@arcote.tech/arc-cli 0.7.20 → 0.7.21

package/dist/index.js

@@ -853,7 +853,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -34723,6 +34723,17 @@ function serverExternalsPlugin() {
     }
   };
 }
+function workspaceSourcePlugin(srcByName) {
+  return {
+    name: "workspace-source",
+    setup(build2) {
+      build2.onResolve({ filter: /^[^./]/ }, (args) => {
+        const src = srcByName.get(args.path);
+        return src ? { path: src, sideEffects: true } : null;
+      });
+    }
+  };
+}
 function jsxDevShimPlugin() {
   return {
     name: "jsx-dev-runtime-shim",
@@ -34743,9 +34754,10 @@ export { Fragment };
   };
 }
 var CONTEXT_CLIENTS = [
-  { name: "server", target: "bun", defines: { ONLY_SERVER: "true", ONLY_BROWSER: "false", ONLY_CLIENT: "false" } },
   { name: "browser", target: "browser", defines: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" } }
 ];
+var SERVER_DEFINES = { ONLY_SERVER: "true", ONLY_BROWSER: "false", ONLY_CLIENT: "false" };
+var SERVER_ENTRY_FILE = "_server.js";
 function discoverPackages(rootDir) {
   const rootPkg = JSON.parse(readFileSync7(join8(rootDir, "package.json"), "utf-8"));
   const workspaceGlobs = rootPkg.workspaces ?? [];
@@ -34838,9 +34850,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   console.log(`  building: ${pkg.name} (${client.name})`);
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
   const allDeps = pkg.packageJson.dependencies ?? {};
-  const isBrowser2 = client.name === "browser";
-  const workspaceDeps = isBrowser2 ? Object.keys(allDeps) : Object.entries(allDeps).filter(([, spec]) => !spec.startsWith("workspace:")).map(([name]) => name);
-  const externals = [...peerDeps, ...workspaceDeps];
+  const externals = [...peerDeps, ...Object.keys(allDeps)];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
     outdir: join8(outDir, "main"),
@@ -34848,7 +34858,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
     format: "esm",
     naming: "index.[ext]",
     external: externals,
-    plugins: isBrowser2 ? [jsxDevShimPlugin()] : [jsxDevShimPlugin(), serverExternalsPlugin()],
+    plugins: [jsxDevShimPlugin()],
     define: client.defines
   });
   if (!result.success) {
@@ -34911,6 +34921,80 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
   }
   return { declarationErrors };
 }
+async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
+  const contexts = packages.filter((p) => isContextPackage(p.packageJson));
+  mkdirSync6(serverDir, { recursive: true });
+  const srcByName = new Map(packages.map((p) => [p.name, p.entrypoint]));
+  const externalSet = new Set(FRAMEWORK_PEERS);
+  for (const p of packages) {
+    for (const name of Object.keys(p.packageJson.peerDependencies ?? {})) {
+      externalSet.add(name);
+    }
+    for (const [name, spec] of Object.entries(p.packageJson.dependencies ?? {})) {
+      if (!spec.startsWith("workspace:"))
+        externalSet.add(name);
+    }
+  }
+  const external = [...externalSet];
+  const unitId = "server-app";
+  const inputHash = sha256OfJson({
+    members: packages.map((p) => ({ name: p.name, src: pkgSourceHash(p) })).sort((a, b) => a.name.localeCompare(b.name)),
+    contexts: contexts.map((p) => p.name).sort(),
+    external: [...external].sort(),
+    defines: SERVER_DEFINES
+  });
+  const entryFileAbs = join8(serverDir, SERVER_ENTRY_FILE);
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [entryFileAbs])) {
+    console.log(`  \u2713 cached: ${unitId}`);
+    return { entryFile: SERVER_ENTRY_FILE, cached: true };
+  }
+  console.log(`  building: ${unitId} (${contexts.length} server modules)`);
+  for (const f of readdirSync4(serverDir)) {
+    if (f.endsWith(".js"))
+      rmSync(join8(serverDir, f), { force: true });
+  }
+  const tmpDir = join8(serverDir, "_entries");
+  mkdirSync6(tmpDir, { recursive: true });
+  const entrySrc = join8(tmpDir, SERVER_ENTRY_FILE.replace(/\.js$/, ".ts"));
+  writeFileSync6(entrySrc, contexts.map((p) => `import "${p.name}";`).join(`
+`) + `
+`);
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: [entrySrc],
+      outdir: serverDir,
+      target: "bun",
+      format: "esm",
+      splitting: true,
+      naming: "[name].[ext]",
+      external,
+      plugins: [
+        jsxDevShimPlugin(),
+        serverExternalsPlugin(),
+        workspaceSourcePlugin(srcByName)
+      ],
+      define: SERVER_DEFINES
+    });
+  } finally {
+    rmSync(tmpDir, { recursive: true, force: true });
+  }
+  if (!result.success) {
+    for (const log2 of result.logs)
+      console.error(log2);
+    throw new Error("Server app build failed");
+  }
+  const entryOut = result.outputs.find((o) => o.kind === "entry-point");
+  if (!entryOut) {
+    throw new Error("Server app build: entry not found in outputs");
+  }
+  if (basename2(entryOut.path) !== SERVER_ENTRY_FILE) {
+    throw new Error(`Server app build: unexpected entry name ${basename2(entryOut.path)} (wanted ${SERVER_ENTRY_FILE})`);
+  }
+  const outputHash = sha256OfDir(serverDir);
+  updateCache(cache, unitId, inputHash, { outputHash });
+  return { entryFile: SERVER_ENTRY_FILE, cached: false };
+}
 async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollector) {
   mkdirSync6(outDir, { recursive: true });
   const publicMembers = plan.groups.get("public") ?? [];
@@ -35216,11 +35300,8 @@ import {
   writeFileSync as writeFileSync7
 } from "fs";
 import { join as join9 } from "path";
-async function extractAccessMap(rootDir, packages) {
-  const serverBundles = packages.filter((p) => isContextPackage(p.packageJson)).map((p) => ({
-    name: p.name,
-    path: join9(p.path, "dist", "server", "main", "index.js")
-  })).filter((b) => existsSync8(b.path));
+async function extractAccessMap(rootDir, serverBundlePath) {
+  const serverBundles = existsSync8(serverBundlePath) ? [{ name: "server", path: serverBundlePath }] : [];
   const workerDir = join9(rootDir, ".arc", ".tmp");
   mkdirSync7(workerDir, { recursive: true });
   const workerPath = join9(workerDir, `access-extractor-${Date.now()}.mjs`);
@@ -35549,8 +35630,9 @@ async function buildAll(ws, opts = {}) {
   log2(`Building (concurrency parallel${noCache ? ", no-cache" : ""})...`);
   assertOneModulePerPackage(ws.packages);
   await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
-  copyContextServerBundles(ws);
-  const accessMap = await extractAccessMap(ws.rootDir, ws.packages);
+  const serverDir = join12(ws.arcDir, "server");
+  const { entryFile: serverEntry } = await buildServerApp(ws.rootDir, serverDir, ws.packages, cache, noCache);
+  const accessMap = await extractAccessMap(ws.rootDir, join12(serverDir, serverEntry));
   mkdirSync9(ws.arcDir, { recursive: true });
   writeFileSync9(join12(ws.arcDir, "access.json"), JSON.stringify(accessMap, null, 2) + `
 `);
@@ -35581,22 +35663,6 @@ function assembleManifest(ws, browser, cache) {
     buildTime: new Date().toISOString()
   };
 }
-function copyContextServerBundles(ws) {
-  const outDir = join12(ws.arcDir, "server");
-  mkdirSync9(outDir, { recursive: true });
-  for (const pkg of ws.packages) {
-    if (!isContextPackage(pkg.packageJson))
-      continue;
-    const src = join12(pkg.path, "dist", "server", "main", "index.js");
-    if (!existsSync10(src)) {
-      err(`Server bundle missing for ${pkg.name}: ${src}`);
-      continue;
-    }
-    const safeName = pkg.path.split("/").pop();
-    const dst = join12(outDir, `${safeName}.js`);
-    copyFileSync(src, dst);
-  }
-}
 function resolveAssetSource(from, pkgDir, rootDir) {
   if (from.startsWith("./") || from.startsWith("../")) {
     const resolved = join12(pkgDir, from);
@@ -35692,34 +35758,15 @@ async function loadServerContext(ws) {
   const platformPkg = JSON.parse(readFileSync11(join12(platformDir, "package.json"), "utf-8"));
   const platformEntry = join12(platformDir, platformPkg.main ?? "src/index.ts");
   await import(platformEntry);
-  const serverDir = join12(ws.arcDir, "server");
-  const bundles = existsSync10(serverDir) ? readdirSync6(serverDir).filter((f) => f.endsWith(".js")) : [];
-  if (bundles.length > 0) {
-    for (const file of bundles) {
-      const bundlePath = join12(serverDir, file);
-      try {
-        await import(bundlePath);
-      } catch (e) {
-        err(`Failed to load server bundle ${file}: ${e}`);
-      }
-    }
-  } else if (ws.packages.length > 0) {
-    const ctxPackages = ws.packages.filter((p) => isContextPackage(p.packageJson));
-    for (const ctx of ctxPackages) {
-      const serverDist = join12(ctx.path, "dist", "server", "main", "index.js");
-      if (!existsSync10(serverDist)) {
-        err(`Context server dist not found: ${serverDist}`);
-        continue;
-      }
-      try {
-        await import(serverDist);
-      } catch (e) {
-        err(`Failed to load server context from ${ctx.name}: ${e}`);
-      }
-    }
-  } else {
+  const serverEntry = join12(ws.arcDir, "server", SERVER_ENTRY_FILE);
+  if (!existsSync10(serverEntry)) {
     return { context: null, moduleAccess: new Map };
   }
+  try {
+    await import(serverEntry);
+  } catch (e) {
+    err(`Failed to load server bundle ${SERVER_ENTRY_FILE}: ${e}`);
+  }
   const { getContext, getAllModuleAccess } = await import(platformEntry);
   return {
     context: getContext() ?? null,
@@ -36553,8 +36600,13 @@ ${envNames.map((name) => `            - "https://${cfg.envs[name].domain}"`).joi
 
   # Per-container CPU / memory / network / block-IO + restarts straight from
   # the Docker daemon (socket bind-mounted read-only, see compose).
+  # api_version pinned: the receiver defaults to Docker API 1.25, which modern
+  # daemons (Engine 25+ require >= 1.40) reject \u2014 without this the receiver
+  # fails to start and takes the whole collector down. Quoted so YAML doesn't
+  # parse 1.40 \u2192 1.4. Must be <= the daemon's max; 1.40 is the safe floor.
   docker_stats:
     endpoint: unix:///var/run/docker.sock
+    api_version: "1.40"
     collection_interval: 30s
     metrics:
       container.restarts:
@@ -36824,6 +36876,15 @@ function generateAlloyConfig() {
 discovery.docker "containers" {
   host             = "unix:///var/run/docker.sock"
   refresh_interval = "15s"
+
+  // Only containers managed by a compose project (our stack). Ad-hoc / rogue
+  // containers (manual debug runs, other stacks) are excluded \u2014 one bad
+  // stream (e.g. log entries older than Loki's reject window) otherwise 400s
+  // the whole loki.write batch and drops good app logs with it.
+  filter {
+    name   = "label"
+    values = ["com.docker.compose.project"]
+  }
 }
 
 discovery.relabel "containers" {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.7.20",
+  "version": "0.7.21",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,13 +12,13 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform --external '@opentelemetry/*' && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.7.20",
-    "@arcote.tech/arc-ds": "^0.7.20",
-    "@arcote.tech/arc-react": "^0.7.20",
-    "@arcote.tech/arc-host": "^0.7.20",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.20",
-    "@arcote.tech/arc-adapter-db-postgres": "^0.7.20",
-    "@arcote.tech/arc-otel": "^0.7.20",
+    "@arcote.tech/arc": "^0.7.21",
+    "@arcote.tech/arc-ds": "^0.7.21",
+    "@arcote.tech/arc-react": "^0.7.21",
+    "@arcote.tech/arc-host": "^0.7.21",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.21",
+    "@arcote.tech/arc-adapter-db-postgres": "^0.7.21",
+    "@arcote.tech/arc-otel": "^0.7.21",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.57.0",
     "@opentelemetry/core": "^1.30.0",
@@ -31,7 +31,7 @@
     "@opentelemetry/sdk-trace-base": "^1.30.0",
     "@opentelemetry/sdk-trace-node": "^1.30.0",
     "@opentelemetry/semantic-conventions": "^1.27.0",
-    "@arcote.tech/platform": "^0.7.20",
+    "@arcote.tech/platform": "^0.7.21",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/src/builder/access-extractor.ts

@@ -7,7 +7,6 @@ import {
   writeFileSync,
 } from "fs";
 import { join } from "path";
-import { isContextPackage, type WorkspacePackage } from "./module-builder";
 
 // ---------------------------------------------------------------------------
 // access-extractor — discovers per-module access rules (`protectedBy(...)`)
@@ -27,8 +26,8 @@ import { isContextPackage, type WorkspacePackage } from "./module-builder";
 // non-context (pure-browser) packages are skipped. This is sensible: access
 // checks logically belong with server state, not display components.
 //
-// Order requirement: buildContextPackages MUST run before extractAccessMap
-// — server bundles at `packages/<pkg>/dist/server/main/index.js` must exist.
+// Order requirement: buildServerApp MUST run before extractAccessMap — the
+// combined server bundle at `<arcDir>/server/_server.js` must exist.
 // ---------------------------------------------------------------------------
 
 export interface SerializedAccessRule {
@@ -44,19 +43,16 @@ export type SerializedAccessMap = Record<string, SerializedModuleAccess>;
 
 export async function extractAccessMap(
   rootDir: string,
-  packages: readonly WorkspacePackage[],
+  serverBundlePath: string,
 ): Promise<SerializedAccessMap> {
-  // Each entry: a context-package server bundle path that the worker will
-  // dynamically import. Bun resolves the bundle's internal external imports
-  // (`@arcote.tech/platform` etc.) via node_modules walking from the bundle
-  // location — workspace symlinks point back to source.
-  const serverBundles = packages
-    .filter((p) => isContextPackage(p.packageJson))
-    .map((p) => ({
-      name: p.name,
-      path: join(p.path, "dist", "server", "main", "index.js"),
-    }))
-    .filter((b) => existsSync(b.path));
+  // The combined server bundle (`<arcDir>/server/_server.js`) side-effect-
+  // registers every module via the platform singleton when imported. The
+  // worker imports just this entry; Bun resolves its `chunk-<hash>.js` siblings
+  // and external peers (`@arcote.tech/platform` etc.) by walking node_modules
+  // from the bundle's directory.
+  const serverBundles = existsSync(serverBundlePath)
+    ? [{ name: "server", path: serverBundlePath }]
+    : [];
 
   // Worker must live INSIDE the workspace tree so Bun's module resolver can
   // walk up to <rootDir>/node_modules and find @arcote.tech/platform via the

package/src/builder/module-builder.ts

@@ -18,7 +18,7 @@ import {
   type BuildCache,
 } from "./build-cache";
 import type { ChunkPlan } from "./chunk-planner";
-import { SHELL_EXTERNALS } from "./framework-peers";
+import { SHELL_EXTERNALS, FRAMEWORK_PEERS } from "./framework-peers";
 import {
   readInstalledVersion,
   sha256Hex,
@@ -125,6 +125,43 @@ function serverExternalsPlugin(): import("bun").BunPlugin {
   };
 }
 
+/**
+ * SERVER bundles inline their workspace (`@ndt/*`) deps so each flattened
+ * `.arc/platform/server/<pkg>.js` is self-contained (the deploy image has no
+ * `node_modules/@ndt/*` tree). Bun would resolve a bare `@ndt/x` import through
+ * package.json `exports` to that dep's PRE-BUILT `dist/server/main/index.js` —
+ * an already-fully-inlined bundle. Nesting one fully-inlined bundle inside
+ * every consumer is catastrophic:
+ *   - diamonds duplicate the shared dep per graph edge (2^depth copies),
+ *   - dist/ is never wiped, so stale bombs from a previous dep graph keep
+ *     getting re-inlined across rebuilds.
+ * Result: bundles ballooned into the hundreds-of-MB / GB range (content =
+ * 1.1 GB, sizes lining up as powers of two by graph depth).
+ *
+ * This plugin pins every workspace package name to its SOURCE entrypoint
+ * (`src/index.ts`). The single Bun.build pass then includes each transitive
+ * module exactly once (Bun dedups by resolved path), so a server bundle is the
+ * size of its UNIQUE source closure — no nesting, no stale re-inlining.
+ *
+ * `sideEffects: true` keeps the dep's top-level `module(...).build()`
+ * registration from being tree-shaken when it's imported only for a named
+ * symbol (workspace packages ship `"sideEffects": false`).
+ */
+function workspaceSourcePlugin(srcByName: Map<string, string>): import("bun").BunPlugin {
+  return {
+    name: "workspace-source",
+    setup(build) {
+      // Bare specifiers only (skip relative `./` and absolute `/`). Non-
+      // workspace bare imports (react, @arcote.tech/*, npm deps) miss the map
+      // and fall through to the `external` list unchanged.
+      build.onResolve({ filter: /^[^./]/ }, (args) => {
+        const src = srcByName.get(args.path);
+        return src ? { path: src, sideEffects: true } : null;
+      });
+    },
+  };
+}
+
 function jsxDevShimPlugin(): import("bun").BunPlugin {
   return {
     name: "jsx-dev-runtime-shim",
@@ -145,12 +182,25 @@ export { Fragment };
   };
 }
 
-/** Clients that a context package is built for. */
+// Per-package context build is BROWSER-only. The server side is produced by a
+// single combined `buildServerApp` pass (see below) — bundling each package's
+// server context separately and inlining its deps' pre-built dist caused
+// catastrophic nested duplication (content.js hit 1.1 GB) and turned the
+// consumer's undeclared cyclic `@ndt/*` imports into broken init order. One
+// shared pass dedups every module once and is cycle-safe (same as the browser
+// app build).
 const CONTEXT_CLIENTS = [
-  { name: "server", target: "bun" as const, defines: { ONLY_SERVER: "true", ONLY_BROWSER: "false", ONLY_CLIENT: "false" } },
   { name: "browser", target: "browser" as const, defines: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" } },
 ];
 
+/** Server-side build defines — applied by the combined `buildServerApp` pass. */
+const SERVER_DEFINES = { ONLY_SERVER: "true", ONLY_BROWSER: "false", ONLY_CLIENT: "false" } as const;
+
+/** Filename of the combined server bundle entry under `<arcDir>/server/`.
+ *  loadServerContext + the access extractor import exactly this file; Bun's
+ *  auto-emitted `chunk-<hash>.js` siblings are pulled in transitively. */
+export const SERVER_ENTRY_FILE = "_server.js";
+
 export interface WorkspacePackage {
   name: string;
   path: string;
@@ -305,32 +355,16 @@ async function buildContextClient(
 
   console.log(`  building: ${pkg.name} (${client.name})`);
 
-  // Externals depend on the target client:
-  //
-  // - BROWSER client: workspace deps MUST be external. Inlining them per
-  //   package would make every context package's dist ship its own copy
-  //   of every workspace dep — the top-level browser Bun.build would see
-  //   N pre-inlined copies of context singletons (`WorkspaceContext =
-  //   createContext`) and could not dedupe them, breaking provider lookup.
-  //
-  // - SERVER client: workspace deps MUST be bundled inline. The deploy
-  //   image flattens each package's server bundle to
-  //   `.arc/platform/server/<pkg>.js` and runs them via a single
-  //   `loadServerContext()` import loop. There is no `node_modules/@ndt/*`
-  //   tree inside the image, so bare `@ndt/workspace` specifiers would
-  //   fail to resolve at startup. Inline duplication is harmless on the
-  //   server: it's a single Node/Bun process and Arc modules register via
-  //   a shared platform registry singleton (registry.ts), so two physical
-  //   copies of the workspace module still merge into one context.
+  // BROWSER client: every dep (workspace + npm + framework peers) is external.
+  // Inlining workspace deps per package would make each context package's dist
+  // ship its own copy of every workspace dep — the top-level browser Bun.build
+  // (`buildBrowserApp`) would then see N pre-inlined copies of context
+  // singletons (`WorkspaceContext = createContext`) and could not dedupe them,
+  // breaking provider lookup. The server side is handled separately by the
+  // combined `buildServerApp` pass.
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
   const allDeps = (pkg.packageJson.dependencies ?? {}) as Record<string, string>;
-  const isBrowser = client.name === "browser";
-  const workspaceDeps = isBrowser
-    ? Object.keys(allDeps)
-    : Object.entries(allDeps)
-        .filter(([, spec]) => !spec.startsWith("workspace:"))
-        .map(([name]) => name);
-  const externals = [...peerDeps, ...workspaceDeps];
+  const externals = [...peerDeps, ...Object.keys(allDeps)];
 
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
@@ -339,9 +373,7 @@ async function buildContextClient(
     format: "esm",
     naming: "index.[ext]",
     external: externals,
-    plugins: isBrowser
-      ? [jsxDevShimPlugin()]
-      : [jsxDevShimPlugin(), serverExternalsPlugin()],
+    plugins: [jsxDevShimPlugin()],
     define: client.defines,
   });
 
@@ -385,11 +417,13 @@ export async function buildContextPackages(
   const contexts = packages.filter((p) => isContextPackage(p.packageJson));
   if (contexts.length === 0) return { declarationErrors: [] };
 
-  // Topological order — each package's server bundle inlines its workspace
-  // deps, so those deps must have their `dist/` ready before Bun.build tries
-  // to resolve them. Without this, a fresh checkout (no dist/ yet) fails the
-  // first build because content's resolve of @ndt/strategy hits a missing
-  // file. Inside a topological level, packages are built in parallel.
+  // Topological order by declared `workspace:` deps. The browser BUNDLE
+  // externalizes every dep (order-independent), but the type-declaration pass
+  // (tsc) resolves `@ndt/x` types through that package's emitted
+  // `dist/browser/index.d.ts` — so a dep's declarations must exist before a
+  // dependent's decl build runs, else tsc reports "Cannot find module @ndt/x".
+  // The declared dep graph is acyclic; undeclared cyclic imports live in source
+  // only and don't affect this ordering. Inside a layer, packages build in parallel.
   const byName = new Map(contexts.map((p) => [p.name, p]));
   const remaining = new Set(contexts.map((p) => p.name));
   const done = new Set<string>();
@@ -440,6 +474,147 @@ export async function buildContextPackages(
   return { declarationErrors };
 }
 
+// ---------------------------------------------------------------------------
+// Combined server bundle — ONE Bun.build for ALL context packages' server side.
+//
+// Replaces N per-package server builds that each inlined their deps' PRE-BUILT
+// dist (`@ndt/x` → `x/dist/server/main/index.js`). That nested an already-
+// fully-inlined bundle inside every consumer: shared deps duplicated per graph
+// edge (content's server bundle reached 1.1 GB) and the consumer's undeclared
+// cyclic `@ndt/*` imports turned into broken module-init order.
+//
+// One shared pass with `splitting: true` — the same recipe as buildBrowserApp:
+//   - every module is bundled from SOURCE exactly once (Bun dedups by path),
+//   - `@ndt/*` workspace deps resolve to their `src/` entry (workspaceSourcePlugin)
+//     so nothing pulls a pre-built dist,
+//   - npm deps + framework peers stay external — the deploy image installs them
+//     into /app/node_modules via `.arc/platform/package.json` (collectFrameworkDeps),
+//   - splitting makes Bun emit eager top-level init, which is cycle-safe; the
+//     old non-split per-package build emitted lazy `__esm` wrappers that broke
+//     under the consumer's import cycles (`workspace.ids` was undefined).
+//
+// Output under `<arcDir>/server/`:
+//   _server.js          ← entry: side-effect-imports every context module
+//   chunk-<hash>.js × N ← auto-shared module chunks
+// loadServerContext + the access extractor import `_server.js`; chunks ride along.
+// ---------------------------------------------------------------------------
+
+export interface ServerAppResult {
+  readonly entryFile: string;
+  readonly cached: boolean;
+}
+
+export async function buildServerApp(
+  rootDir: string,
+  serverDir: string,
+  packages: WorkspacePackage[],
+  cache: BuildCache,
+  noCache: boolean,
+): Promise<ServerAppResult> {
+  void rootDir; // resolution is source-based; rootDir kept for signature parity
+  const contexts = packages.filter((p) => isContextPackage(p.packageJson));
+  mkdirSync(serverDir, { recursive: true });
+
+  // Every workspace package name → its SOURCE entry. Spans ALL packages, not
+  // just context ones — a context package imports non-context workspace libs
+  // (e.g. content-core) that must inline from source too.
+  const srcByName = new Map(packages.map((p) => [p.name, p.entrypoint]));
+
+  // External = framework peers + every non-workspace npm dep any package
+  // declares. NOT bundled; resolved at runtime from /app/node_modules (the
+  // deploy image installs exactly this set — collectFrameworkDeps). Only the
+  // `@ndt/*` workspace source is inlined.
+  const externalSet = new Set<string>(FRAMEWORK_PEERS);
+  for (const p of packages) {
+    for (const name of Object.keys(p.packageJson.peerDependencies ?? {})) {
+      externalSet.add(name);
+    }
+    for (const [name, spec] of Object.entries(
+      (p.packageJson.dependencies ?? {}) as Record<string, string>,
+    )) {
+      if (!spec.startsWith("workspace:")) externalSet.add(name);
+    }
+  }
+  const external = [...externalSet];
+
+  const unitId = "server-app";
+  const inputHash = sha256OfJson({
+    members: packages
+      .map((p) => ({ name: p.name, src: pkgSourceHash(p) }))
+      .sort((a, b) => a.name.localeCompare(b.name)),
+    contexts: contexts.map((p) => p.name).sort(),
+    external: [...external].sort(),
+    defines: SERVER_DEFINES,
+  });
+
+  const entryFileAbs = join(serverDir, SERVER_ENTRY_FILE);
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [entryFileAbs])) {
+    console.log(`  ✓ cached: ${unitId}`);
+    return { entryFile: SERVER_ENTRY_FILE, cached: true };
+  }
+
+  console.log(`  building: ${unitId} (${contexts.length} server modules)`);
+
+  // Wipe stale .js — old per-package flattened bundles AND previous chunks —
+  // so a smaller rebuild never leaves orphaned content-addressed chunks behind.
+  for (const f of readdirSync(serverDir)) {
+    if (f.endsWith(".js")) rmSync(join(serverDir, f), { force: true });
+  }
+
+  // Entry side-effect-imports every context module so each registers via the
+  // platform registry singleton. Written to a tmp subdir so it isn't shipped.
+  const tmpDir = join(serverDir, "_entries");
+  mkdirSync(tmpDir, { recursive: true });
+  const entrySrc = join(tmpDir, SERVER_ENTRY_FILE.replace(/\.js$/, ".ts"));
+  writeFileSync(
+    entrySrc,
+    contexts.map((p) => `import "${p.name}";`).join("\n") + "\n",
+  );
+
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: [entrySrc],
+      outdir: serverDir,
+      target: "bun",
+      format: "esm",
+      // splitting:true is the whole point — it makes Bun emit eager top-level
+      // init (cycle-safe) instead of lazy `__esm` wrappers. Shared modules land
+      // in chunk-<hash>.js referenced by the entry.
+      splitting: true,
+      naming: "[name].[ext]",
+      external,
+      plugins: [
+        jsxDevShimPlugin(),
+        serverExternalsPlugin(),
+        workspaceSourcePlugin(srcByName),
+      ],
+      define: SERVER_DEFINES,
+    });
+  } finally {
+    rmSync(tmpDir, { recursive: true, force: true });
+  }
+
+  if (!result.success) {
+    for (const log of result.logs) console.error(log);
+    throw new Error("Server app build failed");
+  }
+
+  const entryOut = result.outputs.find((o) => o.kind === "entry-point");
+  if (!entryOut) {
+    throw new Error("Server app build: entry not found in outputs");
+  }
+  if (basename(entryOut.path) !== SERVER_ENTRY_FILE) {
+    throw new Error(
+      `Server app build: unexpected entry name ${basename(entryOut.path)} (wanted ${SERVER_ENTRY_FILE})`,
+    );
+  }
+
+  const outputHash = sha256OfDir(serverDir);
+  updateCache(cache, unitId, inputHash, { outputHash });
+  return { entryFile: SERVER_ENTRY_FILE, cached: false };
+}
+
 
 // ---------------------------------------------------------------------------
 // Browser app build — one Bun.build with multiple entrypoints.

package/src/deploy/observability-configs.ts

@@ -87,8 +87,13 @@ ${envNames.map((name) => `            - "https://${cfg.envs[name]!.domain}"`).jo
 
   # Per-container CPU / memory / network / block-IO + restarts straight from
   # the Docker daemon (socket bind-mounted read-only, see compose).
+  # api_version pinned: the receiver defaults to Docker API 1.25, which modern
+  # daemons (Engine 25+ require >= 1.40) reject — without this the receiver
+  # fails to start and takes the whole collector down. Quoted so YAML doesn't
+  # parse 1.40 → 1.4. Must be <= the daemon's max; 1.40 is the safe floor.
   docker_stats:
     endpoint: unix:///var/run/docker.sock
+    api_version: "1.40"
     collection_interval: 30s
     metrics:
       container.restarts:
@@ -372,6 +377,15 @@ export function generateAlloyConfig(): string {
 discovery.docker "containers" {
   host             = "unix:///var/run/docker.sock"
   refresh_interval = "15s"
+
+  // Only containers managed by a compose project (our stack). Ad-hoc / rogue
+  // containers (manual debug runs, other stacks) are excluded — one bad
+  // stream (e.g. log entries older than Loki's reject window) otherwise 400s
+  // the whole loki.write batch and drops good app logs with it.
+  filter {
+    name   = "label"
+    values = ["com.docker.compose.project"]
+  }
 }
 
 discovery.relabel "containers" {

package/src/platform/shared.ts

@@ -4,10 +4,12 @@ import { dirname, join } from "path";
 import {
   buildBrowserApp,
   buildContextPackages,
+  buildServerApp,
   buildStyles,
   buildTranslations,
   discoverPackages,
   isContextPackage,
+  SERVER_ENTRY_FILE,
   type BrowserAppResult,
   type BuildManifest,
   type ModuleDescriptor,
@@ -161,20 +163,30 @@ export async function buildAll(
   // else chunk grouping (per-package) silently mis-assigns the extra module.
   assertOneModulePerPackage(ws.packages);
 
-  // Phase 1 — context packages must finish FIRST. The access-extractor
-  // subprocess imports workspace packages by name, which resolve through
-  // node_modules to packages' `main` field (typically `dist/server/main/`).
+  // Phase 1 — per-package BROWSER context bundles + type declarations.
   await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
 
-  // Phase 1b — relocate per-package server bundles into `.arc/platform/server/`
-  // so the deploy image can be self-contained (image COPY needs everything
-  // server-side under one root). loadServerContext reads from here in prod.
-  copyContextServerBundles(ws);
+  // Phase 1b — combined server bundle at `.arc/platform/server/_server.js`.
+  // ONE Bun.build for all context modules (deduped from source, cycle-safe)
+  // replaces the old per-package server bundles that nested each other's dist
+  // into multi-hundred-MB files. The deploy image COPYs this dir wholesale;
+  // loadServerContext + the access extractor import the entry, chunks ride along.
+  const serverDir = join(ws.arcDir, "server");
+  const { entryFile: serverEntry } = await buildServerApp(
+    ws.rootDir,
+    serverDir,
+    ws.packages,
+    cache,
+    noCache,
+  );
 
   // Phase 2 — extract access metadata (token name + hasCheck per module) in
-  // an isolated subprocess. This MUST run before chunk planning so we know
-  // which token group each module belongs to.
-  const accessMap = await extractAccessMap(ws.rootDir, ws.packages);
+  // an isolated subprocess that imports the combined server bundle. MUST run
+  // before chunk planning so we know which token group each module belongs to.
+  const accessMap = await extractAccessMap(
+    ws.rootDir,
+    join(serverDir, serverEntry),
+  );
 
   // Persist access map for the runtime host (server.ts reads at startup to
   // wire up moduleAccessMap for filterManifestForTokens / signed URLs).
@@ -242,34 +254,6 @@ function assembleManifest(
   };
 }
 
-// ---------------------------------------------------------------------------
-// Context server bundles — flatten to `<arcDir>/server/<safeName>.js`
-// ---------------------------------------------------------------------------
-
-/**
- * Copy each context package's compiled server bundle from
- * `packages/<pkg>/dist/server/main/index.js` to a flat location at
- * `<arcDir>/server/<safeName>.js`. The flat layout makes the deploy image
- * self-contained — `COPY .arc/platform/` pulls everything server-side, no
- * need to drag the entire `packages/` tree into the image.
- */
-function copyContextServerBundles(ws: WorkspaceInfo): void {
-  const outDir = join(ws.arcDir, "server");
-  mkdirSync(outDir, { recursive: true });
-
-  for (const pkg of ws.packages) {
-    if (!isContextPackage(pkg.packageJson)) continue;
-    const src = join(pkg.path, "dist", "server", "main", "index.js");
-    if (!existsSync(src)) {
-      err(`Server bundle missing for ${pkg.name}: ${src}`);
-      continue;
-    }
-    const safeName = pkg.path.split("/").pop()!;
-    const dst = join(outDir, `${safeName}.js`);
-    copyFileSync(src, dst);
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Browser assets — @arcote.tech/* deps deklarują w `arc.browserAssets` jakie
 // pliki muszą być dostępne w przeglądarce (np. SQLite WASM worker + .wasm).
@@ -419,44 +403,21 @@ export async function loadServerContext(
 
   await import(platformEntry);
 
-  // Primary source: flattened server bundles at `<arcDir>/server/<safeName>.js`.
+  // The combined server bundle lives at `<arcDir>/server/_server.js` (entry)
+  // next to its `chunk-<hash>.js` siblings. Importing the entry pulls the
+  // chunks transitively and registers every module via the platform singleton.
   // The deploy image only has this directory — there's no workspace `packages/`
-  // tree. In dev, `copyContextServerBundles` populates this same location, so
-  // both modes go through the same code path.
-  const serverDir = join(ws.arcDir, "server");
-  const bundles = existsSync(serverDir)
-    ? readdirSync(serverDir).filter((f) => f.endsWith(".js"))
-    : [];
-
-  if (bundles.length > 0) {
-    for (const file of bundles) {
-      const bundlePath = join(serverDir, file);
-      try {
-        await import(bundlePath);
-      } catch (e) {
-        err(`Failed to load server bundle ${file}: ${e}`);
-      }
-    }
-  } else if (ws.packages.length > 0) {
-    // Fallback for the "no .arc/platform/server/ yet" case (e.g. somebody
-    // wired up loadServerContext before running the build). This path goes
-    // through workspace packages directly — only meaningful in dev.
-    const ctxPackages = ws.packages.filter((p) => isContextPackage(p.packageJson));
-    for (const ctx of ctxPackages) {
-      const serverDist = join(ctx.path, "dist", "server", "main", "index.js");
-      if (!existsSync(serverDist)) {
-        err(`Context server dist not found: ${serverDist}`);
-        continue;
-      }
-      try {
-        await import(serverDist);
-      } catch (e) {
-        err(`Failed to load server context from ${ctx.name}: ${e}`);
-      }
-    }
-  } else {
+  // tree; dev and prod go through the exact same path.
+  const serverEntry = join(ws.arcDir, "server", SERVER_ENTRY_FILE);
+  if (!existsSync(serverEntry)) {
+    // No build yet (or a static-only workspace) — nothing to register.
     return { context: null, moduleAccess: new Map() };
   }
+  try {
+    await import(serverEntry);
+  } catch (e) {
+    err(`Failed to load server bundle ${SERVER_ENTRY_FILE}: ${e}`);
+  }
 
   const { getContext, getAllModuleAccess } = await import(platformEntry);
   return {

package/src/platform/startup.ts

@@ -62,8 +62,8 @@ export async function startPlatform(
   }
 
   // 2. Server context — same code path in both modes; loadServerContext
-  // prefers .arc/platform/server/*.js (the canonical location after the
-  // copyContextServerBundles step in buildAll).
+  // imports the combined server bundle at .arc/platform/server/_server.js
+  // (produced by the buildServerApp step in buildAll).
   log("Loading server context...");
   const { context, moduleAccess } = await loadServerContext(ws);
   if (context) {