@arcote.tech/arc-cli 0.7.32 → 0.8.1

package/dist/index.js

@@ -10204,11 +10204,18 @@ function notifyTokenChange(scope) {
 
 class AuthAdapter {
   scopes = new Map;
+  namespace;
+  constructor(options) {
+    this.namespace = options?.storageNamespace || undefined;
+  }
+  storageKey(scope) {
+    return this.namespace ? `${TOKEN_PREFIX}${this.namespace}:${scope}` : TOKEN_PREFIX + scope;
+  }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
       if (hasLocalStorage()) {
-        localStorage.removeItem(TOKEN_PREFIX + scope);
+        localStorage.removeItem(this.storageKey(scope));
         notifyTokenChange(scope);
       }
       return;
@@ -10218,7 +10225,7 @@ class AuthAdapter {
       if (parts.length !== 3) {
         this.scopes.delete(scope);
         if (hasLocalStorage())
-          localStorage.removeItem(TOKEN_PREFIX + scope);
+          localStorage.removeItem(this.storageKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -10232,13 +10239,13 @@ class AuthAdapter {
         }
       });
       if (hasLocalStorage()) {
-        localStorage.setItem(TOKEN_PREFIX + scope, token);
+        localStorage.setItem(this.storageKey(scope), token);
         notifyTokenChange(scope);
       }
     } catch {
       this.scopes.delete(scope);
       if (hasLocalStorage())
-        localStorage.removeItem(TOKEN_PREFIX + scope);
+        localStorage.removeItem(this.storageKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
@@ -10247,10 +10254,13 @@ class AuthAdapter {
   loadPersisted() {
     if (!hasLocalStorage())
       return;
+    const prefix = this.namespace ? `${TOKEN_PREFIX}${this.namespace}:` : TOKEN_PREFIX;
     for (let i = 0;i < localStorage.length; i++) {
       const key = localStorage.key(i);
-      if (key?.startsWith(TOKEN_PREFIX)) {
-        const scope = key.slice(TOKEN_PREFIX.length);
+      if (key?.startsWith(prefix)) {
+        const scope = key.slice(prefix.length);
+        if (!this.namespace && scope.includes(":"))
+          continue;
         const raw = localStorage.getItem(key);
         if (raw) {
           try {
@@ -10304,7 +10314,7 @@ class AuthAdapter {
   clear() {
     if (hasLocalStorage()) {
       for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(TOKEN_PREFIX + scope);
+        localStorage.removeItem(this.storageKey(scope));
       }
     }
     this.scopes.clear();
@@ -11393,6 +11403,8 @@ class ArcFunction {
       if (!tokenInstance) {
         return false;
       }
+      if (!protection.check)
+        continue;
       const result = await protection.check(tokenInstance);
       if (result === false) {
         return false;
@@ -17839,11 +17851,18 @@ function notifyTokenChange2(scope) {
 
 class AuthAdapter2 {
   scopes = new Map;
+  namespace;
+  constructor(options) {
+    this.namespace = options?.storageNamespace || undefined;
+  }
+  storageKey(scope) {
+    return this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:${scope}` : TOKEN_PREFIX2 + scope;
+  }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
       if (hasLocalStorage2()) {
-        localStorage.removeItem(TOKEN_PREFIX2 + scope);
+        localStorage.removeItem(this.storageKey(scope));
         notifyTokenChange2(scope);
       }
       return;
@@ -17853,7 +17872,7 @@ class AuthAdapter2 {
       if (parts.length !== 3) {
         this.scopes.delete(scope);
         if (hasLocalStorage2())
-          localStorage.removeItem(TOKEN_PREFIX2 + scope);
+          localStorage.removeItem(this.storageKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -17867,13 +17886,13 @@ class AuthAdapter2 {
         }
       });
       if (hasLocalStorage2()) {
-        localStorage.setItem(TOKEN_PREFIX2 + scope, token);
+        localStorage.setItem(this.storageKey(scope), token);
         notifyTokenChange2(scope);
       }
     } catch {
       this.scopes.delete(scope);
       if (hasLocalStorage2())
-        localStorage.removeItem(TOKEN_PREFIX2 + scope);
+        localStorage.removeItem(this.storageKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
@@ -17882,10 +17901,13 @@ class AuthAdapter2 {
   loadPersisted() {
     if (!hasLocalStorage2())
       return;
+    const prefix = this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:` : TOKEN_PREFIX2;
     for (let i = 0;i < localStorage.length; i++) {
       const key = localStorage.key(i);
-      if (key?.startsWith(TOKEN_PREFIX2)) {
-        const scope = key.slice(TOKEN_PREFIX2.length);
+      if (key?.startsWith(prefix)) {
+        const scope = key.slice(prefix.length);
+        if (!this.namespace && scope.includes(":"))
+          continue;
         const raw = localStorage.getItem(key);
         if (raw) {
           try {
@@ -17939,7 +17961,7 @@ class AuthAdapter2 {
   clear() {
     if (hasLocalStorage2()) {
       for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(TOKEN_PREFIX2 + scope);
+        localStorage.removeItem(this.storageKey(scope));
       }
     }
     this.scopes.clear();
@@ -19028,6 +19050,8 @@ class ArcFunction2 {
       if (!tokenInstance) {
         return false;
       }
+      if (!protection.check)
+        continue;
       const result = await protection.check(tokenInstance);
       if (result === false) {
         return false;
@@ -31298,20 +31322,20 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname8, join as join12 } from "path";
+import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname8, join as join13 } from "path";
 
 // src/builder/module-builder.ts
 import { execSync } from "child_process";
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync7,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync8,
   readdirSync as readdirSync4,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync6
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { basename as basename2, dirname as dirname6, join as join8, relative as relative3 } from "path";
+import { basename as basename3, dirname as dirname6, join as join9, relative as relative3 } from "path";
 import { builtinModules } from "module";
 init_i18n();
 init_compile();
@@ -31390,10 +31414,21 @@ var FRAMEWORK_PEERS = [...ARC_PEERS, ...REACT_PEERS];
 var SHELL_EXTERNALS = [
   ...FRAMEWORK_PEERS,
   "react/jsx-runtime",
-  "react/jsx-dev-runtime"
+  "react-dom/client"
 ];
 var FRAMEWORK_PEER_SET = new Set(FRAMEWORK_PEERS);
 var SHELL_EXTERNAL_SET = new Set(SHELL_EXTERNALS);
+function shortNameOf(pkg) {
+  if (pkg === "@arcote.tech/platform")
+    return "platform";
+  if (pkg.startsWith("@arcote.tech/"))
+    return pkg.slice("@arcote.tech/".length);
+  return pkg;
+}
+
+// src/builder/peer-shell.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename2, join as join8 } from "path";
 
 // src/builder/hash.ts
 import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync } from "fs";
@@ -31474,6 +31509,88 @@ function mtimeOf(path4) {
   }
 }
 
+// src/builder/peer-shell.ts
+var RUNTIME_GLOBAL = "__ARC_RT";
+function peerVersion(rootDir, pkg) {
+  try {
+    const p = JSON.parse(readFileSync7(join8(rootDir, "node_modules", pkg, "package.json"), "utf-8"));
+    return p.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function namedExportsOf(specifier) {
+  try {
+    const mod = await import(specifier);
+    return Object.keys(mod).filter((k) => k !== "default" && /^[A-Za-z_$][\w$]*$/.test(k));
+  } catch {
+    return [];
+  }
+}
+function runtimeExposePrelude() {
+  const lines = SHELL_EXTERNALS.map((spec, i) => `import * as __rt${i} from ${JSON.stringify(spec)};`);
+  const assigns = SHELL_EXTERNALS.map((spec, i) => `  ${JSON.stringify(spec)}: (__rt${i}.default ?? __rt${i}),
+  ${JSON.stringify(spec + "#ns")}: __rt${i},`);
+  return lines.join(`
+`) + `
+globalThis.${RUNTIME_GLOBAL} = Object.assign(globalThis.${RUNTIME_GLOBAL} ?? {}, {
+` + assigns.join(`
+`) + `
+});
+`;
+}
+async function buildPeerShell(rootDir, outDir, cache, noCache) {
+  mkdirSync6(outDir, { recursive: true });
+  const peers = {};
+  for (const pkg of FRAMEWORK_PEERS)
+    peers[pkg] = peerVersion(rootDir, pkg);
+  const namedBySpec = {};
+  for (const spec of SHELL_EXTERNALS)
+    namedBySpec[spec] = await namedExportsOf(spec);
+  const unitId = "peer-shell";
+  const inputHash = sha256OfJson({
+    peers,
+    externals: SHELL_EXTERNALS,
+    named: namedBySpec,
+    mode: "globalThis",
+    rev: 5
+  });
+  if (!noCache && isCacheHit(cache, unitId, inputHash)) {
+    const cached = cache.units[unitId]?.outputHashes;
+    if (cached?._manifest) {
+      try {
+        const m = JSON.parse(cached._manifest);
+        const files = Object.values(m.imports).map((p) => basename2(p));
+        if (files.every((f) => existsSync7(join8(outDir, f)))) {
+          console.log(`  \u2713 cached: ${unitId}`);
+          return { ...m, cached: true };
+        }
+      } catch {}
+    }
+  }
+  console.log(`  building: ${unitId} (${SHELL_EXTERNALS.length} peers, globalThis)`);
+  const imports = {};
+  for (const specifier of SHELL_EXTERNALS) {
+    const short = shortNameOf(specifier).replace(/\//g, "-");
+    const named = namedBySpec[specifier] ?? [];
+    const src = `const M = globalThis.${RUNTIME_GLOBAL}[${JSON.stringify(specifier)}];
+const N = globalThis.${RUNTIME_GLOBAL}[${JSON.stringify(specifier + "#ns")}] ?? M;
+export default M;
+` + named.map((n) => `export const ${n} = N[${JSON.stringify(n)}];`).join(`
+`) + `
+`;
+    const hash = sha256Hex(src).slice(0, 16);
+    const finalName = `${short}.${hash}.js`;
+    writeFileSync6(join8(outDir, finalName), src);
+    imports[specifier] = `/shell/${finalName}`;
+  }
+  const manifest = { imports, peers, cached: false };
+  updateCache(cache, unitId, inputHash, {
+    outputHashes: { _manifest: JSON.stringify(manifest) }
+  });
+  return manifest;
+}
+
 // src/builder/parallel.ts
 import { cpus } from "os";
 var DEFAULT_CONCURRENCY = Math.max(1, cpus().length - 1);
@@ -31527,10 +31644,10 @@ function isBuiltinSpec(spec) {
 function versionFromImporter(importer, name) {
   let dir = importer ? dirname6(importer) : "";
   while (dir && dir !== dirname6(dir)) {
-    const pj = join8(dir, "package.json");
-    if (existsSync7(pj)) {
+    const pj = join9(dir, "package.json");
+    if (existsSync8(pj)) {
       try {
-        const json = JSON.parse(readFileSync7(pj, "utf-8"));
+        const json = JSON.parse(readFileSync8(pj, "utf-8"));
         const spec = json.dependencies?.[name] ?? json.peerDependencies?.[name] ?? json.devDependencies?.[name];
         if (typeof spec === "string")
           return spec;
@@ -31584,11 +31701,7 @@ function jsxDevShimPlugin() {
         namespace: "jsx-dev-shim"
       }));
       build2.onLoad({ filter: /.*/, namespace: "jsx-dev-shim" }, () => ({
-        contents: `import { jsx, jsxs, Fragment } from "react/jsx-runtime";
-export const jsxDEV = jsx;
-export const jsxsDEV = jsxs;
-export { Fragment };
-`,
+        contents: `export { jsx as jsxDEV, jsxs as jsxsDEV, Fragment } from "react/jsx-runtime";`,
         loader: "ts"
       }));
     }
@@ -31601,13 +31714,13 @@ var SERVER_DEFINES = { ONLY_SERVER: "true", ONLY_BROWSER: "false", ONLY_CLIENT:
 var SERVER_ENTRY_FILE = "_server.js";
 var SERVER_EXTERNALS_FILE = "_externals.json";
 function discoverPackages(rootDir) {
-  const rootPkg = JSON.parse(readFileSync7(join8(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf-8"));
   const workspaceGlobs = rootPkg.workspaces ?? [];
   const results = [];
   for (const glob2 of workspaceGlobs) {
     const base2 = glob2.replace("/*", "");
-    const baseDir = join8(rootDir, base2);
-    if (!existsSync7(baseDir))
+    const baseDir = join9(rootDir, base2);
+    if (!existsSync8(baseDir))
       continue;
     let entries;
     try {
@@ -31616,25 +31729,25 @@ function discoverPackages(rootDir) {
       continue;
     }
     for (const entry of entries) {
-      const pkgPath = join8(baseDir, entry, "package.json");
-      if (!existsSync7(pkgPath))
+      const pkgPath = join9(baseDir, entry, "package.json");
+      if (!existsSync8(pkgPath))
         continue;
-      const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
       if (pkg.name?.startsWith("@arcote.tech/"))
         continue;
-      const pkgDir = join8(baseDir, entry);
+      const pkgDir = join9(baseDir, entry);
       const candidates = [
-        join8(pkgDir, "src", "index.ts"),
-        join8(pkgDir, "src", "index.tsx"),
-        join8(pkgDir, "index.ts"),
-        join8(pkgDir, "index.tsx")
+        join9(pkgDir, "src", "index.ts"),
+        join9(pkgDir, "src", "index.tsx"),
+        join9(pkgDir, "index.ts"),
+        join9(pkgDir, "index.tsx")
       ];
-      const entrypoint = candidates.find((c) => existsSync7(c)) ?? null;
+      const entrypoint = candidates.find((c) => existsSync8(c)) ?? null;
       if (!entrypoint)
         continue;
       results.push({
         name: pkg.name,
-        path: join8(baseDir, entry),
+        path: join9(baseDir, entry),
         entrypoint,
         packageJson: pkg
       });
@@ -31663,7 +31776,7 @@ var sourceFilter = (rel) => {
   return true;
 };
 function pkgSourceHash(pkg) {
-  return sha256OfDir(join8(pkg.path, "src"), sourceFilter);
+  return sha256OfDir(join9(pkg.path, "src"), sourceFilter);
 }
 function depVersionsHash(rootDir, pkg) {
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
@@ -31676,7 +31789,7 @@ function depVersionsHash(rootDir, pkg) {
 }
 async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const unitId = `context-pkg:${pkg.name}:${client.name}`;
-  const outDir = join8(pkg.path, "dist", client.name);
+  const outDir = join9(pkg.path, "dist", client.name);
   const inputHash = sha256OfJson({
     src: pkgSourceHash(pkg),
     pkg: pkg.packageJson,
@@ -31685,7 +31798,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
     target: client.target,
     defines: client.defines
   });
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(outDir, "main", "index.js")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(outDir, "main", "index.js")])) {
     console.log(`  \u2713 cached: ${pkg.name} (${client.name})`);
     return { pkgName: pkg.name, client: client.name, declarationErrors: [], cached: true };
   }
@@ -31695,7 +31808,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const externals = [...peerDeps, ...Object.keys(allDeps)];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
-    outdir: join8(outDir, "main"),
+    outdir: join9(outDir, "main"),
     target: client.target,
     format: "esm",
     naming: "index.[ext]",
@@ -31765,7 +31878,7 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
 }
 async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
   const contexts = packages.filter((p) => isContextPackage(p.packageJson));
-  mkdirSync6(serverDir, { recursive: true });
+  mkdirSync7(serverDir, { recursive: true });
   const srcByName = new Map(packages.map((p) => [p.name, p.entrypoint]));
   const externalSet = new Set(FRAMEWORK_PEERS);
   for (const p of packages) {
@@ -31786,8 +31899,8 @@ async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
     defines: SERVER_DEFINES,
     sourcemap: "linked"
   });
-  const entryFileAbs = join8(serverDir, SERVER_ENTRY_FILE);
-  const externalsFileAbs = join8(serverDir, SERVER_EXTERNALS_FILE);
+  const entryFileAbs = join9(serverDir, SERVER_ENTRY_FILE);
+  const externalsFileAbs = join9(serverDir, SERVER_EXTERNALS_FILE);
   if (!noCache && isCacheHit(cache, unitId, inputHash, [entryFileAbs])) {
     console.log(`  \u2713 cached: ${unitId}`);
     return {
@@ -31799,13 +31912,13 @@ async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
   console.log(`  building: ${unitId} (${contexts.length} server modules)`);
   for (const f of readdirSync4(serverDir)) {
     if (f.endsWith(".js") || f.endsWith(".js.map")) {
-      rmSync2(join8(serverDir, f), { force: true });
+      rmSync3(join9(serverDir, f), { force: true });
     }
   }
-  const tmpDir = join8(serverDir, "_entries");
-  mkdirSync6(tmpDir, { recursive: true });
-  const entrySrc = join8(tmpDir, SERVER_ENTRY_FILE.replace(/\.js$/, ".ts"));
-  writeFileSync6(entrySrc, contexts.map((p) => `import "${p.name}";`).join(`
+  const tmpDir = join9(serverDir, "_entries");
+  mkdirSync7(tmpDir, { recursive: true });
+  const entrySrc = join9(tmpDir, SERVER_ENTRY_FILE.replace(/\.js$/, ".ts"));
+  writeFileSync7(entrySrc, contexts.map((p) => `import "${p.name}";`).join(`
 `) + `
 `);
   const recorded = new Map;
@@ -31828,7 +31941,7 @@ async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
       define: SERVER_DEFINES
     });
   } finally {
-    rmSync2(tmpDir, { recursive: true, force: true });
+    rmSync3(tmpDir, { recursive: true, force: true });
   }
   if (!result.success) {
     for (const log2 of result.logs)
@@ -31839,31 +31952,33 @@ async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
   if (!entryOut) {
     throw new Error("Server app build: entry not found in outputs");
   }
-  if (basename2(entryOut.path) !== SERVER_ENTRY_FILE) {
-    throw new Error(`Server app build: unexpected entry name ${basename2(entryOut.path)} (wanted ${SERVER_ENTRY_FILE})`);
+  if (basename3(entryOut.path) !== SERVER_ENTRY_FILE) {
+    throw new Error(`Server app build: unexpected entry name ${basename3(entryOut.path)} (wanted ${SERVER_ENTRY_FILE})`);
   }
   const externals = [...recorded].filter(([name]) => !FRAMEWORK_PEER_SET.has(name)).map(([name, version]) => ({ name, version })).sort((a, b) => a.name.localeCompare(b.name));
-  writeFileSync6(externalsFileAbs, JSON.stringify(externals, null, 2) + `
+  writeFileSync7(externalsFileAbs, JSON.stringify(externals, null, 2) + `
 `);
   const outputHash = sha256OfDir(serverDir);
   updateCache(cache, unitId, inputHash, { outputHash });
   return { entryFile: SERVER_ENTRY_FILE, cached: false, externals };
 }
 function readServerExternals(path4) {
-  if (!existsSync7(path4))
+  if (!existsSync8(path4))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync7(path4, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(path4, "utf-8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch {
     return [];
   }
 }
-async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollector) {
-  mkdirSync6(outDir, { recursive: true });
+async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollector, opts) {
+  const federated = opts?.federated ?? false;
+  const exposeRuntime = opts?.exposeRuntime ?? false;
+  mkdirSync7(outDir, { recursive: true });
   const publicMembers = plan.groups.get("public") ?? [];
   const protectedGroups = plan.chunks.filter((c) => c !== "public").map((c) => ({ name: c, members: plan.groups.get(c) ?? [] })).filter((g) => g.members.length > 0);
-  const unitId = "browser-app";
+  const unitId = opts?.unitId ?? "browser-app";
   const allMembers = [];
   for (const m of publicMembers) {
     allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg) });
@@ -31879,7 +31994,11 @@ async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollec
       "initial",
       ...protectedGroups.map((g) => g.name).sort()
     ],
-    define: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" }
+    define: { ONLY_SERVER: "false", ONLY_BROWSER: "true", ONLY_CLIENT: "true" },
+    federated,
+    exposeRuntime,
+    externals: federated ? [...SHELL_EXTERNALS] : [],
+    builderRev: 3
   });
   if (!noCache && isCacheHit(cache, unitId, inputHash)) {
     const cached = cache.units[unitId]?.outputHashes;
@@ -31891,7 +32010,7 @@ async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollec
           ...Object.values(m.groups).map((g) => g.file),
           ...m.sharedChunks
         ];
-        if (allFiles.every((f) => existsSync7(join8(outDir, f)))) {
+        if (allFiles.every((f) => existsSync8(join9(outDir, f)))) {
           console.log(`  \u2713 cached: ${unitId}`);
           return { ...m, cached: true };
         }
@@ -31899,25 +32018,26 @@ async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollec
     }
   }
   console.log(`  building: ${unitId} (initial: ${publicMembers.length} modules, groups: ${protectedGroups.map((g) => `${g.name}=${g.members.length}`).join(",") || "none"})`);
-  if (existsSync7(outDir)) {
+  if (existsSync8(outDir)) {
     for (const f of readdirSync4(outDir)) {
       if (f.endsWith(".js"))
-        rmSync2(join8(outDir, f), { force: true });
+        rmSync3(join9(outDir, f), { force: true });
     }
   }
-  const tmpDir = join8(outDir, "_entries");
-  mkdirSync6(tmpDir, { recursive: true });
+  const tmpDir = join9(outDir, "_entries");
+  mkdirSync7(tmpDir, { recursive: true });
   const importLines = (pkgs) => pkgs.map((m) => `import "${m.pkg.name}";`).join(`
 `);
-  const initialEntry = join8(tmpDir, "initial.ts");
-  writeFileSync6(initialEntry, `${importLines(publicMembers)}
+  const initialEntry = join9(tmpDir, "initial.ts");
+  writeFileSync7(initialEntry, (exposeRuntime ? runtimeExposePrelude() + `
+` : "") + `${importLines(publicMembers)}
 export { startApp } from "@arcote.tech/platform";
 `);
   const entryPaths = [initialEntry];
   const groupModuleMap = new Map;
   for (const g of protectedGroups) {
-    const entry = join8(tmpDir, `${g.name}.ts`);
-    writeFileSync6(entry, `${importLines(g.members)}
+    const entry = join9(tmpDir, `${g.name}.ts`);
+    writeFileSync7(entry, `${importLines(g.members)}
 `);
     entryPaths.push(entry);
     groupModuleMap.set(g.name, g.members.map((m) => m.moduleName));
@@ -31930,15 +32050,15 @@ export { startApp } from "@arcote.tech/platform";
       allMemberPkgs.set(m.pkg.name, m.pkg);
   const patchedPkgJsons = [];
   for (const pkg of allMemberPkgs.values()) {
-    const pkgJsonPath = join8(pkg.path, "package.json");
-    if (!existsSync7(pkgJsonPath))
+    const pkgJsonPath = join9(pkg.path, "package.json");
+    if (!existsSync8(pkgJsonPath))
       continue;
-    const original = readFileSync7(pkgJsonPath, "utf-8");
+    const original = readFileSync8(pkgJsonPath, "utf-8");
     const parsed = JSON.parse(original);
     if (parsed.sideEffects === true)
       continue;
     parsed.sideEffects = true;
-    writeFileSync6(pkgJsonPath, JSON.stringify(parsed, null, 2) + `
+    writeFileSync7(pkgJsonPath, JSON.stringify(parsed, null, 2) + `
 `);
     patchedPkgJsons.push({ path: pkgJsonPath, original });
   }
@@ -31950,9 +32070,9 @@ export { startApp } from "@arcote.tech/platform";
       splitting: true,
       format: "esm",
       target: "browser",
-      external: [],
+      external: federated ? [...SHELL_EXTERNALS] : [],
       plugins: [
-        singleReactPlugin(rootDir),
+        ...federated ? [] : [singleReactPlugin(rootDir)],
         jsxDevShimPlugin(),
         i18nExtractPlugin(i18nCollector, rootDir)
       ],
@@ -31966,9 +32086,9 @@ export { startApp } from "@arcote.tech/platform";
     });
   } finally {
     for (const p of patchedPkgJsons)
-      writeFileSync6(p.path, p.original);
+      writeFileSync7(p.path, p.original);
   }
-  rmSync2(tmpDir, { recursive: true, force: true });
+  rmSync3(tmpDir, { recursive: true, force: true });
   if (!result.success) {
     for (const log2 of result.logs)
       console.error(log2);
@@ -31979,16 +32099,16 @@ export { startApp } from "@arcote.tech/platform";
   const groups = {};
   const sharedChunks = [];
   for (const out of result.outputs) {
-    const name = basename2(out.path);
+    const name = basename3(out.path);
     if (out.kind === "entry-point") {
-      const bytes = readFileSync7(out.path);
+      const bytes = readFileSync8(out.path);
       const hash = sha256Hex(bytes).slice(0, 16);
       const stem = name.replace(/\.js$/, "");
       const finalName = `${stem}.${hash}.js`;
-      const finalPath = join8(outDir, finalName);
-      rmSync2(finalPath, { force: true });
-      writeFileSync6(finalPath, bytes);
-      rmSync2(out.path, { force: true });
+      const finalPath = join9(outDir, finalName);
+      rmSync3(finalPath, { force: true });
+      writeFileSync7(finalPath, bytes);
+      rmSync3(out.path, { force: true });
       if (stem === "initial") {
         initialFile = finalName;
         initialHash = hash;
@@ -32018,21 +32138,21 @@ export { startApp } from "@arcote.tech/platform";
   return manifest;
 }
 async function buildTranslations(rootDir, arcDir, cache, noCache) {
-  const localesDir = join8(rootDir, "locales");
-  if (!existsSync7(localesDir))
+  const localesDir = join9(rootDir, "locales");
+  if (!existsSync8(localesDir))
     return;
   const unitId = "translations";
-  const poFiles = readdirSync4(localesDir).filter((f) => f.endsWith(".po")).map((f) => join8(localesDir, f));
+  const poFiles = readdirSync4(localesDir).filter((f) => f.endsWith(".po")).map((f) => join9(localesDir, f));
   if (poFiles.length === 0)
     return;
   const inputHash = sha256OfFiles(poFiles);
-  if (!noCache && isCacheHit(cache, unitId, inputHash, [join8(arcDir, "locales")])) {
+  if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(arcDir, "locales")])) {
     console.log(`  \u2713 cached: translations`);
     return;
   }
   console.log(`  building: translations (${poFiles.length} catalog(s))`);
-  compileAllCatalogs(localesDir, join8(arcDir, "locales"));
-  const jsonFiles = readdirSync4(join8(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join8(arcDir, "locales", f));
+  compileAllCatalogs(localesDir, join9(arcDir, "locales"));
+  const jsonFiles = readdirSync4(join9(arcDir, "locales")).filter((f) => f.endsWith(".json")).map((f) => join9(arcDir, "locales", f));
   const outputHash = sha256OfFiles(jsonFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
 }
@@ -32099,10 +32219,10 @@ var TAILWIND_INPUT_TEMPLATE = (rootRel) => `@import "tailwindcss";
 }
 `;
 async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache) {
-  mkdirSync6(arcDir, { recursive: true });
-  const inputCss = join8(arcDir, "_input.css");
-  const outputCss = join8(arcDir, "styles.css");
-  const themeOutput = join8(arcDir, "theme.css");
+  mkdirSync7(arcDir, { recursive: true });
+  const inputCss = join9(arcDir, "_input.css");
+  const outputCss = join9(arcDir, "styles.css");
+  const themeOutput = join9(arcDir, "theme.css");
   const rootRel = relative3(arcDir, rootDir).replace(/\\/g, "/");
   const inputCssContent = TAILWIND_INPUT_TEMPLATE(rootRel);
   const tsxFilter = (rel) => {
@@ -32114,15 +32234,15 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
   };
   const wsHashes = {};
   for (const p of packages) {
-    wsHashes[p.name] = sha256OfDir(join8(p.path, "src"), tsxFilter);
+    wsHashes[p.name] = sha256OfDir(join9(p.path, "src"), tsxFilter);
   }
-  const platformSrc = join8(rootDir, "node_modules", "@arcote.tech", "platform", "src");
-  const arcDsSrc = join8(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
+  const platformSrc = join9(rootDir, "node_modules", "@arcote.tech", "platform", "src");
+  const arcDsSrc = join9(rootDir, "node_modules", "@arcote.tech", "arc-ds", "src");
   const frameworkHashes = {
     platform: sha256OfDir(platformSrc, tsxFilter),
     arcDs: sha256OfDir(arcDsSrc, tsxFilter)
   };
-  const themeContent = themePath && existsSync7(join8(rootDir, themePath)) ? readFileSync7(join8(rootDir, themePath)) : null;
+  const themeContent = themePath && existsSync8(join9(rootDir, themePath)) ? readFileSync8(join9(rootDir, themePath)) : null;
   const themeHash = themeContent ? sha256Hex(themeContent) : null;
   const unitId = "styles";
   const inputHash = sha256OfJson({
@@ -32139,16 +32259,16 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
     return;
   }
   console.log(`  building: styles`);
-  writeFileSync6(inputCss, inputCssContent);
+  writeFileSync7(inputCss, inputCssContent);
   execSync(`bunx @tailwindcss/cli -i ${inputCss} -o ${outputCss} --minify`, {
     cwd: rootDir,
     stdio: "inherit"
   });
   if (themePath && themeContent) {
-    writeFileSync6(themeOutput, themeContent);
+    writeFileSync7(themeOutput, themeContent);
   }
   const outFiles = [outputCss];
-  if (themePath && existsSync7(themeOutput))
+  if (themePath && existsSync8(themeOutput))
     outFiles.push(themeOutput);
   const outputHash = sha256OfFiles(outFiles);
   updateCache(cache, unitId, inputHash, { outputHash });
@@ -32157,20 +32277,20 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
 // src/builder/access-extractor.ts
 var {spawn: spawn2 } = globalThis.Bun;
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync8,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync9,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 async function extractAccessMap(rootDir, serverBundlePath) {
-  const serverBundles = existsSync8(serverBundlePath) ? [{ name: "server", path: serverBundlePath }] : [];
-  const workerDir = join9(rootDir, ".arc", ".tmp");
-  mkdirSync7(workerDir, { recursive: true });
-  const workerPath = join9(workerDir, `access-extractor-${Date.now()}.mjs`);
-  const outPath = join9(workerDir, `access-${Date.now()}.json`);
-  writeFileSync7(workerPath, WORKER_SOURCE);
+  const serverBundles = existsSync9(serverBundlePath) ? [{ name: "server", path: serverBundlePath }] : [];
+  const workerDir = join10(rootDir, ".arc", ".tmp");
+  mkdirSync8(workerDir, { recursive: true });
+  const workerPath = join10(workerDir, `access-extractor-${Date.now()}.mjs`);
+  const outPath = join10(workerDir, `access-${Date.now()}.json`);
+  writeFileSync8(workerPath, WORKER_SOURCE);
   try {
     const proc2 = spawn2({
       cmd: ["bun", "run", workerPath],
@@ -32187,7 +32307,7 @@ async function extractAccessMap(rootDir, serverBundlePath) {
     if (exit !== 0) {
       throw new Error(`access-extractor subprocess exited with ${exit}`);
     }
-    return JSON.parse(readFileSync8(outPath, "utf-8"));
+    return JSON.parse(readFileSync9(outPath, "utf-8"));
   } finally {
     try {
       unlinkSync2(workerPath);
@@ -32224,23 +32344,35 @@ for (const { name, path } of bundles) {
   }
 }
 
-const result = {};
-for (const [name, access] of platform.getAllModuleAccess()) {
-  result[name] = {
-    rules: (access.rules ?? []).map((r) => ({
+const access = {};
+for (const [name, a] of platform.getAllModuleAccess()) {
+  access[name] = {
+    rules: (a.rules ?? []).map((r) => ({
       token: { name: r.token?.name ?? "" },
       hasCheck: typeof r.check === "function",
     })),
   };
 }
 
+const exposure = {};
+const getExposure = platform.getAllModuleExposure;
+if (typeof getExposure === "function") {
+  for (const [name, e] of getExposure()) {
+    exposure[name] = {
+      exposure: e.exposure,
+      permissions: e.permissions ?? [],
+      slots: e.slots ?? [],
+    };
+  }
+}
+
 const { writeFileSync } = await import("node:fs");
-writeFileSync(out, JSON.stringify(result, null, 2) + "\\n");
+writeFileSync(out, JSON.stringify({ access, exposure }, null, 2) + "\\n");
 `.trim();
 
 // src/builder/chunk-planner.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
-import { basename as basename3, join as join10 } from "path";
+import { readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
+import { basename as basename4, join as join11 } from "path";
 var PUBLIC_CHUNK = "public";
 function planChunks(packages, accessMap) {
   const assignments = new Map;
@@ -32253,7 +32385,7 @@ function planChunks(packages, accessMap) {
       pkg,
       chunk,
       moduleName,
-      safeName: basename3(pkg.path)
+      safeName: basename4(pkg.path)
     };
     assignments.set(moduleName, entry);
     const bucket = groups.get(chunk);
@@ -32283,7 +32415,7 @@ function collectModuleNames(dir, acc) {
   for (const e of entries) {
     if (e === "node_modules" || e === "dist")
       continue;
-    const full = join10(dir, e);
+    const full = join11(dir, e);
     let isDir = false;
     try {
       isDir = statSync2(full).isDirectory();
@@ -32293,7 +32425,7 @@ function collectModuleNames(dir, acc) {
     if (isDir) {
       collectModuleNames(full, acc);
     } else if (e.endsWith(".ts") || e.endsWith(".tsx")) {
-      const src = readFileSync9(full, "utf-8");
+      const src = readFileSync10(full, "utf-8");
       MODULE_CALL.lastIndex = 0;
       let m;
       while (m = MODULE_CALL.exec(src))
@@ -32305,7 +32437,7 @@ function assertOneModulePerPackage(packages) {
   const offenders = [];
   for (const pkg of packages) {
     const names = new Set;
-    collectModuleNames(join10(pkg.path, "src"), names);
+    collectModuleNames(join11(pkg.path, "src"), names);
     if (names.size > 1) {
       offenders.push({ pkg: pkg.name, modules: [...names].sort() });
     }
@@ -32337,11 +32469,11 @@ function resolveChunk(moduleName, access) {
 
 // src/builder/dependency-collector.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename4, dirname as dirname7, join as join11 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename5, dirname as dirname7, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], serverExternals = []) {
-  mkdirSync8(arcDir, { recursive: true });
+  mkdirSync9(arcDir, { recursive: true });
   const versions = resolveFrameworkVersions(rootDir, packages);
   mergeServerExternals(versions, rootDir, packages, serverExternals);
   for (const { name, version } of sharedDeps) {
@@ -32350,7 +32482,7 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], server
   try {
     const cliDir = dirname7(fileURLToPath6(import.meta.url));
     const arcOtelPkgPath = Bun.resolveSync("@arcote.tech/arc-otel/package.json", cliDir);
-    const arcOtelPkg = JSON.parse(readFileSync10(arcOtelPkgPath, "utf-8"));
+    const arcOtelPkg = JSON.parse(readFileSync11(arcOtelPkgPath, "utf-8"));
     for (const [name, spec] of Object.entries(arcOtelPkg.dependencies ?? {})) {
       if (name.startsWith("@opentelemetry/")) {
         versions[name] = spec;
@@ -32361,10 +32493,10 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], server
     console.warn(`[arc-otel] could not resolve @arcote.tech/arc-otel \u2014 image will run without telemetry deps: ${e.message}`);
   }
   let rootArc;
-  const rootPkgPath = join11(rootDir, "package.json");
-  if (existsSync9(rootPkgPath)) {
+  const rootPkgPath = join12(rootDir, "package.json");
+  if (existsSync10(rootPkgPath)) {
     try {
-      const rootPkg = JSON.parse(readFileSync10(rootPkgPath, "utf-8"));
+      const rootPkg = JSON.parse(readFileSync11(rootPkgPath, "utf-8"));
       if (rootPkg.arc && typeof rootPkg.arc === "object")
         rootArc = rootPkg.arc;
     } catch {}
@@ -32376,11 +32508,11 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], server
     dependencies: versions,
     ...rootArc ? { arc: rootArc } : {}
   };
-  const manifestPath = join11(arcDir, "package.json");
-  writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
+  const manifestPath = join12(arcDir, "package.json");
+  writeFileSync9(manifestPath, JSON.stringify(manifest, null, 2) + `
 `);
-  const hash = sha256Hex2(readFileSync10(manifestPath));
-  writeFileSync8(join11(arcDir, ".deps-hash"), hash + `
+  const hash = sha256Hex2(readFileSync11(manifestPath));
+  writeFileSync9(join12(arcDir, ".deps-hash"), hash + `
 `);
   return { hash, manifestPath };
 }
@@ -32388,7 +32520,7 @@ function sha256Hex2(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
 function resolveFrameworkVersions(rootDir, packages) {
-  const rootPkg = JSON.parse(readFileSync10(join11(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync11(join12(rootDir, "package.json"), "utf-8"));
   const rootDeps = rootPkg.dependencies ?? {};
   const rootDevDeps = rootPkg.devDependencies ?? {};
   const required = new Set(FRAMEWORK_PEERS);
@@ -32419,7 +32551,7 @@ function findWorkspaceSpec(packages, name) {
   return;
 }
 function mergeServerExternals(versions, rootDir, packages, externals) {
-  const rootPkg = JSON.parse(readFileSync10(join11(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync11(join12(rootDir, "package.json"), "utf-8"));
   const rootDeps = rootPkg.dependencies ?? {};
   const rootDevDeps = rootPkg.devDependencies ?? {};
   for (const { name, version } of externals) {
@@ -32447,9 +32579,9 @@ function resolveWorkspace() {
     process.exit(1);
   }
   const rootDir = dirname8(packageJsonPath);
-  const rootPkg = JSON.parse(readFileSync11(packageJsonPath, "utf-8"));
+  const rootPkg = JSON.parse(readFileSync12(packageJsonPath, "utf-8"));
   const appName = rootPkg.name ?? "Arc App";
-  const arcDir = join12(rootDir, ".arc", "platform");
+  const arcDir = join13(rootDir, ".arc", "platform");
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
   if (packages.length > 0) {
@@ -32459,10 +32591,10 @@ function resolveWorkspace() {
   }
   let manifest;
   for (const name of ["manifest.json", "manifest.webmanifest"]) {
-    const manifestPath = join12(rootDir, name);
-    if (existsSync10(manifestPath)) {
+    const manifestPath = join13(rootDir, name);
+    if (existsSync11(manifestPath)) {
       try {
-        const data = JSON.parse(readFileSync11(manifestPath, "utf-8"));
+        const data = JSON.parse(readFileSync12(manifestPath, "utf-8"));
         const icons = data.icons;
         manifest = {
           path: manifestPath,
@@ -32481,9 +32613,9 @@ function resolveWorkspace() {
     rootPkg,
     appName,
     arcDir,
-    browserDir: join12(arcDir, "browser"),
-    assetsDir: join12(arcDir, "assets"),
-    publicDir: join12(rootDir, "public"),
+    browserDir: join13(arcDir, "browser"),
+    assetsDir: join13(arcDir, "assets"),
+    publicDir: join13(rootDir, "public"),
     packages,
     manifest
   };
@@ -32492,73 +32624,120 @@ async function buildAll(ws, opts = {}) {
   const cache = loadBuildCache(ws.arcDir);
   const noCache = opts.noCache ?? false;
   const themePath = ws.rootPkg.arc?.theme;
+  const federation = getFederationConfig(ws);
   log2(`Building (concurrency parallel${noCache ? ", no-cache" : ""})...`);
   assertOneModulePerPackage(ws.packages);
   await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
-  const serverDir = join12(ws.arcDir, "server");
+  const serverDir = join13(ws.arcDir, "server");
   const { entryFile: serverEntry, externals: serverExternals } = await buildServerApp(ws.rootDir, serverDir, ws.packages, cache, noCache);
-  const accessMap = await extractAccessMap(ws.rootDir, join12(serverDir, serverEntry));
-  mkdirSync9(ws.arcDir, { recursive: true });
-  writeFileSync9(join12(ws.arcDir, "access.json"), JSON.stringify(accessMap, null, 2) + `
+  const accessMap = await extractAccessMap(ws.rootDir, join13(serverDir, serverEntry));
+  mkdirSync10(ws.arcDir, { recursive: true });
+  writeFileSync10(join13(ws.arcDir, "access.json"), JSON.stringify(accessMap.access, null, 2) + `
 `);
-  const plan = planChunks(ws.packages, accessMap);
+  const isHost = Boolean(federation?.host);
+  const moduleNameOf2 = (name) => name.split("/").pop() ?? name;
+  const exposureOf = (pkgName) => accessMap.exposure[moduleNameOf2(pkgName)]?.exposure ?? "local";
+  const localPackages = isHost ? ws.packages : ws.packages.filter((p) => exposureOf(p.name) !== "external");
+  const fedPackages = ws.packages.filter((p) => ["external", "both"].includes(exposureOf(p.name)));
+  const hasFederatedModules = fedPackages.length > 0;
+  const needsPeerShell = isHost || hasFederatedModules;
+  log2();
+  const plan = planChunks(localPackages, accessMap.access);
   ok(`Chunks: ${plan.chunks.map((c) => `${c}(${plan.groups.get(c)?.length ?? 0})`).join(", ")}`);
+  const fedPlan = hasFederatedModules ? planChunks(fedPackages, accessMap.access) : null;
+  if (fedPlan) {
+    ok(`Federated modules: ${fedPackages.map((p) => moduleNameOf2(p.name)).join(", ")}`);
+  }
   const i18nCollector = new Map;
-  const [browserResult] = await Promise.all([
-    buildBrowserApp(ws.rootDir, ws.browserDir, plan, cache, noCache, i18nCollector),
+  const [browserResult, , , , shellResult, fedResult] = await Promise.all([
+    buildBrowserApp(ws.rootDir, ws.browserDir, plan, cache, noCache, i18nCollector, {
+      federated: false,
+      exposeRuntime: isHost
+    }),
     buildStyles(ws.rootDir, ws.arcDir, ws.packages, themePath, cache, noCache),
     copyBrowserAssets(ws, cache, noCache),
-    buildTranslations(ws.rootDir, ws.arcDir, cache, noCache)
+    buildTranslations(ws.rootDir, ws.arcDir, cache, noCache),
+    needsPeerShell ? buildPeerShell(ws.rootDir, join13(ws.arcDir, "shell"), cache, noCache) : Promise.resolve(undefined),
+    fedPlan ? buildBrowserApp(ws.rootDir, join13(ws.arcDir, "browser-fed"), fedPlan, cache, noCache, i18nCollector, { federated: true, unitId: "browser-app-fed" }) : Promise.resolve(undefined)
   ]);
   const { finalizeTranslations: finalizeTranslations3 } = await Promise.resolve().then(() => (init_i18n(), exports_i18n));
   await finalizeTranslations3(ws.rootDir, ws.arcDir, i18nCollector);
   collectFrameworkDeps(ws.arcDir, ws.rootDir, ws.packages, [], serverExternals);
   saveBuildCache(ws.arcDir, cache);
-  const finalManifest = assembleManifest(ws, browserResult, cache);
-  writeFileSync9(join12(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
+  const federationBuild = fedResult && hasFederatedModules ? {
+    config: {
+      slug: federation?.slug,
+      auth: federation?.auth
+    },
+    modules: fedPackages.map((p) => moduleNameOf2(p.name)),
+    permissions: [
+      ...new Set(fedPackages.flatMap((p) => accessMap.exposure[moduleNameOf2(p.name)]?.permissions ?? []))
+    ],
+    slots: [
+      ...new Set(fedPackages.flatMap((p) => accessMap.exposure[moduleNameOf2(p.name)]?.slots ?? []))
+    ],
+    build: {
+      initial: fedResult.initial,
+      groups: fedResult.groups,
+      sharedChunks: fedResult.sharedChunks
+    }
+  } : undefined;
+  const finalManifest = assembleManifest(ws, browserResult, cache, shellResult, federationBuild);
+  writeFileSync10(join13(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
   return finalManifest;
 }
-function assembleManifest(ws, browser, cache) {
+function assembleManifest(ws, browser, cache, shell, federation) {
   const stylesHash = cache.units["styles"]?.outputHash ?? "";
   return {
     initial: browser.initial,
     groups: browser.groups,
     sharedChunks: browser.sharedChunks,
     stylesHash,
-    buildTime: new Date().toISOString()
+    buildTime: new Date().toISOString(),
+    ...shell ? { shell: { imports: shell.imports, peers: shell.peers } } : {},
+    ...federation ? { federation } : {}
   };
 }
+function getFederationConfig(ws) {
+  const raw = ws.rootPkg.arc?.federation;
+  if (!raw)
+    return;
+  if (raw.slug && !/^[a-z0-9-]+$/.test(raw.slug)) {
+    throw new Error(`arc.federation.slug "${raw.slug}" \u2014 dozwolone tylko [a-z0-9-]+`);
+  }
+  return raw;
+}
 function resolveAssetSource(from, pkgDir, rootDir) {
   if (from.startsWith("./") || from.startsWith("../")) {
-    const resolved = join12(pkgDir, from);
-    return existsSync10(resolved) ? resolved : null;
+    const resolved = join13(pkgDir, from);
+    return existsSync11(resolved) ? resolved : null;
   }
   const candidates = [
-    join12(rootDir, "node_modules", from),
-    join12(pkgDir, "node_modules", from)
+    join13(rootDir, "node_modules", from),
+    join13(pkgDir, "node_modules", from)
   ];
   for (const c of candidates) {
-    if (existsSync10(c))
+    if (existsSync11(c))
       return c;
   }
-  const bunCacheDir = join12(rootDir, "node_modules", ".bun");
-  if (existsSync10(bunCacheDir)) {
+  const bunCacheDir = join13(rootDir, "node_modules", ".bun");
+  if (existsSync11(bunCacheDir)) {
     for (const entry of readdirSync6(bunCacheDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const candidate = join12(bunCacheDir, entry.name, "node_modules", from);
-      if (existsSync10(candidate))
+      const candidate = join13(bunCacheDir, entry.name, "node_modules", from);
+      if (existsSync11(candidate))
         return candidate;
     }
   }
   return null;
 }
 function readBrowserAssets(pkgDir) {
-  const pkgJsonPath = join12(pkgDir, "package.json");
-  if (!existsSync10(pkgJsonPath))
+  const pkgJsonPath = join13(pkgDir, "package.json");
+  if (!existsSync11(pkgJsonPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync12(pkgJsonPath, "utf-8"));
     const assets = pkg.arc?.browserAssets;
     if (!Array.isArray(assets))
       return [];
@@ -32568,14 +32747,14 @@ function readBrowserAssets(pkgDir) {
   }
 }
 function discoverBrowserAssets(ws) {
-  const arcDir = join12(ws.rootDir, "node_modules", "@arcote.tech");
-  if (!existsSync10(arcDir))
+  const arcDir = join13(ws.rootDir, "node_modules", "@arcote.tech");
+  if (!existsSync11(arcDir))
     return [];
   const out = [];
   for (const entry of readdirSync6(arcDir, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const pkgDir = join12(arcDir, entry.name);
+    const pkgDir = join13(arcDir, entry.name);
     const assets = readBrowserAssets(pkgDir);
     for (const asset of assets) {
       const src = resolveAssetSource(asset.from, pkgDir, ws.rootDir);
@@ -32589,7 +32768,7 @@ function discoverBrowserAssets(ws) {
   return out;
 }
 async function copyBrowserAssets(ws, cache, noCache) {
-  mkdirSync9(ws.assetsDir, { recursive: true });
+  mkdirSync10(ws.assetsDir, { recursive: true });
   const assets = discoverBrowserAssets(ws);
   if (assets.length === 0)
     return;
@@ -32600,7 +32779,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
     to: a.to,
     mtime: mtimeOf(a.src)
   })));
-  const requiredOutputs = assets.map((a) => join12(ws.assetsDir, a.to));
+  const requiredOutputs = assets.map((a) => join13(ws.assetsDir, a.to));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: browser-assets (${assets.length})`);
     return;
@@ -32608,10 +32787,10 @@ async function copyBrowserAssets(ws, cache, noCache) {
   console.log(`  building: browser-assets (${assets.length})`);
   const outputHashes = {};
   for (const asset of assets) {
-    const dest = join12(ws.assetsDir, asset.to);
-    mkdirSync9(dirname8(dest), { recursive: true });
+    const dest = join13(ws.assetsDir, asset.to);
+    mkdirSync10(dirname8(dest), { recursive: true });
     copyFileSync(asset.src, dest);
-    outputHashes[asset.to] = sha256Hex(readFileSync11(dest));
+    outputHashes[asset.to] = sha256Hex(readFileSync12(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
 }
@@ -32619,12 +32798,12 @@ async function loadServerContext(ws) {
   globalThis.ONLY_SERVER = true;
   globalThis.ONLY_BROWSER = false;
   globalThis.ONLY_CLIENT = false;
-  const platformDir = join12(process.cwd(), "node_modules", "@arcote.tech", "platform");
-  const platformPkg = JSON.parse(readFileSync11(join12(platformDir, "package.json"), "utf-8"));
-  const platformEntry = join12(platformDir, platformPkg.main ?? "src/index.ts");
+  const platformDir = join13(process.cwd(), "node_modules", "@arcote.tech", "platform");
+  const platformPkg = JSON.parse(readFileSync12(join13(platformDir, "package.json"), "utf-8"));
+  const platformEntry = join13(platformDir, platformPkg.main ?? "src/index.ts");
   await import(platformEntry);
-  const serverEntry = join12(ws.arcDir, "server", SERVER_ENTRY_FILE);
-  if (!existsSync10(serverEntry)) {
+  const serverEntry = join13(ws.arcDir, "server", SERVER_ENTRY_FILE);
+  if (!existsSync11(serverEntry)) {
     return { context: null, moduleAccess: new Map };
   }
   try {
@@ -32648,24 +32827,26 @@ async function platformBuild(opts = {}) {
 }
 
 // src/commands/platform-deploy.ts
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { dirname as dirname11, join as join20 } from "path";
+import { randomBytes } from "crypto";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { dirname as dirname11, join as join21 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 
 // src/deploy/bootstrap.ts
 var {spawn: spawn4 } = globalThis.Bun;
-import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync13 } from "fs";
+import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync14 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, join as join18 } from "path";
+import { dirname as dirname9, join as join19 } from "path";
 
 // src/deploy/ansible.ts
 import { spawn as nodeSpawn } from "child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
 import { homedir, tmpdir } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // src/deploy/assets.ts
 var TERRAFORM_MAIN_TF = `terraform {
+  required_version = ">= 1.1"
   required_providers {
     hcloud = {
       source  = "hetznercloud/hcloud"
@@ -32678,17 +32859,50 @@ provider "hcloud" {
   token = var.hcloud_token
 }
 
+locals {
+  # cloud-init injects the operator public key into the default image user's
+  # authorized_keys (root on Hetzner Ubuntu images) \u2014 matching the root-first
+  # ansible bootstrap. Used only when use_cloud_init_key = true.
+  cloud_init_user_data = <<-EOT
+    #cloud-config
+    ssh_pwauth: false
+    chpasswd:
+      expire: false
+    ssh_authorized_keys:
+      - \${trimspace(file(var.ssh_public_key))}
+    # Hetzner marks the root password expired (must-change-on-login) when no
+    # hcloud_ssh_key object is attached \u2014 which blocks non-interactive key
+    # login ("password change required, no TTY"). Clear the expiry so the
+    # deploy user / ansible can SSH in as root right away.
+    runcmd:
+      - chage -d $(date +%Y-%m-%d) -M -1 root
+  EOT
+}
+
+# Legacy path: a managed SSH key object in the Hetzner project. Skipped when
+# use_cloud_init_key = true, because several apps sharing one project with the
+# same local public key would collide on both key NAME and FINGERPRINT.
 resource "hcloud_ssh_key" "deploy" {
+  count      = var.use_cloud_init_key ? 0 : 1
   name       = "\${var.server_name}-deploy"
   public_key = file(var.ssh_public_key)
 }
 
+# Re-home the pre-count address so an already-provisioned host (state created
+# before count existed) plans as a no-op instead of destroy+recreate \u2014 which
+# would ForceNew-replace the server. Ignored for fresh (empty) state.
+moved {
+  from = hcloud_ssh_key.deploy
+  to   = hcloud_ssh_key.deploy[0]
+}
+
 resource "hcloud_server" "arc" {
   name        = var.server_name
   image       = var.server_image
   server_type = var.server_type
   location    = var.server_location
-  ssh_keys    = [hcloud_ssh_key.deploy.id]
+  ssh_keys    = var.use_cloud_init_key ? [] : [hcloud_ssh_key.deploy[0].id]
+  user_data   = var.use_cloud_init_key ? local.cloud_init_user_data : null
 
   public_net {
     ipv4_enabled = true
@@ -32739,6 +32953,12 @@ variable "ssh_public_key" {
   type        = string
   default     = "~/.ssh/id_ed25519.pub"
 }
+
+variable "use_cloud_init_key" {
+  description = "Inject the SSH public key via cloud-init user_data instead of a managed hcloud_ssh_key object (avoids name/fingerprint collisions when multiple apps share one Hetzner project)."
+  type        = bool
+  default     = false
+}
 `;
 var ANSIBLE_SITE_YML = `---
 # Arc platform bootstrap playbook \u2014 minimal hardened Docker host.
@@ -32935,30 +33155,30 @@ var ASSETS = {
   }
 };
 async function materializeAssets(targetDir, files) {
-  const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync10 } = await import("fs");
-  const { join: join13 } = await import("path");
-  mkdirSync10(targetDir, { recursive: true });
+  const { mkdirSync: mkdirSync11, writeFileSync: writeFileSync11 } = await import("fs");
+  const { join: join14 } = await import("path");
+  mkdirSync11(targetDir, { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    writeFileSync10(join13(targetDir, name), content);
+    writeFileSync11(join14(targetDir, name), content);
   }
 }
 
 // src/deploy/ansible.ts
 function pickSshKeyForAnsible(configured) {
   if (configured) {
-    const expanded = configured.startsWith("~") ? join13(homedir(), configured.slice(1)) : configured;
-    return existsSync11(expanded) ? expanded : null;
+    const expanded = configured.startsWith("~") ? join14(homedir(), configured.slice(1)) : configured;
+    return existsSync12(expanded) ? expanded : null;
   }
   for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
-    const path4 = join13(homedir(), ".ssh", name);
-    if (existsSync11(path4))
+    const path4 = join14(homedir(), ".ssh", name);
+    if (existsSync12(path4))
       return path4;
   }
   return null;
 }
 async function runAnsible(inputs) {
-  const workDir = join13(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
-  mkdirSync10(workDir, { recursive: true });
+  const workDir = join14(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
+  mkdirSync11(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.ansible);
   const user = inputs.asRoot ? "root" : inputs.target.user;
   const port = inputs.ansible?.sshPort ?? inputs.target.port;
@@ -32974,7 +33194,7 @@ async function runAnsible(inputs) {
     ""
   ].join(`
 `);
-  writeFileSync10(join13(workDir, "inventory.ini"), inventory);
+  writeFileSync11(join14(workDir, "inventory.ini"), inventory);
   const extraVarsJson = JSON.stringify({
     username: inputs.target.user,
     ssh_port: port,
@@ -34533,16 +34753,16 @@ function panelTimeseries(title, gridPos, query, legend, unit, datasource = PROME
 // src/deploy/terraform.ts
 import { spawn as nodeSpawn2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 async function runTerraform(inputs) {
   const wsHash = createHash2("sha256").update(inputs.workspaceDir).digest("hex").slice(0, 16);
-  const workDir = join14(homedir2(), ".arc-deploy", wsHash, "tf");
-  mkdirSync11(workDir, { recursive: true });
+  const workDir = join15(homedir2(), ".arc-deploy", wsHash, "tf");
+  mkdirSync12(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.terraform);
   const sshPubKey = inputs.tf.sshPublicKey ?? expandHome("~/.ssh/id_ed25519.pub");
-  if (!existsSync12(expandHome(sshPubKey))) {
+  if (!existsSync13(expandHome(sshPubKey))) {
     throw new Error(`SSH public key not found at ${sshPubKey}. Set provision.terraform.sshPublicKey in deploy.arc.json.`);
   }
   const tfvars = [
@@ -34551,11 +34771,12 @@ async function runTerraform(inputs) {
     `server_type = "${inputs.tf.serverType}"`,
     `server_location = "${inputs.tf.location}"`,
     `server_image = "${inputs.tf.image}"`,
-    `ssh_public_key = "${expandHome(sshPubKey)}"`
+    `ssh_public_key = "${expandHome(sshPubKey)}"`,
+    `use_cloud_init_key = ${inputs.useCloudInitKey}`
   ].join(`
 `) + `
 `;
-  writeFileSync11(join14(workDir, "terraform.tfvars"), tfvars);
+  writeFileSync12(join15(workDir, "terraform.tfvars"), tfvars);
   await runTf(workDir, ["init", "-input=false", "-no-color"]);
   await runTf(workDir, [
     "apply",
@@ -34613,20 +34834,20 @@ function expandHome(p) {
 }
 
 // src/deploy/config.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "fs";
+import { join as join17 } from "path";
 
 // src/deploy/env-file.ts
-import { appendFileSync, existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join15 } from "path";
+import { appendFileSync, existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { join as join16 } from "path";
 function loadDeployEnvFiles(rootDir, envNames) {
-  const globalsPath = join15(rootDir, "deploy.arc.env");
-  const globals = existsSync13(globalsPath) ? parseEnvFile(readFileSync12(globalsPath, "utf-8"), globalsPath) : {};
+  const globalsPath = join16(rootDir, "deploy.arc.env");
+  const globals = existsSync14(globalsPath) ? parseEnvFile(readFileSync13(globalsPath, "utf-8"), globalsPath) : {};
   const perEnv = {};
   for (const name of envNames) {
-    const envPath = join15(rootDir, `deploy.arc.${name}.env`);
-    if (existsSync13(envPath)) {
-      perEnv[name] = parseEnvFile(readFileSync12(envPath, "utf-8"), envPath);
+    const envPath = join16(rootDir, `deploy.arc.${name}.env`);
+    if (existsSync14(envPath)) {
+      perEnv[name] = parseEnvFile(readFileSync13(envPath, "utf-8"), envPath);
     }
   }
   return { globals, perEnv };
@@ -34642,16 +34863,16 @@ function ensurePersistedSecret(rootDir, scope, key, generate) {
   if (process.env[key])
     return process.env[key];
   const fileName = scope === "globals" ? "deploy.arc.env" : `deploy.arc.${scope}.env`;
-  const path4 = join15(rootDir, fileName);
-  if (existsSync13(path4)) {
-    const existing = parseEnvFile(readFileSync12(path4, "utf-8"), path4);
+  const path4 = join16(rootDir, fileName);
+  if (existsSync14(path4)) {
+    const existing = parseEnvFile(readFileSync13(path4, "utf-8"), path4);
     if (existing[key]) {
       process.env[key] = existing[key];
       return existing[key];
     }
   }
   const value = generate();
-  const prefix = existsSync13(path4) && !readFileSync12(path4, "utf-8").endsWith(`
+  const prefix = existsSync14(path4) && !readFileSync13(path4, "utf-8").endsWith(`
 `) ? `
 ` : "";
   appendFileSync(path4, `${prefix}${key}=${value}
@@ -34687,17 +34908,17 @@ function parseEnvFile(content, pathForErrors) {
 // src/deploy/config.ts
 var DEPLOY_CONFIG_FILE = "deploy.arc.json";
 function deployConfigPath(rootDir) {
-  return join16(rootDir, DEPLOY_CONFIG_FILE);
+  return join17(rootDir, DEPLOY_CONFIG_FILE);
 }
 function deployConfigExists(rootDir) {
-  return existsSync14(deployConfigPath(rootDir));
+  return existsSync15(deployConfigPath(rootDir));
 }
 function loadDeployConfig(rootDir) {
   const path4 = deployConfigPath(rootDir);
-  if (!existsSync14(path4)) {
+  if (!existsSync15(path4)) {
     throw new Error(`Missing ${DEPLOY_CONFIG_FILE} at ${path4}`);
   }
-  const raw = readFileSync13(path4, "utf-8");
+  const raw = readFileSync14(path4, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -34720,9 +34941,9 @@ function loadDeployConfig(rootDir) {
 }
 function saveDeployConfig(rootDir, cfg) {
   const path4 = deployConfigPath(rootDir);
-  const raw = existsSync14(path4) ? JSON.parse(readFileSync13(path4, "utf-8")) : {};
+  const raw = existsSync15(path4) ? JSON.parse(readFileSync14(path4, "utf-8")) : {};
   raw.target = { ...raw.target, ...cfg.target };
-  writeFileSync12(path4, JSON.stringify(raw, null, 2) + `
+  writeFileSync13(path4, JSON.stringify(raw, null, 2) + `
 `);
 }
 var VAR_REGEX = /\$\{([A-Z0-9_]+)\}|\$([A-Z0-9_]+)/g;
@@ -34757,9 +34978,20 @@ function validateDeployConfig(input) {
   if (!/^[A-Z][A-Z0-9_]*$/.test(passwordEnv)) {
     throw new Error(`deploy.arc.json: registry.passwordEnv "${passwordEnv}" must be an UPPER_SNAKE_CASE env var name`);
   }
+  const provisionRaw = input.provision;
+  const hasProvisionTf = isObject(provisionRaw) && isObject(provisionRaw.terraform);
+  const hostRaw = optionalString(target, "target.host");
+  let host;
+  if (hostRaw && hostRaw.length > 0) {
+    host = hostRaw;
+  } else if (hasProvisionTf) {
+    host = "PENDING_TERRAFORM";
+  } else {
+    throw new Error(`deploy.arc.json: target.host is required unless provision.terraform is present (with provision, terraform fills it on first deploy).`);
+  }
   const validated = {
     target: {
-      host: requireString(target, "target.host"),
+      host,
       user: optionalString(target, "target.user") ?? "deploy",
       port: optionalNumber(target, "target.port") ?? 22,
       remoteDir: optionalString(target, "target.remoteDir") ?? "/opt/arc",
@@ -34860,13 +35092,23 @@ function validateDeployConfig(input) {
     if (providerVal !== "hcloud") {
       throw new Error(`deploy.arc.json: provision.terraform.provider must be "hcloud" (got "${providerVal}")`);
     }
+    const serverName = optionalString(tf, "provision.terraform.serverName");
+    if (serverName !== undefined && !/^[a-z0-9-]{1,63}$/.test(serverName)) {
+      throw new Error(`deploy.arc.json: provision.terraform.serverName "${serverName}" must match [a-z0-9-] and be at most 63 chars`);
+    }
+    const sshKeyStrategyRaw = optionalString(tf, "provision.terraform.sshKeyStrategy");
+    if (sshKeyStrategyRaw !== undefined && sshKeyStrategyRaw !== "resource" && sshKeyStrategyRaw !== "cloud-init") {
+      throw new Error(`deploy.arc.json: provision.terraform.sshKeyStrategy must be "resource" or "cloud-init" (got "${sshKeyStrategyRaw}")`);
+    }
     const terraform = {
       provider: "hcloud",
       serverType: requireString(tf, "provision.terraform.serverType"),
       location: requireString(tf, "provision.terraform.location"),
       image: optionalString(tf, "provision.terraform.image") ?? "ubuntu-22.04",
       tokenEnv: requireString(tf, "provision.terraform.tokenEnv"),
-      sshPublicKey: optionalString(tf, "provision.terraform.sshPublicKey")
+      sshPublicKey: optionalString(tf, "provision.terraform.sshPublicKey"),
+      serverName,
+      sshKeyStrategy: sshKeyStrategyRaw
     };
     let ansible;
     const ansibleRaw = provision.ansible;
@@ -34936,17 +35178,17 @@ function cfgErr(path4, expected) {
 
 // src/deploy/ssh.ts
 var {spawn: spawn3 } = globalThis.Bun;
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function pickSshKey(target) {
   if (target.sshKey) {
-    const expanded = target.sshKey.startsWith("~") ? join17(homedir3(), target.sshKey.slice(1)) : target.sshKey;
-    return existsSync15(expanded) ? expanded : null;
+    const expanded = target.sshKey.startsWith("~") ? join18(homedir3(), target.sshKey.slice(1)) : target.sshKey;
+    return existsSync16(expanded) ? expanded : null;
   }
   for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
-    const path4 = join17(homedir3(), ".ssh", name);
-    if (existsSync15(path4))
+    const path4 = join18(homedir3(), ".ssh", name);
+    if (existsSync16(path4))
       return path4;
   }
   return null;
@@ -34961,7 +35203,7 @@ function sshMuxArgs() {
     "-o",
     "ControlMaster=auto",
     "-o",
-    `ControlPath=${join17(homedir3(), ".ssh", "cm-arc-%C")}`,
+    `ControlPath=${join18(homedir3(), ".ssh", "cm-arc-%C")}`,
     "-o",
     "ControlPersist=120"
   ];
@@ -35161,10 +35403,14 @@ async function bootstrap(inputs) {
     if (!token) {
       throw new Error(`Environment variable ${cfg.provision.terraform.tokenEnv} is not set`);
     }
+    const firstEnv = Object.keys(cfg.envs)[0] ?? "host";
+    const serverName = cfg.provision.terraform.serverName ?? `arc-${firstEnv}`;
+    const useCloudInitKey = cfg.provision.terraform.sshKeyStrategy === "cloud-init";
     const tfOut = await runTerraform({
       tf: cfg.provision.terraform,
       token,
-      serverName: `arc-${Object.keys(cfg.envs)[0] ?? "host"}`,
+      serverName,
+      useCloudInitKey,
       workspaceDir: rootDir
     });
     ok(`Server provisioned: ${tfOut.serverIp}`);
@@ -35226,17 +35472,17 @@ async function isRegistryRunning(cfg) {
 }
 async function upStack(inputs) {
   const { cfg } = inputs;
-  const workDir = join18(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
-  mkdirSync12(workDir, { recursive: true });
+  const workDir = join19(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
+  mkdirSync13(workDir, { recursive: true });
   await assertRegistryDnsResolves(cfg);
   const password = process.env[cfg.registry.passwordEnv];
   if (!password) {
     throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set. ` + `Set it (e.g. \`export ${cfg.registry.passwordEnv}=...\`) before bootstrap.`);
   }
   const htpasswdLine = await generateHtpasswd(cfg.registry.username, password);
-  writeFileSync13(join18(workDir, "htpasswd"), htpasswdLine);
-  writeFileSync13(join18(workDir, "Caddyfile"), generateCaddyfile(cfg));
-  writeFileSync13(join18(workDir, "docker-compose.yml"), generateCompose({ cfg }));
+  writeFileSync14(join19(workDir, "htpasswd"), htpasswdLine);
+  writeFileSync14(join19(workDir, "Caddyfile"), generateCaddyfile(cfg));
+  writeFileSync14(join19(workDir, "docker-compose.yml"), generateCompose({ cfg }));
   let observabilityFiles = null;
   let observabilityHtpasswd = null;
   if (cfg.observability?.enabled) {
@@ -35248,30 +35494,30 @@ async function upStack(inputs) {
     }
     observabilityHtpasswd = await generateCaddyBasicAuthLine("admin", adminPassword);
     for (const [relPath, contents] of Object.entries(observabilityFiles)) {
-      const fullPath = join18(workDir, relPath);
-      mkdirSync12(dirname9(fullPath), { recursive: true });
-      writeFileSync13(fullPath, contents);
+      const fullPath = join19(workDir, relPath);
+      mkdirSync13(dirname9(fullPath), { recursive: true });
+      writeFileSync14(fullPath, contents);
     }
-    writeFileSync13(join18(workDir, "observability-htpasswd"), observabilityHtpasswd);
+    writeFileSync14(join19(workDir, "observability-htpasswd"), observabilityHtpasswd);
   }
   await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
   for (const name of Object.keys(cfg.envs)) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
   }
   await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/registry-auth`);
-  await scpUpload(cfg.target, join18(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
-  await scpUpload(cfg.target, join18(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
-  await scpUpload(cfg.target, join18(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
+  await scpUpload(cfg.target, join19(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
+  await scpUpload(cfg.target, join19(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
+  await scpUpload(cfg.target, join19(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
   if (observabilityFiles && observabilityHtpasswd) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/observability/grafana-dashboards ${cfg.target.remoteDir}/observability/grafana-alerting`);
     for (const relPath of Object.keys(observabilityFiles)) {
-      const localDir = dirname9(join18(workDir, relPath));
-      mkdirSync12(localDir, { recursive: true });
+      const localDir = dirname9(join19(workDir, relPath));
+      mkdirSync13(localDir, { recursive: true });
     }
     for (const relPath of Object.keys(observabilityFiles)) {
-      await scpUpload(cfg.target, join18(workDir, relPath), `${cfg.target.remoteDir}/${relPath}`);
+      await scpUpload(cfg.target, join19(workDir, relPath), `${cfg.target.remoteDir}/${relPath}`);
     }
-    await scpUpload(cfg.target, join18(workDir, "observability-htpasswd"), `${cfg.target.remoteDir}/observability-htpasswd`);
+    await scpUpload(cfg.target, join19(workDir, "observability-htpasswd"), `${cfg.target.remoteDir}/observability-htpasswd`);
   }
   await assertExec(cfg.target, `touch ${cfg.target.remoteDir}/.env`);
   if (cfg.observability?.enabled) {
@@ -35426,14 +35672,14 @@ var {spawn: spawn5 } = globalThis.Bun;
 import { createHash as createHash3 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync16,
-  mkdirSync as mkdirSync13,
-  readFileSync as readFileSync14,
+  existsSync as existsSync17,
+  mkdirSync as mkdirSync14,
+  readFileSync as readFileSync15,
   realpathSync as realpathSync2,
-  writeFileSync as writeFileSync14
+  writeFileSync as writeFileSync15
 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, join as join19 } from "path";
+import { dirname as dirname10, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/deploy/image-template.ts
@@ -35483,8 +35729,8 @@ function generateDockerfile(inputs) {
 // src/deploy/image.ts
 async function buildImage(ws, opts) {
   await ensureDocker();
-  const manifestPath = join19(ws.arcDir, "manifest.json");
-  if (!existsSync16(manifestPath)) {
+  const manifestPath = join20(ws.arcDir, "manifest.json");
+  if (!existsSync17(manifestPath)) {
     throw new Error(`No build manifest at ${manifestPath}. Run \`arc platform build\` first or omit --skip-build.`);
   }
   embedCliBundle(ws);
@@ -35494,10 +35740,10 @@ async function buildImage(ws, opts) {
   const dockerfileInputs = collectDockerfileInputs(ws);
   const dockerfile = generateDockerfile(dockerfileInputs);
   const buildContextDir = ws.rootDir;
-  const dockerfileDir = join19(tmpdir3(), `arc-image-${Date.now()}`);
-  mkdirSync13(dockerfileDir, { recursive: true });
-  const dockerfilePath = join19(dockerfileDir, "Dockerfile");
-  writeFileSync14(dockerfilePath, dockerfile);
+  const dockerfileDir = join20(tmpdir3(), `arc-image-${Date.now()}`);
+  mkdirSync14(dockerfileDir, { recursive: true });
+  const dockerfilePath = join20(dockerfileDir, "Dockerfile");
+  writeFileSync15(dockerfilePath, dockerfile);
   const buildArgs = [
     "build",
     "--platform=linux/amd64",
@@ -35522,20 +35768,20 @@ async function buildImage(ws, opts) {
 }
 function embedCliBundle(ws) {
   const source = locateCliBundle();
-  const target = join19(ws.arcDir, "host.js");
+  const target = join20(ws.arcDir, "host.js");
   copyFileSync2(source, target);
 }
 function locateCliBundle() {
   const here = fileURLToPath7(import.meta.url);
   let cur = dirname10(here);
   while (cur !== "/" && cur !== "") {
-    const candidate = join19(cur, "package.json");
-    if (existsSync16(candidate)) {
+    const candidate = join20(cur, "package.json");
+    if (existsSync17(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync14(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync15(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
-          const distIndex = join19(realpathSync2(cur), "dist", "index.js");
-          if (!existsSync16(distIndex)) {
+          const distIndex = join20(realpathSync2(cur), "dist", "index.js");
+          if (!existsSync17(distIndex)) {
             throw new Error(`arc-cli bundle missing at ${distIndex}. Run \`bun run build\` in packages/cli/.`);
           }
           return distIndex;
@@ -35567,17 +35813,17 @@ async function ensureDocker() {
   }
 }
 function computeContentHash(manifestPath) {
-  const raw = JSON.parse(readFileSync14(manifestPath, "utf-8"));
+  const raw = JSON.parse(readFileSync15(manifestPath, "utf-8"));
   delete raw.buildTime;
   const canonical = JSON.stringify(raw);
   return createHash3("sha256").update(canonical).digest("hex").slice(0, 12);
 }
 function collectDockerfileInputs(ws) {
-  const hasPublicDir = existsSync16(join19(ws.rootDir, "public"));
-  const hasLocales = existsSync16(join19(ws.rootDir, "locales"));
+  const hasPublicDir = existsSync17(join20(ws.rootDir, "public"));
+  const hasLocales = existsSync17(join20(ws.rootDir, "locales"));
   let manifestPath;
   for (const name of ["manifest.webmanifest", "manifest.json"]) {
-    if (existsSync16(join19(ws.rootDir, name))) {
+    if (existsSync17(join20(ws.rootDir, name))) {
       manifestPath = name;
       break;
     }
@@ -36192,7 +36438,7 @@ ${import_picocolors2.default.gray(m2)}  ${s}
 };
 
 // src/deploy/survey.ts
-async function runSurvey() {
+async function runSurvey(appName) {
   we("arc platform deploy \u2014 initial setup");
   const mode = await de({
     message: "How should deploy reach the target server?",
@@ -36294,12 +36540,17 @@ async function runSurvey() {
     });
     if (BD(location))
       cancel();
+    const firstEnv = Object.keys(envs)[0] ?? "host";
+    const appSlug = sanitizeImageName(appName ?? "arc-app").replace(/[^a-z0-9-]+/g, "-");
+    const serverName = `arc-${appSlug}-${firstEnv}`.slice(0, 63);
     const terraform = {
       provider: "hcloud",
       serverType,
       location,
       image: "ubuntu-22.04",
-      tokenEnv
+      tokenEnv,
+      serverName,
+      sshKeyStrategy: "cloud-init"
     };
     provision = { terraform };
   }
@@ -36384,12 +36635,15 @@ function cancel() {
 }
 
 // src/commands/platform-deploy.ts
+function federationExposesModules(ws) {
+  return Boolean(ws.rootPkg?.arc?.federation?.slug);
+}
 async function platformDeploy(envArg, options = {}) {
   const ws = resolveWorkspace();
   let cfg;
   if (!deployConfigExists(ws.rootDir)) {
     log2("No deploy.arc.json found \u2014 launching survey.");
-    cfg = await runSurvey();
+    cfg = await runSurvey(ws.appName);
     saveDeployConfig(ws.rootDir, cfg);
     ok("Saved deploy.arc.json");
   }
@@ -36398,6 +36652,13 @@ async function platformDeploy(envArg, options = {}) {
   for (const pg of pgEnvs) {
     ensurePersistedSecret(ws.rootDir, pg.name, pg.passwordKey, () => crypto.randomUUID().replace(/-/g, ""));
   }
+  if (federationExposesModules(ws)) {
+    for (const name of Object.keys(cfg.envs)) {
+      ensurePersistedSecret(ws.rootDir, name, "ARC_APP_SECRET", () => randomBytes(32).toString("base64url"));
+      ensurePersistedSecret(ws.rootDir, name, "ARC_PAIRING_TOKEN", () => randomBytes(16).toString("base64url"));
+    }
+    cfg = loadDeployConfig(ws.rootDir);
+  }
   if (cfg.observability?.enabled) {
     const key = cfg.observability.adminPasswordEnv ?? "ARC_OBSERVABILITY_PASSWORD";
     ensurePersistedSecret(ws.rootDir, "globals", key, () => crypto.randomUUID().replace(/-/g, ""));
@@ -36406,14 +36667,14 @@ async function platformDeploy(envArg, options = {}) {
     err(`Unknown env "${envArg}". Known: ${Object.keys(cfg.envs).join(", ")}`);
     process.exit(1);
   })() : Object.keys(cfg.envs);
-  const manifestPath = join20(ws.arcDir, "manifest.json");
+  const manifestPath = join21(ws.arcDir, "manifest.json");
   if (!options.imageTag) {
-    const needBuild = options.rebuild || !existsSync17(manifestPath);
+    const needBuild = options.rebuild || !existsSync18(manifestPath);
     if (needBuild && !options.skipBuild) {
       log2("Building platform...");
       await buildAll(ws, { noCache: options.rebuild });
       ok("Build complete");
-    } else if (!existsSync17(manifestPath)) {
+    } else if (!existsSync18(manifestPath)) {
       err("No build found and --skip-build was set.");
       process.exit(1);
     }
@@ -36483,9 +36744,9 @@ function readCliVersion2() {
     let cur = dirname11(fileURLToPath8(import.meta.url));
     const root = dirname11(cur).startsWith("/") ? "/" : ".";
     while (cur !== root && cur !== "") {
-      const candidate = join20(cur, "package.json");
-      if (existsSync17(candidate)) {
-        const pkg = JSON.parse(readFileSync15(candidate, "utf-8"));
+      const candidate = join21(cur, "package.json");
+      if (existsSync18(candidate)) {
+        const pkg = JSON.parse(readFileSync16(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
           return pkg.version ?? "unknown";
         }
@@ -36501,8 +36762,8 @@ function readCliVersion2() {
   }
 }
 async function hashDeployConfig(rootDir) {
-  const p2 = join20(rootDir, "deploy.arc.json");
-  const content = readFileSync15(p2);
+  const p2 = join21(rootDir, "deploy.arc.json");
+  const content = readFileSync16(p2);
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   hasher.update(readCliVersion2());
@@ -36510,8 +36771,9 @@ async function hashDeployConfig(rootDir) {
 }
 
 // src/platform/startup.ts
-import { existsSync as existsSync19, readFileSync as readFileSync16, watch } from "fs";
-import { join as join22 } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+import { existsSync as existsSync20, mkdirSync as mkdirSync16, readFileSync as readFileSync17, watch, writeFileSync as writeFileSync16 } from "fs";
+import { join as join23 } from "path";
 
 // ../host/src/connection-manager.ts
 class ConnectionManager {
@@ -37947,6 +38209,7 @@ async function createArcServer(config) {
   const messageChains = new Map;
   const coep = config.coep ?? "unsafe-none";
   const corsOrigins = config.corsOrigins;
+  const allowPrivateNetwork = config.allowPrivateNetwork ?? false;
   const maxRequestBodySize = config.maxRequestBodySize ?? 10 * 1024 * 1024;
   const securityHeaders = {
     "X-Content-Type-Options": "nosniff",
@@ -37958,7 +38221,7 @@ async function createArcServer(config) {
     const origin = req?.headers.get("Origin") || null;
     const headers = {
       "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
-      "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Arc-Scope, X-Arc-Tokens",
+      "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Arc-Scope, X-Arc-Tokens, X-Arc-Pairing-Token",
       "Cross-Origin-Opener-Policy": "same-origin",
       "Cross-Origin-Embedder-Policy": coep,
       "Cross-Origin-Resource-Policy": "cross-origin",
@@ -37995,7 +38258,8 @@ async function createArcServer(config) {
       const url = new URL(req.url);
       const corsHeaders2 = buildCorsHeaders(req);
       if (req.method === "OPTIONS") {
-        return new Response(null, { headers: corsHeaders2 });
+        const pna = allowPrivateNetwork && req.headers.get("Access-Control-Request-Private-Network") ? { "Access-Control-Allow-Private-Network": "true" } : {};
+        return new Response(null, { headers: { ...corsHeaders2, ...pna } });
       }
       const handleRequest = async (span) => {
         const contentLength = Number(req.headers.get("Content-Length") ?? 0);
@@ -38137,8 +38401,9 @@ async function createArcServer(config) {
 }
 // src/platform/server.ts
 init_i18n();
-import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
-import { join as join21 } from "path";
+import { timingSafeEqual } from "crypto";
+import { existsSync as existsSync19, mkdirSync as mkdirSync15 } from "fs";
+import { join as join22 } from "path";
 async function resolveDbAdapterFactory(dbPath) {
   const databaseUrl = process.env.DATABASE_URL;
   if (databaseUrl && databaseUrl.length > 0) {
@@ -38148,10 +38413,10 @@ async function resolveDbAdapterFactory(dbPath) {
   const { createBunSQLiteAdapterFactory: createBunSQLiteAdapterFactory2 } = await Promise.resolve().then(() => (init_dist2(), exports_dist3));
   const dbDir = dbPath.substring(0, dbPath.lastIndexOf("/"));
   if (dbDir)
-    mkdirSync14(dbDir, { recursive: true });
+    mkdirSync15(dbDir, { recursive: true });
   return createBunSQLiteAdapterFactory2(dbPath);
 }
-function generateShellHtml(appName, manifest, initial, stylesHash) {
+function generateShellHtml(appName, manifest, initial, stylesHash, shell) {
   const otelConfig = process.env.ARC_OTEL_ENABLED === "true" ? {
     enabled: true,
     endpoint: "/otel",
@@ -38165,6 +38430,9 @@ function generateShellHtml(appName, manifest, initial, stylesHash) {
   if (!initialUrl) {
     throw new Error("generateShellHtml: initial bundle missing from manifest");
   }
+  const importMapTag = shell ? `
+  <script type="importmap">${JSON.stringify({ imports: shell.imports })}</script>
+  <script>window.__ARC_PEERS__=${JSON.stringify(shell.peers)};</script>` : "";
   const stylesQs = stylesHash ? `?v=${stylesHash.slice(0, 16)}` : "";
   return `<!doctype html>
 <html lang="en">
@@ -38175,7 +38443,7 @@ function generateShellHtml(appName, manifest, initial, stylesHash) {
   <link rel="icon" href="${manifest.favicon}">` : ""}${manifest ? `
   <link rel="manifest" href="/manifest.json${stylesQs}">` : ""}
   <link rel="stylesheet" href="/styles.css${stylesQs}" />
-  <link rel="stylesheet" href="/theme.css${stylesQs}" />
+  <link rel="stylesheet" href="/theme.css${stylesQs}" />${importMapTag}
   <link rel="modulepreload" href="${initialUrl}" />${otelTag}
 </head>
 <body>
@@ -38207,7 +38475,7 @@ function getMime(path4) {
   return MIME[ext2] ?? "application/octet-stream";
 }
 function serveFile(filePath, headers = {}) {
-  if (!existsSync18(filePath))
+  if (!existsSync19(filePath))
     return new Response("Not Found", { status: 404 });
   return new Response(Bun.file(filePath), {
     headers: { "Content-Type": getMime(filePath), ...headers }
@@ -38225,11 +38493,44 @@ function ensureModuleSigSecret(ws, devMode) {
     MODULE_SIG_SECRET = crypto.randomUUID();
   }
 }
-function signGroupUrl(file) {
+function signGroupUrl(file, prefix = "/browser") {
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(`${file}:${MODULE_SIG_SECRET}`);
   const sig = hasher.digest("hex").slice(0, 16);
-  return `/browser/${file}?sig=${sig}`;
+  return `${prefix}/${file}?sig=${sig}`;
+}
+async function filterGroupsForTokens(groups, moduleAccessMap, tokenPayloads, urlPrefix) {
+  const tokensByName = new Map;
+  for (const t of tokenPayloads) {
+    if (t?.tokenType)
+      tokensByName.set(t.tokenType, t);
+  }
+  const filtered = {};
+  for (const [name, group] of Object.entries(groups)) {
+    let allGranted = true;
+    for (const moduleName of group.modules) {
+      const access = moduleAccessMap.get(moduleName);
+      if (!access || access.rules.length === 0)
+        continue;
+      let granted = false;
+      for (const rule of access.rules) {
+        const matching = tokensByName.get(rule.token.name);
+        if (!matching)
+          continue;
+        granted = rule.check ? await rule.check(matching) : true;
+        if (granted)
+          break;
+      }
+      if (!granted) {
+        allGranted = false;
+        break;
+      }
+    }
+    if (allGranted) {
+      filtered[name] = { ...group, url: signGroupUrl(group.file, urlPrefix) };
+    }
+  }
+  return filtered;
 }
 function verifyGroupSignature(file, sig) {
   if (!sig)
@@ -38270,36 +38571,7 @@ function parseArcTokensHeader(header) {
   return payloads;
 }
 async function filterManifestForTokens(manifest, moduleAccessMap, tokenPayloads) {
-  const tokensByName = new Map;
-  for (const t of tokenPayloads) {
-    if (t?.tokenType)
-      tokensByName.set(t.tokenType, t);
-  }
-  const filteredGroups = {};
-  for (const [name, group] of Object.entries(manifest.groups)) {
-    let allGranted = true;
-    for (const moduleName of group.modules) {
-      const access = moduleAccessMap.get(moduleName);
-      if (!access || access.rules.length === 0)
-        continue;
-      let granted = false;
-      for (const rule of access.rules) {
-        const matching = tokensByName.get(rule.token.name);
-        if (!matching)
-          continue;
-        granted = rule.check ? await rule.check(matching) : true;
-        if (granted)
-          break;
-      }
-      if (!granted) {
-        allGranted = false;
-        break;
-      }
-    }
-    if (allGranted) {
-      filteredGroups[name] = { ...group, url: signGroupUrl(group.file) };
-    }
-  }
+  const filteredGroups = await filterGroupsForTokens(manifest.groups, moduleAccessMap, tokenPayloads, "/browser");
   return {
     initial: manifest.initial,
     groups: filteredGroups,
@@ -38325,28 +38597,58 @@ function staticFilesHandler(ws, devMode, getManifest) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join21(ws.browserDir, file), {
+      return serveFile(join22(ws.browserDir, file), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
+      });
+    }
+    if (path4.startsWith("/shell/")) {
+      const file = path4.slice(7);
+      if (!BROWSER_FILE_RE.test(file)) {
+        return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+      }
+      return serveFile(join22(ws.arcDir, "shell", file), {
+        ...ctx.corsHeaders,
+        "Cross-Origin-Resource-Policy": "cross-origin",
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
+      });
+    }
+    if (path4.startsWith("/browser-fed/")) {
+      const file = path4.slice(13);
+      if (!BROWSER_FILE_RE.test(file)) {
+        return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+      }
+      const fed = getManifest().federation;
+      const isGroupEntry = fed ? Object.values(fed.build.groups).some((g3) => g3.file === file) : false;
+      if (isGroupEntry) {
+        const sig = url.searchParams.get("sig");
+        if (!verifyGroupSignature(file, sig)) {
+          return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
+        }
+      }
+      return serveFile(join22(ws.arcDir, "browser-fed", file), {
         ...ctx.corsHeaders,
+        "Cross-Origin-Resource-Policy": "cross-origin",
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     }
     if (path4.startsWith("/locales/"))
-      return serveFile(join21(ws.arcDir, path4.slice(1)), {
+      return serveFile(join22(ws.arcDir, path4.slice(1)), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=300,stale-while-revalidate=3600"
       });
     if (path4.startsWith("/assets/"))
-      return serveFile(join21(ws.assetsDir, path4.slice(8)), {
+      return serveFile(join22(ws.assetsDir, path4.slice(8)), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     if (path4 === "/styles.css")
-      return serveFile(join21(ws.arcDir, "styles.css"), {
+      return serveFile(join22(ws.arcDir, "styles.css"), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     if (path4 === "/theme.css")
-      return serveFile(join21(ws.arcDir, "theme.css"), {
+      return serveFile(join22(ws.arcDir, "theme.css"), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
@@ -38357,15 +38659,114 @@ function staticFilesHandler(ws, devMode, getManifest) {
       });
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
-      const publicFile = join21(ws.publicDir, path4.slice(1));
-      if (existsSync18(publicFile))
+      const publicFile = join22(ws.publicDir, path4.slice(1));
+      if (existsSync19(publicFile))
         return serveFile(publicFile, ctx.corsHeaders);
     }
     return null;
   };
 }
-function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap, telemetry) {
+function parseCorsOrigins(raw) {
+  if (!raw)
+    return;
+  const list = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  return list.length > 0 ? list : undefined;
+}
+var DISCOVERY_SCHEMA_VERSION = 1;
+function safeEqual(a2, b4) {
+  const ab = Buffer.from(a2);
+  const bb = Buffer.from(b4);
+  if (ab.length !== bb.length)
+    return false;
+  return timingSafeEqual(ab, bb);
+}
+function handleDiscovery(req, ctx, ws, manifest, federation, mapUrl) {
+  if (!federation) {
+    return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+  }
+  const presented = req.headers.get("X-Arc-Pairing-Token");
+  if (!presented || !safeEqual(presented, federation.registrationToken)) {
+    return new Response("Unauthorized", {
+      status: 401,
+      headers: ctx.corsHeaders
+    });
+  }
+  const fed = manifest.federation;
+  const platformUrl = process.env.ARC_PUBLIC_URL || new URL(req.url).origin;
+  return Response.json({
+    meta: {
+      schemaVersion: DISCOVERY_SCHEMA_VERSION,
+      name: ws.appName,
+      version: ws.rootPkg?.version ?? undefined
+    },
+    platformUrl,
+    federation: fed ? {
+      slug: fed.config.slug,
+      auth: fed.config.auth,
+      modules: fed.modules,
+      permissions: fed.permissions,
+      slots: fed.slots
+    } : null,
+    peers: manifest.shell?.peers ?? null,
+    federationManifestUrl: fed ? `${platformUrl}/api/federation/manifest` : null,
+    mapUrl: mapUrl ?? null
+  }, { headers: { ...ctx.corsHeaders, "Cache-Control": "no-cache, private" } });
+}
+async function handleFederationRegister(req, ctx, manifest, federation) {
+  const fed = manifest.federation;
+  if (!fed || !federation) {
+    return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+  }
+  const presented = req.headers.get("X-Arc-Pairing-Token");
+  if (!presented || !safeEqual(presented, federation.registrationToken)) {
+    return new Response("Unauthorized", {
+      status: 401,
+      headers: ctx.corsHeaders
+    });
+  }
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return new Response("Bad Request", {
+      status: 400,
+      headers: ctx.corsHeaders
+    });
+  }
+  const hostId = typeof body.hostId === "string" ? body.hostId : "";
+  const hostUrl = typeof body.hostUrl === "string" ? body.hostUrl : "";
+  const hostName = typeof body.hostName === "string" ? body.hostName : hostId;
+  const organizationId = typeof body.organizationId === "string" ? body.organizationId : "";
+  if (!hostId || !hostUrl) {
+    return new Response("Bad Request: hostId + hostUrl required", {
+      status: 400,
+      headers: ctx.corsHeaders
+    });
+  }
+  ok(`Federation: host "${hostName}" (${hostUrl}) registered for org ${organizationId || "\u2014"}`);
+  return Response.json({
+    secret: federation.appSecret,
+    slug: fed.config.slug,
+    auth: fed.config.auth,
+    modules: fed.modules,
+    permissions: fed.permissions,
+    slots: fed.slots
+  }, { headers: { ...ctx.corsHeaders, "Cache-Control": "no-store" } });
+}
+function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap, telemetry, federation, getMapUrl) {
   return (req, url, ctx) => {
+    if (url.pathname === "/api/discovery") {
+      return handleDiscovery(req, ctx, ws, getManifest(), federation, getMapUrl?.());
+    }
+    if (url.pathname === "/api/federation/register") {
+      if (req.method !== "POST") {
+        return new Response("Method Not Allowed", {
+          status: 405,
+          headers: { ...ctx.corsHeaders, Allow: "POST, OPTIONS" }
+        });
+      }
+      return handleFederationRegister(req, ctx, getManifest(), federation);
+    }
     if (url.pathname === "/api/modules") {
       const arcTokensHeader = req.headers.get("X-Arc-Tokens");
       let payloads = parseArcTokensHeader(arcTokensHeader);
@@ -38379,6 +38780,36 @@ function apiEndpointsHandler(ws, getManifest, cm, moduleAccessMap, telemetry) {
         }
       }));
     }
+    if (url.pathname === "/api/federation/manifest") {
+      const m4 = getManifest();
+      if (!m4.federation || !m4.shell) {
+        return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
+      }
+      const arcTokensHeader = req.headers.get("X-Arc-Tokens");
+      let payloads = parseArcTokensHeader(arcTokensHeader);
+      if (payloads.length === 0 && ctx.tokenPayload) {
+        payloads = [ctx.tokenPayload];
+      }
+      const fed = m4.federation;
+      return filterGroupsForTokens(fed.build.groups, moduleAccessMap, payloads, "/browser-fed").then((groups) => Response.json({
+        initial: fed.build.initial,
+        groups,
+        sharedChunks: fed.build.sharedChunks,
+        stylesHash: m4.stylesHash,
+        peers: m4.shell.peers,
+        app: {
+          slug: fed.config.slug,
+          name: ws.appName,
+          version: ws.rootPkg.version ?? undefined,
+          modules: fed.modules,
+          permissions: fed.permissions,
+          slots: fed.slots,
+          auth: fed.config.auth
+        }
+      }, {
+        headers: { ...ctx.corsHeaders, "Cache-Control": "no-cache, private" }
+      }));
+    }
     if (url.pathname === "/api/translations") {
       const config = readTranslationsConfig(ws.rootDir);
       return Response.json(config ?? { locales: [], sourceLocale: "" }, {
@@ -38424,6 +38855,17 @@ function devReloadHandler(sseClients) {
     });
   };
 }
+function headlessFallbackHandler(ws, getManifest) {
+  return (_req, _url, ctx) => {
+    const m4 = getManifest();
+    return Response.json({
+      arc: "headless",
+      app: ws.appName,
+      federation: m4.federation ?? null,
+      endpoints: ["/api/federation/manifest", "/api/modules", "/health"]
+    }, { headers: ctx.corsHeaders });
+  };
+}
 function spaFallbackHandler(getShellHtml) {
   return (_req, _url, ctx) => {
     return new Response(getShellHtml(), {
@@ -38466,8 +38908,14 @@ async function startPlatformServer(opts) {
   const setManifest = (m4) => {
     manifest = m4;
   };
-  const getShellHtml = () => generateShellHtml(ws.appName, ws.manifest, manifest?.initial, manifest?.stylesHash);
+  let mapUrl = opts.mapUrl;
+  const setMapUrl = (u2) => {
+    mapUrl = u2;
+  };
+  const getMapUrl = () => mapUrl;
+  const getShellHtml = () => generateShellHtml(ws.appName, ws.manifest, manifest?.initial, manifest?.stylesHash, manifest?.shell);
   const sseClients = new Set;
+  const fallbackHandler = opts.headless ? headlessFallbackHandler(ws, getManifest) : spaFallbackHandler(getShellHtml);
   const notifyReload = (m4) => {
     const data = JSON.stringify(m4);
     for (const c2 of sseClients) {
@@ -38493,18 +38941,23 @@ async function startPlatformServer(opts) {
       port,
       async fetch(req) {
         const url = new URL(req.url);
-        if (req.method === "OPTIONS")
-          return new Response(null, { headers: cors });
+        if (req.method === "OPTIONS") {
+          const headers = { ...cors };
+          if (req.headers.get("Access-Control-Request-Private-Network")) {
+            headers["Access-Control-Allow-Private-Network"] = "true";
+          }
+          return new Response(null, { headers });
+        }
         const ctx = {
           rawToken: null,
           tokenPayload: null,
           corsHeaders: cors
         };
         const handlers = [
-          apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry),
+          apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry, opts.federation, getMapUrl),
           devReloadHandler(sseClients),
           staticFilesHandler(ws, !!devMode, getManifest),
-          spaFallbackHandler(getShellHtml)
+          fallbackHandler
         ];
         for (const handler of handlers) {
           const response = await handler(req, url, ctx);
@@ -38519,11 +38972,12 @@ async function startPlatformServer(opts) {
       contextHandler: null,
       connectionManager: null,
       setManifest,
+      setMapUrl,
       notifyReload,
       stop: () => server.stop()
     };
   }
-  const dbPath = opts.dbPath || join21(ws.arcDir, "data", "arc.db");
+  const dbPath = opts.dbPath || join22(ws.arcDir, "data", "arc.db");
   const baseDbFactory = await resolveDbAdapterFactory(dbPath);
   let dbAdapterFactory = baseDbFactory;
   if (telemetry) {
@@ -38539,11 +38993,13 @@ async function startPlatformServer(opts) {
     dbAdapterFactory,
     port,
     coep,
+    corsOrigins: parseCorsOrigins(process.env.ARC_CORS_ORIGINS),
+    allowPrivateNetwork: !!devMode,
     httpHandlers: [
-      apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry),
+      apiEndpointsHandler(ws, getManifest, null, moduleAccessMap, telemetry, opts.federation, getMapUrl),
       devReloadHandler(sseClients),
       staticFilesHandler(ws, !!devMode, getManifest),
-      spaFallbackHandler(getShellHtml)
+      fallbackHandler
     ],
     onWsClose: (clientId) => cleanupClientSubs(clientId),
     telemetry
@@ -38553,6 +39009,7 @@ async function startPlatformServer(opts) {
     contextHandler: arcServer.contextHandler,
     connectionManager: arcServer.connectionManager,
     setManifest,
+    setMapUrl,
     notifyReload,
     stop: () => {
       arcServer.stop();
@@ -38565,17 +39022,23 @@ async function startPlatformServer(opts) {
 async function startPlatform(opts) {
   const { ws, devMode } = opts;
   const port = opts.port ?? parseInt(process.env.PORT || "5005", 10);
-  const dbPath = opts.dbPath ?? join22(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
+  const dbPath = opts.dbPath ?? join23(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
   let manifest;
   if (devMode) {
     manifest = await buildAll(ws);
   } else {
-    const manifestPath = join22(ws.arcDir, "manifest.json");
-    if (!existsSync19(manifestPath)) {
+    const manifestPath = join23(ws.arcDir, "manifest.json");
+    if (!existsSync20(manifestPath)) {
       err("No build found. Run `arc platform build` first.");
       process.exit(1);
     }
-    manifest = JSON.parse(readFileSync16(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync17(manifestPath, "utf-8"));
+  }
+  assertProdFederationSecrets(devMode, !!manifest.federation);
+  const needsPairing = !!manifest.federation || devMode && (opts.map || opts.headless);
+  const pairingToken = needsPairing ? resolvePairingToken(ws.rootDir) : undefined;
+  if (manifest.federation) {
+    process.env.ARC_APP_SECRET = resolveAppSecret(ws.rootDir);
   }
   log2("Loading server context...");
   const { context: context2, moduleAccess } = await loadServerContext(ws);
@@ -38596,7 +39059,12 @@ async function startPlatform(opts) {
         context: context2,
         moduleAccess,
         dbPath,
-        devMode
+        devMode,
+        headless: opts.headless,
+        federation: manifest.federation && pairingToken ? {
+          registrationToken: pairingToken,
+          appSecret: process.env.ARC_APP_SECRET
+        } : undefined
       });
       break;
     } catch (e2) {
@@ -38617,8 +39085,18 @@ async function startPlatform(opts) {
     ok("Commands, queries, WebSocket \u2014 all on same port");
   }
   let onReload;
-  if (devMode && opts.map) {
-    onReload = await startMapTool(ws, actualPort + 1);
+  if (devMode && (opts.map || opts.headless)) {
+    onReload = await startMapTool(ws, actualPort + 1, pairingToken, platform3, {
+      platformUrl: `http://localhost:${actualPort}`,
+      federation: manifest.federation ? {
+        slug: manifest.federation.config.slug,
+        auth: manifest.federation.config.auth,
+        modules: manifest.federation.modules,
+        permissions: manifest.federation.permissions,
+        slots: manifest.federation.slots
+      } : undefined,
+      peers: manifest.shell?.peers
+    });
   }
   if (devMode) {
     attachDevWatcher(ws, platform3, onReload);
@@ -38630,25 +39108,98 @@ async function startPlatform(opts) {
   process.on("SIGTERM", cleanup);
   process.on("SIGINT", cleanup);
 }
-async function startMapTool(ws, port) {
+async function startMapTool(ws, port, authToken, platformServer, platform3) {
   try {
-    const { startMapServer } = await import("@arcote.tech/arc-map");
+    const { startMapServer, MAP_SCHEMA_VERSION } = await import("@arcote.tech/arc-map");
     const { getContext } = await import("@arcote.tech/platform");
-    const globs = ws.packages.map((p3) => join22(p3.path, "src", "**", "*.{ts,tsx}"));
-    const packageOf = (absFile) => ws.packages.find((p3) => absFile.startsWith(join22(p3.path, "src")))?.name;
+    const globs = ws.packages.map((p3) => join23(p3.path, "src", "**", "*.{ts,tsx}"));
+    const packageOf = (absFile) => ws.packages.find((p3) => absFile.startsWith(join23(p3.path, "src")))?.name;
+    const meta = readAppMeta(ws.rootDir, MAP_SCHEMA_VERSION);
     const map = await startMapServer({
       getContext: () => getContext(),
       scan: { globs, workspaceRoot: ws.rootDir, packageOf },
       useCasePackages: ws.packages.map((p3) => ({ name: p3.name, path: p3.path })),
-      port
+      port,
+      authToken,
+      meta,
+      platform: platform3
     });
+    platformServer.setMapUrl(map.url);
     ok(`Context map \u2192 ${map.url}`);
+    ok(`Pairing token: ${authToken}`);
     return map.notifyReload;
   } catch (e2) {
     err(`Context map failed to start: ${e2.message}`);
     return;
   }
 }
+function assertProdFederationSecrets(devMode, hasFederation) {
+  if (devMode || !hasFederation)
+    return;
+  const missing = [];
+  if (!process.env.ARC_APP_SECRET)
+    missing.push("ARC_APP_SECRET");
+  if (!process.env.ARC_PAIRING_TOKEN && !process.env.ARC_MAP_TOKEN) {
+    missing.push("ARC_PAIRING_TOKEN");
+  }
+  if (missing.length === 0)
+    return;
+  err(`Federacja w produkcji wymaga zmiennych \u015Brodowiskowych: ${missing.join(", ")}.
+` + `  Bez nich sekret i token s\u0105 generowane w kontenerze i GIN\u0104 przy pierwszym
+` + `  recreate \u2014 hosty musia\u0142yby przeinstalowa\u0107 aplikacj\u0119, bez \u017Cadnego b\u0142\u0119du.
+` + `  Ustaw je w deployu (deploy.arc.json \u2192 envVars + deploy.arc.<env>.env).`);
+  process.exit(1);
+}
+function resolveAppSecret(rootDir) {
+  const fromEnv = process.env.ARC_APP_SECRET;
+  if (fromEnv)
+    return fromEnv;
+  const file = join23(rootDir, ".arc", "app-secret");
+  try {
+    const saved = readFileSync17(file, "utf-8").trim();
+    if (saved)
+      return saved;
+  } catch {}
+  const secret = randomBytes2(32).toString("base64url");
+  try {
+    mkdirSync16(join23(rootDir, ".arc"), { recursive: true });
+    writeFileSync16(file, secret, { mode: 384 });
+  } catch (e2) {
+    err(`App secret not persisted (${e2.message}) \u2014 hosts will need re-install after restart`);
+  }
+  return secret;
+}
+function resolvePairingToken(rootDir) {
+  const fromEnv = process.env.ARC_PAIRING_TOKEN || process.env.ARC_MAP_TOKEN;
+  if (fromEnv)
+    return fromEnv;
+  const file = join23(rootDir, ".arc", "pairing-token");
+  try {
+    const saved = readFileSync17(file, "utf-8").trim();
+    if (saved)
+      return saved;
+  } catch {}
+  const token = randomBytes2(16).toString("base64url");
+  try {
+    mkdirSync16(join23(rootDir, ".arc"), { recursive: true });
+    writeFileSync16(file, token, { mode: 384 });
+  } catch (e2) {
+    err(`Pairing token not persisted (${e2.message}) \u2014 it will change on restart`);
+  }
+  return token;
+}
+function readAppMeta(rootDir, schemaVersion) {
+  try {
+    const pkg = JSON.parse(readFileSync17(join23(rootDir, "package.json"), "utf-8"));
+    return {
+      schemaVersion,
+      name: pkg.name ?? rootDir.split("/").pop() ?? "arc-app",
+      version: pkg.version
+    };
+  } catch {
+    return { schemaVersion, name: rootDir.split("/").pop() ?? "arc-app" };
+  }
+}
 function attachDevWatcher(ws, platform3, onReload) {
   log2("Watching for changes...");
   let rebuildTimer = null;
@@ -38675,8 +39226,8 @@ function attachDevWatcher(ws, platform3, onReload) {
     }, 300);
   };
   for (const pkg of ws.packages) {
-    const srcDir = join22(pkg.path, "src");
-    if (!existsSync19(srcDir))
+    const srcDir = join23(pkg.path, "src");
+    if (!existsSync20(srcDir))
       continue;
     watch(srcDir, { recursive: true }, (_event, filename) => {
       if (!filename || filename.includes(".arc") || filename.endsWith(".d.ts") || filename.includes("node_modules") || filename.includes("dist"))
@@ -38686,8 +39237,8 @@ function attachDevWatcher(ws, platform3, onReload) {
       triggerRebuild();
     });
   }
-  const localesDir = join22(ws.rootDir, "locales");
-  if (existsSync19(localesDir)) {
+  const localesDir = join23(ws.rootDir, "locales");
+  if (existsSync20(localesDir)) {
     watch(localesDir, { recursive: false }, (_event, filename) => {
       if (!filename?.endsWith(".po"))
         return;
@@ -38699,7 +39250,12 @@ function attachDevWatcher(ws, platform3, onReload) {
 // src/commands/platform-dev.ts
 async function platformDev(opts = {}) {
   const ws = resolveWorkspace();
-  await startPlatform({ ws, devMode: true, map: opts.map });
+  await startPlatform({
+    ws,
+    devMode: true,
+    map: opts.map,
+    headless: opts.headless
+  });
 }
 
 // src/commands/platform-start.ts
@@ -38714,7 +39270,11 @@ program2.name("arc").description("CLI tool for Arc framework").version("0.0.3");
 program2.command("dev").description("Run development mode for Arc framework").action(dev);
 program2.command("build").description("Build all clients and declarations").action(build);
 var platform3 = program2.command("platform").description("Platform commands \u2014 run full stack (server + UI)");
-platform3.command("dev").description("Start platform in dev mode (Bun server + Vite HMR)").option("--no-cache", "Force full rebuild on startup").option("--map", "Also start the Arc Context Map dev tool on a separate port").action((opts) => platformDev({ noCache: opts.cache === false, map: opts.map }));
+platform3.command("dev").description("Start platform in dev mode (Bun server + Vite HMR)").option("--no-cache", "Force full rebuild on startup").option("--map", "Also start the Arc Context Map dev tool on a separate port").option("--headless", "Host API + federated module chunks + map, WITHOUT the app's own SPA shell (implies --map)").action((opts) => platformDev({
+  noCache: opts.cache === false,
+  map: opts.map,
+  headless: opts.headless
+}));
 platform3.command("build").description("Build platform for production").option("--no-cache", "Force full rebuild").action((opts) => platformBuild({ noCache: opts.cache === false }));
 platform3.command("start").description("Start platform in production mode (requires prior build)").action(platformStart);
 platform3.command("deploy [env]").description("Deploy platform to a remote server (reads deploy.arc.json, surveys if missing)").option("--skip-build", "Skip local build step").option("--rebuild", "Force rebuild before deploy").option("--build-only", "Build the Docker image locally, then exit (no remote push)").option("--image-tag <hash>", "Roll back / pin to an existing image tag instead of building a new one").option("--force-bootstrap", "Re-run Ansible host bootstrap even if the server is already configured").action((env2, opts) => platformDeploy(env2, opts));