@arcote.tech/arc-cli 0.7.0 → 0.7.2

package/src/builder/module-builder.ts

@@ -17,7 +17,7 @@ import {
   updateCache,
   type BuildCache,
 } from "./build-cache";
-import type { ChunkPlan, PackageChunk } from "./chunk-planner";
+import type { ChunkPlan } from "./chunk-planner";
 import { SHELL_EXTERNALS } from "./framework-peers";
 import {
   readInstalledVersion,
@@ -47,6 +47,56 @@ export { SHELL_EXTERNALS };
  * JSX-typed Trans/translation components from workspace deps; without the
  * shim, loadServerContext fails on any server bundle that touches them.
  */
+/**
+ * Force every `react*` and `react-dom*` import to resolve from the workspace
+ * root's node_modules. Without this, monorepo symlinks (npm-linked
+ * @arcote.tech/platform → arc workspace's react@A; @ndt/* → ndt workspace's
+ * react@B) produce two physical React copies in the bundle. Two copies =
+ * two `ReactSharedInternals` = null dispatcher = "Invalid hook call".
+ *
+ * We resolve once from `rootDir` and pin every subsequent React-related
+ * specifier to that absolute path, defeating Bun's per-importer resolution.
+ */
+/**
+ * Override `"sideEffects": false` for workspace + framework packages.
+ *
+ * Arc modules auto-register via top-level `module(...).build()` — that IS a
+ * side effect. But packages typically ship with `"sideEffects": false` (a
+ * good default for treeshake-friendly libs). Two failure modes follow:
+ *
+ *   1. Side-effect-only imports (`import "@ndt/strategy"`) get tree-shaken
+ *      to nothing — module never registers.
+ *   2. Splitting heuristics treat such modules as freely duplicatable, so
+ *      a context-package singleton (`WorkspaceContext = createContext(...)`)
+ *      ends up cloned per entry; `useWorkspace()` can't find the provider.
+ *
+ * Bun.build accepts `sideEffects: true` in `onResolve` return values (same
+ * as esbuild) — that flag overrides package.json. We flip the bit for any
+ * `@ndt/*` or `@arcote.tech/*` import. React itself is fine; it doesn't
+ * use sideEffects:false in a problematic way.
+ */
+
+function singleReactPlugin(rootDir: string): import("bun").BunPlugin {
+  const reactPkgs = ["react", "react-dom", "react-dom/client", "react/jsx-runtime"];
+  return {
+    name: "single-react",
+    setup(build) {
+      const resolved = new Map<string, string>();
+      for (const spec of reactPkgs) {
+        try {
+          resolved.set(spec, Bun.resolveSync(spec, rootDir));
+        } catch {
+          // If consumer doesn't have it installed, leave Bun's default behavior.
+        }
+      }
+      build.onResolve({ filter: /^(react|react-dom|react-dom\/client|react\/jsx-runtime)$/ }, (args) => {
+        const path = resolved.get(args.path);
+        return path ? { path } : null;
+      });
+    },
+  };
+}
+
 function jsxDevShimPlugin(): import("bun").BunPlugin {
   return {
     name: "jsx-dev-runtime-shim",
@@ -227,16 +277,32 @@ async function buildContextClient(
 
   console.log(`  building: ${pkg.name} (${client.name})`);
 
-  // Externals: framework peers + npm dependencies. Workspace deps (value
-  // starts with `workspace:`) are bundled inline — the deploy image has no
-  // workspace symlinks, so any cross-package import not bundled here would
-  // fail to resolve at runtime in the container.
+  // Externals depend on the target client:
+  //
+  // - BROWSER client: workspace deps MUST be external. Inlining them per
+  //   package would make every context package's dist ship its own copy
+  //   of every workspace dep — the top-level browser Bun.build would see
+  //   N pre-inlined copies of context singletons (`WorkspaceContext =
+  //   createContext`) and could not dedupe them, breaking provider lookup.
+  //
+  // - SERVER client: workspace deps MUST be bundled inline. The deploy
+  //   image flattens each package's server bundle to
+  //   `.arc/platform/server/<pkg>.js` and runs them via a single
+  //   `loadServerContext()` import loop. There is no `node_modules/@ndt/*`
+  //   tree inside the image, so bare `@ndt/workspace` specifiers would
+  //   fail to resolve at startup. Inline duplication is harmless on the
+  //   server: it's a single Node/Bun process and Arc modules register via
+  //   a shared platform registry singleton (registry.ts), so two physical
+  //   copies of the workspace module still merge into one context.
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
   const allDeps = (pkg.packageJson.dependencies ?? {}) as Record<string, string>;
-  const npmDeps = Object.entries(allDeps)
-    .filter(([, spec]) => !spec.startsWith("workspace:"))
-    .map(([name]) => name);
-  const externals = [...peerDeps, ...npmDeps];
+  const isBrowser = client.name === "browser";
+  const workspaceDeps = isBrowser
+    ? Object.keys(allDeps)
+    : Object.entries(allDeps)
+        .filter(([, spec]) => !spec.startsWith("workspace:"))
+        .map(([name]) => name);
+  const externals = [...peerDeps, ...workspaceDeps];
 
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
@@ -289,14 +355,51 @@ export async function buildContextPackages(
   const contexts = packages.filter((p) => isContextPackage(p.packageJson));
   if (contexts.length === 0) return { declarationErrors: [] };
 
-  const tasks = contexts.flatMap((pkg) =>
-    CONTEXT_CLIENTS.map((client) => () =>
-      buildContextClient(pkg, rootDir, client, cache, noCache),
-    ),
-  );
+  // Topological order — each package's server bundle inlines its workspace
+  // deps, so those deps must have their `dist/` ready before Bun.build tries
+  // to resolve them. Without this, a fresh checkout (no dist/ yet) fails the
+  // first build because content's resolve of @ndt/strategy hits a missing
+  // file. Inside a topological level, packages are built in parallel.
+  const byName = new Map(contexts.map((p) => [p.name, p]));
+  const remaining = new Set(contexts.map((p) => p.name));
+  const done = new Set<string>();
+  const ordered: WorkspacePackage[][] = [];
+
+  const workspaceDepsOf = (pkg: WorkspacePackage): string[] => {
+    const deps = (pkg.packageJson.dependencies ?? {}) as Record<string, string>;
+    return Object.entries(deps)
+      .filter(([name, spec]) => spec.startsWith("workspace:") && byName.has(name))
+      .map(([name]) => name);
+  };
 
-  const results = await pAll(tasks);
-  const declarationErrors = results.flatMap((r) => r.declarationErrors);
+  while (remaining.size > 0) {
+    const layer: WorkspacePackage[] = [];
+    for (const name of remaining) {
+      const pkg = byName.get(name)!;
+      const unmetDeps = workspaceDepsOf(pkg).filter((d) => !done.has(d));
+      if (unmetDeps.length === 0) layer.push(pkg);
+    }
+    if (layer.length === 0) {
+      const cycle = [...remaining].join(", ");
+      throw new Error(`Workspace dependency cycle detected: ${cycle}`);
+    }
+    ordered.push(layer);
+    for (const pkg of layer) {
+      done.add(pkg.name);
+      remaining.delete(pkg.name);
+    }
+  }
+
+  const declarationErrors: string[] = [];
+  for (const layer of ordered) {
+    const tasks = layer.flatMap((pkg) =>
+      CONTEXT_CLIENTS.map((client) => () =>
+        buildContextClient(pkg, rootDir, client, cache, noCache),
+      ),
+    );
+    const results = await pAll(tasks);
+    for (const r of results) declarationErrors.push(...r.declarationErrors);
+  }
 
   if (declarationErrors.length > 0) {
     console.warn("\n\x1b[33mType declaration errors:\x1b[0m");
@@ -307,187 +410,267 @@ export async function buildContextPackages(
   return { declarationErrors };
 }
 
+
 // ---------------------------------------------------------------------------
-// Modules bundles — one Bun.build per chunk group (public + per-token-name)
+// Browser app build — one Bun.build with multiple entrypoints.
+//
+// Replaces the previous architecture of 25+ separate Bun.build calls (per
+// shell peer + per context package × client + per token chunk group + initial
+// bundle). The big win is `splitting: true` across ALL entries:
+//
+//   - workspace context, framework, common deps land in ONE shared chunk
+//     referenced by both `initial.*.js` and `<token>.*.js`. No more multi-
+//     instance bugs (e.g. createWorkspace().build() running twice, each
+//     producing its own aggregate refs).
+//   - No importmap. Nothing is external — Bun bundles everything inline,
+//     dedups via shared chunks. The HTML loads `initial.<hash>.js` and that
+//     pulls shared chunks as needed.
+//   - Token chunks are first-class entries (`<token-name>.<hash>.js`) that
+//     side-effect-import all their member modules. Server signs the URL for
+//     the entry; shared chunks ride along unsigned (filenames are content-
+//     addressed so they're not enumerable without the manifest).
+//
+// Output layout under <outDir> = `<arcDir>/browser/`:
+//   initial.<hash>.js                ← public modules + bootstrap entry
+//   <tokenName>.<hash>.js × N        ← one per token group
+//   chunk-<hash>.js × N              ← auto-shared (workspace ctx, framework, etc.)
 // ---------------------------------------------------------------------------
 
-interface ModulesBundleResult {
-  modules: ModuleDescriptor[];
-  cached: boolean;
+export interface BrowserGroupEntry {
+  /** Filename relative to outDir (`<token>.<hash>.js`). */
+  readonly file: string;
+  readonly hash: string;
+  /** Module names registered by this group (for manifest filterability). */
+  readonly modules: readonly string[];
 }
 
-/**
- * Build each chunk group as an independent Bun.build. Chunks NEVER share
- * code across groups — a public chunk file can be served unauthenticated;
- * per-token chunk files are signed and require the matching token to fetch.
- *
- * Layout: `<outDir>/<chunk>/<safeName>.js` (+ Bun's shared chunk files
- * `chunk-<hash>.js` inside the same chunk dir).
- *
- * i18n strings extracted from all groups are merged into a single workspace
- * translation catalog (extraction is build-input metadata, not bundle output).
- */
-export async function buildModulesByChunks(
+export interface BrowserAppResult {
+  readonly initial: { file: string; hash: string };
+  /** Keyed by token.name. `initial` is NOT here — it's separate. */
+  readonly groups: Record<string, BrowserGroupEntry>;
+  /** Auto-shared chunks emitted by Bun.build splitting. Public, unsigned. */
+  readonly sharedChunks: readonly string[];
+  readonly cached: boolean;
+}
+
+export async function buildBrowserApp(
   rootDir: string,
   outDir: string,
   plan: ChunkPlan,
   cache: BuildCache,
   noCache: boolean,
-): Promise<ModulesBundleResult> {
+  i18nCollector: Map<string, Set<string>>,
+): Promise<BrowserAppResult> {
   mkdirSync(outDir, { recursive: true });
 
-  const i18nCollector = new Map<string, Set<string>>();
-  const aggregateModules: ModuleDescriptor[] = [];
-  let allCached = true;
-
-  for (const chunk of plan.chunks) {
-    const members = plan.groups.get(chunk) ?? [];
-    if (members.length === 0) continue;
-
-    const chunkOutDir = join(outDir, chunk);
-    mkdirSync(chunkOutDir, { recursive: true });
-
-    const result = await buildChunkGroup(
-      rootDir,
-      chunkOutDir,
-      chunk,
-      members,
-      cache,
-      noCache,
-      i18nCollector,
-    );
-
-    aggregateModules.push(...result.modules);
-    if (!result.cached) allCached = false;
-  }
-
-  // Single workspace-wide i18n write — keeps msgid bookkeeping atomic.
-  await finalizeTranslations(rootDir, join(outDir, ".."), i18nCollector);
-
-  return { modules: aggregateModules, cached: allCached };
-}
-
-async function buildChunkGroup(
-  rootDir: string,
-  chunkOutDir: string,
-  chunk: string,
-  members: readonly PackageChunk[],
-  cache: BuildCache,
-  noCache: boolean,
-  i18nCollector: Map<string, Set<string>>,
-): Promise<ModulesBundleResult> {
-  const unitId = `modules-chunk:${chunk}`;
+  const publicMembers = plan.groups.get("public") ?? [];
+  const protectedGroups = plan.chunks
+    .filter((c) => c !== "public")
+    .map((c) => ({ name: c, members: plan.groups.get(c) ?? [] }))
+    .filter((g) => g.members.length > 0);
 
-  const pkgHashes = members.map((m) => ({
-    name: m.pkg.name,
-    safeName: m.safeName,
-    moduleName: m.moduleName,
-    srcHash: pkgSourceHash(m.pkg),
-  }));
+  const unitId = "browser-app";
 
+  // Cache key spans every package's source plus the build config that
+  // matters. If anything changes, full rebuild.
+  const allMembers: { name: string; group: string; srcHash: string }[] = [];
+  for (const m of publicMembers) {
+    allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg) });
+  }
+  for (const g of protectedGroups) {
+    for (const m of g.members) {
+      allMembers.push({ name: m.pkg.name, group: g.name, srcHash: pkgSourceHash(m.pkg) });
+    }
+  }
   const inputHash = sha256OfJson({
-    chunk,
-    pkgHashes,
-    externals: SHELL_EXTERNALS,
+    members: allMembers,
+    groups: [
+      "initial",
+      ...protectedGroups.map((g) => g.name).sort(),
+    ],
     define: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" },
   });
 
   if (!noCache && isCacheHit(cache, unitId, inputHash)) {
-    const existing = cache.units[unitId]?.outputHashes ?? {};
-    const modules: ModuleDescriptor[] = [];
-    let missing = false;
-    for (const h of pkgHashes) {
-      const file = `${h.safeName}.js`;
-      const filePath = join(chunkOutDir, file);
-      if (!existsSync(filePath)) {
-        missing = true;
-        break;
+    const cached = cache.units[unitId]?.outputHashes;
+    if (cached?._manifest) {
+      try {
+        const m = JSON.parse(cached._manifest) as BrowserAppResult;
+        const allFiles = [
+          m.initial.file,
+          ...Object.values(m.groups).map((g) => g.file),
+          ...m.sharedChunks,
+        ];
+        if (allFiles.every((f) => existsSync(join(outDir, f)))) {
+          console.log(`  ✓ cached: ${unitId}`);
+          return { ...m, cached: true };
+        }
+      } catch {
+        // fall through to rebuild
       }
-      modules.push({
-        file,
-        name: h.moduleName,
-        chunk,
-        hash: existing[h.safeName] ?? sha256Hex(readFileSync(filePath)),
-      });
-    }
-    if (!missing) {
-      console.log(`  ✓ cached: ${unitId} (${modules.length} module(s))`);
-      return { modules, cached: true };
     }
-    console.log(`  rebuilding ${unitId}: output file missing`);
   }
 
-  console.log(`  building: ${unitId} (${members.length} module(s))`);
+  console.log(
+    `  building: ${unitId} (initial: ${publicMembers.length} modules, groups: ${protectedGroups
+      .map((g) => `${g.name}=${g.members.length}`)
+      .join(",") || "none"})`,
+  );
 
-  const tmpDir = join(chunkOutDir, "_entries");
+  // Wipe outDir so stale-hash files don't linger.
+  if (existsSync(outDir)) {
+    for (const f of readdirSync(outDir)) {
+      if (f.endsWith(".js")) rmSync(join(outDir, f), { force: true });
+    }
+  }
+
+  const tmpDir = join(outDir, "_entries");
   mkdirSync(tmpDir, { recursive: true });
 
-  const entrypoints: string[] = [];
-  const fileToModuleName = new Map<string, string>();
+  const importLines = (pkgs: { pkg: { name: string } }[]): string =>
+    pkgs.map((m) => `import "${m.pkg.name}";`).join("\n");
+
+  const initialEntry = join(tmpDir, "initial.ts");
+  writeFileSync(
+    initialEntry,
+    `${importLines(publicMembers)}\nexport { startApp } from "@arcote.tech/platform";\n`,
+  );
 
-  for (const m of members) {
-    fileToModuleName.set(m.safeName, m.moduleName);
-    const wrapperFile = join(tmpDir, `${m.safeName}.ts`);
-    writeFileSync(wrapperFile, `export * from "${m.pkg.name}";\n`);
-    entrypoints.push(wrapperFile);
+  const entryPaths: string[] = [initialEntry];
+  const groupModuleMap = new Map<string, string[]>();
+  for (const g of protectedGroups) {
+    const entry = join(tmpDir, `${g.name}.ts`);
+    writeFileSync(entry, `${importLines(g.members)}\n`);
+    entryPaths.push(entry);
+    groupModuleMap.set(g.name, g.members.map((m) => m.moduleName));
   }
 
-  const arcExternalPlugin: import("bun").BunPlugin = {
-    name: "arc-external",
-    setup(build) {
-      build.onResolve({ filter: /^@arcote\.tech\// }, (args) => {
-        return { path: args.path, external: true };
-      });
-    },
-  };
+  // ---------------------------------------------------------------------
+  // Temporarily flip `"sideEffects"` on every workspace package's
+  // package.json from `false` to `true` for the duration of the build.
+  //
+  // Why: Arc modules auto-register via top-level `module(...).build()` —
+  // a real side effect. But packages ship with `"sideEffects": false` (a
+  // good ESM-library default), which makes Bun.build:
+  //   (1) tree-shake side-effect-only imports → module().build() never runs,
+  //   (2) freely duplicate the module across entry chunks → context
+  //       singletons (`createContext`) get cloned, breaking provider lookup.
+  //
+  // Bun has no plugin hook to override package.json `sideEffects` and
+  // `build.resolve()` is not implemented (Bun#2771), so the cleanest
+  // reliable lever is a tiny on-disk patch with guaranteed restore.
+  // ---------------------------------------------------------------------
+  const allMemberPkgs = new Map<string, WorkspacePackage>();
+  for (const m of publicMembers) allMemberPkgs.set(m.pkg.name, m.pkg);
+  for (const g of protectedGroups)
+    for (const m of g.members) allMemberPkgs.set(m.pkg.name, m.pkg);
+
+  const patchedPkgJsons: { path: string; original: string }[] = [];
+  for (const pkg of allMemberPkgs.values()) {
+    const pkgJsonPath = join(pkg.path, "package.json");
+    if (!existsSync(pkgJsonPath)) continue;
+    const original = readFileSync(pkgJsonPath, "utf-8");
+    const parsed = JSON.parse(original);
+    if (parsed.sideEffects === true) continue; // already correct
+    parsed.sideEffects = true;
+    writeFileSync(pkgJsonPath, JSON.stringify(parsed, null, 2) + "\n");
+    patchedPkgJsons.push({ path: pkgJsonPath, original });
+  }
 
-  const result = await Bun.build({
-    entrypoints,
-    outdir: chunkOutDir,
-    splitting: true,
-    format: "esm",
-    target: "browser",
-    external: [...SHELL_EXTERNALS],
-    plugins: [
-      arcExternalPlugin,
-      jsxDevShimPlugin(),
-      i18nExtractPlugin(i18nCollector, rootDir),
-    ],
-    naming: "[name].[ext]",
-    define: {
-      ONLY_SERVER: "false",
-      ONLY_BROWSER: "true",
-      ONLY_CLIENT: "true",
-    },
-  });
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: entryPaths,
+      outdir: outDir,
+      // splitting:true is the whole point: shared deps (workspace context,
+      // framework, lucide, etc.) land in chunk-<hash>.js, referenced by both
+      // initial and token-group entries. One instance, no provider duplication.
+      splitting: true,
+      format: "esm",
+      target: "browser",
+      // No externals. Framework peers (react, @arcote.tech/*) get bundled and
+      // deduped into shared chunks. No importmap needed in the HTML.
+      external: [],
+      plugins: [
+        singleReactPlugin(rootDir),
+        jsxDevShimPlugin(),
+        i18nExtractPlugin(i18nCollector, rootDir),
+      ],
+      naming: "[name].[ext]",
+      define: {
+        ONLY_SERVER: "false",
+        ONLY_BROWSER: "true",
+        ONLY_CLIENT: "true",
+        // CRITICAL: React's index.js does `if (process.env.NODE_ENV === 'production') require('./cjs/react.production.js') else require('./cjs/react.development.js')`.
+        // Without inlining NODE_ENV at build time Bun bundles BOTH branches → TWO ReactSharedInternals → multi-instance "Invalid hook call" crash.
+        "process.env.NODE_ENV": '"production"',
+      },
+    });
+  } finally {
+    // Always restore — a crash here MUST NOT leave the user with mutated
+    // workspace package.json files.
+    for (const p of patchedPkgJsons) writeFileSync(p.path, p.original);
+  }
+
+  rmSync(tmpDir, { recursive: true, force: true });
 
   if (!result.success) {
-    console.error(`Chunk "${chunk}" build failed:`);
     for (const log of result.logs) console.error(log);
-    throw new Error(`Module chunk build failed: ${chunk}`);
+    throw new Error("Browser app build failed");
   }
 
-  rmSync(tmpDir, { recursive: true, force: true });
+  // Bun's `[name]` in naming preserves entry filename without hash. We add
+  // content hashes ourselves so identical bytes produce identical URLs across
+  // deploys (good for browser caching). Shared chunks already have a hash in
+  // their name (Bun auto-emits `chunk-<hash>.js`); we leave those alone.
+  let initialFile = "";
+  let initialHash = "";
+  const groups: Record<string, BrowserGroupEntry> = {};
+  const sharedChunks: string[] = [];
+
+  for (const out of result.outputs) {
+    const name = basename(out.path);
+    if (out.kind === "entry-point") {
+      const bytes = readFileSync(out.path);
+      const hash = sha256Hex(bytes).slice(0, 16);
+      const stem = name.replace(/\.js$/, "");
+      const finalName = `${stem}.${hash}.js`;
+      const finalPath = join(outDir, finalName);
+      rmSync(finalPath, { force: true });
+      writeFileSync(finalPath, bytes);
+      rmSync(out.path, { force: true });
+
+      if (stem === "initial") {
+        initialFile = finalName;
+        initialHash = hash;
+      } else {
+        groups[stem] = {
+          file: finalName,
+          hash,
+          modules: groupModuleMap.get(stem) ?? [],
+        };
+      }
+    } else if (out.kind === "chunk") {
+      sharedChunks.push(name);
+    }
+  }
 
-  const outputHashes: Record<string, string> = {};
-  const modules: ModuleDescriptor[] = result.outputs
-    .filter((o) => o.kind === "entry-point")
-    .map((o) => {
-      const file = basename(o.path);
-      const safeName = file.replace(/\.js$/, "");
-      const bytes = readFileSync(o.path);
-      const hash = sha256Hex(bytes);
-      outputHashes[safeName] = hash;
-      return {
-        file,
-        name: fileToModuleName.get(safeName) ?? safeName,
-        chunk,
-        hash,
-      };
-    });
+  if (!initialFile) {
+    throw new Error("Browser app build: initial entry not found in outputs");
+  }
+
+  const manifest: BrowserAppResult = {
+    initial: { file: initialFile, hash: initialHash },
+    groups,
+    sharedChunks,
+    cached: false,
+  };
+
+  updateCache(cache, unitId, inputHash, {
+    outputHashes: { _manifest: JSON.stringify(manifest) },
+  });
 
-  updateCache(cache, unitId, inputHash, { outputHashes });
-  return { modules, cached: false };
+  return manifest;
 }
 
 // ---------------------------------------------------------------------------

package/src/commands/platform-build.ts

@@ -3,5 +3,6 @@ import { buildAll, ok, resolveWorkspace } from "../platform/shared";
 export async function platformBuild(opts: { noCache?: boolean } = {}): Promise<void> {
   const ws = resolveWorkspace();
   const manifest = await buildAll(ws, { noCache: opts.noCache });
-  ok(`Platform built — ${manifest.modules.length} module(s)`);
+  const groupCount = Object.keys(manifest.groups).length;
+  ok(`Platform built — initial + ${groupCount} group(s)`);
 }