@arcote.tech/arc-cli 0.8.4 → 0.8.6

package/dist/index.js

@@ -10191,8 +10191,72 @@ function apply(state, patches, applyOptions) {
   }
   return create(state, mutate, Object.assign(Object.assign({}, applyOptions), { enablePatches: false }));
 }
-function hasLocalStorage() {
-  return typeof localStorage !== "undefined";
+function hasDocument() {
+  return typeof document !== "undefined";
+}
+function signalCrossTabChange() {
+  if (typeof localStorage === "undefined")
+    return;
+  try {
+    localStorage.setItem(TOKEN_BUMP_KEY, String(Date.now()));
+  } catch {}
+}
+function isSecureContext() {
+  return typeof location !== "undefined" && location.protocol === "https:";
+}
+function tokenCookieName(scopeKey) {
+  return scopeKey === "default" ? COOKIE_PREFIX : `${COOKIE_PREFIX}_${scopeKey.replace(/:/g, ".")}`;
+}
+function scopeKeyFromCookieName(name) {
+  if (name === COOKIE_PREFIX)
+    return "default";
+  if (!name.startsWith(`${COOKIE_PREFIX}_`))
+    return null;
+  return name.slice(COOKIE_PREFIX.length + 1).replace(/\./g, ":");
+}
+function maxAgeFromExp(exp) {
+  const THIRTY_DAYS = 30 * 24 * 60 * 60;
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return THIRTY_DAYS;
+  const expMs = exp > 1000000000000 ? exp : exp * 1000;
+  const secs = Math.floor((expMs - Date.now()) / 1000);
+  return secs > 0 ? secs : THIRTY_DAYS;
+}
+function writeTokenCookie(scopeKey, jwt, exp) {
+  if (!hasDocument())
+    return;
+  const attrs = [
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${maxAgeFromExp(exp)}`
+  ];
+  if (isSecureContext())
+    attrs.push("Secure");
+  document.cookie = `${tokenCookieName(scopeKey)}=${encodeURIComponent(jwt)}; ${attrs.join("; ")}`;
+  signalCrossTabChange();
+}
+function removeTokenCookie(scopeKey) {
+  if (!hasDocument())
+    return;
+  document.cookie = `${tokenCookieName(scopeKey)}=; Path=/; SameSite=Lax; Max-Age=0`;
+  signalCrossTabChange();
+}
+function readAllTokenCookies() {
+  if (!hasDocument() || !document.cookie)
+    return [];
+  const out = [];
+  for (const part of document.cookie.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0)
+      continue;
+    const scopeKey = scopeKeyFromCookieName(part.slice(0, eq).trim());
+    if (scopeKey === null)
+      continue;
+    const jwt = decodeURIComponent(part.slice(eq + 1).trim());
+    if (jwt)
+      out.push({ scopeKey, jwt });
+  }
+  return out;
 }
 function notifyTokenChange(scope) {
   if (typeof window !== "undefined") {
@@ -10208,24 +10272,21 @@ class AuthAdapter {
   constructor(options) {
     this.namespace = options?.storageNamespace || undefined;
   }
-  storageKey(scope) {
-    return this.namespace ? `${TOKEN_PREFIX}${this.namespace}:${scope}` : TOKEN_PREFIX + scope;
+  scopeKey(scope) {
+    return this.namespace ? `${this.namespace}:${scope}` : scope;
   }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
-      if (hasLocalStorage()) {
-        localStorage.removeItem(this.storageKey(scope));
-        notifyTokenChange(scope);
-      }
+      removeTokenCookie(this.scopeKey(scope));
+      notifyTokenChange(scope);
       return;
     }
     try {
       const parts = token.split(".");
       if (parts.length !== 3) {
         this.scopes.delete(scope);
-        if (hasLocalStorage())
-          localStorage.removeItem(this.storageKey(scope));
+        removeTokenCookie(this.scopeKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -10238,49 +10299,45 @@ class AuthAdapter {
           exp: payload.exp
         }
       });
-      if (hasLocalStorage()) {
-        localStorage.setItem(this.storageKey(scope), token);
-        notifyTokenChange(scope);
-      }
+      writeTokenCookie(this.scopeKey(scope), token, payload.exp);
+      notifyTokenChange(scope);
     } catch {
       this.scopes.delete(scope);
-      if (hasLocalStorage())
-        localStorage.removeItem(this.storageKey(scope));
+      removeTokenCookie(this.scopeKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
     this.scopes.set(scope, { raw: "", decoded });
   }
   loadPersisted() {
-    if (!hasLocalStorage())
-      return;
-    const prefix = this.namespace ? `${TOKEN_PREFIX}${this.namespace}:` : TOKEN_PREFIX;
-    for (let i = 0;i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.startsWith(prefix)) {
-        const scope = key.slice(prefix.length);
-        if (!this.namespace && scope.includes(":"))
+    const nsPrefix = this.namespace ? `${this.namespace}:` : "";
+    for (const { scopeKey, jwt } of readAllTokenCookies()) {
+      let scope;
+      if (this.namespace) {
+        if (!scopeKey.startsWith(nsPrefix))
           continue;
-        const raw = localStorage.getItem(key);
-        if (raw) {
-          try {
-            const parts = raw.split(".");
-            if (parts.length !== 3)
-              continue;
-            const payload = JSON.parse(atob(parts[1]));
-            this.scopes.set(scope, {
-              raw,
-              decoded: {
-                tokenName: payload.tokenName,
-                params: payload.params || {},
-                iat: payload.iat,
-                exp: payload.exp
-              }
-            });
-          } catch {
-            localStorage.removeItem(key);
+        scope = scopeKey.slice(nsPrefix.length);
+      } else {
+        if (scopeKey.includes(":"))
+          continue;
+        scope = scopeKey;
+      }
+      try {
+        const parts = jwt.split(".");
+        if (parts.length !== 3)
+          continue;
+        const payload = JSON.parse(atob(parts[1]));
+        this.scopes.set(scope, {
+          raw: jwt,
+          decoded: {
+            tokenName: payload.tokenName,
+            params: payload.params || {},
+            iat: payload.iat,
+            exp: payload.exp
           }
-        }
+        });
+      } catch {
+        removeTokenCookie(scopeKey);
       }
     }
   }
@@ -10312,10 +10369,8 @@ class AuthAdapter {
     return Array.from(this.scopes.keys());
   }
   clear() {
-    if (hasLocalStorage()) {
-      for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(this.storageKey(scope));
-      }
+    for (const scope of this.scopes.keys()) {
+      removeTokenCookie(this.scopeKey(scope));
     }
     this.scopes.clear();
   }
@@ -14595,7 +14650,7 @@ var Operation, PROXY_DRAFT, RAW_RETURN_SYMBOL, iteratorSymbol, dataTypes, intern
     }
     return returnValue(result);
   };
-}, create, constructorString, TOKEN_PREFIX = "arc:token:", DEFAULT_TIMEOUT_MS = 8000, provider = null, latestSync = null, syncSeq = 0, eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcAuthenticationError, ArcAuthorizationError2, ArcValidationError2, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, _te, _td, originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
+}, create, constructorString, COOKIE_PREFIX = "arc_token", TOKEN_BUMP_KEY = "arc:token-bump", DEFAULT_TIMEOUT_MS = 8000, provider = null, latestSync = null, syncSeq = 0, eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcAuthenticationError, ArcAuthorizationError2, ArcValidationError2, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, _te, _td, originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
   const user = typeHandlers(types22 || {});
   return {
     serializers: Object.assign({}, serializers, user.serializers),
@@ -17838,8 +17893,72 @@ function apply2(state, patches, applyOptions) {
   }
   return create2(state, mutate, Object.assign(Object.assign({}, applyOptions), { enablePatches: false }));
 }
-function hasLocalStorage2() {
-  return typeof localStorage !== "undefined";
+function hasDocument2() {
+  return typeof document !== "undefined";
+}
+function signalCrossTabChange2() {
+  if (typeof localStorage === "undefined")
+    return;
+  try {
+    localStorage.setItem(TOKEN_BUMP_KEY2, String(Date.now()));
+  } catch {}
+}
+function isSecureContext2() {
+  return typeof location !== "undefined" && location.protocol === "https:";
+}
+function tokenCookieName2(scopeKey) {
+  return scopeKey === "default" ? COOKIE_PREFIX2 : `${COOKIE_PREFIX2}_${scopeKey.replace(/:/g, ".")}`;
+}
+function scopeKeyFromCookieName2(name) {
+  if (name === COOKIE_PREFIX2)
+    return "default";
+  if (!name.startsWith(`${COOKIE_PREFIX2}_`))
+    return null;
+  return name.slice(COOKIE_PREFIX2.length + 1).replace(/\./g, ":");
+}
+function maxAgeFromExp2(exp) {
+  const THIRTY_DAYS = 30 * 24 * 60 * 60;
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return THIRTY_DAYS;
+  const expMs = exp > 1000000000000 ? exp : exp * 1000;
+  const secs = Math.floor((expMs - Date.now()) / 1000);
+  return secs > 0 ? secs : THIRTY_DAYS;
+}
+function writeTokenCookie2(scopeKey, jwt, exp) {
+  if (!hasDocument2())
+    return;
+  const attrs = [
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${maxAgeFromExp2(exp)}`
+  ];
+  if (isSecureContext2())
+    attrs.push("Secure");
+  document.cookie = `${tokenCookieName2(scopeKey)}=${encodeURIComponent(jwt)}; ${attrs.join("; ")}`;
+  signalCrossTabChange2();
+}
+function removeTokenCookie2(scopeKey) {
+  if (!hasDocument2())
+    return;
+  document.cookie = `${tokenCookieName2(scopeKey)}=; Path=/; SameSite=Lax; Max-Age=0`;
+  signalCrossTabChange2();
+}
+function readAllTokenCookies2() {
+  if (!hasDocument2() || !document.cookie)
+    return [];
+  const out = [];
+  for (const part of document.cookie.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0)
+      continue;
+    const scopeKey = scopeKeyFromCookieName2(part.slice(0, eq).trim());
+    if (scopeKey === null)
+      continue;
+    const jwt = decodeURIComponent(part.slice(eq + 1).trim());
+    if (jwt)
+      out.push({ scopeKey, jwt });
+  }
+  return out;
 }
 function notifyTokenChange2(scope) {
   if (typeof window !== "undefined") {
@@ -17855,24 +17974,21 @@ class AuthAdapter2 {
   constructor(options) {
     this.namespace = options?.storageNamespace || undefined;
   }
-  storageKey(scope) {
-    return this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:${scope}` : TOKEN_PREFIX2 + scope;
+  scopeKey(scope) {
+    return this.namespace ? `${this.namespace}:${scope}` : scope;
   }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
-      if (hasLocalStorage2()) {
-        localStorage.removeItem(this.storageKey(scope));
-        notifyTokenChange2(scope);
-      }
+      removeTokenCookie2(this.scopeKey(scope));
+      notifyTokenChange2(scope);
       return;
     }
     try {
       const parts = token.split(".");
       if (parts.length !== 3) {
         this.scopes.delete(scope);
-        if (hasLocalStorage2())
-          localStorage.removeItem(this.storageKey(scope));
+        removeTokenCookie2(this.scopeKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -17885,49 +18001,45 @@ class AuthAdapter2 {
           exp: payload.exp
         }
       });
-      if (hasLocalStorage2()) {
-        localStorage.setItem(this.storageKey(scope), token);
-        notifyTokenChange2(scope);
-      }
+      writeTokenCookie2(this.scopeKey(scope), token, payload.exp);
+      notifyTokenChange2(scope);
     } catch {
       this.scopes.delete(scope);
-      if (hasLocalStorage2())
-        localStorage.removeItem(this.storageKey(scope));
+      removeTokenCookie2(this.scopeKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
     this.scopes.set(scope, { raw: "", decoded });
   }
   loadPersisted() {
-    if (!hasLocalStorage2())
-      return;
-    const prefix = this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:` : TOKEN_PREFIX2;
-    for (let i = 0;i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.startsWith(prefix)) {
-        const scope = key.slice(prefix.length);
-        if (!this.namespace && scope.includes(":"))
+    const nsPrefix = this.namespace ? `${this.namespace}:` : "";
+    for (const { scopeKey, jwt } of readAllTokenCookies2()) {
+      let scope;
+      if (this.namespace) {
+        if (!scopeKey.startsWith(nsPrefix))
           continue;
-        const raw = localStorage.getItem(key);
-        if (raw) {
-          try {
-            const parts = raw.split(".");
-            if (parts.length !== 3)
-              continue;
-            const payload = JSON.parse(atob(parts[1]));
-            this.scopes.set(scope, {
-              raw,
-              decoded: {
-                tokenName: payload.tokenName,
-                params: payload.params || {},
-                iat: payload.iat,
-                exp: payload.exp
-              }
-            });
-          } catch {
-            localStorage.removeItem(key);
+        scope = scopeKey.slice(nsPrefix.length);
+      } else {
+        if (scopeKey.includes(":"))
+          continue;
+        scope = scopeKey;
+      }
+      try {
+        const parts = jwt.split(".");
+        if (parts.length !== 3)
+          continue;
+        const payload = JSON.parse(atob(parts[1]));
+        this.scopes.set(scope, {
+          raw: jwt,
+          decoded: {
+            tokenName: payload.tokenName,
+            params: payload.params || {},
+            iat: payload.iat,
+            exp: payload.exp
           }
-        }
+        });
+      } catch {
+        removeTokenCookie2(scopeKey);
       }
     }
   }
@@ -17959,10 +18071,8 @@ class AuthAdapter2 {
     return Array.from(this.scopes.keys());
   }
   clear() {
-    if (hasLocalStorage2()) {
-      for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(this.storageKey(scope));
-      }
+    for (const scope of this.scopes.keys()) {
+      removeTokenCookie2(this.scopeKey(scope));
     }
     this.scopes.clear();
   }
@@ -20673,7 +20783,7 @@ var Operation2, PROXY_DRAFT2, RAW_RETURN_SYMBOL2, iteratorSymbol2, dataTypes2, i
     }
     return returnValue(result);
   };
-}, create2, constructorString2, TOKEN_PREFIX2 = "arc:token:", DEFAULT_TIMEOUT_MS2 = 8000, provider2 = null, latestSync2 = null, syncSeq2 = 0, eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcAuthenticationError2, ArcAuthorizationError3, ArcValidationError3, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, _te2, _td2, SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
+}, create2, constructorString2, COOKIE_PREFIX2 = "arc_token", TOKEN_BUMP_KEY2 = "arc:token-bump", DEFAULT_TIMEOUT_MS2 = 8000, provider2 = null, latestSync2 = null, syncSeq2 = 0, eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcAuthenticationError2, ArcAuthorizationError3, ArcValidationError3, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, _te2, _td2, SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
   return async (context) => {
     const adapter = new SQLiteAdapter(db, context);
     await adapter.initialize();
@@ -31322,8 +31432,8 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname8, join as join13 } from "path";
+import { copyFileSync, existsSync as existsSync12, mkdirSync as mkdirSync10, readdirSync as readdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname8, join as join14 } from "path";
 
 // src/builder/module-builder.ts
 import { execSync } from "child_process";
@@ -31692,7 +31802,7 @@ function workspaceSourcePlugin(srcByName) {
     }
   };
 }
-var SERVER_ONLY_NODE_BUILTINS = new Set([
+var SERVER_ONLY_NODE_BUILTINS = [
   "crypto",
   "stream",
   "zlib",
@@ -31720,15 +31830,13 @@ var SERVER_ONLY_NODE_BUILTINS = new Set([
   "diagnostics_channel",
   "module",
   "constants"
-]);
+];
+var NODE_STUB_FILTER = new RegExp(`^(node:)?(${SERVER_ONLY_NODE_BUILTINS.map((b) => b.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")).join("|")})$`);
 function nodeServerBuiltinStubPlugin() {
   return {
     name: "node-server-builtin-stub",
     setup(build2) {
-      build2.onResolve({ filter: /^(node:)?[a-z_/]+$/ }, (args) => {
-        const bare = args.path.replace(/^node:/, "");
-        if (!SERVER_ONLY_NODE_BUILTINS.has(bare))
-          return;
+      build2.onResolve({ filter: NODE_STUB_FILTER }, (args) => {
         return { path: args.path, namespace: "node-server-stub" };
       });
       build2.onLoad({ filter: /.*/, namespace: "node-server-stub" }, (args) => ({
@@ -32023,6 +32131,26 @@ function readServerExternals(path4) {
     return [];
   }
 }
+var STATIC_CHUNK_IMPORT = /(?:^|[;}\s])import\s*["']\.\/(chunk-[a-z0-9]+\.js)["']|from\s*["']\.\/(chunk-[a-z0-9]+\.js)["']/g;
+function staticChunkClosure(entryBytes, chunkBytes) {
+  const seen = new Set;
+  const stack = [entryBytes];
+  while (stack.length) {
+    const src = Buffer.from(stack.pop()).toString("utf8");
+    STATIC_CHUNK_IMPORT.lastIndex = 0;
+    let m;
+    while (m = STATIC_CHUNK_IMPORT.exec(src)) {
+      const chunk = m[1] ?? m[2];
+      if (seen.has(chunk))
+        continue;
+      seen.add(chunk);
+      const b = chunkBytes.get(chunk);
+      if (b)
+        stack.push(b);
+    }
+  }
+  return [...seen];
+}
 function buildStatsEnabled() {
   return process.env.ARC_BUILD_STATS === "1";
 }
@@ -32322,22 +32450,31 @@ export { startApp } from "@arcote.tech/platform";
   }
   let initialFile = "";
   let initialHash = "";
+  let initialStaticChunks = [];
   const groups = {};
   const sharedChunks = [];
+  const chunkBytes = new Map;
+  for (const out of outFiles) {
+    if (out.kind === "chunk")
+      chunkBytes.set(out.name, out.bytes);
+  }
   for (const out of outFiles) {
     if (out.kind === "entry-point") {
       const hash = sha256Hex(out.bytes).slice(0, 16);
       const stem = out.name.replace(/\.js$/, "");
       const finalName = `${stem}.${hash}.js`;
       writeFileSync7(join9(outDir, finalName), out.bytes);
+      const staticChunks = staticChunkClosure(out.bytes, chunkBytes);
       if (stem === "initial") {
         initialFile = finalName;
         initialHash = hash;
+        initialStaticChunks = staticChunks;
       } else {
         groups[stem] = {
           file: finalName,
           hash,
-          modules: groupModuleMap.get(stem) ?? []
+          modules: groupModuleMap.get(stem) ?? [],
+          staticChunks
         };
       }
     } else if (out.kind === "chunk") {
@@ -32365,7 +32502,7 @@ export { startApp } from "@arcote.tech/platform";
     }
   }
   const manifest = {
-    initial: { file: initialFile, hash: initialHash },
+    initial: { file: initialFile, hash: initialHash, staticChunks: initialStaticChunks },
     groups,
     sharedChunks,
     cached: false
@@ -32629,9 +32766,86 @@ const { writeFileSync } = await import("node:fs");
 writeFileSync(out, JSON.stringify({ access, exposure }, null, 2) + "\\n");
 `.trim();
 
+// src/builder/seed-guard.ts
+import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync10 } from "fs";
+import { join as join11, relative as relative4, sep as sep3 } from "path";
+var CALL = /\.(?:seedWith|withSeeds)\s*\(/g;
+var GATED = /^\.(?:seedWith|withSeeds)\s*\(\s*ONLY_SERVER\b/;
+function walkTsFiles(dir, out) {
+  for (const entry of readdirSync5(dir, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || entry.name === "dist")
+      continue;
+    const abs = join11(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "__tests__")
+        continue;
+      walkTsFiles(abs, out);
+    } else if (entry.isFile() && /\.(ts|tsx)$/.test(entry.name) && !entry.name.endsWith(".d.ts")) {
+      out.push(abs);
+    }
+  }
+}
+function findUngatedSeeds(pkgs, rootDir) {
+  const leaks = [];
+  const scanned = new Set;
+  for (const pkg of pkgs) {
+    const srcDir = join11(pkg.path, "src");
+    if (scanned.has(srcDir) || !existsSync10(srcDir))
+      continue;
+    scanned.add(srcDir);
+    const files = [];
+    walkTsFiles(srcDir, files);
+    for (const abs of files) {
+      const content = readFileSync10(abs, "utf-8");
+      CALL.lastIndex = 0;
+      let m;
+      while ((m = CALL.exec(content)) !== null) {
+        const rest = content.slice(m.index);
+        if (GATED.test(rest))
+          continue;
+        const lineStart = content.lastIndexOf(`
+`, m.index) + 1;
+        if (content.slice(lineStart, m.index).includes("//"))
+          continue;
+        const before = content.slice(0, m.index);
+        if (before.lastIndexOf("/*") > before.lastIndexOf("*/"))
+          continue;
+        const nlAfter = content.indexOf(`
+`, m.index);
+        const lineEnd = nlAfter === -1 ? content.length : nlAfter;
+        const line = content.slice(0, m.index).split(`
+`).length;
+        const relpath = relative4(rootDir, abs).split(sep3).join("/");
+        leaks.push({
+          relpath,
+          line,
+          snippet: content.slice(lineStart, lineEnd).trim().slice(0, 120)
+        });
+      }
+    }
+  }
+  return leaks;
+}
+function assertSeedsServerGated(pkgs, rootDir) {
+  const leaks = findUngatedSeeds(pkgs, rootDir);
+  if (leaks.length === 0)
+    return;
+  const lines = leaks.map((l) => `  \u2022 ${l.relpath}:${l.line}
+      ${l.snippet}`).join(`
+`);
+  throw new Error(`Seed leak do bundla klienta: ${leaks.length} wywo\u0142a\u0144 .seedWith(...)/.withSeeds(...) ` + `nie jest owini\u0119tych w ONLY_SERVER.
+
+${lines}
+
+` + `Dane seed czyta wy\u0142\u0105cznie host (runSeeds) \u2014 po stronie klienta s\u0105 zb\u0119dne i ` + `wyciekaj\u0105 do PUBLICZNEGO bundla przegl\u0105darki. Zgejtuj argument w miejscu:
+` + `  .seedWith(ONLY_SERVER ? [ /* wiersze */ ] : [])
+` + `  .seedWith(ONLY_SERVER ? (await import("./seeds.server")).rows : [])
+` + `Statyczny import z osobnego pliku NIE pomaga (build wymusza sideEffects:true).`);
+}
+
 // src/builder/chunk-planner.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
-import { basename as basename4, join as join11 } from "path";
+import { readFileSync as readFileSync11, readdirSync as readdirSync6, statSync as statSync2 } from "fs";
+import { basename as basename4, join as join12 } from "path";
 var PUBLIC_CHUNK = "public";
 function planChunks(packages, accessMap) {
   const assignments = new Map;
@@ -32667,14 +32881,14 @@ var MODULE_CALL = /\bmodule\(\s*["'`]([a-zA-Z0-9_-]+)["'`]/g;
 function collectModuleNames(dir, acc) {
   let entries;
   try {
-    entries = readdirSync5(dir);
+    entries = readdirSync6(dir);
   } catch {
     return;
   }
   for (const e of entries) {
     if (e === "node_modules" || e === "dist")
       continue;
-    const full = join11(dir, e);
+    const full = join12(dir, e);
     let isDir = false;
     try {
       isDir = statSync2(full).isDirectory();
@@ -32684,7 +32898,7 @@ function collectModuleNames(dir, acc) {
     if (isDir) {
       collectModuleNames(full, acc);
     } else if (e.endsWith(".ts") || e.endsWith(".tsx")) {
-      const src = readFileSync10(full, "utf-8");
+      const src = readFileSync11(full, "utf-8");
       MODULE_CALL.lastIndex = 0;
       let m;
       while (m = MODULE_CALL.exec(src))
@@ -32694,14 +32908,14 @@ function collectModuleNames(dir, acc) {
 }
 function packageDeclaresModule(pkg) {
   const names = new Set;
-  collectModuleNames(join11(pkg.path, "src"), names);
+  collectModuleNames(join12(pkg.path, "src"), names);
   return names.size > 0;
 }
 function assertOneModulePerPackage(packages) {
   const offenders = [];
   for (const pkg of packages) {
     const names = new Set;
-    collectModuleNames(join11(pkg.path, "src"), names);
+    collectModuleNames(join12(pkg.path, "src"), names);
     if (names.size > 1) {
       offenders.push({ pkg: pkg.name, modules: [...names].sort() });
     }
@@ -32733,8 +32947,8 @@ function resolveChunk(moduleName, access) {
 
 // src/builder/dependency-collector.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename5, dirname as dirname7, join as join12 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename5, dirname as dirname7, join as join13 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], serverExternals = []) {
   mkdirSync9(arcDir, { recursive: true });
@@ -32746,7 +32960,7 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], server
   try {
     const cliDir = dirname7(fileURLToPath6(import.meta.url));
     const arcOtelPkgPath = Bun.resolveSync("@arcote.tech/arc-otel/package.json", cliDir);
-    const arcOtelPkg = JSON.parse(readFileSync11(arcOtelPkgPath, "utf-8"));
+    const arcOtelPkg = JSON.parse(readFileSync12(arcOtelPkgPath, "utf-8"));
     for (const [name, spec] of Object.entries(arcOtelPkg.dependencies ?? {})) {
       if (name.startsWith("@opentelemetry/")) {
         versions[name] = spec;
@@ -32757,10 +32971,10 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], server
     console.warn(`[arc-otel] could not resolve @arcote.tech/arc-otel \u2014 image will run without telemetry deps: ${e.message}`);
   }
   let rootArc;
-  const rootPkgPath = join12(rootDir, "package.json");
-  if (existsSync10(rootPkgPath)) {
+  const rootPkgPath = join13(rootDir, "package.json");
+  if (existsSync11(rootPkgPath)) {
     try {
-      const rootPkg = JSON.parse(readFileSync11(rootPkgPath, "utf-8"));
+      const rootPkg = JSON.parse(readFileSync12(rootPkgPath, "utf-8"));
       if (rootPkg.arc && typeof rootPkg.arc === "object")
         rootArc = rootPkg.arc;
     } catch {}
@@ -32772,11 +32986,11 @@ function collectFrameworkDeps(arcDir, rootDir, packages, sharedDeps = [], server
     dependencies: versions,
     ...rootArc ? { arc: rootArc } : {}
   };
-  const manifestPath = join12(arcDir, "package.json");
+  const manifestPath = join13(arcDir, "package.json");
   writeFileSync9(manifestPath, JSON.stringify(manifest, null, 2) + `
 `);
-  const hash = sha256Hex2(readFileSync11(manifestPath));
-  writeFileSync9(join12(arcDir, ".deps-hash"), hash + `
+  const hash = sha256Hex2(readFileSync12(manifestPath));
+  writeFileSync9(join13(arcDir, ".deps-hash"), hash + `
 `);
   return { hash, manifestPath };
 }
@@ -32784,7 +32998,7 @@ function sha256Hex2(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
 function resolveFrameworkVersions(rootDir, packages) {
-  const rootPkg = JSON.parse(readFileSync11(join12(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync12(join13(rootDir, "package.json"), "utf-8"));
   const rootDeps = rootPkg.dependencies ?? {};
   const rootDevDeps = rootPkg.devDependencies ?? {};
   const required = new Set(FRAMEWORK_PEERS);
@@ -32815,7 +33029,7 @@ function findWorkspaceSpec(packages, name) {
   return;
 }
 function mergeServerExternals(versions, rootDir, packages, externals) {
-  const rootPkg = JSON.parse(readFileSync11(join12(rootDir, "package.json"), "utf-8"));
+  const rootPkg = JSON.parse(readFileSync12(join13(rootDir, "package.json"), "utf-8"));
   const rootDeps = rootPkg.dependencies ?? {};
   const rootDevDeps = rootPkg.devDependencies ?? {};
   for (const { name, version } of externals) {
@@ -32843,9 +33057,9 @@ function resolveWorkspace() {
     process.exit(1);
   }
   const rootDir = dirname8(packageJsonPath);
-  const rootPkg = JSON.parse(readFileSync12(packageJsonPath, "utf-8"));
+  const rootPkg = JSON.parse(readFileSync13(packageJsonPath, "utf-8"));
   const appName = rootPkg.name ?? "Arc App";
-  const arcDir = join13(rootDir, ".arc", "platform");
+  const arcDir = join14(rootDir, ".arc", "platform");
   log2("Scanning workspaces...");
   const packages = discoverPackages(rootDir);
   if (packages.length > 0) {
@@ -32855,10 +33069,10 @@ function resolveWorkspace() {
   }
   let manifest;
   for (const name of ["manifest.json", "manifest.webmanifest"]) {
-    const manifestPath = join13(rootDir, name);
-    if (existsSync11(manifestPath)) {
+    const manifestPath = join14(rootDir, name);
+    if (existsSync12(manifestPath)) {
       try {
-        const data = JSON.parse(readFileSync12(manifestPath, "utf-8"));
+        const data = JSON.parse(readFileSync13(manifestPath, "utf-8"));
         const icons = data.icons;
         manifest = {
           path: manifestPath,
@@ -32877,9 +33091,9 @@ function resolveWorkspace() {
     rootPkg,
     appName,
     arcDir,
-    browserDir: join13(arcDir, "browser"),
-    assetsDir: join13(arcDir, "assets"),
-    publicDir: join13(rootDir, "public"),
+    browserDir: join14(arcDir, "browser"),
+    assetsDir: join14(arcDir, "assets"),
+    publicDir: join14(rootDir, "public"),
     packages,
     manifest
   };
@@ -32892,12 +33106,13 @@ async function buildAll(ws, opts = {}) {
   const federation = getFederationConfig(ws);
   log2(`Building (concurrency parallel${noCache ? ", no-cache" : ""})...`);
   assertOneModulePerPackage(ws.packages);
+  assertSeedsServerGated(ws.packages, ws.rootDir);
   await buildContextPackages(ws.rootDir, ws.packages, cache, noCache);
-  const serverDir = join13(ws.arcDir, "server");
+  const serverDir = join14(ws.arcDir, "server");
   const { entryFile: serverEntry, externals: serverExternals } = await buildServerApp(ws.rootDir, serverDir, ws.packages, cache, noCache);
-  const accessMap = await extractAccessMap(ws.rootDir, join13(serverDir, serverEntry));
+  const accessMap = await extractAccessMap(ws.rootDir, join14(serverDir, serverEntry));
   mkdirSync10(ws.arcDir, { recursive: true });
-  writeFileSync10(join13(ws.arcDir, "access.json"), JSON.stringify(accessMap.access, null, 2) + `
+  writeFileSync10(join14(ws.arcDir, "access.json"), JSON.stringify(accessMap.access, null, 2) + `
 `);
   const isHost = Boolean(federation?.host);
   const moduleNameOf2 = (name) => name.split("/").pop() ?? name;
@@ -32917,7 +33132,7 @@ async function buildAll(ws, opts = {}) {
   const i18nCollector = new Map;
   const browserSequence = (async () => {
     const bundled = await buildBrowserApp(ws.rootDir, ws.browserDir, plan, cache, noCache, i18nCollector, { federated: false, exposeRuntime: isHost, minify });
-    const fed = fedPlan ? await buildBrowserApp(ws.rootDir, join13(ws.arcDir, "browser-fed"), fedPlan, cache, noCache, i18nCollector, { federated: true, unitId: "browser-app-fed", minify }) : undefined;
+    const fed = fedPlan ? await buildBrowserApp(ws.rootDir, join14(ws.arcDir, "browser-fed"), fedPlan, cache, noCache, i18nCollector, { federated: true, unitId: "browser-app-fed", minify }) : undefined;
     return { bundled, fed };
   })();
   const [{ bundled: browserResult, fed: fedResult }, , , , shellResult] = await Promise.all([
@@ -32925,7 +33140,7 @@ async function buildAll(ws, opts = {}) {
     buildStyles(ws.rootDir, ws.arcDir, ws.packages, themePath, cache, noCache),
     copyBrowserAssets(ws, cache, noCache),
     buildTranslations(ws.rootDir, ws.arcDir, cache, noCache),
-    needsPeerShell ? buildPeerShell(ws.rootDir, join13(ws.arcDir, "shell"), cache, noCache) : Promise.resolve(undefined)
+    needsPeerShell ? buildPeerShell(ws.rootDir, join14(ws.arcDir, "shell"), cache, noCache) : Promise.resolve(undefined)
   ]);
   const { finalizeTranslations: finalizeTranslations3 } = await Promise.resolve().then(() => (init_i18n(), exports_i18n));
   await finalizeTranslations3(ws.rootDir, ws.arcDir, i18nCollector);
@@ -32950,7 +33165,7 @@ async function buildAll(ws, opts = {}) {
     }
   } : undefined;
   const finalManifest = assembleManifest(ws, browserResult, cache, shellResult, federationBuild);
-  writeFileSync10(join13(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
+  writeFileSync10(join14(ws.arcDir, "manifest.json"), JSON.stringify(finalManifest, null, 2));
   return finalManifest;
 }
 function assembleManifest(ws, browser, cache, shell, federation) {
@@ -32976,35 +33191,35 @@ function getFederationConfig(ws) {
 }
 function resolveAssetSource(from, pkgDir, rootDir) {
   if (from.startsWith("./") || from.startsWith("../")) {
-    const resolved = join13(pkgDir, from);
-    return existsSync11(resolved) ? resolved : null;
+    const resolved = join14(pkgDir, from);
+    return existsSync12(resolved) ? resolved : null;
   }
   const candidates = [
-    join13(rootDir, "node_modules", from),
-    join13(pkgDir, "node_modules", from)
+    join14(rootDir, "node_modules", from),
+    join14(pkgDir, "node_modules", from)
   ];
   for (const c of candidates) {
-    if (existsSync11(c))
+    if (existsSync12(c))
       return c;
   }
-  const bunCacheDir = join13(rootDir, "node_modules", ".bun");
-  if (existsSync11(bunCacheDir)) {
-    for (const entry of readdirSync6(bunCacheDir, { withFileTypes: true })) {
+  const bunCacheDir = join14(rootDir, "node_modules", ".bun");
+  if (existsSync12(bunCacheDir)) {
+    for (const entry of readdirSync7(bunCacheDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const candidate = join13(bunCacheDir, entry.name, "node_modules", from);
-      if (existsSync11(candidate))
+      const candidate = join14(bunCacheDir, entry.name, "node_modules", from);
+      if (existsSync12(candidate))
         return candidate;
     }
   }
   return null;
 }
 function readBrowserAssets(pkgDir) {
-  const pkgJsonPath = join13(pkgDir, "package.json");
-  if (!existsSync11(pkgJsonPath))
+  const pkgJsonPath = join14(pkgDir, "package.json");
+  if (!existsSync12(pkgJsonPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync12(pkgJsonPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync13(pkgJsonPath, "utf-8"));
     const assets = pkg.arc?.browserAssets;
     if (!Array.isArray(assets))
       return [];
@@ -33014,14 +33229,14 @@ function readBrowserAssets(pkgDir) {
   }
 }
 function discoverBrowserAssets(ws) {
-  const arcDir = join13(ws.rootDir, "node_modules", "@arcote.tech");
-  if (!existsSync11(arcDir))
+  const arcDir = join14(ws.rootDir, "node_modules", "@arcote.tech");
+  if (!existsSync12(arcDir))
     return [];
   const out = [];
-  for (const entry of readdirSync6(arcDir, { withFileTypes: true })) {
+  for (const entry of readdirSync7(arcDir, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const pkgDir = join13(arcDir, entry.name);
+    const pkgDir = join14(arcDir, entry.name);
     const assets = readBrowserAssets(pkgDir);
     for (const asset of assets) {
       const src = resolveAssetSource(asset.from, pkgDir, ws.rootDir);
@@ -33046,7 +33261,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
     to: a.to,
     mtime: mtimeOf(a.src)
   })));
-  const requiredOutputs = assets.map((a) => join13(ws.assetsDir, a.to));
+  const requiredOutputs = assets.map((a) => join14(ws.assetsDir, a.to));
   if (!noCache && isCacheHit(cache, unitId, inputHash, requiredOutputs)) {
     console.log(`  \u2713 cached: browser-assets (${assets.length})`);
     return;
@@ -33054,10 +33269,10 @@ async function copyBrowserAssets(ws, cache, noCache) {
   console.log(`  building: browser-assets (${assets.length})`);
   const outputHashes = {};
   for (const asset of assets) {
-    const dest = join13(ws.assetsDir, asset.to);
+    const dest = join14(ws.assetsDir, asset.to);
     mkdirSync10(dirname8(dest), { recursive: true });
     copyFileSync(asset.src, dest);
-    outputHashes[asset.to] = sha256Hex(readFileSync12(dest));
+    outputHashes[asset.to] = sha256Hex(readFileSync13(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
 }
@@ -33065,12 +33280,12 @@ async function loadServerContext(ws) {
   globalThis.ONLY_SERVER = true;
   globalThis.ONLY_BROWSER = false;
   globalThis.ONLY_CLIENT = false;
-  const platformDir = join13(process.cwd(), "node_modules", "@arcote.tech", "platform");
-  const platformPkg = JSON.parse(readFileSync12(join13(platformDir, "package.json"), "utf-8"));
-  const platformEntry = join13(platformDir, platformPkg.main ?? "src/index.ts");
+  const platformDir = join14(process.cwd(), "node_modules", "@arcote.tech", "platform");
+  const platformPkg = JSON.parse(readFileSync13(join14(platformDir, "package.json"), "utf-8"));
+  const platformEntry = join14(platformDir, platformPkg.main ?? "src/index.ts");
   await import(platformEntry);
-  const serverEntry = join13(ws.arcDir, "server", SERVER_ENTRY_FILE);
-  if (!existsSync11(serverEntry)) {
+  const serverEntry = join14(ws.arcDir, "server", SERVER_ENTRY_FILE);
+  if (!existsSync12(serverEntry)) {
     return { context: null, moduleAccess: new Map };
   }
   let serverError;
@@ -33100,21 +33315,21 @@ async function platformBuild(opts = {}) {
 
 // src/commands/platform-deploy.ts
 import { randomBytes } from "crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { dirname as dirname11, join as join21 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { dirname as dirname11, join as join22 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 
 // src/deploy/bootstrap.ts
 var {spawn: spawn4 } = globalThis.Bun;
 import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync14 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, join as join19 } from "path";
+import { dirname as dirname9, join as join20 } from "path";
 
 // src/deploy/ansible.ts
 import { spawn as nodeSpawn } from "child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
 import { homedir, tmpdir } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 
 // src/deploy/assets.ts
 var TERRAFORM_MAIN_TF = `terraform {
@@ -33428,28 +33643,28 @@ var ASSETS = {
 };
 async function materializeAssets(targetDir, files) {
   const { mkdirSync: mkdirSync11, writeFileSync: writeFileSync11 } = await import("fs");
-  const { join: join14 } = await import("path");
+  const { join: join15 } = await import("path");
   mkdirSync11(targetDir, { recursive: true });
   for (const [name, content] of Object.entries(files)) {
-    writeFileSync11(join14(targetDir, name), content);
+    writeFileSync11(join15(targetDir, name), content);
   }
 }
 
 // src/deploy/ansible.ts
 function pickSshKeyForAnsible(configured) {
   if (configured) {
-    const expanded = configured.startsWith("~") ? join14(homedir(), configured.slice(1)) : configured;
-    return existsSync12(expanded) ? expanded : null;
+    const expanded = configured.startsWith("~") ? join15(homedir(), configured.slice(1)) : configured;
+    return existsSync13(expanded) ? expanded : null;
   }
   for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
-    const path4 = join14(homedir(), ".ssh", name);
-    if (existsSync12(path4))
+    const path4 = join15(homedir(), ".ssh", name);
+    if (existsSync13(path4))
       return path4;
   }
   return null;
 }
 async function runAnsible(inputs) {
-  const workDir = join14(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
+  const workDir = join15(tmpdir(), "arc-deploy", `ansible-${Date.now()}`);
   mkdirSync11(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.ansible);
   const user = inputs.asRoot ? "root" : inputs.target.user;
@@ -33466,7 +33681,7 @@ async function runAnsible(inputs) {
     ""
   ].join(`
 `);
-  writeFileSync11(join14(workDir, "inventory.ini"), inventory);
+  writeFileSync11(join15(workDir, "inventory.ini"), inventory);
   const extraVarsJson = JSON.stringify({
     username: inputs.target.user,
     ssh_port: port,
@@ -35026,16 +35241,16 @@ function panelTimeseries(title, gridPos, query, legend, unit, datasource = PROME
 // src/deploy/terraform.ts
 import { spawn as nodeSpawn2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 async function runTerraform(inputs) {
   const wsHash = createHash2("sha256").update(inputs.workspaceDir).digest("hex").slice(0, 16);
-  const workDir = join15(homedir2(), ".arc-deploy", wsHash, "tf");
+  const workDir = join16(homedir2(), ".arc-deploy", wsHash, "tf");
   mkdirSync12(workDir, { recursive: true });
   await materializeAssets(workDir, ASSETS.terraform);
   const sshPubKey = inputs.tf.sshPublicKey ?? expandHome("~/.ssh/id_ed25519.pub");
-  if (!existsSync13(expandHome(sshPubKey))) {
+  if (!existsSync14(expandHome(sshPubKey))) {
     throw new Error(`SSH public key not found at ${sshPubKey}. Set provision.terraform.sshPublicKey in deploy.arc.json.`);
   }
   const tfvars = [
@@ -35049,7 +35264,7 @@ async function runTerraform(inputs) {
   ].join(`
 `) + `
 `;
-  writeFileSync12(join15(workDir, "terraform.tfvars"), tfvars);
+  writeFileSync12(join16(workDir, "terraform.tfvars"), tfvars);
   await runTf(workDir, ["init", "-input=false", "-no-color"]);
   await runTf(workDir, [
     "apply",
@@ -35107,20 +35322,20 @@ function expandHome(p) {
 }
 
 // src/deploy/config.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "fs";
+import { join as join18 } from "path";
 
 // src/deploy/env-file.ts
-import { appendFileSync, existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { join as join16 } from "path";
+import { appendFileSync, existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { join as join17 } from "path";
 function loadDeployEnvFiles(rootDir, envNames) {
-  const globalsPath = join16(rootDir, "deploy.arc.env");
-  const globals = existsSync14(globalsPath) ? parseEnvFile(readFileSync13(globalsPath, "utf-8"), globalsPath) : {};
+  const globalsPath = join17(rootDir, "deploy.arc.env");
+  const globals = existsSync15(globalsPath) ? parseEnvFile(readFileSync14(globalsPath, "utf-8"), globalsPath) : {};
   const perEnv = {};
   for (const name of envNames) {
-    const envPath = join16(rootDir, `deploy.arc.${name}.env`);
-    if (existsSync14(envPath)) {
-      perEnv[name] = parseEnvFile(readFileSync13(envPath, "utf-8"), envPath);
+    const envPath = join17(rootDir, `deploy.arc.${name}.env`);
+    if (existsSync15(envPath)) {
+      perEnv[name] = parseEnvFile(readFileSync14(envPath, "utf-8"), envPath);
     }
   }
   return { globals, perEnv };
@@ -35136,16 +35351,16 @@ function ensurePersistedSecret(rootDir, scope, key, generate) {
   if (process.env[key])
     return process.env[key];
   const fileName = scope === "globals" ? "deploy.arc.env" : `deploy.arc.${scope}.env`;
-  const path4 = join16(rootDir, fileName);
-  if (existsSync14(path4)) {
-    const existing = parseEnvFile(readFileSync13(path4, "utf-8"), path4);
+  const path4 = join17(rootDir, fileName);
+  if (existsSync15(path4)) {
+    const existing = parseEnvFile(readFileSync14(path4, "utf-8"), path4);
     if (existing[key]) {
       process.env[key] = existing[key];
       return existing[key];
     }
   }
   const value = generate();
-  const prefix = existsSync14(path4) && !readFileSync13(path4, "utf-8").endsWith(`
+  const prefix = existsSync15(path4) && !readFileSync14(path4, "utf-8").endsWith(`
 `) ? `
 ` : "";
   appendFileSync(path4, `${prefix}${key}=${value}
@@ -35181,17 +35396,17 @@ function parseEnvFile(content, pathForErrors) {
 // src/deploy/config.ts
 var DEPLOY_CONFIG_FILE = "deploy.arc.json";
 function deployConfigPath(rootDir) {
-  return join17(rootDir, DEPLOY_CONFIG_FILE);
+  return join18(rootDir, DEPLOY_CONFIG_FILE);
 }
 function deployConfigExists(rootDir) {
-  return existsSync15(deployConfigPath(rootDir));
+  return existsSync16(deployConfigPath(rootDir));
 }
 function loadDeployConfig(rootDir) {
   const path4 = deployConfigPath(rootDir);
-  if (!existsSync15(path4)) {
+  if (!existsSync16(path4)) {
     throw new Error(`Missing ${DEPLOY_CONFIG_FILE} at ${path4}`);
   }
-  const raw = readFileSync14(path4, "utf-8");
+  const raw = readFileSync15(path4, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -35214,7 +35429,7 @@ function loadDeployConfig(rootDir) {
 }
 function saveDeployConfig(rootDir, cfg) {
   const path4 = deployConfigPath(rootDir);
-  const raw = existsSync15(path4) ? JSON.parse(readFileSync14(path4, "utf-8")) : {};
+  const raw = existsSync16(path4) ? JSON.parse(readFileSync15(path4, "utf-8")) : {};
   raw.target = { ...raw.target, ...cfg.target };
   writeFileSync13(path4, JSON.stringify(raw, null, 2) + `
 `);
@@ -35451,17 +35666,17 @@ function cfgErr(path4, expected) {
 
 // src/deploy/ssh.ts
 var {spawn: spawn3 } = globalThis.Bun;
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function pickSshKey(target) {
   if (target.sshKey) {
-    const expanded = target.sshKey.startsWith("~") ? join18(homedir3(), target.sshKey.slice(1)) : target.sshKey;
-    return existsSync16(expanded) ? expanded : null;
+    const expanded = target.sshKey.startsWith("~") ? join19(homedir3(), target.sshKey.slice(1)) : target.sshKey;
+    return existsSync17(expanded) ? expanded : null;
   }
   for (const name of ["id_ed25519", "id_ecdsa", "id_rsa"]) {
-    const path4 = join18(homedir3(), ".ssh", name);
-    if (existsSync16(path4))
+    const path4 = join19(homedir3(), ".ssh", name);
+    if (existsSync17(path4))
       return path4;
   }
   return null;
@@ -35476,7 +35691,7 @@ function sshMuxArgs() {
     "-o",
     "ControlMaster=auto",
     "-o",
-    `ControlPath=${join18(homedir3(), ".ssh", "cm-arc-%C")}`,
+    `ControlPath=${join19(homedir3(), ".ssh", "cm-arc-%C")}`,
     "-o",
     "ControlPersist=120"
   ];
@@ -35747,7 +35962,7 @@ async function isRegistryRunning(cfg) {
 }
 async function upStack(inputs) {
   const { cfg } = inputs;
-  const workDir = join19(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
+  const workDir = join20(tmpdir2(), "arc-deploy", `stack-${Date.now()}`);
   mkdirSync13(workDir, { recursive: true });
   await assertRegistryDnsResolves(cfg);
   const password = process.env[cfg.registry.passwordEnv];
@@ -35755,9 +35970,9 @@ async function upStack(inputs) {
     throw new Error(`Registry password env var ${cfg.registry.passwordEnv} is not set. ` + `Set it (e.g. \`export ${cfg.registry.passwordEnv}=...\`) before bootstrap.`);
   }
   const htpasswdLine = await generateHtpasswd(cfg.registry.username, password);
-  writeFileSync14(join19(workDir, "htpasswd"), htpasswdLine);
-  writeFileSync14(join19(workDir, "Caddyfile"), generateCaddyfile(cfg));
-  writeFileSync14(join19(workDir, "docker-compose.yml"), generateCompose({ cfg }));
+  writeFileSync14(join20(workDir, "htpasswd"), htpasswdLine);
+  writeFileSync14(join20(workDir, "Caddyfile"), generateCaddyfile(cfg));
+  writeFileSync14(join20(workDir, "docker-compose.yml"), generateCompose({ cfg }));
   let observabilityFiles = null;
   let observabilityHtpasswd = null;
   if (cfg.observability?.enabled) {
@@ -35769,30 +35984,30 @@ async function upStack(inputs) {
     }
     observabilityHtpasswd = await generateCaddyBasicAuthLine("admin", adminPassword);
     for (const [relPath, contents] of Object.entries(observabilityFiles)) {
-      const fullPath = join19(workDir, relPath);
+      const fullPath = join20(workDir, relPath);
       mkdirSync13(dirname9(fullPath), { recursive: true });
       writeFileSync14(fullPath, contents);
     }
-    writeFileSync14(join19(workDir, "observability-htpasswd"), observabilityHtpasswd);
+    writeFileSync14(join20(workDir, "observability-htpasswd"), observabilityHtpasswd);
   }
   await assertExec(cfg.target, `sudo mkdir -p ${cfg.target.remoteDir} && sudo chown ${cfg.target.user}:${cfg.target.user} ${cfg.target.remoteDir}`);
   for (const name of Object.keys(cfg.envs)) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/${name}`);
   }
   await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/registry-auth`);
-  await scpUpload(cfg.target, join19(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
-  await scpUpload(cfg.target, join19(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
-  await scpUpload(cfg.target, join19(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
+  await scpUpload(cfg.target, join20(workDir, "Caddyfile"), `${cfg.target.remoteDir}/Caddyfile`);
+  await scpUpload(cfg.target, join20(workDir, "docker-compose.yml"), `${cfg.target.remoteDir}/docker-compose.yml`);
+  await scpUpload(cfg.target, join20(workDir, "htpasswd"), `${cfg.target.remoteDir}/registry-auth/htpasswd`);
   if (observabilityFiles && observabilityHtpasswd) {
     await assertExec(cfg.target, `mkdir -p ${cfg.target.remoteDir}/observability/grafana-dashboards ${cfg.target.remoteDir}/observability/grafana-alerting`);
     for (const relPath of Object.keys(observabilityFiles)) {
-      const localDir = dirname9(join19(workDir, relPath));
+      const localDir = dirname9(join20(workDir, relPath));
       mkdirSync13(localDir, { recursive: true });
     }
     for (const relPath of Object.keys(observabilityFiles)) {
-      await scpUpload(cfg.target, join19(workDir, relPath), `${cfg.target.remoteDir}/${relPath}`);
+      await scpUpload(cfg.target, join20(workDir, relPath), `${cfg.target.remoteDir}/${relPath}`);
     }
-    await scpUpload(cfg.target, join19(workDir, "observability-htpasswd"), `${cfg.target.remoteDir}/observability-htpasswd`);
+    await scpUpload(cfg.target, join20(workDir, "observability-htpasswd"), `${cfg.target.remoteDir}/observability-htpasswd`);
   }
   await assertExec(cfg.target, `touch ${cfg.target.remoteDir}/.env`);
   if (cfg.observability?.enabled) {
@@ -35814,6 +36029,7 @@ async function upStack(inputs) {
     await writeEnvLine(cfg.target, `${cfg.target.remoteDir}/.env`, key, value);
   }
   await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose pull --ignore-pull-failures caddy registry && docker compose up -d caddy registry`);
+  await assertExec(cfg.target, `cd ${cfg.target.remoteDir} && docker compose restart caddy`);
   await sshDockerLogin(cfg);
   const knownEnvs = await listConfiguredEnvs(cfg);
   if (knownEnvs.length > 0) {
@@ -35947,14 +36163,14 @@ var {spawn: spawn5 } = globalThis.Bun;
 import { createHash as createHash3 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync14,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   realpathSync as realpathSync2,
   writeFileSync as writeFileSync15
 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, join as join20 } from "path";
+import { dirname as dirname10, join as join21 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/deploy/image-template.ts
@@ -36004,8 +36220,8 @@ function generateDockerfile(inputs) {
 // src/deploy/image.ts
 async function buildImage(ws, opts) {
   await ensureDocker();
-  const manifestPath = join20(ws.arcDir, "manifest.json");
-  if (!existsSync17(manifestPath)) {
+  const manifestPath = join21(ws.arcDir, "manifest.json");
+  if (!existsSync18(manifestPath)) {
     throw new Error(`No build manifest at ${manifestPath}. Run \`arc platform build\` first or omit --skip-build.`);
   }
   embedCliBundle(ws);
@@ -36015,9 +36231,9 @@ async function buildImage(ws, opts) {
   const dockerfileInputs = collectDockerfileInputs(ws);
   const dockerfile = generateDockerfile(dockerfileInputs);
   const buildContextDir = ws.rootDir;
-  const dockerfileDir = join20(tmpdir3(), `arc-image-${Date.now()}`);
+  const dockerfileDir = join21(tmpdir3(), `arc-image-${Date.now()}`);
   mkdirSync14(dockerfileDir, { recursive: true });
-  const dockerfilePath = join20(dockerfileDir, "Dockerfile");
+  const dockerfilePath = join21(dockerfileDir, "Dockerfile");
   writeFileSync15(dockerfilePath, dockerfile);
   const buildArgs = [
     "build",
@@ -36043,20 +36259,20 @@ async function buildImage(ws, opts) {
 }
 function embedCliBundle(ws) {
   const source = locateCliBundle();
-  const target = join20(ws.arcDir, "host.js");
+  const target = join21(ws.arcDir, "host.js");
   copyFileSync2(source, target);
 }
 function locateCliBundle() {
   const here = fileURLToPath7(import.meta.url);
   let cur = dirname10(here);
   while (cur !== "/" && cur !== "") {
-    const candidate = join20(cur, "package.json");
-    if (existsSync17(candidate)) {
+    const candidate = join21(cur, "package.json");
+    if (existsSync18(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync15(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync16(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
-          const distIndex = join20(realpathSync2(cur), "dist", "index.js");
-          if (!existsSync17(distIndex)) {
+          const distIndex = join21(realpathSync2(cur), "dist", "index.js");
+          if (!existsSync18(distIndex)) {
             throw new Error(`arc-cli bundle missing at ${distIndex}. Run \`bun run build\` in packages/cli/.`);
           }
           return distIndex;
@@ -36088,17 +36304,17 @@ async function ensureDocker() {
   }
 }
 function computeContentHash(manifestPath) {
-  const raw = JSON.parse(readFileSync15(manifestPath, "utf-8"));
+  const raw = JSON.parse(readFileSync16(manifestPath, "utf-8"));
   delete raw.buildTime;
   const canonical = JSON.stringify(raw);
   return createHash3("sha256").update(canonical).digest("hex").slice(0, 12);
 }
 function collectDockerfileInputs(ws) {
-  const hasPublicDir = existsSync17(join20(ws.rootDir, "public"));
-  const hasLocales = existsSync17(join20(ws.rootDir, "locales"));
+  const hasPublicDir = existsSync18(join21(ws.rootDir, "public"));
+  const hasLocales = existsSync18(join21(ws.rootDir, "locales"));
   let manifestPath;
   for (const name of ["manifest.webmanifest", "manifest.json"]) {
-    if (existsSync17(join20(ws.rootDir, name))) {
+    if (existsSync18(join21(ws.rootDir, name))) {
       manifestPath = name;
       break;
     }
@@ -36809,11 +37025,11 @@ async function runSurvey(appName) {
     });
     if (BD(serverType))
       cancel();
-    const location = await ue({
+    const location2 = await ue({
       message: "Hetzner datacenter location",
       initialValue: "nbg1"
     });
-    if (BD(location))
+    if (BD(location2))
       cancel();
     const firstEnv = Object.keys(envs)[0] ?? "host";
     const appSlug = sanitizeImageName(appName ?? "arc-app").replace(/[^a-z0-9-]+/g, "-");
@@ -36821,7 +37037,7 @@ async function runSurvey(appName) {
     const terraform = {
       provider: "hcloud",
       serverType,
-      location,
+      location: location2,
       image: "ubuntu-22.04",
       tokenEnv,
       serverName,
@@ -36942,14 +37158,14 @@ async function platformDeploy(envArg, options = {}) {
     err(`Unknown env "${envArg}". Known: ${Object.keys(cfg.envs).join(", ")}`);
     process.exit(1);
   })() : Object.keys(cfg.envs);
-  const manifestPath = join21(ws.arcDir, "manifest.json");
+  const manifestPath = join22(ws.arcDir, "manifest.json");
   if (!options.imageTag) {
-    const needBuild = options.rebuild || !existsSync18(manifestPath);
+    const needBuild = options.rebuild || !existsSync19(manifestPath);
     if (needBuild && !options.skipBuild) {
       log2("Building platform...");
       await buildAll(ws, { noCache: options.rebuild });
       ok("Build complete");
-    } else if (!existsSync18(manifestPath)) {
+    } else if (!existsSync19(manifestPath)) {
       err("No build found and --skip-build was set.");
       process.exit(1);
     }
@@ -37019,9 +37235,9 @@ function readCliVersion2() {
     let cur = dirname11(fileURLToPath8(import.meta.url));
     const root = dirname11(cur).startsWith("/") ? "/" : ".";
     while (cur !== root && cur !== "") {
-      const candidate = join21(cur, "package.json");
-      if (existsSync18(candidate)) {
-        const pkg = JSON.parse(readFileSync16(candidate, "utf-8"));
+      const candidate = join22(cur, "package.json");
+      if (existsSync19(candidate)) {
+        const pkg = JSON.parse(readFileSync17(candidate, "utf-8"));
         if (pkg.name === "@arcote.tech/arc-cli") {
           return pkg.version ?? "unknown";
         }
@@ -37037,8 +37253,8 @@ function readCliVersion2() {
   }
 }
 async function hashDeployConfig(rootDir) {
-  const p2 = join21(rootDir, "deploy.arc.json");
-  const content = readFileSync16(p2);
+  const p2 = join22(rootDir, "deploy.arc.json");
+  const content = readFileSync17(p2);
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   hasher.update(readCliVersion2());
@@ -37047,8 +37263,8 @@ async function hashDeployConfig(rootDir) {
 
 // src/platform/startup.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync16, readFileSync as readFileSync17, watch, writeFileSync as writeFileSync16 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync16, readFileSync as readFileSync19, watch, writeFileSync as writeFileSync16 } from "fs";
+import { join as join24 } from "path";
 
 // ../host/src/connection-manager.ts
 class ConnectionManager {
@@ -38677,8 +38893,8 @@ async function createArcServer(config) {
 // src/platform/server.ts
 init_i18n();
 import { timingSafeEqual } from "crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync15 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync18 } from "fs";
+import { join as join23 } from "path";
 async function initContextHandler(context2, dbPath) {
   const factory = await resolveDbAdapterFactory(dbPath);
   const dbAdapter = factory(context2);
@@ -38698,7 +38914,61 @@ async function resolveDbAdapterFactory(dbPath) {
     mkdirSync15(dbDir, { recursive: true });
   return createBunSQLiteAdapterFactory2(dbPath);
 }
-function generateShellHtml(appName, manifest, initial, stylesHash, shell) {
+function inlineJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/[\u2028\u2029]/g, (c2) => `\\u${c2.charCodeAt(0).toString(16)}`);
+}
+function tokenPayloadsFromCookies(cookieHeader) {
+  if (!cookieHeader)
+    return [];
+  const payloads = [];
+  for (const part of cookieHeader.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0)
+      continue;
+    const name = part.slice(0, eq).trim();
+    if (name !== "arc_token" && !name.startsWith("arc_token_"))
+      continue;
+    const payload = decodeTokenPayload(decodeURIComponent(part.slice(eq + 1).trim()));
+    if (payload)
+      payloads.push(payload);
+  }
+  return payloads;
+}
+function pickLocale(cookieHeader, acceptLanguage, locales, sourceLocale) {
+  const fromCookie = cookieHeader?.match(/(?:^|;)\s*arc-locale=([^;]+)/)?.[1];
+  if (fromCookie && locales.includes(decodeURIComponent(fromCookie))) {
+    return decodeURIComponent(fromCookie);
+  }
+  for (const tag of (acceptLanguage ?? "").split(",")) {
+    const lang = tag.split(";")[0].trim();
+    if (!lang)
+      continue;
+    const exact = locales.find((l2) => l2.toLowerCase() === lang.toLowerCase());
+    if (exact)
+      return exact;
+    const prefix = locales.find((l2) => l2.toLowerCase().split("-")[0] === lang.toLowerCase().split("-")[0]);
+    if (prefix)
+      return prefix;
+  }
+  return sourceLocale;
+}
+async function generateShellHtml(opts) {
+  const {
+    appName,
+    appManifest,
+    buildManifest,
+    moduleAccessMap,
+    arcDir,
+    rootDir,
+    cookieHeader,
+    acceptLanguage
+  } = opts;
+  if (!buildManifest?.initial) {
+    throw new Error("generateShellHtml: initial bundle missing from manifest");
+  }
+  const initial = buildManifest.initial;
+  const initialUrl = `/browser/${initial.file}`;
+  const shell = buildManifest.shell;
   const otelConfig = process.env.ARC_OTEL_ENABLED === "true" ? {
     enabled: true,
     endpoint: "/otel",
@@ -38707,26 +38977,58 @@ function generateShellHtml(appName, manifest, initial, stylesHash, shell) {
     sampleRate: Number(process.env.ARC_OTEL_BROWSER_SAMPLE_RATE ?? "0.1")
   } : null;
   const otelTag = otelConfig ? `
-  <script>window.__ARC_OTEL_CONFIG=${JSON.stringify(otelConfig)};</script>` : "";
-  const initialUrl = initial ? `/browser/${initial.file}` : null;
-  if (!initialUrl) {
-    throw new Error("generateShellHtml: initial bundle missing from manifest");
-  }
+  <script>window.__ARC_OTEL_CONFIG=${inlineJson(otelConfig)};</script>` : "";
   const importMapTag = shell ? `
-  <script type="importmap">${JSON.stringify({ imports: shell.imports })}</script>
-  <script>window.__ARC_PEERS__=${JSON.stringify(shell.peers)};</script>` : "";
-  const stylesQs = stylesHash ? `?v=${stylesHash.slice(0, 16)}` : "";
+  <script type="importmap">${inlineJson({ imports: shell.imports })}</script>
+  <script>window.__ARC_PEERS__=${inlineJson(shell.peers)};</script>` : "";
+  const stylesQs = buildManifest.stylesHash ? `?v=${buildManifest.stylesHash.slice(0, 16)}` : "";
+  const tokenPayloads = tokenPayloadsFromCookies(cookieHeader);
+  const filtered = await filterManifestForTokens(buildManifest, moduleAccessMap, tokenPayloads);
+  const preloadUrls = new Set;
+  preloadUrls.add(initialUrl);
+  for (const c2 of initial.staticChunks ?? [])
+    preloadUrls.add(`/browser/${c2}`);
+  for (const group of Object.values(filtered.groups)) {
+    if (group.url)
+      preloadUrls.add(group.url);
+    for (const c2 of group.staticChunks ?? [])
+      preloadUrls.add(`/browser/${c2}`);
+  }
+  const preloadTags = [...preloadUrls].map((u2) => `
+  <link rel="modulepreload" href="${u2}" />`).join("");
+  const manifestTag = `
+  <script>window.__ARC_MANIFEST__=${inlineJson({
+    initial: filtered.initial,
+    groups: filtered.groups,
+    sharedChunks: filtered.sharedChunks,
+    stylesHash: filtered.stylesHash,
+    buildTime: filtered.buildTime
+  })};</script>`;
+  let lang = "en";
+  const tconfig = readTranslationsConfig(rootDir);
+  let messages2 = {};
+  if (tconfig) {
+    lang = pickLocale(cookieHeader, acceptLanguage, tconfig.locales, tconfig.sourceLocale);
+    try {
+      messages2 = JSON.parse(readFileSync18(join23(arcDir, "locales", `${lang}.json`), "utf-8"));
+    } catch {}
+  }
+  const i18nTag = `
+  <script>window.__ARC_I18N__=${inlineJson({
+    locale: lang,
+    config: tconfig,
+    messages: messages2
+  })};</script>`;
   return `<!doctype html>
-<html lang="en">
+<html lang="${lang}">
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
-  <title>${manifest?.title ?? appName}</title>${manifest?.favicon ? `
-  <link rel="icon" href="${manifest.favicon}">` : ""}${manifest ? `
+  <title>${appManifest?.title ?? appName}</title>${appManifest?.favicon ? `
+  <link rel="icon" href="${appManifest.favicon}">` : ""}${appManifest ? `
   <link rel="manifest" href="/manifest.json${stylesQs}">` : ""}
   <link rel="stylesheet" href="/styles.css${stylesQs}" />
-  <link rel="stylesheet" href="/theme.css${stylesQs}" />${importMapTag}
-  <link rel="modulepreload" href="${initialUrl}" />${otelTag}
+  <link rel="stylesheet" href="/theme.css${stylesQs}" />${importMapTag}${preloadTags}${manifestTag}${i18nTag}${otelTag}
 </head>
 <body>
   <div id="root"></div>
@@ -38757,7 +39059,7 @@ function getMime(path4) {
   return MIME[ext2] ?? "application/octet-stream";
 }
 function serveFile(filePath, headers = {}) {
-  if (!existsSync19(filePath))
+  if (!existsSync20(filePath))
     return new Response("Not Found", { status: 404 });
   return new Response(Bun.file(filePath), {
     headers: { "Content-Type": getMime(filePath), ...headers }
@@ -38879,7 +39181,7 @@ function staticFilesHandler(ws, devMode, getManifest) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join22(ws.browserDir, file), {
+      return serveFile(join23(ws.browserDir, file), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
@@ -38889,7 +39191,7 @@ function staticFilesHandler(ws, devMode, getManifest) {
       if (!BROWSER_FILE_RE.test(file)) {
         return new Response("Not Found", { status: 404, headers: ctx.corsHeaders });
       }
-      return serveFile(join22(ws.arcDir, "shell", file), {
+      return serveFile(join23(ws.arcDir, "shell", file), {
         ...ctx.corsHeaders,
         "Cross-Origin-Resource-Policy": "cross-origin",
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
@@ -38908,29 +39210,29 @@ function staticFilesHandler(ws, devMode, getManifest) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
-      return serveFile(join22(ws.arcDir, "browser-fed", file), {
+      return serveFile(join23(ws.arcDir, "browser-fed", file), {
         ...ctx.corsHeaders,
         "Cross-Origin-Resource-Policy": "cross-origin",
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     }
     if (path4.startsWith("/locales/"))
-      return serveFile(join22(ws.arcDir, path4.slice(1)), {
+      return serveFile(join23(ws.arcDir, path4.slice(1)), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=300,stale-while-revalidate=3600"
       });
     if (path4.startsWith("/assets/"))
-      return serveFile(join22(ws.assetsDir, path4.slice(8)), {
+      return serveFile(join23(ws.assetsDir, path4.slice(8)), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     if (path4 === "/styles.css")
-      return serveFile(join22(ws.arcDir, "styles.css"), {
+      return serveFile(join23(ws.arcDir, "styles.css"), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
     if (path4 === "/theme.css")
-      return serveFile(join22(ws.arcDir, "theme.css"), {
+      return serveFile(join23(ws.arcDir, "theme.css"), {
         ...ctx.corsHeaders,
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
       });
@@ -38941,8 +39243,8 @@ function staticFilesHandler(ws, devMode, getManifest) {
       });
     }
     if (path4.lastIndexOf(".") > path4.lastIndexOf("/")) {
-      const publicFile = join22(ws.publicDir, path4.slice(1));
-      if (existsSync19(publicFile))
+      const publicFile = join23(ws.publicDir, path4.slice(1));
+      if (existsSync20(publicFile))
         return serveFile(publicFile, ctx.corsHeaders);
     }
     return null;
@@ -39142,12 +39444,13 @@ function headlessFallbackHandler(ws, getManifest) {
   };
 }
 function spaFallbackHandler(getShellHtml) {
-  return (_req, _url, ctx) => {
-    return new Response(getShellHtml(), {
+  return async (req, _url, ctx) => {
+    return new Response(await getShellHtml(req), {
       headers: {
         ...ctx.corsHeaders,
         "Content-Type": "text/html",
-        "Cache-Control": "no-cache, must-revalidate"
+        "Cache-Control": "no-cache, must-revalidate, private",
+        Vary: "Cookie, Accept-Language"
       }
     });
   };
@@ -39188,7 +39491,16 @@ async function startPlatformServer(opts) {
     mapUrl = u2;
   };
   const getMapUrl = () => mapUrl;
-  const getShellHtml = () => generateShellHtml(ws.appName, ws.manifest, manifest?.initial, manifest?.stylesHash, manifest?.shell);
+  const getShellHtml = (req) => generateShellHtml({
+    appName: ws.appName,
+    appManifest: ws.manifest,
+    buildManifest: manifest,
+    moduleAccessMap,
+    arcDir: ws.arcDir,
+    rootDir: ws.rootDir,
+    cookieHeader: req.headers.get("Cookie"),
+    acceptLanguage: req.headers.get("Accept-Language")
+  });
   const sseClients = new Set;
   const fallbackHandler = opts.headless ? headlessFallbackHandler(ws, getManifest) : spaFallbackHandler(getShellHtml);
   const notifyReload = (m4) => {
@@ -39252,7 +39564,7 @@ async function startPlatformServer(opts) {
       stop: () => server.stop()
     };
   }
-  const dbPath = opts.dbPath || join22(ws.arcDir, "data", "arc.db");
+  const dbPath = opts.dbPath || join23(ws.arcDir, "data", "arc.db");
   const baseDbFactory = await resolveDbAdapterFactory(dbPath);
   let dbAdapterFactory = baseDbFactory;
   if (telemetry) {
@@ -39297,17 +39609,17 @@ async function startPlatformServer(opts) {
 async function startPlatform(opts) {
   const { ws, devMode } = opts;
   const port = opts.port ?? parseInt(process.env.PORT || "5005", 10);
-  const dbPath = opts.dbPath ?? join23(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
+  const dbPath = opts.dbPath ?? join24(ws.rootDir, ".arc", "data", devMode ? "dev.db" : "prod.db");
   let manifest;
   if (devMode) {
     manifest = await buildAll(ws, { minify: false });
   } else {
-    const manifestPath = join23(ws.arcDir, "manifest.json");
-    if (!existsSync20(manifestPath)) {
+    const manifestPath = join24(ws.arcDir, "manifest.json");
+    if (!existsSync21(manifestPath)) {
       err("No build found. Run `arc platform build` first.");
       process.exit(1);
     }
-    manifest = JSON.parse(readFileSync17(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync19(manifestPath, "utf-8"));
   }
   assertProdFederationSecrets(devMode, !!manifest.federation);
   const needsPairing = !!manifest.federation || devMode && (opts.map || opts.headless);
@@ -39391,8 +39703,8 @@ async function startMapTool(ws, port, authToken, platformServer, platform3) {
   try {
     const { startMapServer, MAP_SCHEMA_VERSION } = await import("@arcote.tech/arc-map");
     const { getContext } = await import("@arcote.tech/platform");
-    const globs = ws.packages.map((p3) => join23(p3.path, "src", "**", "*.{ts,tsx}"));
-    const packageOf = (absFile) => ws.packages.find((p3) => absFile.startsWith(join23(p3.path, "src")))?.name;
+    const globs = ws.packages.map((p3) => join24(p3.path, "src", "**", "*.{ts,tsx}"));
+    const packageOf = (absFile) => ws.packages.find((p3) => absFile.startsWith(join24(p3.path, "src")))?.name;
     const meta = readAppMeta(ws.rootDir, MAP_SCHEMA_VERSION);
     const map = await startMapServer({
       getContext: () => getContext(),
@@ -39427,15 +39739,15 @@ function resolveAppSecret(rootDir) {
   const fromEnv = process.env.ARC_APP_SECRET;
   if (fromEnv)
     return fromEnv;
-  const file = join23(rootDir, ".arc", "app-secret");
+  const file = join24(rootDir, ".arc", "app-secret");
   try {
-    const saved = readFileSync17(file, "utf-8").trim();
+    const saved = readFileSync19(file, "utf-8").trim();
     if (saved)
       return saved;
   } catch {}
   const secret = randomBytes2(32).toString("base64url");
   try {
-    mkdirSync16(join23(rootDir, ".arc"), { recursive: true });
+    mkdirSync16(join24(rootDir, ".arc"), { recursive: true });
     writeFileSync16(file, secret, { mode: 384 });
   } catch (e2) {
     err(`App secret not persisted (${e2.message}) \u2014 hosts will need re-install after restart`);
@@ -39446,15 +39758,15 @@ function resolvePairingToken(rootDir) {
   const fromEnv = process.env.ARC_PAIRING_TOKEN || process.env.ARC_MAP_TOKEN;
   if (fromEnv)
     return fromEnv;
-  const file = join23(rootDir, ".arc", "pairing-token");
+  const file = join24(rootDir, ".arc", "pairing-token");
   try {
-    const saved = readFileSync17(file, "utf-8").trim();
+    const saved = readFileSync19(file, "utf-8").trim();
     if (saved)
       return saved;
   } catch {}
   const token = randomBytes2(16).toString("base64url");
   try {
-    mkdirSync16(join23(rootDir, ".arc"), { recursive: true });
+    mkdirSync16(join24(rootDir, ".arc"), { recursive: true });
     writeFileSync16(file, token, { mode: 384 });
   } catch (e2) {
     err(`Pairing token not persisted (${e2.message}) \u2014 it will change on restart`);
@@ -39463,7 +39775,7 @@ function resolvePairingToken(rootDir) {
 }
 function readAppMeta(rootDir, schemaVersion) {
   try {
-    const pkg = JSON.parse(readFileSync17(join23(rootDir, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync19(join24(rootDir, "package.json"), "utf-8"));
     return {
       schemaVersion,
       name: pkg.name ?? rootDir.split("/").pop() ?? "arc-app",
@@ -39499,8 +39811,8 @@ function attachDevWatcher(ws, platform3, onReload) {
     }, 300);
   };
   for (const pkg of ws.packages) {
-    const srcDir = join23(pkg.path, "src");
-    if (!existsSync20(srcDir))
+    const srcDir = join24(pkg.path, "src");
+    if (!existsSync21(srcDir))
       continue;
     watch(srcDir, { recursive: true }, (_event, filename) => {
       if (!filename || filename.includes(".arc") || filename.endsWith(".d.ts") || filename.includes("node_modules") || filename.includes("dist"))
@@ -39510,8 +39822,8 @@ function attachDevWatcher(ws, platform3, onReload) {
       triggerRebuild();
     });
   }
-  const localesDir = join23(ws.rootDir, "locales");
-  if (existsSync20(localesDir)) {
+  const localesDir = join24(ws.rootDir, "locales");
+  if (existsSync21(localesDir)) {
     watch(localesDir, { recursive: false }, (_event, filename) => {
       if (!filename?.endsWith(".po"))
         return;
@@ -39533,7 +39845,7 @@ async function platformDev(opts = {}) {
 
 // src/commands/platform-pairing-token.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 async function platformPairingToken() {
   const ws = resolveWorkspace();
   const { context: context2 } = await loadServerContext(ws);
@@ -39542,7 +39854,7 @@ async function platformPairingToken() {
     process.exit(1);
   }
   const isProd = false;
-  const dbPath = join24(ws.rootDir, ".arc", "data", isProd ? "prod.db" : "dev.db");
+  const dbPath = join25(ws.rootDir, ".arc", "data", isProd ? "prod.db" : "dev.db");
   const handler = await initContextHandler(context2, dbPath);
   const code = randomBytes3(24).toString("base64url");
   const res = await handler.executeCommand("pairingCode.issue", { code }, null, { internal: true });