@arcote.tech/arc-cli 0.7.16 → 0.7.18

package/dist/index.js

@@ -14004,6 +14004,38 @@ class AuthAdapter {
     this.scopes.clear();
   }
 }
+function triggerModuleSync(scope, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  if (!provider) {
+    latestSync = Promise.resolve();
+    return latestSync;
+  }
+  const seq = ++syncSeq;
+  const run = (async () => {
+    try {
+      await provider(scope);
+    } catch (err3) {
+      console.warn("[arc] module sync failed during setToken:", err3);
+    }
+  })();
+  const guarded = new Promise((resolve) => {
+    let settled = false;
+    const done = () => {
+      if (settled)
+        return;
+      settled = true;
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      console.warn(`[arc] module sync did not complete within ${timeoutMs}ms; proceeding anyway.`);
+      done();
+    }, timeoutMs);
+    timer?.unref?.();
+    run.then(done, done).finally(() => clearTimeout(timer));
+  });
+  if (seq === syncSeq)
+    latestSync = guarded;
+  return guarded;
+}
 
 class EventWire {
   baseUrl;
@@ -14017,7 +14049,8 @@ class EventWire {
   onSyncedCallback;
   reconnectTimeout;
   syncRequested = false;
-  viewSubscriptions = new Map;
+  querySubscriptions = new Map;
+  querySubCounter = 0;
   enableEventSync;
   constructor(baseUrl, options) {
     this.baseUrl = baseUrl;
@@ -14072,7 +14105,7 @@ class EventWire {
             this.requestSync();
           }
           this.flushPendingEvents();
-          this.sendAllViewSubscriptions();
+          this.sendAllQuerySubscriptions();
         } else {
           console.log(`[EventWire] onopen called but ws is not OPEN, readyState:`, this.ws?.readyState);
         }
@@ -14148,24 +14181,29 @@ class EventWire {
   onSynced(callback) {
     this.onSyncedCallback = callback;
   }
-  subscribeView(element, scope, callbacks) {
-    const key = `${scope}:${element}`;
-    this.viewSubscriptions.set(key, callbacks);
+  subscribeQuery(descriptor, scope, callbacks) {
+    const subscriptionId = `qs_${this.instanceId}_${++this.querySubCounter}`;
+    this.querySubscriptions.set(subscriptionId, {
+      descriptor,
+      scope,
+      callbacks
+    });
     if (this.state === "connected" && this.ws) {
       this.ws.send(JSON.stringify({
-        type: "subscribe-view",
-        element,
+        type: "subscribe-query",
+        subscriptionId,
+        descriptor,
         scope
       }));
     }
+    return subscriptionId;
   }
-  unsubscribeView(element, scope) {
-    this.viewSubscriptions.delete(`${scope}:${element}`);
+  unsubscribeQuery(subscriptionId) {
+    this.querySubscriptions.delete(subscriptionId);
     if (this.state === "connected" && this.ws) {
       this.ws.send(JSON.stringify({
-        type: "unsubscribe-view",
-        element,
-        scope
+        type: "unsubscribe-query",
+        subscriptionId
       }));
     }
   }
@@ -14200,17 +14238,17 @@ class EventWire {
           this.lastHostEventId = message.lastHostEventId;
         }
         break;
-      case "view-snapshot": {
-        const sub = this.viewSubscriptions.get(`${message.scope}:${message.element}`);
+      case "query-snapshot": {
+        const sub = this.querySubscriptions.get(message.subscriptionId);
         if (sub) {
-          sub.onSnapshot(message.items ?? []);
+          sub.callbacks.onSnapshot(message.result ?? null);
         }
         break;
       }
-      case "view-changes": {
-        const sub = this.viewSubscriptions.get(`${message.scope}:${message.element}`);
+      case "query-changes": {
+        const sub = this.querySubscriptions.get(message.subscriptionId);
         if (sub && Array.isArray(message.changes)) {
-          sub.onChanges(message.changes);
+          sub.callbacks.onChanges(message.changes);
         }
         break;
       }
@@ -14238,17 +14276,15 @@ class EventWire {
       this.pendingEvents = [];
     }
   }
-  sendAllViewSubscriptions() {
+  sendAllQuerySubscriptions() {
     if (!this.ws || this.state !== "connected")
       return;
-    for (const key of this.viewSubscriptions.keys()) {
-      const sepIdx = key.indexOf(":");
-      const scope = key.slice(0, sepIdx);
-      const element = key.slice(sepIdx + 1);
+    for (const [subscriptionId, sub] of this.querySubscriptions) {
       this.ws.send(JSON.stringify({
-        type: "subscribe-view",
-        element,
-        scope
+        type: "subscribe-query",
+        subscriptionId,
+        descriptor: sub.descriptor,
+        scope: sub.scope
       }));
     }
   }
@@ -14267,19 +14303,12 @@ class LocalEventPublisher2 {
   views = [];
   syncCallback;
   subscribers = new Map;
-  viewChangesCallbacks = new Set;
   constructor(dataStorage) {
     this.dataStorage = dataStorage;
   }
   onPublish(callback) {
     this.syncCallback = callback;
   }
-  onViewChanges(callback) {
-    this.viewChangesCallbacks.add(callback);
-    return () => {
-      this.viewChangesCallbacks.delete(callback);
-    };
-  }
   registerViews(views) {
     this.views = views;
   }
@@ -14347,19 +14376,7 @@ class LocalEventPublisher2 {
     });
     const viewChanges = await this.collectViewChanges(event);
     allChanges.push(...viewChanges);
-    const viewStoreNames = new Set(viewChanges.map((c2) => c2.store));
-    const committed = await this.dataStorage.commitChanges(allChanges, {
-      captureRowsFor: viewStoreNames
-    });
-    if (committed.length > 0 && this.viewChangesCallbacks.size > 0) {
-      for (const callback of this.viewChangesCallbacks) {
-        try {
-          callback(committed);
-        } catch (error) {
-          console.error(`[EventPublisher] onViewChanges callback error:`, error);
-        }
-      }
-    }
+    await this.dataStorage.commitChanges(allChanges);
     await this.notifySubscribers(event);
     if (this.syncCallback) {
       this.syncCallback(event);
@@ -14740,9 +14757,8 @@ function typeValidatorBuilder(typeName, comparatorStrategy) {
 }
 
 class DataStorage {
-  async commitChanges(changes, _options) {
+  async commitChanges(changes) {
     await Promise.all(changes.map(({ store, changes: changes2 }) => this.getStore(store).applyChanges(changes2)));
-    return [];
   }
 }
 
@@ -15099,6 +15115,47 @@ function deepMerge(target, source) {
 function isPlainObject(item) {
   return item && typeof item === "object" && !Array.isArray(item) && !(item instanceof Date) && Object.prototype.toString.call(item) === "[object Object]";
 }
+function murmurHash(key, seed = 0) {
+  let remainder, bytes, h1, h1b, c1, c2, k1, i;
+  remainder = key.length & 3;
+  bytes = key.length - remainder;
+  h1 = seed;
+  c1 = 3432918353;
+  c2 = 461845907;
+  i = 0;
+  while (i < bytes) {
+    k1 = key.charCodeAt(i) & 255 | (key.charCodeAt(++i) & 255) << 8 | (key.charCodeAt(++i) & 255) << 16 | (key.charCodeAt(++i) & 255) << 24;
+    ++i;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+    h1 = h1 << 13 | h1 >>> 19;
+    h1b = (h1 & 65535) * 5 + (((h1 >>> 16) * 5 & 65535) << 16) & 4294967295;
+    h1 = (h1b & 65535) + 27492 + (((h1b >>> 16) + 58964 & 65535) << 16);
+  }
+  k1 = 0;
+  if (remainder >= 3) {
+    k1 ^= (key.charCodeAt(i + 2) & 255) << 16;
+  }
+  if (remainder >= 2) {
+    k1 ^= (key.charCodeAt(i + 1) & 255) << 8;
+  }
+  if (remainder >= 1) {
+    k1 ^= key.charCodeAt(i) & 255;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+  }
+  h1 ^= key.length;
+  h1 ^= h1 >>> 16;
+  h1 = (h1 & 65535) * 2246822507 + (((h1 >>> 16) * 2246822507 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 13;
+  h1 = (h1 & 65535) * 3266489909 + (((h1 >>> 16) * 3266489909 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 16;
+  return h1 >>> 0;
+}
 function resolveQueryChange(currentResult, event3, options) {
   const index = currentResult.findIndex((e2) => e2._id === event3.id);
   const isInCurrentResult = index !== -1;
@@ -15200,8 +15257,8 @@ class ObservableDataStorage {
   getReadWriteTransaction() {
     return this.source.getReadWriteTransaction();
   }
-  commitChanges(changes, options) {
-    return this.source.commitChanges(changes, options);
+  commitChanges(changes) {
+    return this.source.commitChanges(changes);
   }
   trackQuery(storeName, options, result, listener4) {
     const key = this.getQueryKey(storeName, options);
@@ -15214,7 +15271,8 @@ class ObservableDataStorage {
   }
   handleStoreChange(storeName, events) {
     let hasChanges = false;
-    for (const query of this.trackedQueries.values()) {
+    const staleKeys = [];
+    for (const [key, query] of this.trackedQueries) {
       if (query.storeName !== storeName)
         continue;
       let currentResult = query.result;
@@ -15226,10 +15284,20 @@ class ObservableDataStorage {
           queryChanged = true;
         }
       }
-      if (queryChanged) {
-        query.result = currentResult;
+      if (!queryChanged)
+        continue;
+      if (query.options.limit !== undefined && query.result.length === query.options.limit && currentResult.length < query.options.limit) {
+        staleKeys.push(key);
         hasChanges = true;
+        continue;
       }
+      query.result = currentResult;
+      hasChanges = true;
+    }
+    for (const key of staleKeys) {
+      const query = this.trackedQueries.get(key);
+      this.source.getStore(query.storeName).unsubscribe(query.listener);
+      this.trackedQueries.delete(key);
     }
     if (hasChanges) {
       this.onChange();
@@ -15402,6 +15470,7 @@ class ScopedModel3 {
     for (const listener4 of this.tokenListeners) {
       listener4();
     }
+    return triggerModuleSync(this.scopeName);
   }
   getToken() {
     return this.authAdapter.getToken();
@@ -15499,243 +15568,136 @@ class Model2 {
     return s;
   }
 }
-
-class StreamingQueryCache {
-  stores = new Map;
-  views = [];
-  activeStreams = new Map;
-  pendingUnsubscribes = new Map;
-  static UNSUBSCRIBE_DELAY_MS = 5000;
-  storeKey(viewName, scope) {
-    return `${scope ?? DEFAULT_SCOPE}:${viewName}`;
-  }
-  registerViews(views) {
-    this.views = views;
-  }
-  getStore(viewName, scope) {
-    const key = this.storeKey(viewName, scope);
-    if (!this.stores.has(key)) {
-      this.stores.set(key, new StreamingStore);
+function applyQueryChanges(result, changes) {
+  const next = [...result];
+  for (const change of changes) {
+    if (change.type === "delete") {
+      const idx = next.findIndex((it) => it._id === change.id);
+      if (idx !== -1)
+        next.splice(idx, 1);
     }
-    return this.stores.get(key);
-  }
-  hasData(viewName, scope) {
-    const store = this.stores.get(this.storeKey(viewName, scope));
-    return store ? store.hasData() : false;
   }
-  registerStream(key, createStream) {
-    const pending = this.pendingUnsubscribes.get(key);
-    if (pending) {
-      clearTimeout(pending);
-      this.pendingUnsubscribes.delete(key);
+  for (const change of changes) {
+    if (change.type === "set") {
+      const idx = next.findIndex((it) => it._id === change.id);
+      if (idx !== -1)
+        next.splice(idx, 1);
+      next.splice(change.index, 0, change.item);
     }
-    const existing = this.activeStreams.get(key);
-    if (existing) {
-      existing.refCount++;
-      return {
-        unsubscribe: () => this.unregisterStream(key),
-        wasReused: true
+  }
+  return next;
+}
+
+class StreamingQueryCache {
+  entries = new Map;
+  static UNSUBSCRIBE_DELAY_MS = 5000;
+  entryKey(descriptor, scope) {
+    return `${scope ?? "default"}:${murmurHash(JSON.stringify(descriptor))}`;
+  }
+  subscribe(descriptor, scope, eventWire, onChange) {
+    const key = this.entryKey(descriptor, scope);
+    let entry = this.entries.get(key);
+    if (entry) {
+      if (entry.pendingUnsub) {
+        clearTimeout(entry.pendingUnsub);
+        entry.pendingUnsub = undefined;
+      }
+      entry.refCount++;
+    } else {
+      const newEntry = {
+        result: undefined,
+        hasResult: false,
+        listeners: new Set,
+        refCount: 1,
+        subscriptionId: ""
       };
+      newEntry.subscriptionId = eventWire.subscribeQuery(descriptor, scope, {
+        onSnapshot: (result) => {
+          newEntry.result = result;
+          newEntry.hasResult = true;
+          this.notify(newEntry);
+        },
+        onChanges: (changes) => {
+          if (!newEntry.hasResult || !Array.isArray(newEntry.result)) {
+            return;
+          }
+          newEntry.result = applyQueryChanges(newEntry.result, changes);
+          this.notify(newEntry);
+        }
+      });
+      this.entries.set(key, newEntry);
+      entry = newEntry;
     }
-    const streamConn = createStream();
-    this.activeStreams.set(key, {
-      unsubscribe: streamConn.unsubscribe,
-      refCount: 1
-    });
+    const subscribed = entry;
+    subscribed.listeners.add(onChange);
+    let active = true;
     return {
-      unsubscribe: () => this.unregisterStream(key),
-      wasReused: false
+      read: () => ({
+        result: subscribed.result,
+        loading: !subscribed.hasResult
+      }),
+      unsubscribe: () => {
+        if (!active)
+          return;
+        active = false;
+        subscribed.listeners.delete(onChange);
+        subscribed.refCount--;
+        if (subscribed.refCount > 0)
+          return;
+        subscribed.pendingUnsub = setTimeout(() => {
+          subscribed.pendingUnsub = undefined;
+          if (subscribed.refCount > 0)
+            return;
+          eventWire.unsubscribeQuery(subscribed.subscriptionId);
+          this.entries.delete(key);
+        }, StreamingQueryCache.UNSUBSCRIBE_DELAY_MS);
+      }
     };
   }
-  unregisterStream(key) {
-    const stream2 = this.activeStreams.get(key);
-    if (!stream2)
-      return;
-    stream2.refCount--;
-    if (stream2.refCount <= 0) {
-      const timeout = setTimeout(() => {
-        this.pendingUnsubscribes.delete(key);
-        const current2 = this.activeStreams.get(key);
-        if (current2 && current2.refCount <= 0) {
-          current2.unsubscribe();
-          this.activeStreams.delete(key);
-        }
-      }, StreamingQueryCache.UNSUBSCRIBE_DELAY_MS);
-      this.pendingUnsubscribes.set(key, timeout);
-    }
-  }
-  subscribeView(viewName, eventWire, scope) {
-    const key = this.storeKey(viewName, scope);
-    const { unsubscribe } = this.registerStream(key, () => {
-      const store = this.stores.get(key) ?? new StreamingStore;
-      this.stores.set(key, store);
-      eventWire.subscribeView(viewName, scope ?? DEFAULT_SCOPE, {
-        onSnapshot: (items) => store.setAll(items),
-        onChanges: (changes) => store.applyChanges(changes)
-      });
-      return {
-        unsubscribe: () => eventWire.unsubscribeView(viewName, scope ?? DEFAULT_SCOPE)
-      };
-    });
-    return unsubscribe;
-  }
-  invalidateScope(scope) {
+  invalidateScope(scope, eventWire) {
     const prefix = `${scope}:`;
-    for (const [key, timeout] of this.pendingUnsubscribes) {
+    for (const [key, entry] of this.entries) {
       if (!key.startsWith(prefix))
         continue;
-      clearTimeout(timeout);
-      this.pendingUnsubscribes.delete(key);
-    }
-    for (const [key, stream2] of this.activeStreams) {
-      if (!key.startsWith(prefix))
-        continue;
-      try {
-        stream2.unsubscribe();
-      } catch {}
-      this.activeStreams.delete(key);
-    }
-    for (const [key, store] of this.stores) {
-      if (!key.startsWith(prefix))
-        continue;
-      store.clear();
-    }
-  }
-  async applyEvent(event3) {
-    for (const view3 of this.views) {
-      const handlers = view3.getHandlers();
-      const handler = handlers[event3.type];
-      if (!handler)
-        continue;
-      const suffix = `:${view3.name}`;
-      for (const [key, store] of this.stores) {
-        if (!key.endsWith(suffix))
-          continue;
-        const ctx = {
-          set: async (id3, data) => {
-            store.set(String(id3), { _id: String(id3), ...data });
-          },
-          modify: async (id3, data) => {
-            store.modify(String(id3), data);
-          },
-          remove: async (id3) => {
-            store.remove(String(id3));
-          },
-          find: async (options) => {
-            return store.find(options);
-          },
-          findOne: async (where) => {
-            return store.findOne(where);
-          },
-          $auth: {}
-        };
-        await handler(ctx, event3);
-      }
+      if (entry.pendingUnsub)
+        clearTimeout(entry.pendingUnsub);
+      eventWire?.unsubscribeQuery(entry.subscriptionId);
+      this.entries.delete(key);
+      entry.result = undefined;
+      entry.hasResult = false;
+      this.notify(entry);
     }
   }
-  clear() {
-    for (const stream2 of this.activeStreams.values()) {
-      stream2.unsubscribe();
-    }
-    this.activeStreams.clear();
-    for (const timeout of this.pendingUnsubscribes.values()) {
-      clearTimeout(timeout);
-    }
-    this.pendingUnsubscribes.clear();
-    for (const store of this.stores.values()) {
-      store.clear();
+  clear(eventWire) {
+    for (const entry of this.entries.values()) {
+      if (entry.pendingUnsub)
+        clearTimeout(entry.pendingUnsub);
+      eventWire?.unsubscribeQuery(entry.subscriptionId);
     }
+    this.entries.clear();
   }
-}
-
-class StreamingStore {
-  data = new Map;
-  listeners = new Set;
-  initialized = false;
-  hasData() {
-    return this.initialized;
-  }
-  setAll(items) {
-    this.initialized = true;
-    this.data.clear();
-    for (const item of items) {
-      this.data.set(item._id, item);
-    }
-    this.notifyListeners(null);
-  }
-  applyChanges(events) {
-    if (events.length === 0)
-      return;
-    for (const event3 of events) {
-      if (event3.type === "set" && event3.item) {
-        this.data.set(event3.id, event3.item);
-      } else if (event3.type === "delete") {
-        this.data.delete(event3.id);
+  notify(entry) {
+    for (const listener4 of entry.listeners) {
+      try {
+        listener4();
+      } catch (err3) {
+        console.error(`[Arc] Query cache listener error:`, err3);
       }
     }
-    this.notifyListeners(events);
-  }
-  set(id3, item) {
-    this.data.set(id3, item);
-    this.notifyListeners([{ type: "set", id: id3, item }]);
-  }
-  modify(id3, updates) {
-    const existing = this.data.get(id3);
-    if (existing) {
-      const updated = { ...existing, ...updates };
-      this.data.set(id3, updated);
-      this.notifyListeners([{ type: "set", id: id3, item: updated }]);
-    }
-  }
-  remove(id3) {
-    if (this.data.delete(id3)) {
-      this.notifyListeners([{ type: "delete", id: id3, item: null }]);
-    }
-  }
-  clear() {
-    this.initialized = false;
-    this.data.clear();
-    this.notifyListeners(null);
-  }
-  find(options = {}) {
-    let results = Array.from(this.data.values());
-    if (options.where) {
-      results = results.filter((item) => checkItemMatchesWhere(item, options.where));
-    }
-    return applyOrderByAndLimit(results, options);
-  }
-  findOne(where) {
-    const results = this.find({ where });
-    return results[0];
-  }
-  subscribe(listener4) {
-    this.listeners.add(listener4);
-    return () => {
-      this.listeners.delete(listener4);
-    };
-  }
-  notifyListeners(events) {
-    for (const listener4 of this.listeners) {
-      listener4(events);
-    }
   }
 }
 
 class StreamingEventPublisher {
-  cache;
   eventWire;
   views = [];
   subscribers = new Map;
-  constructor(cache, eventWire) {
-    this.cache = cache;
+  constructor(eventWire) {
     this.eventWire = eventWire;
   }
   registerViews(views) {
     this.views = views;
-    this.cache.registerViews(views);
   }
   async publish(event3) {
-    await this.cache.applyEvent(event3);
     await this.notifySubscribers(event3);
     this.eventWire.syncEvents([
       {
@@ -18142,7 +18104,7 @@ var Operation, PROXY_DRAFT, RAW_RETURN_SYMBOL, iteratorSymbol, dataTypes, intern
     }
     return returnValue(result);
   };
-}, create, constructorString, TOKEN_PREFIX = "arc:token:", eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, DEFAULT_SCOPE = "default", originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
+}, create, constructorString, TOKEN_PREFIX = "arc:token:", DEFAULT_TIMEOUT_MS = 8000, provider = null, latestSync = null, syncSeq = 0, eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
   const user = typeHandlers(types22 || {});
   return {
     serializers: Object.assign({}, serializers, user.serializers),
@@ -19748,12 +19710,8 @@ var init_dist = __esm(() => {
       }
       return transaction.find(this.storeName, { where: { _id: id2 } }).then((results) => results[0]);
     }
-    async applyChangeAndReturnEvent(transaction, change, transactionCache, options) {
+    async applyChangeAndReturnEvent(transaction, change, transactionCache) {
       if (change.type === "set") {
-        let existing;
-        if (options?.captureRows) {
-          existing = await this.readExisting(transaction, change.data._id, transactionCache);
-        }
         await transaction.set(this.storeName, change.data);
         const item = this.deserialize ? this.deserialize(change.data) : change.data;
         if (transactionCache) {
@@ -19766,16 +19724,10 @@ var init_dist = __esm(() => {
             type: "set",
             item: change.data,
             id: change.data._id
-          },
-          oldRow: existing ?? null,
-          newRow: change.data
+          }
         };
       }
       if (change.type === "delete") {
-        let existing;
-        if (options?.captureRows) {
-          existing = await this.readExisting(transaction, change.id, transactionCache);
-        }
         await transaction.remove(this.storeName, change.id);
         if (transactionCache) {
           transactionCache.delete(`${this.storeName}:${change.id}`);
@@ -19787,9 +19739,7 @@ var init_dist = __esm(() => {
             type: "delete",
             item: null,
             id: change.id
-          },
-          oldRow: existing ?? null,
-          newRow: null
+          }
         };
       }
       if (change.type === "modify") {
@@ -19807,9 +19757,7 @@ var init_dist = __esm(() => {
             type: "set",
             item,
             id: change.id
-          },
-          oldRow: existing ?? null,
-          newRow: updated
+          }
         };
       }
       if (change.type === "mutate") {
@@ -19827,9 +19775,7 @@ var init_dist = __esm(() => {
             type: "set",
             item,
             id: change.id
-          },
-          oldRow: existing ?? null,
-          newRow: updated
+          }
         };
       }
       throw new Error("Unknown change type");
@@ -19906,22 +19852,17 @@ var init_dist = __esm(() => {
     applySerializedChanges(changes) {
       return Promise.all(changes.map(({ store, changes: changes2 }) => this.getStore(store).applySerializedChanges(changes2)));
     }
-    async commitChanges(changes, options) {
+    async commitChanges(changes) {
       const transaction = await this.getReadWriteTransaction();
       const transactionCache = new Map;
       const eventsByStore = new Map;
-      const committed = [];
       for (const { store, changes: storeChanges } of changes) {
         const storeState = this.getStore(store);
         const storeEvents = [];
-        const capture = options?.captureRowsFor?.has(store) ?? false;
         for (const change of storeChanges) {
-          const { event: event3, oldRow, newRow } = await storeState.applyChangeAndReturnEvent(transaction, change, transactionCache, { captureRows: capture });
+          const { event: event3 } = await storeState.applyChangeAndReturnEvent(transaction, change, transactionCache);
           if (event3)
             storeEvents.push(event3);
-          if (capture) {
-            committed.push({ store, id: event3.id, oldRow, newRow });
-          }
         }
         if (storeEvents.length > 0) {
           eventsByStore.set(store, storeEvents);
@@ -19932,7 +19873,6 @@ var init_dist = __esm(() => {
         const storeState = this.getStore(store);
         storeState.notifyListenersPublic(events);
       }
-      return committed;
     }
     fork() {
       return new ForkedDataStorage(this);
@@ -21435,6 +21375,38 @@ class AuthAdapter2 {
     this.scopes.clear();
   }
 }
+function triggerModuleSync2(scope, timeoutMs = DEFAULT_TIMEOUT_MS2) {
+  if (!provider2) {
+    latestSync2 = Promise.resolve();
+    return latestSync2;
+  }
+  const seq = ++syncSeq2;
+  const run = (async () => {
+    try {
+      await provider2(scope);
+    } catch (err3) {
+      console.warn("[arc] module sync failed during setToken:", err3);
+    }
+  })();
+  const guarded = new Promise((resolve) => {
+    let settled = false;
+    const done = () => {
+      if (settled)
+        return;
+      settled = true;
+      resolve();
+    };
+    const timer2 = setTimeout(() => {
+      console.warn(`[arc] module sync did not complete within ${timeoutMs}ms; proceeding anyway.`);
+      done();
+    }, timeoutMs);
+    timer2?.unref?.();
+    run.then(done, done).finally(() => clearTimeout(timer2));
+  });
+  if (seq === syncSeq2)
+    latestSync2 = guarded;
+  return guarded;
+}
 
 class EventWire2 {
   baseUrl;
@@ -21448,7 +21420,8 @@ class EventWire2 {
   onSyncedCallback;
   reconnectTimeout;
   syncRequested = false;
-  viewSubscriptions = new Map;
+  querySubscriptions = new Map;
+  querySubCounter = 0;
   enableEventSync;
   constructor(baseUrl, options) {
     this.baseUrl = baseUrl;
@@ -21503,7 +21476,7 @@ class EventWire2 {
             this.requestSync();
           }
           this.flushPendingEvents();
-          this.sendAllViewSubscriptions();
+          this.sendAllQuerySubscriptions();
         } else {
           console.log(`[EventWire] onopen called but ws is not OPEN, readyState:`, this.ws?.readyState);
         }
@@ -21579,24 +21552,29 @@ class EventWire2 {
   onSynced(callback) {
     this.onSyncedCallback = callback;
   }
-  subscribeView(element, scope, callbacks) {
-    const key = `${scope}:${element}`;
-    this.viewSubscriptions.set(key, callbacks);
+  subscribeQuery(descriptor, scope, callbacks) {
+    const subscriptionId = `qs_${this.instanceId}_${++this.querySubCounter}`;
+    this.querySubscriptions.set(subscriptionId, {
+      descriptor,
+      scope,
+      callbacks
+    });
     if (this.state === "connected" && this.ws) {
       this.ws.send(JSON.stringify({
-        type: "subscribe-view",
-        element,
+        type: "subscribe-query",
+        subscriptionId,
+        descriptor,
         scope
       }));
     }
+    return subscriptionId;
   }
-  unsubscribeView(element, scope) {
-    this.viewSubscriptions.delete(`${scope}:${element}`);
+  unsubscribeQuery(subscriptionId) {
+    this.querySubscriptions.delete(subscriptionId);
     if (this.state === "connected" && this.ws) {
       this.ws.send(JSON.stringify({
-        type: "unsubscribe-view",
-        element,
-        scope
+        type: "unsubscribe-query",
+        subscriptionId
       }));
     }
   }
@@ -21631,17 +21609,17 @@ class EventWire2 {
           this.lastHostEventId = message.lastHostEventId;
         }
         break;
-      case "view-snapshot": {
-        const sub = this.viewSubscriptions.get(`${message.scope}:${message.element}`);
+      case "query-snapshot": {
+        const sub = this.querySubscriptions.get(message.subscriptionId);
         if (sub) {
-          sub.onSnapshot(message.items ?? []);
+          sub.callbacks.onSnapshot(message.result ?? null);
         }
         break;
       }
-      case "view-changes": {
-        const sub = this.viewSubscriptions.get(`${message.scope}:${message.element}`);
+      case "query-changes": {
+        const sub = this.querySubscriptions.get(message.subscriptionId);
         if (sub && Array.isArray(message.changes)) {
-          sub.onChanges(message.changes);
+          sub.callbacks.onChanges(message.changes);
         }
         break;
       }
@@ -21669,17 +21647,15 @@ class EventWire2 {
       this.pendingEvents = [];
     }
   }
-  sendAllViewSubscriptions() {
+  sendAllQuerySubscriptions() {
     if (!this.ws || this.state !== "connected")
       return;
-    for (const key of this.viewSubscriptions.keys()) {
-      const sepIdx = key.indexOf(":");
-      const scope = key.slice(0, sepIdx);
-      const element = key.slice(sepIdx + 1);
+    for (const [subscriptionId, sub] of this.querySubscriptions) {
       this.ws.send(JSON.stringify({
-        type: "subscribe-view",
-        element,
-        scope
+        type: "subscribe-query",
+        subscriptionId,
+        descriptor: sub.descriptor,
+        scope: sub.scope
       }));
     }
   }
@@ -21698,19 +21674,12 @@ class LocalEventPublisher3 {
   views = [];
   syncCallback;
   subscribers = new Map;
-  viewChangesCallbacks = new Set;
   constructor(dataStorage) {
     this.dataStorage = dataStorage;
   }
   onPublish(callback) {
     this.syncCallback = callback;
   }
-  onViewChanges(callback) {
-    this.viewChangesCallbacks.add(callback);
-    return () => {
-      this.viewChangesCallbacks.delete(callback);
-    };
-  }
   registerViews(views) {
     this.views = views;
   }
@@ -21778,19 +21747,7 @@ class LocalEventPublisher3 {
     });
     const viewChanges = await this.collectViewChanges(event);
     allChanges.push(...viewChanges);
-    const viewStoreNames = new Set(viewChanges.map((c2) => c2.store));
-    const committed = await this.dataStorage.commitChanges(allChanges, {
-      captureRowsFor: viewStoreNames
-    });
-    if (committed.length > 0 && this.viewChangesCallbacks.size > 0) {
-      for (const callback of this.viewChangesCallbacks) {
-        try {
-          callback(committed);
-        } catch (error) {
-          console.error(`[EventPublisher] onViewChanges callback error:`, error);
-        }
-      }
-    }
+    await this.dataStorage.commitChanges(allChanges);
     await this.notifySubscribers(event);
     if (this.syncCallback) {
       this.syncCallback(event);
@@ -22171,9 +22128,8 @@ function typeValidatorBuilder2(typeName, comparatorStrategy) {
 }
 
 class DataStorage2 {
-  async commitChanges(changes, _options) {
+  async commitChanges(changes) {
     await Promise.all(changes.map(({ store, changes: changes2 }) => this.getStore(store).applyChanges(changes2)));
-    return [];
   }
 }
 
@@ -22530,6 +22486,47 @@ function deepMerge2(target, source) {
 function isPlainObject2(item) {
   return item && typeof item === "object" && !Array.isArray(item) && !(item instanceof Date) && Object.prototype.toString.call(item) === "[object Object]";
 }
+function murmurHash2(key, seed = 0) {
+  let remainder, bytes, h1, h1b, c1, c2, k1, i;
+  remainder = key.length & 3;
+  bytes = key.length - remainder;
+  h1 = seed;
+  c1 = 3432918353;
+  c2 = 461845907;
+  i = 0;
+  while (i < bytes) {
+    k1 = key.charCodeAt(i) & 255 | (key.charCodeAt(++i) & 255) << 8 | (key.charCodeAt(++i) & 255) << 16 | (key.charCodeAt(++i) & 255) << 24;
+    ++i;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+    h1 = h1 << 13 | h1 >>> 19;
+    h1b = (h1 & 65535) * 5 + (((h1 >>> 16) * 5 & 65535) << 16) & 4294967295;
+    h1 = (h1b & 65535) + 27492 + (((h1b >>> 16) + 58964 & 65535) << 16);
+  }
+  k1 = 0;
+  if (remainder >= 3) {
+    k1 ^= (key.charCodeAt(i + 2) & 255) << 16;
+  }
+  if (remainder >= 2) {
+    k1 ^= (key.charCodeAt(i + 1) & 255) << 8;
+  }
+  if (remainder >= 1) {
+    k1 ^= key.charCodeAt(i) & 255;
+    k1 = (k1 & 65535) * c1 + (((k1 >>> 16) * c1 & 65535) << 16) & 4294967295;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = (k1 & 65535) * c2 + (((k1 >>> 16) * c2 & 65535) << 16) & 4294967295;
+    h1 ^= k1;
+  }
+  h1 ^= key.length;
+  h1 ^= h1 >>> 16;
+  h1 = (h1 & 65535) * 2246822507 + (((h1 >>> 16) * 2246822507 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 13;
+  h1 = (h1 & 65535) * 3266489909 + (((h1 >>> 16) * 3266489909 & 65535) << 16) & 4294967295;
+  h1 ^= h1 >>> 16;
+  return h1 >>> 0;
+}
 function resolveQueryChange2(currentResult, event3, options) {
   const index = currentResult.findIndex((e2) => e2._id === event3.id);
   const isInCurrentResult = index !== -1;
@@ -22631,8 +22628,8 @@ class ObservableDataStorage2 {
   getReadWriteTransaction() {
     return this.source.getReadWriteTransaction();
   }
-  commitChanges(changes, options) {
-    return this.source.commitChanges(changes, options);
+  commitChanges(changes) {
+    return this.source.commitChanges(changes);
   }
   trackQuery(storeName, options, result, listener4) {
     const key = this.getQueryKey(storeName, options);
@@ -22645,7 +22642,8 @@ class ObservableDataStorage2 {
   }
   handleStoreChange(storeName, events) {
     let hasChanges = false;
-    for (const query of this.trackedQueries.values()) {
+    const staleKeys = [];
+    for (const [key, query] of this.trackedQueries) {
       if (query.storeName !== storeName)
         continue;
       let currentResult = query.result;
@@ -22657,10 +22655,20 @@ class ObservableDataStorage2 {
           queryChanged = true;
         }
       }
-      if (queryChanged) {
-        query.result = currentResult;
+      if (!queryChanged)
+        continue;
+      if (query.options.limit !== undefined && query.result.length === query.options.limit && currentResult.length < query.options.limit) {
+        staleKeys.push(key);
         hasChanges = true;
+        continue;
       }
+      query.result = currentResult;
+      hasChanges = true;
+    }
+    for (const key of staleKeys) {
+      const query = this.trackedQueries.get(key);
+      this.source.getStore(query.storeName).unsubscribe(query.listener);
+      this.trackedQueries.delete(key);
     }
     if (hasChanges) {
       this.onChange();
@@ -22833,6 +22841,7 @@ class ScopedModel4 {
     for (const listener4 of this.tokenListeners) {
       listener4();
     }
+    return triggerModuleSync2(this.scopeName);
   }
   getToken() {
     return this.authAdapter.getToken();
@@ -22930,243 +22939,136 @@ class Model3 {
     return s;
   }
 }
-
-class StreamingQueryCache2 {
-  stores = new Map;
-  views = [];
-  activeStreams = new Map;
-  pendingUnsubscribes = new Map;
-  static UNSUBSCRIBE_DELAY_MS = 5000;
-  storeKey(viewName, scope) {
-    return `${scope ?? DEFAULT_SCOPE2}:${viewName}`;
-  }
-  registerViews(views) {
-    this.views = views;
-  }
-  getStore(viewName, scope) {
-    const key = this.storeKey(viewName, scope);
-    if (!this.stores.has(key)) {
-      this.stores.set(key, new StreamingStore2);
+function applyQueryChanges2(result, changes) {
+  const next = [...result];
+  for (const change of changes) {
+    if (change.type === "delete") {
+      const idx = next.findIndex((it) => it._id === change.id);
+      if (idx !== -1)
+        next.splice(idx, 1);
     }
-    return this.stores.get(key);
-  }
-  hasData(viewName, scope) {
-    const store = this.stores.get(this.storeKey(viewName, scope));
-    return store ? store.hasData() : false;
   }
-  registerStream(key, createStream) {
-    const pending = this.pendingUnsubscribes.get(key);
-    if (pending) {
-      clearTimeout(pending);
-      this.pendingUnsubscribes.delete(key);
+  for (const change of changes) {
+    if (change.type === "set") {
+      const idx = next.findIndex((it) => it._id === change.id);
+      if (idx !== -1)
+        next.splice(idx, 1);
+      next.splice(change.index, 0, change.item);
     }
-    const existing = this.activeStreams.get(key);
-    if (existing) {
-      existing.refCount++;
-      return {
-        unsubscribe: () => this.unregisterStream(key),
-        wasReused: true
+  }
+  return next;
+}
+
+class StreamingQueryCache2 {
+  entries = new Map;
+  static UNSUBSCRIBE_DELAY_MS = 5000;
+  entryKey(descriptor, scope) {
+    return `${scope ?? "default"}:${murmurHash2(JSON.stringify(descriptor))}`;
+  }
+  subscribe(descriptor, scope, eventWire, onChange) {
+    const key = this.entryKey(descriptor, scope);
+    let entry = this.entries.get(key);
+    if (entry) {
+      if (entry.pendingUnsub) {
+        clearTimeout(entry.pendingUnsub);
+        entry.pendingUnsub = undefined;
+      }
+      entry.refCount++;
+    } else {
+      const newEntry = {
+        result: undefined,
+        hasResult: false,
+        listeners: new Set,
+        refCount: 1,
+        subscriptionId: ""
       };
+      newEntry.subscriptionId = eventWire.subscribeQuery(descriptor, scope, {
+        onSnapshot: (result) => {
+          newEntry.result = result;
+          newEntry.hasResult = true;
+          this.notify(newEntry);
+        },
+        onChanges: (changes) => {
+          if (!newEntry.hasResult || !Array.isArray(newEntry.result)) {
+            return;
+          }
+          newEntry.result = applyQueryChanges2(newEntry.result, changes);
+          this.notify(newEntry);
+        }
+      });
+      this.entries.set(key, newEntry);
+      entry = newEntry;
     }
-    const streamConn = createStream();
-    this.activeStreams.set(key, {
-      unsubscribe: streamConn.unsubscribe,
-      refCount: 1
-    });
+    const subscribed = entry;
+    subscribed.listeners.add(onChange);
+    let active = true;
     return {
-      unsubscribe: () => this.unregisterStream(key),
-      wasReused: false
+      read: () => ({
+        result: subscribed.result,
+        loading: !subscribed.hasResult
+      }),
+      unsubscribe: () => {
+        if (!active)
+          return;
+        active = false;
+        subscribed.listeners.delete(onChange);
+        subscribed.refCount--;
+        if (subscribed.refCount > 0)
+          return;
+        subscribed.pendingUnsub = setTimeout(() => {
+          subscribed.pendingUnsub = undefined;
+          if (subscribed.refCount > 0)
+            return;
+          eventWire.unsubscribeQuery(subscribed.subscriptionId);
+          this.entries.delete(key);
+        }, StreamingQueryCache2.UNSUBSCRIBE_DELAY_MS);
+      }
     };
   }
-  unregisterStream(key) {
-    const stream2 = this.activeStreams.get(key);
-    if (!stream2)
-      return;
-    stream2.refCount--;
-    if (stream2.refCount <= 0) {
-      const timeout = setTimeout(() => {
-        this.pendingUnsubscribes.delete(key);
-        const current22 = this.activeStreams.get(key);
-        if (current22 && current22.refCount <= 0) {
-          current22.unsubscribe();
-          this.activeStreams.delete(key);
-        }
-      }, StreamingQueryCache2.UNSUBSCRIBE_DELAY_MS);
-      this.pendingUnsubscribes.set(key, timeout);
-    }
-  }
-  subscribeView(viewName, eventWire, scope) {
-    const key = this.storeKey(viewName, scope);
-    const { unsubscribe } = this.registerStream(key, () => {
-      const store = this.stores.get(key) ?? new StreamingStore2;
-      this.stores.set(key, store);
-      eventWire.subscribeView(viewName, scope ?? DEFAULT_SCOPE2, {
-        onSnapshot: (items) => store.setAll(items),
-        onChanges: (changes) => store.applyChanges(changes)
-      });
-      return {
-        unsubscribe: () => eventWire.unsubscribeView(viewName, scope ?? DEFAULT_SCOPE2)
-      };
-    });
-    return unsubscribe;
-  }
-  invalidateScope(scope) {
+  invalidateScope(scope, eventWire) {
     const prefix = `${scope}:`;
-    for (const [key, timeout] of this.pendingUnsubscribes) {
+    for (const [key, entry] of this.entries) {
       if (!key.startsWith(prefix))
         continue;
-      clearTimeout(timeout);
-      this.pendingUnsubscribes.delete(key);
-    }
-    for (const [key, stream2] of this.activeStreams) {
-      if (!key.startsWith(prefix))
-        continue;
-      try {
-        stream2.unsubscribe();
-      } catch {}
-      this.activeStreams.delete(key);
-    }
-    for (const [key, store] of this.stores) {
-      if (!key.startsWith(prefix))
-        continue;
-      store.clear();
-    }
-  }
-  async applyEvent(event3) {
-    for (const view3 of this.views) {
-      const handlers = view3.getHandlers();
-      const handler = handlers[event3.type];
-      if (!handler)
-        continue;
-      const suffix = `:${view3.name}`;
-      for (const [key, store] of this.stores) {
-        if (!key.endsWith(suffix))
-          continue;
-        const ctx = {
-          set: async (id3, data) => {
-            store.set(String(id3), { _id: String(id3), ...data });
-          },
-          modify: async (id3, data) => {
-            store.modify(String(id3), data);
-          },
-          remove: async (id3) => {
-            store.remove(String(id3));
-          },
-          find: async (options) => {
-            return store.find(options);
-          },
-          findOne: async (where) => {
-            return store.findOne(where);
-          },
-          $auth: {}
-        };
-        await handler(ctx, event3);
-      }
-    }
-  }
-  clear() {
-    for (const stream2 of this.activeStreams.values()) {
-      stream2.unsubscribe();
-    }
-    this.activeStreams.clear();
-    for (const timeout of this.pendingUnsubscribes.values()) {
-      clearTimeout(timeout);
-    }
-    this.pendingUnsubscribes.clear();
-    for (const store of this.stores.values()) {
-      store.clear();
+      if (entry.pendingUnsub)
+        clearTimeout(entry.pendingUnsub);
+      eventWire?.unsubscribeQuery(entry.subscriptionId);
+      this.entries.delete(key);
+      entry.result = undefined;
+      entry.hasResult = false;
+      this.notify(entry);
     }
   }
-}
-
-class StreamingStore2 {
-  data = new Map;
-  listeners = new Set;
-  initialized = false;
-  hasData() {
-    return this.initialized;
-  }
-  setAll(items) {
-    this.initialized = true;
-    this.data.clear();
-    for (const item of items) {
-      this.data.set(item._id, item);
+  clear(eventWire) {
+    for (const entry of this.entries.values()) {
+      if (entry.pendingUnsub)
+        clearTimeout(entry.pendingUnsub);
+      eventWire?.unsubscribeQuery(entry.subscriptionId);
     }
-    this.notifyListeners(null);
+    this.entries.clear();
   }
-  applyChanges(events) {
-    if (events.length === 0)
-      return;
-    for (const event3 of events) {
-      if (event3.type === "set" && event3.item) {
-        this.data.set(event3.id, event3.item);
-      } else if (event3.type === "delete") {
-        this.data.delete(event3.id);
+  notify(entry) {
+    for (const listener4 of entry.listeners) {
+      try {
+        listener4();
+      } catch (err3) {
+        console.error(`[Arc] Query cache listener error:`, err3);
       }
     }
-    this.notifyListeners(events);
-  }
-  set(id3, item) {
-    this.data.set(id3, item);
-    this.notifyListeners([{ type: "set", id: id3, item }]);
-  }
-  modify(id3, updates) {
-    const existing = this.data.get(id3);
-    if (existing) {
-      const updated = { ...existing, ...updates };
-      this.data.set(id3, updated);
-      this.notifyListeners([{ type: "set", id: id3, item: updated }]);
-    }
-  }
-  remove(id3) {
-    if (this.data.delete(id3)) {
-      this.notifyListeners([{ type: "delete", id: id3, item: null }]);
-    }
-  }
-  clear() {
-    this.initialized = false;
-    this.data.clear();
-    this.notifyListeners(null);
-  }
-  find(options = {}) {
-    let results = Array.from(this.data.values());
-    if (options.where) {
-      results = results.filter((item) => checkItemMatchesWhere2(item, options.where));
-    }
-    return applyOrderByAndLimit2(results, options);
-  }
-  findOne(where) {
-    const results = this.find({ where });
-    return results[0];
-  }
-  subscribe(listener4) {
-    this.listeners.add(listener4);
-    return () => {
-      this.listeners.delete(listener4);
-    };
-  }
-  notifyListeners(events) {
-    for (const listener4 of this.listeners) {
-      listener4(events);
-    }
   }
 }
 
 class StreamingEventPublisher2 {
-  cache;
   eventWire;
   views = [];
   subscribers = new Map;
-  constructor(cache, eventWire) {
-    this.cache = cache;
+  constructor(eventWire) {
     this.eventWire = eventWire;
   }
   registerViews(views) {
     this.views = views;
-    this.cache.registerViews(views);
   }
   async publish(event3) {
-    await this.cache.applyEvent(event3);
     await this.notifySubscribers(event3);
     this.eventWire.syncEvents([
       {
@@ -24049,7 +23951,7 @@ var Operation2, PROXY_DRAFT2, RAW_RETURN_SYMBOL2, iteratorSymbol2, dataTypes2, i
     }
     return returnValue(result);
   };
-}, create2, constructorString2, TOKEN_PREFIX2 = "arc:token:", eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, DEFAULT_SCOPE2 = "default", SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
+}, create2, constructorString2, TOKEN_PREFIX2 = "arc:token:", DEFAULT_TIMEOUT_MS2 = 8000, provider2 = null, latestSync2 = null, syncSeq2 = 0, eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
   return async (context) => {
     const adapter = new SQLiteAdapter(db, context);
     await adapter.initialize();
@@ -25614,12 +25516,8 @@ var init_dist2 = __esm(() => {
       }
       return transaction.find(this.storeName, { where: { _id: id22 } }).then((results) => results[0]);
     }
-    async applyChangeAndReturnEvent(transaction, change, transactionCache, options) {
+    async applyChangeAndReturnEvent(transaction, change, transactionCache) {
       if (change.type === "set") {
-        let existing;
-        if (options?.captureRows) {
-          existing = await this.readExisting(transaction, change.data._id, transactionCache);
-        }
         await transaction.set(this.storeName, change.data);
         const item = this.deserialize ? this.deserialize(change.data) : change.data;
         if (transactionCache) {
@@ -25632,16 +25530,10 @@ var init_dist2 = __esm(() => {
             type: "set",
             item: change.data,
             id: change.data._id
-          },
-          oldRow: existing ?? null,
-          newRow: change.data
+          }
         };
       }
       if (change.type === "delete") {
-        let existing;
-        if (options?.captureRows) {
-          existing = await this.readExisting(transaction, change.id, transactionCache);
-        }
         await transaction.remove(this.storeName, change.id);
         if (transactionCache) {
           transactionCache.delete(`${this.storeName}:${change.id}`);
@@ -25653,9 +25545,7 @@ var init_dist2 = __esm(() => {
             type: "delete",
             item: null,
             id: change.id
-          },
-          oldRow: existing ?? null,
-          newRow: null
+          }
         };
       }
       if (change.type === "modify") {
@@ -25673,9 +25563,7 @@ var init_dist2 = __esm(() => {
             type: "set",
             item,
             id: change.id
-          },
-          oldRow: existing ?? null,
-          newRow: updated
+          }
         };
       }
       if (change.type === "mutate") {
@@ -25693,9 +25581,7 @@ var init_dist2 = __esm(() => {
             type: "set",
             item,
             id: change.id
-          },
-          oldRow: existing ?? null,
-          newRow: updated
+          }
         };
       }
       throw new Error("Unknown change type");
@@ -25772,22 +25658,17 @@ var init_dist2 = __esm(() => {
     applySerializedChanges(changes) {
       return Promise.all(changes.map(({ store, changes: changes2 }) => this.getStore(store).applySerializedChanges(changes2)));
     }
-    async commitChanges(changes, options) {
+    async commitChanges(changes) {
       const transaction = await this.getReadWriteTransaction();
       const transactionCache = new Map;
       const eventsByStore = new Map;
-      const committed = [];
       for (const { store, changes: storeChanges } of changes) {
         const storeState = this.getStore(store);
         const storeEvents = [];
-        const capture = options?.captureRowsFor?.has(store) ?? false;
         for (const change of storeChanges) {
-          const { event: event3, oldRow, newRow } = await storeState.applyChangeAndReturnEvent(transaction, change, transactionCache, { captureRows: capture });
+          const { event: event3 } = await storeState.applyChangeAndReturnEvent(transaction, change, transactionCache);
           if (event3)
             storeEvents.push(event3);
-          if (capture) {
-            committed.push({ store, id: event3.id, oldRow, newRow });
-          }
         }
         if (storeEvents.length > 0) {
           eventsByStore.set(store, storeEvents);
@@ -25798,7 +25679,6 @@ var init_dist2 = __esm(() => {
         const storeState = this.getStore(store);
         storeState.notifyListenersPublic(events);
       }
-      return committed;
     }
     fork() {
       return new ForkedDataStorage2(this);
@@ -34582,8 +34462,8 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname8, join as join11 } from "path";
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join12 } from "path";
 
 // src/builder/module-builder.ts
 import { execSync } from "child_process";
@@ -35378,7 +35258,8 @@ writeFileSync(out, JSON.stringify(result, null, 2) + "\\n");
 `.trim();
 
 // src/builder/chunk-planner.ts
-import { basename as basename3 } from "path";
+import { readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
+import { basename as basename3, join as join10 } from "path";
 var PUBLIC_CHUNK = "public";
 function planChunks(packages, accessMap) {
   const assignments = new Map;
@@ -35410,6 +35291,53 @@ function planChunks(packages, accessMap) {
   });
   return { assignments, groups, chunks };
 }
+var MODULE_CALL = /\bmodule\(\s*["'`]([a-zA-Z0-9_-]+)["'`]/g;
+function collectModuleNames(dir, acc) {
+  let entries;
+  try {
+    entries = readdirSync5(dir);
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (e === "node_modules" || e === "dist")
+      continue;
+    const full = join10(dir, e);
+    let isDir = false;
+    try {
+      isDir = statSync2(full).isDirectory();
+    } catch {
+      continue;
+    }
+    if (isDir) {
+      collectModuleNames(full, acc);
+    } else if (e.endsWith(".ts") || e.endsWith(".tsx")) {
+      const src = readFileSync9(full, "utf-8");
+      MODULE_CALL.lastIndex = 0;
+      let m;
+      while (m = MODULE_CALL.exec(src))
+        acc.add(m[1]);
+    }
+  }
+}
+function assertOneModulePerPackage(packages) {
+  const offenders = [];
+  for (const pkg of packages) {
+    const names = new Set;
+    collectModuleNames(join10(pkg.path, "src"), names);
+    if (names.size > 1) {
+      offenders.push({ pkg: pkg.name, modules: [...names].sort() });
+    }
+  }
+  if (offenders.length === 0)
+    return;
+  const detail = offenders.map((o) => `  \u2022 ${o.pkg} declares ${o.modules.length}: ${o.modules.join(", ")}`).join(`
+`);
+  throw new Error(`Arc build: a workspace package must declare at most ONE module().
+` + `Chunk grouping is per-package \u2014 a second module() silently inherits the ` + `first module's token protection and chunk, so e.g. a public onboarding ` + `page sharing a package with a workspaceToken-gated module becomes ` + `unreachable for users without that token.
+${detail}
+` + `Fix: move each extra module() into its own workspace package ` + `(declare its own protectedBy there).`);
+}
 function moduleNameOf(pkgName) {
   return pkgName.includes("/") ? pkgName.split("/").pop() : pkgName;
 }
@@ -35417,17 +35345,19 @@ function resolveChunk(moduleName, access) {
   if (!access || access.rules.length === 0)
     return PUBLIC_CHUNK;
   const tokenNames = new Set(access.rules.map((r) => r.token.name));
-  if (tokenNames.size === 1) {
-    return [...tokenNames][0];
+  if (tokenNames.size > 1) {
+    const list = [...tokenNames].sort().join(", ");
+    throw new Error(`Module "${moduleName}" has access rules for multiple tokens [${list}]. ` + `Multi-token modules are not supported \u2014 split the module or unify on a single token type.`);
   }
-  const list = [...tokenNames].sort().join(", ");
-  throw new Error(`Module "${moduleName}" has access rules for multiple tokens [${list}]. ` + `Multi-token modules are not supported \u2014 split the module or unify on a single token type.`);
+  const tokenName = [...tokenNames][0];
+  const hasCheck = access.rules.some((r) => r.hasCheck);
+  return hasCheck ? `${tokenName}__${moduleName}` : tokenName;
 }
 
 // src/builder/dependency-collector.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename4, dirname as dirname7, join as join10 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename4, dirname as dirname7, join as join11 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = []) {
   mkdirSync8(arcDir, { recursive: true });
@@ -35438,7 +35368,7 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = []) {
   try {
     const cliDir = dirname7(fileURLToPath6(import.meta.url));
     const arcOtelPkgPath = Bun.resolveSync("@arcote.tech/arc-otel/package.json", cliDir);
-    const arcOtelPkg = JSON.parse(readFileSync9(arcOtelPkgPath, "utf-8"));
+    const arcOtelPkg = JSON.parse(readFileSync10(arcOtelPkgPath, "utf-8"));
     for (const [name, spec] of Object.entries(arcOtelPkg.dependencies ?? {})) {
       if (name.startsWith("@opentelemetry/")) {
         versions[name] = spec;
@@ -35449,10 +35379,10 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = []) {
     console.warn(`[arc-otel] could not resolve @arcote.tech/arc-otel \u2014 image will run without telemetry deps: ${e.message}`);
   }
   let rootArc;
-  const rootPkgPath = join10(rootDir, "package.json");
+  const rootPkgPath = join11(rootDir, "package.json");
   if (existsSync9(rootPkgPath)) {
     try {
-      const rootPkg = JSON.parse(readFileSync9(rootPkgPath, "utf-8"));
+      const rootPkg = JSON.parse(readFileSync10(rootPkgPath, "utf-8"));
       if (rootPkg.arc && typeof rootPkg.arc === "object")
         rootArc = rootPkg.arc;
     } catch {}
@@ -35464,11 +35394,11 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = []) {
     dependencies: versions,
     ...rootArc ? { arc: rootArc } : {}
   };
-  const manifestPath = join10(arcDir, "package.json");
+  const manifestPath = join11(arcDir, "package.json");
   writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
 `);
-  const hash = sha256Hex2(readFileSync9(manifestPath));
-  writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
+  const hash = sha256Hex2(readFileSync10(manifestPath));
+  writeFileSync8(join11(arcDir, ".deps-hash"), hash + `
 `);
   return { hash, manifestPath };
 }
@@ -35476,7 +35406,7 @@ function sha256Hex2(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
 function resolveFrameworkVersions(rootDir, packages) {
-  const rootPkg = JSON.parse(readFileSync9(join10(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync10(join11(rootDir, "package.json"), "utf-8"));
   const rootDeps = rootPkg.dependencies ?? {};
   const rootDevDeps = rootPkg.devDependencies ?? {};
   const required = new Set(FRAMEWORK_PEERS);
@@ -35535,9 +35465,9 @@ function resolveWorkspace() {
     process.exit(1);
   }
   const rootDir = dirname8(packageJsonPath);
-  const rootPkg = JSON.parse(readFileSync10(packageJsonPath, "utf-8"));
+  const rootPkg = JSON.parse(readFileSync11(packageJsonPath, "utf-8"));
   const appName = rootPkg.name ?? "Arc App";
-  const arcDir = join11(rootDir, ".arc", "platform");
+  const arcDir = join12(rootDir, ".arc", "platform");
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
   if (packages.length > 0) {
@@ -35547,10 +35477,10 @@ function resolveWorkspace() {
   }
   let manifest;
   for (const name of ["manifest.json", "manifest.webmanifest"]) {
-    const manifestPath = join11(rootDir, name);
+    const manifestPath = join12(rootDir, name);
     if (existsSync10(manifestPath)) {
       try {
-        const data = JSON.parse(readFileSync10(manifestPath, "utf-8"));
+        const data = JSON.parse(readFileSync11(manifestPath, "utf-8"));
         const icons = data.icons;
         manifest = {
           path: manifestPath,
@@ -35569,9 +35499,9 @@ function resolveWorkspace() {
     rootPkg,
     appName,
     arcDir,
-    browserDir: join11(arcDir, "browser"),
-    assetsDir: join11(arcDir, "assets"),
-    publicDir: join11(rootDir, "public"),
+    browserDir: join12(arcDir, "browser"),
+    assetsDir: join12(arcDir, "assets"),
+    publicDir: join12(rootDir, "public"),
     packages,
     manifest
   };
@@ -35581,11 +35511,12 @@ async function buildAll(ws, opts = {}) {
   const noCache = opts.noCache ?? false;
   const themePath = ws.rootPkg.arc?.theme;
   log2(`Building (concurrency parallel${noCache ? ", no-cache" : ""})...`);
+  assertOneModulePerPackage(ws.packages);
   await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
   copyContextServerBundles(ws);
   const accessMap = await extractAccessMap(ws.rootDir, ws.packages);
   mkdirSync9(ws.arcDir, { recursive: true });
-  writeFileSync9(join11(ws.arcDir, "access.json"), JSON.stringify(accessMap, null, 2) + `
+  writeFileSync9(join12(ws.arcDir, "access.json"), JSON.stringify(accessMap, null, 2) + `
 `);
   const plan = planChunks(ws.packages, accessMap);
   ok(`Chunks: ${plan.chunks.map((c) => `${c}(${plan.groups.get(c)?.length ?? 0})`).join(", ")}`);
@@ -35601,7 +35532,7 @@ async function buildAll(ws, opts = {}) {
   collectFrameworkDeps(ws.arcDir, ws.rootDir, ws.packages);
   saveBuildCache(ws.arcDir, cache);
   const finalManifest = assembleManifest(ws, browserResult, cache);
-  writeFileSync9(join11(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
+  writeFileSync9(join12(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
   return finalManifest;
 }
 function assembleManifest(ws, browser, cache) {
@@ -35615,40 +35546,40 @@ function assembleManifest(ws, browser, cache) {
   };
 }
 function copyContextServerBundles(ws) {
-  const outDir = join11(ws.arcDir, "server");
+  const outDir = join12(ws.arcDir, "server");
   mkdirSync9(outDir, { recursive: true });
   for (const pkg of ws.packages) {
     if (!isContextPackage(pkg.packageJson))
       continue;
-    const src = join11(pkg.path, "dist", "server", "main", "index.js");
+    const src = join12(pkg.path, "dist", "server", "main", "index.js");
     if (!existsSync10(src)) {
       err(`Server bundle missing for ${pkg.name}: ${src}`);
       continue;
     }
     const safeName = pkg.path.split("/").pop();
-    const dst = join11(outDir, `${safeName}.js`);
+    const dst = join12(outDir, `${safeName}.js`);
     copyFileSync(src, dst);
   }
 }
 function resolveAssetSource(from, pkgDir, rootDir) {
   if (from.startsWith("./") || from.startsWith("../")) {
-    const resolved = join11(pkgDir, from);
+    const resolved = join12(pkgDir, from);
     return existsSync10(resolved) ? resolved : null;
   }
   const candidates = [
-    join11(rootDir, "node_modules", from),
-    join11(pkgDir, "node_modules", from)
+    join12(rootDir, "node_modules", from),
+    join12(pkgDir, "node_modules", from)
   ];
   for (const c of candidates) {
     if (existsSync10(c))
       return c;
   }
-  const bunCacheDir = join11(rootDir, "node_modules", ".bun");
+  const bunCacheDir = join12(rootDir, "node_modules", ".bun");
   if (existsSync10(bunCacheDir)) {
-    for (const entry of readdirSync5(bunCacheDir, { withFileTypes: true })) {
+    for (const entry of readdirSync6(bunCacheDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const candidate = join11(bunCacheDir, entry.name, "node_modules", from);
+      const candidate = join12(bunCacheDir, entry.name, "node_modules", from);
       if (existsSync10(candidate))
         return candidate;
     }
@@ -35656,11 +35587,11 @@ function resolveAssetSource(from, pkgDir, rootDir) {
   return null;
 }
 function readBrowserAssets(pkgDir) {
-  const pkgJsonPath = join11(pkgDir, "package.json");
+  const pkgJsonPath = join12(pkgDir, "package.json");
   if (!existsSync10(pkgJsonPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync10(pkgJsonPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
     const assets = pkg.arc?.browserAssets;
     if (!Array.isArray(assets))
       return [];
@@ -35670,14 +35601,14 @@ function readBrowserAssets(pkgDir) {
   }
 }
 function discoverBrowserAssets(ws) {
-  const arcDir = join11(ws.rootDir, "node_modules", "@arcote.tech");
+  const arcDir = join12(ws.rootDir, "node_modules", "@arcote.tech");
   if (!existsSync10(arcDir))
     return [];
   const out = [];
-  for (const entry of readdirSync5(arcDir, { withFileTypes: true })) {
+  for (const entry of readdirSync6(arcDir, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const pkgDir = join11(arcDir, entry.name);
+    const pkgDir = join12(arcDir, entry.name);
     const assets = readBrowserAssets(pkgDir);
     for (const asset of assets) {
       const src = resolveAssetSource(asset.from, pkgDir, ws.rootDir);
@@ -35702,7 +35633,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
     to: a.to,
     mtime: mtimeOf(a.src)
   })));
-  const requiredOutputs = assets.map((a) => join11(ws.assetsDir, a.to));
+  const requiredOutputs = assets.map((a) => join12(ws.assetsDir, a.to));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: browser-assets (${assets.length})`);
     return;
@@ -35710,10 +35641,10 @@ async function copyBrowserAssets(ws, cache, noCache) {
   console.log(`  building: browser-assets (${assets.length})`);
   const outputHashes = {};
   for (const asset of assets) {
-    const dest = join11(ws.assetsDir, asset.to);
+    const dest = join12(ws.assetsDir, asset.to);
     mkdirSync9(dirname8(dest), { recursive: true });
     copyFileSync(asset.src, dest);
-    outputHashes[asset.to] = sha256Hex(readFileSync10(dest));
+    outputHashes[asset.to] = sha256Hex(readFileSync11(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
 }
@@ -35721,15 +35652,15 @@ async function loadServerContext(ws) {
   globalThis.ONLY_SERVER = true;
   globalThis.ONLY_BROWSER = false;
   globalThis.ONLY_CLIENT = false;
-  const platformDir = join11(process.cwd(), "node_modules", "@arcote.tech", "platform");
-  const platformPkg = JSON.parse(readFileSync10(join11(platformDir, "package.json"), "utf-8"));
-  const platformEntry = join11(platformDir, platformPkg.main ?? "src/index.ts");
+  const platformDir = join12(process.cwd(), "node_modules", "@arcote.tech", "platform");
+  const platformPkg = JSON.parse(readFileSync11(join12(platformDir, "package.json"), "utf-8"));
+  const platformEntry = join12(platformDir, platformPkg.main ?? "src/index.ts");
   await import(platformEntry);
-  const serverDir = join11(ws.arcDir, "server");
-  const bundles = existsSync10(serverDir) ? readdirSync5(serverDir).filter((f) => f.endsWith(".js")) : [];
+  const serverDir = join12(ws.arcDir, "server");
+  const bundles = existsSync10(serverDir) ? readdirSync6(serverDir).filter((f) => f.endsWith(".js")) : [];
   if (bundles.length > 0) {
     for (const file of bundles) {
-      const bundlePath = join11(serverDir, file);
+      const bundlePath = join12(serverDir, file);
       try {
         await import(bundlePath);
       } catch (e) {
@@ -35739,7 +35670,7 @@ async function loadServerContext(ws) {
   } else if (ws.packages.length > 0) {
     const ctxPackages = ws.packages.filter((p) => isContextPackage(p.packageJson));
     for (const ctx of ctxPackages) {
-      const serverDist = join11(ctx.path, "dist", "server", "main", "index.js");
+      const serverDist = join12(ctx.path, "dist", "server", "main", "index.js");
       if (!existsSync10(serverDist)) {
         err(`Context server dist not found: ${serverDist}`);
         continue;
@@ -35769,21 +35700,21 @@ async function platformBuild(opts = {}) {
 }
 
 // src/commands/platform-deploy.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname11, join as join19 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { dirname as dirname11, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 
 // src/deploy/bootstrap.ts
 var {spawn: spawn4 } = globalThis.Bun;
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync13 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, join as join17 } from "path";
+import { dirname as dirname9, join as join18 } from "path";
 
 // src/deploy/ansible.ts
 import { spawn as nodeSpawn } from "child_process";
 import { existsSync as existsSync11, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
 import { homedir, tmpdir } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/deploy/assets.ts
 var TERRAFORM_MAIN_TF = `terraform {
@@ -36057,28 +35988,28 @@ var ASSETS = {
 };
 async function materializeAssets(targetDir, files) {
   const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync10 } = await import("fs");
-  const { join: join12 } = await import("path");
+  const { join: join13 } = await import("path");
   mkdirSync10(targetDir, { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    writeFileSync10(join12(targetDir, name), content);
+    writeFileSync10(join13(targetDir, name), content);
   }
 }
 
 // src/deploy/ansible.ts
 function pickSshKeyForAnsible(configured) {
   if (configured) {
-    const expanded = configured.startsWith("~") ? join12(homedir(), configured.slice(1)) : configured;
+    const expanded = configured.startsWith("~") ? join13(homedir(), configured.slice(1)) : configured;
     return existsSync11(expanded) ? expanded : null;
   }
   for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
-    const path4 = join12(homedir(), ".ssh", name);
+    const path4 = join13(homedir(), ".ssh", name);
     if (existsSync11(path4))
       return path4;
   }
   return null;
 }
 async function runAnsible(inputs) {
-  const workDir = join12(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
+  const workDir = join13(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
   mkdirSync10(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.ansible);
   const user = inputs.asRoot ? "root" : inputs.target.user;
@@ -36095,7 +36026,7 @@ async function runAnsible(inputs) {
     ""
   ].join(`
 `);
-  writeFileSync10(join12(workDir, "inventory.ini"), inventory);
+  writeFileSync10(join13(workDir, "inventory.ini"), inventory);
   const extraVarsJson = JSON.stringify({
     username: inputs.target.user,
     ssh_port: port,
@@ -37143,10 +37074,10 @@ import { spawn as nodeSpawn2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 async function runTerraform(inputs) {
   const wsHash = createHash2("sha256").update(inputs.workspaceDir).digest("hex").slice(0, 16);
-  const workDir = join13(homedir2(), ".arc-deploy", wsHash, "tf");
+  const workDir = join14(homedir2(), ".arc-deploy", wsHash, "tf");
   mkdirSync11(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.terraform);
   const sshPubKey = inputs.tf.sshPublicKey ?? expandHome("~/.ssh/id_ed25519.pub");
@@ -37163,7 +37094,7 @@ async function runTerraform(inputs) {
   ].join(`
 `) + `
 `;
-  writeFileSync11(join13(workDir, "terraform.tfvars"), tfvars);
+  writeFileSync11(join14(workDir, "terraform.tfvars"), tfvars);
   await runTf(workDir, ["init", "-input=false", "-no-color"]);
   await runTf(workDir, [
     "apply",
@@ -37221,20 +37152,20 @@ function expandHome(p) {
 }
 
 // src/deploy/config.ts
-import { existsSync as existsSync14, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "fs";
+import { join as join16 } from "path";
 
 // src/deploy/env-file.ts
-import { appendFileSync, existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { appendFileSync, existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 function loadDeployEnvFiles(rootDir, envNames) {
-  const globalsPath = join14(rootDir, "deploy.arc.env");
-  const globals = existsSync13(globalsPath) ? parseEnvFile(readFileSync11(globalsPath, "utf-8"), globalsPath) : {};
+  const globalsPath = join15(rootDir, "deploy.arc.env");
+  const globals = existsSync13(globalsPath) ? parseEnvFile(readFileSync12(globalsPath, "utf-8"), globalsPath) : {};
   const perEnv = {};
   for (const name of envNames) {
-    const envPath = join14(rootDir, `deploy.arc.${name}.env`);
+    const envPath = join15(rootDir, `deploy.arc.${name}.env`);
     if (existsSync13(envPath)) {
-      perEnv[name] = parseEnvFile(readFileSync11(envPath, "utf-8"), envPath);
+      perEnv[name] = parseEnvFile(readFileSync12(envPath, "utf-8"), envPath);
     }
   }
   return { globals, perEnv };
@@ -37250,16 +37181,16 @@ function ensurePersistedSecret(rootDir, scope, key, generate) {
   if (process.env[key])
     return process.env[key];
   const fileName = scope === "globals" ? "deploy.arc.env" : `deploy.arc.${scope}.env`;
-  const path4 = join14(rootDir, fileName);
+  const path4 = join15(rootDir, fileName);
   if (existsSync13(path4)) {
-    const existing = parseEnvFile(readFileSync11(path4, "utf-8"), path4);
+    const existing = parseEnvFile(readFileSync12(path4, "utf-8"), path4);
     if (existing[key]) {
       process.env[key] = existing[key];
       return existing[key];
     }
   }
   const value = generate();
-  const prefix = existsSync13(path4) && !readFileSync11(path4, "utf-8").endsWith(`
+  const prefix = existsSync13(path4) && !readFileSync12(path4, "utf-8").endsWith(`
 `) ? `
 ` : "";
   appendFileSync(path4, `${prefix}${key}=${value}
@@ -37295,7 +37226,7 @@ function parseEnvFile(content, pathForErrors) {
 // src/deploy/config.ts
 var DEPLOY_CONFIG_FILE = "deploy.arc.json";
 function deployConfigPath(rootDir) {
-  return join15(rootDir, DEPLOY_CONFIG_FILE);
+  return join16(rootDir, DEPLOY_CONFIG_FILE);
 }
 function deployConfigExists(rootDir) {
   return existsSync14(deployConfigPath(rootDir));
@@ -37305,7 +37236,7 @@ function loadDeployConfig(rootDir) {
   if (!existsSync14(path4)) {
     throw new Error(`Missing ${DEPLOY_CONFIG_FILE} at ${path4}`);
   }
-  const raw = readFileSync12(path4, "utf-8");
+  const raw = readFileSync13(path4, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -37328,7 +37259,7 @@ function loadDeployConfig(rootDir) {
 }
 function saveDeployConfig(rootDir, cfg) {
   const path4 = deployConfigPath(rootDir);
-  const raw = existsSync14(path4) ? JSON.parse(readFileSync12(path4, "utf-8")) : {};
+  const raw = existsSync14(path4) ? JSON.parse(readFileSync13(path4, "utf-8")) : {};
   raw.target = { ...raw.target, ...cfg.target };
   writeFileSync12(path4, JSON.stringify(raw, null, 2) + `
 `);
@@ -37541,14 +37472,14 @@ function cfgErr(path4, expected) {
 var {spawn: spawn3 } = globalThis.Bun;
 import { existsSync as existsSync15 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function pickSshKey(target) {
   if (target.sshKey) {
-    const expanded = target.sshKey.startsWith("~") ? join16(homedir3(), target.sshKey.slice(1)) : target.sshKey;
+    const expanded = target.sshKey.startsWith("~") ? join17(homedir3(), target.sshKey.slice(1)) : target.sshKey;
     return existsSync15(expanded) ? expanded : null;
   }
   for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
-    const path4 = join16(homedir3(), ".ssh", name);
+    const path4 = join17(homedir3(), ".ssh", name);
     if (existsSync15(path4))
       return path4;
   }
@@ -37784,7 +37715,7 @@ async function isRegistryRunning(cfg) {
 }
 async function upStack(inputs) {
   const { cfg } = inputs;
-  const workDir = join17(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
+  const workDir = join18(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
   mkdirSync12(workDir, { recursive: true });
   await assertRegistryDnsResolves(cfg);
   const password = process.env[cfg.registry.passwordEnv];
@@ -37792,9 +37723,9 @@ async function upStack(inputs) {
     throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set. ` + `Set it (e.g. \`export ${cfg.registry.passwordEnv}=...\`) before bootstrap.`);
   }
   const htpasswdLine = await generateHtpasswd(cfg.registry.username, password);
-  writeFileSync13(join17(workDir, "htpasswd"), htpasswdLine);
-  writeFileSync13(join17(workDir, "Caddyfile"), generateCaddyfile(cfg));
-  writeFileSync13(join17(workDir, "docker-compose.yml"), generateCompose({ cfg }));
+  writeFileSync13(join18(workDir, "htpasswd"), htpasswdLine);
+  writeFileSync13(join18(workDir, "Caddyfile"), generateCaddyfile(cfg));
+  writeFileSync13(join18(workDir, "docker-compose.yml"), generateCompose({ cfg }));
   let observabilityFiles = null;
   let observabilityHtpasswd = null;
   if (cfg.observability?.enabled) {
@@ -37806,30 +37737,30 @@ async function upStack(inputs) {
     }
     observabilityHtpasswd = await generateCaddyBasicAuthLine("admin", adminPassword);
     for (const [relPath, contents] of Object.entries(observabilityFiles)) {
-      const fullPath = join17(workDir, relPath);
+      const fullPath = join18(workDir, relPath);
       mkdirSync12(dirname9(fullPath), { recursive: true });
       writeFileSync13(fullPath, contents);
     }
-    writeFileSync13(join17(workDir, "observability-htpasswd"), observabilityHtpasswd);
+    writeFileSync13(join18(workDir, "observability-htpasswd"), observabilityHtpasswd);
   }
   await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
   for (const name of Object.keys(cfg.envs)) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
   }
   await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/registry-auth`);
-  await scpUpload(cfg.target, join17(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
-  await scpUpload(cfg.target, join17(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
-  await scpUpload(cfg.target, join17(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
+  await scpUpload(cfg.target, join18(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
+  await scpUpload(cfg.target, join18(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
+  await scpUpload(cfg.target, join18(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
   if (observabilityFiles && observabilityHtpasswd) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/observability/grafana-dashboards`);
     for (const relPath of Object.keys(observabilityFiles)) {
-      const localDir = dirname9(join17(workDir, relPath));
+      const localDir = dirname9(join18(workDir, relPath));
       mkdirSync12(localDir, { recursive: true });
     }
     for (const relPath of Object.keys(observabilityFiles)) {
-      await scpUpload(cfg.target, join17(workDir, relPath), `${cfg.target.remoteDir}/${relPath}`);
+      await scpUpload(cfg.target, join18(workDir, relPath), `${cfg.target.remoteDir}/${relPath}`);
     }
-    await scpUpload(cfg.target, join17(workDir, "observability-htpasswd"), `${cfg.target.remoteDir}/observability-htpasswd`);
+    await scpUpload(cfg.target, join18(workDir, "observability-htpasswd"), `${cfg.target.remoteDir}/observability-htpasswd`);
   }
   await assertExec(cfg.target, `touch ${cfg.target.remoteDir}/.env`);
   if (cfg.observability?.enabled) {
@@ -37997,12 +37928,12 @@ import {
   copyFileSync as copyFileSync2,
   existsSync as existsSync16,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   realpathSync as realpathSync2,
   writeFileSync as writeFileSync14
 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, join as join18 } from "path";
+import { dirname as dirname10, join as join19 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/deploy/image-template.ts
@@ -38052,7 +37983,7 @@ function generateDockerfile(inputs) {
 // src/deploy/image.ts
 async function buildImage(ws, opts) {
   await ensureDocker();
-  const manifestPath = join18(ws.arcDir, "manifest.json");
+  const manifestPath = join19(ws.arcDir, "manifest.json");
   if (!existsSync16(manifestPath)) {
     throw new Error(`No build manifest at ${manifestPath}. Run \`arc platform build\` first or omit --skip-build.`);
   }
@@ -38063,9 +37994,9 @@ async function buildImage(ws, opts) {
   const dockerfileInputs = collectDockerfileInputs(ws);
   const dockerfile = generateDockerfile(dockerfileInputs);
   const buildContextDir = ws.rootDir;
-  const dockerfileDir = join18(tmpdir3(), `arc-image-${Date.now()}`);
+  const dockerfileDir = join19(tmpdir3(), `arc-image-${Date.now()}`);
   mkdirSync13(dockerfileDir, { recursive: true });
-  const dockerfilePath = join18(dockerfileDir, "Dockerfile");
+  const dockerfilePath = join19(dockerfileDir, "Dockerfile");
   writeFileSync14(dockerfilePath, dockerfile);
   const buildArgs = [
     "build",
@@ -38091,19 +38022,19 @@ async function buildImage(ws, opts) {
 }
 function embedCliBundle(ws) {
   const source = locateCliBundle();
-  const target = join18(ws.arcDir, "host.js");
+  const target = join19(ws.arcDir, "host.js");
   copyFileSync2(source, target);
 }
 function locateCliBundle() {
   const here = fileURLToPath7(import.meta.url);
   let cur = dirname10(here);
   while (cur !== "/" && cur !== "") {
-    const candidate = join18(cur, "package.json");
+    const candidate = join19(cur, "package.json");
     if (existsSync16(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync13(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync14(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
-          const distIndex = join18(realpathSync2(cur), "dist", "index.js");
+          const distIndex = join19(realpathSync2(cur), "dist", "index.js");
           if (!existsSync16(distIndex)) {
             throw new Error(`arc-cli bundle missing at ${distIndex}. Run \`bun run build\` in packages/cli/.`);
           }
@@ -38136,17 +38067,17 @@ async function ensureDocker() {
   }
 }
 function computeContentHash(manifestPath) {
-  const raw = JSON.parse(readFileSync13(manifestPath, "utf-8"));
+  const raw = JSON.parse(readFileSync14(manifestPath, "utf-8"));
   delete raw.buildTime;
   const canonical = JSON.stringify(raw);
   return createHash3("sha256").update(canonical).digest("hex").slice(0, 12);
 }
 function collectDockerfileInputs(ws) {
-  const hasPublicDir = existsSync16(join18(ws.rootDir, "public"));
-  const hasLocales = existsSync16(join18(ws.rootDir, "locales"));
+  const hasPublicDir = existsSync16(join19(ws.rootDir, "public"));
+  const hasLocales = existsSync16(join19(ws.rootDir, "locales"));
   let manifestPath;
   for (const name of ["manifest.webmanifest", "manifest.json"]) {
-    if (existsSync16(join18(ws.rootDir, name))) {
+    if (existsSync16(join19(ws.rootDir, name))) {
       manifestPath = name;
       break;
     }
@@ -38975,7 +38906,7 @@ async function platformDeploy(envArg, options = {}) {
     err(`Unknown env "${envArg}". Known: ${Object.keys(cfg.envs).join(", ")}`);
     process.exit(1);
   })() : Object.keys(cfg.envs);
-  const manifestPath = join19(ws.arcDir, "manifest.json");
+  const manifestPath = join20(ws.arcDir, "manifest.json");
   if (!options.imageTag) {
     const needBuild = options.rebuild || !existsSync17(manifestPath);
     if (needBuild && !options.skipBuild) {
@@ -39048,9 +38979,9 @@ function readCliVersion2() {
     let cur = dirname11(fileURLToPath8(import.meta.url));
     const root = dirname11(cur).startsWith("/") ? "/" : ".";
     while (cur !== root && cur !== "") {
-      const candidate = join19(cur, "package.json");
+      const candidate = join20(cur, "package.json");
       if (existsSync17(candidate)) {
-        const pkg = JSON.parse(readFileSync14(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync15(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
           return pkg.version ?? "unknown";
         }
@@ -39066,8 +38997,8 @@ function readCliVersion2() {
   }
 }
 async function hashDeployConfig(rootDir) {
-  const p2 = join19(rootDir, "deploy.arc.json");
-  const content = readFileSync14(p2);
+  const p2 = join20(rootDir, "deploy.arc.json");
+  const content = readFileSync15(p2);
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   hasher.update(readCliVersion2());
@@ -39075,8 +39006,8 @@ async function hashDeployConfig(rootDir) {
 }
 
 // src/platform/startup.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15, watch } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync16, watch } from "fs";
+import { join as join22 } from "path";
 
 // ../host/src/create-server.ts
 var import_jsonwebtoken = __toESM(require_jsonwebtoken(), 1);
@@ -40496,7 +40427,7 @@ async function createArcServer(config) {
 // src/platform/server.ts
 init_i18n();
 import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 async function resolveDbAdapterFactory(dbPath) {
   const databaseUrl = process.env.DATABASE_URL;
   if (databaseUrl && databaseUrl.length > 0) {
@@ -40628,15 +40559,13 @@ function parseArcTokensHeader(header) {
   return payloads;
 }
 async function filterManifestForTokens(manifest, moduleAccessMap, tokenPayloads) {
-  const allowedGroups = new Set;
+  const tokensByName = new Map;
   for (const t of tokenPayloads) {
     if (t?.tokenType)
-      allowedGroups.add(t.tokenType);
+      tokensByName.set(t.tokenType, t);
   }
   const filteredGroups = {};
   for (const [name, group] of Object.entries(manifest.groups)) {
-    if (!allowedGroups.has(name))
-      continue;
     let allGranted = true;
     for (const moduleName of group.modules) {
       const access = moduleAccessMap.get(moduleName);
@@ -40644,9 +40573,7 @@ async function filterManifestForTokens(manifest, moduleAccessMap, tokenPayloads)
         continue;
       let granted = false;
       for (const rule of access.rules) {
-        if (rule.token.name !== name)
-          continue;
-        const matching = tokenPayloads.find((t) => t.tokenType === name);
+        const matching = tokensByName.get(rule.token.name);
         if (!matching)
           continue;
         granted = rule.check ? await rule.check(matching) : true;
@@ -40687,28 +40614,28 @@ function staticFilesHandler(ws, devMode, getManifest) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join20(ws.browserDir, file), {
+      return serveFile(join21(ws.browserDir, file), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     }
     if (path4.startsWith("/locales/"))
-      return serveFile(join20(ws.arcDir, path4.slice(1)), {
+      return serveFile(join21(ws.arcDir, path4.slice(1)), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=300,stale-while-revalidate=3600"
       });
     if (path4.startsWith("/assets/"))
-      return serveFile(join20(ws.assetsDir, path4.slice(8)), {
+      return serveFile(join21(ws.assetsDir, path4.slice(8)), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     if (path4 === "/styles.css")
-      return serveFile(join20(ws.arcDir, "styles.css"), {
+      return serveFile(join21(ws.arcDir, "styles.css"), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     if (path4 === "/theme.css")
-      return serveFile(join20(ws.arcDir, "theme.css"), {
+      return serveFile(join21(ws.arcDir, "theme.css"), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
@@ -40716,7 +40643,7 @@ function staticFilesHandler(ws, devMode, getManifest) {
       return serveFile(ws.manifest.path, ctx.corsHeaders);
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
-      const publicFile = join20(ws.publicDir, path4.slice(1));
+      const publicFile = join21(ws.publicDir, path4.slice(1));
       if (existsSync18(publicFile))
         return serveFile(publicFile, ctx.corsHeaders);
     }
@@ -40871,7 +40798,7 @@ async function startPlatformServer(opts) {
       stop: () => server.stop()
     };
   }
-  const dbPath = opts.dbPath || join20(ws.arcDir, "data", "arc.db");
+  const dbPath = opts.dbPath || join21(ws.arcDir, "data", "arc.db");
   const baseDbFactory = await resolveDbAdapterFactory(dbPath);
   let dbAdapterFactory = baseDbFactory;
   if (telemetry) {
@@ -40912,17 +40839,17 @@ async function startPlatformServer(opts) {
 async function startPlatform(opts) {
   const { ws, devMode } = opts;
   const port = opts.port ?? parseInt(process.env.PORT || "5005", 10);
-  const dbPath = opts.dbPath ?? join21(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
+  const dbPath = opts.dbPath ?? join22(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
   let manifest;
   if (devMode) {
     manifest = await buildAll(ws);
   } else {
-    const manifestPath = join21(ws.arcDir, "manifest.json");
+    const manifestPath = join22(ws.arcDir, "manifest.json");
     if (!existsSync19(manifestPath)) {
       err("No build found. Run `arc platform build` first.");
       process.exit(1);
     }
-    manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync16(manifestPath, "utf-8"));
   }
   log2("Loading server context...");
   const { context: context2, moduleAccess } = await loadServerContext(ws);
@@ -40998,7 +40925,7 @@ function attachDevWatcher(ws, platform3) {
     }, 300);
   };
   for (const pkg of ws.packages) {
-    const srcDir = join21(pkg.path, "src");
+    const srcDir = join22(pkg.path, "src");
     if (!existsSync19(srcDir))
       continue;
     watch(srcDir, { recursive: true }, (_event, filename) => {
@@ -41009,7 +40936,7 @@ function attachDevWatcher(ws, platform3) {
       triggerRebuild();
     });
   }
-  const localesDir = join21(ws.rootDir, "locales");
+  const localesDir = join22(ws.rootDir, "locales");
   if (existsSync19(localesDir)) {
     watch(localesDir, { recursive: false }, (_event, filename) => {
       if (!filename?.endsWith(".po"))