@lark-apaas/fullstack-cli 1.1.59-alpha.20260722071909 → 1.1.59-alpha.20260722165429

package/dist/index.js

@@ -8261,6 +8261,57 @@ function classTransformerStorageResolver(projectRoot) {
     }
   };
 }
+function projectUsesNestjsDevtools(projectRoot) {
+  const distRoot = path25.join(projectRoot, "dist");
+  if (!fs29.existsSync(distRoot)) return false;
+  const pending = [distRoot];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) continue;
+    for (const entry of fs29.readdirSync(current, { withFileTypes: true })) {
+      const entryPath = path25.join(current, entry.name);
+      if (entry.isDirectory()) {
+        pending.push(entryPath);
+      } else if (entry.isFile() && /\.[cm]?js$/.test(entry.name)) {
+        const source = fs29.readFileSync(entryPath, "utf8");
+        if (source.includes("@lark-apaas/fullstack-nestjs-core") && /\bDevTools(?:V2)?Module\b/.test(source)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function previewNestjsRuntimeEntryPlugin(projectRoot) {
+  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
+  let runtimeEntry;
+  if (!projectUsesNestjsDevtools(projectRoot)) {
+    try {
+      runtimeEntry = projectRequire.resolve(
+        "@lark-apaas/fullstack-nestjs-core/runtime"
+      );
+    } catch {
+      runtimeEntry = void 0;
+    }
+  }
+  let runtimeEntryUsed = false;
+  return {
+    used: () => runtimeEntryUsed,
+    plugin: {
+      name: "preview-nestjs-runtime-entry",
+      setup(esbuild) {
+        esbuild.onResolve(
+          { filter: /^@lark-apaas\/fullstack-nestjs-core$/ },
+          () => {
+            if (!runtimeEntry) return void 0;
+            runtimeEntryUsed = true;
+            return { path: runtimeEntry };
+          }
+        );
+      }
+    }
+  };
+}
 function optionalDependencyStubPlugin() {
   const stubbedDependencies = /* @__PURE__ */ new Set();
   const escapedNames = OPTIONAL_DEPENDENCY_STUBS.map(
@@ -8523,6 +8574,7 @@ async function buildPreviewServerArtifact(options) {
     );
     fs29.writeFileSync(bootstrapPath, generateBootstrap(entryPath, plugins));
     const optionalDependencies = optionalDependencyStubPlugin();
+    const nestjsRuntimeEntry = previewNestjsRuntimeEntryPlugin(projectRoot);
     const buildOptions = {
       absWorkingDir: projectRoot,
       entryPoints: [bootstrapPath],
@@ -8538,6 +8590,7 @@ async function buildPreviewServerArtifact(options) {
       metafile: true,
       logLevel: "silent",
       plugins: [
+        nestjsRuntimeEntry.plugin,
         classTransformerStorageResolver(projectRoot),
         optionalDependencies.plugin
       ]
@@ -8574,6 +8627,7 @@ async function buildPreviewServerArtifact(options) {
       closureStatus,
       closureRisks,
       stubbedOptionalDependencies,
+      nestjsRuntimeEntryUsed: nestjsRuntimeEntry.used(),
       runtimeProbeStatus: "not-run",
       consumable: false,
       elapsedMs: Date.now() - startedAt
@@ -8623,7 +8677,7 @@ async function buildPreviewServerArtifact(options) {
 }
 
 // src/commands/preview-artifact/producer.ts
-import * as crypto2 from "crypto";
+import * as crypto3 from "crypto";
 import * as fs34 from "fs";
 import * as path30 from "path";
 import { spawnSync as spawnSync8 } from "child_process";
@@ -8929,6 +8983,10 @@ function rejectSymlinks(root) {
     }
   }
 }
+function inspectClientArchive(archivePath) {
+  archiveEntries(archivePath);
+  rejectArchivedSymlinks(archivePath);
+}
 function isPathInside(parent, candidate) {
   const relative5 = path27.relative(parent, candidate);
   return relative5 !== "" && relative5 !== ".." && !relative5.startsWith(`..${path27.sep}`) && !path27.isAbsolute(relative5);
@@ -9004,8 +9062,7 @@ function extractClientArchive(archivePath, destination) {
   if (fs31.existsSync(destination)) {
     throw new Error("client archive destination must not already exist");
   }
-  archiveEntries(archivePath);
-  rejectArchivedSymlinks(archivePath);
+  inspectClientArchive(archivePath);
   fs31.mkdirSync(destination, { recursive: true });
   try {
     const extraction = spawnSync7(
@@ -9024,6 +9081,40 @@ function extractClientArchive(archivePath, destination) {
     throw error;
   }
 }
+async function extractInspectedClientArchive(archivePath, destination) {
+  if (fs31.existsSync(destination)) {
+    throw new Error("client archive destination must not already exist");
+  }
+  fs31.mkdirSync(destination, { recursive: true });
+  try {
+    await new Promise((resolve9, reject) => {
+      const extraction = spawn2(
+        "unzip",
+        ["-q", archivePath, "-d", destination],
+        { stdio: ["ignore", "ignore", "pipe"] }
+      );
+      let stderr = "";
+      extraction.stderr?.setEncoding("utf8");
+      extraction.stderr?.on("data", (chunk) => {
+        stderr = `${stderr}${String(chunk)}`.slice(-8 * 1024);
+      });
+      extraction.once("error", reject);
+      extraction.once("close", (code) => {
+        if (code === 0) resolve9();
+        else
+          reject(
+            new Error(
+              `client archive extraction failed: ${stderr.trim() || `exit ${code ?? "unknown"}`}`
+            )
+          );
+      });
+    });
+    rejectSymlinks(destination);
+  } catch (error) {
+    fs31.rmSync(destination, { recursive: true, force: true });
+    throw error;
+  }
+}
 async function fetchUntil(url, timeoutAt) {
   while (Date.now() < timeoutAt) {
     try {
@@ -9200,6 +9291,7 @@ function previewArtifactRuntimeEnvironment(environment) {
 }
 
 // src/commands/preview-artifact/store.ts
+import * as crypto2 from "crypto";
 import * as fs33 from "fs";
 import * as path29 from "path";
 var GENERATION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -9261,7 +9353,7 @@ function validateRegularDirectory(directoryPath, label) {
     ];
   }
 }
-function validateGeneration(generationDir, runtime) {
+function validateGeneration(generationDir, runtime, verifyPayloads = true) {
   const reasons = validateRegularDirectory(
     generationDir,
     "generation directory"
@@ -9301,19 +9393,29 @@ function validateGeneration(generationDir, runtime) {
   if (!/^[a-f0-9]{64}$/.test(manifest.buildEnvironmentSha256)) {
     reasons.push("build environment identity is invalid");
   }
-  const serverPath = path29.join(generationDir, "server.bundle.cjs");
-  const clientPath = path29.join(generationDir, "client.zip");
-  try {
-    if (sha256File(serverPath) !== manifest.files.server.sha256) {
-      reasons.push("server.bundle.cjs hash does not match manifest");
+  for (const [label, identity, expectedPath] of [
+    ["server", manifest.files?.server, "server.bundle.cjs"],
+    ["client", manifest.files?.client, "client.zip"]
+  ]) {
+    if (!identity || identity.path !== expectedPath || !Number.isSafeInteger(identity.bytes) || identity.bytes < 0 || !/^[a-f0-9]{64}$/.test(identity.sha256)) {
+      reasons.push(`${label} file identity is invalid`);
     }
-    if (sha256File(clientPath) !== manifest.files.client.sha256) {
-      reasons.push("client.zip hash does not match manifest");
+  }
+  if (verifyPayloads && manifest.files?.server && manifest.files?.client) {
+    const serverPath = path29.join(generationDir, "server.bundle.cjs");
+    const clientPath = path29.join(generationDir, "client.zip");
+    try {
+      if (sha256File(serverPath) !== manifest.files.server.sha256) {
+        reasons.push("server.bundle.cjs hash does not match manifest");
+      }
+      if (sha256File(clientPath) !== manifest.files.client.sha256) {
+        reasons.push("client.zip hash does not match manifest");
+      }
+    } catch (error) {
+      reasons.push(
+        `generation files are unavailable: ${error instanceof Error ? error.message : String(error)}`
+      );
     }
-  } catch (error) {
-    reasons.push(
-      `generation files are unavailable: ${error instanceof Error ? error.message : String(error)}`
-    );
   }
   if (probe.serverSha256 !== manifest.files.server.sha256 || probe.clientSha256 !== manifest.files.client.sha256) {
     reasons.push("probe file identity does not match manifest");
@@ -9374,7 +9476,7 @@ function publishPreviewArtifactGeneration(options) {
     };
   }
 }
-function resolveCurrentPreviewArtifact(options) {
+function resolveCurrentPreviewArtifactMetadata(options) {
   const storeRoot = path29.resolve(options.storeRoot);
   let pointer;
   try {
@@ -9402,11 +9504,15 @@ function resolveCurrentPreviewArtifact(options) {
     "generations",
     pointer.generationId
   );
-  const validation = validateGeneration(generationDir, {
-    nodeMajor,
-    platform: options.platform,
-    arch: options.arch
-  });
+  const validation = validateGeneration(
+    generationDir,
+    {
+      nodeMajor,
+      platform: options.platform,
+      arch: options.arch
+    },
+    false
+  );
   if (!validation.manifest || validation.reasons.length > 0) {
     return { resolved: false, reasons: validation.reasons };
   }
@@ -9429,11 +9535,85 @@ function resolveCurrentPreviewArtifact(options) {
     manifest: validation.manifest
   };
 }
+async function materializeVerifiedPreviewArtifactFile(options) {
+  const source = path29.resolve(options.source);
+  const destination = path29.resolve(options.destination);
+  const temporary = `${destination}.${process.pid}.${Date.now()}.tmp`;
+  fs33.mkdirSync(path29.dirname(destination), { recursive: true });
+  if (fs33.existsSync(destination)) {
+    throw new Error(
+      `materialization destination already exists: ${destination}`
+    );
+  }
+  const noFollow = fs33.constants.O_NOFOLLOW ?? 0;
+  let sourceHandle;
+  let destinationHandle;
+  try {
+    sourceHandle = await fs33.promises.open(
+      source,
+      fs33.constants.O_RDONLY | noFollow
+    );
+    const sourceStat = await sourceHandle.stat();
+    if (!sourceStat.isFile()) {
+      throw new Error(`${options.identity.path} is not a regular file`);
+    }
+    destinationHandle = await fs33.promises.open(
+      temporary,
+      fs33.constants.O_WRONLY | fs33.constants.O_CREAT | fs33.constants.O_EXCL,
+      384
+    );
+    const hash = crypto2.createHash("sha256");
+    const buffer = Buffer.allocUnsafe(256 * 1024);
+    let totalBytes = 0;
+    for (; ; ) {
+      const { bytesRead } = await sourceHandle.read(
+        buffer,
+        0,
+        buffer.length,
+        null
+      );
+      if (bytesRead === 0) break;
+      hash.update(buffer.subarray(0, bytesRead));
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await destinationHandle.write(
+          buffer,
+          written,
+          bytesRead - written,
+          null
+        );
+        if (result.bytesWritten <= 0) {
+          throw new Error(
+            `${options.identity.path} materialization short write`
+          );
+        }
+        written += result.bytesWritten;
+      }
+      totalBytes += bytesRead;
+    }
+    const sha256 = hash.digest("hex");
+    if (sha256 !== options.identity.sha256) {
+      throw new Error(`${options.identity.path} hash does not match manifest`);
+    }
+    if (totalBytes !== options.identity.bytes) {
+      throw new Error(`${options.identity.path} bytes do not match manifest`);
+    }
+    await destinationHandle.sync();
+    await destinationHandle.close();
+    destinationHandle = void 0;
+    await fs33.promises.rename(temporary, destination);
+    return { bytes: totalBytes, sha256 };
+  } finally {
+    await destinationHandle?.close().catch(() => void 0);
+    await sourceHandle?.close().catch(() => void 0);
+    await fs33.promises.rm(temporary, { force: true }).catch(() => void 0);
+  }
+}
 
 // src/commands/preview-artifact/producer.ts
 function defaultGenerationId() {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:.TZ]/g, "");
-  return `${timestamp}-${crypto2.randomBytes(5).toString("hex")}`;
+  return `${timestamp}-${crypto3.randomBytes(5).toString("hex")}`;
 }
 function defaultPreviewBundleBuildCommands(projectRootInput) {
   const projectRoot = path30.resolve(projectRootInput);
@@ -9957,7 +10137,7 @@ async function startPreviewArtifactRuntime(options) {
   const resolved = measure(
     timings,
     "metadata_validate",
-    () => resolveCurrentPreviewArtifact({
+    () => resolveCurrentPreviewArtifactMetadata({
       storeRoot: options.storeRoot,
       nodeVersion: process.version,
       platform: process.platform,
@@ -9993,53 +10173,85 @@ async function startPreviewArtifactRuntime(options) {
     );
     const runtimeBundle = path32.join(runtimeDir, "server.bundle.cjs");
     const serverSource = path32.join(resolved.generationDir, "server.bundle.cjs");
-    measure(
-      timings,
-      "server_materialize",
-      () => fs36.copyFileSync(serverSource, runtimeBundle),
-      { bytes: resolved.manifest.files.server.bytes }
-    );
+    const clientArchive = path32.join(runtimeDir, "client.zip");
+    const clientSource = path32.join(resolved.generationDir, "client.zip");
     const clientRoot = path32.join(runtimeDir, "dist", "client");
-    measure(
-      timings,
-      "client_archive_inspect_extract",
-      () => extractClientArchive(
-        path32.join(resolved.generationDir, "client.zip"),
-        clientRoot
-      ),
-      { bytes: resolved.manifest.files.client.bytes }
-    );
-    const cachedServerPort = options.cachedServerPort === 0 ? await reservePort2() : options.cachedServerPort;
-    cachedRuntime = spawn3(process.execPath, [runtimeBundle], {
-      cwd: runtimeDir,
-      detached: true,
-      stdio: "ignore",
-      env: {
-        ...process.env,
-        ...previewArtifactRuntimeEnvironment(options.environment),
-        SERVER_PORT: String(cachedServerPort)
-      }
-    });
-    const cachedOrigin = `http://127.0.0.1:${cachedServerPort}`;
-    await measureAsync(
-      timings,
-      "backend_spawn_to_business_ready",
-      () => waitForCachedRuntime(
-        cachedOrigin,
-        options.appBasePath,
-        options.businessApiPath,
-        options.startupTimeoutMs ?? 3e4,
-        cachedRuntime
-      )
-    );
-    const cachedAssetFiles = measure(
-      timings,
-      "asset_index",
-      () => collectCachedAssetFiles(clientRoot, options.appBasePath)
-    );
-    timings[timings.length - 1].fileCount = new Set(
-      cachedAssetFiles.values()
-    ).size;
+    const backendReady = (async () => {
+      await measureAsync(
+        timings,
+        "server_materialize",
+        () => materializeVerifiedPreviewArtifactFile({
+          source: serverSource,
+          destination: runtimeBundle,
+          identity: resolved.manifest.files.server
+        }),
+        { bytes: resolved.manifest.files.server.bytes }
+      );
+      const cachedServerPort2 = options.cachedServerPort === 0 ? await reservePort2() : options.cachedServerPort;
+      cachedRuntime = spawn3(process.execPath, [runtimeBundle], {
+        cwd: runtimeDir,
+        detached: true,
+        stdio: "ignore",
+        env: {
+          ...process.env,
+          ...previewArtifactRuntimeEnvironment(options.environment),
+          SERVER_PORT: String(cachedServerPort2)
+        }
+      });
+      const cachedOrigin = `http://127.0.0.1:${cachedServerPort2}`;
+      await measureAsync(
+        timings,
+        "backend_spawn_to_business_ready",
+        () => waitForCachedRuntime(
+          cachedOrigin,
+          options.appBasePath,
+          options.businessApiPath,
+          options.startupTimeoutMs ?? 3e4,
+          cachedRuntime
+        )
+      );
+      return cachedServerPort2;
+    })();
+    const assetsReady = (async () => {
+      await measureAsync(
+        timings,
+        "client_materialize",
+        () => materializeVerifiedPreviewArtifactFile({
+          source: clientSource,
+          destination: clientArchive,
+          identity: resolved.manifest.files.client
+        }),
+        { bytes: resolved.manifest.files.client.bytes }
+      );
+      measure(
+        timings,
+        "client_archive_inspect",
+        () => inspectClientArchive(clientArchive)
+      );
+      await measureAsync(
+        timings,
+        "client_extract",
+        () => extractInspectedClientArchive(clientArchive, clientRoot)
+      );
+      const cachedAssetFiles2 = measure(
+        timings,
+        "asset_index",
+        () => collectCachedAssetFiles(clientRoot, options.appBasePath)
+      );
+      timings[timings.length - 1].fileCount = new Set(
+        cachedAssetFiles2.values()
+      ).size;
+      fs36.rmSync(clientArchive, { force: true });
+      return cachedAssetFiles2;
+    })();
+    const [backendResult, assetsResult] = await Promise.allSettled([
+      backendReady,
+      assetsReady
+    ]);
+    if (assetsResult.status === "rejected") throw assetsResult.reason;
+    if (backendResult.status === "rejected") throw backendResult.reason;
+    const cachedServerPort = backendResult.value;
+    const cachedAssetFiles = assetsResult.value;
     switcher = createPreviewArtifactSwitcher({
       listenHost: options.listenHost,
       listenPort: options.listenPort,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/fullstack-cli",
-  "version": "1.1.59-alpha.20260722071909",
+  "version": "1.1.59-alpha.20260722165429",
   "description": "CLI tool for fullstack template management",
   "type": "module",
   "main": "dist/index.js",