@arcote.tech/arc-cli 0.7.0 → 0.7.1

package/dist/index.js

@@ -8974,547 +8974,826 @@ var require_chokidar = __commonJS((exports) => {
   exports.watch = watch;
 });
 
-// ../../node_modules/.bun/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
-var require_src = __commonJS((exports, module) => {
-  var ESC2 = "\x1B";
-  var CSI = `${ESC2}[`;
-  var beep2 = "\x07";
-  var cursor = {
-    to(x, y) {
-      if (!y)
-        return `${CSI}${x + 1}G`;
-      return `${CSI}${y + 1};${x + 1}H`;
-    },
-    move(x, y) {
-      let ret = "";
-      if (x < 0)
-        ret += `${CSI}${-x}D`;
-      else if (x > 0)
-        ret += `${CSI}${x}C`;
-      if (y < 0)
-        ret += `${CSI}${-y}A`;
-      else if (y > 0)
-        ret += `${CSI}${y}B`;
-      return ret;
-    },
-    up: (count = 1) => `${CSI}${count}A`,
-    down: (count = 1) => `${CSI}${count}B`,
-    forward: (count = 1) => `${CSI}${count}C`,
-    backward: (count = 1) => `${CSI}${count}D`,
-    nextLine: (count = 1) => `${CSI}E`.repeat(count),
-    prevLine: (count = 1) => `${CSI}F`.repeat(count),
-    left: `${CSI}G`,
-    hide: `${CSI}?25l`,
-    show: `${CSI}?25h`,
-    save: `${ESC2}7`,
-    restore: `${ESC2}8`
-  };
-  var scroll = {
-    up: (count = 1) => `${CSI}S`.repeat(count),
-    down: (count = 1) => `${CSI}T`.repeat(count)
-  };
-  var erase = {
-    screen: `${CSI}2J`,
-    up: (count = 1) => `${CSI}1J`.repeat(count),
-    down: (count = 1) => `${CSI}J`.repeat(count),
-    line: `${CSI}2K`,
-    lineEnd: `${CSI}K`,
-    lineStart: `${CSI}1K`,
-    lines(count) {
-      let clear = "";
-      for (let i = 0;i < count; i++)
-        clear += this.line + (i < count - 1 ? cursor.up() : "");
-      if (count)
-        clear += cursor.left;
-      return clear;
+// src/i18n/catalog.ts
+function hashMsgid(msgid) {
+  const hasher = new Bun.CryptoHasher("md5");
+  hasher.update(msgid);
+  return hasher.digest("hex").slice(0, 8);
+}
+function parsePo(content) {
+  const entries = [];
+  const lines = content.split(`
+`);
+  let locations = [];
+  let hash = "";
+  let msgid = "";
+  let msgstr = "";
+  let obsolete = false;
+  let inManual = false;
+  const flush = () => {
+    if (msgid) {
+      entries.push({
+        msgid,
+        msgstr,
+        locations,
+        hash: hash || hashMsgid(msgid),
+        obsolete,
+        ...inManual ? { manual: true } : {}
+      });
     }
+    locations = [];
+    hash = "";
+    msgid = "";
+    msgstr = "";
+    obsolete = false;
   };
-  module.exports = { cursor, scroll, erase, beep: beep2 };
-});
-
-// ../../node_modules/.bun/picocolors@1.1.1/node_modules/picocolors/picocolors.js
-var require_picocolors = __commonJS((exports, module) => {
-  var p = process || {};
-  var argv2 = p.argv || [];
-  var env2 = p.env || {};
-  var isColorSupported2 = !(!!env2.NO_COLOR || argv2.includes("--no-color")) && (!!env2.FORCE_COLOR || argv2.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env2.TERM !== "dumb" || !!env2.CI);
-  var formatter = (open, close, replace = open) => (input) => {
-    let string = "" + input, index = string.indexOf(close, open.length);
-    return ~index ? open + replaceClose2(string, close, replace, index) + close : open + string + close;
-  };
-  var replaceClose2 = (string, close, replace, index) => {
-    let result = "", cursor = 0;
-    do {
-      result += string.substring(cursor, index) + replace;
-      cursor = index + close.length;
-      index = string.indexOf(close, cursor);
-    } while (~index);
-    return result + string.substring(cursor);
-  };
-  var createColors2 = (enabled = isColorSupported2) => {
-    let f = enabled ? formatter : () => String;
-    return {
-      isColorSupported: enabled,
-      reset: f("\x1B[0m", "\x1B[0m"),
-      bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
-      dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
-      italic: f("\x1B[3m", "\x1B[23m"),
-      underline: f("\x1B[4m", "\x1B[24m"),
-      inverse: f("\x1B[7m", "\x1B[27m"),
-      hidden: f("\x1B[8m", "\x1B[28m"),
-      strikethrough: f("\x1B[9m", "\x1B[29m"),
-      black: f("\x1B[30m", "\x1B[39m"),
-      red: f("\x1B[31m", "\x1B[39m"),
-      green: f("\x1B[32m", "\x1B[39m"),
-      yellow: f("\x1B[33m", "\x1B[39m"),
-      blue: f("\x1B[34m", "\x1B[39m"),
-      magenta: f("\x1B[35m", "\x1B[39m"),
-      cyan: f("\x1B[36m", "\x1B[39m"),
-      white: f("\x1B[37m", "\x1B[39m"),
-      gray: f("\x1B[90m", "\x1B[39m"),
-      bgBlack: f("\x1B[40m", "\x1B[49m"),
-      bgRed: f("\x1B[41m", "\x1B[49m"),
-      bgGreen: f("\x1B[42m", "\x1B[49m"),
-      bgYellow: f("\x1B[43m", "\x1B[49m"),
-      bgBlue: f("\x1B[44m", "\x1B[49m"),
-      bgMagenta: f("\x1B[45m", "\x1B[49m"),
-      bgCyan: f("\x1B[46m", "\x1B[49m"),
-      bgWhite: f("\x1B[47m", "\x1B[49m"),
-      blackBright: f("\x1B[90m", "\x1B[39m"),
-      redBright: f("\x1B[91m", "\x1B[39m"),
-      greenBright: f("\x1B[92m", "\x1B[39m"),
-      yellowBright: f("\x1B[93m", "\x1B[39m"),
-      blueBright: f("\x1B[94m", "\x1B[39m"),
-      magentaBright: f("\x1B[95m", "\x1B[39m"),
-      cyanBright: f("\x1B[96m", "\x1B[39m"),
-      whiteBright: f("\x1B[97m", "\x1B[39m"),
-      bgBlackBright: f("\x1B[100m", "\x1B[49m"),
-      bgRedBright: f("\x1B[101m", "\x1B[49m"),
-      bgGreenBright: f("\x1B[102m", "\x1B[49m"),
-      bgYellowBright: f("\x1B[103m", "\x1B[49m"),
-      bgBlueBright: f("\x1B[104m", "\x1B[49m"),
-      bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
-      bgCyanBright: f("\x1B[106m", "\x1B[49m"),
-      bgWhiteBright: f("\x1B[107m", "\x1B[49m")
-    };
-  };
-  module.exports = createColors2();
-  module.exports.createColors = createColors2;
-});
-
-// ../../node_modules/.bun/safe-buffer@5.2.1/node_modules/safe-buffer/index.js
-var require_safe_buffer = __commonJS((exports, module) => {
-  /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
-  var buffer = __require("buffer");
-  var Buffer2 = buffer.Buffer;
-  function copyProps(src, dst) {
-    for (var key in src) {
-      dst[key] = src[key];
-    }
-  }
-  if (Buffer2.from && Buffer2.alloc && Buffer2.allocUnsafe && Buffer2.allocUnsafeSlow) {
-    module.exports = buffer;
-  } else {
-    copyProps(buffer, exports);
-    exports.Buffer = SafeBuffer;
-  }
-  function SafeBuffer(arg, encodingOrOffset, length) {
-    return Buffer2(arg, encodingOrOffset, length);
-  }
-  SafeBuffer.prototype = Object.create(Buffer2.prototype);
-  copyProps(Buffer2, SafeBuffer);
-  SafeBuffer.from = function(arg, encodingOrOffset, length) {
-    if (typeof arg === "number") {
-      throw new TypeError("Argument must not be a number");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "# manual") {
+      inManual = true;
+      continue;
     }
-    return Buffer2(arg, encodingOrOffset, length);
-  };
-  SafeBuffer.alloc = function(size, fill, encoding) {
-    if (typeof size !== "number") {
-      throw new TypeError("Argument must be a number");
+    if (trimmed === "# end manual") {
+      if (msgid)
+        flush();
+      inManual = false;
+      continue;
     }
-    var buf = Buffer2(size);
-    if (fill !== undefined) {
-      if (typeof encoding === "string") {
-        buf.fill(fill, encoding);
-      } else {
-        buf.fill(fill);
-      }
-    } else {
-      buf.fill(0);
+    if (trimmed === "" || trimmed.startsWith("#,")) {
+      if (msgid)
+        flush();
+      continue;
     }
-    return buf;
-  };
-  SafeBuffer.allocUnsafe = function(size) {
-    if (typeof size !== "number") {
-      throw new TypeError("Argument must be a number");
+    if (trimmed.startsWith("#:")) {
+      if (msgid)
+        flush();
+      locations.push(trimmed.slice(3).trim());
+      continue;
     }
-    return Buffer2(size);
-  };
-  SafeBuffer.allocUnsafeSlow = function(size) {
-    if (typeof size !== "number") {
-      throw new TypeError("Argument must be a number");
+    if (trimmed.startsWith("#.")) {
+      const hashMatch = trimmed.match(/hash:(\w+)/);
+      if (hashMatch)
+        hash = hashMatch[1];
+      continue;
     }
-    return buffer.SlowBuffer(size);
-  };
-});
-
-// ../../node_modules/.bun/jws@4.0.1/node_modules/jws/lib/data-stream.js
-var require_data_stream = __commonJS((exports, module) => {
-  var Buffer2 = require_safe_buffer().Buffer;
-  var Stream2 = __require("stream");
-  var util = __require("util");
-  function DataStream(data) {
-    this.buffer = null;
-    this.writable = true;
-    this.readable = true;
-    if (!data) {
-      this.buffer = Buffer2.alloc(0);
-      return this;
+    if (trimmed.startsWith("#~")) {
+      const rest = trimmed.slice(3).trim();
+      if (rest.startsWith("msgid")) {
+        if (msgid)
+          flush();
+        obsolete = true;
+        msgid = extractQuoted(rest.slice(5));
+      } else if (rest.startsWith("msgstr")) {
+        msgstr = extractQuoted(rest.slice(6));
+      }
+      continue;
     }
-    if (typeof data.pipe === "function") {
-      this.buffer = Buffer2.alloc(0);
-      data.pipe(this);
-      return this;
+    if (trimmed.startsWith("msgid")) {
+      if (msgid)
+        flush();
+      msgid = extractQuoted(trimmed.slice(5));
+    } else if (trimmed.startsWith("msgstr")) {
+      msgstr = extractQuoted(trimmed.slice(6));
     }
-    if (data.length || typeof data === "object") {
-      this.buffer = data;
-      this.writable = false;
-      process.nextTick(function() {
-        this.emit("end", data);
-        this.readable = false;
-        this.emit("close");
-      }.bind(this));
-      return this;
+  }
+  flush();
+  return entries;
+}
+function writePo(entries) {
+  const lines = [];
+  const manual = entries.filter((e) => e.manual);
+  const active = entries.filter((e) => !e.obsolete && !e.manual);
+  const obsolete = entries.filter((e) => e.obsolete);
+  if (manual.length > 0) {
+    lines.push("# manual");
+    for (const entry of manual) {
+      lines.push(`msgid ${quoteString(entry.msgid)}`);
+      lines.push(`msgstr ${quoteString(entry.msgstr)}`);
+      lines.push("");
     }
-    throw new TypeError("Unexpected data type (" + typeof data + ")");
+    lines.push("# end manual");
+    lines.push("");
   }
-  util.inherits(DataStream, Stream2);
-  DataStream.prototype.write = function write(data) {
-    this.buffer = Buffer2.concat([this.buffer, Buffer2.from(data)]);
-    this.emit("data", data);
-  };
-  DataStream.prototype.end = function end(data) {
-    if (data)
-      this.write(data);
-    this.emit("end", data);
-    this.emit("close");
-    this.writable = false;
-    this.readable = false;
-  };
-  module.exports = DataStream;
-});
-
-// ../../node_modules/.bun/ecdsa-sig-formatter@1.0.11/node_modules/ecdsa-sig-formatter/src/param-bytes-for-alg.js
-var require_param_bytes_for_alg = __commonJS((exports, module) => {
-  function getParamSize(keySize) {
-    var result = (keySize / 8 | 0) + (keySize % 8 === 0 ? 0 : 1);
-    return result;
+  for (const entry of active) {
+    for (const loc of entry.locations) {
+      lines.push(`#: ${loc}`);
+    }
+    lines.push(`#. hash:${entry.hash}`);
+    lines.push(`msgid ${quoteString(entry.msgid)}`);
+    lines.push(`msgstr ${quoteString(entry.msgstr)}`);
+    lines.push("");
   }
-  var paramBytesForAlg = {
-    ES256: getParamSize(256),
-    ES384: getParamSize(384),
-    ES512: getParamSize(521)
-  };
-  function getParamBytesForAlg(alg) {
-    var paramBytes = paramBytesForAlg[alg];
-    if (paramBytes) {
-      return paramBytes;
+  if (obsolete.length > 0) {
+    lines.push("# Obsolete entries");
+    lines.push("");
+    for (const entry of obsolete) {
+      lines.push(`#~ msgid ${quoteString(entry.msgid)}`);
+      lines.push(`#~ msgstr ${quoteString(entry.msgstr)}`);
+      lines.push("");
     }
-    throw new Error('Unknown algorithm "' + alg + '"');
   }
-  module.exports = getParamBytesForAlg;
-});
-
-// ../../node_modules/.bun/ecdsa-sig-formatter@1.0.11/node_modules/ecdsa-sig-formatter/src/ecdsa-sig-formatter.js
-var require_ecdsa_sig_formatter = __commonJS((exports, module) => {
-  var Buffer2 = require_safe_buffer().Buffer;
-  var getParamBytesForAlg = require_param_bytes_for_alg();
-  var MAX_OCTET = 128;
-  var CLASS_UNIVERSAL = 0;
-  var PRIMITIVE_BIT = 32;
-  var TAG_SEQ = 16;
-  var TAG_INT = 2;
-  var ENCODED_TAG_SEQ = TAG_SEQ | PRIMITIVE_BIT | CLASS_UNIVERSAL << 6;
-  var ENCODED_TAG_INT = TAG_INT | CLASS_UNIVERSAL << 6;
-  function base64Url(base64) {
-    return base64.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  return lines.join(`
+`);
+}
+function mergeCatalog(existing, extracted) {
+  const existingMap = new Map;
+  for (const entry of existing) {
+    existingMap.set(entry.msgid, entry);
   }
-  function signatureAsBuffer(signature) {
-    if (Buffer2.isBuffer(signature)) {
-      return signature;
-    } else if (typeof signature === "string") {
-      return Buffer2.from(signature, "base64");
-    }
-    throw new TypeError("ECDSA signature must be a Base64 string or a Buffer");
+  const manualEntries = existing.filter((e) => e.manual);
+  const manualIds = new Set(manualEntries.map((e) => e.msgid));
+  const result = [];
+  const seen = new Set;
+  for (const [msgid, locations] of extracted) {
+    seen.add(msgid);
+    if (manualIds.has(msgid))
+      continue;
+    const prev = existingMap.get(msgid);
+    result.push({
+      msgid,
+      msgstr: prev?.msgstr ?? "",
+      locations: [...locations].sort(),
+      hash: hashMsgid(msgid),
+      obsolete: false
+    });
   }
-  function derToJose(signature, alg) {
-    signature = signatureAsBuffer(signature);
-    var paramBytes = getParamBytesForAlg(alg);
-    var maxEncodedParamLength = paramBytes + 1;
-    var inputLength = signature.length;
-    var offset = 0;
-    if (signature[offset++] !== ENCODED_TAG_SEQ) {
-      throw new Error('Could not find expected "seq"');
-    }
-    var seqLength = signature[offset++];
-    if (seqLength === (MAX_OCTET | 1)) {
-      seqLength = signature[offset++];
-    }
-    if (inputLength - offset < seqLength) {
-      throw new Error('"seq" specified length of "' + seqLength + '", only "' + (inputLength - offset) + '" remaining');
-    }
-    if (signature[offset++] !== ENCODED_TAG_INT) {
-      throw new Error('Could not find expected "int" for "r"');
-    }
-    var rLength = signature[offset++];
-    if (inputLength - offset - 2 < rLength) {
-      throw new Error('"r" specified length of "' + rLength + '", only "' + (inputLength - offset - 2) + '" available');
-    }
-    if (maxEncodedParamLength < rLength) {
-      throw new Error('"r" specified length of "' + rLength + '", max of "' + maxEncodedParamLength + '" is acceptable');
-    }
-    var rOffset = offset;
-    offset += rLength;
-    if (signature[offset++] !== ENCODED_TAG_INT) {
-      throw new Error('Could not find expected "int" for "s"');
-    }
-    var sLength = signature[offset++];
-    if (inputLength - offset !== sLength) {
-      throw new Error('"s" specified length of "' + sLength + '", expected "' + (inputLength - offset) + '"');
-    }
-    if (maxEncodedParamLength < sLength) {
-      throw new Error('"s" specified length of "' + sLength + '", max of "' + maxEncodedParamLength + '" is acceptable');
-    }
-    var sOffset = offset;
-    offset += sLength;
-    if (offset !== inputLength) {
-      throw new Error('Expected to consume entire buffer, but "' + (inputLength - offset) + '" bytes remain');
-    }
-    var rPadding = paramBytes - rLength, sPadding = paramBytes - sLength;
-    var dst = Buffer2.allocUnsafe(rPadding + rLength + sPadding + sLength);
-    for (offset = 0;offset < rPadding; ++offset) {
-      dst[offset] = 0;
-    }
-    signature.copy(dst, offset, rOffset + Math.max(-rPadding, 0), rOffset + rLength);
-    offset = paramBytes;
-    for (var o = offset;offset < o + sPadding; ++offset) {
-      dst[offset] = 0;
+  for (const entry of existing) {
+    if (!seen.has(entry.msgid) && !entry.obsolete && !entry.manual && entry.msgstr) {
+      result.push({
+        ...entry,
+        obsolete: true,
+        locations: []
+      });
     }
-    signature.copy(dst, offset, sOffset + Math.max(-sPadding, 0), sOffset + sLength);
-    dst = dst.toString("base64");
-    dst = base64Url(dst);
-    return dst;
   }
-  function countPadding(buf, start, stop) {
-    var padding = 0;
-    while (start + padding < stop && buf[start + padding] === 0) {
-      ++padding;
-    }
-    var needsSign = buf[start + padding] >= MAX_OCTET;
-    if (needsSign) {
-      --padding;
-    }
-    return padding;
+  result.sort((a, b) => a.msgid.localeCompare(b.msgid));
+  return [...manualEntries, ...result];
+}
+function extractQuoted(s) {
+  const trimmed = s.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    return trimmed.slice(1, -1).replace(/\\n/g, `
+`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
   }
-  function joseToDer(signature, alg) {
-    signature = signatureAsBuffer(signature);
-    var paramBytes = getParamBytesForAlg(alg);
-    var signatureBytes = signature.length;
-    if (signatureBytes !== paramBytes * 2) {
-      throw new TypeError('"' + alg + '" signatures must be "' + paramBytes * 2 + '" bytes, saw "' + signatureBytes + '"');
-    }
-    var rPadding = countPadding(signature, 0, paramBytes);
-    var sPadding = countPadding(signature, paramBytes, signature.length);
-    var rLength = paramBytes - rPadding;
-    var sLength = paramBytes - sPadding;
-    var rsBytes = 1 + 1 + rLength + 1 + 1 + sLength;
-    var shortLength = rsBytes < MAX_OCTET;
-    var dst = Buffer2.allocUnsafe((shortLength ? 2 : 3) + rsBytes);
-    var offset = 0;
-    dst[offset++] = ENCODED_TAG_SEQ;
-    if (shortLength) {
-      dst[offset++] = rsBytes;
-    } else {
-      dst[offset++] = MAX_OCTET | 1;
-      dst[offset++] = rsBytes & 255;
-    }
-    dst[offset++] = ENCODED_TAG_INT;
-    dst[offset++] = rLength;
-    if (rPadding < 0) {
-      dst[offset++] = 0;
-      offset += signature.copy(dst, offset, 0, paramBytes);
-    } else {
-      offset += signature.copy(dst, offset, rPadding, paramBytes);
+  return trimmed;
+}
+function quoteString(s) {
+  const escaped = s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+  return `"${escaped}"`;
+}
+
+// src/i18n/compile.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+function compileCatalog(poPath) {
+  const content = readFileSync3(poPath, "utf-8");
+  const entries = parsePo(content);
+  const result = {};
+  for (const entry of entries) {
+    if (!entry.obsolete && entry.msgstr) {
+      result[entry.msgid] = entry.msgstr;
     }
-    dst[offset++] = ENCODED_TAG_INT;
-    dst[offset++] = sLength;
-    if (sPadding < 0) {
-      dst[offset++] = 0;
-      signature.copy(dst, offset, paramBytes);
-    } else {
-      signature.copy(dst, offset, paramBytes + sPadding);
-    }
-    return dst;
   }
-  module.exports = {
-    derToJose,
-    joseToDer
+  const sorted = {};
+  for (const key of Object.keys(result).sort()) {
+    sorted[key] = result[key];
+  }
+  return sorted;
+}
+function compileAllCatalogs(localesDir, outDir) {
+  mkdirSync3(outDir, { recursive: true });
+  for (const file of readdirSync2(localesDir)) {
+    if (!file.endsWith(".po"))
+      continue;
+    const locale = file.replace(".po", "");
+    const compiled = compileCatalog(join4(localesDir, file));
+    writeFileSync3(join4(outDir, `${locale}.json`), JSON.stringify(compiled));
+  }
+}
+var init_compile = () => {};
+
+// src/i18n/plugin.ts
+function i18nExtractPlugin(collector, rootDir) {
+  return {
+    name: "arc-i18n-extract",
+    setup(build2) {
+      build2.onLoad({ filter: /\.tsx?$/ }, async (args) => {
+        const source = await Bun.file(args.path).text();
+        const relPath = args.path.startsWith(rootDir) ? args.path.slice(rootDir.length + 1) : args.path;
+        const transRegex = /<Trans>\s*([^<{]+?)\s*<\/Trans>/g;
+        for (const match2 of source.matchAll(transRegex)) {
+          const msgid = match2[1].trim();
+          if (!msgid)
+            continue;
+          const line = source.substring(0, match2.index).split(`
+`).length;
+          const loc = `${relPath}:${line}`;
+          if (!collector.has(msgid))
+            collector.set(msgid, new Set);
+          collector.get(msgid).add(loc);
+        }
+        const tRegex = /\bt`([^`]+)`/g;
+        for (const match2 of source.matchAll(tRegex)) {
+          const msgid = match2[1];
+          if (!msgid)
+            continue;
+          const line = source.substring(0, match2.index).split(`
+`).length;
+          const loc = `${relPath}:${line}`;
+          if (!collector.has(msgid))
+            collector.set(msgid, new Set);
+          collector.get(msgid).add(loc);
+        }
+        return;
+      });
+    }
   };
+}
+
+// src/i18n/index.ts
+var exports_i18n = {};
+__export(exports_i18n, {
+  readTranslationsConfig: () => readTranslationsConfig,
+  i18nExtractPlugin: () => i18nExtractPlugin,
+  finalizeTranslations: () => finalizeTranslations
+});
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
+function readTranslationsConfig(rootDir) {
+  const pkgPath = join5(rootDir, "package.json");
+  if (!existsSync4(pkgPath))
+    return null;
+  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
+  const config = pkg.arc?.translations;
+  if (!config?.locales?.length)
+    return null;
+  return {
+    locales: config.locales,
+    sourceLocale: config.sourceLocale ?? config.locales[0]
+  };
+}
+async function finalizeTranslations(rootDir, outDir, collector) {
+  const config = readTranslationsConfig(rootDir);
+  if (!config || collector.size === 0)
+    return;
+  const localesJsonDir = join5(outDir, "locales");
+  mkdirSync4(localesJsonDir, { recursive: true });
+  console.log(`  Extracted ${collector.size} translatable string(s) for ${config.locales.length} locale(s)`);
+  for (const locale of config.locales) {
+    const poPath = join5(rootDir, "locales", `${locale}.po`);
+    mkdirSync4(dirname4(poPath), { recursive: true });
+    const existing = existsSync4(poPath) ? parsePo(readFileSync4(poPath, "utf-8")) : [];
+    const merged = mergeCatalog(existing, collector);
+    writeFileSync4(poPath, writePo(merged));
+    const compiled = compileCatalog(poPath);
+    writeFileSync4(join5(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
+  }
+}
+var init_i18n = __esm(() => {
+  init_compile();
 });
 
-// ../../node_modules/.bun/buffer-equal-constant-time@1.0.1/node_modules/buffer-equal-constant-time/index.js
-var require_buffer_equal_constant_time = __commonJS((exports, module) => {
-  var Buffer2 = __require("buffer").Buffer;
-  var SlowBuffer = __require("buffer").SlowBuffer;
-  module.exports = bufferEq;
-  function bufferEq(a2, b2) {
-    if (!Buffer2.isBuffer(a2) || !Buffer2.isBuffer(b2)) {
-      return false;
-    }
-    if (a2.length !== b2.length) {
-      return false;
-    }
-    var c2 = 0;
-    for (var i = 0;i < a2.length; i++) {
-      c2 |= a2[i] ^ b2[i];
+// ../../node_modules/.bun/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
+var require_src = __commonJS((exports, module) => {
+  var ESC2 = "\x1B";
+  var CSI = `${ESC2}[`;
+  var beep2 = "\x07";
+  var cursor = {
+    to(x, y) {
+      if (!y)
+        return `${CSI}${x + 1}G`;
+      return `${CSI}${y + 1};${x + 1}H`;
+    },
+    move(x, y) {
+      let ret = "";
+      if (x < 0)
+        ret += `${CSI}${-x}D`;
+      else if (x > 0)
+        ret += `${CSI}${x}C`;
+      if (y < 0)
+        ret += `${CSI}${-y}A`;
+      else if (y > 0)
+        ret += `${CSI}${y}B`;
+      return ret;
+    },
+    up: (count = 1) => `${CSI}${count}A`,
+    down: (count = 1) => `${CSI}${count}B`,
+    forward: (count = 1) => `${CSI}${count}C`,
+    backward: (count = 1) => `${CSI}${count}D`,
+    nextLine: (count = 1) => `${CSI}E`.repeat(count),
+    prevLine: (count = 1) => `${CSI}F`.repeat(count),
+    left: `${CSI}G`,
+    hide: `${CSI}?25l`,
+    show: `${CSI}?25h`,
+    save: `${ESC2}7`,
+    restore: `${ESC2}8`
+  };
+  var scroll = {
+    up: (count = 1) => `${CSI}S`.repeat(count),
+    down: (count = 1) => `${CSI}T`.repeat(count)
+  };
+  var erase = {
+    screen: `${CSI}2J`,
+    up: (count = 1) => `${CSI}1J`.repeat(count),
+    down: (count = 1) => `${CSI}J`.repeat(count),
+    line: `${CSI}2K`,
+    lineEnd: `${CSI}K`,
+    lineStart: `${CSI}1K`,
+    lines(count) {
+      let clear = "";
+      for (let i = 0;i < count; i++)
+        clear += this.line + (i < count - 1 ? cursor.up() : "");
+      if (count)
+        clear += cursor.left;
+      return clear;
     }
-    return c2 === 0;
-  }
-  bufferEq.install = function() {
-    Buffer2.prototype.equal = SlowBuffer.prototype.equal = function equal(that) {
-      return bufferEq(this, that);
-    };
   };
-  var origBufEqual = Buffer2.prototype.equal;
-  var origSlowBufEqual = SlowBuffer.prototype.equal;
-  bufferEq.restore = function() {
-    Buffer2.prototype.equal = origBufEqual;
-    SlowBuffer.prototype.equal = origSlowBufEqual;
+  module.exports = { cursor, scroll, erase, beep: beep2 };
+});
+
+// ../../node_modules/.bun/picocolors@1.1.1/node_modules/picocolors/picocolors.js
+var require_picocolors = __commonJS((exports, module) => {
+  var p = process || {};
+  var argv2 = p.argv || [];
+  var env2 = p.env || {};
+  var isColorSupported2 = !(!!env2.NO_COLOR || argv2.includes("--no-color")) && (!!env2.FORCE_COLOR || argv2.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env2.TERM !== "dumb" || !!env2.CI);
+  var formatter = (open, close, replace = open) => (input) => {
+    let string = "" + input, index = string.indexOf(close, open.length);
+    return ~index ? open + replaceClose2(string, close, replace, index) + close : open + string + close;
+  };
+  var replaceClose2 = (string, close, replace, index) => {
+    let result = "", cursor = 0;
+    do {
+      result += string.substring(cursor, index) + replace;
+      cursor = index + close.length;
+      index = string.indexOf(close, cursor);
+    } while (~index);
+    return result + string.substring(cursor);
+  };
+  var createColors2 = (enabled = isColorSupported2) => {
+    let f = enabled ? formatter : () => String;
+    return {
+      isColorSupported: enabled,
+      reset: f("\x1B[0m", "\x1B[0m"),
+      bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
+      dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
+      italic: f("\x1B[3m", "\x1B[23m"),
+      underline: f("\x1B[4m", "\x1B[24m"),
+      inverse: f("\x1B[7m", "\x1B[27m"),
+      hidden: f("\x1B[8m", "\x1B[28m"),
+      strikethrough: f("\x1B[9m", "\x1B[29m"),
+      black: f("\x1B[30m", "\x1B[39m"),
+      red: f("\x1B[31m", "\x1B[39m"),
+      green: f("\x1B[32m", "\x1B[39m"),
+      yellow: f("\x1B[33m", "\x1B[39m"),
+      blue: f("\x1B[34m", "\x1B[39m"),
+      magenta: f("\x1B[35m", "\x1B[39m"),
+      cyan: f("\x1B[36m", "\x1B[39m"),
+      white: f("\x1B[37m", "\x1B[39m"),
+      gray: f("\x1B[90m", "\x1B[39m"),
+      bgBlack: f("\x1B[40m", "\x1B[49m"),
+      bgRed: f("\x1B[41m", "\x1B[49m"),
+      bgGreen: f("\x1B[42m", "\x1B[49m"),
+      bgYellow: f("\x1B[43m", "\x1B[49m"),
+      bgBlue: f("\x1B[44m", "\x1B[49m"),
+      bgMagenta: f("\x1B[45m", "\x1B[49m"),
+      bgCyan: f("\x1B[46m", "\x1B[49m"),
+      bgWhite: f("\x1B[47m", "\x1B[49m"),
+      blackBright: f("\x1B[90m", "\x1B[39m"),
+      redBright: f("\x1B[91m", "\x1B[39m"),
+      greenBright: f("\x1B[92m", "\x1B[39m"),
+      yellowBright: f("\x1B[93m", "\x1B[39m"),
+      blueBright: f("\x1B[94m", "\x1B[39m"),
+      magentaBright: f("\x1B[95m", "\x1B[39m"),
+      cyanBright: f("\x1B[96m", "\x1B[39m"),
+      whiteBright: f("\x1B[97m", "\x1B[39m"),
+      bgBlackBright: f("\x1B[100m", "\x1B[49m"),
+      bgRedBright: f("\x1B[101m", "\x1B[49m"),
+      bgGreenBright: f("\x1B[102m", "\x1B[49m"),
+      bgYellowBright: f("\x1B[103m", "\x1B[49m"),
+      bgBlueBright: f("\x1B[104m", "\x1B[49m"),
+      bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
+      bgCyanBright: f("\x1B[106m", "\x1B[49m"),
+      bgWhiteBright: f("\x1B[107m", "\x1B[49m")
+    };
   };
+  module.exports = createColors2();
+  module.exports.createColors = createColors2;
 });
 
-// ../../node_modules/.bun/jwa@2.0.1/node_modules/jwa/index.js
-var require_jwa = __commonJS((exports, module) => {
-  var Buffer2 = require_safe_buffer().Buffer;
-  var crypto2 = __require("crypto");
-  var formatEcdsa = require_ecdsa_sig_formatter();
-  var util = __require("util");
-  var MSG_INVALID_ALGORITHM = `"%s" is not a valid algorithm.
-  Supported algorithms are:
-  "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`;
-  var MSG_INVALID_SECRET = "secret must be a string or buffer";
-  var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
-  var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-  var supportsKeyObjects = typeof crypto2.createPublicKey === "function";
-  if (supportsKeyObjects) {
-    MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
-    MSG_INVALID_SECRET += "or a KeyObject";
+// ../../node_modules/.bun/safe-buffer@5.2.1/node_modules/safe-buffer/index.js
+var require_safe_buffer = __commonJS((exports, module) => {
+  /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
+  var buffer = __require("buffer");
+  var Buffer2 = buffer.Buffer;
+  function copyProps(src, dst) {
+    for (var key in src) {
+      dst[key] = src[key];
+    }
   }
-  function checkIsPublicKey(key) {
-    if (Buffer2.isBuffer(key)) {
-      return;
+  if (Buffer2.from && Buffer2.alloc && Buffer2.allocUnsafe && Buffer2.allocUnsafeSlow) {
+    module.exports = buffer;
+  } else {
+    copyProps(buffer, exports);
+    exports.Buffer = SafeBuffer;
+  }
+  function SafeBuffer(arg, encodingOrOffset, length) {
+    return Buffer2(arg, encodingOrOffset, length);
+  }
+  SafeBuffer.prototype = Object.create(Buffer2.prototype);
+  copyProps(Buffer2, SafeBuffer);
+  SafeBuffer.from = function(arg, encodingOrOffset, length) {
+    if (typeof arg === "number") {
+      throw new TypeError("Argument must not be a number");
     }
-    if (typeof key === "string") {
-      return;
+    return Buffer2(arg, encodingOrOffset, length);
+  };
+  SafeBuffer.alloc = function(size, fill, encoding) {
+    if (typeof size !== "number") {
+      throw new TypeError("Argument must be a number");
     }
-    if (!supportsKeyObjects) {
-      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    var buf = Buffer2(size);
+    if (fill !== undefined) {
+      if (typeof encoding === "string") {
+        buf.fill(fill, encoding);
+      } else {
+        buf.fill(fill);
+      }
+    } else {
+      buf.fill(0);
     }
-    if (typeof key !== "object") {
-      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    return buf;
+  };
+  SafeBuffer.allocUnsafe = function(size) {
+    if (typeof size !== "number") {
+      throw new TypeError("Argument must be a number");
     }
-    if (typeof key.type !== "string") {
-      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    return Buffer2(size);
+  };
+  SafeBuffer.allocUnsafeSlow = function(size) {
+    if (typeof size !== "number") {
+      throw new TypeError("Argument must be a number");
     }
-    if (typeof key.asymmetricKeyType !== "string") {
-      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    return buffer.SlowBuffer(size);
+  };
+});
+
+// ../../node_modules/.bun/jws@4.0.1/node_modules/jws/lib/data-stream.js
+var require_data_stream = __commonJS((exports, module) => {
+  var Buffer2 = require_safe_buffer().Buffer;
+  var Stream2 = __require("stream");
+  var util = __require("util");
+  function DataStream(data) {
+    this.buffer = null;
+    this.writable = true;
+    this.readable = true;
+    if (!data) {
+      this.buffer = Buffer2.alloc(0);
+      return this;
     }
-    if (typeof key.export !== "function") {
-      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    if (typeof data.pipe === "function") {
+      this.buffer = Buffer2.alloc(0);
+      data.pipe(this);
+      return this;
     }
-  }
-  function checkIsPrivateKey(key) {
-    if (Buffer2.isBuffer(key)) {
-      return;
+    if (data.length || typeof data === "object") {
+      this.buffer = data;
+      this.writable = false;
+      process.nextTick(function() {
+        this.emit("end", data);
+        this.readable = false;
+        this.emit("close");
+      }.bind(this));
+      return this;
     }
-    if (typeof key === "string") {
-      return;
+    throw new TypeError("Unexpected data type (" + typeof data + ")");
+  }
+  util.inherits(DataStream, Stream2);
+  DataStream.prototype.write = function write(data) {
+    this.buffer = Buffer2.concat([this.buffer, Buffer2.from(data)]);
+    this.emit("data", data);
+  };
+  DataStream.prototype.end = function end(data) {
+    if (data)
+      this.write(data);
+    this.emit("end", data);
+    this.emit("close");
+    this.writable = false;
+    this.readable = false;
+  };
+  module.exports = DataStream;
+});
+
+// ../../node_modules/.bun/ecdsa-sig-formatter@1.0.11/node_modules/ecdsa-sig-formatter/src/param-bytes-for-alg.js
+var require_param_bytes_for_alg = __commonJS((exports, module) => {
+  function getParamSize(keySize) {
+    var result = (keySize / 8 | 0) + (keySize % 8 === 0 ? 0 : 1);
+    return result;
+  }
+  var paramBytesForAlg = {
+    ES256: getParamSize(256),
+    ES384: getParamSize(384),
+    ES512: getParamSize(521)
+  };
+  function getParamBytesForAlg(alg) {
+    var paramBytes = paramBytesForAlg[alg];
+    if (paramBytes) {
+      return paramBytes;
     }
-    if (typeof key === "object") {
-      return;
+    throw new Error('Unknown algorithm "' + alg + '"');
+  }
+  module.exports = getParamBytesForAlg;
+});
+
+// ../../node_modules/.bun/ecdsa-sig-formatter@1.0.11/node_modules/ecdsa-sig-formatter/src/ecdsa-sig-formatter.js
+var require_ecdsa_sig_formatter = __commonJS((exports, module) => {
+  var Buffer2 = require_safe_buffer().Buffer;
+  var getParamBytesForAlg = require_param_bytes_for_alg();
+  var MAX_OCTET = 128;
+  var CLASS_UNIVERSAL = 0;
+  var PRIMITIVE_BIT = 32;
+  var TAG_SEQ = 16;
+  var TAG_INT = 2;
+  var ENCODED_TAG_SEQ = TAG_SEQ | PRIMITIVE_BIT | CLASS_UNIVERSAL << 6;
+  var ENCODED_TAG_INT = TAG_INT | CLASS_UNIVERSAL << 6;
+  function base64Url(base64) {
+    return base64.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  }
+  function signatureAsBuffer(signature) {
+    if (Buffer2.isBuffer(signature)) {
+      return signature;
+    } else if (typeof signature === "string") {
+      return Buffer2.from(signature, "base64");
     }
-    throw typeError(MSG_INVALID_SIGNER_KEY);
+    throw new TypeError("ECDSA signature must be a Base64 string or a Buffer");
   }
-  function checkIsSecretKey(key) {
-    if (Buffer2.isBuffer(key)) {
-      return;
+  function derToJose(signature, alg) {
+    signature = signatureAsBuffer(signature);
+    var paramBytes = getParamBytesForAlg(alg);
+    var maxEncodedParamLength = paramBytes + 1;
+    var inputLength = signature.length;
+    var offset = 0;
+    if (signature[offset++] !== ENCODED_TAG_SEQ) {
+      throw new Error('Could not find expected "seq"');
     }
-    if (typeof key === "string") {
-      return key;
+    var seqLength = signature[offset++];
+    if (seqLength === (MAX_OCTET | 1)) {
+      seqLength = signature[offset++];
     }
-    if (!supportsKeyObjects) {
-      throw typeError(MSG_INVALID_SECRET);
+    if (inputLength - offset < seqLength) {
+      throw new Error('"seq" specified length of "' + seqLength + '", only "' + (inputLength - offset) + '" remaining');
     }
-    if (typeof key !== "object") {
-      throw typeError(MSG_INVALID_SECRET);
+    if (signature[offset++] !== ENCODED_TAG_INT) {
+      throw new Error('Could not find expected "int" for "r"');
     }
-    if (key.type !== "secret") {
-      throw typeError(MSG_INVALID_SECRET);
+    var rLength = signature[offset++];
+    if (inputLength - offset - 2 < rLength) {
+      throw new Error('"r" specified length of "' + rLength + '", only "' + (inputLength - offset - 2) + '" available');
     }
-    if (typeof key.export !== "function") {
-      throw typeError(MSG_INVALID_SECRET);
+    if (maxEncodedParamLength < rLength) {
+      throw new Error('"r" specified length of "' + rLength + '", max of "' + maxEncodedParamLength + '" is acceptable');
     }
-  }
-  function fromBase64(base64) {
-    return base64.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-  }
-  function toBase64(base64url) {
-    base64url = base64url.toString();
-    var padding = 4 - base64url.length % 4;
-    if (padding !== 4) {
-      for (var i = 0;i < padding; ++i) {
-        base64url += "=";
-      }
+    var rOffset = offset;
+    offset += rLength;
+    if (signature[offset++] !== ENCODED_TAG_INT) {
+      throw new Error('Could not find expected "int" for "s"');
     }
-    return base64url.replace(/\-/g, "+").replace(/_/g, "/");
-  }
-  function typeError(template) {
-    var args = [].slice.call(arguments, 1);
-    var errMsg = util.format.bind(util, template).apply(null, args);
-    return new TypeError(errMsg);
-  }
-  function bufferOrString(obj) {
-    return Buffer2.isBuffer(obj) || typeof obj === "string";
-  }
-  function normalizeInput(thing) {
-    if (!bufferOrString(thing))
-      thing = JSON.stringify(thing);
-    return thing;
-  }
-  function createHmacSigner(bits) {
-    return function sign(thing, secret) {
-      checkIsSecretKey(secret);
-      thing = normalizeInput(thing);
-      var hmac = crypto2.createHmac("sha" + bits, secret);
-      var sig = (hmac.update(thing), hmac.digest("base64"));
-      return fromBase64(sig);
-    };
-  }
-  var bufferEqual;
-  var timingSafeEqual = "timingSafeEqual" in crypto2 ? function timingSafeEqual2(a2, b2) {
-    if (a2.byteLength !== b2.byteLength) {
-      return false;
+    var sLength = signature[offset++];
+    if (inputLength - offset !== sLength) {
+      throw new Error('"s" specified length of "' + sLength + '", expected "' + (inputLength - offset) + '"');
     }
-    return crypto2.timingSafeEqual(a2, b2);
-  } : function timingSafeEqual2(a2, b2) {
-    if (!bufferEqual) {
-      bufferEqual = require_buffer_equal_constant_time();
+    if (maxEncodedParamLength < sLength) {
+      throw new Error('"s" specified length of "' + sLength + '", max of "' + maxEncodedParamLength + '" is acceptable');
     }
-    return bufferEqual(a2, b2);
-  };
-  function createHmacVerifier(bits) {
-    return function verify(thing, signature, secret) {
+    var sOffset = offset;
+    offset += sLength;
+    if (offset !== inputLength) {
+      throw new Error('Expected to consume entire buffer, but "' + (inputLength - offset) + '" bytes remain');
+    }
+    var rPadding = paramBytes - rLength, sPadding = paramBytes - sLength;
+    var dst = Buffer2.allocUnsafe(rPadding + rLength + sPadding + sLength);
+    for (offset = 0;offset < rPadding; ++offset) {
+      dst[offset] = 0;
+    }
+    signature.copy(dst, offset, rOffset + Math.max(-rPadding, 0), rOffset + rLength);
+    offset = paramBytes;
+    for (var o = offset;offset < o + sPadding; ++offset) {
+      dst[offset] = 0;
+    }
+    signature.copy(dst, offset, sOffset + Math.max(-sPadding, 0), sOffset + sLength);
+    dst = dst.toString("base64");
+    dst = base64Url(dst);
+    return dst;
+  }
+  function countPadding(buf, start, stop) {
+    var padding = 0;
+    while (start + padding < stop && buf[start + padding] === 0) {
+      ++padding;
+    }
+    var needsSign = buf[start + padding] >= MAX_OCTET;
+    if (needsSign) {
+      --padding;
+    }
+    return padding;
+  }
+  function joseToDer(signature, alg) {
+    signature = signatureAsBuffer(signature);
+    var paramBytes = getParamBytesForAlg(alg);
+    var signatureBytes = signature.length;
+    if (signatureBytes !== paramBytes * 2) {
+      throw new TypeError('"' + alg + '" signatures must be "' + paramBytes * 2 + '" bytes, saw "' + signatureBytes + '"');
+    }
+    var rPadding = countPadding(signature, 0, paramBytes);
+    var sPadding = countPadding(signature, paramBytes, signature.length);
+    var rLength = paramBytes - rPadding;
+    var sLength = paramBytes - sPadding;
+    var rsBytes = 1 + 1 + rLength + 1 + 1 + sLength;
+    var shortLength = rsBytes < MAX_OCTET;
+    var dst = Buffer2.allocUnsafe((shortLength ? 2 : 3) + rsBytes);
+    var offset = 0;
+    dst[offset++] = ENCODED_TAG_SEQ;
+    if (shortLength) {
+      dst[offset++] = rsBytes;
+    } else {
+      dst[offset++] = MAX_OCTET | 1;
+      dst[offset++] = rsBytes & 255;
+    }
+    dst[offset++] = ENCODED_TAG_INT;
+    dst[offset++] = rLength;
+    if (rPadding < 0) {
+      dst[offset++] = 0;
+      offset += signature.copy(dst, offset, 0, paramBytes);
+    } else {
+      offset += signature.copy(dst, offset, rPadding, paramBytes);
+    }
+    dst[offset++] = ENCODED_TAG_INT;
+    dst[offset++] = sLength;
+    if (sPadding < 0) {
+      dst[offset++] = 0;
+      signature.copy(dst, offset, paramBytes);
+    } else {
+      signature.copy(dst, offset, paramBytes + sPadding);
+    }
+    return dst;
+  }
+  module.exports = {
+    derToJose,
+    joseToDer
+  };
+});
+
+// ../../node_modules/.bun/buffer-equal-constant-time@1.0.1/node_modules/buffer-equal-constant-time/index.js
+var require_buffer_equal_constant_time = __commonJS((exports, module) => {
+  var Buffer2 = __require("buffer").Buffer;
+  var SlowBuffer = __require("buffer").SlowBuffer;
+  module.exports = bufferEq;
+  function bufferEq(a2, b2) {
+    if (!Buffer2.isBuffer(a2) || !Buffer2.isBuffer(b2)) {
+      return false;
+    }
+    if (a2.length !== b2.length) {
+      return false;
+    }
+    var c2 = 0;
+    for (var i = 0;i < a2.length; i++) {
+      c2 |= a2[i] ^ b2[i];
+    }
+    return c2 === 0;
+  }
+  bufferEq.install = function() {
+    Buffer2.prototype.equal = SlowBuffer.prototype.equal = function equal(that) {
+      return bufferEq(this, that);
+    };
+  };
+  var origBufEqual = Buffer2.prototype.equal;
+  var origSlowBufEqual = SlowBuffer.prototype.equal;
+  bufferEq.restore = function() {
+    Buffer2.prototype.equal = origBufEqual;
+    SlowBuffer.prototype.equal = origSlowBufEqual;
+  };
+});
+
+// ../../node_modules/.bun/jwa@2.0.1/node_modules/jwa/index.js
+var require_jwa = __commonJS((exports, module) => {
+  var Buffer2 = require_safe_buffer().Buffer;
+  var crypto2 = __require("crypto");
+  var formatEcdsa = require_ecdsa_sig_formatter();
+  var util = __require("util");
+  var MSG_INVALID_ALGORITHM = `"%s" is not a valid algorithm.
+  Supported algorithms are:
+  "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`;
+  var MSG_INVALID_SECRET = "secret must be a string or buffer";
+  var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
+  var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
+  var supportsKeyObjects = typeof crypto2.createPublicKey === "function";
+  if (supportsKeyObjects) {
+    MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
+    MSG_INVALID_SECRET += "or a KeyObject";
+  }
+  function checkIsPublicKey(key) {
+    if (Buffer2.isBuffer(key)) {
+      return;
+    }
+    if (typeof key === "string") {
+      return;
+    }
+    if (!supportsKeyObjects) {
+      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    }
+    if (typeof key !== "object") {
+      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    }
+    if (typeof key.type !== "string") {
+      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    }
+    if (typeof key.asymmetricKeyType !== "string") {
+      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    }
+    if (typeof key.export !== "function") {
+      throw typeError(MSG_INVALID_VERIFIER_KEY);
+    }
+  }
+  function checkIsPrivateKey(key) {
+    if (Buffer2.isBuffer(key)) {
+      return;
+    }
+    if (typeof key === "string") {
+      return;
+    }
+    if (typeof key === "object") {
+      return;
+    }
+    throw typeError(MSG_INVALID_SIGNER_KEY);
+  }
+  function checkIsSecretKey(key) {
+    if (Buffer2.isBuffer(key)) {
+      return;
+    }
+    if (typeof key === "string") {
+      return key;
+    }
+    if (!supportsKeyObjects) {
+      throw typeError(MSG_INVALID_SECRET);
+    }
+    if (typeof key !== "object") {
+      throw typeError(MSG_INVALID_SECRET);
+    }
+    if (key.type !== "secret") {
+      throw typeError(MSG_INVALID_SECRET);
+    }
+    if (typeof key.export !== "function") {
+      throw typeError(MSG_INVALID_SECRET);
+    }
+  }
+  function fromBase64(base64) {
+    return base64.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  }
+  function toBase64(base64url) {
+    base64url = base64url.toString();
+    var padding = 4 - base64url.length % 4;
+    if (padding !== 4) {
+      for (var i = 0;i < padding; ++i) {
+        base64url += "=";
+      }
+    }
+    return base64url.replace(/\-/g, "+").replace(/_/g, "/");
+  }
+  function typeError(template) {
+    var args = [].slice.call(arguments, 1);
+    var errMsg = util.format.bind(util, template).apply(null, args);
+    return new TypeError(errMsg);
+  }
+  function bufferOrString(obj) {
+    return Buffer2.isBuffer(obj) || typeof obj === "string";
+  }
+  function normalizeInput(thing) {
+    if (!bufferOrString(thing))
+      thing = JSON.stringify(thing);
+    return thing;
+  }
+  function createHmacSigner(bits) {
+    return function sign(thing, secret) {
+      checkIsSecretKey(secret);
+      thing = normalizeInput(thing);
+      var hmac = crypto2.createHmac("sha" + bits, secret);
+      var sig = (hmac.update(thing), hmac.digest("base64"));
+      return fromBase64(sig);
+    };
+  }
+  var bufferEqual;
+  var timingSafeEqual = "timingSafeEqual" in crypto2 ? function timingSafeEqual2(a2, b2) {
+    if (a2.byteLength !== b2.byteLength) {
+      return false;
+    }
+    return crypto2.timingSafeEqual(a2, b2);
+  } : function timingSafeEqual2(a2, b2) {
+    if (!bufferEqual) {
+      bufferEqual = require_buffer_equal_constant_time();
+    }
+    return bufferEqual(a2, b2);
+  };
+  function createHmacVerifier(bits) {
+    return function verify(thing, signature, secret) {
       var computedSig = createHmacSigner(bits)(thing, secret);
       return timingSafeEqual(Buffer2.from(signature), Buffer2.from(computedSig));
     };
@@ -9744,9 +10023,9 @@ var require_verify_stream = __commonJS((exports, module) => {
   }
   function jwsVerify(jwsSig, algorithm, secretOrKey) {
     if (!algorithm) {
-      var err2 = new Error("Missing algorithm parameter for jws.verify");
-      err2.code = "MISSING_ALGORITHM";
-      throw err2;
+      var err3 = new Error("Missing algorithm parameter for jws.verify");
+      err3.code = "MISSING_ALGORITHM";
+      throw err3;
     }
     jwsSig = toString(jwsSig);
     var signature = signatureFromJWS(jwsSig);
@@ -11934,9 +12213,9 @@ var require_verify = __commonJS((exports, module) => {
     if (callback) {
       done = callback;
     } else {
-      done = function(err2, data) {
-        if (err2)
-          throw err2;
+      done = function(err3, data) {
+        if (err3)
+          throw err3;
         return data;
       };
     }
@@ -11963,8 +12242,8 @@ var require_verify = __commonJS((exports, module) => {
     let decodedToken;
     try {
       decodedToken = decode(jwtString, { complete: true });
-    } catch (err2) {
-      return done(err2);
+    } catch (err3) {
+      return done(err3);
     }
     if (!decodedToken) {
       return done(new JsonWebTokenError("invalid token"));
@@ -11981,9 +12260,9 @@ var require_verify = __commonJS((exports, module) => {
         return secretCallback(null, secretOrPublicKey);
       };
     }
-    return getSecret(header, function(err2, secretOrPublicKey2) {
-      if (err2) {
-        return done(new JsonWebTokenError("error in secret or public key callback: " + err2.message));
+    return getSecret(header, function(err3, secretOrPublicKey2) {
+      if (err3) {
+        return done(new JsonWebTokenError("error in secret or public key callback: " + err3.message));
       }
       const hasSignature = parts[2].trim() !== "";
       if (!hasSignature && secretOrPublicKey2) {
@@ -12619,11 +12898,11 @@ var require_sign = __commonJS((exports, module) => {
       typ: isObjectPayload ? "JWT" : undefined,
       kid: options.keyid
     }, options.header);
-    function failure(err2) {
+    function failure(err3) {
       if (callback) {
-        return callback(err2);
+        return callback(err3);
       }
-      throw err2;
+      throw err3;
     }
     if (!secretOrPrivateKey && options.algorithm !== "none") {
       return failure(new Error("secretOrPrivateKey must have a value"));
@@ -12695,8 +12974,8 @@ var require_sign = __commonJS((exports, module) => {
     if (typeof options.notBefore !== "undefined") {
       try {
         payload.nbf = timespan(options.notBefore, timestamp2);
-      } catch (err2) {
-        return failure(err2);
+      } catch (err3) {
+        return failure(err3);
       }
       if (typeof payload.nbf === "undefined") {
         return failure(new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));
@@ -12705,8 +12984,8 @@ var require_sign = __commonJS((exports, module) => {
     if (typeof options.expiresIn !== "undefined" && typeof payload === "object") {
       try {
         payload.exp = timespan(options.expiresIn, timestamp2);
-      } catch (err2) {
-        return failure(err2);
+      } catch (err3) {
+        return failure(err3);
       }
       if (typeof payload.exp === "undefined") {
         return failure(new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));
@@ -13764,8 +14043,8 @@ class EventWire {
         try {
           const message = JSON.parse(event.data);
           this.handleMessage(message);
-        } catch (err2) {
-          console.error("EventWire: Failed to parse message", err2);
+        } catch (err3) {
+          console.error("EventWire: Failed to parse message", err3);
         }
       };
       this.ws.onclose = (event) => {
@@ -13774,17 +14053,17 @@ class EventWire {
         console.log("EventWire disconnected");
         this.scheduleReconnect();
       };
-      this.ws.onerror = (err2) => {
-        console.error("EventWire error:", err2);
+      this.ws.onerror = (err3) => {
+        console.error("EventWire error:", err3);
         if (this.state === "connecting") {
           this.state = "disconnected";
           this.ws = null;
         }
       };
-    } catch (err2) {
+    } catch (err3) {
       this.state = "disconnected";
       this.ws = null;
-      console.error("EventWire: Failed to connect", err2);
+      console.error("EventWire: Failed to connect", err3);
       this.scheduleReconnect();
     }
   }
@@ -26312,325 +26591,56 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
               rebuildsInProgress.delete(key);
             }
           })();
-          rebuildsInProgress.set(key, rebuildPromise);
-          await rebuildPromise;
-        }
-      });
-      devContexts.push({
-        configPath,
-        config,
-        configDir,
-        contexts,
-        watchers: [watcher]
-      });
-      console.log("");
-      log(`Watching for changes in ${configDir}...`, "cyan");
-    }
-    console.log("");
-    log("Development mode started. Press Ctrl+C to stop.", "green");
-    process.on("SIGINT", () => {
-      console.log("");
-      log("Shutting down dev mode...", "yellow");
-      for (const devCtx of devContexts) {
-        for (const watcher of devCtx.watchers) {
-          watcher.close();
-        }
-      }
-      process.exit(0);
-    });
-  } catch (err) {
-    console.error("Error in dev command:", err);
-    process.exit(1);
-  }
-}
-
-// src/platform/shared.ts
-import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync10, readdirSync as readdirSync5, rmSync as rmSync2, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname7, join as join11 } from "path";
-
-// src/builder/module-builder.ts
-import { execSync } from "child_process";
-import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync7,
-  readdirSync as readdirSync4,
-  rmSync,
-  writeFileSync as writeFileSync6
-} from "fs";
-import { basename as basename2, dirname as dirname5, join as join8, relative as relative3 } from "path";
-
-// src/i18n/index.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-
-// src/i18n/catalog.ts
-function hashMsgid(msgid) {
-  const hasher = new Bun.CryptoHasher("md5");
-  hasher.update(msgid);
-  return hasher.digest("hex").slice(0, 8);
-}
-function parsePo(content) {
-  const entries = [];
-  const lines = content.split(`
-`);
-  let locations = [];
-  let hash = "";
-  let msgid = "";
-  let msgstr = "";
-  let obsolete = false;
-  let inManual = false;
-  const flush = () => {
-    if (msgid) {
-      entries.push({
-        msgid,
-        msgstr,
-        locations,
-        hash: hash || hashMsgid(msgid),
-        obsolete,
-        ...inManual ? { manual: true } : {}
-      });
-    }
-    locations = [];
-    hash = "";
-    msgid = "";
-    msgstr = "";
-    obsolete = false;
-  };
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed === "# manual") {
-      inManual = true;
-      continue;
-    }
-    if (trimmed === "# end manual") {
-      if (msgid)
-        flush();
-      inManual = false;
-      continue;
-    }
-    if (trimmed === "" || trimmed.startsWith("#,")) {
-      if (msgid)
-        flush();
-      continue;
-    }
-    if (trimmed.startsWith("#:")) {
-      if (msgid)
-        flush();
-      locations.push(trimmed.slice(3).trim());
-      continue;
-    }
-    if (trimmed.startsWith("#.")) {
-      const hashMatch = trimmed.match(/hash:(\w+)/);
-      if (hashMatch)
-        hash = hashMatch[1];
-      continue;
-    }
-    if (trimmed.startsWith("#~")) {
-      const rest = trimmed.slice(3).trim();
-      if (rest.startsWith("msgid")) {
-        if (msgid)
-          flush();
-        obsolete = true;
-        msgid = extractQuoted(rest.slice(5));
-      } else if (rest.startsWith("msgstr")) {
-        msgstr = extractQuoted(rest.slice(6));
-      }
-      continue;
-    }
-    if (trimmed.startsWith("msgid")) {
-      if (msgid)
-        flush();
-      msgid = extractQuoted(trimmed.slice(5));
-    } else if (trimmed.startsWith("msgstr")) {
-      msgstr = extractQuoted(trimmed.slice(6));
-    }
-  }
-  flush();
-  return entries;
-}
-function writePo(entries) {
-  const lines = [];
-  const manual = entries.filter((e) => e.manual);
-  const active = entries.filter((e) => !e.obsolete && !e.manual);
-  const obsolete = entries.filter((e) => e.obsolete);
-  if (manual.length > 0) {
-    lines.push("# manual");
-    for (const entry of manual) {
-      lines.push(`msgid ${quoteString(entry.msgid)}`);
-      lines.push(`msgstr ${quoteString(entry.msgstr)}`);
-      lines.push("");
-    }
-    lines.push("# end manual");
-    lines.push("");
-  }
-  for (const entry of active) {
-    for (const loc of entry.locations) {
-      lines.push(`#: ${loc}`);
-    }
-    lines.push(`#. hash:${entry.hash}`);
-    lines.push(`msgid ${quoteString(entry.msgid)}`);
-    lines.push(`msgstr ${quoteString(entry.msgstr)}`);
-    lines.push("");
-  }
-  if (obsolete.length > 0) {
-    lines.push("# Obsolete entries");
-    lines.push("");
-    for (const entry of obsolete) {
-      lines.push(`#~ msgid ${quoteString(entry.msgid)}`);
-      lines.push(`#~ msgstr ${quoteString(entry.msgstr)}`);
-      lines.push("");
-    }
-  }
-  return lines.join(`
-`);
-}
-function mergeCatalog(existing, extracted) {
-  const existingMap = new Map;
-  for (const entry of existing) {
-    existingMap.set(entry.msgid, entry);
-  }
-  const manualEntries = existing.filter((e) => e.manual);
-  const manualIds = new Set(manualEntries.map((e) => e.msgid));
-  const result = [];
-  const seen = new Set;
-  for (const [msgid, locations] of extracted) {
-    seen.add(msgid);
-    if (manualIds.has(msgid))
-      continue;
-    const prev = existingMap.get(msgid);
-    result.push({
-      msgid,
-      msgstr: prev?.msgstr ?? "",
-      locations: [...locations].sort(),
-      hash: hashMsgid(msgid),
-      obsolete: false
-    });
-  }
-  for (const entry of existing) {
-    if (!seen.has(entry.msgid) && !entry.obsolete && !entry.manual && entry.msgstr) {
-      result.push({
-        ...entry,
-        obsolete: true,
-        locations: []
-      });
-    }
-  }
-  result.sort((a, b) => a.msgid.localeCompare(b.msgid));
-  return [...manualEntries, ...result];
-}
-function extractQuoted(s) {
-  const trimmed = s.trim();
-  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
-    return trimmed.slice(1, -1).replace(/\\n/g, `
-`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-  }
-  return trimmed;
-}
-function quoteString(s) {
-  const escaped = s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
-  return `"${escaped}"`;
-}
-
-// src/i18n/compile.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
-function compileCatalog(poPath) {
-  const content = readFileSync3(poPath, "utf-8");
-  const entries = parsePo(content);
-  const result = {};
-  for (const entry of entries) {
-    if (!entry.obsolete && entry.msgstr) {
-      result[entry.msgid] = entry.msgstr;
-    }
-  }
-  const sorted = {};
-  for (const key of Object.keys(result).sort()) {
-    sorted[key] = result[key];
-  }
-  return sorted;
-}
-function compileAllCatalogs(localesDir, outDir) {
-  mkdirSync3(outDir, { recursive: true });
-  for (const file of readdirSync2(localesDir)) {
-    if (!file.endsWith(".po"))
-      continue;
-    const locale = file.replace(".po", "");
-    const compiled = compileCatalog(join4(localesDir, file));
-    writeFileSync3(join4(outDir, `${locale}.json`), JSON.stringify(compiled));
-  }
-}
-
-// src/i18n/plugin.ts
-function i18nExtractPlugin(collector, rootDir) {
-  return {
-    name: "arc-i18n-extract",
-    setup(build2) {
-      build2.onLoad({ filter: /\.tsx?$/ }, async (args) => {
-        const source = await Bun.file(args.path).text();
-        const relPath = args.path.startsWith(rootDir) ? args.path.slice(rootDir.length + 1) : args.path;
-        const transRegex = /<Trans>\s*([^<{]+?)\s*<\/Trans>/g;
-        for (const match2 of source.matchAll(transRegex)) {
-          const msgid = match2[1].trim();
-          if (!msgid)
-            continue;
-          const line = source.substring(0, match2.index).split(`
-`).length;
-          const loc = `${relPath}:${line}`;
-          if (!collector.has(msgid))
-            collector.set(msgid, new Set);
-          collector.get(msgid).add(loc);
-        }
-        const tRegex = /\bt`([^`]+)`/g;
-        for (const match2 of source.matchAll(tRegex)) {
-          const msgid = match2[1];
-          if (!msgid)
-            continue;
-          const line = source.substring(0, match2.index).split(`
-`).length;
-          const loc = `${relPath}:${line}`;
-          if (!collector.has(msgid))
-            collector.set(msgid, new Set);
-          collector.get(msgid).add(loc);
-        }
-        return;
-      });
-    }
-  };
-}
-
-// src/i18n/index.ts
-function readTranslationsConfig(rootDir) {
-  const pkgPath = join5(rootDir, "package.json");
-  if (!existsSync4(pkgPath))
-    return null;
-  const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
-  const config = pkg.arc?.translations;
-  if (!config?.locales?.length)
-    return null;
-  return {
-    locales: config.locales,
-    sourceLocale: config.sourceLocale ?? config.locales[0]
-  };
-}
-async function finalizeTranslations(rootDir, outDir, collector) {
-  const config = readTranslationsConfig(rootDir);
-  if (!config || collector.size === 0)
-    return;
-  const localesJsonDir = join5(outDir, "locales");
-  mkdirSync4(localesJsonDir, { recursive: true });
-  console.log(`  Extracted ${collector.size} translatable string(s) for ${config.locales.length} locale(s)`);
-  for (const locale of config.locales) {
-    const poPath = join5(rootDir, "locales", `${locale}.po`);
-    mkdirSync4(dirname4(poPath), { recursive: true });
-    const existing = existsSync4(poPath) ? parsePo(readFileSync4(poPath, "utf-8")) : [];
-    const merged = mergeCatalog(existing, collector);
-    writeFileSync4(poPath, writePo(merged));
-    const compiled = compileCatalog(poPath);
-    writeFileSync4(join5(localesJsonDir, `${locale}.json`), JSON.stringify(compiled));
+          rebuildsInProgress.set(key, rebuildPromise);
+          await rebuildPromise;
+        }
+      });
+      devContexts.push({
+        configPath,
+        config,
+        configDir,
+        contexts,
+        watchers: [watcher]
+      });
+      console.log("");
+      log(`Watching for changes in ${configDir}...`, "cyan");
+    }
+    console.log("");
+    log("Development mode started. Press Ctrl+C to stop.", "green");
+    process.on("SIGINT", () => {
+      console.log("");
+      log("Shutting down dev mode...", "yellow");
+      for (const devCtx of devContexts) {
+        for (const watcher of devCtx.watchers) {
+          watcher.close();
+        }
+      }
+      process.exit(0);
+    });
+  } catch (err) {
+    console.error("Error in dev command:", err);
+    process.exit(1);
   }
 }
 
+// src/platform/shared.ts
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname6, join as join11 } from "path";
+
+// src/builder/module-builder.ts
+import { execSync } from "child_process";
+import {
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync7,
+  readdirSync as readdirSync4,
+  rmSync,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { basename as basename2, dirname as dirname5, join as join8, relative as relative3 } from "path";
+init_i18n();
+init_compile();
+
 // src/builder/build-cache.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
 import { join as join6 } from "path";
@@ -26799,6 +26809,24 @@ async function pAll(tasks, concurrency = DEFAULT_CONCURRENCY) {
 }
 
 // src/builder/module-builder.ts
+function singleReactPlugin(rootDir) {
+  const reactPkgs = ["react", "react-dom", "react-dom/client", "react/jsx-runtime"];
+  return {
+    name: "single-react",
+    setup(build2) {
+      const resolved = new Map;
+      for (const spec of reactPkgs) {
+        try {
+          resolved.set(spec, Bun.resolveSync(spec, rootDir));
+        } catch {}
+      }
+      build2.onResolve({ filter: /^(react|react-dom|react-dom\/client|react\/jsx-runtime)$/ }, (args) => {
+        const path4 = resolved.get(args.path);
+        return path4 ? { path: path4 } : null;
+      });
+    }
+  };
+}
 function jsxDevShimPlugin() {
   return {
     name: "jsx-dev-runtime-shim",
@@ -26914,8 +26942,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   console.log(`  building: ${pkg.name} (${client.name})`);
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
   const allDeps = pkg.packageJson.dependencies ?? {};
-  const npmDeps = Object.entries(allDeps).filter(([, spec]) => !spec.startsWith("workspace:")).map(([name]) => name);
-  const externals = [...peerDeps, ...npmDeps];
+  const externals = [...peerDeps, ...Object.keys(allDeps)];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
     outdir: join8(outDir, "main"),
@@ -26956,125 +26983,163 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
   }
   return { declarationErrors };
 }
-async function buildModulesByChunks(rootDir, outDir, plan, cache, noCache) {
+async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollector) {
   mkdirSync6(outDir, { recursive: true });
-  const i18nCollector = new Map;
-  const aggregateModules = [];
-  let allCached = true;
-  for (const chunk of plan.chunks) {
-    const members = plan.groups.get(chunk) ?? [];
-    if (members.length === 0)
-      continue;
-    const chunkOutDir = join8(outDir, chunk);
-    mkdirSync6(chunkOutDir, { recursive: true });
-    const result = await buildChunkGroup(rootDir, chunkOutDir, chunk, members, cache, noCache, i18nCollector);
-    aggregateModules.push(...result.modules);
-    if (!result.cached)
-      allCached = false;
-  }
-  await finalizeTranslations(rootDir, join8(outDir, ".."), i18nCollector);
-  return { modules: aggregateModules, cached: allCached };
-}
-async function buildChunkGroup(rootDir, chunkOutDir, chunk, members, cache, noCache, i18nCollector) {
-  const unitId = `modules-chunk:${chunk}`;
-  const pkgHashes = members.map((m) => ({
-    name: m.pkg.name,
-    safeName: m.safeName,
-    moduleName: m.moduleName,
-    srcHash: pkgSourceHash(m.pkg)
-  }));
+  const publicMembers = plan.groups.get("public") ?? [];
+  const protectedGroups = plan.chunks.filter((c) => c !== "public").map((c) => ({ name: c, members: plan.groups.get(c) ?? [] })).filter((g) => g.members.length > 0);
+  const unitId = "browser-app";
+  const allMembers = [];
+  for (const m of publicMembers) {
+    allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg) });
+  }
+  for (const g of protectedGroups) {
+    for (const m of g.members) {
+      allMembers.push({ name: m.pkg.name, group: g.name, srcHash: pkgSourceHash(m.pkg) });
+    }
+  }
   const inputHash = sha256OfJson({
-    chunk,
-    pkgHashes,
-    externals: SHELL_EXTERNALS,
+    members: allMembers,
+    groups: [
+      "initial",
+      ...protectedGroups.map((g) => g.name).sort()
+    ],
     define: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" }
   });
   if (!noCache && isCacheHit(cache, unitId, inputHash)) {
-    const existing = cache.units[unitId]?.outputHashes ?? {};
-    const modules2 = [];
-    let missing = false;
-    for (const h of pkgHashes) {
-      const file = `${h.safeName}.js`;
-      const filePath = join8(chunkOutDir, file);
-      if (!existsSync7(filePath)) {
-        missing = true;
-        break;
-      }
-      modules2.push({
-        file,
-        name: h.moduleName,
-        chunk,
-        hash: existing[h.safeName] ?? sha256Hex(readFileSync7(filePath))
-      });
+    const cached = cache.units[unitId]?.outputHashes;
+    if (cached?._manifest) {
+      try {
+        const m = JSON.parse(cached._manifest);
+        const allFiles = [
+          m.initial.file,
+          ...Object.values(m.groups).map((g) => g.file),
+          ...m.sharedChunks
+        ];
+        if (allFiles.every((f) => existsSync7(join8(outDir, f)))) {
+          console.log(`  \u2713 cached: ${unitId}`);
+          return { ...m, cached: true };
+        }
+      } catch {}
     }
-    if (!missing) {
-      console.log(`  \u2713 cached: ${unitId} (${modules2.length} module(s))`);
-      return { modules: modules2, cached: true };
+  }
+  console.log(`  building: ${unitId} (initial: ${publicMembers.length} modules, groups: ${protectedGroups.map((g) => `${g.name}=${g.members.length}`).join(",") || "none"})`);
+  if (existsSync7(outDir)) {
+    for (const f of readdirSync4(outDir)) {
+      if (f.endsWith(".js"))
+        rmSync(join8(outDir, f), { force: true });
     }
-    console.log(`  rebuilding ${unitId}: output file missing`);
   }
-  console.log(`  building: ${unitId} (${members.length} module(s))`);
-  const tmpDir = join8(chunkOutDir, "_entries");
+  const tmpDir = join8(outDir, "_entries");
   mkdirSync6(tmpDir, { recursive: true });
-  const entrypoints = [];
-  const fileToModuleName = new Map;
-  for (const m of members) {
-    fileToModuleName.set(m.safeName, m.moduleName);
-    const wrapperFile = join8(tmpDir, `${m.safeName}.ts`);
-    writeFileSync6(wrapperFile, `export * from "${m.pkg.name}";
+  const importLines = (pkgs) => pkgs.map((m) => `import "${m.pkg.name}";`).join(`
+`);
+  const initialEntry = join8(tmpDir, "initial.ts");
+  writeFileSync6(initialEntry, `${importLines(publicMembers)}
+export { startApp } from "@arcote.tech/platform";
+`);
+  const entryPaths = [initialEntry];
+  const groupModuleMap = new Map;
+  for (const g of protectedGroups) {
+    const entry = join8(tmpDir, `${g.name}.ts`);
+    writeFileSync6(entry, `${importLines(g.members)}
+`);
+    entryPaths.push(entry);
+    groupModuleMap.set(g.name, g.members.map((m) => m.moduleName));
+  }
+  const allMemberPkgs = new Map;
+  for (const m of publicMembers)
+    allMemberPkgs.set(m.pkg.name, m.pkg);
+  for (const g of protectedGroups)
+    for (const m of g.members)
+      allMemberPkgs.set(m.pkg.name, m.pkg);
+  const patchedPkgJsons = [];
+  for (const pkg of allMemberPkgs.values()) {
+    const pkgJsonPath = join8(pkg.path, "package.json");
+    if (!existsSync7(pkgJsonPath))
+      continue;
+    const original = readFileSync7(pkgJsonPath, "utf-8");
+    const parsed = JSON.parse(original);
+    if (parsed.sideEffects === true)
+      continue;
+    parsed.sideEffects = true;
+    writeFileSync6(pkgJsonPath, JSON.stringify(parsed, null, 2) + `
 `);
-    entrypoints.push(wrapperFile);
+    patchedPkgJsons.push({ path: pkgJsonPath, original });
   }
-  const arcExternalPlugin = {
-    name: "arc-external",
-    setup(build2) {
-      build2.onResolve({ filter: /^@arcote\.tech\// }, (args) => {
-        return { path: args.path, external: true };
-      });
-    }
-  };
-  const result = await Bun.build({
-    entrypoints,
-    outdir: chunkOutDir,
-    splitting: true,
-    format: "esm",
-    target: "browser",
-    external: [...SHELL_EXTERNALS],
-    plugins: [
-      arcExternalPlugin,
-      jsxDevShimPlugin(),
-      i18nExtractPlugin(i18nCollector, rootDir)
-    ],
-    naming: "[name].[ext]",
-    define: {
-      ONLY_SERVER: "false",
-      ONLY_BROWSER: "true",
-      ONLY_CLIENT: "true"
-    }
-  });
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: entryPaths,
+      outdir: outDir,
+      splitting: true,
+      format: "esm",
+      target: "browser",
+      external: [],
+      plugins: [
+        singleReactPlugin(rootDir),
+        jsxDevShimPlugin(),
+        i18nExtractPlugin(i18nCollector, rootDir)
+      ],
+      naming: "[name].[ext]",
+      define: {
+        ONLY_SERVER: "false",
+        ONLY_BROWSER: "true",
+        ONLY_CLIENT: "true",
+        "process.env.NODE_ENV": '"production"'
+      }
+    });
+  } finally {
+    for (const p of patchedPkgJsons)
+      writeFileSync6(p.path, p.original);
+  }
+  rmSync(tmpDir, { recursive: true, force: true });
   if (!result.success) {
-    console.error(`Chunk "${chunk}" build failed:`);
     for (const log2 of result.logs)
       console.error(log2);
-    throw new Error(`Module chunk build failed: ${chunk}`);
+    throw new Error("Browser app build failed");
+  }
+  let initialFile = "";
+  let initialHash = "";
+  const groups = {};
+  const sharedChunks = [];
+  for (const out of result.outputs) {
+    const name = basename2(out.path);
+    if (out.kind === "entry-point") {
+      const bytes = readFileSync7(out.path);
+      const hash = sha256Hex(bytes).slice(0, 16);
+      const stem = name.replace(/\.js$/, "");
+      const finalName = `${stem}.${hash}.js`;
+      const finalPath = join8(outDir, finalName);
+      rmSync(finalPath, { force: true });
+      writeFileSync6(finalPath, bytes);
+      rmSync(out.path, { force: true });
+      if (stem === "initial") {
+        initialFile = finalName;
+        initialHash = hash;
+      } else {
+        groups[stem] = {
+          file: finalName,
+          hash,
+          modules: groupModuleMap.get(stem) ?? []
+        };
+      }
+    } else if (out.kind === "chunk") {
+      sharedChunks.push(name);
+    }
   }
-  rmSync(tmpDir, { recursive: true, force: true });
-  const outputHashes = {};
-  const modules = result.outputs.filter((o) => o.kind === "entry-point").map((o) => {
-    const file = basename2(o.path);
-    const safeName = file.replace(/\.js$/, "");
-    const bytes = readFileSync7(o.path);
-    const hash = sha256Hex(bytes);
-    outputHashes[safeName] = hash;
-    return {
-      file,
-      name: fileToModuleName.get(safeName) ?? safeName,
-      chunk,
-      hash
-    };
+  if (!initialFile) {
+    throw new Error("Browser app build: initial entry not found in outputs");
+  }
+  const manifest = {
+    initial: { file: initialFile, hash: initialHash },
+    groups,
+    sharedChunks,
+    cached: false
+  };
+  updateCache(cache, unitId, inputHash, {
+    outputHashes: { _manifest: JSON.stringify(manifest) }
   });
-  updateCache(cache, unitId, inputHash, { outputHashes });
-  return { modules, cached: false };
+  return manifest;
 }
 async function buildTranslations(rootDir, arcDir, cache, noCache) {
   const localesDir = join8(rootDir, "locales");
@@ -27216,17 +27281,10 @@ import {
   existsSync as existsSync8,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync8,
-  realpathSync as realpathSync2,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
-function locatePlatformServerEntry() {
-  const here = fileURLToPath5(import.meta.url);
-  const arcRoot = realpathSync2(dirname6(dirname6(dirname6(dirname6(here)))));
-  return join9(arcRoot, "packages", "platform", "src", "index.server.ts");
-}
+import { join as join9 } from "path";
 async function extractAccessMap(rootDir, packages) {
   const serverBundles = packages.filter((p) => isContextPackage(p.packageJson)).map((p) => ({
     name: p.name,
@@ -27244,8 +27302,7 @@ async function extractAccessMap(rootDir, packages) {
       env: {
         ...process.env,
         ARC_ACCESS_BUNDLES: JSON.stringify(serverBundles),
-        ARC_ACCESS_OUT: outPath,
-        ARC_PLATFORM_ENTRY: locatePlatformServerEntry()
+        ARC_ACCESS_OUT: outPath
       },
       stdout: "pipe",
       stderr: "inherit"
@@ -27276,9 +27333,11 @@ if (!out) {
   process.exit(2);
 }
 
-// Direct file-path import \u2014 bypasses node_modules resolution entirely.
-// Avoids quirks with bun-link snapshots holding stale package.json exports.
-const platform = await import(process.env.ARC_PLATFORM_ENTRY);
+// Bare-specifier import \u2014 Bun walks up from this worker's location
+// (<rootDir>/.arc/.tmp/) to <rootDir>/node_modules and finds the package.
+// Single entry (./src/index.ts) \u2014 React imports on top level are benign
+// (createContext, function defs); no DOM access until actual render.
+const platform = await import("@arcote.tech/platform");
 
 for (const { name, path } of bundles) {
   try {
@@ -27436,7 +27495,7 @@ function resolveWorkspace() {
     err("No package.json found");
     process.exit(1);
   }
-  const rootDir = dirname7(packageJsonPath);
+  const rootDir = dirname6(packageJsonPath);
   const rootPkg = JSON.parse(readFileSync10(packageJsonPath, "utf-8"));
   const appName = rootPkg.name ?? "Arc App";
   const arcDir = join11(rootDir, ".arc", "platform");
@@ -27471,8 +27530,7 @@ function resolveWorkspace() {
     rootPkg,
     appName,
     arcDir,
-    modulesDir: join11(arcDir, "modules"),
-    shellDir: join11(arcDir, "shell"),
+    browserDir: join11(arcDir, "browser"),
     assetsDir: join11(arcDir, "assets"),
     publicDir: join11(rootDir, "public"),
     packages,
@@ -27492,32 +27550,27 @@ async function buildAll(ws, opts = {}) {
 `);
   const plan = planChunks(ws.packages, accessMap);
   ok(`Chunks: ${plan.chunks.map((c) => `${c}(${plan.groups.get(c)?.length ?? 0})`).join(", ")}`);
-  const [modulesResult] = await Promise.all([
-    buildModulesByChunks(ws.rootDir, ws.modulesDir, plan, cache, noCache),
-    buildShell(ws, cache, noCache),
+  const i18nCollector = new Map;
+  const [browserResult] = await Promise.all([
+    buildBrowserApp(ws.rootDir, ws.browserDir, plan, cache, noCache, i18nCollector),
     buildStyles(ws.rootDir, ws.arcDir, ws.packages, themePath, cache, noCache),
     copyBrowserAssets(ws, cache, noCache),
     buildTranslations(ws.rootDir, ws.arcDir, cache, noCache)
   ]);
+  const { finalizeTranslations: finalizeTranslations3 } = await Promise.resolve().then(() => (init_i18n(), exports_i18n));
+  await finalizeTranslations3(ws.rootDir, ws.arcDir, i18nCollector);
   collectFrameworkDeps(ws.arcDir, ws.rootDir, ws.packages);
   saveBuildCache(ws.arcDir, cache);
-  const finalManifest = assembleManifest(ws, modulesResult.modules, plan.chunks, cache);
-  writeFileSync9(join11(ws.modulesDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
+  const finalManifest = assembleManifest(ws, browserResult, cache);
+  writeFileSync9(join11(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
   return finalManifest;
 }
-function assembleManifest(ws, modules, chunks, cache) {
-  const shellEntries = {};
-  for (const [unitId, entry] of Object.entries(cache.units)) {
-    if (unitId.startsWith("shell:") && entry.outputHash) {
-      shellEntries[unitId] = entry.outputHash;
-    }
-  }
-  const shellHash = sha256OfJson(shellEntries);
+function assembleManifest(ws, browser, cache) {
   const stylesHash = cache.units["styles"]?.outputHash ?? "";
   return {
-    modules,
-    chunks,
-    shellHash,
+    initial: browser.initial,
+    groups: browser.groups,
+    sharedChunks: browser.sharedChunks,
     stylesHash,
     buildTime: new Date().toISOString()
   };
@@ -27619,170 +27672,12 @@ async function copyBrowserAssets(ws, cache, noCache) {
   const outputHashes = {};
   for (const asset of assets) {
     const dest = join11(ws.assetsDir, asset.to);
-    mkdirSync9(dirname7(dest), { recursive: true });
+    mkdirSync9(dirname6(dest), { recursive: true });
     copyFileSync(asset.src, dest);
     outputHashes[asset.to] = sha256Hex(readFileSync10(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
 }
-function collectArcPeerDeps(packages) {
-  const seen = new Set;
-  for (const pkg of ["@arcote.tech/arc", "@arcote.tech/arc-ds", "@arcote.tech/arc-react", "@arcote.tech/platform"]) {
-    seen.add(pkg);
-  }
-  for (const wp of packages) {
-    const peerDeps = wp.packageJson.peerDependencies ?? {};
-    for (const dep of Object.keys(peerDeps)) {
-      if (dep.startsWith("@arcote.tech/"))
-        seen.add(dep);
-    }
-  }
-  return [...seen].map((pkg) => {
-    const short = pkg === "@arcote.tech/platform" ? "platform" : pkg.replace("@arcote.tech/", "");
-    return [short, pkg];
-  });
-}
-var REACT_ENTRIES = [
-  [
-    "react",
-    `import React from "react";
-export default React;
-export const {
-  Children, Component, Fragment, Profiler, PureComponent, StrictMode, Suspense,
-  cloneElement, createContext, createElement, createRef, forwardRef, isValidElement,
-  lazy, memo, startTransition, use, useCallback, useContext, useDebugValue,
-  useDeferredValue, useEffect, useId, useImperativeHandle, useInsertionEffect,
-  useLayoutEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore,
-  useTransition, version, useActionState, useOptimistic,
-} = React;`
-  ],
-  ["jsx-runtime", `export { jsx, jsxs, Fragment } from "react/jsx-runtime";`],
-  [
-    "jsx-dev-runtime",
-    `export { jsxDEV, Fragment } from "react/jsx-dev-runtime";`
-  ],
-  [
-    "react-dom",
-    `import ReactDOM from "react-dom";
-export default ReactDOM;
-export const { createPortal, flushSync } = ReactDOM;`
-  ],
-  [
-    "react-dom-client",
-    `export { createRoot, hydrateRoot } from "react-dom/client";`
-  ]
-];
-var REACT_OUTPUT_FILES = REACT_ENTRIES.map(([n]) => `${n}.js`);
-var SHELL_BASE_EXTERNAL = [
-  "react",
-  "react-dom",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "react-dom/client"
-];
-var sourceFilter2 = (rel) => {
-  if (rel.startsWith("dist/") || rel.startsWith("dist"))
-    return false;
-  if (rel.includes("/node_modules/") || rel.startsWith("node_modules"))
-    return false;
-  if (rel.startsWith(".arc/") || rel.startsWith(".arc"))
-    return false;
-  return true;
-};
-function arcPkgSrcHash(rootDir, pkg) {
-  const srcDir = join11(rootDir, "node_modules", pkg, "src");
-  if (existsSync10(srcDir))
-    return sha256OfDir(srcDir, sourceFilter2);
-  return sha256OfDir(join11(rootDir, "node_modules", pkg), sourceFilter2);
-}
-async function buildShellReact(shellDir, tmpDir, rootDir, cache, noCache) {
-  const unitId = "shell:react";
-  const inputHash = sha256OfJson({
-    react: readInstalledVersion(rootDir, "react"),
-    "react-dom": readInstalledVersion(rootDir, "react-dom"),
-    entries: REACT_ENTRIES.map(([k, v]) => [k, v])
-  });
-  const requiredOutputs = REACT_OUTPUT_FILES.map((f) => join11(shellDir, f));
-  if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
-    console.log(`  \u2713 cached: shell:react`);
-    return;
-  }
-  console.log(`  building: shell:react`);
-  const reactEps = [];
-  for (const [name, code] of REACT_ENTRIES) {
-    const f = join11(tmpDir, `${name}.ts`);
-    await Bun.write(f, code);
-    reactEps.push(f);
-  }
-  const r = await Bun.build({
-    entrypoints: reactEps,
-    outdir: shellDir,
-    splitting: true,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]"
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error("Shell React build failed");
-  }
-  const outputHash = sha256OfFiles(requiredOutputs);
-  updateCache(cache, unitId, inputHash, { outputHash });
-}
-async function buildShellArcEntry(shortName, pkg, allArcPkgs, shellDir, tmpDir, rootDir, cache, noCache) {
-  const unitId = `shell:arc:${shortName}`;
-  const otherExternals = allArcPkgs.filter((p) => p !== pkg);
-  const inputHash = sha256OfJson({
-    pkg,
-    version: readInstalledVersion(rootDir, pkg),
-    src: arcPkgSrcHash(rootDir, pkg),
-    base: SHELL_BASE_EXTERNAL,
-    others: [...otherExternals].sort()
-  });
-  const outputFile = join11(shellDir, `${shortName}.js`);
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [outputFile])) {
-    console.log(`  \u2713 cached: ${unitId}`);
-    return;
-  }
-  console.log(`  building: ${unitId}`);
-  const f = join11(tmpDir, `${shortName}.ts`);
-  await Bun.write(f, `export * from "${pkg}";
-`);
-  const r = await Bun.build({
-    entrypoints: [f],
-    outdir: shellDir,
-    format: "esm",
-    target: "browser",
-    naming: "[name].[ext]",
-    external: [...SHELL_BASE_EXTERNAL, ...otherExternals],
-    define: {
-      ONLY_SERVER: "false",
-      ONLY_BROWSER: "true",
-      ONLY_CLIENT: "true"
-    }
-  });
-  if (!r.success) {
-    for (const l of r.logs)
-      console.error(l);
-    throw new Error(`Shell build failed for ${pkg}`);
-  }
-  const outputHash = sha256OfFiles([outputFile]);
-  updateCache(cache, unitId, inputHash, { outputHash });
-}
-async function buildShell(ws, cache, noCache) {
-  mkdirSync9(ws.shellDir, { recursive: true });
-  const tmpDir = join11(ws.shellDir, "_tmp");
-  mkdirSync9(tmpDir, { recursive: true });
-  const arcEntries = collectArcPeerDeps(ws.packages);
-  const allArcPkgs = arcEntries.map(([, pkg]) => pkg);
-  const tasks = [
-    () => buildShellReact(ws.shellDir, tmpDir, ws.rootDir, cache, noCache),
-    ...arcEntries.map(([short, pkg]) => () => buildShellArcEntry(short, pkg, allArcPkgs, ws.shellDir, tmpDir, ws.rootDir, cache, noCache))
-  ];
-  await pAll(tasks);
-  rmSync2(tmpDir, { recursive: true, force: true });
-}
 async function loadServerContext(ws) {
   globalThis.ONLY_SERVER = true;
   globalThis.ONLY_BROWSER = false;
@@ -27830,24 +27725,25 @@ async function loadServerContext(ws) {
 async function platformBuild(opts = {}) {
   const ws = resolveWorkspace();
   const manifest = await buildAll(ws, { noCache: opts.noCache });
-  ok(`Platform built \u2014 ${manifest.modules.length} module(s)`);
+  const groupCount = Object.keys(manifest.groups).length;
+  ok(`Platform built \u2014 initial + ${groupCount} group(s)`);
 }
 
 // src/commands/platform-deploy.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { dirname as dirname9, join as join17 } from "path";
-import { fileURLToPath as fileURLToPath7 } from "url";
+import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
+import { dirname as dirname8, join as join19 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/deploy/bootstrap.ts
 var {spawn: spawn4 } = globalThis.Bun;
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync13 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join15 } from "path";
+import { join as join17 } from "path";
 
 // src/deploy/ansible.ts
 import { spawn as nodeSpawn } from "child_process";
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { tmpdir } from "os";
+import { existsSync as existsSync11, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { homedir, tmpdir } from "os";
 import { join as join12 } from "path";
 
 // src/deploy/assets.ts
@@ -28042,7 +27938,22 @@ var ANSIBLE_SITE_YML = `---
         - { policy: deny, dir: incoming }
         - { policy: allow, dir: outgoing }
 
-    - name: Open firewall ports
+    - name: Remove legacy ufw limit rule on SSH (replaced by plain allow)
+      # If a prior bootstrap installed \`ufw limit 22/tcp\`, drop it \u2014 otherwise
+      # the limit rule shadows the allow rule and rate-throttles deploy flows.
+      ufw:
+        rule: limit
+        port: "{{ ssh_port }}"
+        proto: tcp
+        delete: true
+      ignore_errors: true
+
+    - name: Open firewall ports (SSH key-only auth, no brute-force surface)
+      # SSH on port 22: PasswordAuthentication=no + key-only means brute force
+      # is impossible without the operator's private key. Rate-limiting (ufw
+      # limit / fail2ban sshd jail) breaks legitimate deploy flows that open
+      # many short SSH connections in sequence (canSsh -> sshExec -> scp -> ...).
+      # 80/443: Caddy ACME + app traffic, never rate-limited.
       ufw:
         rule: allow
         port: "{{ item }}"
@@ -28056,17 +27967,18 @@ var ANSIBLE_SITE_YML = `---
       ufw:
         state: enabled
 
-    - name: Configure fail2ban for sshd
+    - name: Disable fail2ban sshd jail
+      # Key-only SSH + ufw rate-limit make fail2ban for sshd redundant and
+      # actively harmful when the operator's IP roams. Keep fail2ban installed
+      # for future jails (web/db) but turn off the sshd jail explicitly.
       copy:
         dest: /etc/fail2ban/jail.local
         content: |
           [sshd]
-          enabled = true
-          port = {{ ssh_port }}
-          maxretry = 5
-          findtime = 600
-          bantime = 3600
+          enabled = false
+          {% if extra_allowed_ips %}
           ignoreip = 127.0.0.1/8 ::1 {{ extra_allowed_ips | join(' ') }}
+          {% endif %}
         mode: "0644"
       notify: restart fail2ban
 
@@ -28114,18 +28026,32 @@ async function materializeAssets(targetDir, files) {
 }
 
 // src/deploy/ansible.ts
+function pickSshKeyForAnsible(configured) {
+  if (configured) {
+    const expanded = configured.startsWith("~") ? join12(homedir(), configured.slice(1)) : configured;
+    return existsSync11(expanded) ? expanded : null;
+  }
+  for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
+    const path4 = join12(homedir(), ".ssh", name);
+    if (existsSync11(path4))
+      return path4;
+  }
+  return null;
+}
 async function runAnsible(inputs) {
   const workDir = join12(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
   mkdirSync10(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.ansible);
   const user = inputs.asRoot ? "root" : inputs.target.user;
   const port = inputs.ansible?.sshPort ?? inputs.target.port;
+  const sshKey = pickSshKeyForAnsible(inputs.target.sshKey);
+  const sshKeyArg = sshKey ? ` -o IdentitiesOnly=yes -i ${sshKey}` : "";
   const inventory = [
     "[arc]",
     `${inputs.target.host} ansible_user=${user} ansible_port=${port}`,
     "",
     "[arc:vars]",
-    "ansible_ssh_common_args='-o StrictHostKeyChecking=accept-new -o BatchMode=yes'",
+    `ansible_ssh_common_args='-o StrictHostKeyChecking=accept-new -o BatchMode=yes -o PreferredAuthentications=publickey${sshKeyArg}'`,
     "ansible_python_interpreter=/usr/bin/python3",
     ""
   ].join(`
@@ -28224,7 +28150,7 @@ function generateCompose({ cfg }) {
   for (const [name, env2] of Object.entries(cfg.envs)) {
     const upperName = name.toUpperCase().replace(/-/g, "_");
     lines.push(`  arc-${name}:`);
-    lines.push(`    image: \${ARC_IMAGE_${upperName}:?Run \\\`arc platform deploy ${name}\\\` to publish an image first}`);
+    lines.push(`    image: \${ARC_IMAGE_${upperName}:-arc-${name}:not-deployed}`);
     lines.push(`    container_name: arc-${name}`);
     lines.push("    restart: unless-stopped");
     lines.push("    volumes:");
@@ -28278,16 +28204,16 @@ async function generateHtpasswd(user, password) {
 // src/deploy/terraform.ts
 import { spawn as nodeSpawn2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-import { homedir } from "os";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { homedir as homedir2 } from "os";
 import { join as join13 } from "path";
 async function runTerraform(inputs) {
   const wsHash = createHash2("sha256").update(inputs.workspaceDir).digest("hex").slice(0, 16);
-  const workDir = join13(homedir(), ".arc-deploy", wsHash, "tf");
+  const workDir = join13(homedir2(), ".arc-deploy", wsHash, "tf");
   mkdirSync11(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.terraform);
   const sshPubKey = inputs.tf.sshPublicKey ?? expandHome("~/.ssh/id_ed25519.pub");
-  if (!existsSync11(expandHome(sshPubKey))) {
+  if (!existsSync12(expandHome(sshPubKey))) {
     throw new Error(`SSH public key not found at ${sshPubKey}. Set provision.terraform.sshPublicKey in deploy.arc.json.`);
   }
   const tfvars = [
@@ -28358,33 +28284,93 @@ function expandHome(p) {
 }
 
 // src/deploy/config.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
+import { join as join15 } from "path";
+
+// src/deploy/env-file.ts
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
 import { join as join14 } from "path";
+function loadDeployEnvFiles(rootDir, envNames) {
+  const globalsPath = join14(rootDir, "deploy.arc.env");
+  const globals = existsSync13(globalsPath) ? parseEnvFile(readFileSync11(globalsPath, "utf-8"), globalsPath) : {};
+  const perEnv = {};
+  for (const name of envNames) {
+    const envPath = join14(rootDir, `deploy.arc.${name}.env`);
+    if (existsSync13(envPath)) {
+      perEnv[name] = parseEnvFile(readFileSync11(envPath, "utf-8"), envPath);
+    }
+  }
+  return { globals, perEnv };
+}
+function applyDeployGlobals(globals) {
+  for (const [k, v] of Object.entries(globals)) {
+    if (process.env[k] === undefined) {
+      process.env[k] = v;
+    }
+  }
+}
+function parseEnvFile(content, pathForErrors) {
+  const out = {};
+  const lines = content.split(/\r?\n/);
+  for (let i = 0;i < lines.length; i++) {
+    const raw = lines[i];
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) {
+      throw new Error(`${pathForErrors}:${i + 1}: malformed line (expected KEY=VALUE): ${raw}`);
+    }
+    const key = line.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      throw new Error(`${pathForErrors}:${i + 1}: invalid variable name "${key}"`);
+    }
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/deploy/config.ts
 var DEPLOY_CONFIG_FILE = "deploy.arc.json";
 function deployConfigPath(rootDir) {
-  return join14(rootDir, DEPLOY_CONFIG_FILE);
+  return join15(rootDir, DEPLOY_CONFIG_FILE);
 }
 function deployConfigExists(rootDir) {
-  return existsSync12(deployConfigPath(rootDir));
+  return existsSync14(deployConfigPath(rootDir));
 }
 function loadDeployConfig(rootDir) {
   const path4 = deployConfigPath(rootDir);
-  if (!existsSync12(path4)) {
+  if (!existsSync14(path4)) {
     throw new Error(`Missing ${DEPLOY_CONFIG_FILE} at ${path4}`);
   }
-  const raw = readFileSync11(path4, "utf-8");
+  const raw = readFileSync12(path4, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch (e) {
     throw new Error(`Invalid JSON in ${DEPLOY_CONFIG_FILE}: ${e.message}`);
   }
+  const envNames = isObject(parsed) && isObject(parsed.envs) ? Object.keys(parsed.envs) : [];
+  const envFiles = loadDeployEnvFiles(rootDir, envNames);
+  applyDeployGlobals(envFiles.globals);
   const expanded = expandEnvVars(parsed, process.env);
-  return validateDeployConfig(expanded);
+  const validated = validateDeployConfig(expanded);
+  for (const [envName, vars] of Object.entries(envFiles.perEnv)) {
+    if (!(envName in validated.envs))
+      continue;
+    const env2 = validated.envs[envName];
+    const merged = { ...vars, ...env2.envVars ?? {} };
+    validated.envs[envName] = { ...env2, envVars: merged };
+  }
+  return validated;
 }
 function saveDeployConfig(rootDir, cfg) {
   const path4 = deployConfigPath(rootDir);
-  const raw = existsSync12(path4) ? JSON.parse(readFileSync11(path4, "utf-8")) : {};
+  const raw = existsSync14(path4) ? JSON.parse(readFileSync12(path4, "utf-8")) : {};
   raw.target = { ...raw.target, ...cfg.target };
   writeFileSync12(path4, JSON.stringify(raw, null, 2) + `
 `);
@@ -28552,22 +28538,47 @@ function cfgErr(path4, expected) {
 
 // src/deploy/ssh.ts
 var {spawn: spawn3 } = globalThis.Bun;
+import { existsSync as existsSync15 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join16 } from "path";
+function pickSshKey(target) {
+  if (target.sshKey) {
+    const expanded = target.sshKey.startsWith("~") ? join16(homedir3(), target.sshKey.slice(1)) : target.sshKey;
+    return existsSync15(expanded) ? expanded : null;
+  }
+  for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
+    const path4 = join16(homedir3(), ".ssh", name);
+    if (existsSync15(path4))
+      return path4;
+  }
+  return null;
+}
 async function streamToString(stream2) {
   if (!stream2 || typeof stream2 === "number")
     return "";
   return new Response(stream2).text();
 }
 function baseSshArgs(target) {
+  const key = pickSshKey(target);
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "PreferredAuthentications=publickey",
+    "-o",
+    "ConnectTimeout=5",
+    "-o",
+    "ServerAliveInterval=10",
+    "-o",
+    "ServerAliveCountMax=2",
     "-p",
     String(target.port)
   ];
-  if (target.sshKey)
-    args.push("-i", target.sshKey);
+  if (key) {
+    args.push("-o", "IdentitiesOnly=yes", "-i", key);
+  }
   return args;
 }
 async function sshExec(target, cmd, opts = {}) {
@@ -28610,28 +28621,23 @@ async function canSsh(target) {
   const res = await sshExec(target, "true", { quiet: true });
   return res.exitCode === 0;
 }
-async function waitForSsh(target, opts = {}) {
-  const timeout = opts.timeoutMs ?? 300000;
-  const interval = opts.intervalMs ?? 1e4;
-  const start = Date.now();
-  while (Date.now() - start < timeout) {
-    if (await canSsh(target))
-      return;
-    await Bun.sleep(interval);
-  }
-  throw new Error(`Timed out waiting for SSH on ${target.user}@${target.host}`);
-}
 async function scpUpload(target, localPath, remotePath) {
+  const key = pickSshKey(target);
   const args = [
     "-o",
     "BatchMode=yes",
     "-o",
     "StrictHostKeyChecking=accept-new",
+    "-o",
+    "PreferredAuthentications=publickey",
+    "-o",
+    "ConnectTimeout=5",
     "-P",
     String(target.port)
   ];
-  if (target.sshKey)
-    args.push("-i", target.sshKey);
+  if (key) {
+    args.push("-o", "IdentitiesOnly=yes", "-i", key);
+  }
   args.push(localPath, `${target.user}@${target.host}:${remotePath}`);
   const proc2 = spawn3({ cmd: ["scp", ...args], stderr: "pipe" });
   const [stderr, exitCode] = await Promise.all([
@@ -28689,6 +28695,18 @@ JSON`);
 }
 
 // src/deploy/bootstrap.ts
+async function waitForAnySsh(targets, opts = {}) {
+  const timeout = opts.timeoutMs ?? 300000;
+  const interval = opts.intervalMs ?? 5000;
+  const start = Date.now();
+  while (Date.now() - start < timeout) {
+    const results = await Promise.all(targets.map((t) => canSsh(t)));
+    if (results.some(Boolean))
+      return;
+    await Bun.sleep(interval);
+  }
+  throw new Error(`Timed out waiting for SSH on ${targets.map((t) => `${t.user}@${t.host}`).join(" or ")}`);
+}
 async function bootstrap(inputs) {
   const { cfg, state, rootDir } = inputs;
   if (state.kind === "unreachable") {
@@ -28710,12 +28728,16 @@ async function bootstrap(inputs) {
     cfg.target.host = tfOut.serverIp;
     saveDeployConfig(rootDir, cfg);
     log2("Waiting for SSH to come up...");
-    await waitForSsh({ ...cfg.target, user: "root" });
+    await waitForAnySsh([
+      { ...cfg.target, user: "root" },
+      { ...cfg.target, user: cfg.target.user }
+    ]);
     ok("SSH reachable");
   }
-  if (state.kind === "unreachable" || state.kind === "no-docker") {
+  const needAnsible = state.kind === "unreachable" || state.kind === "no-docker" || inputs.forceAnsible === true;
+  if (needAnsible) {
     log2("Running Ansible bootstrap (Docker + firewall + SSH hardening)...");
-    const deployUserWorks = state.kind === "no-docker" && await canSsh(cfg.target);
+    const deployUserWorks = state.kind !== "unreachable" && await canSsh(cfg.target);
     const asRoot = !deployUserWorks;
     await runAnsible({
       target: cfg.target,
@@ -28724,7 +28746,8 @@ async function bootstrap(inputs) {
     });
     ok("Host bootstrapped");
   }
-  if (state.kind !== "ready") {
+  const needUpStack = state.kind !== "ready" || state.marker === null || state.marker.configHash !== inputs.configHash || !await isRegistryRunning(cfg);
+  if (needUpStack) {
     await upStack(inputs);
     ok("Docker stack up");
   }
@@ -28734,9 +28757,14 @@ async function bootstrap(inputs) {
     updatedAt: new Date().toISOString()
   });
 }
+async function isRegistryRunning(cfg) {
+  const res = await sshExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose ps --status running --format '{{.Service}}' 2>/dev/null || true`, { quiet: true });
+  return res.stdout.split(`
+`).map((s) => s.trim()).includes("registry");
+}
 async function upStack(inputs) {
   const { cfg } = inputs;
-  const workDir = join15(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
+  const workDir = join17(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
   mkdirSync12(workDir, { recursive: true });
   await assertRegistryDnsResolves(cfg);
   const password = process.env[cfg.registry.passwordEnv];
@@ -28744,17 +28772,17 @@ async function upStack(inputs) {
     throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set. ` + `Set it (e.g. \`export ${cfg.registry.passwordEnv}=...\`) before bootstrap.`);
   }
   const htpasswdLine = await generateHtpasswd(cfg.registry.username, password);
-  writeFileSync13(join15(workDir, "htpasswd"), htpasswdLine);
-  writeFileSync13(join15(workDir, "Caddyfile"), generateCaddyfile(cfg));
-  writeFileSync13(join15(workDir, "docker-compose.yml"), generateCompose({ cfg }));
+  writeFileSync13(join17(workDir, "htpasswd"), htpasswdLine);
+  writeFileSync13(join17(workDir, "Caddyfile"), generateCaddyfile(cfg));
+  writeFileSync13(join17(workDir, "docker-compose.yml"), generateCompose({ cfg }));
   await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
   for (const name of Object.keys(cfg.envs)) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
   }
   await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/registry-auth`);
-  await scpUpload(cfg.target, join15(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
-  await scpUpload(cfg.target, join15(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
-  await scpUpload(cfg.target, join15(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
+  await scpUpload(cfg.target, join17(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
+  await scpUpload(cfg.target, join17(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
+  await scpUpload(cfg.target, join17(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
   await assertExec(cfg.target, `touch ${cfg.target.remoteDir}/.env`);
   await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose pull --ignore-pull-failures caddy registry && docker compose up -d caddy registry`);
   await sshDockerLogin(cfg);
@@ -28768,18 +28796,23 @@ async function sshDockerLogin(cfg) {
   if (!password) {
     throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set on the deploy host (CLI machine).`);
   }
-  const cmd = `echo "$ARC_REGISTRY_PASSWORD_FORWARDED" | docker login ${cfg.registry.domain} -u ${cfg.registry.username} --password-stdin`;
+  const cmd = `docker login ${cfg.registry.domain} -u ${cfg.registry.username} --password-stdin`;
   const proc2 = spawn4({
     cmd: [
       "ssh",
       ...baseSshArgs(cfg.target),
       `${cfg.target.user}@${cfg.target.host}`,
       "--",
-      `ARC_REGISTRY_PASSWORD_FORWARDED='${password.replace(/'/g, "'\\''")}' bash -c ${JSON.stringify(cmd)}`
+      cmd
     ],
+    stdin: "pipe",
     stdout: "pipe",
     stderr: "pipe"
   });
+  if (proc2.stdin) {
+    await proc2.stdin.write(new TextEncoder().encode(password));
+    await proc2.stdin.end?.();
+  }
   const exit = await proc2.exited;
   if (exit !== 0) {
     const stderr = await new Response(proc2.stderr).text();
@@ -28801,24 +28834,39 @@ async function listConfiguredEnvs(cfg) {
   return [...set];
 }
 async function assertRegistryDnsResolves(cfg) {
+  const apex = apexDomain(cfg.registry.domain);
+  let nameservers = await digQuery("8.8.8.8", "NS", apex);
+  nameservers = nameservers.map((s) => s.replace(/\.$/, ""));
+  const sources = [...nameservers, "1.1.1.1", "8.8.8.8"];
+  let lastAnswers = [];
+  for (const source of sources) {
+    const answers = await digQuery(source, "A", cfg.registry.domain);
+    if (answers.length === 0)
+      continue;
+    lastAnswers = answers;
+    if (answers.includes(cfg.target.host))
+      return;
+  }
+  if (lastAnswers.length === 0) {
+    throw new Error(`Registry DNS not configured: ${cfg.registry.domain} doesn't resolve. ` + `Add an A record pointing to ${cfg.target.host} and re-run deploy.`);
+  }
+  throw new Error(`Registry DNS mismatch: ${cfg.registry.domain} resolves to [${lastAnswers.join(", ")}], ` + `but target host is ${cfg.target.host}. Update the A record before continuing.`);
+}
+function apexDomain(host) {
+  const parts = host.split(".");
+  return parts.slice(-2).join(".");
+}
+async function digQuery(server, type, name) {
   const proc2 = spawn4({
-    cmd: ["dig", "+short", "+time=3", "+tries=1", cfg.registry.domain],
+    cmd: ["dig", `@${server}`, "+short", "+time=3", "+tries=1", type, name],
     stdout: "pipe",
     stderr: "ignore"
   });
   const exit = await proc2.exited;
-  if (exit !== 0) {
-    err(`\`dig\` is not available \u2014 skipping DNS pre-flight for ${cfg.registry.domain}.`);
-    return;
-  }
-  const resolved = (await new Response(proc2.stdout).text()).split(`
+  if (exit !== 0)
+    return [];
+  return (await new Response(proc2.stdout).text()).split(`
 `).map((s) => s.trim()).filter(Boolean);
-  if (resolved.length === 0) {
-    throw new Error(`Registry DNS not configured: ${cfg.registry.domain} doesn't resolve. ` + `Add an A record pointing to ${cfg.target.host} and re-run deploy.`);
-  }
-  if (!resolved.includes(cfg.target.host)) {
-    throw new Error(`Registry DNS mismatch: ${cfg.registry.domain} resolves to [${resolved.join(", ")}], ` + `but target host is ${cfg.target.host}. Update the A record before continuing.`);
-  }
 }
 
 // src/deploy/deploy-env.ts
@@ -28831,7 +28879,7 @@ async function updateEnvDeployment(opts) {
   const envPath = `${cfg.target.remoteDir}/.env`;
   const escapedRef = fullRef.replace(/"/g, "\\\"");
   const updateScript = [
-    `touch ${envPath}`,
+    `touch ${envPath} && `,
     `awk -v line="${envVarName}=${escapedRef}" -v key="${envVarName}=" '`,
     `  BEGIN { replaced=0 } `,
     `  $0 ~ "^"key { print line; replaced=1; next } `,
@@ -28881,15 +28929,15 @@ var {spawn: spawn5 } = globalThis.Bun;
 import { createHash as createHash3 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync13,
+  existsSync as existsSync16,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync12,
-  realpathSync as realpathSync3,
+  readFileSync as readFileSync13,
+  realpathSync as realpathSync2,
   writeFileSync as writeFileSync14
 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname8, join as join16 } from "path";
-import { fileURLToPath as fileURLToPath6 } from "url";
+import { dirname as dirname7, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/deploy/image-template.ts
 function generateDockerfile(inputs) {
@@ -28938,8 +28986,8 @@ function generateDockerfile(inputs) {
 // src/deploy/image.ts
 async function buildImage(ws, opts) {
   await ensureDocker();
-  const manifestPath = join16(ws.modulesDir, "manifest.json");
-  if (!existsSync13(manifestPath)) {
+  const manifestPath = join18(ws.arcDir, "manifest.json");
+  if (!existsSync16(manifestPath)) {
     throw new Error(`No build manifest at ${manifestPath}. Run \`arc platform build\` first or omit --skip-build.`);
   }
   embedCliBundle(ws);
@@ -28949,12 +28997,13 @@ async function buildImage(ws, opts) {
   const dockerfileInputs = collectDockerfileInputs(ws);
   const dockerfile = generateDockerfile(dockerfileInputs);
   const buildContextDir = ws.rootDir;
-  const dockerfileDir = join16(tmpdir3(), `arc-image-${Date.now()}`);
+  const dockerfileDir = join18(tmpdir3(), `arc-image-${Date.now()}`);
   mkdirSync13(dockerfileDir, { recursive: true });
-  const dockerfilePath = join16(dockerfileDir, "Dockerfile");
+  const dockerfilePath = join18(dockerfileDir, "Dockerfile");
   writeFileSync14(dockerfilePath, dockerfile);
   const buildArgs = [
     "build",
+    "--platform=linux/amd64",
     "-f",
     dockerfilePath,
     "-t",
@@ -28976,20 +29025,20 @@ async function buildImage(ws, opts) {
 }
 function embedCliBundle(ws) {
   const source = locateCliBundle();
-  const target = join16(ws.arcDir, "host.js");
+  const target = join18(ws.arcDir, "host.js");
   copyFileSync2(source, target);
 }
 function locateCliBundle() {
-  const here = fileURLToPath6(import.meta.url);
-  let cur = dirname8(here);
+  const here = fileURLToPath5(import.meta.url);
+  let cur = dirname7(here);
   while (cur !== "/" && cur !== "") {
-    const candidate = join16(cur, "package.json");
-    if (existsSync13(candidate)) {
+    const candidate = join18(cur, "package.json");
+    if (existsSync16(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync12(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync13(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
-          const distIndex = join16(realpathSync3(cur), "dist", "index.js");
-          if (!existsSync13(distIndex)) {
+          const distIndex = join18(realpathSync2(cur), "dist", "index.js");
+          if (!existsSync16(distIndex)) {
             throw new Error(`arc-cli bundle missing at ${distIndex}. Run \`bun run build\` in packages/cli/.`);
           }
           return distIndex;
@@ -28999,7 +29048,7 @@ function locateCliBundle() {
           throw e;
       }
     }
-    const parent = dirname8(cur);
+    const parent = dirname7(cur);
     if (parent === cur)
       break;
     cur = parent;
@@ -29021,17 +29070,17 @@ async function ensureDocker() {
   }
 }
 function computeContentHash(manifestPath) {
-  const raw = JSON.parse(readFileSync12(manifestPath, "utf-8"));
+  const raw = JSON.parse(readFileSync13(manifestPath, "utf-8"));
   delete raw.buildTime;
   const canonical = JSON.stringify(raw);
   return createHash3("sha256").update(canonical).digest("hex").slice(0, 12);
 }
 function collectDockerfileInputs(ws) {
-  const hasPublicDir = existsSync13(join16(ws.rootDir, "public"));
-  const hasLocales = existsSync13(join16(ws.rootDir, "locales"));
+  const hasPublicDir = existsSync16(join18(ws.rootDir, "public"));
+  const hasLocales = existsSync16(join18(ws.rootDir, "locales"));
   let manifestPath;
   for (const name of ["manifest.webmanifest", "manifest.json"]) {
-    if (existsSync13(join16(ws.rootDir, name))) {
+    if (existsSync16(join18(ws.rootDir, name))) {
       manifestPath = name;
       break;
     }
@@ -29852,14 +29901,14 @@ async function platformDeploy(envArg, options = {}) {
     err(`Unknown env "${envArg}". Known: ${Object.keys(cfg.envs).join(", ")}`);
     process.exit(1);
   })() : Object.keys(cfg.envs);
-  const manifestPath = join17(ws.modulesDir, "manifest.json");
+  const manifestPath = join19(ws.arcDir, "manifest.json");
   if (!options.imageTag) {
-    const needBuild = options.rebuild || !existsSync14(manifestPath);
+    const needBuild = options.rebuild || !existsSync17(manifestPath);
     if (needBuild && !options.skipBuild) {
       log2("Building platform...");
       await buildAll(ws, { noCache: options.rebuild });
       ok("Build complete");
-    } else if (!existsSync14(manifestPath)) {
+    } else if (!existsSync17(manifestPath)) {
       err("No build found and --skip-build was set.");
       process.exit(1);
     }
@@ -29884,25 +29933,26 @@ async function platformDeploy(envArg, options = {}) {
       log2(`contentHash: ${contentHash}`);
       return;
     }
-    log2(`Logging in to ${cfg.registry.domain}...`);
-    await dockerLogin(cfg.registry);
-    log2(`Pushing ${fullRef}...`);
-    await dockerPush(fullRef);
-    ok("Image pushed");
   }
   log2("Inspecting remote server...");
   const state = await detectRemoteState(cfg);
   log2(`Remote state: ${state.kind}`);
   const cliVersion = readCliVersion();
   const configHash = await hashDeployConfig(ws.rootDir);
-  if (state.kind !== "ready") {
-    await bootstrap({
-      cfg,
-      rootDir: ws.rootDir,
-      state,
-      cliVersion,
-      configHash
-    });
+  await bootstrap({
+    cfg,
+    rootDir: ws.rootDir,
+    state,
+    cliVersion,
+    configHash,
+    forceAnsible: options.forceBootstrap
+  });
+  if (!options.imageTag) {
+    log2(`Logging in to ${cfg.registry.domain}...`);
+    await dockerLogin(cfg.registry);
+    log2(`Pushing ${fullRef}...`);
+    await dockerPush(fullRef);
+    ok("Image pushed");
   }
   for (const env2 of targetEnvs) {
     log2(`Updating env "${env2}"...`);
@@ -29921,17 +29971,17 @@ async function platformDeploy(envArg, options = {}) {
 }
 function readCliVersion() {
   try {
-    let cur = dirname9(fileURLToPath7(import.meta.url));
-    const root = dirname9(cur).startsWith("/") ? "/" : ".";
+    let cur = dirname8(fileURLToPath6(import.meta.url));
+    const root = dirname8(cur).startsWith("/") ? "/" : ".";
     while (cur !== root && cur !== "") {
-      const candidate = join17(cur, "package.json");
-      if (existsSync14(candidate)) {
-        const pkg = JSON.parse(readFileSync13(candidate, "utf-8"));
+      const candidate = join19(cur, "package.json");
+      if (existsSync17(candidate)) {
+        const pkg = JSON.parse(readFileSync14(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
           return pkg.version ?? "unknown";
         }
       }
-      const parent = dirname9(cur);
+      const parent = dirname8(cur);
       if (parent === cur)
         break;
       cur = parent;
@@ -29942,16 +29992,16 @@ function readCliVersion() {
   }
 }
 async function hashDeployConfig(rootDir) {
-  const p2 = join17(rootDir, "deploy.arc.json");
-  const content = readFileSync13(p2);
+  const p2 = join19(rootDir, "deploy.arc.json");
+  const content = readFileSync14(p2);
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   return hasher.digest("hex").slice(0, 16);
 }
 
 // src/platform/startup.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14, watch } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync15, watch } from "fs";
+import { join as join21 } from "path";
 
 // ../host/src/create-server.ts
 var import_jsonwebtoken = __toESM(require_jsonwebtoken(), 1);
@@ -31197,8 +31247,8 @@ function querySubscriptionHandler() {
             subscriptionId,
             data: data ?? null
           });
-        } catch (err2) {
-          console.error(`[Arc] Query subscription error:`, err2);
+        } catch (err3) {
+          console.error(`[Arc] Query subscription error:`, err3);
         }
       };
       sendData();
@@ -31401,25 +31451,14 @@ async function createArcServer(config) {
   };
 }
 // src/platform/server.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync14 } from "fs";
-import { join as join18 } from "path";
-function generateShellHtml(appName, manifest, arcEntries) {
-  const arcImports = {};
-  if (arcEntries) {
-    for (const [short, pkg] of arcEntries) {
-      arcImports[pkg] = `/shell/${short}.js`;
-    }
+init_i18n();
+import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
+import { join as join20 } from "path";
+function generateShellHtml(appName, manifest, initial) {
+  const initialUrl = initial ? `/browser/${initial.file}` : null;
+  if (!initialUrl) {
+    throw new Error("generateShellHtml: initial bundle missing from manifest");
   }
-  const importMap = {
-    imports: {
-      react: "/shell/react.js",
-      "react/jsx-runtime": "/shell/jsx-runtime.js",
-      "react/jsx-dev-runtime": "/shell/jsx-dev-runtime.js",
-      "react-dom": "/shell/react-dom.js",
-      "react-dom/client": "/shell/react-dom-client.js",
-      ...arcImports
-    }
-  };
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -31430,18 +31469,13 @@ function generateShellHtml(appName, manifest, arcEntries) {
   <link rel="manifest" href="/manifest.json">` : ""}
   <link rel="stylesheet" href="/styles.css" />
   <link rel="stylesheet" href="/theme.css" />
-  <script type="importmap">${JSON.stringify(importMap)}</script>
+  <link rel="modulepreload" href="${initialUrl}" />
 </head>
 <body>
   <div id="root"></div>
   <script type="module">
-    import { createRoot } from "react-dom/client";
-    import { createElement } from "react";
-    import { PlatformApp } from "@arcote.tech/platform";
-
-    createRoot(document.getElementById("root")).render(
-      createElement(PlatformApp)
-    );
+    import { startApp } from "${initialUrl}";
+    startApp("root");
   </script>
 </body>
 </html>`;
@@ -31466,28 +31500,39 @@ function getMime(path4) {
   return MIME[ext2] ?? "application/octet-stream";
 }
 function serveFile(filePath, headers = {}) {
-  if (!existsSync15(filePath))
+  if (!existsSync18(filePath))
     return new Response("Not Found", { status: 404 });
   return new Response(Bun.file(filePath), {
     headers: { "Content-Type": getMime(filePath), ...headers }
   });
 }
-var MODULE_SIG_SECRET = process.env.ARC_MODULE_SECRET ?? crypto.randomUUID();
+var MODULE_SIG_SECRET = process.env.ARC_MODULE_SECRET ?? "";
 var MODULE_SIG_TTL = 3600;
-function signChunkUrl(chunk, file) {
+function ensureModuleSigSecret(ws, devMode) {
+  if (MODULE_SIG_SECRET)
+    return;
+  if (devMode) {
+    const hasher = new Bun.CryptoHasher("sha256");
+    hasher.update(`arc-dev-secret:${ws.rootDir}`);
+    MODULE_SIG_SECRET = hasher.digest("hex").slice(0, 32);
+  } else {
+    MODULE_SIG_SECRET = crypto.randomUUID();
+  }
+}
+function signGroupUrl(file) {
   const exp = Math.floor(Date.now() / 1000) + MODULE_SIG_TTL;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${chunk}/${file}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
   const sig = hasher.digest("hex").slice(0, 16);
-  return `/modules/${chunk}/${file}?sig=${sig}&exp=${exp}`;
+  return `/browser/${file}?sig=${sig}&exp=${exp}`;
 }
-function verifyChunkSignature(chunk, file, sig, exp) {
+function verifyGroupSignature(file, sig, exp) {
   if (!sig || !exp)
     return false;
   if (Number(exp) < Date.now() / 1000)
     return false;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${chunk}/${file}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
   return hasher.digest("hex").slice(0, 16) === sig;
 }
 function decodeTokenPayload(jwt2) {
@@ -31522,90 +31567,85 @@ function parseArcTokensHeader(header) {
   return payloads;
 }
 async function filterManifestForTokens(manifest, moduleAccessMap, tokenPayloads) {
-  const allowedChunks = new Set(["public"]);
+  const allowedGroups = new Set;
   for (const t of tokenPayloads) {
     if (t?.tokenType)
-      allowedChunks.add(t.tokenType);
+      allowedGroups.add(t.tokenType);
   }
-  const filtered = [];
-  for (const mod of manifest.modules) {
-    if (!allowedChunks.has(mod.chunk))
-      continue;
-    if (mod.chunk === "public") {
-      filtered.push(mod);
+  const filteredGroups = {};
+  for (const [name, group] of Object.entries(manifest.groups)) {
+    if (!allowedGroups.has(name))
       continue;
-    }
-    const access = moduleAccessMap.get(mod.name);
-    let granted = true;
-    if (access && access.rules.length > 0) {
-      granted = false;
+    let allGranted = true;
+    for (const moduleName of group.modules) {
+      const access = moduleAccessMap.get(moduleName);
+      if (!access || access.rules.length === 0)
+        continue;
+      let granted = false;
       for (const rule of access.rules) {
-        if (rule.token.name !== mod.chunk)
+        if (rule.token.name !== name)
           continue;
-        const matching = tokenPayloads.find((t) => t.tokenType === rule.token.name);
+        const matching = tokenPayloads.find((t) => t.tokenType === name);
         if (!matching)
           continue;
         granted = rule.check ? await rule.check(matching) : true;
         if (granted)
           break;
       }
+      if (!granted) {
+        allGranted = false;
+        break;
+      }
     }
-    if (granted) {
-      filtered.push({ ...mod, url: signChunkUrl(mod.chunk, mod.file) });
+    if (allGranted) {
+      filteredGroups[name] = { ...group, url: signGroupUrl(group.file) };
     }
   }
   return {
-    modules: filtered,
-    chunks: manifest.chunks,
-    shellHash: manifest.shellHash,
+    initial: manifest.initial,
+    groups: filteredGroups,
+    sharedChunks: manifest.sharedChunks,
     stylesHash: manifest.stylesHash,
     buildTime: manifest.buildTime
   };
 }
-var CHUNK_NAME_RE = /^[A-Za-z0-9_-]+$/;
-var MODULE_FILE_RE = /^[A-Za-z0-9_.-]+\.js$/;
-function staticFilesHandler(ws, devMode) {
+var BROWSER_FILE_RE = /^[A-Za-z0-9_.-]+\.js$/;
+function staticFilesHandler(ws, devMode, getManifest) {
   return (_req, url, ctx) => {
     const path4 = url.pathname;
-    if (path4.startsWith("/shell/"))
-      return serveFile(join18(ws.shellDir, path4.slice(7)), ctx.corsHeaders);
-    if (path4.startsWith("/modules/")) {
-      const rest = path4.slice(9);
-      const slash = rest.indexOf("/");
-      if (slash <= 0) {
-        return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
-      }
-      const chunk = rest.slice(0, slash);
-      const file = rest.slice(slash + 1);
-      if (!CHUNK_NAME_RE.test(chunk) || !MODULE_FILE_RE.test(file)) {
+    if (path4.startsWith("/browser/")) {
+      const file = path4.slice(9);
+      if (!BROWSER_FILE_RE.test(file)) {
         return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
       }
-      if (chunk !== "public") {
+      const manifest = getManifest();
+      const isGroupEntry = Object.values(manifest.groups).some((g3) => g3.file === file);
+      if (isGroupEntry) {
         const sig = url.searchParams.get("sig");
         const exp = url.searchParams.get("exp");
-        if (!verifyChunkSignature(chunk, file, sig, exp)) {
+        if (!verifyGroupSignature(file, sig, exp)) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join18(ws.modulesDir, chunk, file), {
+      return serveFile(join20(ws.browserDir, file), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     }
     if (path4.startsWith("/locales/"))
-      return serveFile(join18(ws.arcDir, path4.slice(1)), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, path4.slice(1)), ctx.corsHeaders);
     if (path4.startsWith("/assets/"))
-      return serveFile(join18(ws.assetsDir, path4.slice(8)), ctx.corsHeaders);
+      return serveFile(join20(ws.assetsDir, path4.slice(8)), ctx.corsHeaders);
     if (path4 === "/styles.css")
-      return serveFile(join18(ws.arcDir, "styles.css"), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, "styles.css"), ctx.corsHeaders);
     if (path4 === "/theme.css")
-      return serveFile(join18(ws.arcDir, "theme.css"), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, "theme.css"), ctx.corsHeaders);
     if ((path4 === "/manifest.json" || path4 === "/manifest.webmanifest") && ws.manifest) {
       return serveFile(ws.manifest.path, ctx.corsHeaders);
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
-      const publicFile = join18(ws.publicDir, path4.slice(1));
-      if (existsSync15(publicFile))
+      const publicFile = join20(ws.publicDir, path4.slice(1));
+      if (existsSync18(publicFile))
         return serveFile(publicFile, ctx.corsHeaders);
     }
     return null;
@@ -31630,7 +31670,7 @@ function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap) {
     if (url.pathname === "/health") {
       return Response.json({
         status: "ok",
-        modules: getManifest().modules.length,
+        groups: Object.keys(getManifest().groups).length,
         clients: cm?.clientCount ?? 0
       }, { headers: ctx.corsHeaders });
     }
@@ -31662,22 +31702,23 @@ function devReloadHandler(sseClients) {
     });
   };
 }
-function spaFallbackHandler(shellHtml) {
+function spaFallbackHandler(getShellHtml) {
   return (_req, _url, ctx) => {
-    return new Response(shellHtml, {
+    return new Response(getShellHtml(), {
       headers: { ...ctx.corsHeaders, "Content-Type": "text/html" }
     });
   };
 }
 async function startPlatformServer(opts) {
   const { ws, port, devMode, context } = opts;
+  ensureModuleSigSecret(ws, !!devMode);
   const moduleAccessMap = opts.moduleAccess ?? new Map;
   let manifest = opts.manifest;
   const getManifest = () => manifest;
   const setManifest = (m4) => {
     manifest = m4;
   };
-  const shellHtml = generateShellHtml(ws.appName, ws.manifest, opts.arcEntries);
+  const getShellHtml = () => generateShellHtml(ws.appName, ws.manifest, manifest?.initial);
   const sseClients = new Set;
   const notifyReload = (m4) => {
     const data = JSON.stringify(m4);
@@ -31714,8 +31755,8 @@ async function startPlatformServer(opts) {
         const handlers = [
           apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
           devReloadHandler(sseClients),
-          staticFilesHandler(ws, !!devMode),
-          spaFallbackHandler(shellHtml)
+          staticFilesHandler(ws, !!devMode, getManifest),
+          spaFallbackHandler(getShellHtml)
         ];
         for (const handler of handlers) {
           const response = await handler(req, url, ctx);
@@ -31735,7 +31776,7 @@ async function startPlatformServer(opts) {
     };
   }
   const { createBunSQLiteAdapterFactory: createBunSQLiteAdapterFactory2 } = await Promise.resolve().then(() => (init_dist(), exports_dist2));
-  const dbPath = opts.dbPath || join18(ws.arcDir, "data", "arc.db");
+  const dbPath = opts.dbPath || join20(ws.arcDir, "data", "arc.db");
   const dbDir = dbPath.substring(0, dbPath.lastIndexOf("/"));
   if (dbDir)
     mkdirSync14(dbDir, { recursive: true });
@@ -31746,8 +31787,8 @@ async function startPlatformServer(opts) {
     httpHandlers: [
       apiEndpointsHandler(ws, getManifest, null, moduleAccessMap),
       devReloadHandler(sseClients),
-      staticFilesHandler(ws, !!devMode),
-      spaFallbackHandler(shellHtml)
+      staticFilesHandler(ws, !!devMode, getManifest),
+      spaFallbackHandler(getShellHtml)
     ],
     onWsClose: (clientId) => cleanupClientSubs(clientId)
   });
@@ -31765,17 +31806,17 @@ async function startPlatformServer(opts) {
 async function startPlatform(opts) {
   const { ws, devMode } = opts;
   const port = opts.port ?? parseInt(process.env.PORT || "5005", 10);
-  const dbPath = opts.dbPath ?? join19(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
+  const dbPath = opts.dbPath ?? join21(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
   let manifest;
   if (devMode) {
     manifest = await buildAll(ws);
   } else {
-    const manifestPath = join19(ws.modulesDir, "manifest.json");
-    if (!existsSync16(manifestPath)) {
+    const manifestPath = join21(ws.arcDir, "manifest.json");
+    if (!existsSync19(manifestPath)) {
       err("No build found. Run `arc platform build` first.");
       process.exit(1);
     }
-    manifest = JSON.parse(readFileSync14(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
   }
   log2("Loading server context...");
   const { context, moduleAccess } = await loadServerContext(ws);
@@ -31784,7 +31825,6 @@ async function startPlatform(opts) {
   } else {
     log2("No context \u2014 server endpoints skipped");
   }
-  const arcEntries = collectArcPeerDeps(ws.packages);
   const platform3 = await startPlatformServer({
     ws,
     port,
@@ -31792,8 +31832,7 @@ async function startPlatform(opts) {
     context,
     moduleAccess,
     dbPath,
-    devMode,
-    arcEntries
+    devMode
   });
   ok(`Server on http://localhost:${port}`);
   if (platform3.contextHandler) {
@@ -31825,7 +31864,7 @@ function attachDevWatcher(ws, platform3) {
         const next = await buildAll(ws);
         platform3.setManifest(next);
         platform3.notifyReload(next);
-        ok(`Rebuilt \u2014 ${next.modules.length} module(s)`);
+        ok(`Rebuilt \u2014 initial + ${Object.keys(next.groups).length} group(s)`);
       } catch (e2) {
         console.error(`Rebuild failed: ${e2}`);
       } finally {
@@ -31834,8 +31873,8 @@ function attachDevWatcher(ws, platform3) {
     }, 300);
   };
   for (const pkg of ws.packages) {
-    const srcDir = join19(pkg.path, "src");
-    if (!existsSync16(srcDir))
+    const srcDir = join21(pkg.path, "src");
+    if (!existsSync19(srcDir))
       continue;
     watch(srcDir, { recursive: true }, (_event, filename) => {
       if (!filename || filename.includes(".arc") || filename.endsWith(".d.ts") || filename.includes("node_modules") || filename.includes("dist"))
@@ -31845,8 +31884,8 @@ function attachDevWatcher(ws, platform3) {
       triggerRebuild();
     });
   }
-  const localesDir = join19(ws.rootDir, "locales");
-  if (existsSync16(localesDir)) {
+  const localesDir = join21(ws.rootDir, "locales");
+  if (existsSync19(localesDir)) {
     watch(localesDir, { recursive: false }, (_event, filename) => {
       if (!filename?.endsWith(".po"))
         return;
@@ -31876,7 +31915,7 @@ var platform3 = program2.command("platform").description("Platform commands \u20
 platform3.command("dev").description("Start platform in dev mode (Bun server + Vite HMR)").option("--no-cache", "Force full rebuild on startup").action((opts) => platformDev({ noCache: opts.cache === false }));
 platform3.command("build").description("Build platform for production").option("--no-cache", "Force full rebuild").action((opts) => platformBuild({ noCache: opts.cache === false }));
 platform3.command("start").description("Start platform in production mode (requires prior build)").action(platformStart);
-platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").option("--build-only", "Build the Docker image locally, then exit (no remote push)").option("--image-tag <hash>", "Roll back / pin to an existing image tag instead of building a new one").action((env2, opts) => platformDeploy(env2, opts));
+platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").option("--build-only", "Build the Docker image locally, then exit (no remote push)").option("--image-tag <hash>", "Roll back / pin to an existing image tag instead of building a new one").option("--force-bootstrap", "Re-run Ansible host bootstrap even if the server is already configured").action((env2, opts) => platformDeploy(env2, opts));
 program2.parse(process.argv);
 if (process.argv.length === 2) {
   program2.help();