "react",
-  "react-dom",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "@arcote.tech/arc",
-  "@arcote.tech/arc-ds",
-  "@arcote.tech/arc-react",
-  "@arcote.tech/arc-auth",
-  "@arcote.tech/arc-utils",
-  "@arcote.tech/arc-workspace",
-  "@arcote.tech/platform"
-];
 function discoverPackages(rootDir) {
-  const rootPkg = JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync7(join8(rootDir, "package.json"), "utf-8"));
   const workspaceGlobs = rootPkg.workspaces ?? [];
   const results = [];
   for (const glob2 of workspaceGlobs) {
     const base2 = glob2.replace("/*", "");
-    const baseDir = join9(rootDir, base2);
-    if (!existsSync8(baseDir))
+    const baseDir = join8(rootDir, base2);
+    if (!existsSync7(baseDir))
       continue;
     let entries;
     try {
-      entries = readdirSync5(baseDir);
+      entries = readdirSync4(baseDir);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const pkgPath = join9(baseDir, entry, "package.json");
-      if (!existsSync8(pkgPath))
+      const pkgPath = join8(baseDir, entry, "package.json");
+      if (!existsSync7(pkgPath))
         continue;
-      const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
       if (pkg.name?.startsWith("@arcote.tech/"))
         continue;
-      const pkgDir = join9(baseDir, entry);
+      const pkgDir = join8(baseDir, entry);
       const candidates = [
-        join9(pkgDir, "src", "index.ts"),
-        join9(pkgDir, "src", "index.tsx"),
-        join9(pkgDir, "index.ts"),
-        join9(pkgDir, "index.tsx")
+        join8(pkgDir, "src", "index.ts"),
+        join8(pkgDir, "src", "index.tsx"),
+        join8(pkgDir, "index.ts"),
+        join8(pkgDir, "index.tsx")
       ];
-      const entrypoint = candidates.find((c) => existsSync8(c)) ?? null;
+      const entrypoint = candidates.find((c) => existsSync7(c)) ?? null;
       if (!entrypoint)
         continue;
       results.push({
         name: pkg.name,
-        path: join9(baseDir, entry),
+        path: join8(baseDir, entry),
         entrypoint,
         packageJson: pkg
       });
@@ -26956,7 +26913,7 @@ var sourceFilter = (rel) => {
   return true;
 };
 function pkgSourceHash(pkg) {
-  return sha256OfDir(join9(pkg.path, "src"), sourceFilter);
+  return sha256OfDir(join8(pkg.path, "src"), sourceFilter);
 }
 function depVersionsHash(rootDir, pkg) {
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
@@ -26969,7 +26926,7 @@ function depVersionsHash(rootDir, pkg) {
 }
 async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const unitId = `context-pkg:${pkg.name}:${client.name}`;
-  const outDir = join9(pkg.path, "dist", client.name);
+  const outDir = join8(pkg.path, "dist", client.name);
   const inputHash = sha256OfJson({
     src: pkgSourceHash(pkg),
     pkg: pkg.packageJson,
@@ -26978,21 +26935,22 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
     target: client.target,
     defines: client.defines
   });
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(outDir, "main", "index.js")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(outDir, "main", "index.js")])) {
     console.log(`  \u2713 cached: ${pkg.name} (${client.name})`);
     return { pkgName: pkg.name, client: client.name, declarationErrors: [], cached: true };
   }
   console.log(`  building: ${pkg.name} (${client.name})`);
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
-  const deps = Object.keys(pkg.packageJson.dependencies ?? {});
-  const externals = [...peerDeps, ...deps];
+  const allDeps = pkg.packageJson.dependencies ?? {};
+  const externals = [...peerDeps, ...Object.keys(allDeps)];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
-    outdir: join9(outDir, "main"),
+    outdir: join8(outDir, "main"),
     target: client.target,
     format: "esm",
     naming: "index.[ext]",
     external: externals,
+    plugins: [jsxDevShimPlugin()],
     define: client.defines
   });
   if (!result.success) {
@@ -27025,115 +26983,180 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
   }
   return { declarationErrors };
 }
-async function buildModulesBundle(rootDir, outDir, packages, cache, noCache) {
-  mkdirSync7(outDir, { recursive: true });
-  const unitId = "modules-bundle";
-  const pkgHashes = packages.map((p) => ({
-    name: p.name,
-    safeName: basename2(p.path),
-    srcHash: pkgSourceHash(p)
-  }));
+async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollector) {
+  mkdirSync6(outDir, { recursive: true });
+  const publicMembers = plan.groups.get("public") ?? [];
+  const protectedGroups = plan.chunks.filter((c) => c !== "public").map((c) => ({ name: c, members: plan.groups.get(c) ?? [] })).filter((g) => g.members.length > 0);
+  const unitId = "browser-app";
+  const allMembers = [];
+  for (const m of publicMembers) {
+    allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg) });
+  }
+  for (const g of protectedGroups) {
+    for (const m of g.members) {
+      allMembers.push({ name: m.pkg.name, group: g.name, srcHash: pkgSourceHash(m.pkg) });
+    }
+  }
   const inputHash = sha256OfJson({
-    pkgHashes,
-    externals: SHELL_EXTERNALS,
+    members: allMembers,
+    groups: [
+      "initial",
+      ...protectedGroups.map((g) => g.name).sort()
+    ],
     define: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" }
   });
   if (!noCache && isCacheHit(cache, unitId, inputHash)) {
-    const existing = cache.units[unitId]?.outputHashes ?? {};
-    const modules = [];
-    for (const { safeName, name } of pkgHashes) {
-      const file = `${safeName}.js`;
-      const filePath = join9(outDir, file);
-      if (!existsSync8(filePath)) {
-        console.log(`  rebuilding modules-bundle: output ${file} missing`);
-        return await actuallyBuild();
-      }
-      modules.push({ file, name, hash: existing[safeName] ?? sha256Hex(readFileSync8(filePath)) });
-    }
-    console.log(`  \u2713 cached: modules-bundle (${modules.length} module(s))`);
-    return { modules, cached: true };
-  }
-  return await actuallyBuild();
-  async function actuallyBuild() {
-    console.log(`  building: modules-bundle (${packages.length} package(s))`);
-    const tmpDir = join9(outDir, "_entries");
-    mkdirSync7(tmpDir, { recursive: true });
-    const entrypoints = [];
-    const fileToName = new Map;
-    for (const pkg of packages) {
-      const safeName = basename2(pkg.path);
-      const moduleName = pkg.name.includes("/") ? pkg.name.split("/").pop() : pkg.name;
-      fileToName.set(safeName, moduleName);
-      const wrapperFile = join9(tmpDir, `${safeName}.ts`);
-      writeFileSync7(wrapperFile, `export * from "${pkg.name}";
+    const cached = cache.units[unitId]?.outputHashes;
+    if (cached?._manifest) {
+      try {
+        const m = JSON.parse(cached._manifest);
+        const allFiles = [
+          m.initial.file,
+          ...Object.values(m.groups).map((g) => g.file),
+          ...m.sharedChunks
+        ];
+        if (allFiles.every((f) => existsSync7(join8(outDir, f)))) {
+          console.log(`  \u2713 cached: ${unitId}`);
+          return { ...m, cached: true };
+        }
+      } catch {}
+    }
+  }
+  console.log(`  building: ${unitId} (initial: ${publicMembers.length} modules, groups: ${protectedGroups.map((g) => `${g.name}=${g.members.length}`).join(",") || "none"})`);
+  if (existsSync7(outDir)) {
+    for (const f of readdirSync4(outDir)) {
+      if (f.endsWith(".js"))
+        rmSync(join8(outDir, f), { force: true });
+    }
+  }
+  const tmpDir = join8(outDir, "_entries");
+  mkdirSync6(tmpDir, { recursive: true });
+  const importLines = (pkgs) => pkgs.map((m) => `import "${m.pkg.name}";`).join(`
 `);
-      entrypoints.push(wrapperFile);
-    }
-    const i18nCollector = new Map;
-    const arcExternalPlugin = {
-      name: "arc-external",
-      setup(build2) {
-        build2.onResolve({ filter: /^@arcote\.tech\// }, (args) => {
-          return { path: args.path, external: true };
-        });
-      }
-    };
-    const result = await Bun.build({
-      entrypoints,
+  const initialEntry = join8(tmpDir, "initial.ts");
+  writeFileSync6(initialEntry, `${importLines(publicMembers)}
+export { startApp } from "@arcote.tech/platform";
+`);
+  const entryPaths = [initialEntry];
+  const groupModuleMap = new Map;
+  for (const g of protectedGroups) {
+    const entry = join8(tmpDir, `${g.name}.ts`);
+    writeFileSync6(entry, `${importLines(g.members)}
+`);
+    entryPaths.push(entry);
+    groupModuleMap.set(g.name, g.members.map((m) => m.moduleName));
+  }
+  const allMemberPkgs = new Map;
+  for (const m of publicMembers)
+    allMemberPkgs.set(m.pkg.name, m.pkg);
+  for (const g of protectedGroups)
+    for (const m of g.members)
+      allMemberPkgs.set(m.pkg.name, m.pkg);
+  const patchedPkgJsons = [];
+  for (const pkg of allMemberPkgs.values()) {
+    const pkgJsonPath = join8(pkg.path, "package.json");
+    if (!existsSync7(pkgJsonPath))
+      continue;
+    const original = readFileSync7(pkgJsonPath, "utf-8");
+    const parsed = JSON.parse(original);
+    if (parsed.sideEffects === true)
+      continue;
+    parsed.sideEffects = true;
+    writeFileSync6(pkgJsonPath, JSON.stringify(parsed, null, 2) + `
+`);
+    patchedPkgJsons.push({ path: pkgJsonPath, original });
+  }
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: entryPaths,
       outdir: outDir,
       splitting: true,
       format: "esm",
       target: "browser",
-      external: SHELL_EXTERNALS,
-      plugins: [arcExternalPlugin, i18nExtractPlugin(i18nCollector, rootDir)],
+      external: [],
+      plugins: [
+        singleReactPlugin(rootDir),
+        jsxDevShimPlugin(),
+        i18nExtractPlugin(i18nCollector, rootDir)
+      ],
       naming: "[name].[ext]",
       define: {
         ONLY_SERVER: "false",
         ONLY_BROWSER: "true",
-        ONLY_CLIENT: "true"
+        ONLY_CLIENT: "true",
+        "process.env.NODE_ENV": '"production"'
       }
     });
-    if (!result.success) {
-      console.error("Modules bundle build failed:");
-      for (const log2 of result.logs)
-        console.error(log2);
-      throw new Error("Module build failed");
-    }
-    await finalizeTranslations(rootDir, join9(outDir, ".."), i18nCollector);
-    rmSync2(tmpDir, { recursive: true, force: true });
-    const outputHashes = {};
-    const modules = result.outputs.filter((o) => o.kind === "entry-point").map((o) => {
-      const file = basename2(o.path);
-      const safeName = file.replace(/\.js$/, "");
-      const bytes = readFileSync8(o.path);
-      const hash = sha256Hex(bytes);
-      outputHashes[safeName] = hash;
-      return {
-        file,
-        name: fileToName.get(safeName) ?? safeName,
-        hash
-      };
-    });
-    updateCache(cache, unitId, inputHash, { outputHashes });
-    return { modules, cached: false };
+  } finally {
+    for (const p of patchedPkgJsons)
+      writeFileSync6(p.path, p.original);
   }
+  rmSync(tmpDir, { recursive: true, force: true });
+  if (!result.success) {
+    for (const log2 of result.logs)
+      console.error(log2);
+    throw new Error("Browser app build failed");
+  }
+  let initialFile = "";
+  let initialHash = "";
+  const groups = {};
+  const sharedChunks = [];
+  for (const out of result.outputs) {
+    const name = basename2(out.path);
+    if (out.kind === "entry-point") {
+      const bytes = readFileSync7(out.path);
+      const hash = sha256Hex(bytes).slice(0, 16);
+      const stem = name.replace(/\.js$/, "");
+      const finalName = `${stem}.${hash}.js`;
+      const finalPath = join8(outDir, finalName);
+      rmSync(finalPath, { force: true });
+      writeFileSync6(finalPath, bytes);
+      rmSync(out.path, { force: true });
+      if (stem === "initial") {
+        initialFile = finalName;
+        initialHash = hash;
+      } else {
+        groups[stem] = {
+          file: finalName,
+          hash,
+          modules: groupModuleMap.get(stem) ?? []
+        };
+      }
+    } else if (out.kind === "chunk") {
+      sharedChunks.push(name);
+    }
+  }
+  if (!initialFile) {
+    throw new Error("Browser app build: initial entry not found in outputs");
+  }
+  const manifest = {
+    initial: { file: initialFile, hash: initialHash },
+    groups,
+    sharedChunks,
+    cached: false
+  };
+  updateCache(cache, unitId, inputHash, {
+    outputHashes: { _manifest: JSON.stringify(manifest) }
+  });
+  return manifest;
 }
 async function buildTranslations(rootDir, arcDir, cache, noCache) {
-  const localesDir = join9(rootDir, "locales");
-  if (!existsSync8(localesDir))
+  const localesDir = join8(rootDir, "locales");
+  if (!existsSync7(localesDir))
     return;
   const unitId = "translations";
-  const poFiles = readdirSync5(localesDir).filter((f) => f.endsWith(".po")).map((f) => join9(localesDir, f));
+  const poFiles = readdirSync4(localesDir).filter((f) => f.endsWith(".po")).map((f) => join8(localesDir, f));
   if (poFiles.length === 0)
     return;
   const inputHash = sha256OfFiles(poFiles);
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(arcDir, "locales")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(arcDir, "locales")])) {
     console.log(`  \u2713 cached: translations`);
     return;
   }
   console.log(`  building: translations (${poFiles.length} catalog(s))`);
-  compileAllCatalogs(localesDir, join9(arcDir, "locales"));
-  const jsonFiles = readdirSync5(join9(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join9(arcDir, "locales", f));
+  compileAllCatalogs(localesDir, join8(arcDir, "locales"));
+  const jsonFiles = readdirSync4(join8(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join8(arcDir, "locales", f));
   const outputHash = sha256OfFiles(jsonFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
@@ -27197,10 +27220,10 @@ var TAILWIND_INPUT_TEMPLATE = (rootRel) => `@import "tailwindcss";
 }
 `;
 async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache) {
-  mkdirSync7(arcDir, { recursive: true });
-  const inputCss = join9(arcDir, "_input.css");
-  const outputCss = join9(arcDir, "styles.css");
-  const themeOutput = join9(arcDir, "theme.css");
+  mkdirSync6(arcDir, { recursive: true });
+  const inputCss = join8(arcDir, "_input.css");
+  const outputCss = join8(arcDir, "styles.css");
+  const themeOutput = join8(arcDir, "theme.css");
   const rootRel = relative3(arcDir, rootDir).replace(/\\/g, "/");
   const inputCssContent = TAILWIND_INPUT_TEMPLATE(rootRel);
   const tsxFilter = (rel) => {
@@ -27212,15 +27235,15 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
   };
   const wsHashes = {};
   for (const p of packages) {
-    wsHashes[p.name] = sha256OfDir(join9(p.path, "src"), tsxFilter);
+    wsHashes[p.name] = sha256OfDir(join8(p.path, "src"), tsxFilter);
   }
-  const platformSrc = join9(rootDir, "node_modules", "@arcote.tech", "platform", "src");
-  const arcDsSrc = join9(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
+  const platformSrc = join8(rootDir, "node_modules", "@arcote.tech", "platform", "src");
+  const arcDsSrc = join8(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
   const frameworkHashes = {
     platform: sha256OfDir(platformSrc, tsxFilter),
     arcDs: sha256OfDir(arcDsSrc, tsxFilter)
   };
-  const themeContent = themePath && existsSync8(join9(rootDir, themePath)) ? readFileSync8(join9(rootDir, themePath)) : null;
+  const themeContent = themePath && existsSync7(join8(rootDir, themePath)) ? readFileSync7(join8(rootDir, themePath)) : null;
   const themeHash = themeContent ? sha256Hex(themeContent) : null;
   const unitId = "styles";
   const inputHash = sha256OfJson({
@@ -27237,142 +27260,45 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
     return;
   }
   console.log(`  building: styles`);
-  writeFileSync7(inputCss, inputCssContent);
+  writeFileSync6(inputCss, inputCssContent);
   execSync(`bunx @tailwindcss/cli -i ${inputCss} -o ${outputCss} --minify`, {
     cwd: rootDir,
     stdio: "inherit"
   });
   if (themePath && themeContent) {
-    writeFileSync7(themeOutput, themeContent);
+    writeFileSync6(themeOutput, themeContent);
   }
   const outFiles = [outputCss];
-  if (themePath && existsSync8(themeOutput))
+  if (themePath && existsSync7(themeOutput))
     outFiles.push(themeOutput);
   const outputHash = sha256OfFiles(outFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
 
-// src/builder/dependency-collector.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename3, join as join10 } from "path";
-var FRAMEWORK_PEERS = [
-  "@arcote.tech/arc",
-  "@arcote.tech/arc-ds",
-  "@arcote.tech/arc-react",
-  "@arcote.tech/platform",
-  "react",
-  "react-dom"
-];
-function collectFrameworkDeps(arcDir, rootDir, packages) {
-  mkdirSync8(arcDir, { recursive: true });
-  const versions = resolveFrameworkVersions(rootDir, packages);
-  const manifest = {
-    name: "arc-platform-framework",
-    private: true,
-    type: "module",
-    dependencies: versions
-  };
-  const manifestPath = join10(arcDir, "package.json");
-  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
-`);
-  const targetLock = join10(arcDir, "bun.lock");
-  writeFileSync8(targetLock, "");
-  const hash = sha256ConcatHex([manifestPath, targetLock]);
-  writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
-`);
-  return { hash, manifestPath };
-}
-function sha256ConcatHex(paths) {
-  const hash = createHash("sha256");
-  for (const p of paths) {
-    if (existsSync9(p)) {
-      hash.update(readFileSync9(p));
-    }
-  }
-  return hash.digest("hex");
-}
-function collectModuleDeps(arcDir, pkg) {
-  const safeName = basename3(pkg.path);
-  const moduleDir = join10(arcDir, "modules", safeName);
-  mkdirSync8(moduleDir, { recursive: true });
-  const pkgDeps = pkg.packageJson.dependencies ?? {};
-  const filtered = {};
-  const frameworkSet = new Set(FRAMEWORK_PEERS);
-  for (const [name, spec] of Object.entries(pkgDeps)) {
-    if (frameworkSet.has(name))
-      continue;
-    if (spec.startsWith("workspace:"))
-      continue;
-    filtered[name] = spec;
-  }
-  const manifest = {
-    name: `arc-module-${safeName}`,
-    private: true,
-    type: "module",
-    dependencies: filtered
-  };
-  const manifestPath = join10(moduleDir, "package.json");
-  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
-`);
-  const hash = sha256OfFiles2([manifestPath]);
-  writeFileSync8(join10(moduleDir, ".deps-hash"), hash + `
-`);
-  return { hash, manifestPath };
-}
-function resolveFrameworkVersions(rootDir, packages) {
-  const rootPkg = JSON.parse(readFileSync9(join10(rootDir, "package.json"), "utf-8"));
-  const rootDeps = rootPkg.dependencies ?? {};
-  const out = {};
-  for (const name of FRAMEWORK_PEERS) {
-    const rootSpec = rootDeps[name];
-    if (rootSpec) {
-      out[name] = rootSpec;
-      continue;
-    }
-    let found;
-    for (const pkg of packages) {
-      const spec = (pkg.packageJson.dependencies ?? {})[name];
-      if (spec) {
-        found = spec;
-        break;
-      }
-    }
-    out[name] = found ?? "*";
-  }
-  return out;
-}
-function sha256OfFiles2(paths) {
-  const hash = createHash("sha256");
-  for (const p of paths.sort()) {
-    if (!existsSync9(p))
-      continue;
-    hash.update(p);
-    hash.update("\x00");
-    hash.update(readFileSync9(p));
-    hash.update("\x00");
-  }
-  return hash.digest("hex");
-}
-
 // src/builder/access-extractor.ts
 var {spawn: spawn2 } = globalThis.Bun;
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
-import { tmpdir } from "os";
-import { basename as basename4, join as join11 } from "path";
-async function extractAccessMap(arcDir, packages) {
-  const serverBundles = packages.filter((p) => isContextPackage(p.packageJson)).map((p) => {
-    const v06Path = join11(arcDir, "modules", basename4(p.path), "server.js");
-    const legacyPath = join11(p.path, "dist", "server", "main", "index.js");
-    return { name: p.name, path: v06Path, fallback: legacyPath };
-  });
-  const outPath = join11(arcDir, "access.json");
-  mkdirSync9(arcDir, { recursive: true });
-  const workerPath = join11(tmpdir(), `arc-access-extractor-${Date.now()}.mjs`);
-  writeFileSync9(workerPath, WORKER_SOURCE);
+import {
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync8,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { join as join9 } from "path";
+async function extractAccessMap(rootDir, packages) {
+  const serverBundles = packages.filter((p) => isContextPackage(p.packageJson)).map((p) => ({
+    name: p.name,
+    path: join9(p.path, "dist", "server", "main", "index.js")
+  })).filter((b) => existsSync8(b.path));
+  const workerDir = join9(rootDir, ".arc", ".tmp");
+  mkdirSync7(workerDir, { recursive: true });
+  const workerPath = join9(workerDir, `access-extractor-${Date.now()}.mjs`);
+  const outPath = join9(workerDir, `access-${Date.now()}.json`);
+  writeFileSync7(workerPath, WORKER_SOURCE);
   try {
     const proc2 = spawn2({
       cmd: ["bun", "run", workerPath],
+      cwd: rootDir,
       env: {
         ...process.env,
         ARC_ACCESS_BUNDLES: JSON.stringify(serverBundles),
@@ -27385,17 +27311,20 @@ async function extractAccessMap(arcDir, packages) {
     if (exit !== 0) {
       throw new Error(`access-extractor subprocess exited with ${exit}`);
     }
-    return JSON.parse(readFileSync10(outPath, "utf-8"));
+    return JSON.parse(readFileSync8(outPath, "utf-8"));
   } finally {
     try {
       unlinkSync2(workerPath);
     } catch {}
+    try {
+      unlinkSync2(outPath);
+    } catch {}
   }
 }
 var WORKER_SOURCE = `
-import { existsSync } from "node:fs";
-
 globalThis.ONLY_SERVER = true;
+globalThis.ONLY_BROWSER = false;
+globalThis.ONLY_CLIENT = false;
 
 const bundles = JSON.parse(process.env.ARC_ACCESS_BUNDLES || "[]");
 const out = process.env.ARC_ACCESS_OUT;
@@ -27403,38 +27332,153 @@ if (!out) {
   console.error("[access-extractor-worker] ARC_ACCESS_OUT not set");
   process.exit(2);
 }
-
-const platform = await import("@arcote.tech/platform");
-
-for (const { name, path, fallback } of bundles) {
-  const target = existsSync(path) ? path : fallback;
-  if (!target || !existsSync(target)) {
-    // No server bundle on either path \u2014 module has no protected access rules
-    // to discover. Skip silently rather than logging a misleading error.
-    continue;
+
+// Bare-specifier import \u2014 Bun walks up from this worker's location
+// (<rootDir>/.arc/.tmp/) to <rootDir>/node_modules and finds the package.
+// Single entry (./src/index.ts) \u2014 React imports on top level are benign
+// (createContext, function defs); no DOM access until actual render.
+const platform = await import("@arcote.tech/platform");
+
+for (const { name, path } of bundles) {
+  try {
+    await import(path);
+  } catch (e) {
+    console.error("[access-extractor-worker] failed to import", name, ":", e.message);
+    // Partial map is better than total failure.
+  }
+}
+
+const result = {};
+for (const [name, access] of platform.getAllModuleAccess()) {
+  result[name] = {
+    rules: (access.rules ?? []).map((r) => ({
+      token: { name: r.token?.name ?? "" },
+      hasCheck: typeof r.check === "function",
+    })),
+  };
+}
+
+const { writeFileSync } = await import("node:fs");
+writeFileSync(out, JSON.stringify(result, null, 2) + "\\n");
+`.trim();
+
+// src/builder/chunk-planner.ts
+import { basename as basename3 } from "path";
+var PUBLIC_CHUNK = "public";
+function planChunks(packages, accessMap) {
+  const assignments = new Map;
+  const groups = new Map;
+  for (const pkg of packages) {
+    const moduleName = moduleNameOf(pkg.name);
+    const access = accessMap[moduleName];
+    const chunk = resolveChunk(moduleName, access);
+    const entry = {
+      pkg,
+      chunk,
+      moduleName,
+      safeName: basename3(pkg.path)
+    };
+    assignments.set(moduleName, entry);
+    const bucket = groups.get(chunk);
+    if (bucket) {
+      bucket.push(entry);
+    } else {
+      groups.set(chunk, [entry]);
+    }
+  }
+  const chunks = [...groups.keys()].sort((a, b) => {
+    if (a === PUBLIC_CHUNK)
+      return -1;
+    if (b === PUBLIC_CHUNK)
+      return 1;
+    return a.localeCompare(b);
+  });
+  return { assignments, groups, chunks };
+}
+function moduleNameOf(pkgName) {
+  return pkgName.includes("/") ? pkgName.split("/").pop() : pkgName;
+}
+function resolveChunk(moduleName, access) {
+  if (!access || access.rules.length === 0)
+    return PUBLIC_CHUNK;
+  const tokenNames = new Set(access.rules.map((r) => r.token.name));
+  if (tokenNames.size === 1) {
+    return [...tokenNames][0];
+  }
+  const list = [...tokenNames].sort().join(", ");
+  throw new Error(`Module "${moduleName}" has access rules for multiple tokens [${list}]. ` + `Multi-token modules are not supported \u2014 split the module or unify on a single token type.`);
+}
+
+// src/builder/dependency-collector.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename4, join as join10 } from "path";
+function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = []) {
+  mkdirSync8(arcDir, { recursive: true });
+  const versions = resolveFrameworkVersions(rootDir, packages);
+  for (const { name, version } of sharedDeps) {
+    versions[name] = version;
+  }
+  const manifest = {
+    name: "arc-platform-framework",
+    private: true,
+    type: "module",
+    dependencies: versions
+  };
+  const manifestPath = join10(arcDir, "package.json");
+  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
+`);
+  const hash = sha256Hex2(readFileSync9(manifestPath));
+  writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
+`);
+  return { hash, manifestPath };
+}
+function sha256Hex2(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function resolveFrameworkVersions(rootDir, packages) {
+  const rootPkg = JSON.parse(readFileSync9(join10(rootDir, "package.json"), "utf-8"));
+  const rootDeps = rootPkg.dependencies ?? {};
+  const rootDevDeps = rootPkg.devDependencies ?? {};
+  const required = new Set(FRAMEWORK_PEERS);
+  for (const pkg of packages) {
+    const peers = pkg.packageJson.peerDependencies ?? {};
+    const deps = pkg.packageJson.dependencies ?? {};
+    for (const name of Object.keys(peers)) {
+      if (name.startsWith("@arcote.tech/"))
+        required.add(name);
+    }
+    for (const [name, spec] of Object.entries(deps)) {
+      if (spec.startsWith("workspace:"))
+        continue;
+      if (name.startsWith("@arcote.tech/") || !isFrameworkExternal(name))
+        continue;
+      required.add(name);
+    }
   }
-  try {
-    await import(target);
-  } catch (e) {
-    console.error("[access-extractor-worker] failed to import", name, "from", target, e);
-    // Continue \u2014 partial access map is better than total failure.
+  const out = {};
+  for (const name of required) {
+    const rootSpec = rootDeps[name] ?? rootDevDeps[name];
+    if (rootSpec) {
+      out[name] = rootSpec;
+      continue;
+    }
+    let found;
+    for (const pkg of packages) {
+      const spec = (pkg.packageJson.dependencies ?? {})[name] ?? (pkg.packageJson.peerDependencies ?? {})[name];
+      if (spec) {
+        found = spec;
+        break;
+      }
+    }
+    out[name] = found ?? "*";
   }
+  return out;
 }
-
-const result = {};
-for (const [name, access] of platform.getAllModuleAccess()) {
-  result[name] = {
-    rules: (access.rules ?? []).map((r) => ({
-      token: { name: r.token?.name ?? "" },
-      hasCheck: typeof r.check === "function",
-    })),
-  };
+function isFrameworkExternal(_name) {
+  return true;
 }
 
-const { writeFileSync } = await import("node:fs");
-writeFileSync(out, JSON.stringify(result, null, 2) + "\\n");
-`.trim();
-
 // src/platform/shared.ts
 var C = {
   reset: "\x1B[0m",
@@ -27452,22 +27496,22 @@ function resolveWorkspace() {
     process.exit(1);
   }
   const rootDir = dirname6(packageJsonPath);
-  const rootPkg = JSON.parse(readFileSync11(packageJsonPath, "utf-8"));
+  const rootPkg = JSON.parse(readFileSync10(packageJsonPath, "utf-8"));
   const appName = rootPkg.name ?? "Arc App";
-  const arcDir = join12(rootDir, ".arc", "platform");
+  const arcDir = join11(rootDir, ".arc", "platform");
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
-  ok(`Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`);
-  if (packages.length === 0 && process.env.ARC_DEPLOY_API !== "1") {
-    err("No workspace packages found.");
-    process.exit(1);
+  if (packages.length > 0) {
+    ok(`Found ${packages.length} package(s): ${packages.map((p) => p.name).join(", ")}`);
+  } else {
+    log2("No workspace packages found \u2014 assuming image runtime mode.");
   }
   let manifest;
   for (const name of ["manifest.json", "manifest.webmanifest"]) {
-    const manifestPath = join12(rootDir, name);
+    const manifestPath = join11(rootDir, name);
     if (existsSync10(manifestPath)) {
       try {
-        const data = JSON.parse(readFileSync11(manifestPath, "utf-8"));
+        const data = JSON.parse(readFileSync10(manifestPath, "utf-8"));
         const icons = data.icons;
         manifest = {
           path: manifestPath,
@@ -27486,10 +27530,9 @@ function resolveWorkspace() {
     rootPkg,
     appName,
     arcDir,
-    modulesDir: join12(arcDir, "modules"),
-    shellDir: join12(arcDir, "shell"),
-    assetsDir: join12(arcDir, "assets"),
-    publicDir: join12(rootDir, "public"),
+    browserDir: join11(arcDir, "browser"),
+    assetsDir: join11(arcDir, "assets"),
+    publicDir: join11(rootDir, "public"),
     packages,
     manifest
   };
@@ -27499,63 +27542,74 @@ async function buildAll(ws, opts = {}) {
   const noCache = opts.noCache ?? false;
   const themePath = ws.rootPkg.arc?.theme;
   log2(`Building (concurrency parallel${noCache ? ", no-cache" : ""})...`);
-  const [, modulesResult] = await Promise.all([
-    buildContextPackages(ws.rootDir, ws.packages, cache, noCache),
-    buildModulesBundle(ws.rootDir, ws.modulesDir, ws.packages, cache, noCache),
-    buildShell2(ws, cache, noCache),
+  await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
+  copyContextServerBundles(ws);
+  const accessMap = await extractAccessMap(ws.rootDir, ws.packages);
+  mkdirSync9(ws.arcDir, { recursive: true });
+  writeFileSync9(join11(ws.arcDir, "access.json"), JSON.stringify(accessMap, null, 2) + `
+`);
+  const plan = planChunks(ws.packages, accessMap);
+  ok(`Chunks: ${plan.chunks.map((c) => `${c}(${plan.groups.get(c)?.length ?? 0})`).join(", ")}`);
+  const i18nCollector = new Map;
+  const [browserResult] = await Promise.all([
+    buildBrowserApp(ws.rootDir, ws.browserDir, plan, cache, noCache, i18nCollector),
     buildStyles(ws.rootDir, ws.arcDir, ws.packages, themePath, cache, noCache),
     copyBrowserAssets(ws, cache, noCache),
     buildTranslations(ws.rootDir, ws.arcDir, cache, noCache)
   ]);
-  saveBuildCache(ws.arcDir, cache);
+  const { finalizeTranslations: finalizeTranslations3 } = await Promise.resolve().then(() => (init_i18n(), exports_i18n));
+  await finalizeTranslations3(ws.rootDir, ws.arcDir, i18nCollector);
   collectFrameworkDeps(ws.arcDir, ws.rootDir, ws.packages);
-  for (const pkg of ws.packages) {
-    collectModuleDeps(ws.arcDir, pkg);
-  }
-  try {
-    await extractAccessMap(ws.arcDir, ws.packages);
-  } catch (e) {
-    err(`access-extractor failed: ${e.message}`);
-  }
-  const finalManifest = assembleManifest(ws, modulesResult.modules, cache);
-  writeFileSync10(join12(ws.modulesDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
+  saveBuildCache(ws.arcDir, cache);
+  const finalManifest = assembleManifest(ws, browserResult, cache);
+  writeFileSync9(join11(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
   return finalManifest;
 }
-function assembleManifest(ws, modules, cache) {
-  const shellEntries = {};
-  for (const [unitId, entry] of Object.entries(cache.units)) {
-    if (unitId.startsWith("shell:") && entry.outputHash) {
-      shellEntries[unitId] = entry.outputHash;
-    }
-  }
-  const shellHash = sha256OfJson(shellEntries);
+function assembleManifest(ws, browser, cache) {
   const stylesHash = cache.units["styles"]?.outputHash ?? "";
   return {
-    modules,
-    shellHash,
+    initial: browser.initial,
+    groups: browser.groups,
+    sharedChunks: browser.sharedChunks,
     stylesHash,
     buildTime: new Date().toISOString()
   };
 }
+function copyContextServerBundles(ws) {
+  const outDir = join11(ws.arcDir, "server");
+  mkdirSync9(outDir, { recursive: true });
+  for (const pkg of ws.packages) {
+    if (!isContextPackage(pkg.packageJson))
+      continue;
+    const src = join11(pkg.path, "dist", "server", "main", "index.js");
+    if (!existsSync10(src)) {
+      err(`Server bundle missing for ${pkg.name}: ${src}`);
+      continue;
+    }
+    const safeName = pkg.path.split("/").pop();
+    const dst = join11(outDir, `${safeName}.js`);
+    copyFileSync(src, dst);
+  }
+}
 function resolveAssetSource(from, pkgDir, rootDir) {
   if (from.startsWith("./") || from.startsWith("../")) {
-    const resolved = join12(pkgDir, from);
+    const resolved = join11(pkgDir, from);
     return existsSync10(resolved) ? resolved : null;
   }
   const candidates = [
-    join12(rootDir, "node_modules", from),
-    join12(pkgDir, "node_modules", from)
+    join11(rootDir, "node_modules", from),
+    join11(pkgDir, "node_modules", from)
   ];
   for (const c of candidates) {
     if (existsSync10(c))
       return c;
   }
-  const bunCacheDir = join12(rootDir, "node_modules", ".bun");
+  const bunCacheDir = join11(rootDir, "node_modules", ".bun");
   if (existsSync10(bunCacheDir)) {
-    for (const entry of readdirSync6(bunCacheDir, { withFileTypes: true })) {
+    for (const entry of readdirSync5(bunCacheDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const candidate = join12(bunCacheDir, entry.name, "node_modules", from);
+      const candidate = join11(bunCacheDir, entry.name, "node_modules", from);
       if (existsSync10(candidate))
         return candidate;
     }
@@ -27563,11 +27617,11 @@ function resolveAssetSource(from, pkgDir, rootDir) {
   return null;
 }
 function readBrowserAssets(pkgDir) {
-  const pkgJsonPath = join12(pkgDir, "package.json");
+  const pkgJsonPath = join11(pkgDir, "package.json");
   if (!existsSync10(pkgJsonPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgJsonPath, "utf-8"));
     const assets = pkg.arc?.browserAssets;
     if (!Array.isArray(assets))
       return [];
@@ -27577,14 +27631,14 @@ function readBrowserAssets(pkgDir) {
   }
 }
 function discoverBrowserAssets(ws) {
-  const arcDir = join12(ws.rootDir, "node_modules", "@arcote.tech");
+  const arcDir = join11(ws.rootDir, "node_modules", "@arcote.tech");
   if (!existsSync10(arcDir))
     return [];
   const out = [];
-  for (const entry of readdirSync6(arcDir, { withFileTypes: true })) {
+  for (const entry of readdirSync5(arcDir, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const pkgDir = join12(arcDir, entry.name);
+    const pkgDir = join11(arcDir, entry.name);
     const assets = readBrowserAssets(pkgDir);
     for (const asset of assets) {
       const src = resolveAssetSource(asset.from, pkgDir, ws.rootDir);
@@ -27598,7 +27652,7 @@ function discoverBrowserAssets(ws) {
   return out;
 }
 async function copyBrowserAssets(ws, cache, noCache) {
-  mkdirSync10(ws.assetsDir, { recursive: true });
+  mkdirSync9(ws.assetsDir, { recursive: true });
   const assets = discoverBrowserAssets(ws);
   if (assets.length === 0)
     return;
@@ -27609,7 +27663,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
     to: a.to,
     mtime: mtimeOf(a.src)
   })));
-  const requiredOutputs = assets.map((a) => join12(ws.assetsDir, a.to));
+  const requiredOutputs = assets.map((a) => join11(ws.assetsDir, a.to));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: browser-assets (${assets.length})`);
     return;
@@ -27617,199 +27671,48 @@ async function copyBrowserAssets(ws, cache, noCache) {
   console.log(`  building: browser-assets (${assets.length})`);
   const outputHashes = {};
   for (const asset of assets) {
-    const dest = join12(ws.assetsDir, asset.to);
-    mkdirSync10(dirname6(dest), { recursive: true });
+    const dest = join11(ws.assetsDir, asset.to);
+    mkdirSync9(dirname6(dest), { recursive: true });
     copyFileSync(asset.src, dest);
-    outputHashes[asset.to] = sha256Hex(readFileSync11(dest));
+    outputHashes[asset.to] = sha256Hex(readFileSync10(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
 }
-function collectArcPeerDeps(packages) {
-  const seen = new Set;
-  for (const pkg of ["@arcote.tech/arc", "@arcote.tech/arc-ds", "@arcote.tech/arc-react", "@arcote.tech/platform"]) {
-    seen.add(pkg);
-  }
-  for (const wp of packages) {
-    const peerDeps = wp.packageJson.peerDependencies ?? {};
-    for (const dep of Object.keys(peerDeps)) {
-      if (dep.startsWith("@arcote.tech/"))
-        seen.add(dep);
-    }
-  }
-  return [...seen].map((pkg) => {
-    const short = pkg === "@arcote.tech/platform" ? "platform" : pkg.replace("@arcote.tech/", "");
-    return [short, pkg];
-  });
-}
-var REACT_ENTRIES2 = [
-  [
-    "react",
-    `import React from "react";
-export default React;
-export const {
-  Children, Component, Fragment, Profiler, PureComponent, StrictMode, Suspense,
-  cloneElement, createContext, createElement, createRef, forwardRef, isValidElement,
-  lazy, memo, startTransition, use, useCallback, useContext, useDebugValue,
-  useDeferredValue, useEffect, useId, useImperativeHandle, useInsertionEffect,
-  useLayoutEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore,
-  useTransition, version, useActionState, useOptimistic,
-} = React;`
-  ],
-  ["jsx-runtime", `export { jsx, jsxs, Fragment } from "react/jsx-runtime";`],
-  [
-    "jsx-dev-runtime",
-    `export { jsxDEV, Fragment } from "react/jsx-dev-runtime";`
-  ],
-  [
-    "react-dom",
-    `import ReactDOM from "react-dom";
-export default ReactDOM;
-export const { createPortal, flushSync } = ReactDOM;`
-  ],
-  [
-    "react-dom-client",
-    `export { createRoot, hydrateRoot } from "react-dom/client";`
-  ]
-];
-var REACT_OUTPUT_FILES = REACT_ENTRIES2.map(([n]) => `${n}.js`);
-var SHELL_BASE_EXTERNAL2 = [
-  "react",
-  "react-dom",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "react-dom/client"
-];
-var sourceFilter2 = (rel) => {
-  if (rel.startsWith("dist/") || rel.startsWith("dist"))
-    return false;
-  if (rel.includes("/node_modules/") || rel.startsWith("node_modules"))
-    return false;
-  if (rel.startsWith(".arc/") || rel.startsWith(".arc"))
-    return false;
-  return true;
-};
-function arcPkgSrcHash(rootDir, pkg) {
-  const srcDir = join12(rootDir, "node_modules", pkg, "src");
-  if (existsSync10(srcDir))
-    return sha256OfDir(srcDir, sourceFilter2);
-  return sha256OfDir(join12(rootDir, "node_modules", pkg), sourceFilter2);
-}
-async function buildShellReact(shellDir, tmpDir, rootDir, cache, noCache) {
-  const unitId = "shell:react";
-  const inputHash = sha256OfJson({
-    react: readInstalledVersion(rootDir, "react"),
-    "react-dom": readInstalledVersion(rootDir, "react-dom"),
-    entries: REACT_ENTRIES2.map(([k, v]) => [k, v])
-  });
-  const requiredOutputs = REACT_OUTPUT_FILES.map((f) => join12(shellDir, f));
-  if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
-    console.log(`  \u2713 cached: shell:react`);
-    return;
-  }
-  console.log(`  building: shell:react`);
-  const reactEps = [];
-  for (const [name, code] of REACT_ENTRIES2) {
-    const f = join12(tmpDir, `${name}.ts`);
-    await Bun.write(f, code);
-    reactEps.push(f);
-  }
-  const r = await Bun.build({
-    entrypoints: reactEps,
-    outdir: shellDir,
-    splitting: true,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]"
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error("Shell React build failed");
-  }
-  const outputHash = sha256OfFiles(requiredOutputs);
-  updateCache(cache, unitId, inputHash, { outputHash });
-}
-async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir, rootDir, cache, noCache) {
-  const unitId = `shell:arc:${shortName}`;
-  const otherExternals = allArcPkgs.filter((p) => p !== pkg);
-  const inputHash = sha256OfJson({
-    pkg,
-    version: readInstalledVersion(rootDir, pkg),
-    src: arcPkgSrcHash(rootDir, pkg),
-    base: SHELL_BASE_EXTERNAL2,
-    others: [...otherExternals].sort()
-  });
-  const outputFile = join12(shellDir, `${shortName}.js`);
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [outputFile])) {
-    console.log(`  \u2713 cached: ${unitId}`);
-    return;
-  }
-  console.log(`  building: ${unitId}`);
-  const f = join12(tmpDir, `${shortName}.ts`);
-  await Bun.write(f, `export * from "${pkg}";
-`);
-  const r = await Bun.build({
-    entrypoints: [f],
-    outdir: shellDir,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]",
-    external: [...SHELL_BASE_EXTERNAL2, ...otherExternals],
-    define: {
-      ONLY_SERVER: "false",
-      ONLY_BROWSER: "true",
-      ONLY_CLIENT: "true"
-    }
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error(`Shell build failed for ${pkg}`);
-  }
-  const outputHash = sha256OfFiles([outputFile]);
-  updateCache(cache, unitId, inputHash, { outputHash });
-}
-async function buildShell2(ws, cache, noCache) {
-  mkdirSync10(ws.shellDir, { recursive: true });
-  const tmpDir = join12(ws.shellDir, "_tmp");
-  mkdirSync10(tmpDir, { recursive: true });
-  const arcEntries = collectArcPeerDeps(ws.packages);
-  const allArcPkgs = arcEntries.map(([, pkg]) => pkg);
-  const tasks = [
-    () => buildShellReact(ws.shellDir, tmpDir, ws.rootDir, cache, noCache),
-    ...arcEntries.map(([short, pkg]) => () => buildShellArcEntry(short, pkg, allArcPkgs, ws.shellDir, tmpDir, ws.rootDir, cache, noCache))
-  ];
-  await pAll(tasks);
-  rmSync3(tmpDir, { recursive: true, force: true });
-}
-async function loadServerContext(packages) {
-  const ctxPackages = packages.filter((p) => isContextPackage(p.packageJson));
-  if (ctxPackages.length === 0)
-    return { context: null, moduleAccess: new Map };
+async function loadServerContext(ws) {
   globalThis.ONLY_SERVER = true;
   globalThis.ONLY_BROWSER = false;
   globalThis.ONLY_CLIENT = false;
-  const platformDir = join12(process.cwd(), "node_modules", "@arcote.tech", "platform");
-  const platformPkg = JSON.parse(readFileSync11(join12(platformDir, "package.json"), "utf-8"));
-  const platformEntry = join12(platformDir, platformPkg.main ?? "src/index.ts");
+  const platformDir = join11(process.cwd(), "node_modules", "@arcote.tech", "platform");
+  const platformPkg = JSON.parse(readFileSync10(join11(platformDir, "package.json"), "utf-8"));
+  const platformEntry = join11(platformDir, platformPkg.main ?? "src/index.ts");
   await import(platformEntry);
-  for (const ctx of ctxPackages) {
-    const serverDist = join12(ctx.path, "dist", "server", "main", "index.js");
-    if (!existsSync10(serverDist)) {
-      err(`Context server dist not found: ${serverDist}`);
-      continue;
+  const serverDir = join11(ws.arcDir, "server");
+  const bundles = existsSync10(serverDir) ? readdirSync5(serverDir).filter((f) => f.endsWith(".js")) : [];
+  if (bundles.length > 0) {
+    for (const file of bundles) {
+      const bundlePath = join11(serverDir, file);
+      try {
+        await import(bundlePath);
+      } catch (e) {
+        err(`Failed to load server bundle ${file}: ${e}`);
+      }
     }
-    try {
-      await import(serverDist);
-    } catch (e) {
-      err(`Failed to load server context from ${ctx.name}: ${e}`);
+  } else if (ws.packages.length > 0) {
+    const ctxPackages = ws.packages.filter((p) => isContextPackage(p.packageJson));
+    for (const ctx of ctxPackages) {
+      const serverDist = join11(ctx.path, "dist", "server", "main", "index.js");
+      if (!existsSync10(serverDist)) {
+        err(`Context server dist not found: ${serverDist}`);
+        continue;
+      }
+      try {
+        await import(serverDist);
+      } catch (e) {
+        err(`Failed to load server context from ${ctx.name}: ${e}`);
+      }
     }
-  }
-  const nonCtxPackages = packages.filter((p) => !isContextPackage(p.packageJson));
-  for (const pkg of nonCtxPackages) {
-    try {
-      await import(pkg.entrypoint);
-    } catch {}
+  } else {
+    return { context: null, moduleAccess: new Map };
   }
   const { getContext, getAllModuleAccess } = await import(platformEntry);
   return {
@@ -27822,23 +27725,26 @@ async function loadServerContext(packages) {
 async function platformBuild(opts = {}) {
   const ws = resolveWorkspace();
   const manifest = await buildAll(ws, { noCache: opts.noCache });
-  ok(`Platform built \u2014 ${manifest.modules.length} module(s)`);
+  const groupCount = Object.keys(manifest.groups).length;
+  ok(`Platform built \u2014 initial + ${groupCount} group(s)`);
 }
 
 // src/commands/platform-deploy.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
+import { dirname as dirname8, join as join19 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/deploy/bootstrap.ts
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync14 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join16 } from "path";
+var {spawn: spawn4 } = globalThis.Bun;
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync13 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join17 } from "path";
 
 // src/deploy/ansible.ts
 import { spawn as nodeSpawn } from "child_process";
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join13 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { homedir, tmpdir } from "os";
+import { join as join12 } from "path";
 
 // src/deploy/assets.ts
 var TERRAFORM_MAIN_TF = `terraform {
@@ -28032,7 +27938,22 @@ var ANSIBLE_SITE_YML = `---
         - { policy: deny, dir: incoming }
         - { policy: allow, dir: outgoing }
 
-    - name: Open firewall ports
+    - name: Remove legacy ufw limit rule on SSH (replaced by plain allow)
+      # If a prior bootstrap installed \`ufw limit 22/tcp\`, drop it \u2014 otherwise
+      # the limit rule shadows the allow rule and rate-throttles deploy flows.
+      ufw:
+        rule: limit
+        port: "{{ ssh_port }}"
+        proto: tcp
+        delete: true
+      ignore_errors: true
+
+    - name: Open firewall ports (SSH key-only auth, no brute-force surface)
+      # SSH on port 22: PasswordAuthentication=no + key-only means brute force
+      # is impossible without the operator's private key. Rate-limiting (ufw
+      # limit / fail2ban sshd jail) breaks legitimate deploy flows that open
+      # many short SSH connections in sequence (canSsh -> sshExec -> scp -> ...).
+      # 80/443: Caddy ACME + app traffic, never rate-limited.
       ufw:
         rule: allow
         port: "{{ item }}"
@@ -28046,17 +27967,18 @@ var ANSIBLE_SITE_YML = `---
       ufw:
         state: enabled
 
-    - name: Configure fail2ban for sshd
+    - name: Disable fail2ban sshd jail
+      # Key-only SSH + ufw rate-limit make fail2ban for sshd redundant and
+      # actively harmful when the operator's IP roams. Keep fail2ban installed
+      # for future jails (web/db) but turn off the sshd jail explicitly.
       copy:
         dest: /etc/fail2ban/jail.local
         content: |
           [sshd]
-          enabled = true
-          port = {{ ssh_port }}
-          maxretry = 5
-          findtime = 600
-          bantime = 3600
+          enabled = false
+          {% if extra_allowed_ips %}
           ignoreip = 127.0.0.1/8 ::1 {{ extra_allowed_ips | join(' ') }}
+          {% endif %}
         mode: "0644"
       notify: restart fail2ban
 
@@ -28095,32 +28017,46 @@ var ASSETS = {
   }
 };
 async function materializeAssets(targetDir, files) {
-  const { mkdirSync: mkdirSync11, writeFileSync: writeFileSync11 } = await import("fs");
-  const { join: join13 } = await import("path");
-  mkdirSync11(targetDir, { recursive: true });
+  const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync10 } = await import("fs");
+  const { join: join12 } = await import("path");
+  mkdirSync10(targetDir, { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    writeFileSync11(join13(targetDir, name), content);
+    writeFileSync10(join12(targetDir, name), content);
   }
 }
 
 // src/deploy/ansible.ts
+function pickSshKeyForAnsible(configured) {
+  if (configured) {
+    const expanded = configured.startsWith("~") ? join12(homedir(), configured.slice(1)) : configured;
+    return existsSync11(expanded) ? expanded : null;
+  }
+  for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
+    const path4 = join12(homedir(), ".ssh", name);
+    if (existsSync11(path4))
+      return path4;
+  }
+  return null;
+}
 async function runAnsible(inputs) {
-  const workDir = join13(tmpdir2(), "arc-deploy", `ansible-${Date.now()}`);
-  mkdirSync11(workDir, { recursive: true });
+  const workDir = join12(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
+  mkdirSync10(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.ansible);
   const user = inputs.asRoot ? "root" : inputs.target.user;
   const port = inputs.ansible?.sshPort ?? inputs.target.port;
+  const sshKey = pickSshKeyForAnsible(inputs.target.sshKey);
+  const sshKeyArg = sshKey ? ` -o IdentitiesOnly=yes -i ${sshKey}` : "";
   const inventory = [
     "[arc]",
     `${inputs.target.host} ansible_user=${user} ansible_port=${port}`,
     "",
     "[arc:vars]",
-    "ansible_ssh_common_args='-o StrictHostKeyChecking=accept-new -o BatchMode=yes'",
+    `ansible_ssh_common_args='-o StrictHostKeyChecking=accept-new -o BatchMode=yes -o PreferredAuthentications=publickey${sshKeyArg}'`,
     "ansible_python_interpreter=/usr/bin/python3",
     ""
   ].join(`
 `);
-  writeFileSync11(join13(workDir, "inventory.ini"), inventory);
+  writeFileSync10(join12(workDir, "inventory.ini"), inventory);
   const extraVarsJson = JSON.stringify({
     username: inputs.target.user,
     ssh_port: port,
@@ -28159,22 +28095,17 @@ function generateCaddyfile(cfg) {
   lines.push("");
   for (const [name, env2] of Object.entries(cfg.envs)) {
     lines.push(`${env2.domain} {${tlsDirective}`);
-    lines.push("    @deploy path /api/deploy /api/deploy/*");
-    lines.push("    respond @deploy 404");
-    lines.push("");
     lines.push(`    reverse_proxy arc-${name}:5005`);
     lines.push("}");
     lines.push("");
   }
-  lines.push("# Loopback-only management listener (SSH tunnel access).");
-  lines.push("http://127.0.0.1:2019 {");
-  lines.push("    bind 127.0.0.1");
-  for (const [name] of Object.entries(cfg.envs)) {
-    lines.push(`    handle_path /env/${name}/* {`);
-    lines.push(`        reverse_proxy arc-${name}:5005`);
-    lines.push(`    }`);
-  }
-  lines.push("    respond 404");
+  lines.push(`${cfg.registry.domain} {${tlsDirective}`);
+  lines.push("    reverse_proxy registry:5000 {");
+  lines.push("        header_up Host {host}");
+  lines.push("    }");
+  lines.push("    request_body {");
+  lines.push("        max_size 5GB");
+  lines.push("    }");
   lines.push("}");
   return lines.join(`
 `) + `
@@ -28182,8 +28113,7 @@ function generateCaddyfile(cfg) {
 }
 
 // src/deploy/compose.ts
-var RESERVED_ENV = new Set(["PORT", "ARC_DEPLOY_API", "ARC_CLI_VERSION"]);
-function generateCompose({ cfg, cliVersion }) {
+function generateCompose({ cfg }) {
   const lines = [];
   lines.push("# Generated by `arc platform deploy` \u2014 do not edit by hand.");
   lines.push("");
@@ -28194,7 +28124,6 @@ function generateCompose({ cfg, cliVersion }) {
   lines.push("    ports:");
   lines.push('      - "80:80"');
   lines.push('      - "443:443"');
-  lines.push('      - "127.0.0.1:2019:2019"');
   lines.push("    volumes:");
   lines.push("      - ./Caddyfile:/etc/caddy/Caddyfile:ro");
   lines.push("      - caddy_data:/data");
@@ -28202,25 +28131,39 @@ function generateCompose({ cfg, cliVersion }) {
   lines.push("    networks:");
   lines.push("      - arc-net");
   lines.push("");
+  lines.push("  registry:");
+  lines.push("    image: registry:2");
+  lines.push("    restart: unless-stopped");
+  lines.push("    volumes:");
+  lines.push("      - registry_data:/var/lib/registry");
+  lines.push("      - ./registry-auth/htpasswd:/auth/htpasswd:ro");
+  lines.push("    environment:");
+  lines.push("      REGISTRY_AUTH: htpasswd");
+  lines.push('      REGISTRY_AUTH_HTPASSWD_REALM: "Arc Registry"');
+  lines.push("      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd");
+  lines.push('      REGISTRY_HTTP_HOST: "https://' + cfg.registry.domain + '"');
+  lines.push("    networks:");
+  lines.push("      - arc-net");
+  lines.push("    expose:");
+  lines.push('      - "5000"');
+  lines.push("");
   for (const [name, env2] of Object.entries(cfg.envs)) {
+    const upperName = name.toUpperCase().replace(/-/g, "_");
     lines.push(`  arc-${name}:`);
-    lines.push("    image: pkrasinski/arc-runtime:1");
+    lines.push(`    image: \${ARC_IMAGE_${upperName}:-arc-${name}:not-deployed}`);
+    lines.push(`    container_name: arc-${name}`);
     lines.push("    restart: unless-stopped");
     lines.push("    volumes:");
-    lines.push(`      - arc-platform-${name}:/app/.arc/platform`);
     lines.push(`      - arc-data-${name}:/app/.arc/data`);
-    lines.push("      - arc-cli-cache:/app/.arc/cli");
-    lines.push("      - arc-bun-cache:/root/.bun/install/cache");
     lines.push("    environment:");
     lines.push("      PORT: 5005");
-    lines.push('      ARC_DEPLOY_API: "1"');
-    lines.push(`      ARC_CLI_VERSION: ${JSON.stringify(cliVersion)}`);
     const userEnv = env2.envVars ?? {};
     if (!("NODE_ENV" in userEnv)) {
       lines.push("      NODE_ENV: production");
     }
+    const reserved = new Set(["PORT"]);
     for (const [k, v] of Object.entries(userEnv)) {
-      if (RESERVED_ENV.has(k))
+      if (reserved.has(k))
         continue;
       lines.push(`      ${k}: ${JSON.stringify(v)}`);
     }
@@ -28236,10 +28179,8 @@ function generateCompose({ cfg, cliVersion }) {
   lines.push("volumes:");
   lines.push("  caddy_data:");
   lines.push("  caddy_config:");
-  lines.push("  arc-cli-cache:");
-  lines.push("  arc-bun-cache:");
+  lines.push("  registry_data:");
   for (const [name] of Object.entries(cfg.envs)) {
-    lines.push(`  arc-platform-${name}:`);
     lines.push(`  arc-data-${name}:`);
   }
   return lines.join(`
@@ -28247,19 +28188,32 @@ function generateCompose({ cfg, cliVersion }) {
 `;
 }
 
+// src/deploy/htpasswd.ts
+async function generateHtpasswd(user, password) {
+  if (!user || !password) {
+    throw new Error("htpasswd: user and password must both be non-empty");
+  }
+  const hash = await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+  return `${user}:${hash}
+`;
+}
+
 // src/deploy/terraform.ts
 import { spawn as nodeSpawn2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
-import { homedir } from "os";
-import { join as join14 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join13 } from "path";
 async function runTerraform(inputs) {
   const wsHash = createHash2("sha256").update(inputs.workspaceDir).digest("hex").slice(0, 16);
-  const workDir = join14(homedir(), ".arc-deploy", wsHash, "tf");
-  mkdirSync12(workDir, { recursive: true });
+  const workDir = join13(homedir2(), ".arc-deploy", wsHash, "tf");
+  mkdirSync11(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.terraform);
   const sshPubKey = inputs.tf.sshPublicKey ?? expandHome("~/.ssh/id_ed25519.pub");
-  if (!existsSync11(expandHome(sshPubKey))) {
+  if (!existsSync12(expandHome(sshPubKey))) {
     throw new Error(`SSH public key not found at ${sshPubKey}. Set provision.terraform.sshPublicKey in deploy.arc.json.`);
   }
   const tfvars = [
@@ -28272,7 +28226,7 @@ async function runTerraform(inputs) {
   ].join(`
 `) + `
 `;
-  writeFileSync12(join14(workDir, "terraform.tfvars"), tfvars);
+  writeFileSync11(join13(workDir, "terraform.tfvars"), tfvars);
   await runTf(workDir, ["init", "-input=false", "-no-color"]);
   await runTf(workDir, [
     "apply",
@@ -28330,18 +28284,67 @@ function expandHome(p) {
 }
 
 // src/deploy/config.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
 import { join as join15 } from "path";
+
+// src/deploy/env-file.ts
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
+function loadDeployEnvFiles(rootDir, envNames) {
+  const globalsPath = join14(rootDir, "deploy.arc.env");
+  const globals = existsSync13(globalsPath) ? parseEnvFile(readFileSync11(globalsPath, "utf-8"), globalsPath) : {};
+  const perEnv = {};
+  for (const name of envNames) {
+    const envPath = join14(rootDir, `deploy.arc.${name}.env`);
+    if (existsSync13(envPath)) {
+      perEnv[name] = parseEnvFile(readFileSync11(envPath, "utf-8"), envPath);
+    }
+  }
+  return { globals, perEnv };
+}
+function applyDeployGlobals(globals) {
+  for (const [k, v] of Object.entries(globals)) {
+    if (process.env[k] === undefined) {
+      process.env[k] = v;
+    }
+  }
+}
+function parseEnvFile(content, pathForErrors) {
+  const out = {};
+  const lines = content.split(/\r?\n/);
+  for (let i = 0;i < lines.length; i++) {
+    const raw = lines[i];
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) {
+      throw new Error(`${pathForErrors}:${i + 1}: malformed line (expected KEY=VALUE): ${raw}`);
+    }
+    const key = line.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      throw new Error(`${pathForErrors}:${i + 1}: invalid variable name "${key}"`);
+    }
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/deploy/config.ts
 var DEPLOY_CONFIG_FILE = "deploy.arc.json";
 function deployConfigPath(rootDir) {
   return join15(rootDir, DEPLOY_CONFIG_FILE);
 }
 function deployConfigExists(rootDir) {
-  return existsSync12(deployConfigPath(rootDir));
+  return existsSync14(deployConfigPath(rootDir));
 }
 function loadDeployConfig(rootDir) {
   const path4 = deployConfigPath(rootDir);
-  if (!existsSync12(path4)) {
+  if (!existsSync14(path4)) {
     throw new Error(`Missing ${DEPLOY_CONFIG_FILE} at ${path4}`);
   }
   const raw = readFileSync12(path4, "utf-8");
@@ -28351,14 +28354,25 @@ function loadDeployConfig(rootDir) {
   } catch (e) {
     throw new Error(`Invalid JSON in ${DEPLOY_CONFIG_FILE}: ${e.message}`);
   }
+  const envNames = isObject(parsed) && isObject(parsed.envs) ? Object.keys(parsed.envs) : [];
+  const envFiles = loadDeployEnvFiles(rootDir, envNames);
+  applyDeployGlobals(envFiles.globals);
   const expanded = expandEnvVars(parsed, process.env);
-  return validateDeployConfig(expanded);
+  const validated = validateDeployConfig(expanded);
+  for (const [envName, vars] of Object.entries(envFiles.perEnv)) {
+    if (!(envName in validated.envs))
+      continue;
+    const env2 = validated.envs[envName];
+    const merged = { ...vars, ...env2.envVars ?? {} };
+    validated.envs[envName] = { ...env2, envVars: merged };
+  }
+  return validated;
 }
 function saveDeployConfig(rootDir, cfg) {
   const path4 = deployConfigPath(rootDir);
-  const raw = existsSync12(path4) ? JSON.parse(readFileSync12(path4, "utf-8")) : {};
+  const raw = existsSync14(path4) ? JSON.parse(readFileSync12(path4, "utf-8")) : {};
   raw.target = { ...raw.target, ...cfg.target };
-  writeFileSync13(path4, JSON.stringify(raw, null, 2) + `
+  writeFileSync12(path4, JSON.stringify(raw, null, 2) + `
 `);
 }
 var VAR_REGEX = /\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g;
@@ -28384,6 +28398,15 @@ function validateDeployConfig(input) {
   const target = requireObject(input, "target");
   const envs = requireObject(input, "envs");
   const caddy = requireObject(input, "caddy");
+  const registry = requireObject(input, "registry");
+  const registryDomain = requireString(registry, "registry.domain");
+  if (!/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(registryDomain)) {
+    throw new Error(`deploy.arc.json: registry.domain "${registryDomain}" doesn't look like a domain`);
+  }
+  const passwordEnv = requireString(registry, "registry.passwordEnv");
+  if (!/^[A-Z][A-Z0-9_]*$/.test(passwordEnv)) {
+    throw new Error(`deploy.arc.json: registry.passwordEnv "${passwordEnv}" must be an UPPER_SNAKE_CASE env var name`);
+  }
   const validated = {
     target: {
       host: requireString(target, "target.host"),
@@ -28395,6 +28418,11 @@ function validateDeployConfig(input) {
     envs: {},
     caddy: {
       email: requireString(caddy, "caddy.email")
+    },
+    registry: {
+      domain: registryDomain,
+      username: optionalString(registry, "registry.username") ?? "deploy",
+      passwordEnv
     }
   };
   const envKeys = Object.keys(envs);
@@ -28510,25 +28538,48 @@ function cfgErr(path4, expected) {
 
 // src/deploy/ssh.ts
 var {spawn: spawn3 } = globalThis.Bun;
+import { existsSync as existsSync15 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join16 } from "path";
+function pickSshKey(target) {
+  if (target.sshKey) {
+    const expanded = target.sshKey.startsWith("~") ? join16(homedir3(), target.sshKey.slice(1)) : target.sshKey;
+    return existsSync15(expanded) ? expanded : null;
+  }
+  for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
+    const path4 = join16(homedir3(), ".ssh", name);
+    if (existsSync15(path4))
+      return path4;
+  }
+  return null;
+}
 async function streamToString(stream2) {
   if (!stream2 || typeof stream2 === "number")
     return "";
   return new Response(stream2).text();
 }
 function baseSshArgs(target) {
-  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
-  return [
+  const key = pickSshKey(target);
+  const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
     "-o",
-    "IdentitiesOnly=yes",
-    "-i",
-    key,
+    "PreferredAuthentications=publickey",
+    "-o",
+    "ConnectTimeout=5",
+    "-o",
+    "ServerAliveInterval=10",
+    "-o",
+    "ServerAliveCountMax=2",
     "-p",
     String(target.port)
   ];
+  if (key) {
+    args.push("-o", "IdentitiesOnly=yes", "-i", key);
+  }
+  return args;
 }
 async function sshExec(target, cmd, opts = {}) {
   const args = [
@@ -28570,31 +28621,23 @@ async function canSsh(target) {
   const res = await sshExec(target, "true", { quiet: true });
   return res.exitCode === 0;
 }
-async function waitForSsh(target, opts = {}) {
-  const timeout = opts.timeoutMs ?? 300000;
-  const interval = opts.intervalMs ?? 1e4;
-  const start = Date.now();
-  while (Date.now() - start < timeout) {
-    if (await canSsh(target))
-      return;
-    await Bun.sleep(interval);
-  }
-  throw new Error(`Timed out waiting for SSH on ${target.user}@${target.host}`);
-}
 async function scpUpload(target, localPath, remotePath) {
-  const key = target.sshKey ?? `${process.env.HOME}/.ssh/id_ed25519`;
+  const key = pickSshKey(target);
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
     "-o",
-    "IdentitiesOnly=yes",
-    "-i",
-    key,
+    "PreferredAuthentications=publickey",
+    "-o",
+    "ConnectTimeout=5",
     "-P",
     String(target.port)
   ];
+  if (key) {
+    args.push("-o", "IdentitiesOnly=yes", "-i", key);
+  }
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
   const proc2 = spawn3({ cmd: ["scp", ...args], stderr: "pipe" });
   const [stderr, exitCode] = await Promise.all([
@@ -28605,52 +28648,6 @@ async function scpUpload(target, localPath, remotePath) {
     throw new Error(`scp failed (${exitCode}): ${stderr}`);
   }
 }
-async function openTunnel(target, localPort, remoteHost, remotePort) {
-  const args = [
-    ...baseSshArgs(target),
-    "-N",
-    "-L",
-    `${localPort}:${remoteHost}:${remotePort}`,
-    `${target.user}@${target.host}`
-  ];
-  const proc2 = spawn3({
-    cmd: ["ssh", ...args],
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const deadline = Date.now() + 1e4;
-  let lastErr;
-  while (Date.now() < deadline) {
-    if (proc2.exitCode !== null) {
-      const stderr = await streamToString(proc2.stderr);
-      throw new Error(`ssh tunnel exited early: ${stderr}`);
-    }
-    try {
-      const probe = await Bun.connect({
-        hostname: "127.0.0.1",
-        port: localPort,
-        socket: { data() {}, open() {}, close() {}, error() {} }
-      });
-      probe.end();
-      return {
-        localPort,
-        close() {
-          try {
-            proc2.kill();
-          } catch {}
-        }
-      };
-    } catch (e) {
-      lastErr = e;
-      await Bun.sleep(200);
-    }
-  }
-  try {
-    proc2.kill();
-  } catch {}
-  throw new Error(`Failed to establish SSH tunnel on localhost:${localPort}: ${String(lastErr)}`);
-}
 
 // src/deploy/remote-state.ts
 var STATE_MARKER_PATH = "/opt/arc/.arc-state.json";
@@ -28698,6 +28695,18 @@ JSON`);
 }
 
 // src/deploy/bootstrap.ts
+async function waitForAnySsh(targets, opts = {}) {
+  const timeout = opts.timeoutMs ?? 300000;
+  const interval = opts.intervalMs ?? 5000;
+  const start = Date.now();
+  while (Date.now() - start < timeout) {
+    const results = await Promise.all(targets.map((t) => canSsh(t)));
+    if (results.some(Boolean))
+      return;
+    await Bun.sleep(interval);
+  }
+  throw new Error(`Timed out waiting for SSH on ${targets.map((t) => `${t.user}@${t.host}`).join(" or ")}`);
+}
 async function bootstrap(inputs) {
   const { cfg, state, rootDir } = inputs;
   if (state.kind === "unreachable") {
@@ -28719,12 +28728,16 @@ async function bootstrap(inputs) {
     cfg.target.host = tfOut.serverIp;
     saveDeployConfig(rootDir, cfg);
     log2("Waiting for SSH to come up...");
-    await waitForSsh({ ...cfg.target, user: "root" });
+    await waitForAnySsh([
+      { ...cfg.target, user: "root" },
+      { ...cfg.target, user: cfg.target.user }
+    ]);
     ok("SSH reachable");
   }
-  if (state.kind === "unreachable" || state.kind === "no-docker") {
+  const needAnsible = state.kind === "unreachable" || state.kind === "no-docker" || inputs.forceAnsible === true;
+  if (needAnsible) {
     log2("Running Ansible bootstrap (Docker + firewall + SSH hardening)...");
-    const deployUserWorks = state.kind === "no-docker" && await canSsh(cfg.target);
+    const deployUserWorks = state.kind !== "unreachable" && await canSsh(cfg.target);
     const asRoot = !deployUserWorks;
     await runAnsible({
       target: cfg.target,
@@ -28733,202 +28746,400 @@ async function bootstrap(inputs) {
     });
     ok("Host bootstrapped");
   }
-  if (state.kind !== "ready") {
+  const needUpStack = state.kind !== "ready" || state.marker === null || state.marker.configHash !== inputs.configHash || !await isRegistryRunning(cfg);
+  if (needUpStack) {
     await upStack(inputs);
     ok("Docker stack up");
   }
-  await writeStateMarker(cfg.target, {
-    cliVersion: inputs.cliVersion,
-    configHash: inputs.configHash,
-    updatedAt: new Date().toISOString()
+  await writeStateMarker(cfg.target, {
+    cliVersion: inputs.cliVersion,
+    configHash: inputs.configHash,
+    updatedAt: new Date().toISOString()
+  });
+}
+async function isRegistryRunning(cfg) {
+  const res = await sshExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose ps --status running --format '{{.Service}}' 2>/dev/null || true`, { quiet: true });
+  return res.stdout.split(`
+`).map((s) => s.trim()).includes("registry");
+}
+async function upStack(inputs) {
+  const { cfg } = inputs;
+  const workDir = join17(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
+  mkdirSync12(workDir, { recursive: true });
+  await assertRegistryDnsResolves(cfg);
+  const password = process.env[cfg.registry.passwordEnv];
+  if (!password) {
+    throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set. ` + `Set it (e.g. \`export ${cfg.registry.passwordEnv}=...\`) before bootstrap.`);
+  }
+  const htpasswdLine = await generateHtpasswd(cfg.registry.username, password);
+  writeFileSync13(join17(workDir, "htpasswd"), htpasswdLine);
+  writeFileSync13(join17(workDir, "Caddyfile"), generateCaddyfile(cfg));
+  writeFileSync13(join17(workDir, "docker-compose.yml"), generateCompose({ cfg }));
+  await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
+  for (const name of Object.keys(cfg.envs)) {
+    await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
+  }
+  await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/registry-auth`);
+  await scpUpload(cfg.target, join17(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
+  await scpUpload(cfg.target, join17(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
+  await scpUpload(cfg.target, join17(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
+  await assertExec(cfg.target, `touch ${cfg.target.remoteDir}/.env`);
+  await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose pull --ignore-pull-failures caddy registry && docker compose up -d caddy registry`);
+  await sshDockerLogin(cfg);
+  const knownEnvs = await listConfiguredEnvs(cfg);
+  if (knownEnvs.length > 0) {
+    await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose up -d ${knownEnvs.map((e) => `arc-${e}`).join(" ")}`);
+  }
+}
+async function sshDockerLogin(cfg) {
+  const password = process.env[cfg.registry.passwordEnv];
+  if (!password) {
+    throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set on the deploy host (CLI machine).`);
+  }
+  const cmd = `docker login ${cfg.registry.domain} -u ${cfg.registry.username} --password-stdin`;
+  const proc2 = spawn4({
+    cmd: [
+      "ssh",
+      ...baseSshArgs(cfg.target),
+      `${cfg.target.user}@${cfg.target.host}`,
+      "--",
+      cmd
+    ],
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (proc2.stdin) {
+    await proc2.stdin.write(new TextEncoder().encode(password));
+    await proc2.stdin.end?.();
+  }
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    const stderr = await new Response(proc2.stderr).text();
+    throw new Error(`Server-side docker login failed (exit ${exit}): ${stderr.trim()}`);
+  }
+}
+async function listConfiguredEnvs(cfg) {
+  const res = await sshExec(cfg.target, `cat ${cfg.target.remoteDir}/.env 2>/dev/null || true`, { quiet: true });
+  const set = new Set;
+  for (const line of res.stdout.split(`
+`)) {
+    const m = line.match(/^ARC_IMAGE_([A-Z0-9_]+)=/);
+    if (!m)
+      continue;
+    const lowerName = m[1].toLowerCase().replace(/_/g, "-");
+    if (lowerName in cfg.envs)
+      set.add(lowerName);
+  }
+  return [...set];
+}
+async function assertRegistryDnsResolves(cfg) {
+  const apex = apexDomain(cfg.registry.domain);
+  let nameservers = await digQuery("8.8.8.8", "NS", apex);
+  nameservers = nameservers.map((s) => s.replace(/\.$/, ""));
+  const sources = [...nameservers, "1.1.1.1", "8.8.8.8"];
+  let lastAnswers = [];
+  for (const source of sources) {
+    const answers = await digQuery(source, "A", cfg.registry.domain);
+    if (answers.length === 0)
+      continue;
+    lastAnswers = answers;
+    if (answers.includes(cfg.target.host))
+      return;
+  }
+  if (lastAnswers.length === 0) {
+    throw new Error(`Registry DNS not configured: ${cfg.registry.domain} doesn't resolve. ` + `Add an A record pointing to ${cfg.target.host} and re-run deploy.`);
+  }
+  throw new Error(`Registry DNS mismatch: ${cfg.registry.domain} resolves to [${lastAnswers.join(", ")}], ` + `but target host is ${cfg.target.host}. Update the A record before continuing.`);
+}
+function apexDomain(host) {
+  const parts = host.split(".");
+  return parts.slice(-2).join(".");
+}
+async function digQuery(server, type, name) {
+  const proc2 = spawn4({
+    cmd: ["dig", `@${server}`, "+short", "+time=3", "+tries=1", type, name],
+    stdout: "pipe",
+    stderr: "ignore"
   });
+  const exit = await proc2.exited;
+  if (exit !== 0)
+    return [];
+  return (await new Response(proc2.stdout).text()).split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+
+// src/deploy/deploy-env.ts
+var HEALTH_RETRIES = 10;
+var HEALTH_DELAY_MS = 1000;
+async function updateEnvDeployment(opts) {
+  const { target, cfg, env: env2, fullRef } = opts;
+  const upperEnv = env2.toUpperCase().replace(/-/g, "_");
+  const envVarName = `ARC_IMAGE_${upperEnv}`;
+  const envPath = `${cfg.target.remoteDir}/.env`;
+  const escapedRef = fullRef.replace(/"/g, "\\\"");
+  const updateScript = [
+    `touch ${envPath} && `,
+    `awk -v line="${envVarName}=${escapedRef}" -v key="${envVarName}=" '`,
+    `  BEGIN { replaced=0 } `,
+    `  $0 ~ "^"key { print line; replaced=1; next } `,
+    `  { print } `,
+    `  END { if (!replaced) print line } `,
+    `' ${envPath} > ${envPath}.tmp && mv ${envPath}.tmp ${envPath}`
+  ].join("");
+  await assertExec(target, updateScript);
+  await assertExec(target, `cd ${cfg.target.remoteDir} && docker compose pull arc-${env2}`);
+  await assertExec(target, `cd ${cfg.target.remoteDir} && docker compose up -d arc-${env2}`);
+  const retain = opts.retainImages ?? 3;
+  const imageBaseName = imageBaseFromRef(fullRef);
+  if (imageBaseName) {
+    const pruneScript = [
+      `docker images "${imageBaseName}" --format "{{.Repository}}:{{.Tag}} {{.CreatedAt}}" `,
+      `| grep -v ":latest " `,
+      `| sort -k2,3 -r `,
+      `| tail -n +${retain + 1} `,
+      `| awk '{print $1}' `,
+      `| xargs -r docker rmi 2>/dev/null || true`
+    ].join("");
+    await sshExec(target, pruneScript, { quiet: true });
+  }
+  const ok2 = await healthCheck(target, env2);
+  return { env: env2, fullRef, redeployed: ok2 };
+}
+function imageBaseFromRef(fullRef) {
+  const colonIdx = fullRef.lastIndexOf(":");
+  return colonIdx > 0 ? fullRef.slice(0, colonIdx) : null;
+}
+async function healthCheck(target, env2) {
+  for (let i = 0;i < HEALTH_RETRIES; i++) {
+    const res = await sshExec(target, `docker exec arc-${env2} wget -qO- http://localhost:5005/health 2>&1 || echo HEALTHCHECK_FAILED`, { quiet: true });
+    if (res.exitCode === 0 && !res.stdout.includes("HEALTHCHECK_FAILED")) {
+      return true;
+    }
+    await sleep(HEALTH_DELAY_MS);
+  }
+  return false;
 }
-async function upStack(inputs) {
-  const { cfg } = inputs;
-  const workDir = join16(tmpdir3(), "arc-deploy", `stack-${Date.now()}`);
-  mkdirSync13(workDir, { recursive: true });
-  writeFileSync14(join16(workDir, "Caddyfile"), generateCaddyfile(cfg));
-  writeFileSync14(join16(workDir, "docker-compose.yml"), generateCompose({ cfg, cliVersion: inputs.cliVersion }));
-  await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
-  for (const name of Object.keys(cfg.envs)) {
-    await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/deploy/image.ts
+var {spawn: spawn5 } = globalThis.Bun;
+import { createHash as createHash3 } from "crypto";
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync13,
+  realpathSync as realpathSync2,
+  writeFileSync as writeFileSync14
+} from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname7, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+
+// src/deploy/image-template.ts
+function generateDockerfile(inputs) {
+  const conditionalCopies = [];
+  if (inputs.hasPublicDir) {
+    conditionalCopies.push("COPY public/ /app/public/");
+  }
+  if (inputs.hasManifest && inputs.manifestPath) {
+    conditionalCopies.push(`COPY ${inputs.manifestPath} /app/${inputs.manifestPath}`);
+  }
+  if (inputs.hasLocales) {
+    conditionalCopies.push("COPY locales/ /app/locales/");
   }
-  await scpUpload(cfg.target, join16(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
-  await scpUpload(cfg.target, join16(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
-  await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose pull --ignore-pull-failures && docker compose up -d`);
+  return [
+    "# Generated by `arc platform deploy` \u2014 do not edit by hand.",
+    "FROM oven/bun:1-alpine",
+    "",
+    "RUN apk add --no-cache tini ca-certificates",
+    "",
+    "WORKDIR /app",
+    "",
+    "# Layer 1 \u2014 framework peers as /app/package.json + install into /app/node_modules.",
+    "# resolveWorkspace() walks up looking for the first package.json (finds /app/),",
+    "# loadServerContext resolves @arcote.tech/platform from /app/node_modules.",
+    "# Cached, invalidates only on .arc/platform/package.json change.",
+    "COPY .arc/platform/package.json /app/package.json",
+    "RUN cd /app && bun install --production --no-save",
+    "",
+    "# Layer 2 \u2014 user artifacts (chunks, shell, styles, server bundles, host.js).",
+    "# host.js IS the arc-cli bundle \u2014 `arc platform deploy` copied it here from",
+    "# whatever arc-cli was on the user's PATH. No npm dependency at runtime.",
+    "COPY .arc/platform/ /app/.arc/platform/",
+    ...conditionalCopies,
+    "",
+    "ENV PORT=5005",
+    "ENV NODE_ENV=production",
+    "EXPOSE 5005",
+    "",
+    'ENTRYPOINT ["tini", "--"]',
+    'CMD ["bun", "run", "/app/.arc/platform/host.js", "platform", "start"]',
+    ""
+  ].join(`
+`);
 }
 
-// src/deploy/remote-sync.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
-import { basename as basename5, join as join17 } from "path";
-function diffManifests(local, remote) {
-  const remoteByName = new Map(remote.modules.map((m) => [m.name, m]));
-  const changedModules = local.modules.filter((m) => remoteByName.get(m.name)?.hash !== m.hash);
-  return {
-    changedModules: [...changedModules],
-    stylesChanged: local.stylesHash !== remote.stylesHash
-  };
-}
-async function syncEnv(inputs) {
-  const { cfg, env: env2, ws } = inputs;
-  const envConfig = cfg.envs[env2];
-  if (!envConfig)
-    throw new Error(`Unknown env: ${env2}`);
-  const localManifestPath = join17(ws.modulesDir, "manifest.json");
-  if (!existsSync13(localManifestPath)) {
-    throw new Error(`Local build missing at ${localManifestPath}. Run arc platform build first.`);
-  }
-  const localManifest = JSON.parse(readFileSync13(localManifestPath, "utf-8"));
-  const pkgByName = new Map(ws.packages.map((p) => [p.name.includes("/") ? p.name.split("/").pop() : p.name, p]));
-  let tunnel = await openTunnel(cfg.target, 15500 + hashEnvToOffset(env2), "127.0.0.1", 2019);
-  let restarts = 0;
-  let frameworkChanged = false;
-  try {
-    const base2 = () => `http://127.0.0.1:${tunnel.localPort}/env/${env2}`;
-    const localFrameworkHash = readDepsHash(join17(ws.arcDir, ".deps-hash"));
-    const remoteFwRes = await fetch(`${base2()}/api/deploy/framework`);
-    const remoteFw = remoteFwRes.ok ? await remoteFwRes.json() : { depsHash: null };
-    if (localFrameworkHash && localFrameworkHash !== remoteFw.depsHash) {
-      console.log("[arc] Pushing framework deps...");
-      const form = new FormData;
-      form.append("package.json", new Blob([readFileSync13(join17(ws.arcDir, "package.json"))]), "package.json");
-      form.append("bun.lock", new Blob([""]), "bun.lock");
-      const res = await fetch(`${base2()}/api/deploy/framework`, {
-        method: "POST",
-        body: form
-      });
-      if (!res.ok) {
-        throw new Error(`framework push failed: ${res.status} ${await res.text()}`);
-      }
-      frameworkChanged = true;
-      const result = await res.json();
-      if (result.needsRestart) {
-        tunnel = await restartAndReopen(cfg, env2, tunnel);
-        restarts += 1;
-      }
-    }
-    const remoteManifestRes = await fetch(`${base2()}/api/deploy/manifest`);
-    const remoteManifest = remoteManifestRes.ok ? await remoteManifestRes.json() : {
-      modules: [],
-      shellHash: "",
-      stylesHash: "",
-      buildTime: ""
-    };
-    const diff = diffManifests(localManifest, remoteManifest);
-    for (const mod of diff.changedModules) {
-      const safeName = sanitizeName(mod.name);
-      const moduleDir = join17(ws.modulesDir, safeName);
-      const browserPath = join17(moduleDir, "browser.js");
-      const serverPath = join17(moduleDir, "server.js");
-      const pkgPath = join17(moduleDir, "package.json");
-      const accessPath = join17(moduleDir, "access.json");
-      const browserActual = existsSync13(browserPath) ? browserPath : join17(ws.modulesDir, `${safeName}.js`);
-      if (!existsSync13(browserActual)) {
-        throw new Error(`Missing browser bundle for module ${mod.name}`);
-      }
-      const form = new FormData;
-      form.append("browser.js", new Blob([readFileSync13(browserActual)]), "browser.js");
-      const pkg = pkgByName.get(safeName);
-      if (pkg && isContextPackage(pkg.packageJson) && existsSync13(serverPath)) {
-        form.append("server.js", new Blob([readFileSync13(serverPath)]), "server.js");
-      }
-      if (existsSync13(pkgPath)) {
-        form.append("package.json", new Blob([readFileSync13(pkgPath)]), "package.json");
-      }
-      if (existsSync13(accessPath)) {
-        form.append("access.json", new Blob([readFileSync13(accessPath)]), "access.json");
-      }
-      console.log(`[arc] Pushing module ${safeName}...`);
-      const res = await fetch(`${base2()}/api/deploy/modules/${safeName}`, {
-        method: "POST",
-        body: form
-      });
-      if (!res.ok) {
-        throw new Error(`module ${safeName} push failed: ${res.status} ${await res.text()}`);
-      }
-    }
-    if (diff.stylesChanged) {
-      console.log("[arc] Pushing styles...");
-      const form = new FormData;
-      for (const name of ["styles.css", "theme.css"]) {
-        const p = join17(ws.arcDir, name);
-        if (existsSync13(p)) {
-          form.append(name, new Blob([readFileSync13(p)]), name);
+// src/deploy/image.ts
+async function buildImage(ws, opts) {
+  await ensureDocker();
+  const manifestPath = join18(ws.arcDir, "manifest.json");
+  if (!existsSync16(manifestPath)) {
+    throw new Error(`No build manifest at ${manifestPath}. Run \`arc platform build\` first or omit --skip-build.`);
+  }
+  embedCliBundle(ws);
+  const contentHash = computeContentHash(manifestPath);
+  const imageTag = `${opts.imageName}:${contentHash}`;
+  const fullRef = opts.registryDomain ? `${opts.registryDomain}/${imageTag}` : imageTag;
+  const dockerfileInputs = collectDockerfileInputs(ws);
+  const dockerfile = generateDockerfile(dockerfileInputs);
+  const buildContextDir = ws.rootDir;
+  const dockerfileDir = join18(tmpdir3(), `arc-image-${Date.now()}`);
+  mkdirSync13(dockerfileDir, { recursive: true });
+  const dockerfilePath = join18(dockerfileDir, "Dockerfile");
+  writeFileSync14(dockerfilePath, dockerfile);
+  const buildArgs = [
+    "build",
+    "--platform=linux/amd64",
+    "-f",
+    dockerfilePath,
+    "-t",
+    fullRef,
+    "-t",
+    `${opts.imageName}:latest`,
+    buildContextDir
+  ];
+  const proc2 = spawn5({
+    cmd: ["docker", ...buildArgs],
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    throw new Error(`docker build failed (exit ${exit})`);
+  }
+  return { imageTag, fullRef, contentHash };
+}
+function embedCliBundle(ws) {
+  const source = locateCliBundle();
+  const target = join18(ws.arcDir, "host.js");
+  copyFileSync2(source, target);
+}
+function locateCliBundle() {
+  const here = fileURLToPath5(import.meta.url);
+  let cur = dirname7(here);
+  while (cur !== "/" && cur !== "") {
+    const candidate = join18(cur, "package.json");
+    if (existsSync16(candidate)) {
+      try {
+        const pkg = JSON.parse(readFileSync13(candidate, "utf-8"));
+        if (pkg.name === "@arcote.tech/arc-cli") {
+          const distIndex = join18(realpathSync2(cur), "dist", "index.js");
+          if (!existsSync16(distIndex)) {
+            throw new Error(`arc-cli bundle missing at ${distIndex}. Run \`bun run build\` in packages/cli/.`);
+          }
+          return distIndex;
         }
+      } catch (e) {
+        if (e instanceof Error && e.message.startsWith("arc-cli bundle"))
+          throw e;
       }
-      const res = await fetch(`${base2()}/api/deploy/styles`, {
-        method: "POST",
-        body: form
-      });
-      if (!res.ok) {
-        throw new Error(`styles push failed: ${res.status} ${await res.text()}`);
-      }
-    }
-    const commitRes = await fetch(`${base2()}/api/deploy/manifest`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(localManifest)
-    });
-    if (!commitRes.ok) {
-      throw new Error(`manifest commit failed: ${commitRes.status} ${await commitRes.text()}`);
     }
-    const commit = await commitRes.json();
-    if (commit.needsRestart) {
-      tunnel = await restartAndReopen(cfg, env2, tunnel);
-      restarts += 1;
-    }
-    return {
-      env: env2,
-      frameworkChanged,
-      changedModules: diff.changedModules.map((m) => m.name),
-      stylesChanged: diff.stylesChanged,
-      restarts
-    };
-  } finally {
-    tunnel.close();
+    const parent = dirname7(cur);
+    if (parent === cur)
+      break;
+    cur = parent;
   }
+  throw new Error("Could not locate @arcote.tech/arc-cli package.json walking up from " + here);
 }
-function readDepsHash(path4) {
-  if (!existsSync13(path4))
-    return null;
-  return readFileSync13(path4, "utf-8").trim() || null;
-}
-function sanitizeName(name) {
-  return basename5(name);
-}
-async function restartAndReopen(cfg, env2, oldTunnel) {
-  console.log(`[arc] Restarting arc-${env2}...`);
-  oldTunnel.close();
-  await assertExec(cfg.target, `docker restart arc-${env2}`);
-  const tunnel = await openTunnel(cfg.target, 15500 + hashEnvToOffset(env2), "127.0.0.1", 2019);
-  await waitForHealthy(`http://127.0.0.1:${tunnel.localPort}/env/${env2}`, 60000);
-  return tunnel;
-}
-async function waitForHealthy(baseUrl, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  let lastErr;
-  while (Date.now() < deadline) {
-    try {
-      const res = await fetch(`${baseUrl}/api/deploy/health`, {
-        signal: AbortSignal.timeout(2000)
-      });
-      if (res.ok)
-        return;
-      lastErr = `status ${res.status}`;
-    } catch (e) {
-      lastErr = e;
+async function ensureDocker() {
+  try {
+    const proc2 = spawn5({
+      cmd: ["docker", "--version"],
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exit = await proc2.exited;
+    if (exit !== 0)
+      throw new Error("docker --version exited non-zero");
+  } catch {
+    throw new Error("Docker is not available on PATH. Install Docker Desktop (or docker engine + buildx) before running deploy.");
+  }
+}
+function computeContentHash(manifestPath) {
+  const raw = JSON.parse(readFileSync13(manifestPath, "utf-8"));
+  delete raw.buildTime;
+  const canonical = JSON.stringify(raw);
+  return createHash3("sha256").update(canonical).digest("hex").slice(0, 12);
+}
+function collectDockerfileInputs(ws) {
+  const hasPublicDir = existsSync16(join18(ws.rootDir, "public"));
+  const hasLocales = existsSync16(join18(ws.rootDir, "locales"));
+  let manifestPath;
+  for (const name of ["manifest.webmanifest", "manifest.json"]) {
+    if (existsSync16(join18(ws.rootDir, name))) {
+      manifestPath = name;
+      break;
     }
-    await new Promise((r) => setTimeout(r, 1000));
   }
-  throw new Error(`Health check timeout: ${String(lastErr)}`);
+  return {
+    hasPublicDir,
+    hasManifest: !!manifestPath,
+    manifestPath,
+    hasLocales
+  };
+}
+function sanitizeImageName(name) {
+  const cleaned = name.toLowerCase().replace(/^@/, "").replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return cleaned || "arc-app";
+}
+
+// src/deploy/registry.ts
+var {spawn: spawn6 } = globalThis.Bun;
+async function dockerLogin(registry) {
+  const password = process.env[registry.passwordEnv];
+  if (!password) {
+    throw new Error(`Registry password env var ${registry.passwordEnv} is not set. ` + `Set it in your shell before running deploy.`);
+  }
+  const proc2 = spawn6({
+    cmd: [
+      "docker",
+      "login",
+      registry.domain,
+      "-u",
+      registry.username,
+      "--password-stdin"
+    ],
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  proc2.stdin.write(password);
+  await proc2.stdin.end();
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    const stderr = await new Response(proc2.stderr).text();
+    throw new Error(`docker login ${registry.domain} failed (exit ${exit}): ${stderr.trim()}`);
+  }
 }
-function hashEnvToOffset(env2) {
-  let h = 0;
-  for (const ch of env2)
-    h = h * 31 + ch.charCodeAt(0) >>> 0;
-  return h % 100;
+async function dockerPush(fullRef) {
+  const proc2 = spawn6({
+    cmd: ["docker", "push", fullRef],
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  const exit = await proc2.exited;
+  if (exit !== 0) {
+    throw new Error(`docker push ${fullRef} failed (exit ${exit})`);
+  }
 }
 
+// ../../node_modules/.bun/@clack+prompts@0.9.1/node_modules/@clack/prompts/dist/index.mjs
+import { stripVTControlCharacters as T2 } from "util";
+
 // ../../node_modules/.bun/@clack+core@0.4.1/node_modules/@clack/core/dist/index.mjs
 var import_sisteransi = __toESM(require_src(), 1);
 import { stdin as $, stdout as j } from "process";
@@ -29452,6 +29663,21 @@ ${import_picocolors2.default.cyan(m2)}
     }
   } }).prompt();
 };
+var ye = (s = "", n = "") => {
+  const t = `
+${s}
+`.split(`
+`), i = T2(n).length, r2 = Math.max(t.reduce((o, l2) => {
+    const $2 = T2(l2);
+    return $2.length > o ? $2.length : o;
+  }, 0), i) + 2, c2 = t.map((o) => `${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.dim(o)}${" ".repeat(r2 - T2(o).length)}${import_picocolors2.default.gray(a)}`).join(`
+`);
+  process.stdout.write(`${import_picocolors2.default.gray(a)}
+${import_picocolors2.default.green(S2)}  ${import_picocolors2.default.reset(n)} ${import_picocolors2.default.gray(N2.repeat(Math.max(r2 - i - 1, 1)) + re)}
+${c2}
+${import_picocolors2.default.gray(ie + N2.repeat(r2 + 2) + ne)}
+`);
+};
 var ve = (s = "") => {
   process.stdout.write(`${import_picocolors2.default.gray(m2)}  ${import_picocolors2.default.red(s)}
 
@@ -29593,6 +29819,45 @@ async function runSurvey() {
   });
   if (BD(email))
     cancel();
+  ye(`The host runs a private Docker registry behind Caddy.
+Create an A record for the registry domain pointing to your host before deploy.`, "Registry");
+  const registryDomain = await ue({
+    message: "Registry domain (full FQDN)",
+    placeholder: "registry.example.com",
+    validate: (v2) => /^[a-z0-9.-]+\.[a-z]{2,}$/i.test(v2) ? undefined : "Expected a domain"
+  });
+  if (BD(registryDomain))
+    cancel();
+  const registryUser = await ue({
+    message: "Registry username",
+    initialValue: "deploy",
+    validate: (v2) => /^[a-z_][a-z0-9_-]*$/.test(v2) ? undefined : "Invalid username"
+  });
+  if (BD(registryUser))
+    cancel();
+  const registryPasswordEnv = await ue({
+    message: "Env var holding the registry password",
+    initialValue: "ARC_REGISTRY_PASSWORD",
+    validate: (v2) => /^[A-Z][A-Z0-9_]*$/.test(v2) ? undefined : "Must be UPPER_SNAKE_CASE"
+  });
+  if (BD(registryPasswordEnv))
+    cancel();
+  const generatePassword = await me({
+    message: "Generate a random password now?",
+    initialValue: true
+  });
+  if (BD(generatePassword))
+    cancel();
+  if (generatePassword) {
+    const random = generateRandomPassword(32);
+    ye(`Save this password \u2014 you'll need it on every deploy.
+
+  export ${registryPasswordEnv}=${random}
+
+This prompt is the only time it's shown.`, "Registry password");
+  } else {
+    ye(`Set ${registryPasswordEnv} in your shell before running deploy.`, "Registry password");
+  }
   fe("Configuration ready \u2014 writing deploy.arc.json");
   return {
     target: {
@@ -29603,9 +29868,19 @@ async function runSurvey() {
     },
     envs,
     caddy: { email },
+    registry: {
+      domain: registryDomain,
+      username: registryUser,
+      passwordEnv: registryPasswordEnv
+    },
     provision
   };
 }
+function generateRandomPassword(bytes) {
+  const buf = new Uint8Array(bytes);
+  crypto.getRandomValues(buf);
+  return btoa(String.fromCharCode(...buf)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function cancel() {
   ve("Cancelled.");
   process.exit(0);
@@ -29626,82 +29901,106 @@ async function platformDeploy(envArg, options = {}) {
     err(`Unknown env "${envArg}". Known: ${Object.keys(cfg.envs).join(", ")}`);
     process.exit(1);
   })() : Object.keys(cfg.envs);
-  const manifestPath = join18(ws.modulesDir, "manifest.json");
-  const needBuild = options.rebuild || !existsSync14(manifestPath);
-  if (needBuild && !options.skipBuild) {
-    log2("Building platform...");
-    await buildAll(ws, { noCache: options.rebuild });
-    ok("Build complete");
-  } else if (!existsSync14(manifestPath)) {
-    err("No build found and --skip-build was set.");
-    process.exit(1);
+  const manifestPath = join19(ws.arcDir, "manifest.json");
+  if (!options.imageTag) {
+    const needBuild = options.rebuild || !existsSync17(manifestPath);
+    if (needBuild && !options.skipBuild) {
+      log2("Building platform...");
+      await buildAll(ws, { noCache: options.rebuild });
+      ok("Build complete");
+    } else if (!existsSync17(manifestPath)) {
+      err("No build found and --skip-build was set.");
+      process.exit(1);
+    }
+  }
+  const imageName = sanitizeImageName(ws.rootPkg.name ?? ws.appName);
+  let fullRef;
+  let contentHash;
+  if (options.imageTag) {
+    contentHash = options.imageTag.includes(":") ? options.imageTag.split(":").pop() : options.imageTag;
+    fullRef = `${cfg.registry.domain}/${imageName}:${contentHash}`;
+    log2(`Pinning to existing image ${fullRef} (skipping build + push)`);
+  } else {
+    log2(`Building Docker image ${imageName}...`);
+    const result = await buildImage(ws, {
+      imageName,
+      registryDomain: cfg.registry.domain
+    });
+    fullRef = result.fullRef;
+    contentHash = result.contentHash;
+    ok(`Image built: ${fullRef}`);
+    if (options.buildOnly) {
+      log2(`contentHash: ${contentHash}`);
+      return;
+    }
   }
   log2("Inspecting remote server...");
   const state = await detectRemoteState(cfg);
   log2(`Remote state: ${state.kind}`);
   const cliVersion = readCliVersion();
   const configHash = await hashDeployConfig(ws.rootDir);
-  if (state.kind !== "ready") {
-    await bootstrap({
-      cfg,
-      rootDir: ws.rootDir,
-      state,
-      cliVersion,
-      configHash
-    });
+  await bootstrap({
+    cfg,
+    rootDir: ws.rootDir,
+    state,
+    cliVersion,
+    configHash,
+    forceAnsible: options.forceBootstrap
+  });
+  if (!options.imageTag) {
+    log2(`Logging in to ${cfg.registry.domain}...`);
+    await dockerLogin(cfg.registry);
+    log2(`Pushing ${fullRef}...`);
+    await dockerPush(fullRef);
+    ok("Image pushed");
   }
   for (const env2 of targetEnvs) {
-    log2(`Syncing env "${env2}"...`);
-    const outcome = await syncEnv({
+    log2(`Updating env "${env2}"...`);
+    const outcome = await updateEnvDeployment({
+      target: cfg.target,
       cfg,
       env: env2,
-      ws,
-      projectDir: ws.rootDir
+      fullRef
     });
-    if (outcome.changedModules.length === 0 && !outcome.shellChanged && !outcome.stylesChanged) {
-      ok(`${env2}: already up to date`);
+    if (outcome.redeployed) {
+      ok(`${env2}: live at ${fullRef}`);
     } else {
-      const parts = [];
-      if (outcome.changedModules.length > 0) {
-        parts.push(`${outcome.changedModules.length} module(s): ${outcome.changedModules.join(", ")}`);
-      }
-      if (outcome.shellChanged)
-        parts.push("shell");
-      if (outcome.stylesChanged)
-        parts.push("styles");
-      ok(`${env2}: updated ${parts.join(", ")}`);
+      err(`${env2}: deployed but health check did not pass within retries \u2014 check \`docker logs arc-${env2}\``);
     }
   }
 }
 function readCliVersion() {
-  const candidates = [];
-  const entry = process.argv[1];
-  if (entry) {
-    candidates.push(join18(dirname7(entry), "..", "package.json"));
-  }
   try {
-    candidates.push(join18(import.meta.dir, "..", "..", "package.json"));
-  } catch {}
-  for (const path4 of candidates) {
-    try {
-      const pkg = JSON.parse(readFileSync14(path4, "utf-8"));
-      if (pkg.name === "@arcote.tech/arc-cli" && pkg.version) {
-        return pkg.version;
-      }
-    } catch {}
+    let cur = dirname8(fileURLToPath6(import.meta.url));
+    const root = dirname8(cur).startsWith("/") ? "/" : ".";
+    while (cur !== root && cur !== "") {
+      const candidate = join19(cur, "package.json");
+      if (existsSync17(candidate)) {
+        const pkg = JSON.parse(readFileSync14(candidate, "utf-8"));
+        if (pkg.name === "@arcote.tech/arc-cli") {
+          return pkg.version ?? "unknown";
+        }
+      }
+      const parent = dirname8(cur);
+      if (parent === cur)
+        break;
+      cur = parent;
+    }
+    return "unknown";
+  } catch {
+    return "unknown";
   }
-  return "unknown";
 }
 async function hashDeployConfig(rootDir) {
-  const p2 = join18(rootDir, "deploy.arc.json");
+  const p2 = join19(rootDir, "deploy.arc.json");
   const content = readFileSync14(p2);
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   return hasher.digest("hex").slice(0, 16);
 }
 
-// src/commands/platform-dev.ts
-import { existsSync as existsSync17, watch } from "fs";
+// src/platform/startup.ts
+import { existsSync as existsSync19, readFileSync as readFileSync15, watch } from "fs";
 import { join as join21 } from "path";
 
 // ../host/src/create-server.ts
@@ -30162,8 +30461,8 @@ var d2 = class {
       throw new TypeError("CronPattern: Syntax error, steps cannot be greater than maximum value of part (" + this[e2].length + ")");
     if (c2 > w2)
       throw new TypeError("CronPattern: From value is larger than to value: '" + t + "'");
-    for (let T2 = c2;T2 <= w2; T2 += C2)
-      this.setPart(e2, T2, i[1] || s);
+    for (let T3 = c2;T3 <= w2; T3 += C2)
+      this.setPart(e2, T3, i[1] || s);
   }
   extractNth(t, e2) {
     let r2 = t, s;
@@ -31152,248 +31451,14 @@ async function createArcServer(config) {
   };
 }
 // src/platform/server.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync15 } from "fs";
+init_i18n();
+import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
 import { join as join20 } from "path";
-
-// src/platform/deploy-api.ts
-var {spawn: spawn4 } = globalThis.Bun;
-import {
-  cpSync,
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync14,
-  readFileSync as readFileSync15,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync15
-} from "fs";
-import { dirname as dirname8, join as join19, normalize as normalize2, resolve } from "path";
-function createDeployApiHandler(opts) {
-  return async (req, url, ctx) => {
-    const p3 = url.pathname;
-    if (!p3.startsWith("/api/deploy/"))
-      return null;
-    const cors = ctx.corsHeaders;
-    if (p3 === "/api/deploy/health" && req.method === "GET") {
-      return Response.json({ ok: true, modules: opts.getManifest().modules.length }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/framework" && req.method === "GET") {
-      const hashPath = join19(opts.ws.arcDir, ".deps-hash");
-      const depsHash = existsSync15(hashPath) ? readFileSync15(hashPath, "utf-8").trim() : null;
-      return Response.json({ depsHash }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/manifest" && req.method === "GET") {
-      return Response.json(opts.getManifest(), { headers: cors });
-    }
-    if (p3 === "/api/deploy/framework" && req.method === "POST") {
-      const form = await req.formData();
-      const pkgFile = form.get("package.json");
-      const lockFile = form.get("bun.lock");
-      if (!isFile(pkgFile) || !isFile(lockFile)) {
-        return badRequest("framework requires package.json + bun.lock", cors);
-      }
-      mkdirSync14(opts.ws.arcDir, { recursive: true });
-      writeFileSync15(join19(opts.ws.arcDir, "package.json"), Buffer.from(await pkgFile.arrayBuffer()));
-      writeFileSync15(join19(opts.ws.arcDir, "bun.lock"), Buffer.from(await lockFile.arrayBuffer()));
-      const start = Date.now();
-      const installOk = await runBun(["install", "--production"], opts.ws.arcDir);
-      if (!installOk) {
-        return Response.json({ error: "bun install failed" }, { status: 500, headers: cors });
-      }
-      const cliBin = process.argv[1] ?? "arc";
-      const shellOk = await runBun([
-        "run",
-        cliBin,
-        "_build-shell",
-        "--out",
-        opts.ws.shellDir,
-        "--from",
-        join19(opts.ws.arcDir, "node_modules")
-      ], opts.ws.arcDir);
-      if (!shellOk) {
-        return Response.json({ error: "shell build failed" }, { status: 500, headers: cors });
-      }
-      const newHash = sha256Hex(Buffer.concat([
-        readFileSync15(join19(opts.ws.arcDir, "package.json")),
-        readFileSync15(join19(opts.ws.arcDir, "bun.lock"))
-      ]));
-      writeFileSync15(join19(opts.ws.arcDir, ".deps-hash"), newHash + `
-`);
-      return Response.json({
-        changed: true,
-        tookMs: Date.now() - start,
-        needsRestart: true
-      }, { headers: cors });
-    }
-    const moduleMatch = p3.match(/^\/api\/deploy\/modules\/([^/]+)$/);
-    if (moduleMatch && req.method === "POST") {
-      const safeName = sanitizeName2(moduleMatch[1]);
-      if (!safeName)
-        return badRequest("invalid module name", cors);
-      const form = await req.formData();
-      const browser = form.get("browser.js");
-      if (!isFile(browser)) {
-        return badRequest("modules/<name> requires browser.js", cors);
-      }
-      const stagingDir = join19(opts.ws.arcDir, ".staging", "modules", safeName);
-      mkdirSync14(stagingDir, { recursive: true });
-      await writeField(stagingDir, "browser.js", browser);
-      const server = form.get("server.js");
-      if (isFile(server)) {
-        await writeField(stagingDir, "server.js", server);
-      }
-      const pkg = form.get("package.json");
-      if (isFile(pkg)) {
-        await writeField(stagingDir, "package.json", pkg);
-      }
-      const access = form.get("access.json");
-      if (isFile(access)) {
-        await writeField(stagingDir, "access.json", access);
-      }
-      const stagingPkgPath = join19(stagingDir, "package.json");
-      const livePkgPath = join19(opts.ws.arcDir, "modules", safeName, "package.json");
-      const stagingPkgBytes = existsSync15(stagingPkgPath) ? readFileSync15(stagingPkgPath) : Buffer.from("");
-      const livePkgBytes = existsSync15(livePkgPath) ? readFileSync15(livePkgPath) : Buffer.from("");
-      const depsChanged = sha256Hex(stagingPkgBytes) !== sha256Hex(livePkgBytes);
-      writeFileSync15(join19(stagingDir, ".deps-hash"), sha256Hex(stagingPkgBytes) + `
-`);
-      if (depsChanged && existsSync15(stagingPkgPath)) {
-        const ok2 = await runBun(["install", "--production"], stagingDir);
-        if (!ok2) {
-          rmSync4(stagingDir, { recursive: true, force: true });
-          return Response.json({ error: `bun install failed for module ${safeName}` }, { status: 500, headers: cors });
-        }
-      } else if (!depsChanged) {
-        const liveNodeModules = join19(opts.ws.arcDir, "modules", safeName, "node_modules");
-        if (existsSync15(liveNodeModules)) {
-          cpSync(liveNodeModules, join19(stagingDir, "node_modules"), {
-            recursive: true
-          });
-        }
-      }
-      return Response.json({
-        ok: true,
-        name: safeName,
-        depsChanged,
-        serverIncluded: isFile(server)
-      }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/styles" && req.method === "POST") {
-      const form = await req.formData();
-      const stagingDir = join19(opts.ws.arcDir, ".staging");
-      mkdirSync14(stagingDir, { recursive: true });
-      const written = [];
-      for (const name of ["styles.css", "theme.css"]) {
-        const f2 = form.get(name);
-        if (isFile(f2)) {
-          await writeField(stagingDir, name, f2);
-          written.push(name);
-        }
-      }
-      return Response.json({ ok: true, written }, { headers: cors });
-    }
-    if (p3 === "/api/deploy/manifest" && req.method === "POST") {
-      const body = await req.json();
-      if (!validateManifest(body)) {
-        return badRequest("invalid manifest body", cors);
-      }
-      const stagingRoot = join19(opts.ws.arcDir, ".staging");
-      const stagingModules = join19(stagingRoot, "modules");
-      let serverSideChanged = false;
-      if (existsSync15(stagingModules)) {
-        const stagedNames = readDir(stagingModules);
-        for (const name of stagedNames) {
-          const src2 = join19(stagingModules, name);
-          const dst = join19(opts.ws.arcDir, "modules", name);
-          if (existsSync15(join19(src2, "server.js")))
-            serverSideChanged = true;
-          if (existsSync15(dst)) {
-            rmSync4(dst, { recursive: true, force: true });
-          }
-          mkdirSync14(dirname8(dst), { recursive: true });
-          cpSync(src2, dst, { recursive: true });
-        }
-      }
-      for (const name of ["styles.css", "theme.css"]) {
-        const src2 = join19(stagingRoot, name);
-        if (existsSync15(src2)) {
-          cpSync(src2, join19(opts.ws.arcDir, name));
-        }
-      }
-      writeFileSync15(join19(opts.ws.modulesDir, "manifest.json"), JSON.stringify(body, null, 2));
-      opts.setManifest(body);
-      rmSync4(stagingRoot, { recursive: true, force: true });
-      if (!serverSideChanged) {
-        opts.notifyReload(body);
-      }
-      return Response.json({
-        ok: true,
-        moduleCount: body.modules.length,
-        needsRestart: serverSideChanged
-      }, { headers: cors });
-    }
-    return new Response("Not Found", { status: 404, headers: cors });
-  };
-}
-function badRequest(msg, cors) {
-  return Response.json({ error: msg }, { status: 400, headers: cors });
-}
-function isFile(v3) {
-  return typeof v3 === "object" && v3 !== null && typeof v3.arrayBuffer === "function" && typeof v3.name === "string";
-}
-async function writeField(targetDir, name, file) {
-  const safe = normalize2(name);
-  const safeRoot = resolve(targetDir);
-  const full = resolve(safeRoot, safe);
-  if (!full.startsWith(safeRoot + "/") && full !== safeRoot) {
-    throw new Error(`Path traversal rejected: ${name}`);
-  }
-  mkdirSync14(dirname8(full), { recursive: true });
-  writeFileSync15(full, Buffer.from(await file.arrayBuffer()));
-}
-function sanitizeName2(name) {
-  if (!/^[a-zA-Z0-9_-]+$/.test(name))
-    return null;
-  return name;
-}
-function readDir(dir) {
-  if (!existsSync15(dir))
-    return [];
-  return __require("fs").readdirSync(dir);
-}
-async function runBun(args, cwd) {
-  const proc2 = spawn4({
-    cmd: ["bun", ...args],
-    cwd,
-    stdout: "inherit",
-    stderr: "inherit"
-  });
-  const exit = await proc2.exited;
-  return exit === 0;
-}
-function validateManifest(m4) {
-  if (!m4 || typeof m4 !== "object")
-    return false;
-  const cast = m4;
-  return Array.isArray(cast.modules) && typeof cast.shellHash === "string" && typeof cast.stylesHash === "string" && typeof cast.buildTime === "string";
-}
-
-// src/platform/server.ts
-function generateShellHtml(appName, manifest, arcEntries) {
-  const arcImports = {};
-  if (arcEntries) {
-    for (const [short, pkg] of arcEntries) {
-      arcImports[pkg] = `/shell/${short}.js`;
-    }
+function generateShellHtml(appName, manifest, initial) {
+  const initialUrl = initial ? `/browser/${initial.file}` : null;
+  if (!initialUrl) {
+    throw new Error("generateShellHtml: initial bundle missing from manifest");
   }
-  const importMap = {
-    imports: {
-      react: "/shell/react.js",
-      "react/jsx-runtime": "/shell/jsx-runtime.js",
-      "react/jsx-dev-runtime": "/shell/jsx-dev-runtime.js",
-      "react-dom": "/shell/react-dom.js",
-      "react-dom/client": "/shell/react-dom-client.js",
-      ...arcImports
-    }
-  };
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -31404,18 +31469,13 @@ function generateShellHtml(appName, manifest, arcEntries) {
   <link rel="manifest" href="/manifest.json">` : ""}
   <link rel="stylesheet" href="/styles.css" />
   <link rel="stylesheet" href="/theme.css" />
-  <script type="importmap">${JSON.stringify(importMap)}</script>
+  <link rel="modulepreload" href="${initialUrl}" />
 </head>
 <body>
   <div id="root"></div>
   <script type="module">
-    import { createRoot } from "react-dom/client";
-    import { createElement } from "react";
-    import { PlatformApp } from "@arcote.tech/platform";
-
-    createRoot(document.getElementById("root")).render(
-      createElement(PlatformApp)
-    );
+    import { startApp } from "${initialUrl}";
+    startApp("root");
   </script>
 </body>
 </html>`;
@@ -31440,28 +31500,39 @@ function getMime(path4) {
   return MIME[ext2] ?? "application/octet-stream";
 }
 function serveFile(filePath, headers = {}) {
-  if (!existsSync16(filePath))
+  if (!existsSync18(filePath))
     return new Response("Not Found", { status: 404 });
   return new Response(Bun.file(filePath), {
     headers: { "Content-Type": getMime(filePath), ...headers }
   });
 }
-var MODULE_SIG_SECRET = process.env.ARC_MODULE_SECRET ?? crypto.randomUUID();
+var MODULE_SIG_SECRET = process.env.ARC_MODULE_SECRET ?? "";
 var MODULE_SIG_TTL = 3600;
-function signModuleUrl(filename) {
+function ensureModuleSigSecret(ws, devMode) {
+  if (MODULE_SIG_SECRET)
+    return;
+  if (devMode) {
+    const hasher = new Bun.CryptoHasher("sha256");
+    hasher.update(`arc-dev-secret:${ws.rootDir}`);
+    MODULE_SIG_SECRET = hasher.digest("hex").slice(0, 32);
+  } else {
+    MODULE_SIG_SECRET = crypto.randomUUID();
+  }
+}
+function signGroupUrl(file) {
   const exp = Math.floor(Date.now() / 1000) + MODULE_SIG_TTL;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${filename}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
   const sig = hasher.digest("hex").slice(0, 16);
-  return `/modules/${filename}?sig=${sig}&exp=${exp}`;
+  return `/browser/${file}?sig=${sig}&exp=${exp}`;
 }
-function verifyModuleSignature(filename, sig, exp) {
+function verifyGroupSignature(file, sig, exp) {
   if (!sig || !exp)
     return false;
   if (Number(exp) < Date.now() / 1000)
     return false;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${filename}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
   return hasher.digest("hex").slice(0, 16) === sig;
 }
 function decodeTokenPayload(jwt2) {
@@ -31496,52 +31567,67 @@ function parseArcTokensHeader(header) {
   return payloads;
 }
 async function filterManifestForTokens(manifest, moduleAccessMap, tokenPayloads) {
-  const filtered = [];
-  for (const mod of manifest.modules) {
-    const access = moduleAccessMap.get(mod.name);
-    if (!access) {
-      filtered.push(mod);
+  const allowedGroups = new Set;
+  for (const t of tokenPayloads) {
+    if (t?.tokenType)
+      allowedGroups.add(t.tokenType);
+  }
+  const filteredGroups = {};
+  for (const [name, group] of Object.entries(manifest.groups)) {
+    if (!allowedGroups.has(name))
       continue;
-    }
-    if (tokenPayloads.length === 0)
-      continue;
-    let granted = false;
-    for (const rule of access.rules) {
-      const matching = tokenPayloads.find((t) => t.tokenType === rule.token.name);
-      if (matching) {
+    let allGranted = true;
+    for (const moduleName of group.modules) {
+      const access = moduleAccessMap.get(moduleName);
+      if (!access || access.rules.length === 0)
+        continue;
+      let granted = false;
+      for (const rule of access.rules) {
+        if (rule.token.name !== name)
+          continue;
+        const matching = tokenPayloads.find((t) => t.tokenType === name);
+        if (!matching)
+          continue;
         granted = rule.check ? await rule.check(matching) : true;
         if (granted)
           break;
       }
+      if (!granted) {
+        allGranted = false;
+        break;
+      }
     }
-    if (granted) {
-      filtered.push({ ...mod, url: signModuleUrl(mod.file) });
+    if (allGranted) {
+      filteredGroups[name] = { ...group, url: signGroupUrl(group.file) };
     }
   }
   return {
-    modules: filtered,
-    shellHash: manifest.shellHash,
+    initial: manifest.initial,
+    groups: filteredGroups,
+    sharedChunks: manifest.sharedChunks,
     stylesHash: manifest.stylesHash,
     buildTime: manifest.buildTime
   };
 }
-function staticFilesHandler(ws, devMode, moduleAccessMap) {
+var BROWSER_FILE_RE = /^[A-Za-z0-9_.-]+\.js$/;
+function staticFilesHandler(ws, devMode, getManifest) {
   return (_req, url, ctx) => {
     const path4 = url.pathname;
-    if (path4.startsWith("/shell/"))
-      return serveFile(join20(ws.shellDir, path4.slice(7)), ctx.corsHeaders);
-    if (path4.startsWith("/modules/")) {
-      const fileWithParams = path4.slice(9);
-      const filename = fileWithParams.split("?")[0];
-      const moduleName = filename.replace(/\.js$/, "");
-      if (moduleAccessMap.has(moduleName)) {
+    if (path4.startsWith("/browser/")) {
+      const file = path4.slice(9);
+      if (!BROWSER_FILE_RE.test(file)) {
+        return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+      }
+      const manifest = getManifest();
+      const isGroupEntry = Object.values(manifest.groups).some((g3) => g3.file === file);
+      if (isGroupEntry) {
         const sig = url.searchParams.get("sig");
         const exp = url.searchParams.get("exp");
-        if (!verifyModuleSignature(filename, sig, exp)) {
+        if (!verifyGroupSignature(file, sig, exp)) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join20(ws.modulesDir, filename), {
+      return serveFile(join20(ws.browserDir, file), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
@@ -31559,7 +31645,7 @@ function staticFilesHandler(ws, devMode, moduleAccessMap) {
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
       const publicFile = join20(ws.publicDir, path4.slice(1));
-      if (existsSync16(publicFile))
+      if (existsSync18(publicFile))
         return serveFile(publicFile, ctx.corsHeaders);
     }
     return null;
@@ -31584,7 +31670,7 @@ function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap) {
     if (url.pathname === "/health") {
       return Response.json({
         status: "ok",
-        modules: getManifest().modules.length,
+        groups: Object.keys(getManifest().groups).length,
         clients: cm?.clientCount ?? 0
       }, { headers: ctx.corsHeaders });
     }
@@ -31616,22 +31702,23 @@ function devReloadHandler(sseClients) {
     });
   };
 }
-function spaFallbackHandler(shellHtml) {
+function spaFallbackHandler(getShellHtml) {
   return (_req, _url, ctx) => {
-    return new Response(shellHtml, {
+    return new Response(getShellHtml(), {
       headers: { ...ctx.corsHeaders, "Content-Type": "text/html" }
     });
   };
 }
 async function startPlatformServer(opts) {
   const { ws, port, devMode, context } = opts;
+  ensureModuleSigSecret(ws, !!devMode);
   const moduleAccessMap = opts.moduleAccess ?? new Map;
   let manifest = opts.manifest;
   const getManifest = () => manifest;
   const setManifest = (m4) => {
     manifest = m4;
   };
-  const shellHtml = generateShellHtml(ws.appName, ws.manifest, opts.arcEntries);
+  const getShellHtml = () => generateShellHtml(ws.appName, ws.manifest, manifest?.initial);
   const sseClients = new Set;
   const notifyReload = (m4) => {
     const data = JSON.stringify(m4);
@@ -31645,13 +31732,6 @@ async function startPlatformServer(opts) {
       }
     }
   };
-  const deployApiEnabled = opts.deployApi ?? process.env.ARC_DEPLOY_API === "1";
-  const deployApiHandler = deployApiEnabled ? createDeployApiHandler({
-    ws,
-    getManifest,
-    setManifest,
-    notifyReload
-  }) : null;
   if (!context) {
     const cors = {
       "Access-Control-Allow-Origin": "*",
@@ -31673,11 +31753,10 @@ async function startPlatformServer(opts) {
           corsHeaders: cors
         };
         const handlers = [
-          ...deployApiHandler ? [deployApiHandler] : [],
           apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
           devReloadHandler(sseClients),
-          staticFilesHandler(ws, !!devMode, moduleAccessMap),
-          spaFallbackHandler(shellHtml)
+          staticFilesHandler(ws, !!devMode, getManifest),
+          spaFallbackHandler(getShellHtml)
         ];
         for (const handler of handlers) {
           const response = await handler(req, url, ctx);
@@ -31700,17 +31779,16 @@ async function startPlatformServer(opts) {
   const dbPath = opts.dbPath || join20(ws.arcDir, "data", "arc.db");
   const dbDir = dbPath.substring(0, dbPath.lastIndexOf("/"));
   if (dbDir)
-    mkdirSync15(dbDir, { recursive: true });
+    mkdirSync14(dbDir, { recursive: true });
   const arcServer = await createArcServer({
     context,
     dbAdapterFactory: createBunSQLiteAdapterFactory2(dbPath),
     port,
     httpHandlers: [
-      ...deployApiHandler ? [deployApiHandler] : [],
       apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
       devReloadHandler(sseClients),
-      staticFilesHandler(ws, !!devMode, moduleAccessMap),
-      spaFallbackHandler(shellHtml)
+      staticFilesHandler(ws, !!devMode, getManifest),
+      spaFallbackHandler(getShellHtml)
     ],
     onWsClose: (clientId) => cleanupClientSubs(clientId)
   });
@@ -31724,32 +31802,53 @@ async function startPlatformServer(opts) {
   };
 }
 
-// src/commands/platform-dev.ts
-async function platformDev(opts = {}) {
-  const ws = resolveWorkspace();
-  const port = 5005;
-  let manifest = await buildAll(ws, { noCache: opts.noCache });
+// src/platform/startup.ts
+async function startPlatform(opts) {
+  const { ws, devMode } = opts;
+  const port = opts.port ?? parseInt(process.env.PORT || "5005", 10);
+  const dbPath = opts.dbPath ?? join21(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
+  let manifest;
+  if (devMode) {
+    manifest = await buildAll(ws);
+  } else {
+    const manifestPath = join21(ws.arcDir, "manifest.json");
+    if (!existsSync19(manifestPath)) {
+      err("No build found. Run `arc platform build` first.");
+      process.exit(1);
+    }
+    manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
+  }
   log2("Loading server context...");
-  const { context, moduleAccess } = await loadServerContext(ws.packages);
+  const { context, moduleAccess } = await loadServerContext(ws);
   if (context) {
     ok("Context loaded");
   } else {
     log2("No context \u2014 server endpoints skipped");
   }
-  const arcEntries = collectArcPeerDeps(ws.packages);
   const platform3 = await startPlatformServer({
     ws,
     port,
     manifest,
     context,
     moduleAccess,
-    dbPath: join21(ws.rootDir, ".arc", "data", "dev.db"),
-    devMode: true,
-    arcEntries
+    dbPath,
+    devMode
   });
   ok(`Server on http://localhost:${port}`);
-  if (platform3.contextHandler)
+  if (platform3.contextHandler) {
     ok("Commands, queries, WebSocket \u2014 all on same port");
+  }
+  if (devMode) {
+    attachDevWatcher(ws, platform3);
+  }
+  const cleanup = () => {
+    platform3.stop();
+    process.exit(0);
+  };
+  process.on("SIGTERM", cleanup);
+  process.on("SIGINT", cleanup);
+}
+function attachDevWatcher(ws, platform3) {
   log2("Watching for changes...");
   let rebuildTimer = null;
   let isRebuilding = false;
@@ -31762,10 +31861,10 @@ async function platformDev(opts = {}) {
       isRebuilding = true;
       log2("Rebuilding...");
       try {
-        manifest = await buildAll(ws);
-        platform3.setManifest(manifest);
-        platform3.notifyReload(manifest);
-        ok(`Rebuilt \u2014 ${manifest.modules.length} module(s)`);
+        const next = await buildAll(ws);
+        platform3.setManifest(next);
+        platform3.notifyReload(next);
+        ok(`Rebuilt \u2014 initial + ${Object.keys(next.groups).length} group(s)`);
       } catch (e2) {
         console.error(`Rebuild failed: ${e2}`);
       } finally {
@@ -31775,7 +31874,7 @@ async function platformDev(opts = {}) {
   };
   for (const pkg of ws.packages) {
     const srcDir = join21(pkg.path, "src");
-    if (!existsSync17(srcDir))
+    if (!existsSync19(srcDir))
       continue;
     watch(srcDir, { recursive: true }, (_event, filename) => {
       if (!filename || filename.includes(".arc") || filename.endsWith(".d.ts") || filename.includes("node_modules") || filename.includes("dist"))
@@ -31786,90 +31885,25 @@ async function platformDev(opts = {}) {
     });
   }
   const localesDir = join21(ws.rootDir, "locales");
-  if (existsSync17(localesDir)) {
+  if (existsSync19(localesDir)) {
     watch(localesDir, { recursive: false }, (_event, filename) => {
       if (!filename?.endsWith(".po"))
         return;
       triggerRebuild();
     });
   }
-  const cleanup = () => {
-    platform3.stop();
-    process.exit(0);
-  };
-  process.on("SIGTERM", cleanup);
-  process.on("SIGINT", cleanup);
+}
+
+// src/commands/platform-dev.ts
+async function platformDev(opts = {}) {
+  const ws = resolveWorkspace();
+  await startPlatform({ ws, devMode: true });
 }
 
 // src/commands/platform-start.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { join as join22 } from "path";
 async function platformStart() {
   const ws = resolveWorkspace();
-  const port = parseInt(process.env.PORT || "5005", 10);
-  const deployApi = process.env.ARC_DEPLOY_API === "1";
-  const manifestPath = join22(ws.modulesDir, "manifest.json");
-  if (!existsSync18(manifestPath)) {
-    if (!deployApi) {
-      err("No build found. Run `arc platform build` first.");
-      process.exit(1);
-    }
-    log2("Pre-deploy mode \u2014 no manifest yet, awaiting first /api/deploy/*");
-    const emptyManifest = {
-      modules: [],
-      shellHash: "",
-      stylesHash: "",
-      buildTime: new Date().toISOString()
-    };
-    const platform4 = await startPlatformServer({
-      ws,
-      port,
-      manifest: emptyManifest,
-      context: null,
-      moduleAccess: new Map,
-      dbPath: join22(ws.rootDir, ".arc", "data", "prod.db"),
-      devMode: false,
-      deployApi: true,
-      arcEntries: []
-    });
-    ok(`Pre-deploy server on http://localhost:${port}`);
-    registerSignalCleanup(platform4);
-    return;
-  }
-  const manifest = JSON.parse(readFileSync16(manifestPath, "utf-8"));
-  log2("Loading server context...");
-  const { context, moduleAccess } = await loadServerContext(ws.packages);
-  if (context) {
-    ok("Context loaded");
-  } else {
-    log2("No context \u2014 server endpoints skipped");
-  }
-  const arcEntries = collectArcPeerDeps(ws.packages);
-  if (deployApi)
-    ok("Deploy API enabled (/api/deploy/*)");
-  const platform3 = await startPlatformServer({
-    ws,
-    port,
-    manifest,
-    context,
-    moduleAccess,
-    dbPath: join22(ws.rootDir, ".arc", "data", "prod.db"),
-    devMode: false,
-    deployApi,
-    arcEntries
-  });
-  ok(`Server on http://localhost:${port}`);
-  if (platform3.contextHandler)
-    ok("Commands, queries, WebSocket \u2014 all on same port");
-  registerSignalCleanup(platform3);
-}
-function registerSignalCleanup(platform3) {
-  const cleanup = () => {
-    platform3.stop();
-    process.exit(0);
-  };
-  process.on("SIGTERM", cleanup);
-  process.on("SIGINT", cleanup);
+  await startPlatform({ ws, devMode: false });
 }
 
 // src/index.ts
@@ -31881,8 +31915,7 @@ var platform3 = program2.command("platform").description("Platform commands \u20
 platform3.command("dev").description("Start platform in dev mode (Bun server + Vite HMR)").option("--no-cache", "Force full rebuild on startup").action((opts) => platformDev({ noCache: opts.cache === false }));
 platform3.command("build").description("Build platform for production").option("--no-cache", "Force full rebuild").action((opts) => platformBuild({ noCache: opts.cache === false }));
 platform3.command("start").description("Start platform in production mode (requires prior build)").action(platformStart);
-platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").action((env2, opts) => platformDeploy(env2, opts));
-program2.command("_build-shell", { hidden: true }).description("Build framework shell bundles from a node_modules dir").requiredOption("--out <dir>", "Output directory for shell .js bundles").requiredOption("--from <dir>", "node_modules directory to discover packages in").action((opts) => buildShell(opts));
+platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").option("--build-only", "Build the Docker image locally, then exit (no remote push)").option("--image-tag <hash>", "Roll back / pin to an existing image tag instead of building a new one").option("--force-bootstrap", "Re-run Ansible host bootstrap even if the server is already configured").action((env2, opts) => platformDeploy(env2, opts));
 program2.parse(process.argv);
 if (process.argv.length === 2) {
   program2.help();