@dimina-kit/compiler 0.0.2-dev.20260711141929 → 0.0.2-dev.20260716153350

package/dist/stage-worker.node.js

@@ -3,12 +3,12 @@ import {
   preloadStage,
   resetCompilerState,
   runStage
-} from "./pool.node-chunks/chunk-PDHO4Y56.js";
+} from "./pool.node-chunks/chunk-LVUKEB4F.js";
 import {
   getAppId,
   getAppName,
   resetStoreInfo
-} from "./pool.node-chunks/chunk-7FGOYOXU.js";
+} from "./pool.node-chunks/chunk-QLBB5HQB.js";
 
 // src/stage-worker-node.js
 import { createRequire } from "node:module";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dimina-kit/compiler",
-  "version": "0.0.2-dev.20260711141929",
+  "version": "0.0.2-dev.20260716153350",
   "description": "dmcc compiler bundles (browser + node) that drive @dimina/compiler against a caller-injected node:fs replacement (no bundled fs)",
   "license": "MIT",
   "type": "module",
@@ -82,6 +82,7 @@
     "test:realm-reuse": "node scripts/build-compiler.js node && node --import ./scripts/register-kit.js scripts/test-realm-reuse.js",
     "test:pool-node": "node scripts/build-compiler.js node && node --import ./scripts/register-kit.js scripts/test-pool-node.js",
     "test:pool-scopehash": "node scripts/build-compiler.js node && node --import ./scripts/register-kit.js scripts/test-pool-scopehash.js",
+    "test:crypto-shim": "node scripts/test-crypto-shim.js",
     "test:pool-hardening": "node scripts/build-compiler.js node && node scripts/test-pool-hardening.js",
     "test:pool-toolchain-death": "node scripts/build-compiler.js node && node scripts/test-pool-toolchain-death.js",
     "test:pool-worker-hardening": "node scripts/test-pool-worker-hardening.js",

package/scripts/build-compiler.js

@@ -121,6 +121,8 @@ if (MODE === 'node') {
     'node:url': shim('url.js'),
     'url': shim('url.js'),
     'node:worker_threads': shim('worker_threads.js'),
+    'node:crypto': shim('crypto.js'),
+    'crypto': shim('crypto.js'),
     'node:path': 'path-browserify',
     'path': 'path-browserify',
     'node:events': 'events',

package/scripts/test-crypto-shim.js

@@ -0,0 +1,58 @@
+// The browser build has no node:crypto, so src/shims/crypto.js provides a synchronous
+// SHA-256 to back @dimina/compiler's scope-id `createHash('sha256').update(path)
+// .digest().readBigUInt64BE(0)`. This asserts the shim is byte-identical to node:crypto
+// on every input the compiler can feed it — if they ever diverge, browser-compiled scope
+// ids would silently disagree with node-compiled ones.
+import nodeCrypto from 'node:crypto'
+import { createHash as shimCreateHash } from '../src/shims/crypto.js'
+
+const SAMPLES = [
+  'pages/index/index',
+  'components/foo/foo',
+  '/components/c16wtkpz/index',
+  '/components/c1v8pxjl/index',
+  '',
+  'a',
+  'app.json',
+  '中文/页面/path',
+  'pages/very/deeply/nested/component/index',
+  'x'.repeat(1),
+  'x'.repeat(55),
+  'x'.repeat(56),
+  'x'.repeat(64),
+  'x'.repeat(120),
+  'x'.repeat(1000),
+  // Varied bytes across block boundaries — a constant byte exercises the sha256
+  // message schedule (w[t] recurrence) weakly; these would catch a w[] indexing typo
+  // that repeated-byte inputs mask. Lengths deliberately straddle 55/56/64/65.
+  Array.from({ length: 65 }, (_, i) => String.fromCharCode(33 + (i * 7) % 90)).join(''),
+  Array.from({ length: 200 }, (_, i) => `seg${(i * 31) % 97}/`).join(''),
+  'pages/index/index'.split('').reverse().join('') + '/深/x'.repeat(20),
+]
+
+let failed = 0
+const fail = (m) => { failed++; console.error(`❌ ${m}`) }
+
+for (const p of SAMPLES) {
+  const shimHex = shimCreateHash('sha256').update(p).digest().toString('hex')
+  const nodeHex = nodeCrypto.createHash('sha256').update(p).digest('hex')
+  const shimId = shimCreateHash('sha256').update(p).digest().readBigUInt64BE(0).toString(36)
+  const nodeId = nodeCrypto.createHash('sha256').update(p).digest().readBigUInt64BE(0).toString(36)
+  if (shimHex !== nodeHex) fail(`hex mismatch for ${JSON.stringify(p.slice(0, 24))}: shim ${shimHex} != node ${nodeHex}`)
+  else if (shimId !== nodeId) fail(`scope-id mismatch for ${JSON.stringify(p.slice(0, 24))}: shim ${shimId} != node ${nodeId}`)
+}
+
+// Chained updates must equal a single concatenated update (the compiler only calls
+// update once today, but the shim promises standard incremental semantics).
+const chained = shimCreateHash('sha256').update('pages/').update('index/').update('index').digest().toString('hex')
+const oneShot = nodeCrypto.createHash('sha256').update('pages/index/index').digest('hex')
+if (chained !== oneShot) fail(`chained update() != single update(): ${chained} != ${oneShot}`)
+
+// Only sha256 is implemented — anything else must fail loudly, not silently mis-hash.
+try {
+  shimCreateHash('md5')
+  fail('createHash("md5") should throw (shim implements sha256 only)')
+} catch { /* expected */ }
+
+console.log(failed ? `\n❌ FAIL (${failed})` : `\n✅ PASS: crypto shim === node:crypto on ${SAMPLES.length} samples + chained + guard`)
+process.exit(failed ? 1 : 0)

package/scripts/test-pool-scopehash.js

@@ -1,18 +1,19 @@
 // Content-level scope-hash consistency check for the stage-parallel pool.
 //
 // The pool's structural-equivalence tests (test:pool-node) only compare file
-// NAME/length multisets, so they cannot see whether the `data-v-XXXXX` scope
-// hashes baked into the CSS (`[data-v-X]` selectors) actually match the ones
-// baked into the compiled render templates (`.js`, `scopeId: data-v-X`). If the
-// view stage and the style stage allocate ids in DIFFERENT realms, their hashes
-// diverge and every WXSS rule targets a selector that never appears in the DOM —
-// styles silently stop working while the file lists still match.
+// NAME/length multisets, so they cannot see whether the `data-v-<id>` scope hashes
+// baked into the CSS (`[data-v-<id>]` selectors) actually match the ones baked into
+// the compiled render templates (`id:"<id>"`). Scope ids are a deterministic
+// hash(path) (dimina utils.js), so stages compiling in separate realms derive
+// identical ids; were the id ever per-realm state (a random uuid), the view and style
+// stages would diverge and every WXSS rule would target a selector that never renders.
 //
-// This script models the browser pool (src/pool.js + src/stage-worker.js) in
-// Node: each stage compiles in its OWN fresh memfs, exactly as a separate Web
-// Worker realm would. It runs the OLD per-worker-setup path and the FIXED
-// shared-setup path and asserts, at the content level, that every scope hash
-// used in CSS also appears in the render output.
+// This script models the browser pool (src/pool.js + src/stage-worker.js) in Node:
+// each stage compiles in its OWN fresh memfs, exactly as a separate Web Worker realm
+// would. It asserts, at the content level, that every scope hash used in CSS also
+// appears in the render output — for per-stage independent setup (MODEL A, which
+// deterministic ids keep consistent with no broadcast), the shared-setup broadcast
+// de-dup path (MODEL B), and the real pool orchestration (MODEL C).
 import { readdirSync, readFileSync, statSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import path from 'node:path'
@@ -58,10 +59,10 @@ const STAGES = ['logic', 'view', 'style']
 const freshFs = () => createFsFromVolume(Volume.fromJSON(seed, workPath))
 const clean = (m) => { for (const k of Object.keys(m)) if (m[k] == null) delete m[k]; return m }
 
-// CSS carries the scope hash as `[data-v-XXXXX]`; the compiled render carries
-// the SAME 5-char id bare in each `Module({ …, id:"XXXXX", … })` (the runtime
-// prepends `data-v-`). Extract each with its own pattern so we compare the
-// cross-file linkage the runtime actually relies on.
+// CSS carries the scope hash as `[data-v-<id>]`; the compiled render carries the SAME
+// id bare in each `Module({ …, id:"<id>", … })` (the runtime prepends `data-v-`).
+// Extract each with its own pattern so we compare the cross-file linkage the runtime
+// actually relies on.
 function hashesIn(files, pred, re) {
   const set = new Set()
   for (const k of Object.keys(files)) {
@@ -74,8 +75,11 @@ function hashesIn(files, pred, re) {
   }
   return set
 }
-const CSS_RE = /data-v-([a-z0-9]{5})/g
-const RENDER_RE = /\bid:\s*["']([a-z0-9]{5})["']/g
+// `{5,}` (not a fixed width): the scope id is a base36 hash(path) (~13 chars today).
+// Keeping an open lower bound of 5 still matches a regressed random 5-char id, so a
+// revert to per-realm random ids makes MODEL A orphan again instead of matching nothing.
+const CSS_RE = /data-v-([a-z0-9]{5,})/g
+const RENDER_RE = /\bid:\s*["']([a-z0-9]{5,})["']/g
 const isCss = (k) => k.endsWith('.css')
 const isRender = (k) => k.endsWith('.js') && k !== 'main/logic.js' && !k.endsWith('/logic.js')
 
@@ -93,7 +97,9 @@ function report(label, files) {
   return { css, js, orphanCss, matched }
 }
 
-// --- MODEL A: OLD browser pool — each stage runs setupCompile in its own realm ---
+// --- MODEL A: each stage runs setupCompile in its OWN realm, no broadcast ---
+// The direct regression guard: deterministic hash(path) ids must keep independent
+// realms consistent. A revert to per-realm random ids surfaces here as orphan CSS.
 async function buildPerStageSetup() {
   const merged = {}
   for (const stage of STAGES) {
@@ -106,11 +112,11 @@ async function buildPerStageSetup() {
   return merged
 }
 
-// --- MODEL B: FIXED pool — setup ONCE, broadcast the bundle across stage realms ---
-// This models the fixed browser pool exactly (mirrors the working Node disk pool):
-// one realm runs setupCompile (id allocation + npm/app-config scaffold); the shared
-// `{ pages, storeInfo }` bundle is broadcast to every stage worker, which only runs
-// compileStage against it. Setup scaffold (app-config.json + npm) is merged in.
+// --- MODEL B: setup ONCE, broadcast the bundle across stage realms (de-dup path) ---
+// Models the pool's broadcast path (mirrors the Node disk pool): one realm runs
+// setupCompile (npm/app-config scaffold + { pages, storeInfo }); that bundle is
+// broadcast to every stage worker, which only runs compileStage against it — so the
+// heavy setup runs once. Setup scaffold (app-config.json + npm) is merged in.
 async function buildSharedSetup() {
   realm()
   const setupFs = freshFs()
@@ -186,10 +192,10 @@ const inline = clean((await compileMiniApp({ fs: freshFs(), workPath })).files)
 const gt = report('inline (single realm, ground truth)', inline)
 
 const modelA = await buildPerStageSetup()
-const rA = report('MODEL A — per-stage independent setup (current browser pool)', modelA)
+const rA = report('MODEL A — per-stage independent setup (no broadcast)', modelA)
 
 const modelB = await buildSharedSetup()
-const rB = report('MODEL B — shared setup bundle (fix)', modelB)
+const rB = report('MODEL B — shared setup broadcast (de-dup path)', modelB)
 
 const poolRes = await buildViaPool()
 const modelC = clean(poolRes.files)
@@ -203,25 +209,26 @@ const pass = (m) => console.log(`✅ ${m}`)
 if (gt.orphanCss.length) fail(`ground truth has ${gt.orphanCss.length} orphan CSS hashes — test harness bug`)
 else pass('ground truth: every CSS scope hash appears in the render output')
 
-// Model A is EXPECTED to be broken — assert it reproduces the bug.
-if (rA.orphanCss.length > 0 && rA.matched.length === 0) {
-  pass(`REPRODUCED: per-stage setup yields ${rA.orphanCss.length} orphan CSS hashes, 0 matched — WXSS fully broken`)
-} else if (rA.orphanCss.length > 0) {
-  pass(`REPRODUCED (partial): per-stage setup yields ${rA.orphanCss.length} orphan CSS hashes`)
+// With deterministic hash(path) scope ids, per-stage INDEPENDENT setup (MODEL A) must
+// stay scope-consistent too: separate realms derive the SAME id from the same path with
+// no broadcast. This is the guarantee stable ids buy, and the direct regression guard —
+// a revert to per-realm random ids would make MODEL A orphan again.
+if (rA.orphanCss.length === 0 && rA.css.size === gt.css.size) {
+  pass(`STABLE ID: per-stage independent setup yields 0 orphan CSS hashes, ${rA.matched.length} matched (== ground truth ${gt.css.size}) — deterministic hash(path) keeps realms consistent without a broadcast`)
 } else {
-  fail('per-stage setup did NOT reproduce the mismatch (bug model invalid)')
+  fail(`per-stage independent setup has ${rA.orphanCss.length} orphan CSS hashes (css=${rA.css.size} gt=${gt.css.size}) — scope id is not a deterministic function of path across realms`)
 }
 
 // Model B (fix) must be fully consistent AND structurally complete.
 if (rB.orphanCss.length === 0 && rB.css.size === gt.css.size) {
-  pass(`FIX VERIFIED: shared setup yields 0 orphan CSS hashes, ${rB.matched.length} matched (== ground truth ${gt.css.size})`)
+  pass(`BROADCAST PATH: shared setup yields 0 orphan CSS hashes, ${rB.matched.length} matched (== ground truth ${gt.css.size})`)
 } else {
   fail(`shared setup still has ${rB.orphanCss.length} orphan CSS hashes (css=${rB.css.size} gt=${gt.css.size})`)
 }
 // Both models must emit the SAME file set as the single-realm ground truth — this is
 // what the structural test already checks, and why it stays green while WXSS is broken.
 if (fileSet(modelA) !== fileSet(inline)) fail('MODEL A file set differs from ground truth (unexpected)')
-else pass('MODEL A file set == ground truth (this is exactly why the name/length structural test passes while WXSS is broken)')
+else pass('MODEL A file set == ground truth (the name/length structural test can only see this, not the scope-hash linkage this content check verifies)')
 if (fileSet(modelB) !== fileSet(inline)) fail('MODEL B (fix) file set differs from ground truth')
 else pass('MODEL B (fix) file set == ground truth')
 

package/src/pool.js

@@ -162,14 +162,15 @@ export function createCompilerPool(options = {}) {
   async function runAttempt(files, workPath, options) {
     await settleAll(workers.map(ensureWarm))
 
-    // Setup step — one worker runs setup ONCE: it allocates the scope-hash ids
-    // (page + component data-v-XXXXX) and builds miniprogram_npm/app-config.json.
-    // Broadcasting this single bundle to every stage is REQUIRED for correctness:
-    // each stage runs in its own realm, and if each ran its own setup it would roll
-    // independent random uuids, so the CSS `[data-v-X]` selectors would never match
-    // the render `Module id` and every WXSS rule would target nothing (regression
-    // guarded by scripts/test-pool-scopehash.js). This mirrors the Node disk pool,
-    // which likewise sets up once and fans the same { pages, storeInfo } out.
+    // Setup step — one worker runs setup ONCE: it parses config, builds
+    // miniprogram_npm + app-config.json (the npm build can invoke the wasm toolchain)
+    // and produces the scaffold. The resulting { pages, storeInfo } bundle is
+    // broadcast to every stage so this heavy work runs once instead of per stage.
+    // Scope ids are a deterministic hash(path) (dimina utils.js), so each stage would
+    // derive identical `data-v-<id>` even from its own setup — the broadcast is a
+    // de-dup optimization, NOT a scope-correctness requirement (scripts/test-pool-scopehash.js
+    // asserts per-stage independent setup stays scope-consistent). Mirrors the Node
+    // disk pool, which likewise sets up once and fans the same { pages, storeInfo } out.
     // `options` (e.g. { fileTypes }) only needs to reach THIS setup call: dmcc's
     // storeInfo() bakes the normalized dialect into the returned storeInfo object
     // (dimina/fe/packages/compiler/src/env.js:106-120), which rides inside `bundle`

package/src/shims/crypto.js

@@ -0,0 +1,101 @@
+// node:crypto shim for the browser build. @dimina/compiler derives its CSS scope id
+// via `createHash('sha256').update(path).digest().readBigUInt64BE(0)` (utils.js). The
+// browser has no node:crypto, and Web Crypto's `subtle.digest` is async — it cannot
+// back a synchronous `uuid()`. So this provides a self-contained synchronous SHA-256.
+// Only the sha256 + digest()->Buffer path the compiler actually uses is implemented.
+import { Buffer } from 'buffer'
+
+const K = new Uint32Array([
+  0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5, 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
+  0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3, 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
+  0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC, 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
+  0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7, 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
+  0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13, 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
+  0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3, 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
+  0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5, 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
+  0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208, 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2,
+])
+
+function rotr(x, n) {
+  return (x >>> n) | (x << (32 - n))
+}
+
+// SHA-256 over a Uint8Array, returning the 32-byte digest as a Uint8Array.
+function sha256(msg) {
+  let h0 = 0x6A09E667, h1 = 0xBB67AE85, h2 = 0x3C6EF372, h3 = 0xA54FF53A
+  let h4 = 0x510E527F, h5 = 0x9B05688C, h6 = 0x1F83D9AB, h7 = 0x5BE0CD19
+
+  const l = msg.length
+  const bitLen = l * 8
+  // pad: 0x80, then zeros so length ≡ 56 (mod 64), then 64-bit big-endian bit length.
+  const total = (((l + 8) >> 6) + 1) << 6
+  const buf = new Uint8Array(total)
+  buf.set(msg)
+  buf[l] = 0x80
+  const dv = new DataView(buf.buffer)
+  dv.setUint32(total - 8, Math.floor(bitLen / 0x100000000), false)
+  dv.setUint32(total - 4, bitLen >>> 0, false)
+
+  const w = new Uint32Array(64)
+  for (let i = 0; i < total; i += 64) {
+    for (let t = 0; t < 16; t++) w[t] = dv.getUint32(i + t * 4, false)
+    for (let t = 16; t < 64; t++) {
+      const s0 = rotr(w[t - 15], 7) ^ rotr(w[t - 15], 18) ^ (w[t - 15] >>> 3)
+      const s1 = rotr(w[t - 2], 17) ^ rotr(w[t - 2], 19) ^ (w[t - 2] >>> 10)
+      w[t] = (w[t - 16] + s0 + w[t - 7] + s1) >>> 0
+    }
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7
+    for (let t = 0; t < 64; t++) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)
+      const ch = (e & f) ^ (~e & g)
+      const t1 = (h + S1 + ch + K[t] + w[t]) >>> 0
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)
+      const maj = (a & b) ^ (a & c) ^ (b & c)
+      const t2 = (S0 + maj) >>> 0
+      h = g; g = f; f = e; e = (d + t1) >>> 0; d = c; c = b; b = a; a = (t1 + t2) >>> 0
+    }
+    h0 = (h0 + a) >>> 0; h1 = (h1 + b) >>> 0; h2 = (h2 + c) >>> 0; h3 = (h3 + d) >>> 0
+    h4 = (h4 + e) >>> 0; h5 = (h5 + f) >>> 0; h6 = (h6 + g) >>> 0; h7 = (h7 + h) >>> 0
+  }
+
+  const out = new Uint8Array(32)
+  const odv = new DataView(out.buffer)
+  const hs = [h0, h1, h2, h3, h4, h5, h6, h7]
+  for (let i = 0; i < 8; i++) odv.setUint32(i * 4, hs[i], false)
+  return out
+}
+
+class Hash {
+  constructor() {
+    this._chunks = []
+  }
+
+  // Accepts a string (UTF-8 encoded, matching node's default) or raw bytes
+  // (Uint8Array/Buffer, copied). No inputEncoding form (`update(x, 'hex')`) — the
+  // compiler only ever hashes a path string, and silently accepting an encoding we
+  // ignore would diverge from node:crypto.
+  update(data) {
+    const bytes = typeof data === 'string' ? new TextEncoder().encode(data) : new Uint8Array(data)
+    this._chunks.push(bytes)
+    return this
+  }
+
+  digest() {
+    let len = 0
+    for (const c of this._chunks) len += c.length
+    const all = new Uint8Array(len)
+    let off = 0
+    for (const c of this._chunks) { all.set(c, off); off += c.length }
+    // Return a Buffer so callers can use Buffer methods (readBigUInt64BE) on the digest.
+    return Buffer.from(sha256(all))
+  }
+}
+
+export function createHash(algorithm) {
+  if (algorithm !== 'sha256') {
+    throw new Error(`[compiler] browser crypto shim only implements sha256 (got '${algorithm}')`)
+  }
+  return new Hash()
+}
+
+export default { createHash }

package/src/stage-worker.js

@@ -58,13 +58,13 @@ function freshFs(files, workPath) {
   return createFsFromVolume(Volume.fromJSON(files, workPath))
 }
 
-// Run setupCompile ONCE for a compile: parse config, allocate the scope-hash ids
-// (page + component `data-v-XXXXX`), scaffold app-config.json + miniprogram_npm.
-// Returns the SERIALIZABLE id bundle every stage worker must share, plus the
-// non-stage scaffold files. Sharing this one bundle across the per-stage realms is
-// what keeps the CSS `[data-v-X]` selectors and the render `Module id` in agreement:
-// if each stage ran its own setupCompile it would roll its own random uuids and every
-// WXSS rule would target a selector that never renders (see scripts/test-pool-scopehash.js).
+// Run setupCompile ONCE for a compile: parse config, build the scaffold
+// (app-config.json + miniprogram_npm), and collect the { pages, storeInfo } bundle.
+// Sharing this one bundle across the per-stage realms lets the heavy setup work (npm
+// build, config parse) run once instead of per stage. Scope ids are a deterministic
+// hash(path) (dimina utils.js), so the CSS `[data-v-<id>]` selectors and the render
+// `Module id` agree across stages no matter who runs setup — the shared bundle is a
+// de-dup optimization, not a scope-correctness requirement (see scripts/test-pool-scopehash.js).
 async function runSetup(files, workPath, options) {
   const fs = freshFs(files, workPath)
   resetCompilerState()
@@ -87,11 +87,12 @@ async function runSetup(files, workPath, options) {
 // stays correct across compiles. Stages write disjoint products; we return this
 // worker's subset and the pool unions them.
 //
-// With a `bundle` (from runSetup), the stage reuses the coordinator's shared ids
-// (mirroring the Node disk pool, which broadcasts the same { pages, storeInfo } to
-// every stage worker) instead of running its own setupCompile — the fix for the
-// cross-stage scope-hash mismatch. Stages read source from `workPath` and write
-// disjoint products; they never read the setup scaffold, so it is not seeded here.
+// With a `bundle` (from runSetup), the stage reuses the coordinator's { pages, storeInfo }
+// instead of re-running setupCompile — so the npm build / config parse happens once, not
+// per stage (mirroring the Node disk pool). Scope ids are a deterministic hash(path), so
+// reusing the bundle vs re-deriving would yield the same `data-v-<id>` either way. Stages
+// read source from `workPath` and write disjoint products; they never read the setup
+// scaffold, so it is not seeded here.
 // Without a bundle the worker stays self-contained (single-worker / legacy callers).
 // `options` (e.g. { fileTypes }) is only used on the no-bundle fallback path: with a
 // bundle, its storeInfo already carries the normalized dialect from the coordinator's