@arcote.tech/arc-cli 0.8.5 → 0.8.7

package/dist/index.js

@@ -10191,8 +10191,72 @@ function apply(state, patches, applyOptions) {
   }
   return create(state, mutate, Object.assign(Object.assign({}, applyOptions), { enablePatches: false }));
 }
-function hasLocalStorage() {
-  return typeof localStorage !== "undefined";
+function hasDocument() {
+  return typeof document !== "undefined";
+}
+function signalCrossTabChange() {
+  if (typeof localStorage === "undefined")
+    return;
+  try {
+    localStorage.setItem(TOKEN_BUMP_KEY, String(Date.now()));
+  } catch {}
+}
+function isSecureContext() {
+  return typeof location !== "undefined" && location.protocol === "https:";
+}
+function tokenCookieName(scopeKey) {
+  return scopeKey === "default" ? COOKIE_PREFIX : `${COOKIE_PREFIX}_${scopeKey.replace(/:/g, ".")}`;
+}
+function scopeKeyFromCookieName(name) {
+  if (name === COOKIE_PREFIX)
+    return "default";
+  if (!name.startsWith(`${COOKIE_PREFIX}_`))
+    return null;
+  return name.slice(COOKIE_PREFIX.length + 1).replace(/\./g, ":");
+}
+function maxAgeFromExp(exp) {
+  const THIRTY_DAYS = 30 * 24 * 60 * 60;
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return THIRTY_DAYS;
+  const expMs = exp > 1000000000000 ? exp : exp * 1000;
+  const secs = Math.floor((expMs - Date.now()) / 1000);
+  return secs > 0 ? secs : THIRTY_DAYS;
+}
+function writeTokenCookie(scopeKey, jwt, exp) {
+  if (!hasDocument())
+    return;
+  const attrs = [
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${maxAgeFromExp(exp)}`
+  ];
+  if (isSecureContext())
+    attrs.push("Secure");
+  document.cookie = `${tokenCookieName(scopeKey)}=${encodeURIComponent(jwt)}; ${attrs.join("; ")}`;
+  signalCrossTabChange();
+}
+function removeTokenCookie(scopeKey) {
+  if (!hasDocument())
+    return;
+  document.cookie = `${tokenCookieName(scopeKey)}=; Path=/; SameSite=Lax; Max-Age=0`;
+  signalCrossTabChange();
+}
+function readAllTokenCookies() {
+  if (!hasDocument() || !document.cookie)
+    return [];
+  const out = [];
+  for (const part of document.cookie.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0)
+      continue;
+    const scopeKey = scopeKeyFromCookieName(part.slice(0, eq).trim());
+    if (scopeKey === null)
+      continue;
+    const jwt = decodeURIComponent(part.slice(eq + 1).trim());
+    if (jwt)
+      out.push({ scopeKey, jwt });
+  }
+  return out;
 }
 function notifyTokenChange(scope) {
   if (typeof window !== "undefined") {
@@ -10208,24 +10272,21 @@ class AuthAdapter {
   constructor(options) {
     this.namespace = options?.storageNamespace || undefined;
   }
-  storageKey(scope) {
-    return this.namespace ? `${TOKEN_PREFIX}${this.namespace}:${scope}` : TOKEN_PREFIX + scope;
+  scopeKey(scope) {
+    return this.namespace ? `${this.namespace}:${scope}` : scope;
   }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
-      if (hasLocalStorage()) {
-        localStorage.removeItem(this.storageKey(scope));
-        notifyTokenChange(scope);
-      }
+      removeTokenCookie(this.scopeKey(scope));
+      notifyTokenChange(scope);
       return;
     }
     try {
       const parts = token.split(".");
       if (parts.length !== 3) {
         this.scopes.delete(scope);
-        if (hasLocalStorage())
-          localStorage.removeItem(this.storageKey(scope));
+        removeTokenCookie(this.scopeKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -10238,49 +10299,45 @@ class AuthAdapter {
           exp: payload.exp
         }
       });
-      if (hasLocalStorage()) {
-        localStorage.setItem(this.storageKey(scope), token);
-        notifyTokenChange(scope);
-      }
+      writeTokenCookie(this.scopeKey(scope), token, payload.exp);
+      notifyTokenChange(scope);
     } catch {
       this.scopes.delete(scope);
-      if (hasLocalStorage())
-        localStorage.removeItem(this.storageKey(scope));
+      removeTokenCookie(this.scopeKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
     this.scopes.set(scope, { raw: "", decoded });
   }
   loadPersisted() {
-    if (!hasLocalStorage())
-      return;
-    const prefix = this.namespace ? `${TOKEN_PREFIX}${this.namespace}:` : TOKEN_PREFIX;
-    for (let i = 0;i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.startsWith(prefix)) {
-        const scope = key.slice(prefix.length);
-        if (!this.namespace && scope.includes(":"))
+    const nsPrefix = this.namespace ? `${this.namespace}:` : "";
+    for (const { scopeKey, jwt } of readAllTokenCookies()) {
+      let scope;
+      if (this.namespace) {
+        if (!scopeKey.startsWith(nsPrefix))
           continue;
-        const raw = localStorage.getItem(key);
-        if (raw) {
-          try {
-            const parts = raw.split(".");
-            if (parts.length !== 3)
-              continue;
-            const payload = JSON.parse(atob(parts[1]));
-            this.scopes.set(scope, {
-              raw,
-              decoded: {
-                tokenName: payload.tokenName,
-                params: payload.params || {},
-                iat: payload.iat,
-                exp: payload.exp
-              }
-            });
-          } catch {
-            localStorage.removeItem(key);
+        scope = scopeKey.slice(nsPrefix.length);
+      } else {
+        if (scopeKey.includes(":"))
+          continue;
+        scope = scopeKey;
+      }
+      try {
+        const parts = jwt.split(".");
+        if (parts.length !== 3)
+          continue;
+        const payload = JSON.parse(atob(parts[1]));
+        this.scopes.set(scope, {
+          raw: jwt,
+          decoded: {
+            tokenName: payload.tokenName,
+            params: payload.params || {},
+            iat: payload.iat,
+            exp: payload.exp
           }
-        }
+        });
+      } catch {
+        removeTokenCookie(scopeKey);
       }
     }
   }
@@ -10312,10 +10369,8 @@ class AuthAdapter {
     return Array.from(this.scopes.keys());
   }
   clear() {
-    if (hasLocalStorage()) {
-      for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(this.storageKey(scope));
-      }
+    for (const scope of this.scopes.keys()) {
+      removeTokenCookie(this.scopeKey(scope));
     }
     this.scopes.clear();
   }
@@ -14595,7 +14650,7 @@ var Operation, PROXY_DRAFT, RAW_RETURN_SYMBOL, iteratorSymbol, dataTypes, intern
     }
     return returnValue(result);
   };
-}, create, constructorString, TOKEN_PREFIX = "arc:token:", DEFAULT_TIMEOUT_MS = 8000, provider = null, latestSync = null, syncSeq = 0, eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcAuthenticationError, ArcAuthorizationError2, ArcValidationError2, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, _te, _td, originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
+}, create, constructorString, COOKIE_PREFIX = "arc_token", TOKEN_BUMP_KEY = "arc:token-bump", DEFAULT_TIMEOUT_MS = 8000, provider = null, latestSync = null, syncSeq = 0, eventWireInstanceCounter = 0, EVENT_TABLES, arrayValidator, ArcArray, objectValidator, ArcObject, ScopedDataStorage, ArcAuthenticationError, ArcAuthorizationError2, ArcValidationError2, ArcPrimitive, stringValidator, ArcString, ArcContextElement, ArcBoolean, ArcId, numberValidator, ArcNumber, ArcEvent, ArcCommand, ArcListener, ArcRoute, ForkedStoreState, ForkedDataStorage, MasterStoreState, MasterDataStorage2, dateValidator, _te, _td, originCache, originStackCache, originError, CLOSE, Query, PostgresError, Errors, types2, Identifier, Parameter, Builder, defaultHandlers, builders, serializers, parsers, mergeUserTypes = function(types22) {
   const user = typeHandlers(types22 || {});
   return {
     serializers: Object.assign({}, serializers, user.serializers),
@@ -17838,8 +17893,72 @@ function apply2(state, patches, applyOptions) {
   }
   return create2(state, mutate, Object.assign(Object.assign({}, applyOptions), { enablePatches: false }));
 }
-function hasLocalStorage2() {
-  return typeof localStorage !== "undefined";
+function hasDocument2() {
+  return typeof document !== "undefined";
+}
+function signalCrossTabChange2() {
+  if (typeof localStorage === "undefined")
+    return;
+  try {
+    localStorage.setItem(TOKEN_BUMP_KEY2, String(Date.now()));
+  } catch {}
+}
+function isSecureContext2() {
+  return typeof location !== "undefined" && location.protocol === "https:";
+}
+function tokenCookieName2(scopeKey) {
+  return scopeKey === "default" ? COOKIE_PREFIX2 : `${COOKIE_PREFIX2}_${scopeKey.replace(/:/g, ".")}`;
+}
+function scopeKeyFromCookieName2(name) {
+  if (name === COOKIE_PREFIX2)
+    return "default";
+  if (!name.startsWith(`${COOKIE_PREFIX2}_`))
+    return null;
+  return name.slice(COOKIE_PREFIX2.length + 1).replace(/\./g, ":");
+}
+function maxAgeFromExp2(exp) {
+  const THIRTY_DAYS = 30 * 24 * 60 * 60;
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return THIRTY_DAYS;
+  const expMs = exp > 1000000000000 ? exp : exp * 1000;
+  const secs = Math.floor((expMs - Date.now()) / 1000);
+  return secs > 0 ? secs : THIRTY_DAYS;
+}
+function writeTokenCookie2(scopeKey, jwt, exp) {
+  if (!hasDocument2())
+    return;
+  const attrs = [
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${maxAgeFromExp2(exp)}`
+  ];
+  if (isSecureContext2())
+    attrs.push("Secure");
+  document.cookie = `${tokenCookieName2(scopeKey)}=${encodeURIComponent(jwt)}; ${attrs.join("; ")}`;
+  signalCrossTabChange2();
+}
+function removeTokenCookie2(scopeKey) {
+  if (!hasDocument2())
+    return;
+  document.cookie = `${tokenCookieName2(scopeKey)}=; Path=/; SameSite=Lax; Max-Age=0`;
+  signalCrossTabChange2();
+}
+function readAllTokenCookies2() {
+  if (!hasDocument2() || !document.cookie)
+    return [];
+  const out = [];
+  for (const part of document.cookie.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0)
+      continue;
+    const scopeKey = scopeKeyFromCookieName2(part.slice(0, eq).trim());
+    if (scopeKey === null)
+      continue;
+    const jwt = decodeURIComponent(part.slice(eq + 1).trim());
+    if (jwt)
+      out.push({ scopeKey, jwt });
+  }
+  return out;
 }
 function notifyTokenChange2(scope) {
   if (typeof window !== "undefined") {
@@ -17855,24 +17974,21 @@ class AuthAdapter2 {
   constructor(options) {
     this.namespace = options?.storageNamespace || undefined;
   }
-  storageKey(scope) {
-    return this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:${scope}` : TOKEN_PREFIX2 + scope;
+  scopeKey(scope) {
+    return this.namespace ? `${this.namespace}:${scope}` : scope;
   }
   setToken(token, scope = "default") {
     if (!token) {
       this.scopes.delete(scope);
-      if (hasLocalStorage2()) {
-        localStorage.removeItem(this.storageKey(scope));
-        notifyTokenChange2(scope);
-      }
+      removeTokenCookie2(this.scopeKey(scope));
+      notifyTokenChange2(scope);
       return;
     }
     try {
       const parts = token.split(".");
       if (parts.length !== 3) {
         this.scopes.delete(scope);
-        if (hasLocalStorage2())
-          localStorage.removeItem(this.storageKey(scope));
+        removeTokenCookie2(this.scopeKey(scope));
         return;
       }
       const payload = JSON.parse(atob(parts[1]));
@@ -17885,49 +18001,45 @@ class AuthAdapter2 {
           exp: payload.exp
         }
       });
-      if (hasLocalStorage2()) {
-        localStorage.setItem(this.storageKey(scope), token);
-        notifyTokenChange2(scope);
-      }
+      writeTokenCookie2(this.scopeKey(scope), token, payload.exp);
+      notifyTokenChange2(scope);
     } catch {
       this.scopes.delete(scope);
-      if (hasLocalStorage2())
-        localStorage.removeItem(this.storageKey(scope));
+      removeTokenCookie2(this.scopeKey(scope));
     }
   }
   setDecoded(decoded, scope = "default") {
     this.scopes.set(scope, { raw: "", decoded });
   }
   loadPersisted() {
-    if (!hasLocalStorage2())
-      return;
-    const prefix = this.namespace ? `${TOKEN_PREFIX2}${this.namespace}:` : TOKEN_PREFIX2;
-    for (let i = 0;i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.startsWith(prefix)) {
-        const scope = key.slice(prefix.length);
-        if (!this.namespace && scope.includes(":"))
+    const nsPrefix = this.namespace ? `${this.namespace}:` : "";
+    for (const { scopeKey, jwt } of readAllTokenCookies2()) {
+      let scope;
+      if (this.namespace) {
+        if (!scopeKey.startsWith(nsPrefix))
           continue;
-        const raw = localStorage.getItem(key);
-        if (raw) {
-          try {
-            const parts = raw.split(".");
-            if (parts.length !== 3)
-              continue;
-            const payload = JSON.parse(atob(parts[1]));
-            this.scopes.set(scope, {
-              raw,
-              decoded: {
-                tokenName: payload.tokenName,
-                params: payload.params || {},
-                iat: payload.iat,
-                exp: payload.exp
-              }
-            });
-          } catch {
-            localStorage.removeItem(key);
+        scope = scopeKey.slice(nsPrefix.length);
+      } else {
+        if (scopeKey.includes(":"))
+          continue;
+        scope = scopeKey;
+      }
+      try {
+        const parts = jwt.split(".");
+        if (parts.length !== 3)
+          continue;
+        const payload = JSON.parse(atob(parts[1]));
+        this.scopes.set(scope, {
+          raw: jwt,
+          decoded: {
+            tokenName: payload.tokenName,
+            params: payload.params || {},
+            iat: payload.iat,
+            exp: payload.exp
           }
-        }
+        });
+      } catch {
+        removeTokenCookie2(scopeKey);
       }
     }
   }
@@ -17959,10 +18071,8 @@ class AuthAdapter2 {
     return Array.from(this.scopes.keys());
   }
   clear() {
-    if (hasLocalStorage2()) {
-      for (const scope of this.scopes.keys()) {
-        localStorage.removeItem(this.storageKey(scope));
-      }
+    for (const scope of this.scopes.keys()) {
+      removeTokenCookie2(this.scopeKey(scope));
     }
     this.scopes.clear();
   }
@@ -20673,7 +20783,7 @@ var Operation2, PROXY_DRAFT2, RAW_RETURN_SYMBOL2, iteratorSymbol2, dataTypes2, i
     }
     return returnValue(result);
   };
-}, create2, constructorString2, TOKEN_PREFIX2 = "arc:token:", DEFAULT_TIMEOUT_MS2 = 8000, provider2 = null, latestSync2 = null, syncSeq2 = 0, eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcAuthenticationError2, ArcAuthorizationError3, ArcValidationError3, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, _te2, _td2, SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
+}, create2, constructorString2, COOKIE_PREFIX2 = "arc_token", TOKEN_BUMP_KEY2 = "arc:token-bump", DEFAULT_TIMEOUT_MS2 = 8000, provider2 = null, latestSync2 = null, syncSeq2 = 0, eventWireInstanceCounter2 = 0, EVENT_TABLES2, arrayValidator2, ArcArray2, objectValidator2, ArcObject2, ScopedDataStorage2, ArcAuthenticationError2, ArcAuthorizationError3, ArcValidationError3, ArcPrimitive2, stringValidator2, ArcString2, ArcContextElement2, ArcBoolean2, ArcId2, numberValidator2, ArcNumber2, ArcEvent2, ArcCommand2, ArcListener2, ArcRoute2, ForkedStoreState2, ForkedDataStorage2, MasterStoreState2, MasterDataStorage3, dateValidator2, _te2, _td2, SQLiteReadWriteTransaction, createSQLiteAdapterFactory = (db) => {
   return async (context) => {
     const adapter = new SQLiteAdapter(db, context);
     await adapter.initialize();
@@ -31692,7 +31802,7 @@ function workspaceSourcePlugin(srcByName) {
     }
   };
 }
-var SERVER_ONLY_NODE_BUILTINS = new Set([
+var SERVER_ONLY_NODE_BUILTINS = [
   "crypto",
   "stream",
   "zlib",
@@ -31720,15 +31830,13 @@ var SERVER_ONLY_NODE_BUILTINS = new Set([
   "diagnostics_channel",
   "module",
   "constants"
-]);
+];
+var NODE_STUB_FILTER = new RegExp(`^(node:)?(${SERVER_ONLY_NODE_BUILTINS.map((b) => b.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")).join("|")})$`);
 function nodeServerBuiltinStubPlugin() {
   return {
     name: "node-server-builtin-stub",
     setup(build2) {
-      build2.onResolve({ filter: /^(node:)?[a-z_/]+$/ }, (args) => {
-        const bare = args.path.replace(/^node:/, "");
-        if (!SERVER_ONLY_NODE_BUILTINS.has(bare))
-          return;
+      build2.onResolve({ filter: NODE_STUB_FILTER }, (args) => {
         return { path: args.path, namespace: "node-server-stub" };
       });
       build2.onLoad({ filter: /.*/, namespace: "node-server-stub" }, (args) => ({
@@ -31782,19 +31890,23 @@ function discoverPackages(rootDir) {
       if (pkg.name?.startsWith("@arcote.tech/"))
         continue;
       const pkgDir = join9(baseDir, entry);
-      const candidates = [
-        join9(pkgDir, "src", "index.ts"),
-        join9(pkgDir, "src", "index.tsx"),
-        join9(pkgDir, "index.ts"),
-        join9(pkgDir, "index.tsx")
+      const entryCandidates = (variant) => [
+        join9(pkgDir, "src", `index${variant}.ts`),
+        join9(pkgDir, "src", `index${variant}.tsx`),
+        join9(pkgDir, `index${variant}.ts`),
+        join9(pkgDir, `index${variant}.tsx`)
       ];
-      const entrypoint = candidates.find((c) => existsSync8(c)) ?? null;
+      const entrypoint = entryCandidates("").find((c) => existsSync8(c)) ?? null;
       if (!entrypoint)
         continue;
+      const serverEntrypoint = entryCandidates(".server").find((c) => existsSync8(c)) ?? entrypoint;
+      const clientEntrypoint = entryCandidates(".client").find((c) => existsSync8(c)) ?? entrypoint;
       results.push({
         name: pkg.name,
         path: join9(baseDir, entry),
         entrypoint,
+        serverEntrypoint,
+        clientEntrypoint,
         packageJson: pkg
       });
     }
@@ -31836,13 +31948,15 @@ function depVersionsHash(rootDir, pkg) {
 async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const unitId = `context-pkg:${pkg.name}:${client.name}`;
   const outDir = join9(pkg.path, "dist", client.name);
+  const entry = client.target === "browser" ? pkg.clientEntrypoint : pkg.entrypoint;
   const inputHash = sha256OfJson({
     src: pkgSourceHash(pkg),
     pkg: pkg.packageJson,
     deps: depVersionsHash(rootDir, pkg),
     client: client.name,
     target: client.target,
-    defines: client.defines
+    defines: client.defines,
+    entry: relative3(pkg.path, entry)
   });
   if (!noCache && isCacheHit(cache, unitId, inputHash, [join9(outDir, "main", "index.js")])) {
     console.log(`  \u2713 cached: ${pkg.name} (${client.name})`);
@@ -31853,7 +31967,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   const allDeps = pkg.packageJson.dependencies ?? {};
   const externals = [...peerDeps, ...Object.keys(allDeps)];
   const result = await Bun.build({
-    entrypoints: [pkg.entrypoint],
+    entrypoints: [entry],
     outdir: join9(outDir, "main"),
     target: client.target,
     format: "esm",
@@ -31873,7 +31987,7 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   }
   const globalsContent = Object.entries(client.defines).map(([k, v]) => `declare const ${k}: ${v};`).join(`
 `);
-  const declResult = await buildTypeDeclarations([pkg.entrypoint], outDir, dirname6(pkg.entrypoint), globalsContent);
+  const declResult = await buildTypeDeclarations([entry], outDir, dirname6(entry), globalsContent);
   const declarationErrors = !declResult.success && declResult.errors.length > 0 ? declResult.errors.map((e) => `[${pkg.name}/${client.name}] ${e}`) : [];
   const outputHash = sha256OfDir(outDir);
   updateCache(cache, unitId, inputHash, { outputHash });
@@ -31928,7 +32042,7 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
 async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
   const contexts = packages.filter((p) => isContextPackage(p.packageJson));
   mkdirSync7(serverDir, { recursive: true });
-  const srcByName = new Map(packages.map((p) => [p.name, p.entrypoint]));
+  const srcByName = new Map(packages.map((p) => [p.name, p.serverEntrypoint]));
   const externalSet = new Set(FRAMEWORK_PEERS);
   for (const p of packages) {
     for (const name of Object.keys(p.packageJson.peerDependencies ?? {})) {
@@ -31942,7 +32056,11 @@ async function buildServerApp(rootDir, serverDir, packages, cache, noCache) {
   const external = [...externalSet];
   const unitId = "server-app";
   const inputHash = sha256OfJson({
-    members: packages.map((p) => ({ name: p.name, src: pkgSourceHash(p) })).sort((a, b) => a.name.localeCompare(b.name)),
+    members: packages.map((p) => ({
+      name: p.name,
+      src: pkgSourceHash(p),
+      serverEntry: relative3(p.path, p.serverEntrypoint)
+    })).sort((a, b) => a.name.localeCompare(b.name)),
     contexts: contexts.map((p) => p.name).sort(),
     external: [...external].sort(),
     defines: SERVER_DEFINES,
@@ -32184,11 +32302,11 @@ async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollec
   const unitId = opts?.unitId ?? "browser-app";
   const allMembers = [];
   for (const m of publicMembers) {
-    allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg) });
+    allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg), clientEntry: relative3(m.pkg.path, m.pkg.clientEntrypoint) });
   }
   for (const g of protectedGroups) {
     for (const m of g.members) {
-      allMembers.push({ name: m.pkg.name, group: g.name, srcHash: pkgSourceHash(m.pkg) });
+      allMembers.push({ name: m.pkg.name, group: g.name, srcHash: pkgSourceHash(m.pkg), clientEntry: relative3(m.pkg.path, m.pkg.clientEntrypoint) });
     }
   }
   const inputHash = sha256OfJson({
@@ -32202,7 +32320,7 @@ async function buildBrowserApp(rootDir, outDir, plan, cache, noCache, i18nCollec
     exposeRuntime,
     minify,
     externals: federated ? [...SHELL_EXTERNALS] : [],
-    builderRev: 3
+    builderRev: 4
   });
   if (!noCache && !buildStatsEnabled() && isCacheHit(cache, unitId, inputHash)) {
     const cached = cache.units[unitId]?.outputHashes;
@@ -32255,6 +32373,12 @@ export { startApp } from "@arcote.tech/platform";
   for (const g of protectedGroups)
     for (const m of g.members)
       allMemberPkgs.set(m.pkg.name, m.pkg);
+  const clientByName = new Map;
+  for (const pkg of allMemberPkgs.values()) {
+    if (pkg.clientEntrypoint !== pkg.entrypoint) {
+      clientByName.set(pkg.name, pkg.clientEntrypoint);
+    }
+  }
   const patchedPkgJsons = [];
   for (const pkg of allMemberPkgs.values()) {
     const pkgJsonPath = join9(pkg.path, "package.json");
@@ -32281,6 +32405,7 @@ export { startApp } from "@arcote.tech/platform";
       target: "browser",
       external: federated ? [...SHELL_EXTERNALS] : [],
       plugins: [
+        ...clientByName.size > 0 ? [workspaceSourcePlugin(clientByName)] : [],
         ...federated ? [] : [singleReactPlugin(rootDir)],
         jsxDevShimPlugin(),
         nodeServerBuiltinStubPlugin(),
@@ -32672,7 +32797,7 @@ function walkTsFiles(dir, out) {
       if (entry.name === "__tests__")
         continue;
       walkTsFiles(abs, out);
-    } else if (entry.isFile() && /\.(ts|tsx)$/.test(entry.name) && !entry.name.endsWith(".d.ts")) {
+    } else if (entry.isFile() && /\.(ts|tsx)$/.test(entry.name) && !entry.name.endsWith(".d.ts") && !/\.server\.tsx?$/.test(entry.name)) {
       out.push(abs);
     }
   }
@@ -36917,11 +37042,11 @@ async function runSurvey(appName) {
     });
     if (BD(serverType))
       cancel();
-    const location = await ue({
+    const location2 = await ue({
       message: "Hetzner datacenter location",
       initialValue: "nbg1"
     });
-    if (BD(location))
+    if (BD(location2))
       cancel();
     const firstEnv = Object.keys(envs)[0] ?? "host";
     const appSlug = sanitizeImageName(appName ?? "arc-app").replace(/[^a-z0-9-]+/g, "-");
@@ -36929,7 +37054,7 @@ async function runSurvey(appName) {
     const terraform = {
       provider: "hcloud",
       serverType,
-      location,
+      location: location2,
       image: "ubuntu-22.04",
       tokenEnv,
       serverName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,13 +12,13 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform --external @arcote.tech/arc-map --external '@opentelemetry/*' && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.8.5",
-    "@arcote.tech/arc-ds": "^0.8.5",
-    "@arcote.tech/arc-react": "^0.8.5",
-    "@arcote.tech/arc-host": "^0.8.5",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.8.5",
-    "@arcote.tech/arc-adapter-db-postgres": "^0.8.5",
-    "@arcote.tech/arc-otel": "^0.8.5",
+    "@arcote.tech/arc": "^0.8.7",
+    "@arcote.tech/arc-ds": "^0.8.7",
+    "@arcote.tech/arc-react": "^0.8.7",
+    "@arcote.tech/arc-host": "^0.8.7",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.8.7",
+    "@arcote.tech/arc-adapter-db-postgres": "^0.8.7",
+    "@arcote.tech/arc-otel": "^0.8.7",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.57.0",
     "@opentelemetry/core": "^1.30.0",
@@ -31,8 +31,8 @@
     "@opentelemetry/sdk-trace-base": "^1.30.0",
     "@opentelemetry/sdk-trace-node": "^1.30.0",
     "@opentelemetry/semantic-conventions": "^1.27.0",
-    "@arcote.tech/platform": "^0.8.5",
-    "@arcote.tech/arc-map": "^0.8.5",
+    "@arcote.tech/platform": "^0.8.7",
+    "@arcote.tech/arc-map": "^0.8.7",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/src/builder/module-builder.ts

@@ -248,12 +248,27 @@ function workspaceSourcePlugin(srcByName: Map<string, string>): import("bun").Bu
 // CELOWO NIE stubujemy „przeglądarkowo-bezpiecznych" builtinów (buffer, util,
 // events, path, url, string_decoder, querystring, assert, process) — te bywają
 // realnie używane po stronie klienta i mają lekkie, działające polyfille.
-const SERVER_ONLY_NODE_BUILTINS = new Set([
+const SERVER_ONLY_NODE_BUILTINS = [
   "crypto", "stream", "zlib", "fs", "fs/promises", "net", "tls", "http",
   "https", "http2", "dns", "dgram", "child_process", "worker_threads",
   "cluster", "os", "v8", "vm", "readline", "repl", "tty", "perf_hooks",
   "inspector", "async_hooks", "diagnostics_channel", "module", "constants",
-]);
+];
+
+/**
+ * Filtr onResolve dopasowujący DOKŁADNIE serwerowe builtiny (`node:crypto`,
+ * `crypto`, `fs/promises`, …) i NIC innego. KRYTYCZNE, że jest precyzyjny:
+ * szeroki filtr `/^(node:)?[a-z_/]+$/` łapał też gołe pakiety npm (np. `unified`,
+ * `vfile`, `micromark`), a samo przepuszczenie ich przez onResolve — nawet ze
+ * zwrotem `undefined` — korumpuje tree-shaking Buna pod minify: pakiet znika z
+ * bundla, ale zostaje wiszące wywołanie (`ReferenceError: X is not defined` w
+ * produkcji — react-markdown/`unified()` na stronach z markdownem).
+ */
+const NODE_STUB_FILTER = new RegExp(
+  `^(node:)?(${SERVER_ONLY_NODE_BUILTINS.map((b) =>
+    b.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&"),
+  ).join("|")})$`,
+);
 
 /**
  * Zastępuje serwerowe builtiny node (SERVER_ONLY_NODE_BUILTINS) rzucającym
@@ -266,9 +281,7 @@ function nodeServerBuiltinStubPlugin(): import("bun").BunPlugin {
   return {
     name: "node-server-builtin-stub",
     setup(build) {
-      build.onResolve({ filter: /^(node:)?[a-z_/]+$/ }, (args) => {
-        const bare = args.path.replace(/^node:/, "");
-        if (!SERVER_ONLY_NODE_BUILTINS.has(bare)) return undefined;
+      build.onResolve({ filter: NODE_STUB_FILTER }, (args) => {
         return { path: args.path, namespace: "node-server-stub" };
       });
       build.onLoad({ filter: /.*/, namespace: "node-server-stub" }, (args) => ({
@@ -332,7 +345,12 @@ export const SERVER_EXTERNALS_FILE = "_externals.json";
 export interface WorkspacePackage {
   name: string;
   path: string;
+  /** Base entry (src/index.ts). Fallback for both targets. */
   entrypoint: string;
+  /** src/index.server.ts if present, else `entrypoint`. Used by the SERVER bundle. */
+  serverEntrypoint: string;
+  /** src/index.client.ts if present, else `entrypoint`. Used by the CLIENT (browser) bundle. */
+  clientEntrypoint: string;
   packageJson: Record<string, any>;
 }
 
@@ -374,19 +392,30 @@ export function discoverPackages(rootDir: string): WorkspacePackage[] {
       if (pkg.name?.startsWith("@arcote.tech/")) continue;
 
       const pkgDir = join(baseDir, entry);
-      const candidates = [
-        join(pkgDir, "src", "index.ts"),
-        join(pkgDir, "src", "index.tsx"),
-        join(pkgDir, "index.ts"),
-        join(pkgDir, "index.tsx"),
+      const entryCandidates = (variant: "" | ".server" | ".client") => [
+        join(pkgDir, "src", `index${variant}.ts`),
+        join(pkgDir, "src", `index${variant}.tsx`),
+        join(pkgDir, `index${variant}.ts`),
+        join(pkgDir, `index${variant}.tsx`),
       ];
-      const entrypoint = candidates.find((c) => existsSync(c)) ?? null;
+      const entrypoint = entryCandidates("").find((c) => existsSync(c)) ?? null;
       if (!entrypoint) continue;
 
+      // Per-target entry override by file convention: index.server.ts /
+      // index.client.ts. Absent → fall back to the base entry (zero change for
+      // packages that don't opt in). Lets seeds live in index.server.ts so they
+      // never enter the client graph (see seed-guard.ts).
+      const serverEntrypoint =
+        entryCandidates(".server").find((c) => existsSync(c)) ?? entrypoint;
+      const clientEntrypoint =
+        entryCandidates(".client").find((c) => existsSync(c)) ?? entrypoint;
+
       results.push({
         name: pkg.name,
         path: join(baseDir, entry),
         entrypoint,
+        serverEntrypoint,
+        clientEntrypoint,
         packageJson: pkg,
       });
     }
@@ -467,6 +496,12 @@ async function buildContextClient(
   const unitId = `context-pkg:${pkg.name}:${client.name}`;
   const outDir = join(pkg.path, "dist", client.name);
 
+  // Per-target entry: the browser dist is built from the CLIENT entry
+  // (index.client.ts if present, else index.ts) so dist/browser reflects exactly
+  // what ships to the browser. Non-browser clients keep the base entry.
+  const entry =
+    client.target === "browser" ? pkg.clientEntrypoint : pkg.entrypoint;
+
   const inputHash = sha256OfJson({
     src: pkgSourceHash(pkg),
     pkg: pkg.packageJson,
@@ -474,6 +509,7 @@ async function buildContextClient(
     client: client.name,
     target: client.target,
     defines: client.defines,
+    entry: relative(pkg.path, entry),
   });
 
   if (!noCache && isCacheHit(cache, unitId, inputHash, [join(outDir, "main", "index.js")])) {
@@ -495,7 +531,7 @@ async function buildContextClient(
   const externals = [...peerDeps, ...Object.keys(allDeps)];
 
   const result = await Bun.build({
-    entrypoints: [pkg.entrypoint],
+    entrypoints: [entry],
     outdir: join(outDir, "main"),
     target: client.target,
     format: "esm",
@@ -522,9 +558,9 @@ async function buildContextClient(
     .join("\n");
 
   const declResult = await buildTypeDeclarations(
-    [pkg.entrypoint],
+    [entry],
     outDir,
-    dirname(pkg.entrypoint),
+    dirname(entry),
     globalsContent,
   );
 
@@ -658,7 +694,9 @@ export async function buildServerApp(
   // Every workspace package name → its SOURCE entry. Spans ALL packages, not
   // just context ones — a context package imports non-context workspace libs
   // (e.g. content-core) that must inline from source too.
-  const srcByName = new Map(packages.map((p) => [p.name, p.entrypoint]));
+  // SERVER bundle resolves every `@pkg` to its server entry (index.server.ts if
+  // present, else index.ts) via workspaceSourcePlugin — bypassing package.json.
+  const srcByName = new Map(packages.map((p) => [p.name, p.serverEntrypoint]));
 
   // External = framework peers + every non-workspace npm dep any package
   // declares. NOT bundled; resolved at runtime from /app/node_modules (the
@@ -680,7 +718,13 @@ export async function buildServerApp(
   const unitId = "server-app";
   const inputHash = sha256OfJson({
     members: packages
-      .map((p) => ({ name: p.name, src: pkgSourceHash(p) }))
+      .map((p) => ({
+        name: p.name,
+        src: pkgSourceHash(p),
+        // Which file is the server entry — invalidate if the selection changes
+        // (e.g. an index.server.ts is added/removed) even without other src edits.
+        serverEntry: relative(p.path, p.serverEntrypoint),
+      }))
       .sort((a, b) => a.name.localeCompare(b.name)),
     contexts: contexts.map((p) => p.name).sort(),
     external: [...external].sort(),
@@ -1118,13 +1162,13 @@ export async function buildBrowserApp(
 
   // Cache key spans every package's source plus the build config that
   // matters. If anything changes, full rebuild.
-  const allMembers: { name: string; group: string; srcHash: string }[] = [];
+  const allMembers: { name: string; group: string; srcHash: string; clientEntry: string }[] = [];
   for (const m of publicMembers) {
-    allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg) });
+    allMembers.push({ name: m.pkg.name, group: "public", srcHash: pkgSourceHash(m.pkg), clientEntry: relative(m.pkg.path, m.pkg.clientEntrypoint) });
   }
   for (const g of protectedGroups) {
     for (const m of g.members) {
-      allMembers.push({ name: m.pkg.name, group: g.name, srcHash: pkgSourceHash(m.pkg) });
+      allMembers.push({ name: m.pkg.name, group: g.name, srcHash: pkgSourceHash(m.pkg), clientEntry: relative(m.pkg.path, m.pkg.clientEntrypoint) });
     }
   }
   const inputHash = sha256OfJson({
@@ -1142,7 +1186,8 @@ export async function buildBrowserApp(
     externals: federated ? [...SHELL_EXTERNALS] : [],
     // Podbij przy zmianie SEMANTYKI builda (pluginy/flagi), której nie widać
     // w źródłach — inaczej cache odda bundle zbudowany starą logiką.
-    builderRev: 3,
+    // 4: client-entry (index.client.ts) + workspaceClientSourcePlugin.
+    builderRev: 4,
   });
 
   // Tryb stats zawsze buduje od nowa — cache-hit pominąłby analizę i nie
@@ -1235,6 +1280,18 @@ export async function buildBrowserApp(
   for (const g of protectedGroups)
     for (const m of g.members) allMemberPkgs.set(m.pkg.name, m.pkg);
 
+  // Client-entry override: only packages that DECLARE `index.client.ts`
+  // (clientEntrypoint !== entrypoint) are redirected to their client source.
+  // Everything else — packages without a variant, framework peers, npm — misses
+  // the map and resolves natively (package.json `exports.browser`, e.g. the
+  // per-pkg dist/browser). Empty map ⇒ identical to today's behaviour.
+  const clientByName = new Map<string, string>();
+  for (const pkg of allMemberPkgs.values()) {
+    if (pkg.clientEntrypoint !== pkg.entrypoint) {
+      clientByName.set(pkg.name, pkg.clientEntrypoint);
+    }
+  }
+
   const patchedPkgJsons: { path: string; original: string }[] = [];
   for (const pkg of allMemberPkgs.values()) {
     const pkgJsonPath = join(pkg.path, "package.json");
@@ -1275,6 +1332,11 @@ export async function buildBrowserApp(
       // singletonów React/rejestru z hostem federacji.
       external: federated ? [...SHELL_EXTERNALS] : [],
       plugins: [
+        // Client-entry: `@pkg` z wariantem index.client.ts → jego source. MUSI
+        // być pierwszy (onResolve first-wins), ale mapa zawiera tylko pakiety
+        // workspace z wariantem — react/@arcote.tech/*/npm i pakiety bez wariantu
+        // miss → null → natywna rezolucja / external niżej. Zero regresji.
+        ...(clientByName.size > 0 ? [workspaceSourcePlugin(clientByName)] : []),
         // Federated: singleReactPlugin MUSI zniknąć (jego onResolve wygrałby z
         // `external` → React zbundlowany; singleton daje import mapa). Ale
         // jsxDevShimPlugin ZOSTAJE (Bun i tak emituje jsxDEV) — jego shim jest

package/src/builder/seed-guard.ts

@@ -16,9 +16,17 @@ import type { WorkspacePackage } from "./module-builder";
 // w PUBLICZNYM bundlu przeglądarki. Seedy czyta wyłącznie host (`runSeeds()`),
 // po stronie klienta nie mają żadnego zastosowania — czysty wyciek.
 //
-// Gejt wywołania to WARUNEK KONIECZNY (ten guard go egzekwuje), ale to, gdzie
-// fizycznie leży treść seeda, decyduje czy bajty realnie znikają. Zweryfikowane
-// empirycznie (migracja ndt+bmf, grep bundla klienta):
+// KANONICZNY WZORZEC (rekomendowany): trzymaj seedy w `index.server.ts` pakietu.
+// Build serwera rozwiązuje `@pkg` do `index.server.ts`, a build przeglądarki go
+// nigdy nie importuje — seedy są izolowane FIZYCZNIE (zero DCE, zero ternary,
+// zero szansy na regresję z nieczystym top-level modułu seed). Guard POMIJA pliki
+// `*.server.ts`, więc `.withSeeds(...)` nie wymaga tam gejtu. Patrz discoverPackages
+// / buildServerApp (module-builder.ts).
+//
+// ŚCIEŻKA LEGACY (pliki współdzielone klient+serwer): gejt wywołania to WARUNEK
+// KONIECZNY (ten guard go egzekwuje), ale to, gdzie fizycznie leży treść seeda,
+// decyduje czy bajty realnie znikają. Zweryfikowane empirycznie (migracja ndt+bmf,
+// grep bundla klienta):
 //
 //   // mały seed — inline w gejtowanym literale (ZAWSZE działa: constant-fold):
 //   .seedWith(ONLY_SERVER ? [ { /* wiersze */ } ] : [])
@@ -63,7 +71,16 @@ function walkTsFiles(dir: string, out: string[]): void {
     if (entry.isDirectory()) {
       if (entry.name === "__tests__") continue;
       walkTsFiles(abs, out);
-    } else if (entry.isFile() && /\.(ts|tsx)$/.test(entry.name) && !entry.name.endsWith(".d.ts")) {
+    } else if (
+      entry.isFile() &&
+      /\.(ts|tsx)$/.test(entry.name) &&
+      !entry.name.endsWith(".d.ts") &&
+      // `*.server.ts(x)` (w tym index.server.ts) NIE trafiają do bundla klienta —
+      // build serwera rozwiązuje `@pkg` do index.server.ts, a build przeglądarki
+      // nigdy go nie importuje. Seedy w tych plikach są izolowane fizycznie, więc
+      // `.withSeeds(...)` nie wymaga tam gejtu `ONLY_SERVER`.
+      !/\.server\.tsx?$/.test(entry.name)
+    ) {
       out.push(abs);
     }
   }