@lark-apaas/fullstack-cli 1.1.59 → 1.1.61-alpha.20260818172555

package/dist/index.js

@@ -1,8 +1,7 @@
 // src/index.ts
-import fs29 from "fs";
-import path25 from "path";
+import fs35 from "fs";
+import path32 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import { config as dotenvConfig } from "dotenv";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -2554,6 +2553,20 @@ function buildDefaultRules(opts) {
       command: "fullstack-cli action-plugin init",
       overwrite: false
     },
+    // Cache generation keeps workspace source live and only snapshots the
+    // automatically traced Nest runtime dependencies.
+    {
+      type: "add-script",
+      name: "build:server-runtime-dependencies:from-dist",
+      command: "fullstack-cli build server-runtime-dependencies",
+      overwrite: true
+    },
+    {
+      type: "patch-script",
+      name: "build:cache:from-dist",
+      to: "npm run build:server-runtime-dependencies:from-dist && fullstack-cli build app-runtime-manifest --runtime-manifest-file ${MIAODA_PLATFORM_RUNTIME_MANIFEST:-/opt/miaoda/preview-runtime/runtime-manifest.json} && npm run build:vite-cache && fullstack-cli build cache-generation --runtime-manifest-file ${MIAODA_PLATFORM_RUNTIME_MANIFEST:-/opt/miaoda/preview-runtime/runtime-manifest.json}",
+      ifStartsWith: "npm run build:server-cache:from-dist"
+    },
     // 6. 替换 drizzle.config.ts（仅当文件存在时）
     {
       from: "templates/drizzle.config.ts",
@@ -2604,7 +2617,11 @@ function defaultProfile(opts) {
   return {
     sync: buildDefaultRules(opts),
     // 文件权限设置（所有 .sh 文件设置为可执行：'**/*.sh': 0o755）
-    permissions: {},
+    // Workspace / TOS restore may materialize scripts with 0644 even when the
+    // platform template tracks the executable bit. `npm run dev` executes
+    // scripts/dev.sh directly, so repairing the mode is part of sync's
+    // platform contract rather than an image-entrypoint side effect.
+    permissions: { "**/*.sh": 493 },
     activateGitHooks: true
   };
 }
@@ -3502,6 +3519,26 @@ function resolveGrayscaleVersions(_cwd, configJson) {
   return versions;
 }
 
+// src/utils/npm-child.ts
+function sanitizedNpmEnv(source = process.env) {
+  const env = { ...source };
+  for (const key of [
+    "FORCE_AUTHN_INNERAPI_DOMAIN",
+    "FORCE_AUTHN_ACCESS_SECRET",
+    "FORCE_AUTHN_ACCESS_KEY",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "BASH_ENV",
+    "ENV",
+    "NPM_CONFIG_IGNORE_SCRIPTS",
+    "npm_config_ignore_scripts"
+  ]) {
+    delete env[key];
+  }
+  env.npm_config_ignore_scripts = "true";
+  return env;
+}
+
 // src/commands/upgrade/deps/run.handler.ts
 function parseSemver(version) {
   const match = version.match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -3560,8 +3597,9 @@ function upgradePackages(packages, version, cwd) {
     packages.forEach((pkg2) => {
       const target = `${pkg2}@${version}`;
       console.log(`[fullstack-cli]   Installing ${target}...`);
-      const result = spawnSync4("npm", ["install", target], {
+      const result = spawnSync4("npm", ["install", target, "--ignore-scripts=true"], {
         cwd,
+        env: sanitizedNpmEnv(),
         stdio: "inherit"
       });
       if (result.error || result.status !== 0) {
@@ -3572,8 +3610,9 @@ function upgradePackages(packages, version, cwd) {
     console.log("[fullstack-cli] Upgrading to latest compatible versions...");
     packages.forEach((pkg2) => {
       console.log(`[fullstack-cli]   Updating ${pkg2}...`);
-      const result = spawnSync4("npm", ["update", pkg2], {
+      const result = spawnSync4("npm", ["update", pkg2, "--ignore-scripts=true"], {
         cwd,
+        env: sanitizedNpmEnv(),
         stdio: "inherit"
       });
       if (result.error || result.status !== 0) {
@@ -3633,8 +3672,9 @@ function installGrayscaleVersions(packages, grayscaleVersions, cwd, dryRun, mode
   }
   const targets = upgradePlan.map(({ pkg: pkg2, version }) => `${pkg2}@${version}`);
   console.log(`[fullstack-cli] Installing ${targets.join(" ")}...`);
-  const result = spawnSync4("npm", ["install", ...targets], {
+  const result = spawnSync4("npm", ["install", ...targets, "--ignore-scripts=true"], {
     cwd,
+    env: sanitizedNpmEnv(),
     stdio: "inherit"
   });
   if (result.error || result.status !== 0) {
@@ -3826,28 +3866,96 @@ var upgradeCommand = {
 
 // src/commands/action-plugin/utils.ts
 import fs13 from "fs";
+import os from "os";
+import path12 from "path";
+import { spawnSync as spawnSync6 } from "child_process";
+
+// src/commands/action-plugin/validation.ts
 import path11 from "path";
-import { spawnSync as spawnSync6, execSync as execSync2 } from "child_process";
+var SCOPED_PACKAGE_NAME = /^@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/;
+var REGISTRY_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+var PLUGIN_VERSION = /^(?:latest|[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?)$/;
+var PEER_DEP_RANGE = /^[0-9A-Za-z*^~<>=|.\-\s]+$/;
+function assertScopedPackageName(value, label = "package name") {
+  if (typeof value !== "string" || !SCOPED_PACKAGE_NAME.test(value)) {
+    throw new Error(`Invalid ${label}: ${String(value)}`);
+  }
+}
+function assertRegistryPackageName(value, label = "package name") {
+  if (typeof value !== "string" || !REGISTRY_PACKAGE_NAME.test(value)) {
+    throw new Error(`Invalid ${label}: ${String(value)}`);
+  }
+}
+function assertPluginVersion(value) {
+  if (typeof value !== "string" || !PLUGIN_VERSION.test(value)) {
+    throw new Error(`Invalid plugin version: ${String(value)}`);
+  }
+}
+function assertSafePeerDependencySpec(value) {
+  if (typeof value !== "string") {
+    throw new Error(`Invalid peer dependency spec: ${String(value)}`);
+  }
+  const spec = value.trim();
+  const lower = spec.toLowerCase();
+  if (spec.length === 0 || !PEER_DEP_RANGE.test(spec) || lower.startsWith("file:") || lower.startsWith("git") || lower.startsWith("http:") || lower.startsWith("https:") || lower.startsWith("npm:") || spec.includes("/") || spec.includes("\\")) {
+    throw new Error(`Invalid peer dependency spec: ${value}`);
+  }
+}
+function resolveContainedPath(root, ...segments) {
+  const resolvedRoot = path11.resolve(root);
+  const resolved = path11.resolve(resolvedRoot, ...segments);
+  if (!resolved.startsWith(`${resolvedRoot}${path11.sep}`)) {
+    throw new Error(`Resolved path escapes allowed root: ${resolved}`);
+  }
+  return resolved;
+}
+
+// src/commands/action-plugin/utils.ts
 function parsePluginName(input) {
-  const match = input.match(/^(@[^/]+\/[^@]+)(?:@(.+))?$/);
-  if (!match) {
+  if (typeof input !== "string") {
+    throw new Error(
+      `Invalid plugin name format: ${input}. Expected format: @scope/name or @scope/name@version`
+    );
+  }
+  const versionSeparator = input.lastIndexOf("@");
+  const hasVersion = versionSeparator > 0;
+  const name = hasVersion ? input.slice(0, versionSeparator) : input;
+  const version = hasVersion ? input.slice(versionSeparator + 1) : "latest";
+  try {
+    assertScopedPackageName(name, "plugin name");
+    assertPluginVersion(version);
+  } catch {
     throw new Error(
       `Invalid plugin name format: ${input}. Expected format: @scope/name or @scope/name@version`
     );
   }
   return {
-    name: match[1],
-    version: match[2] || "latest"
+    name,
+    version
   };
 }
 function getProjectRoot() {
   return process.cwd();
 }
+function assertRealDirectoryIfExists(directory, label) {
+  if (!fs13.existsSync(directory)) {
+    return;
+  }
+  const stat = fs13.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`${label} must be a real directory`);
+  }
+}
 function getPackageJsonPath() {
-  return path11.join(getProjectRoot(), "package.json");
+  return path12.join(getProjectRoot(), "package.json");
 }
 function getPluginPath(pluginName) {
-  return path11.join(getProjectRoot(), "node_modules", pluginName);
+  assertScopedPackageName(pluginName, "plugin name");
+  const nodeModulesPath = path12.resolve(getProjectRoot(), "node_modules");
+  const pluginPath = resolveContainedPath(nodeModulesPath, pluginName);
+  assertRealDirectoryIfExists(nodeModulesPath, "node_modules");
+  assertRealDirectoryIfExists(path12.dirname(pluginPath), "plugin scope directory");
+  return pluginPath;
 }
 function readPackageJson2() {
   const pkgPath = getPackageJsonPath();
@@ -3886,6 +3994,7 @@ function npmInstall(tgzPath) {
   console.log(`[action-plugin] Running npm install ${tgzPath}...`);
   const result = spawnSync6("npm", ["install", tgzPath, "--no-save", "--no-package-lock", "--ignore-scripts"], {
     cwd: getProjectRoot(),
+    env: sanitizedNpmEnv(),
     stdio: "inherit"
   });
   if (result.error) {
@@ -3896,7 +4005,7 @@ function npmInstall(tgzPath) {
   }
 }
 function getPackageVersion(pluginName) {
-  const pkgJsonPath = path11.join(getPluginPath(pluginName), "package.json");
+  const pkgJsonPath = path12.join(getPluginPath(pluginName), "package.json");
   if (!fs13.existsSync(pkgJsonPath)) {
     return null;
   }
@@ -3909,7 +4018,7 @@ function getPackageVersion(pluginName) {
   }
 }
 function readPluginPackageJson(pluginPath) {
-  const pkgJsonPath = path11.join(pluginPath, "package.json");
+  const pkgJsonPath = path12.join(pluginPath, "package.json");
   if (!fs13.existsSync(pkgJsonPath)) {
     return null;
   }
@@ -3921,29 +4030,39 @@ function readPluginPackageJson(pluginPath) {
   }
 }
 function extractTgzToNodeModules(tgzPath, pluginName) {
-  const nodeModulesPath = path11.join(getProjectRoot(), "node_modules");
-  const targetDir = path11.join(nodeModulesPath, pluginName);
-  const scopeDir = path11.dirname(targetDir);
+  assertScopedPackageName(pluginName, "plugin name");
+  const nodeModulesPath = path12.resolve(getProjectRoot(), "node_modules");
+  const targetDir = resolveContainedPath(nodeModulesPath, pluginName);
+  const scopeDir = path12.dirname(targetDir);
+  if (!fs13.existsSync(nodeModulesPath)) {
+    fs13.mkdirSync(nodeModulesPath, { recursive: true });
+  }
+  assertRealDirectoryIfExists(nodeModulesPath, "node_modules");
   if (!fs13.existsSync(scopeDir)) {
     fs13.mkdirSync(scopeDir, { recursive: true });
   }
+  assertRealDirectoryIfExists(scopeDir, "plugin scope directory");
   if (fs13.existsSync(targetDir)) {
     fs13.rmSync(targetDir, { recursive: true });
   }
-  const tempDir = path11.join(nodeModulesPath, ".cache", "fullstack-cli", "extract-temp");
-  if (fs13.existsSync(tempDir)) {
-    fs13.rmSync(tempDir, { recursive: true });
-  }
-  fs13.mkdirSync(tempDir, { recursive: true });
+  const tempDir = fs13.mkdtempSync(path12.join(os.tmpdir(), "fullstack-cli-extract-"));
   try {
-    execSync2(`tar -xzf "${tgzPath}" -C "${tempDir}"`, { stdio: "pipe" });
-    const extractedDir = path11.join(tempDir, "package");
+    const tarResult = spawnSync6("tar", ["-xzf", tgzPath, "-C", tempDir], {
+      stdio: "pipe"
+    });
+    if (tarResult.error) {
+      throw new Error(`Failed to extract plugin archive: ${tarResult.error.message}`);
+    }
+    if (tarResult.status !== 0) {
+      throw new Error(`Failed to extract plugin archive: tar exited with code ${tarResult.status}`);
+    }
+    const extractedDir = path12.join(tempDir, "package");
     if (fs13.existsSync(extractedDir)) {
       fs13.renameSync(extractedDir, targetDir);
     } else {
       const files = fs13.readdirSync(tempDir);
       if (files.length === 1) {
-        fs13.renameSync(path11.join(tempDir, files[0]), targetDir);
+        fs13.renameSync(path12.join(tempDir, files[0]), targetDir);
       } else {
         throw new Error("Unexpected tgz structure");
       }
@@ -3960,9 +4079,11 @@ function checkMissingPeerDeps(peerDeps) {
     return [];
   }
   const missing = [];
-  const nodeModulesPath = path11.join(getProjectRoot(), "node_modules");
+  const nodeModulesPath = path12.join(getProjectRoot(), "node_modules");
   for (const [depName, _version] of Object.entries(peerDeps)) {
-    const depPath = path11.join(nodeModulesPath, depName);
+    assertRegistryPackageName(depName, "peer dependency name");
+    assertSafePeerDependencySpec(_version);
+    const depPath = resolveContainedPath(nodeModulesPath, depName);
     if (!fs13.existsSync(depPath)) {
       missing.push(depName);
     }
@@ -3973,9 +4094,13 @@ function installMissingDeps(deps) {
   if (deps.length === 0) {
     return;
   }
+  for (const depName of deps) {
+    assertRegistryPackageName(depName, "peer dependency name");
+  }
   console.log(`[action-plugin] Installing missing dependencies: ${deps.join(", ")}`);
-  const result = spawnSync6("npm", ["install", ...deps, "--no-save", "--no-package-lock"], {
+  const result = spawnSync6("npm", ["install", ...deps, "--no-save", "--no-package-lock", "--ignore-scripts=true"], {
     cwd: getProjectRoot(),
+    env: sanitizedNpmEnv(),
     stdio: "inherit"
   });
   if (result.error) {
@@ -3986,6 +4111,7 @@ function installMissingDeps(deps) {
   }
 }
 function removePluginDirectory(pluginName) {
+  assertScopedPackageName(pluginName, "plugin name");
   const pluginPath = getPluginPath(pluginName);
   if (fs13.existsSync(pluginPath)) {
     fs13.rmSync(pluginPath, { recursive: true });
@@ -3996,9 +4122,12 @@ function removePluginDirectory(pluginName) {
 // src/commands/action-plugin/api-client.ts
 import { HttpClient as HttpClient2 } from "@lark-apaas/http-client";
 import fs14 from "fs";
-import path12 from "path";
+import path13 from "path";
 var PLUGIN_CACHE_DIR = "node_modules/.cache/fullstack-cli/plugins";
 async function getPluginVersions(keys, latestOnly = true) {
+  for (const key of keys) {
+    assertScopedPackageName(key, "plugin key");
+  }
   const client = getHttpClient();
   const response = await client.post(`/api/v1/studio/innerapi/plugins/-/versions/batch_get?keys=${keys.join(",")}&latest_only=${latestOnly}`);
   if (!response.ok || response.status !== 200) {
@@ -4012,6 +4141,8 @@ async function getPluginVersions(keys, latestOnly = true) {
   return result.data.pluginVersions;
 }
 async function getPluginVersion(pluginKey, requestedVersion) {
+  assertScopedPackageName(pluginKey, "plugin key");
+  assertPluginVersion(requestedVersion);
   const isLatest = requestedVersion === "latest";
   const versions = await getPluginVersions([pluginKey], isLatest);
   const pluginVersions = versions[pluginKey];
@@ -4019,6 +4150,7 @@ async function getPluginVersion(pluginKey, requestedVersion) {
     throw new Error(`Plugin not found: ${pluginKey}`);
   }
   if (isLatest) {
+    assertPluginVersion(pluginVersions[0].version);
     return pluginVersions[0];
   }
   const targetVersion = pluginVersions.find((v) => v.version === requestedVersion);
@@ -4030,10 +4162,8 @@ async function getPluginVersion(pluginKey, requestedVersion) {
   return targetVersion;
 }
 function parsePluginKey(key) {
-  const match = key.match(/^(@[^/]+)\/(.+)$/);
-  if (!match) {
-    throw new Error(`Invalid plugin key format: ${key}`);
-  }
+  assertScopedPackageName(key, "plugin key");
+  const match = key.match(/^(@[^/]+)\/([^/]+)$/);
   return { scope: match[1], name: match[2] };
 }
 async function downloadFromInner(pluginKey, version) {
@@ -4060,19 +4190,32 @@ async function downloadFromPublic(downloadURL) {
   return Buffer.from(arrayBuffer);
 }
 function getPluginCacheDir() {
-  return path12.join(process.cwd(), PLUGIN_CACHE_DIR);
+  return path13.join(process.cwd(), PLUGIN_CACHE_DIR);
 }
 function ensureCacheDir() {
   const cacheDir = getPluginCacheDir();
-  if (!fs14.existsSync(cacheDir)) {
-    fs14.mkdirSync(cacheDir, { recursive: true });
+  const projectRoot = path13.resolve(process.cwd());
+  const relative = path13.relative(projectRoot, cacheDir);
+  let current = projectRoot;
+  for (const segment of relative.split(path13.sep)) {
+    current = path13.join(current, segment);
+    if (fs14.existsSync(current)) {
+      const stat = fs14.lstatSync(current);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(`Plugin cache path must be a real directory: ${current}`);
+      }
+    } else {
+      fs14.mkdirSync(current);
+    }
   }
 }
 function getTempFilePath(pluginKey, version) {
+  assertScopedPackageName(pluginKey, "plugin key");
+  assertPluginVersion(version);
   ensureCacheDir();
   const safeKey = pluginKey.replace(/[/@]/g, "_");
   const filename = `${safeKey}@${version}.tgz`;
-  return path12.join(getPluginCacheDir(), filename);
+  return resolveContainedPath(getPluginCacheDir(), filename);
 }
 var MAX_RETRIES = 2;
 async function withRetry(operation, description, maxRetries = MAX_RETRIES) {
@@ -4120,10 +4263,12 @@ async function downloadPlugin(pluginKey, requestedVersion) {
 function cleanupTempFile(tgzPath) {
 }
 function getCachePath(pluginKey, version) {
+  assertScopedPackageName(pluginKey, "plugin key");
+  assertPluginVersion(version);
   ensureCacheDir();
   const safeKey = pluginKey.replace(/[/@]/g, "_");
   const filename = `${safeKey}@${version}.tgz`;
-  return path12.join(getPluginCacheDir(), filename);
+  return resolveContainedPath(getPluginCacheDir(), filename);
 }
 function hasCachedPlugin(pluginKey, version) {
   const cachePath = getCachePath(pluginKey, version);
@@ -4142,7 +4287,7 @@ function listCachedPlugins() {
     if (!match) continue;
     const [, rawName, version] = match;
     const name = rawName.replace(/^_/, "@").replace(/_/, "/");
-    const filePath = path12.join(cacheDir, file);
+    const filePath = path13.join(cacheDir, file);
     const stat = fs14.statSync(filePath);
     result.push({
       name,
@@ -4163,7 +4308,7 @@ function cleanAllCache() {
   let count = 0;
   for (const file of files) {
     if (file.endsWith(".tgz")) {
-      fs14.unlinkSync(path12.join(cacheDir, file));
+      fs14.unlinkSync(path13.join(cacheDir, file));
       count++;
     }
   }
@@ -4180,12 +4325,12 @@ function cleanPluginCache(pluginKey, version) {
   for (const file of files) {
     if (version) {
       if (file === `${safeKey}@${version}.tgz`) {
-        fs14.unlinkSync(path12.join(cacheDir, file));
+        fs14.unlinkSync(path13.join(cacheDir, file));
         count++;
       }
     } else {
       if (file.startsWith(`${safeKey}@`) && file.endsWith(".tgz")) {
-        fs14.unlinkSync(path12.join(cacheDir, file));
+        fs14.unlinkSync(path13.join(cacheDir, file));
         count++;
       }
     }
@@ -4196,6 +4341,8 @@ function cleanPluginCache(pluginKey, version) {
 // src/commands/action-plugin/init.handler.ts
 async function installOneForInit(name, version) {
   try {
+    assertScopedPackageName(name, "plugin name");
+    assertPluginVersion(version);
     const installedVersion = getPackageVersion(name);
     if (installedVersion === version) {
       return { name, version, success: true, skipped: true };
@@ -4614,24 +4761,24 @@ var actionPluginCommandGroup = {
 // src/commands/capability/utils.ts
 import fs15 from "fs";
 import { createRequire as createRequire2 } from "module";
-import path13 from "path";
+import path14 from "path";
 var CAPABILITIES_DIR = "server/capabilities";
 var SHARED_CAPABILITIES_DIR = "shared/capabilities";
 function getProjectRoot2() {
   return process.cwd();
 }
 function getCapabilitiesDir() {
-  const sharedDir = path13.join(getProjectRoot2(), SHARED_CAPABILITIES_DIR);
+  const sharedDir = path14.join(getProjectRoot2(), SHARED_CAPABILITIES_DIR);
   if (fs15.existsSync(sharedDir)) {
     return sharedDir;
   }
-  return path13.join(getProjectRoot2(), CAPABILITIES_DIR);
+  return path14.join(getProjectRoot2(), CAPABILITIES_DIR);
 }
 function getCapabilityPath(id) {
-  return path13.join(getCapabilitiesDir(), `${id}.json`);
+  return path14.join(getCapabilitiesDir(), `${id}.json`);
 }
 function getPluginManifestPath(pluginKey) {
-  return path13.join(getProjectRoot2(), "node_modules", pluginKey, "manifest.json");
+  return path14.join(getProjectRoot2(), "node_modules", pluginKey, "manifest.json");
 }
 function capabilitiesDirExists() {
   return fs15.existsSync(getCapabilitiesDir());
@@ -4698,7 +4845,7 @@ function hasValidParamsSchema(paramsSchema) {
 }
 async function loadPlugin(pluginKey) {
   try {
-    const userRequire = createRequire2(path13.join(getProjectRoot2(), "package.json"));
+    const userRequire = createRequire2(path14.join(getProjectRoot2(), "package.json"));
     const resolvedPath = userRequire.resolve(pluginKey);
     const pluginModule = await import(resolvedPath);
     const pluginPackage = pluginModule.default ?? pluginModule;
@@ -4862,8 +5009,8 @@ import { execFile } from "child_process";
 
 // src/commands/component/registry-preparer.ts
 import fs16 from "fs";
-import path14 from "path";
-import os from "os";
+import path15 from "path";
+import os2 from "os";
 
 // src/commands/component/service.ts
 import { mapValues } from "es-toolkit";
@@ -4918,7 +5065,7 @@ async function sendInstallEvent(key) {
 }
 
 // src/commands/component/registry-preparer.ts
-var REGISTRY_TEMP_DIR = path14.join(os.tmpdir(), "miaoda-registry");
+var REGISTRY_TEMP_DIR = path15.join(os2.tmpdir(), "miaoda-registry");
 function parseComponentKey(key) {
   const match = key.match(/^@([^/]+)\/(.+)$/);
   if (!match) {
@@ -4930,7 +5077,7 @@ function parseComponentKey(key) {
 }
 function getLocalRegistryPath(key) {
   const { scope, name } = parseComponentKey(key);
-  return path14.join(REGISTRY_TEMP_DIR, scope, `${name}.json`);
+  return path15.join(REGISTRY_TEMP_DIR, scope, `${name}.json`);
 }
 function ensureDir(dirPath) {
   if (!fs16.existsSync(dirPath)) {
@@ -4967,7 +5114,7 @@ async function prepareRecursive(key, visited) {
     registryDependencies: deps.map((dep) => getLocalRegistryPath(dep))
   };
   const localPath = getLocalRegistryPath(key);
-  ensureDir(path14.dirname(localPath));
+  ensureDir(path15.dirname(localPath));
   fs16.writeFileSync(localPath, JSON.stringify(rewrittenItem, null, 2), "utf-8");
   debug("\u4FDD\u5B58\u5230: %s", localPath);
 }
@@ -5158,11 +5305,11 @@ var componentCommandGroup = {
 
 // src/commands/migration/version-manager.ts
 import fs17 from "fs";
-import path15 from "path";
+import path16 from "path";
 var PACKAGE_JSON = "package.json";
 var VERSION_FIELD = "migrationVersion";
 function getPackageJsonPath2() {
-  return path15.join(process.cwd(), PACKAGE_JSON);
+  return path16.join(process.cwd(), PACKAGE_JSON);
 }
 function getCurrentVersion() {
   const pkgPath = getPackageJsonPath2();
@@ -5181,26 +5328,26 @@ function setCurrentVersion(version) {
 
 // src/commands/migration/versions/v001_capability/json-migrator/detector.ts
 import fs19 from "fs";
-import path17 from "path";
+import path18 from "path";
 
 // src/commands/migration/versions/v001_capability/utils.ts
 import fs18 from "fs";
-import path16 from "path";
+import path17 from "path";
 var CAPABILITIES_DIR2 = "server/capabilities";
 function getProjectRoot3() {
   return process.cwd();
 }
 function getCapabilitiesDir2() {
-  return path16.join(getProjectRoot3(), CAPABILITIES_DIR2);
+  return path17.join(getProjectRoot3(), CAPABILITIES_DIR2);
 }
 function getPluginManifestPath2(pluginKey) {
-  return path16.join(getProjectRoot3(), "node_modules", pluginKey, "manifest.json");
+  return path17.join(getProjectRoot3(), "node_modules", pluginKey, "manifest.json");
 }
 
 // src/commands/migration/versions/v001_capability/json-migrator/detector.ts
 function detectJsonMigration() {
   const capabilitiesDir = getCapabilitiesDir2();
-  const oldFilePath = path17.join(capabilitiesDir, "capabilities.json");
+  const oldFilePath = path18.join(capabilitiesDir, "capabilities.json");
   if (!fs19.existsSync(oldFilePath)) {
     return {
       needsMigration: false,
@@ -5260,7 +5407,7 @@ async function check(options) {
 
 // src/commands/migration/versions/v001_capability/json-migrator/index.ts
 import fs20 from "fs";
-import path18 from "path";
+import path19 from "path";
 
 // src/commands/migration/versions/v001_capability/mapping.ts
 var DEFAULT_PLUGIN_VERSION = "1.0.0";
@@ -5500,7 +5647,7 @@ function loadExistingCapabilities() {
       continue;
     }
     try {
-      const filePath = path18.join(capabilitiesDir, file);
+      const filePath = path19.join(capabilitiesDir, file);
       const content = fs20.readFileSync(filePath, "utf-8");
       const capability = JSON.parse(content);
       if (capability.id && capability.pluginKey) {
@@ -5559,7 +5706,7 @@ async function migrateJsonFiles(options) {
   }
   const capabilitiesDir = getCapabilitiesDir2();
   for (const cap of newCapabilities) {
-    const filePath = path18.join(capabilitiesDir, `${cap.id}.json`);
+    const filePath = path19.join(capabilitiesDir, `${cap.id}.json`);
     const content = JSON.stringify(cap, null, 2);
     fs20.writeFileSync(filePath, content, "utf-8");
     console.log(`   \u2713 Created: ${cap.id}.json`);
@@ -5653,12 +5800,12 @@ async function installPlugins(capabilities, options) {
 }
 
 // src/commands/migration/versions/v001_capability/code-migrator/index.ts
-import path20 from "path";
+import path21 from "path";
 import { Project as Project3 } from "ts-morph";
 
 // src/commands/migration/versions/v001_capability/code-migrator/scanner.ts
 import fs22 from "fs";
-import path19 from "path";
+import path20 from "path";
 var EXCLUDED_DIRS = [
   "node_modules",
   "dist",
@@ -5675,7 +5822,7 @@ var EXCLUDED_PATTERNS = [
 function scanDirectory(dir, files = []) {
   const entries = fs22.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path19.join(dir, entry.name);
+    const fullPath = path20.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (EXCLUDED_DIRS.includes(entry.name)) {
         continue;
@@ -5691,7 +5838,7 @@ function scanDirectory(dir, files = []) {
   return files;
 }
 function scanServerFiles() {
-  const serverDir = path19.join(getProjectRoot3(), "server");
+  const serverDir = path20.join(getProjectRoot3(), "server");
   if (!fs22.existsSync(serverDir)) {
     return [];
   }
@@ -6075,7 +6222,7 @@ function analyzeFile(project, filePath, actionNameMap) {
   const callSites = analyzeCallSites(sourceFile, imports);
   const classInfo = analyzeClass(sourceFile);
   const { canMigrate, reason } = canAutoMigrate(classInfo);
-  const relativePath = path20.relative(getProjectRoot3(), filePath);
+  const relativePath = path21.relative(getProjectRoot3(), filePath);
   return {
     filePath: relativePath,
     imports,
@@ -6086,7 +6233,7 @@ function analyzeFile(project, filePath, actionNameMap) {
   };
 }
 function migrateFile(project, analysis, dryRun) {
-  const absolutePath = path20.join(getProjectRoot3(), analysis.filePath);
+  const absolutePath = path21.join(getProjectRoot3(), analysis.filePath);
   if (!analysis.canAutoMigrate) {
     return {
       filePath: analysis.filePath,
@@ -6190,12 +6337,12 @@ function getSuggestion(analysis) {
 
 // src/commands/migration/versions/v001_capability/cleanup.ts
 import fs23 from "fs";
-import path21 from "path";
+import path22 from "path";
 function cleanupOldFiles(capabilities, dryRun) {
   const deletedFiles = [];
   const errors = [];
   const capabilitiesDir = getCapabilitiesDir2();
-  const oldJsonPath = path21.join(capabilitiesDir, "capabilities.json");
+  const oldJsonPath = path22.join(capabilitiesDir, "capabilities.json");
   if (fs23.existsSync(oldJsonPath)) {
     try {
       if (!dryRun) {
@@ -6207,7 +6354,7 @@ function cleanupOldFiles(capabilities, dryRun) {
     }
   }
   for (const cap of capabilities) {
-    const tsFilePath = path21.join(capabilitiesDir, `${cap.id}.ts`);
+    const tsFilePath = path22.join(capabilitiesDir, `${cap.id}.ts`);
     if (fs23.existsSync(tsFilePath)) {
       try {
         if (!dryRun) {
@@ -6228,7 +6375,7 @@ function cleanupOldFiles(capabilities, dryRun) {
 
 // src/commands/migration/versions/v001_capability/report-generator.ts
 import fs24 from "fs";
-import path22 from "path";
+import path23 from "path";
 var REPORT_FILE = "capability-migration-report.md";
 function printSummary(result) {
   const { jsonMigration, pluginInstallation, codeMigration, cleanup } = result;
@@ -6394,11 +6541,11 @@ async function generateReport(result) {
   if (!fs24.existsSync(logDir)) {
     return;
   }
-  const reportDir = path22.join(logDir, "migration");
+  const reportDir = path23.join(logDir, "migration");
   if (!fs24.existsSync(reportDir)) {
     fs24.mkdirSync(reportDir, { recursive: true });
   }
-  const reportPath = path22.join(reportDir, REPORT_FILE);
+  const reportPath = path23.join(reportDir, REPORT_FILE);
   fs24.writeFileSync(reportPath, lines.join("\n"), "utf-8");
   console.log(`\u{1F4C4} Report generated: ${reportPath}`);
 }
@@ -6931,7 +7078,7 @@ var migrationCommand = {
 };
 
 // src/commands/read-logs/index.ts
-import path23 from "path";
+import path24 from "path";
 
 // src/commands/read-logs/std-utils.ts
 import fs25 from "fs";
@@ -7698,7 +7845,7 @@ function sanitizeStructuredLog(value) {
   delete sanitized.pid;
   return sanitized;
 }
-var TRANSIENT_CONNECTION_ERROR_PATTERN = /ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH|socket hang up|proxy error|\[Proxy\] (?:Error:\s*$|Error during|Connection error|Non-connection error|Headers already sent|Service (?:recovered|did not recover))/i;
+var TRANSIENT_CONNECTION_ERROR_PATTERN = /ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH|proxy error|\[Proxy\] (?:Error:\s*$|Error during|Connection error|Non-connection error|Headers already sent|Service (?:recovered|did not recover))/i;
 function hasErrorInStdLines(lines) {
   const filtered = lines.filter((line) => !TRANSIENT_CONNECTION_ERROR_PATTERN.test(line));
   const combined = filtered.join("\n");
@@ -7833,30 +7980,30 @@ async function readLogsJsonResult(options) {
   };
 }
 function resolveLogFilePath(logDir, type) {
-  const base = path23.isAbsolute(logDir) ? logDir : path23.join(process.cwd(), logDir);
+  const base = path24.isAbsolute(logDir) ? logDir : path24.join(process.cwd(), logDir);
   if (type === "server") {
-    return path23.join(base, "server.log");
+    return path24.join(base, "server.log");
   }
   if (type === "trace") {
-    return path23.join(base, "trace.log");
+    return path24.join(base, "trace.log");
   }
   if (type === "server-std") {
-    return path23.join(base, "server.std.log");
+    return path24.join(base, "server.std.log");
   }
   if (type === "client-std") {
-    return path23.join(base, "client.std.log");
+    return path24.join(base, "client.std.log");
   }
   if (type === "dev") {
-    return path23.join(base, "dev.log");
+    return path24.join(base, "dev.log");
   }
   if (type === "dev-std") {
-    return path23.join(base, "dev.std.log");
+    return path24.join(base, "dev.std.log");
   }
   if (type === "install-dep-std") {
-    return path23.join(base, "install-dep.std.log");
+    return path24.join(base, "install-dep.std.log");
   }
   if (type === "browser") {
-    return path23.join(base, "browser.log");
+    return path24.join(base, "browser.log");
   }
   throw new Error(`Unsupported log type: ${type}`);
 }
@@ -8034,8 +8181,8 @@ function camelToKebab(str) {
 
 // src/commands/build/upload-static.handler.ts
 import * as fs28 from "fs";
-import * as os2 from "os";
-import * as path24 from "path";
+import * as os3 from "os";
+import * as path25 from "path";
 import { execFileSync } from "child_process";
 function readCredentialsFromEnv() {
   const uploadPrefix = process.env.STATIC_UPLOAD_PREFIX;
@@ -8059,7 +8206,7 @@ async function uploadStatic(options) {
       endpoint = UPLOAD_STATIC_DEFAULTS.endpoint,
       region = UPLOAD_STATIC_DEFAULTS.region
     } = options;
-    const resolvedStaticDir = path24.resolve(staticDir);
+    const resolvedStaticDir = path25.resolve(staticDir);
     if (!fs28.existsSync(resolvedStaticDir)) {
       console.error(`${LOG_PREFIX} \u76EE\u5F55\u4E0D\u5B58\u5728: ${resolvedStaticDir}\uFF0C\u8DF3\u8FC7\u4E0A\u4F20`);
       return;
@@ -8093,7 +8240,7 @@ async function uploadStatic(options) {
       ({ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, SessionToken: sessionToken } = uploadCredential);
     }
     console.error(`${LOG_PREFIX} \u4E0A\u4F20\u76EE\u6807: ${uploadPrefix}`);
-    const confPath = path24.join(os2.tmpdir(), `.tosutilconfig-static-${process.pid}`);
+    const confPath = path25.join(os3.tmpdir(), `.tosutilconfig-static-${process.pid}`);
     fs28.writeFileSync(confPath, "");
     try {
       console.error(`${LOG_PREFIX} \u914D\u7F6E tosutil...`);
@@ -8128,7 +8275,7 @@ async function uploadStatic(options) {
   }
 }
 function resolveTosutilPath(tosutilPath) {
-  if (path24.isAbsolute(tosutilPath)) {
+  if (path25.isAbsolute(tosutilPath)) {
     return fs28.existsSync(tosutilPath) ? tosutilPath : null;
   }
   try {
@@ -8221,62 +8368,3254 @@ async function preUploadStatic(options) {
   }
 }
 
-// src/commands/build/index.ts
-var getTokenCommand = {
-  name: "get-token",
-  description: "Get artifact upload credential (STI token)",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(async (options) => {
-      await getToken(options);
-    });
+// src/commands/build/server-cache-bundle.handler.ts
+import fs29 from "fs";
+import http from "http";
+import net from "net";
+import os4 from "os";
+import path26 from "path";
+import { builtinModules, createRequire as createRequire3 } from "module";
+import { spawn as spawn2 } from "child_process";
+import { createHash } from "crypto";
+import { build } from "esbuild";
+import { parse } from "acorn";
+import { simple as walkSimple } from "acorn-walk";
+var OPTIONAL_NEST_DEPENDENCIES = [
+  "@nestjs/microservices",
+  "@nestjs/microservices/microservices-module",
+  "@nestjs/websockets/socket-module",
+  "@node-rs/xxhash",
+  "fsevents"
+];
+var BUILTINS = /* @__PURE__ */ new Set([
+  ...builtinModules,
+  ...builtinModules.map((name) => `node:${name}`)
+]);
+var DEFAULT_COMPILED_ENTRIES = [
+  "dist/server/main.js",
+  "dist/main.js"
+];
+var BUILD_ONLY_SERVER_CACHE_PACKAGES = [
+  "@lark-apaas/nestjs-openapi-devtools",
+  "@hey-api/openapi-ts",
+  "typescript",
+  "jiti",
+  "nypm"
+];
+function workspaceSourceSha256(projectRoot) {
+  const files = [];
+  const visit = (directory) => {
+    if (!fs29.existsSync(directory)) return;
+    for (const entry of fs29.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path26.join(directory, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) visit(candidate);
+      else if (entry.isFile()) files.push(candidate);
+    }
+  };
+  for (const root of ["server", "shared", "src"]) {
+    visit(path26.join(projectRoot, root));
   }
-};
-var uploadStaticCommand = {
-  name: "upload-static",
-  description: "Upload shared/static files to TOS",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option("--static-dir <dir>", "Static files directory", UPLOAD_STATIC_DEFAULTS.staticDir).option("--tosutil-path <path>", "Path to tosutil binary", UPLOAD_STATIC_DEFAULTS.tosutilPath).option("--endpoint <endpoint>", "TOS endpoint", UPLOAD_STATIC_DEFAULTS.endpoint).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
-      await uploadStatic(options);
-    });
+  const hash = createHash("sha256");
+  for (const file of files.sort()) {
+    hash.update(path26.relative(projectRoot, file).split(path26.sep).join("/"));
+    hash.update("\0");
+    hash.update(fs29.readFileSync(file));
+    hash.update("\0");
   }
-};
-var preUploadStaticCommand = {
-  name: "pre-upload-static",
-  description: "Get TOS upload info and output as env vars for build.sh eval",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").action(async (options) => {
-      await preUploadStatic(options);
+  return hash.digest("hex");
+}
+function absolute(root, candidate) {
+  return path26.isAbsolute(candidate) ? candidate : path26.resolve(root, candidate);
+}
+function isPathInside(root, candidate) {
+  const relative = path26.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path26.isAbsolute(relative);
+}
+function validateOwnedServerOutput(projectRoot, outfile, metadataFile) {
+  const cacheRoot = path26.join(projectRoot, ".miaoda-cache");
+  if (!isPathInside(cacheRoot, outfile) || path26.basename(path26.dirname(outfile)) !== "server" || path26.basename(outfile) !== "server.bundle.cjs" || metadataFile !== `${outfile}.meta.json`) {
+    return "server cache output must be <projectRoot>/.miaoda-cache/**/server/server.bundle.cjs with adjacent metadata";
+  }
+  let current = path26.dirname(outfile);
+  while (current !== projectRoot) {
+    if (fs29.existsSync(current) && fs29.lstatSync(current).isSymbolicLink()) {
+      return `server cache output directory symlink is unsupported: ${current}`;
+    }
+    const parent = path26.dirname(current);
+    if (parent === current || !isPathInside(projectRoot, parent)) {
+      return "server cache output escaped project root";
+    }
+    current = parent;
+  }
+  return void 0;
+}
+function resolveCompiledEntry(projectRoot, requestedEntry) {
+  if (requestedEntry) {
+    const entry = absolute(projectRoot, requestedEntry);
+    return fs29.existsSync(entry) ? { entry, reasons: [] } : { reasons: [`compiled entry missing: ${entry}`] };
+  }
+  const candidates = DEFAULT_COMPILED_ENTRIES.map(
+    (candidate) => absolute(projectRoot, candidate)
+  ).filter((candidate) => fs29.existsSync(candidate));
+  if (candidates.length === 1) return { entry: candidates[0], reasons: [] };
+  if (candidates.length > 1) {
+    return {
+      reasons: [
+        `compiled entry is ambiguous; pass --entry explicitly: ${candidates.join(", ")}`
+      ]
+    };
+  }
+  return {
+    reasons: [
+      `compiled entry missing; checked: ${DEFAULT_COMPILED_ENTRIES.map(
+        (candidate) => absolute(projectRoot, candidate)
+      ).join(", ")}`
+    ]
+  };
+}
+function optionalDependencyStubPlugin() {
+  const escaped = OPTIONAL_NEST_DEPENDENCIES.map(
+    (name) => name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  );
+  const filter = new RegExp(`^(?:${escaped.join("|")})$`);
+  return {
+    name: "miaoda-optional-nest-dependency-stubs",
+    setup(esbuild) {
+      esbuild.onResolve({ filter }, (args) => ({
+        path: args.path,
+        namespace: "miaoda-optional-nest-dependency"
+      }));
+      esbuild.onLoad(
+        { filter: /.*/, namespace: "miaoda-optional-nest-dependency" },
+        (args) => ({
+          contents: `const error = new Error(${JSON.stringify(
+            `Optional dependency is unavailable in cache runtime: ${args.path}`
+          )}); error.code = 'MODULE_NOT_FOUND'; throw error;`,
+          loader: "js"
+        })
+      );
+    }
+  };
+}
+function classTransformerStorageResolver(projectRoot) {
+  const projectRequire = createRequire3(path26.join(projectRoot, "package.json"));
+  return {
+    name: "miaoda-class-transformer-storage-resolver",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /^class-transformer\/storage$/ }, () => {
+        try {
+          return {
+            path: projectRequire.resolve("class-transformer/cjs/storage.js")
+          };
+        } catch {
+          return void 0;
+        }
+      });
+    }
+  };
+}
+function resolveProjectPackage(projectRoot, specifier) {
+  return createRequire3(path26.join(projectRoot, "package.json")).resolve(
+    specifier
+  );
+}
+function fullstackNestRuntimeResolver(projectRoot) {
+  return {
+    name: "miaoda-fullstack-nest-runtime-resolver",
+    setup(esbuild) {
+      esbuild.onResolve(
+        { filter: /^@lark-apaas\/fullstack-nestjs-core$/ },
+        () => {
+          try {
+            return {
+              path: resolveProjectPackage(
+                projectRoot,
+                "@lark-apaas/fullstack-nestjs-core/runtime"
+              )
+            };
+          } catch (runtimeError) {
+            try {
+              return {
+                path: resolveProjectPackage(
+                  projectRoot,
+                  "@lark-apaas/fullstack-nestjs-core"
+                )
+              };
+            } catch (rootError) {
+              return {
+                errors: [
+                  {
+                    text: `@lark-apaas/fullstack-nestjs-core cannot be resolved from the project: runtime=${runtimeError instanceof Error ? runtimeError.message : String(runtimeError)}; root=${rootError instanceof Error ? rootError.message : String(rootError)}`
+                  }
+                ]
+              };
+            }
+          }
+        }
+      );
+    }
+  };
+}
+function legacyFullstackNestOpenApiStub(projectRoot) {
+  let runtimeOnlyEntryAvailable = false;
+  try {
+    resolveProjectPackage(
+      projectRoot,
+      "@lark-apaas/fullstack-nestjs-core/runtime"
+    );
+    runtimeOnlyEntryAvailable = true;
+  } catch {
+  }
+  return {
+    name: "miaoda-legacy-nest-openapi-stub",
+    setup(esbuild) {
+      if (runtimeOnlyEntryAvailable) return;
+      esbuild.onResolve(
+        { filter: /^@lark-apaas\/nestjs-openapi-devtools$/ },
+        () => ({
+          path: "@lark-apaas/nestjs-openapi-devtools",
+          namespace: "miaoda-legacy-nest-openapi-stub"
+        })
+      );
+      esbuild.onLoad(
+        { filter: /.*/, namespace: "miaoda-legacy-nest-openapi-stub" },
+        () => ({
+          contents: "class DisabledOpenApiModule { static async mount() {} }\nmodule.exports = { DevToolsModule: DisabledOpenApiModule, DevToolsV2Module: DisabledOpenApiModule };",
+          loader: "js"
+        })
+      );
+    }
+  };
+}
+function rejectNativeAddonsPlugin() {
+  return {
+    name: "miaoda-reject-native-addons",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /\.node$/ }, (args) => {
+        if (args.path.startsWith(".") && fs29.existsSync(path26.resolve(args.resolveDir, `${args.path}.js`))) {
+          return void 0;
+        }
+        return {
+          errors: [
+            {
+              text: `native addons are unsupported in the server cache bundle: ${args.path}`
+            }
+          ]
+        };
+      });
+    }
+  };
+}
+function findPackageRoot(entryPath) {
+  let current = path26.dirname(entryPath);
+  while (current !== path26.dirname(current)) {
+    if (fs29.existsSync(path26.join(current, "package.json"))) return current;
+    current = path26.dirname(current);
+  }
+  return void 0;
+}
+function canonicalSourcePath(projectRoot, sourcePath) {
+  const relativeOrigin = path26.relative(projectRoot, sourcePath).split(path26.sep).join("/");
+  const nestedPackageMarker = "/node_modules/";
+  const nestedPackageIndex = relativeOrigin.lastIndexOf(nestedPackageMarker);
+  const firstPackageIndex = relativeOrigin.indexOf("node_modules/");
+  if (nestedPackageIndex >= 0) {
+    return `node_modules/${relativeOrigin.slice(
+      nestedPackageIndex + nestedPackageMarker.length
+    )}`;
+  }
+  return firstPackageIndex > 0 ? relativeOrigin.slice(firstPackageIndex) : relativeOrigin;
+}
+function parseJavaScriptSource(source) {
+  try {
+    return parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      allowHashBang: true,
+      locations: true
+    });
+  } catch {
+    return parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "script",
+      allowHashBang: true,
+      allowReturnOutsideFunction: true,
+      locations: true
     });
   }
-};
-var buildCommandGroup = {
-  name: "build",
-  description: "Build related commands",
-  commands: [getTokenCommand, uploadStaticCommand, preUploadStaticCommand]
-};
-
-// src/commands/index.ts
-var commands = [
-  genDbSchemaCommand,
-  syncCommand,
-  upgradeCommand,
-  actionPluginCommandGroup,
-  capabilityCommandGroup,
-  componentCommandGroup,
-  migrationCommand,
-  readLogsCommand,
-  buildCommandGroup
-];
-
-// src/index.ts
-for (const filename of [".env.local", ".env"]) {
-  const envPath = path25.join(process.cwd(), filename);
-  if (fs29.existsSync(envPath)) {
-    dotenvConfig({ path: envPath });
+}
+function staticStringValue(node) {
+  if (!node) return void 0;
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return node.value;
+  }
+  if (node.type === "TemplateLiteral" && node.expressions.length === 0) {
+    return node.quasis[0]?.value?.cooked ?? "";
+  }
+  return void 0;
+}
+function isImportMetaUrl(node) {
+  return Boolean(
+    node?.type === "MemberExpression" && staticPropertyName(node) === "url" && node.object?.type === "MetaProperty" && node.object.meta?.name === "import" && node.object.property?.name === "meta"
+  );
+}
+function isBundleDirectoryExpression(node) {
+  if (!node) return false;
+  if (node.type === "Identifier" && node.name === "__dirname") return true;
+  if (node.type !== "CallExpression") return false;
+  const property = staticPropertyName(node.callee);
+  if (property === "dirname" && (node.arguments[0]?.type === "Identifier" && node.arguments[0].name === "__filename" ? true : node.arguments[0]?.type === "CallExpression" && staticPropertyName(node.arguments[0].callee) === "fileURLToPath" && isImportMetaUrl(node.arguments[0].arguments[0]))) {
+    return true;
+  }
+  return false;
+}
+function canonicalRuntimeAssetPath(candidate) {
+  const normalized = candidate.split(path26.sep).join("/");
+  if (!normalized || normalized === "." || normalized !== path26.posix.normalize(normalized) || normalized.startsWith("../") || path26.posix.isAbsolute(normalized) || normalized.includes("\\")) {
+    return void 0;
+  }
+  return normalized;
+}
+function resolveRuntimeAssetExpression(projectRoot, sourcePath, node) {
+  const direct = staticStringValue(node);
+  if (direct !== void 0 && !path26.isAbsolute(direct)) {
+    const destination2 = canonicalRuntimeAssetPath(direct);
+    return destination2 ? { source: path26.resolve(projectRoot, direct), destination: destination2 } : void 0;
+  }
+  if (node?.type === "NewExpression" && node.callee?.type === "Identifier" && node.callee.name === "URL") {
+    const relative2 = staticStringValue(node.arguments[0]);
+    if (relative2 && isImportMetaUrl(node.arguments[1])) {
+      const destination2 = canonicalRuntimeAssetPath(
+        relative2.replace(/^\.\//, "")
+      );
+      return destination2 ? {
+        source: path26.resolve(path26.dirname(sourcePath), relative2),
+        destination: destination2
+      } : void 0;
+    }
+  }
+  if (node?.type !== "CallExpression") return void 0;
+  const property = staticPropertyName(node.callee);
+  if (!["join", "resolve"].includes(property ?? "")) return void 0;
+  if (!isBundleDirectoryExpression(node.arguments[0])) return void 0;
+  const segments = node.arguments.slice(1).map(staticStringValue);
+  if (segments.some((segment) => segment === void 0)) return void 0;
+  const relative = path26.join(...segments);
+  const destination = canonicalRuntimeAssetPath(relative);
+  return destination ? {
+    source: path26.resolve(path26.dirname(sourcePath), relative),
+    destination
+  } : void 0;
+}
+function isFsModuleSpecifier(node) {
+  return ["fs", "node:fs"].includes(staticStringValue(node) ?? "");
+}
+function containsFsModuleLoad(node) {
+  if (!node) return false;
+  if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require" && isFsModuleSpecifier(node.arguments[0])) {
+    return true;
+  }
+  if (node.type === "CallExpression") {
+    return node.arguments.some(
+      (argument) => containsFsModuleLoad(argument)
+    );
+  }
+  if (node.type === "MemberExpression") {
+    return containsFsModuleLoad(node.object);
+  }
+  if (node.type === "ChainExpression") {
+    return containsFsModuleLoad(node.expression);
+  }
+  return false;
+}
+function rootIdentifier(node) {
+  let current = node;
+  while (current?.type === "MemberExpression") current = current.object;
+  return current?.type === "Identifier" ? current.name : void 0;
+}
+function collectFsBindings(ast, runtimeFsMethods) {
+  const namespaces = /* @__PURE__ */ new Set();
+  const methods = /* @__PURE__ */ new Set();
+  walkSimple(ast, {
+    ImportDeclaration(node) {
+      if (!isFsModuleSpecifier(node.source)) return;
+      for (const specifier of node.specifiers ?? []) {
+        if (specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier") {
+          namespaces.add(specifier.local.name);
+          continue;
+        }
+        if (specifier.type !== "ImportSpecifier") continue;
+        const imported = specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value;
+        if (typeof imported === "string" && runtimeFsMethods.has(imported)) {
+          methods.add(specifier.local.name);
+        }
+      }
+    },
+    VariableDeclarator(node) {
+      if (!containsFsModuleLoad(node.init)) return;
+      if (node.id?.type === "Identifier") {
+        const importedMethod = staticPropertyName(node.init);
+        if (importedMethod && runtimeFsMethods.has(importedMethod)) {
+          methods.add(node.id.name);
+        } else {
+          namespaces.add(node.id.name);
+        }
+        return;
+      }
+      if (node.id?.type === "ObjectPattern") {
+        for (const property of node.id.properties ?? []) {
+          if (property.type === "RestElement") continue;
+          const imported = property.key.type === "Identifier" ? property.key.name : staticStringValue(property.key);
+          const local = property.value.type === "Identifier" ? property.value.name : void 0;
+          if (typeof imported === "string" && runtimeFsMethods.has(imported) && typeof local === "string") {
+            methods.add(local);
+          }
+        }
+      }
+    }
+  });
+  return { namespaces, methods };
+}
+function resolveFsMethod(callee, bindings, runtimeFsMethods) {
+  if (callee.type === "Identifier" && bindings.methods.has(callee.name)) {
+    return callee.name;
+  }
+  const method = staticPropertyName(callee);
+  if (!method || !runtimeFsMethods.has(method)) return void 0;
+  if (callee.type !== "MemberExpression") return void 0;
+  if (containsFsModuleLoad(callee.object)) return method;
+  const root = rootIdentifier(callee.object);
+  return root && bindings.namespaces.has(root) ? method : void 0;
+}
+function isChildProcessModuleSpecifier(node) {
+  return ["child_process", "node:child_process"].includes(
+    staticStringValue(node) ?? ""
+  );
+}
+function containsChildProcessLoad(node) {
+  if (!node) return false;
+  if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require" && isChildProcessModuleSpecifier(node.arguments[0])) {
+    return true;
+  }
+  if (node.type === "MemberExpression") {
+    return containsChildProcessLoad(node.object);
+  }
+  return false;
+}
+function collectChildProcessForkBindings(ast) {
+  const namespaces = /* @__PURE__ */ new Set();
+  const methods = /* @__PURE__ */ new Set();
+  walkSimple(ast, {
+    ImportDeclaration(node) {
+      if (!isChildProcessModuleSpecifier(node.source)) return;
+      for (const specifier of node.specifiers ?? []) {
+        if (specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier") {
+          namespaces.add(specifier.local.name);
+        } else if (specifier.type === "ImportSpecifier" && (specifier.imported?.name === "fork" || specifier.imported?.value === "fork")) {
+          methods.add(specifier.local.name);
+        }
+      }
+    },
+    VariableDeclarator(node) {
+      if (!containsChildProcessLoad(node.init)) return;
+      if (node.id?.type === "Identifier") {
+        if (staticPropertyName(node.init) === "fork") {
+          methods.add(node.id.name);
+        } else {
+          namespaces.add(node.id.name);
+        }
+      } else if (node.id?.type === "ObjectPattern") {
+        for (const property of node.id.properties ?? []) {
+          const imported = property.type !== "RestElement" && property.key?.type === "Identifier" ? property.key.name : property.type !== "RestElement" ? staticStringValue(property.key) : void 0;
+          if (property.type !== "RestElement" && imported === "fork" && property.value?.type === "Identifier") {
+            methods.add(property.value.name);
+          }
+        }
+      }
+    }
+  });
+  return { namespaces, methods };
+}
+function isChildProcessFork(callee, bindings) {
+  if (callee.type === "Identifier") return bindings.methods.has(callee.name);
+  if (callee.type !== "MemberExpression" || staticPropertyName(callee) !== "fork") {
+    return false;
   }
+  if (containsChildProcessLoad(callee.object)) return true;
+  const root = rootIdentifier(callee.object);
+  return Boolean(root && bindings.namespaces.has(root));
 }
-var __dirname = path25.dirname(fileURLToPath5(import.meta.url));
-var pkg = JSON.parse(fs29.readFileSync(path25.join(__dirname, "../package.json"), "utf-8"));
+function materializeServerRuntimeAssets(projectRoot, metafile, bundleDirectory, configuredAssets = []) {
+  const candidates = [];
+  const warnings = [];
+  const runtimeFsMethods = /* @__PURE__ */ new Set([
+    "readFile",
+    "readFileSync",
+    "createReadStream",
+    "open",
+    "openSync"
+  ]);
+  for (const input of Object.keys(metafile.inputs).sort()) {
+    if (!/\.(?:cjs|mjs|js)$/.test(input)) continue;
+    const sourcePath = path26.resolve(projectRoot, input);
+    if (!fs29.existsSync(sourcePath) || !fs29.statSync(sourcePath).isFile()) {
+      continue;
+    }
+    const source = fs29.readFileSync(sourcePath, "utf8");
+    const origin = canonicalSourcePath(projectRoot, sourcePath);
+    const ast = parseJavaScriptSource(source);
+    const fsBindings = collectFsBindings(ast, runtimeFsMethods);
+    const childProcessBindings = collectChildProcessForkBindings(ast);
+    const recordRuntimeAsset = (expressionNode) => {
+      const resolved = resolveRuntimeAssetExpression(
+        projectRoot,
+        sourcePath,
+        expressionNode
+      );
+      if (resolved && fs29.existsSync(resolved.source)) {
+        candidates.push({ ...resolved, origin });
+        return;
+      }
+      const expression = source.slice(
+        expressionNode?.start ?? 0,
+        expressionNode?.end ?? source.length
+      );
+      warnings.push({
+        kind: resolved ? "missing-runtime-asset" : "dynamic-runtime-asset",
+        source: origin,
+        expressionHash: createHash("sha256").update(expression).digest("hex").slice(0, 16),
+        message: resolved ? `Static runtime asset is unavailable at build time: ${resolved.destination}` : "Runtime asset path cannot be determined statically"
+      });
+    };
+    walkSimple(ast, {
+      CallExpression(node) {
+        const method = resolveFsMethod(
+          node.callee,
+          fsBindings,
+          runtimeFsMethods
+        );
+        if (method || isChildProcessFork(node.callee, childProcessBindings)) {
+          recordRuntimeAsset(node.arguments[0]);
+        }
+      },
+      NewExpression(node) {
+        if (node.callee?.type === "Identifier" && node.callee.name === "URL" && isImportMetaUrl(node.arguments[1])) {
+          recordRuntimeAsset(node);
+          return;
+        }
+        if (node.callee?.type === "Identifier" && ["Worker", "SharedWorker"].includes(node.callee.name)) {
+          recordRuntimeAsset(node.arguments[0]);
+        }
+      }
+    });
+  }
+  for (const configured of configuredAssets) {
+    if (typeof configured?.source !== "string" || !configured.source || typeof configured?.path !== "string") {
+      throw new Error("configured runtime asset must include source and path");
+    }
+    const destination = canonicalRuntimeAssetPath(configured.path);
+    if (!destination) {
+      throw new Error(
+        `configured runtime asset path is invalid: ${configured.path}`
+      );
+    }
+    const source = path26.resolve(projectRoot, configured.source);
+    if (!isPathInside(projectRoot, source) || !fs29.existsSync(source)) {
+      throw new Error(
+        `configured runtime asset source is invalid: ${configured.source}`
+      );
+    }
+    candidates.push({ source, destination, origin: "package.json" });
+  }
+  const published = /* @__PURE__ */ new Map();
+  const assertNoSymlinkPath = (source) => {
+    const relative = path26.relative(projectRoot, source);
+    if (!relative || relative.startsWith("..") || path26.isAbsolute(relative)) {
+      throw new Error(`server runtime asset source escaped project: ${source}`);
+    }
+    let current = projectRoot;
+    for (const segment of relative.split(path26.sep)) {
+      current = path26.join(current, segment);
+      if (fs29.lstatSync(current).isSymbolicLink()) {
+        throw new Error(
+          `server runtime asset symlink is unsupported: ${current}`
+        );
+      }
+    }
+  };
+  const publishFile = (source, destination) => {
+    const assetPath = canonicalRuntimeAssetPath(destination);
+    if (!assetPath) {
+      throw new Error(`server runtime asset path is invalid: ${destination}`);
+    }
+    assertNoSymlinkPath(source);
+    const target = path26.join(bundleDirectory, ...assetPath.split("/"));
+    const content = fs29.readFileSync(source);
+    const sha2563 = createHash("sha256").update(content).digest("hex");
+    const existing = published.get(assetPath);
+    if (existing && existing.sha256 !== sha2563) {
+      throw new Error(`server runtime asset collision: ${assetPath}`);
+    }
+    if (!existing) {
+      fs29.mkdirSync(path26.dirname(target), { recursive: true });
+      fs29.writeFileSync(target, content);
+      published.set(assetPath, {
+        path: assetPath,
+        sha256: sha2563,
+        size: content.length
+      });
+    }
+  };
+  const publishCandidate = (source, destination) => {
+    assertNoSymlinkPath(source);
+    const stat = fs29.lstatSync(source);
+    if (stat.isSymbolicLink()) {
+      throw new Error(`server runtime asset symlink is unsupported: ${source}`);
+    }
+    if (stat.isFile()) {
+      publishFile(source, destination);
+      return;
+    }
+    if (!stat.isDirectory()) {
+      throw new Error(`server runtime asset type is unsupported: ${source}`);
+    }
+    for (const entry of fs29.readdirSync(source, { withFileTypes: true })) {
+      publishCandidate(
+        path26.join(source, entry.name),
+        path26.posix.join(destination, entry.name)
+      );
+    }
+  };
+  for (const candidate of candidates.sort(
+    (left, right) => left.destination.localeCompare(right.destination)
+  )) {
+    publishCandidate(candidate.source, candidate.destination);
+  }
+  return {
+    assets: Array.from(published.values()).sort(
+      (left, right) => left.path.localeCompare(right.path)
+    ),
+    warnings: warnings.filter(
+      (warning, index, all) => all.findIndex(
+        (item) => item.kind === warning.kind && item.source === warning.source && item.expressionHash === warning.expressionHash
+      ) === index
+    ).sort(
+      (left, right) => `${left.source}:${left.expressionHash}`.localeCompare(
+        `${right.source}:${right.expressionHash}`
+      )
+    )
+  };
+}
+function resolveStaticActionPlugins(projectRoot, configuredPlugins) {
+  const projectRequire = createRequire3(path26.join(projectRoot, "package.json"));
+  const plugins = [];
+  const reasons = [];
+  for (const [name, configuredVersion] of Object.entries(
+    configuredPlugins
+  ).sort(([left], [right]) => left.localeCompare(right))) {
+    if (typeof configuredVersion !== "string" || configuredVersion === "") {
+      reasons.push(`Action Plugin ${name} has an invalid configured version`);
+      continue;
+    }
+    try {
+      const entry = projectRequire.resolve(name);
+      const packageRoot2 = findPackageRoot(entry);
+      if (!packageRoot2) {
+        reasons.push(`Action Plugin package root not found: ${name}`);
+        continue;
+      }
+      const packageJson = JSON.parse(
+        fs29.readFileSync(path26.join(packageRoot2, "package.json"), "utf8")
+      );
+      if (packageJson.name !== name) {
+        reasons.push(
+          `Action Plugin package name mismatch: configured=${name} installed=${packageJson.name ?? "<missing>"}`
+        );
+        continue;
+      }
+      if (packageJson.version !== configuredVersion) {
+        reasons.push(
+          `Action Plugin version mismatch: ${name} configured=${configuredVersion} installed=${packageJson.version ?? "<missing>"}`
+        );
+        continue;
+      }
+      const manifestPath = path26.join(packageRoot2, "manifest.json");
+      if (!fs29.existsSync(manifestPath)) {
+        reasons.push(`Action Plugin manifest is missing: ${name}`);
+        continue;
+      }
+      const manifest = JSON.parse(fs29.readFileSync(manifestPath, "utf8"));
+      if (manifest.name !== void 0 && manifest.name !== name) {
+        reasons.push(
+          `Action Plugin manifest name mismatch: configured=${name} manifest=${String(manifest.name)}`
+        );
+        continue;
+      }
+      if (manifest.version !== void 0 && manifest.version !== configuredVersion) {
+        reasons.push(
+          `Action Plugin manifest version mismatch: ${name} configured=${configuredVersion} manifest=${String(manifest.version)}`
+        );
+        continue;
+      }
+      plugins.push({ name, version: configuredVersion, entry, manifest });
+    } catch (error) {
+      reasons.push(
+        `Action Plugin cannot be statically resolved: ${name}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  return { plugins, reasons };
+}
+function staticActionPluginRegistry(projectRoot, plugins, actionPluginProbe) {
+  if (plugins.length === 0) {
+    return { name: "miaoda-static-action-plugin-registry", setup() {
+    } };
+  }
+  const capabilityEntry = resolveProjectPackage(
+    projectRoot,
+    "@lark-apaas/nestjs-capability"
+  );
+  const registryEntries = plugins.map(
+    (plugin, index) => `[${JSON.stringify(plugin.name)}, { version: ${JSON.stringify(plugin.version)}, manifest: ${JSON.stringify(plugin.manifest)}, pluginPackage: __miaodaActionPlugin${index} }]`
+  ).join(",\n");
+  const staticImports = plugins.map(
+    (plugin, index) => `const __miaodaActionPlugin${index} = require(${JSON.stringify(plugin.entry)});`
+  ).join("\n");
+  const contents = `
+const __miaodaCapability = require(${JSON.stringify(capabilityEntry)});
+${staticImports}
+const __miaodaActionPluginRegistry = new Map([${registryEntries}]);
+const __miaodaActionPluginProbe = ${JSON.stringify(actionPluginProbe ?? null)};
+if (process.env.MIAODA_SERVER_CACHE_PROBE === 'true') {
+  for (const [__miaodaPluginKey, __miaodaRegistration] of __miaodaActionPluginRegistry) {
+    const __miaodaPluginPackage = __miaodaRegistration.pluginPackage.default ?? __miaodaRegistration.pluginPackage;
+    if (typeof __miaodaPluginPackage.create !== 'function') {
+      throw new Error('MIAODA_ACTION_PLUGIN_PROBE_CREATE_MISSING:' + __miaodaPluginKey);
+    }
+  }
+  console.error('MIAODA_ACTION_PLUGIN_REGISTRY_OK:' + __miaodaActionPluginRegistry.size);
+}
+if (process.env.MIAODA_SERVER_CACHE_PROBE === 'true' && __miaodaActionPluginProbe) {
+  const __miaodaProbeRegistration = __miaodaActionPluginRegistry.get(__miaodaActionPluginProbe.key);
+  if (!__miaodaProbeRegistration) {
+    throw new Error('MIAODA_ACTION_PLUGIN_PROBE_NOT_REGISTERED:' + __miaodaActionPluginProbe.key);
+  }
+  const __miaodaProbePackage = __miaodaProbeRegistration.pluginPackage.default ?? __miaodaProbeRegistration.pluginPackage;
+  if (typeof __miaodaProbePackage.create !== 'function') {
+    throw new Error('MIAODA_ACTION_PLUGIN_PROBE_CREATE_MISSING:' + __miaodaActionPluginProbe.key);
+  }
+  Promise.resolve(__miaodaProbePackage.create(__miaodaActionPluginProbe.config))
+    .then(() => console.error('MIAODA_ACTION_PLUGIN_PROBE_OK:' + __miaodaActionPluginProbe.key))
+    .catch(error => {
+      console.error('MIAODA_ACTION_PLUGIN_PROBE_FAILED:' + __miaodaActionPluginProbe.key + ':' + (error?.message ?? String(error)));
+      process.exitCode = 1;
+    });
+}
+const __miaodaPluginLoader = __miaodaCapability.PluginLoaderService;
+if (typeof __miaodaPluginLoader !== 'function') {
+  throw new Error('MIAODA_STATIC_ACTION_PLUGIN_REGISTRY_UNSUPPORTED');
+}
+const __miaodaPluginLoaderPrototype = __miaodaPluginLoader.prototype;
+__miaodaPluginLoaderPrototype.getManifest = function getStaticManifest(pluginKey) {
+  return __miaodaActionPluginRegistry.get(pluginKey)?.manifest ?? null;
+};
+__miaodaPluginLoaderPrototype.createPluginInstance = async function createStaticPluginInstance(pluginKey, config) {
+  const registered = __miaodaActionPluginRegistry.get(pluginKey);
+  if (!registered) throw new __miaodaCapability.PluginNotFoundError(pluginKey);
+  const pluginPackage = registered.pluginPackage.default ?? registered.pluginPackage;
+  if (typeof pluginPackage.create !== 'function') {
+    throw new __miaodaCapability.PluginLoadError(pluginKey, 'Plugin does not export create() function');
+  }
+  return pluginPackage.create(config);
+};
+__miaodaPluginLoaderPrototype.isPluginInstalled = function isStaticPluginInstalled(pluginKey) {
+  return __miaodaActionPluginRegistry.has(pluginKey);
+};
+__miaodaPluginLoaderPrototype.clearCache = function clearStaticPluginCache(pluginKey) {
+  if (pluginKey) {
+    this.pluginInstances?.delete(pluginKey);
+    this.manifestCache?.delete(pluginKey);
+    return;
+  }
+  this.pluginInstances?.clear();
+  this.manifestCache?.clear();
+};
+module.exports = __miaodaCapability;
+`;
+  return {
+    name: "miaoda-static-action-plugin-registry",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /^@lark-apaas\/nestjs-capability$/ }, () => ({
+        path: "@lark-apaas/nestjs-capability",
+        namespace: "miaoda-static-action-plugin-registry"
+      }));
+      esbuild.onLoad(
+        {
+          filter: /.*/,
+          namespace: "miaoda-static-action-plugin-registry"
+        },
+        () => ({ contents, loader: "js", resolveDir: projectRoot })
+      );
+    }
+  };
+}
+function collectExternalImports(metafile, outfile, projectRoot) {
+  const realOutfile = fs29.existsSync(outfile) ? fs29.realpathSync(outfile) : path26.resolve(outfile);
+  const output = Object.entries(metafile.outputs).find(([candidate]) => {
+    const resolvedCandidate = path26.resolve(projectRoot, candidate);
+    return resolvedCandidate === path26.resolve(outfile) || fs29.existsSync(resolvedCandidate) && fs29.realpathSync(resolvedCandidate) === realOutfile;
+  })?.[1];
+  if (!output) return [];
+  const externalImports = new Set(
+    output.imports.filter((item) => item.external).map((item) => item.path).filter((item) => !BUILTINS.has(item) && !item.startsWith("node:"))
+  );
+  if (fs29.existsSync(outfile)) {
+    const ast = parseJavaScriptSource(fs29.readFileSync(outfile, "utf8"));
+    walkSimple(ast, {
+      CallExpression(node) {
+        if (staticPropertyName(node.callee) !== "resolve" || node.callee?.type !== "MemberExpression" || node.callee.object?.type !== "Identifier" || !["require", "__require"].includes(node.callee.object.name)) {
+          return;
+        }
+        const specifier = staticStringValue(node.arguments?.[0]);
+        if (!specifier || specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("#") || BUILTINS.has(specifier) || specifier.startsWith("node:")) {
+          return;
+        }
+        externalImports.add(specifier);
+      }
+    });
+  }
+  return Array.from(externalImports).sort();
+}
+function collectBuildOnlyInputs(projectRoot, metafile) {
+  return Array.from(
+    new Set(
+      Object.keys(metafile.inputs).flatMap((input) => {
+        const source = canonicalSourcePath(
+          projectRoot,
+          path26.resolve(projectRoot, input)
+        );
+        const normalized = `/${source.replace(/^\.\//, "")}/`;
+        return BUILD_ONLY_SERVER_CACHE_PACKAGES.filter(
+          (packageName) => normalized.includes(`/node_modules/${packageName}/`)
+        );
+      })
+    )
+  ).sort();
+}
+function isStaticString(node) {
+  if (!node) return false;
+  if (node.type === "Literal") return typeof node.value === "string";
+  return node.type === "TemplateLiteral" && node.expressions.length === 0;
+}
+function staticPropertyName(node) {
+  if (node?.type !== "MemberExpression") return void 0;
+  if (!node.computed && node.property.type === "Identifier") {
+    return node.property.name;
+  }
+  if (node.computed && node.property.type === "Literal" && typeof node.property.value === "string") {
+    return node.property.value;
+  }
+  return void 0;
+}
+function collectDynamicImportWarnings(projectRoot, metafile) {
+  const warnings = [];
+  const sourceInputs = Object.keys(metafile.inputs).filter((input) => /\.(?:cjs|mjs|js)$/.test(input)).sort();
+  for (const input of sourceInputs) {
+    const sourcePath = path26.resolve(projectRoot, input);
+    if (!fs29.existsSync(sourcePath) || !fs29.statSync(sourcePath).isFile()) {
+      continue;
+    }
+    const source = fs29.readFileSync(sourcePath, "utf8");
+    const ast = parseJavaScriptSource(source);
+    const origin = canonicalSourcePath(projectRoot, sourcePath);
+    const fingerprint = (kind, node, message) => {
+      const expression = source.slice(node.start, node.end);
+      const hash = createHash("sha256").update(expression).digest("hex").slice(0, 16);
+      warnings.push({ kind, source: origin, expressionHash: hash, message });
+    };
+    walkSimple(ast, {
+      CallExpression(node) {
+        if (node.callee.type === "Identifier" && node.callee.name === "require" && !isStaticString(node.arguments[0])) {
+          fingerprint(
+            "dynamic-require",
+            node,
+            "Variable module loading remains in bundle"
+          );
+        }
+        const property = staticPropertyName(node.callee);
+        const resolverObject = node.callee.type === "MemberExpression" ? node.callee.object : void 0;
+        if (node.callee.type === "Identifier" && node.callee.name === "createRequire") {
+          fingerprint(
+            "create-require",
+            node,
+            "Runtime module resolver is created in bundle"
+          );
+        } else if (property === "resolve" && resolverObject?.type === "Identifier" && resolverObject.name === "require" && !isStaticString(node.arguments[0])) {
+          fingerprint(
+            "dynamic-require-resolve",
+            node,
+            "Variable require.resolve target remains in bundle"
+          );
+        } else if (property === "resolve" && resolverObject?.type === "Identifier" && ["import", "module"].includes(resolverObject.name) && !isStaticString(node.arguments[0])) {
+          fingerprint(
+            "runtime-module-resolution",
+            node,
+            "Variable runtime module resolution remains in bundle"
+          );
+        }
+      },
+      ImportExpression(node) {
+        if (!isStaticString(node.source)) {
+          fingerprint(
+            "dynamic-import",
+            node,
+            "Variable dynamic import remains in bundle"
+          );
+        }
+      }
+    });
+  }
+  return warnings.filter(
+    (warning, index, all) => all.findIndex(
+      (item) => item.kind === warning.kind && item.source === warning.source && item.expressionHash === warning.expressionHash
+    ) === index
+  ).sort(
+    (left, right) => `${left.kind}:${left.source}:${left.expressionHash}`.localeCompare(
+      `${right.kind}:${right.source}:${right.expressionHash}`
+    )
+  );
+}
+async function reservePort() {
+  return new Promise((resolve2, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(() => reject(new Error("unable to reserve probe port")));
+        return;
+      }
+      server.close((error) => error ? reject(error) : resolve2(address.port));
+    });
+  });
+}
+function resolveLegacyCapabilityProbe(projectRoot) {
+  const capabilitiesRoot = path26.join(projectRoot, "server", "capabilities");
+  if (!fs29.existsSync(capabilitiesRoot)) {
+    return { files: [], expectedIds: [] };
+  }
+  const rootStat = fs29.lstatSync(capabilitiesRoot);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+    throw new Error(
+      "legacy capability probe directory must be a regular directory"
+    );
+  }
+  const realProjectRoot = fs29.realpathSync(projectRoot);
+  const realCapabilitiesRoot = fs29.realpathSync(capabilitiesRoot);
+  if (!isPathInside(realProjectRoot, realCapabilitiesRoot)) {
+    throw new Error("legacy capability probe directory escaped project root");
+  }
+  const files = [];
+  const expectedIds = [];
+  for (const name of fs29.readdirSync(realCapabilitiesRoot).sort()) {
+    if (!name.endsWith(".json")) continue;
+    const source = path26.join(realCapabilitiesRoot, name);
+    const stat = fs29.lstatSync(source);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`legacy capability probe file is unsafe: ${name}`);
+    }
+    const parsed = JSON.parse(fs29.readFileSync(source, "utf8"));
+    if (typeof parsed.id !== "string" || parsed.id.length === 0) {
+      throw new Error(`legacy capability probe file has no id: ${name}`);
+    }
+    files.push({ source, name });
+    expectedIds.push(parsed.id);
+  }
+  return { files, expectedIds };
+}
+function resolveAvailabilityProbeConfig(projectRoot, configured) {
+  if (configured === void 0) {
+    const configuredBasePath = process.env.CLIENT_BASE_PATH;
+    const basePath = typeof configuredBasePath === "string" && configuredBasePath.startsWith("/") && !configuredBasePath.startsWith("//") ? configuredBasePath : "/";
+    const normalizedBasePath = basePath === "/" ? "" : basePath.replace(/\/+$/, "");
+    const capabilityPath = `${normalizedBasePath}/__innerapi__/capability/list`;
+    return {
+      readiness: { path: capabilityPath, expectedStatus: 200 },
+      business: {
+        path: capabilityPath,
+        expectedStatus: 200,
+        bodyIncludes: '"status_code":"0"'
+      },
+      legacyCapabilityProbe: resolveLegacyCapabilityProbe(projectRoot)
+    };
+  }
+  if (!configured?.readiness || !configured.business) {
+    throw new Error(
+      "miaodaCache.availabilityProbe.readiness and business are required"
+    );
+  }
+  const normalize = (name, value) => {
+    const requestPath = value?.path;
+    const expectedStatus = value?.expectedStatus;
+    if (typeof requestPath !== "string" || !requestPath.startsWith("/") || requestPath.startsWith("//") || !Number.isSafeInteger(expectedStatus) || expectedStatus < 100 || expectedStatus > 599 || value?.bodyIncludes !== void 0 && typeof value.bodyIncludes !== "string") {
+      throw new Error(`invalid ${name} availability probe configuration`);
+    }
+    return {
+      path: requestPath,
+      expectedStatus,
+      ...value?.bodyIncludes ? { bodyIncludes: value.bodyIncludes } : {}
+    };
+  };
+  return {
+    readiness: normalize("readiness", configured.readiness),
+    business: normalize("business", configured.business)
+  };
+}
+function requestHttp(port, request) {
+  return new Promise((resolve2, reject) => {
+    const clientRequest = http.request(
+      {
+        host: "127.0.0.1",
+        port,
+        path: request.path,
+        method: "GET",
+        timeout: 1e3,
+        headers: { connection: "close" }
+      },
+      (response) => {
+        let body = "";
+        response.setEncoding("utf8");
+        response.on("data", (chunk) => {
+          body = `${body}${String(chunk)}`.slice(0, 64 * 1024);
+        });
+        response.once(
+          "end",
+          () => resolve2({ status: response.statusCode ?? 0, body })
+        );
+      }
+    );
+    clientRequest.once("timeout", () => {
+      clientRequest.destroy(new Error("HTTP probe timed out"));
+    });
+    clientRequest.once("error", reject);
+    clientRequest.end();
+  });
+}
+function requestMatches(response, request) {
+  return response.status === request.expectedStatus && (request.bodyIncludes === void 0 || response.body.includes(request.bodyIncludes));
+}
+async function terminateProcessGroup(child) {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  const exited = new Promise(
+    (resolve2) => child.once("exit", () => resolve2())
+  );
+  try {
+    child.kill("SIGTERM");
+  } catch {
+  }
+  await Promise.race([
+    exited,
+    new Promise((resolve2) => setTimeout(resolve2, 500))
+  ]);
+  if (child.exitCode === null && child.signalCode === null) {
+    try {
+      process.kill(-child.pid, "SIGKILL");
+    } catch {
+      child.kill("SIGKILL");
+    }
+    await exited;
+  }
+}
+async function runAvailabilityProbe(bundleFile, runtimeAssets, timeoutMs, config, actionPluginCount, actionPluginProbeKey) {
+  const probeRoot = fs29.mkdtempSync(
+    path26.join(os4.tmpdir(), "server-cache-probe-")
+  );
+  const isolatedBundle = path26.join(probeRoot, "server.bundle.cjs");
+  fs29.copyFileSync(bundleFile, isolatedBundle);
+  for (const asset of runtimeAssets) {
+    const source = path26.join(
+      path26.dirname(bundleFile),
+      ...asset.path.split("/")
+    );
+    const destination = path26.join(probeRoot, ...asset.path.split("/"));
+    fs29.mkdirSync(path26.dirname(destination), { recursive: true });
+    fs29.copyFileSync(source, destination);
+  }
+  if (config.legacyCapabilityProbe) {
+    const capabilityRoot = path26.join(probeRoot, "server", "capabilities");
+    fs29.mkdirSync(capabilityRoot, { recursive: true });
+    for (const file of config.legacyCapabilityProbe.files) {
+      fs29.copyFileSync(file.source, path26.join(capabilityRoot, file.name));
+    }
+  }
+  const port = await reservePort();
+  let stdout = "";
+  let stderr = "";
+  let responseText = "";
+  const checks = [];
+  const startedAt = Date.now();
+  const child = spawn2(process.execPath, [isolatedBundle], {
+    cwd: probeRoot,
+    detached: true,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...process.env,
+      NODE_PATH: "",
+      // The cache bundle serves the development preview. Probe the same module
+      // graph instead of forcing production mode, which disables Miaoda's
+      // internal capability route and produces a false HTTP 500.
+      NODE_ENV: "development",
+      SERVER_HOST: "127.0.0.1",
+      SERVER_PORT: String(port),
+      MIAODA_SERVER_CACHE_PROBE: "true",
+      DEPRECATED_SKIP_INIT_DB_CONNECTION: process.env.DEPRECATED_SKIP_INIT_DB_CONNECTION ?? "true",
+      FORCE_AUTHN_INNERAPI_DOMAIN: process.env.FORCE_AUTHN_INNERAPI_DOMAIN ?? "http://127.0.0.1",
+      FORCE_AUTHN_ACCESS_KEY: process.env.FORCE_AUTHN_ACCESS_KEY ?? "server-cache-probe",
+      FORCE_AUTHN_ACCESS_SECRET: process.env.FORCE_AUTHN_ACCESS_SECRET ?? "server-cache-probe"
+    }
+  });
+  child.stdout?.setEncoding("utf8");
+  child.stdout?.on("data", (chunk) => {
+    stdout = `${stdout}${String(chunk)}`.slice(-8 * 1024);
+  });
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk) => {
+    stderr = `${stderr}${String(chunk)}`.slice(-8 * 1024);
+  });
+  try {
+    const nodeModulesPresent = fs29.existsSync(
+      path26.join(probeRoot, "node_modules")
+    );
+    checks.push({
+      name: "isolated-node-modules",
+      success: !nodeModulesPresent,
+      message: nodeModulesPresent ? "node_modules unexpectedly exists in isolated probe directory" : "node_modules is absent"
+    });
+    const runtimeAssetsReadable = runtimeAssets.every((asset) => {
+      const file = path26.join(probeRoot, ...asset.path.split("/"));
+      return fs29.existsSync(file) && fs29.statSync(file).isFile() && fs29.statSync(file).size === asset.size && createHash("sha256").update(fs29.readFileSync(file)).digest("hex") === asset.sha256;
+    });
+    checks.push({
+      name: "runtime-assets",
+      success: runtimeAssetsReadable,
+      message: runtimeAssetsReadable ? `${runtimeAssets.length} runtime assets are readable` : "runtime asset integrity check failed in isolated directory"
+    });
+    let readinessResponse;
+    let lastReadinessError = "";
+    while (Date.now() - startedAt < timeoutMs && child.exitCode === null && child.signalCode === null) {
+      try {
+        const response = await requestHttp(port, config.readiness);
+        responseText = `${responseText}
+${response.body}`.slice(-64 * 1024);
+        readinessResponse = response;
+        if (requestMatches(response, config.readiness)) break;
+        lastReadinessError = `unexpected HTTP ${response.status}`;
+      } catch (error) {
+        lastReadinessError = error instanceof Error ? error.message : String(error);
+      }
+      await new Promise((resolve2) => setTimeout(resolve2, 25));
+    }
+    if (child.exitCode !== null || child.signalCode !== null) {
+      await new Promise((resolve2) => setTimeout(resolve2, 50));
+    }
+    const readinessSuccess = Boolean(
+      readinessResponse && requestMatches(readinessResponse, config.readiness)
+    );
+    const startupMs = Date.now() - startedAt;
+    checks.push({
+      name: "http-readiness",
+      success: readinessSuccess,
+      path: config.readiness.path,
+      status: readinessResponse?.status,
+      elapsedMs: startupMs,
+      ...!readinessSuccess ? {
+        message: child.exitCode !== null ? `process exited before readiness: ${child.exitCode}` : lastReadinessError || "HTTP readiness timed out"
+      } : {}
+    });
+    let businessResponse;
+    let businessError = "";
+    if (readinessSuccess) {
+      try {
+        businessResponse = await requestHttp(port, config.business);
+        responseText = `${responseText}
+${businessResponse.body}`.slice(
+          -64 * 1024
+        );
+      } catch (error) {
+        businessError = error instanceof Error ? error.message : String(error);
+      }
+    }
+    const businessSuccess = Boolean(
+      businessResponse && requestMatches(businessResponse, config.business)
+    );
+    checks.push({
+      name: "business-api",
+      success: businessSuccess,
+      path: config.business.path,
+      status: businessResponse?.status,
+      ...!businessSuccess ? {
+        message: businessError || (businessResponse ? `expected HTTP ${config.business.expectedStatus}${config.business.bodyIncludes ? ` containing ${JSON.stringify(config.business.bodyIncludes)}` : ""}, received HTTP ${businessResponse.status}` : "business API was not requested because readiness failed")
+      } : {}
+    });
+    if (config.legacyCapabilityProbe) {
+      let actualIds = [];
+      let capabilityError = "";
+      try {
+        const payload = JSON.parse(businessResponse?.body ?? "");
+        actualIds = (payload.data?.capabilities ?? []).map((capability) => capability.id).filter((id) => typeof id === "string").sort();
+      } catch (error) {
+        capabilityError = error instanceof Error ? error.message : String(error);
+      }
+      const expectedIds = [...config.legacyCapabilityProbe.expectedIds].sort();
+      const missingIds = expectedIds.filter((id) => !actualIds.includes(id));
+      checks.push({
+        name: "capability-configs",
+        success: businessSuccess && capabilityError.length === 0 && missingIds.length === 0,
+        message: capabilityError.length > 0 ? `capability response is invalid JSON: ${capabilityError}` : missingIds.length > 0 ? `capability response missed: ${missingIds.join(", ")}` : `${expectedIds.length} workspace capability configs loaded`
+      });
+    }
+    if (actionPluginCount > 0) {
+      const marker = `MIAODA_ACTION_PLUGIN_REGISTRY_OK:${actionPluginCount}`;
+      const markerDeadline = Date.now() + Math.min(1e3, timeoutMs);
+      while (!stderr.includes(marker) && Date.now() < markerDeadline) {
+        await new Promise((resolve2) => setTimeout(resolve2, 10));
+      }
+      checks.push({
+        name: "action-plugin-registry",
+        success: stderr.includes(marker),
+        message: stderr.includes(marker) ? `${actionPluginCount} static Action Plugin packages registered` : `static Action Plugin registry marker missing: expected ${actionPluginCount}`
+      });
+    }
+    if (actionPluginProbeKey) {
+      const marker = `MIAODA_ACTION_PLUGIN_PROBE_OK:${actionPluginProbeKey}`;
+      const markerDeadline = Date.now() + Math.min(1e3, timeoutMs);
+      while (!stderr.includes(marker) && Date.now() < markerDeadline) {
+        await new Promise((resolve2) => setTimeout(resolve2, 10));
+      }
+      checks.push({
+        name: "action-plugin-instantiation",
+        success: stderr.includes(marker),
+        message: stderr.includes(marker) ? `static Action Plugin instantiated: ${actionPluginProbeKey}` : `static Action Plugin probe marker missing: ${actionPluginProbeKey}`
+      });
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, 25));
+    checks.push({
+      name: "process-alive",
+      success: child.exitCode === null && child.signalCode === null,
+      ...child.exitCode !== null ? { message: `process exited with code ${child.exitCode}` } : {}
+    });
+    const moduleNotFound = /MODULE_NOT_FOUND/.test(
+      `${stdout}
+${stderr}
+${responseText}`
+    );
+    checks.push({
+      name: "module-resolution",
+      success: !moduleNotFound,
+      ...moduleNotFound ? { message: "MODULE_NOT_FOUND appeared in stderr or HTTP response" } : {}
+    });
+    const success = checks.every((check2) => check2.success);
+    return {
+      success,
+      nodeModulesPresent,
+      port,
+      startupMs,
+      checks,
+      ...stdout.trim() ? { stdout: stdout.trim() } : {},
+      ...stderr.trim() ? { stderr: stderr.trim() } : {}
+    };
+  } finally {
+    await terminateProcessGroup(child);
+    fs29.rmSync(probeRoot, { recursive: true, force: true });
+  }
+}
+async function buildServerCacheBundle(options) {
+  const startedAt = Date.now();
+  const projectRoot = path26.resolve(options.projectRoot);
+  const outfile = absolute(
+    projectRoot,
+    options.outfile ?? ".miaoda-cache/server/server.bundle.cjs"
+  );
+  const metadataFile = absolute(
+    projectRoot,
+    options.metadataFile ?? `${outfile}.meta.json`
+  );
+  const fail = (reasons) => ({
+    built: false,
+    reasons,
+    elapsedMs: Date.now() - startedAt
+  });
+  const outputValidationError = validateOwnedServerOutput(
+    projectRoot,
+    outfile,
+    metadataFile
+  );
+  if (outputValidationError) return fail([outputValidationError]);
+  const serverOutputRoot = path26.dirname(outfile);
+  fs29.rmSync(serverOutputRoot, { recursive: true, force: true });
+  const resolvedEntry = resolveCompiledEntry(projectRoot, options.entry);
+  if (!resolvedEntry.entry) return fail(resolvedEntry.reasons);
+  const entry = resolvedEntry.entry;
+  if (outfile === entry || metadataFile === entry || outfile === metadataFile) {
+    return fail(["bundle output conflicts with an input or metadata file"]);
+  }
+  const packageJsonPath = path26.join(projectRoot, "package.json");
+  if (!fs29.existsSync(packageJsonPath)) {
+    return fail([`package.json missing: ${packageJsonPath}`]);
+  }
+  const packageJson = JSON.parse(fs29.readFileSync(packageJsonPath, "utf8"));
+  let availabilityProbeConfig;
+  try {
+    availabilityProbeConfig = resolveAvailabilityProbeConfig(
+      projectRoot,
+      packageJson.miaodaCache?.availabilityProbe
+    );
+  } catch (error) {
+    return fail([error instanceof Error ? error.message : String(error)]);
+  }
+  const actionPluginResolution = resolveStaticActionPlugins(
+    projectRoot,
+    packageJson.actionPlugins ?? {}
+  );
+  if (actionPluginResolution.reasons.length > 0) {
+    return fail(actionPluginResolution.reasons);
+  }
+  const actionPlugins = actionPluginResolution.plugins;
+  const configuredActionPluginProbe = packageJson.miaodaCache?.actionPluginProbe;
+  const actionPluginProbe = configuredActionPluginProbe === void 0 ? void 0 : typeof configuredActionPluginProbe.key === "string" && configuredActionPluginProbe.key ? {
+    key: configuredActionPluginProbe.key,
+    config: configuredActionPluginProbe.config
+  } : null;
+  if (actionPluginProbe === null) {
+    return fail(["Action Plugin probe key is invalid"]);
+  }
+  if (actionPluginProbe && !actionPlugins.some((plugin) => plugin.name === actionPluginProbe.key)) {
+    return fail([
+      `Action Plugin probe is not configured in actionPlugins: ${actionPluginProbe.key}`
+    ]);
+  }
+  fs29.mkdirSync(path26.dirname(serverOutputRoot), { recursive: true });
+  const tempRoot = fs29.mkdtempSync(
+    path26.join(path26.dirname(serverOutputRoot), ".server-build-")
+  );
+  const tempOutfile = path26.join(tempRoot, "server.bundle.cjs");
+  try {
+    const result = await build({
+      absWorkingDir: projectRoot,
+      entryPoints: [entry],
+      outfile: tempOutfile,
+      bundle: true,
+      platform: "node",
+      format: "cjs",
+      target: "node22",
+      treeShaking: true,
+      keepNames: true,
+      legalComments: "none",
+      sourcemap: false,
+      metafile: true,
+      logLevel: "silent",
+      define: {
+        "import.meta.url": "__miaoda_server_cache_import_meta_url__"
+      },
+      banner: {
+        js: 'const __miaoda_server_cache_import_meta_url__ = require("node:url").pathToFileURL(__filename).href;'
+      },
+      plugins: [
+        rejectNativeAddonsPlugin(),
+        fullstackNestRuntimeResolver(projectRoot),
+        legacyFullstackNestOpenApiStub(projectRoot),
+        staticActionPluginRegistry(
+          projectRoot,
+          actionPlugins,
+          actionPluginProbe ?? void 0
+        ),
+        classTransformerStorageResolver(projectRoot),
+        optionalDependencyStubPlugin()
+      ]
+    });
+    if (!result.metafile) return fail(["esbuild metafile missing"]);
+    for (const warning of result.warnings) {
+      console.warn(
+        `[server-cache-bundle] WARN ${JSON.stringify({
+          kind: "esbuild-warning",
+          message: warning.text,
+          location: warning.location
+        })}`
+      );
+    }
+    const nativeInputs = Object.keys(result.metafile.inputs).filter(
+      (input) => input.endsWith(".node")
+    );
+    if (nativeInputs.length > 0) {
+      return fail([
+        `native addons are unsupported: ${nativeInputs.join(", ")}`
+      ]);
+    }
+    const externalImports = collectExternalImports(
+      result.metafile,
+      tempOutfile,
+      projectRoot
+    );
+    if (externalImports.length > 0) {
+      return fail([`external imports remain: ${externalImports.join(", ")}`]);
+    }
+    const buildOnlyInputs = collectBuildOnlyInputs(
+      projectRoot,
+      result.metafile
+    );
+    if (buildOnlyInputs.length > 0) {
+      return fail([
+        `build-only packages entered server cache bundle: ${buildOnlyInputs.join(", ")}`
+      ]);
+    }
+    const configuredRuntimeAssets = [
+      ...packageJson.miaodaCache?.runtimeAssets ?? [],
+      ...availabilityProbeConfig.legacyCapabilityProbe?.files.length ? [
+        {
+          source: "server/capabilities",
+          path: "server/capabilities"
+        }
+      ] : []
+    ];
+    const materializedRuntimeAssets = materializeServerRuntimeAssets(
+      projectRoot,
+      result.metafile,
+      tempRoot,
+      configuredRuntimeAssets
+    );
+    const runtimeAssets = materializedRuntimeAssets.assets;
+    const runtimeAssetWarnings = materializedRuntimeAssets.warnings;
+    const dynamicImportWarnings = collectDynamicImportWarnings(
+      projectRoot,
+      result.metafile
+    );
+    for (const warning of [...dynamicImportWarnings, ...runtimeAssetWarnings]) {
+      console.warn(`[server-cache-bundle] WARN ${JSON.stringify(warning)}`);
+    }
+    const availabilityProbe = await runAvailabilityProbe(
+      tempOutfile,
+      runtimeAssets,
+      options.probeTimeoutMs ?? 3e4,
+      availabilityProbeConfig,
+      actionPlugins.length,
+      actionPluginProbe?.key
+    );
+    if (!availabilityProbe.success || availabilityProbe.nodeModulesPresent) {
+      return fail([
+        "isolated node_modules-free availability probe failed",
+        ...availabilityProbe.checks.filter((check2) => !check2.success).map(
+          (check2) => `${check2.name}: ${check2.message ?? `HTTP ${check2.status ?? "unavailable"}`}`
+        ),
+        ...availabilityProbe.stderr ? [availabilityProbe.stderr] : [],
+        ...availabilityProbe.stdout ? [availabilityProbe.stdout] : []
+      ]);
+    }
+    const bundleSha256 = createHash("sha256").update(fs29.readFileSync(tempOutfile)).digest("hex");
+    const sealedAvailabilityProbe = {
+      success: availabilityProbe.success,
+      nodeModulesPresent: availabilityProbe.nodeModulesPresent,
+      startupMs: availabilityProbe.startupMs,
+      checks: availabilityProbe.checks,
+      ...availabilityProbe.stderr ? { stderr: availabilityProbe.stderr } : {}
+    };
+    const metadata = {
+      schemaVersion: 2,
+      entry: path26.relative(projectRoot, entry).split(path26.sep).join("/"),
+      outfile: "server/server.bundle.cjs",
+      nodeVersion: process.version,
+      nodeModuleAbi: process.versions.modules,
+      platform: process.platform,
+      arch: process.arch,
+      bundleBytes: fs29.statSync(tempOutfile).size,
+      bundleSha256,
+      inputFiles: Object.keys(result.metafile.inputs).length,
+      workspaceSourceSha256: workspaceSourceSha256(projectRoot),
+      externalImports,
+      dynamicImportWarnings,
+      runtimeAssetWarnings,
+      actionPlugins: actionPlugins.map(({ name, version }) => ({
+        name,
+        version
+      })),
+      runtimeAssets,
+      availabilityProbe: sealedAvailabilityProbe,
+      consumable: true
+    };
+    fs29.writeFileSync(
+      path26.join(tempRoot, path26.basename(metadataFile)),
+      `${JSON.stringify(metadata, null, 2)}
+`
+    );
+    fs29.mkdirSync(path26.dirname(serverOutputRoot), { recursive: true });
+    fs29.renameSync(tempRoot, serverOutputRoot);
+    return {
+      built: true,
+      outfile,
+      metadataFile,
+      bundleBytes: metadata.bundleBytes,
+      inputFiles: metadata.inputFiles,
+      externalImports,
+      dynamicImportWarnings,
+      runtimeAssetWarnings,
+      runtimeAssets,
+      actionPlugins: actionPlugins.map(({ name, version }) => ({
+        name,
+        version
+      })),
+      availabilityProbe,
+      reasons: [],
+      elapsedMs: Date.now() - startedAt
+    };
+  } catch (error) {
+    fs29.rmSync(serverOutputRoot, { recursive: true, force: true });
+    return fail([error instanceof Error ? error.message : String(error)]);
+  } finally {
+    fs29.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+// src/commands/build/server-runtime-dependencies.handler.ts
+import crypto from "crypto";
+import fs30 from "fs";
+import path27 from "path";
+import { createRequire as createRequire4 } from "module";
+import { nodeFileTrace } from "@vercel/nft";
+var DEFAULT_COMPILED_ENTRIES2 = [
+  "dist/server/main.js",
+  "dist/main.js"
+];
+var DEFAULT_SOURCE_ENTRIES = ["server/main.ts", "src/main.ts"];
+var TRANSITION_BOOTSTRAP_SPECIFIERS = [
+  "ts-node/register/transpile-only",
+  "tsconfig-paths/register"
+];
+var TRANSITION_TOOLCHAIN_TRACE_SPECIFIERS = ["typescript"];
+var PROJECT_ROOT_TOKEN = "${MIAODA_WORKSPACE_ROOT}";
+function isPathInside2(root, candidate) {
+  const relative = path27.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path27.isAbsolute(relative);
+}
+function sha256(file) {
+  return crypto.createHash("sha256").update(fs30.readFileSync(file)).digest("hex");
+}
+function resolveExistingFile(projectRoot, requested, defaults, label) {
+  if (requested) {
+    const candidate = path27.resolve(projectRoot, requested);
+    if (!fs30.existsSync(candidate) || !fs30.statSync(candidate).isFile()) {
+      throw new Error(`${label} missing: ${candidate}`);
+    }
+    return candidate;
+  }
+  const matches = defaults.map((relative) => path27.join(projectRoot, relative)).filter((candidate) => fs30.existsSync(candidate));
+  if (matches.length === 1) return matches[0];
+  if (matches.length > 1) {
+    throw new Error(
+      `${label} is ambiguous; pass it explicitly: ${matches.join(", ")}`
+    );
+  }
+  throw new Error(
+    `${label} missing; checked: ${defaults.map((relative) => path27.join(projectRoot, relative)).join(", ")}`
+  );
+}
+function packageLocationFromNodeModulesPath(candidate) {
+  const parts = candidate.split(/[\\/]+/);
+  const nodeModulesIndex = parts.lastIndexOf("node_modules");
+  if (nodeModulesIndex < 0 || nodeModulesIndex + 1 >= parts.length) {
+    return void 0;
+  }
+  const first = parts[nodeModulesIndex + 1];
+  let name;
+  let packageEnd;
+  if (first.startsWith("@")) {
+    const second = parts[nodeModulesIndex + 2];
+    if (!second) return void 0;
+    name = `${first}/${second}`;
+    packageEnd = nodeModulesIndex + 3;
+  } else {
+    name = first;
+    packageEnd = nodeModulesIndex + 2;
+  }
+  return {
+    name,
+    relativeRoot: parts.slice(0, packageEnd).join("/")
+  };
+}
+function packageRoot(nodeModulesRoot, packageName) {
+  return path27.join(nodeModulesRoot, ...packageName.split("/"));
+}
+function readPackage(nodeModulesRoot, packageName) {
+  const packageFile = path27.join(
+    packageRoot(nodeModulesRoot, packageName),
+    "package.json"
+  );
+  if (!fs30.existsSync(packageFile)) {
+    throw new Error(`runtime package is missing: ${packageName}`);
+  }
+  return JSON.parse(fs30.readFileSync(packageFile, "utf8"));
+}
+function parseJsonc(file, projectRequire) {
+  const typescript = projectRequire("typescript");
+  const parsed = typescript.parseConfigFileTextToJson(
+    file,
+    fs30.readFileSync(file, "utf8")
+  );
+  if (parsed.error || !parsed.config) {
+    throw new Error(
+      `tsconfig is invalid: ${file}: ${String(parsed.error?.messageText ?? "")}`
+    );
+  }
+  return parsed.config;
+}
+function resolveTsconfigPackageEntries(projectRoot, projectRequire) {
+  const entries = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const initial = ["tsconfig.node.json", "tsconfig.json"].map((relative) => path27.join(projectRoot, relative)).find((file) => fs30.existsSync(file));
+  if (!initial) return [];
+  const visit = (file) => {
+    const resolvedFile = fs30.realpathSync(file);
+    if (visited.has(resolvedFile)) return;
+    visited.add(resolvedFile);
+    const config = parseJsonc(resolvedFile, projectRequire);
+    if (typeof config.extends !== "string" || !config.extends) return;
+    const specifier = config.extends;
+    if (specifier.startsWith(".") || path27.isAbsolute(specifier)) {
+      const candidate = path27.resolve(path27.dirname(resolvedFile), specifier);
+      const configFile = fs30.existsSync(candidate) ? candidate : `${candidate}.json`;
+      if (!fs30.existsSync(configFile)) {
+        throw new Error(`tsconfig extends file is missing: ${specifier}`);
+      }
+      visit(configFile);
+      return;
+    }
+    let entry;
+    try {
+      entry = projectRequire.resolve(specifier);
+    } catch {
+      try {
+        entry = projectRequire.resolve(`${specifier}.json`);
+      } catch {
+        throw new Error(`tsconfig extends package is missing: ${specifier}`);
+      }
+    }
+    entries.add(entry);
+    if (entry.endsWith(".json")) visit(entry);
+  };
+  visit(initial);
+  return [...entries];
+}
+function transitionCompilerOptions(projectRoot, projectRequire) {
+  const configFile = ["tsconfig.node.json", "tsconfig.json"].map((relative) => path27.join(projectRoot, relative)).find((file) => fs30.existsSync(file));
+  if (!configFile) throw new Error("server tsconfig is missing");
+  const typescript = projectRequire("typescript");
+  let fatalDiagnostic = "";
+  const parsed = typescript.getParsedCommandLineOfConfigFile(
+    configFile,
+    {},
+    {
+      ...typescript.sys,
+      onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+        fatalDiagnostic = typescript.flattenDiagnosticMessageText(
+          diagnostic.messageText,
+          "\n"
+        );
+      }
+    }
+  );
+  const errors = parsed?.errors.filter((error) => error.category === typescript.DiagnosticCategory.Error).map(
+    (error) => typescript.flattenDiagnosticMessageText(error.messageText, "\n")
+  );
+  if (!parsed || fatalDiagnostic || errors?.length) {
+    throw new Error(
+      `server tsconfig cannot be resolved: ${fatalDiagnostic || errors?.join("; ") || configFile}`
+    );
+  }
+  const tokeniseProjectPaths = (value) => {
+    if (typeof value === "string" && path27.isAbsolute(value)) {
+      if (!isPathInside2(projectRoot, value)) {
+        throw new Error(`server compiler option path escaped project: ${value}`);
+      }
+      const relative = path27.relative(projectRoot, value).split(path27.sep).join("/");
+      return relative ? `${PROJECT_ROOT_TOKEN}/${relative}` : PROJECT_ROOT_TOKEN;
+    }
+    if (Array.isArray(value)) return value.map(tokeniseProjectPaths);
+    if (value && typeof value === "object") {
+      return Object.fromEntries(
+        Object.entries(value).map(([key, entry]) => [
+          key,
+          tokeniseProjectPaths(entry)
+        ])
+      );
+    }
+    return value;
+  };
+  return tokeniseProjectPaths(
+    Object.fromEntries(typescript.serializeCompilerOptions(parsed.options))
+  );
+}
+function collectDeclaredPluginClosure(nodeModulesRoot, seeds) {
+  const selected = new Set(seeds);
+  const pending = [...selected];
+  while (pending.length > 0) {
+    const packageName = pending.shift();
+    const packageJson = readPackage(nodeModulesRoot, packageName);
+    const declared = {
+      ...packageJson.dependencies ?? {},
+      ...packageJson.optionalDependencies ?? {},
+      ...packageJson.peerDependencies ?? {}
+    };
+    for (const dependencyName of Object.keys(declared)) {
+      if (!fs30.existsSync(packageRoot(nodeModulesRoot, dependencyName))) {
+        const optional = packageJson.peerDependenciesMeta?.[dependencyName]?.optional === true || Object.hasOwn(packageJson.optionalDependencies ?? {}, dependencyName);
+        if (optional) continue;
+        throw new Error(
+          `ActionPlugin runtime dependency ${dependencyName} required by ${packageName} is missing`
+        );
+      }
+      if (!selected.has(dependencyName)) {
+        selected.add(dependencyName);
+        pending.push(dependencyName);
+      }
+    }
+  }
+  return selected;
+}
+function copyDereferenced(source, destination) {
+  const stat = fs30.lstatSync(source);
+  if (stat.isSymbolicLink()) {
+    copyDereferenced(fs30.realpathSync(source), destination);
+    return;
+  }
+  if (stat.isDirectory()) {
+    fs30.mkdirSync(destination, { recursive: true });
+    for (const entry of fs30.readdirSync(source)) {
+      copyDereferenced(
+        path27.join(source, entry),
+        path27.join(destination, entry)
+      );
+    }
+    return;
+  }
+  if (!stat.isFile()) {
+    throw new Error(`unsupported runtime dependency file: ${source}`);
+  }
+  fs30.mkdirSync(path27.dirname(destination), { recursive: true });
+  fs30.copyFileSync(source, destination);
+  fs30.chmodSync(destination, stat.mode & 511);
+}
+function listRuntimeFiles(nodeModulesRoot) {
+  const files = [];
+  const visit = (directory) => {
+    for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path27.join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`runtime dependency cache contains symlink: ${candidate}`);
+      }
+      if (entry.isDirectory()) {
+        visit(candidate);
+      } else if (entry.isFile()) {
+        files.push({
+          path: path27.relative(nodeModulesRoot, candidate).split(path27.sep).join("/"),
+          sha256: sha256(candidate),
+          size: fs30.statSync(candidate).size
+        });
+      }
+    }
+  };
+  visit(nodeModulesRoot);
+  return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+function stableTreeSha256(files) {
+  return crypto.createHash("sha256").update(JSON.stringify(files)).digest("hex");
+}
+function validateOutput(projectRoot, outdir, metadataFile) {
+  const expectedRoot = path27.join(projectRoot, ".miaoda-cache");
+  if (!isPathInside2(expectedRoot, outdir) || path27.basename(outdir) !== "node_modules" || path27.basename(path27.dirname(outdir)) !== "server" || metadataFile !== path27.join(path27.dirname(outdir), "dependencies.json")) {
+    throw new Error(
+      "server runtime dependency output must be a .miaoda-cache/**/server/node_modules directory with adjacent dependencies.json"
+    );
+  }
+}
+async function buildServerRuntimeDependencies(options) {
+  const startedAt = Date.now();
+  const projectRoot = fs30.realpathSync(path27.resolve(options.projectRoot));
+  const outdir = path27.resolve(
+    projectRoot,
+    options.outdir ?? ".miaoda-cache/server/node_modules"
+  );
+  const metadataFile = path27.resolve(
+    projectRoot,
+    options.metadataFile ?? path27.join(path27.dirname(outdir), "dependencies.json")
+  );
+  const stagingRoot = path27.join(
+    path27.dirname(outdir),
+    `.dependencies-staging-${process.pid}-${Date.now()}`
+  );
+  const stagingNodeModules = path27.join(stagingRoot, "node_modules");
+  const serverOutputRoot = path27.dirname(outdir);
+  try {
+    validateOutput(projectRoot, outdir, metadataFile);
+    fs30.rmSync(serverOutputRoot, { recursive: true, force: true });
+    fs30.mkdirSync(serverOutputRoot, { recursive: true });
+    const compiledEntry = resolveExistingFile(
+      projectRoot,
+      options.entry,
+      DEFAULT_COMPILED_ENTRIES2,
+      "compiled Nest entry"
+    );
+    const sourceEntry = resolveExistingFile(
+      projectRoot,
+      options.sourceEntry,
+      DEFAULT_SOURCE_ENTRIES,
+      "Nest source entry"
+    );
+    const projectPackageFile = path27.join(projectRoot, "package.json");
+    const projectNodeModules = path27.join(projectRoot, "node_modules");
+    if (!fs30.existsSync(projectPackageFile) || !fs30.existsSync(projectNodeModules)) {
+      throw new Error("project package.json or node_modules is missing");
+    }
+    const projectPackage = JSON.parse(
+      fs30.readFileSync(projectPackageFile, "utf8")
+    );
+    const projectRequire = createRequire4(projectPackageFile);
+    const configuredPlatformRuntimeRoot = process.env.MIAODA_PLATFORM_RUNTIME_ROOT;
+    const platformNodeModules = configuredPlatformRuntimeRoot ? path27.join(
+      fs30.realpathSync(path27.resolve(configuredPlatformRuntimeRoot)),
+      "node_modules"
+    ) : void 0;
+    if (platformNodeModules && (!fs30.existsSync(platformNodeModules) || !fs30.statSync(platformNodeModules).isDirectory())) {
+      throw new Error(
+        `platform runtime node_modules is missing: ${platformNodeModules}`
+      );
+    }
+    const traceBase = platformNodeModules ? path27.parse(projectRoot).root : projectRoot;
+    const bootstrapEntries = TRANSITION_BOOTSTRAP_SPECIFIERS.map((specifier) => {
+      try {
+        return projectRequire.resolve(specifier);
+      } catch {
+        throw new Error(`transition bootstrap module is missing: ${specifier}`);
+      }
+    });
+    const toolchainTraceEntries = TRANSITION_TOOLCHAIN_TRACE_SPECIFIERS.map(
+      (specifier) => {
+        try {
+          return projectRequire.resolve(specifier);
+        } catch {
+          throw new Error(`transition toolchain module is missing: ${specifier}`);
+        }
+      }
+    );
+    const actionPluginNames = Object.keys(projectPackage.actionPlugins ?? {});
+    const actionPluginEntries = actionPluginNames.map((name) => {
+      try {
+        return projectRequire.resolve(name);
+      } catch {
+        throw new Error(`ActionPlugin entry is missing: ${name}`);
+      }
+    });
+    const tsconfigPackageEntries = resolveTsconfigPackageEntries(
+      projectRoot,
+      projectRequire
+    );
+    const compilerOptions = transitionCompilerOptions(
+      projectRoot,
+      projectRequire
+    );
+    const trace = await nodeFileTrace(
+      [
+        compiledEntry,
+        ...bootstrapEntries,
+        ...toolchainTraceEntries,
+        ...tsconfigPackageEntries,
+        ...actionPluginEntries
+      ],
+      {
+        base: traceBase,
+        processCwd: projectRoot,
+        ts: false,
+        conditions: ["node", "development"]
+      }
+    );
+    const tracedFiles = /* @__PURE__ */ new Map();
+    const packageLocations = /* @__PURE__ */ new Map();
+    const addTracedFile = (candidate) => {
+      let source = path27.isAbsolute(candidate) ? candidate : path27.resolve(traceBase, candidate);
+      if (!fs30.existsSync(source)) {
+        return;
+      }
+      const sourceStat = fs30.lstatSync(source);
+      if (sourceStat.isSymbolicLink()) {
+        const realSource = fs30.realpathSync(source);
+        if (fs30.statSync(realSource).isDirectory()) {
+          if (platformNodeModules && isPathInside2(platformNodeModules, realSource)) {
+            return;
+          }
+          throw new Error(`runtime dependency symlink is not trusted: ${source}`);
+        }
+        source = realSource;
+      }
+      const sourceNodeModules = [projectNodeModules, platformNodeModules].filter((root) => Boolean(root)).find((root) => isPathInside2(root, source));
+      if (!sourceNodeModules) {
+        return;
+      }
+      const relativeNodeModulesPath = path27.relative(sourceNodeModules, source);
+      const logicalProjectPath = path27.join("node_modules", relativeNodeModulesPath).split(path27.sep).join("/");
+      const location = packageLocationFromNodeModulesPath(logicalProjectPath);
+      if (!location) return;
+      const sourceRoot = path27.join(
+        sourceNodeModules,
+        ...location.relativeRoot.replace(/^node_modules\//, "").split("/")
+      );
+      const destinationRoot = path27.join(
+        stagingNodeModules,
+        ...location.relativeRoot.replace(/^node_modules\//, "").split("/")
+      );
+      packageLocations.set(location.relativeRoot, {
+        name: location.name,
+        destinationRoot
+      });
+      const addFile = (file, destination) => {
+        const previous = tracedFiles.get(destination);
+        if (previous && fs30.realpathSync(previous) !== fs30.realpathSync(file) && sha256(previous) !== sha256(file)) {
+          throw new Error(
+            `runtime dependency destination conflict: ${destination}`
+          );
+        }
+        tracedFiles.set(destination, file);
+      };
+      addFile(
+        source,
+        path27.join(stagingNodeModules, relativeNodeModulesPath)
+      );
+      addFile(
+        path27.join(sourceRoot, "package.json"),
+        path27.join(destinationRoot, "package.json")
+      );
+    };
+    for (const file of trace.fileList) {
+      addTracedFile(file);
+    }
+    for (const specifier of TRANSITION_BOOTSTRAP_SPECIFIERS) {
+      addTracedFile(projectRequire.resolve(specifier));
+    }
+    for (const specifier of TRANSITION_TOOLCHAIN_TRACE_SPECIFIERS) {
+      addTracedFile(projectRequire.resolve(specifier));
+    }
+    for (const entry of tsconfigPackageEntries) {
+      addTracedFile(entry);
+    }
+    const pluginClosure = collectDeclaredPluginClosure(
+      projectNodeModules,
+      actionPluginNames
+    );
+    fs30.rmSync(stagingRoot, { recursive: true, force: true });
+    fs30.mkdirSync(stagingNodeModules, { recursive: true });
+    for (const [destination, source] of [...tracedFiles.entries()].sort(
+      ([left], [right]) => left.localeCompare(right)
+    )) {
+      if (!fs30.existsSync(source) || !fs30.statSync(source).isFile()) {
+        throw new Error(`traced runtime dependency file is missing: ${source}`);
+      }
+      copyDereferenced(source, destination);
+    }
+    for (const packageName of [...pluginClosure].sort()) {
+      const sourceRoot = packageRoot(projectNodeModules, packageName);
+      const destinationRoot = packageRoot(stagingNodeModules, packageName);
+      packageLocations.set(`node_modules/${packageName}`, {
+        name: packageName,
+        destinationRoot
+      });
+      fs30.rmSync(destinationRoot, { recursive: true, force: true });
+      copyDereferenced(sourceRoot, destinationRoot);
+    }
+    const files = listRuntimeFiles(stagingNodeModules);
+    const packages = [...packageLocations.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([, location]) => ({
+      name: location.name,
+      version: String(
+        JSON.parse(
+          fs30.readFileSync(
+            path27.join(location.destinationRoot, "package.json"),
+            "utf8"
+          )
+        ).version ?? ""
+      )
+    }));
+    if (packages.some((pkg2) => !pkg2.version)) {
+      throw new Error("runtime dependency package version is missing");
+    }
+    const actionPlugins = actionPluginNames.sort().map((name) => {
+      const installedVersion = String(
+        readPackage(stagingNodeModules, name).version ?? ""
+      );
+      const declaredVersion = String(projectPackage.actionPlugins[name]);
+      if (!installedVersion || declaredVersion !== installedVersion) {
+        throw new Error(
+          `ActionPlugin version mismatch: ${name} declared=${declaredVersion} installed=${installedVersion}`
+        );
+      }
+      return { name, version: installedVersion };
+    });
+    const metadata = {
+      schemaVersion: 1,
+      sourceEntry: path27.relative(projectRoot, sourceEntry).split(path27.sep).join("/"),
+      compiledEntry: path27.relative(projectRoot, compiledEntry).split(path27.sep).join("/"),
+      nodeVersion: process.version,
+      nodeModuleAbi: process.versions.modules,
+      platform: process.platform,
+      arch: process.arch,
+      bootstrapModules: [...TRANSITION_BOOTSTRAP_SPECIFIERS],
+      transitionCompilerOptions: compilerOptions,
+      packages,
+      actionPlugins,
+      files,
+      treeSha256: stableTreeSha256(files),
+      fileCount: files.length,
+      totalBytes: files.reduce((total, file) => total + file.size, 0)
+    };
+    fs30.writeFileSync(
+      path27.join(stagingRoot, "dependencies.json"),
+      `${JSON.stringify(metadata, null, 2)}
+`
+    );
+    fs30.rmSync(outdir, { recursive: true, force: true });
+    fs30.rmSync(metadataFile, { force: true });
+    fs30.renameSync(stagingNodeModules, outdir);
+    fs30.renameSync(path27.join(stagingRoot, "dependencies.json"), metadataFile);
+    fs30.rmSync(stagingRoot, { recursive: true, force: true });
+    return {
+      built: true,
+      outdir,
+      metadataFile,
+      packages,
+      actionPlugins,
+      fileCount: metadata.fileCount,
+      totalBytes: metadata.totalBytes,
+      elapsedMs: Date.now() - startedAt,
+      reasons: []
+    };
+  } catch (error) {
+    fs30.rmSync(serverOutputRoot, { recursive: true, force: true });
+    return {
+      built: false,
+      elapsedMs: Date.now() - startedAt,
+      reasons: [error instanceof Error ? error.message : String(error)]
+    };
+  }
+}
+
+// src/commands/build/app-runtime-manifest.handler.ts
+import fs32 from "fs";
+import path29 from "path";
+
+// src/client-dependency-graph.ts
+import crypto2 from "crypto";
+import fs31 from "fs";
+import path28 from "path";
+import { builtinModules as builtinModules2 } from "module";
+import { Node as Node11, Project as Project4, SyntaxKind as SyntaxKind7 } from "ts-morph";
+var BUILTIN_MODULES = /* @__PURE__ */ new Set([
+  ...builtinModules2,
+  ...builtinModules2.map((name) => `node:${name}`)
+]);
+var SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+var STYLE_EXTENSIONS = [
+  ".css",
+  ".less",
+  ".sass",
+  ".scss",
+  ".styl",
+  ".stylus"
+];
+function packageNameFromSpecifier(specifier) {
+  if (!specifier || specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("\0") || specifier.includes("://") || BUILTIN_MODULES.has(specifier)) {
+    return void 0;
+  }
+  const parts = specifier.split("/");
+  return specifier.startsWith("@") ? parts.length >= 2 ? `${parts[0]}/${parts[1]}` : void 0 : parts[0];
+}
+function isStyleSpecifier(specifier) {
+  return STYLE_EXTENSIONS.some(
+    (extension) => new RegExp(`\\${extension}(?:$|\\?)`, "i").test(specifier)
+  );
+}
+function resolveLocalFile(specifier, importer, projectRoot, clientRoot) {
+  let candidate;
+  if (specifier.startsWith("@/")) {
+    candidate = path28.join(clientRoot, "src", specifier.slice(2));
+  } else if (specifier.startsWith("@client/")) {
+    candidate = path28.join(clientRoot, specifier.slice("@client/".length));
+  } else if (specifier.startsWith("@shared/")) {
+    candidate = path28.join(
+      projectRoot,
+      "shared",
+      specifier.slice("@shared/".length)
+    );
+  } else if (specifier.startsWith(".") || path28.isAbsolute(specifier)) {
+    candidate = path28.resolve(path28.dirname(importer), specifier);
+  }
+  if (!candidate) return void 0;
+  const projectRelative = path28.relative(projectRoot, path28.resolve(candidate));
+  if (projectRelative === ".." || projectRelative.startsWith(`..${path28.sep}`) || path28.isAbsolute(projectRelative)) {
+    throw new Error(
+      `MIAODA_CLIENT_SOURCE_PATH_ESCAPE: ${specifier} from ${path28.relative(
+        projectRoot,
+        importer
+      )}`
+    );
+  }
+  const extensions = [...SOURCE_EXTENSIONS, ...STYLE_EXTENSIONS];
+  const candidates = [
+    candidate,
+    ...extensions.map((extension) => `${candidate}${extension}`),
+    ...extensions.map((extension) => path28.join(candidate, `index${extension}`))
+  ];
+  const resolvedFile = candidates.find((file) => {
+    try {
+      return fs31.statSync(file).isFile();
+    } catch {
+      return false;
+    }
+  });
+  if (!resolvedFile) return void 0;
+  const realProjectRoot = fs31.realpathSync(projectRoot);
+  const realFile = fs31.realpathSync(resolvedFile);
+  const relative = path28.relative(realProjectRoot, realFile);
+  if (relative === ".." || relative.startsWith(`..${path28.sep}`) || path28.isAbsolute(relative)) {
+    throw new Error(`MIAODA_CLIENT_SOURCE_SYMLINK_ESCAPE: ${resolvedFile}`);
+  }
+  return resolvedFile;
+}
+function discoverClientSpecifiers(projectRoot, scanAllSourceFiles = false) {
+  const clientRoot = fs31.existsSync(path28.join(projectRoot, "client")) ? path28.join(projectRoot, "client") : projectRoot;
+  if (!fs31.existsSync(path28.join(clientRoot, "src"))) {
+    return { specifiers: [], optimizeDependencies: [] };
+  }
+  const project = new Project4({
+    skipAddingFilesFromTsConfig: true,
+    compilerOptions: { allowJs: true, jsx: 2 }
+  });
+  const specifiers = /* @__PURE__ */ new Set();
+  const optimizeDependencies = /* @__PURE__ */ new Set();
+  const pending = SOURCE_EXTENSIONS.map(
+    (extension) => path28.join(clientRoot, "src", `index${extension}`)
+  ).filter((file) => fs31.existsSync(file));
+  if (scanAllSourceFiles) {
+    const visit = (directory) => {
+      for (const entry of fs31.readdirSync(directory, { withFileTypes: true })) {
+        const file = path28.join(directory, entry.name);
+        if (entry.isSymbolicLink()) {
+          throw new Error(`MIAODA_CLIENT_SOURCE_SYMLINK_REJECTED: ${file}`);
+        }
+        if (entry.isDirectory()) visit(file);
+        else if (entry.isFile() && [...SOURCE_EXTENSIONS, ...STYLE_EXTENSIONS].includes(
+          path28.extname(file)
+        )) {
+          pending.push(file);
+        }
+      }
+    };
+    visit(path28.join(clientRoot, "src"));
+  }
+  const visited = /* @__PURE__ */ new Set();
+  const addBare = (specifier, optimize) => {
+    if (!packageNameFromSpecifier(specifier)) return;
+    specifiers.add(specifier);
+    if (optimize) optimizeDependencies.add(specifier);
+  };
+  const traverse = (specifier, importer, optimize = true) => {
+    const dependency = resolveLocalFile(
+      specifier,
+      importer,
+      projectRoot,
+      clientRoot
+    );
+    if (dependency) pending.push(dependency);
+    else addBare(specifier, optimize && !isStyleSpecifier(specifier));
+  };
+  while (pending.length > 0) {
+    const sourcePath = path28.resolve(pending.pop());
+    if (visited.has(sourcePath)) continue;
+    visited.add(sourcePath);
+    if (STYLE_EXTENSIONS.includes(path28.extname(sourcePath))) {
+      const css = fs31.readFileSync(sourcePath, "utf8");
+      for (const match of css.matchAll(
+        /@(import|plugin)\s+(?:url\(\s*)?["']([^"']+)["']/g
+      )) {
+        traverse(match[2], sourcePath, false);
+      }
+      for (const match of css.matchAll(/@source\s+["']([^"']+)["']/g)) {
+        const marker = /(?:^|[\\/])node_modules[\\/]((?:@[^\\/]+[\\/])?[^\\/*?{}]+)/.exec(
+          match[1]
+        );
+        if (marker) addBare(marker[1].replace(/\\/g, "/"), false);
+      }
+      continue;
+    }
+    const sourceFile = project.addSourceFileAtPath(sourcePath);
+    for (const declaration of sourceFile.getImportDeclarations()) {
+      if (declaration.isTypeOnly()) continue;
+      const namedImports = declaration.getNamedImports();
+      const hasRuntimeBinding = Boolean(declaration.getDefaultImport()) || Boolean(declaration.getNamespaceImport()) || namedImports.length === 0 || namedImports.some((specifier) => !specifier.isTypeOnly());
+      if (hasRuntimeBinding) {
+        traverse(declaration.getModuleSpecifierValue(), sourcePath);
+      }
+    }
+    for (const declaration of sourceFile.getExportDeclarations()) {
+      if (declaration.isTypeOnly()) continue;
+      const namedExports = declaration.getNamedExports();
+      const specifier = declaration.getModuleSpecifierValue();
+      if (specifier && (namedExports.length === 0 || namedExports.some((namedExport) => !namedExport.isTypeOnly()))) {
+        traverse(specifier, sourcePath);
+      }
+    }
+    for (const call of sourceFile.getDescendantsOfKind(
+      SyntaxKind7.CallExpression
+    )) {
+      const expression = call.getExpression();
+      const isDynamicImport = expression.getKind() === SyntaxKind7.ImportKeyword;
+      const isRequire = Node11.isIdentifier(expression) && expression.getText() === "require";
+      if (!isDynamicImport && !isRequire) continue;
+      const argument = call.getArguments()[0];
+      if (!argument || !Node11.isStringLiteral(argument)) {
+        throw new Error(
+          `MIAODA_CLIENT_DYNAMIC_DEPENDENCY_UNSUPPORTED: ${path28.relative(
+            projectRoot,
+            sourcePath
+          )}:${call.getStartLineNumber()}`
+        );
+      }
+      traverse(argument.getLiteralValue(), sourcePath);
+    }
+  }
+  return {
+    specifiers: [...specifiers].sort(),
+    optimizeDependencies: [...optimizeDependencies].sort()
+  };
+}
+function parentPackagePath(packagePath) {
+  const nestedMarker = packagePath.lastIndexOf("/node_modules/");
+  if (nestedMarker >= 0) return packagePath.slice(0, nestedMarker);
+  return packagePath.startsWith("node_modules/") ? "" : void 0;
+}
+function resolveLockedPackagePath(packages, fromPackagePath, packageName) {
+  let current = fromPackagePath;
+  while (current !== void 0) {
+    const candidate = current ? `${current}/node_modules/${packageName}` : `node_modules/${packageName}`;
+    if (packages[candidate]?.version) return candidate;
+    current = current ? parentPackagePath(current) : void 0;
+  }
+  return void 0;
+}
+function canonicalize(value) {
+  return JSON.stringify(value);
+}
+function clientConfigFiles(projectRoot) {
+  const fixedNames = [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vite.config.js",
+    "vite.config.mjs",
+    "vite.config.cjs",
+    "postcss.config.js",
+    "postcss.config.cjs",
+    "postcss.config.mjs",
+    "tailwind.config.ts",
+    "tailwind.config.js",
+    "tailwind.config.cjs",
+    "tailwind.config.mjs",
+    "tsconfig.json",
+    "tsconfig.app.json",
+    "tsconfig.node.json",
+    ".env",
+    ".env.development",
+    ".env.development.local"
+  ];
+  const pending = fixedNames.map((name) => path28.join(projectRoot, name));
+  for (const patchRootName of ["patches", ".yarn/patches"]) {
+    const patchRoot = path28.join(projectRoot, patchRootName);
+    if (!fs31.existsSync(patchRoot)) continue;
+    const visit = (directory) => {
+      for (const entry of fs31.readdirSync(directory, { withFileTypes: true })) {
+        const file = path28.join(directory, entry.name);
+        if (entry.isSymbolicLink()) {
+          throw new Error(`MIAODA_CLIENT_CONFIG_SYMLINK_REJECTED: ${file}`);
+        }
+        if (entry.isDirectory()) visit(file);
+        else if (entry.isFile()) pending.push(file);
+      }
+    };
+    visit(patchRoot);
+  }
+  const visited = /* @__PURE__ */ new Set();
+  const result = [];
+  const resolveRelativeConfig = (specifier, importer) => {
+    if (!specifier.startsWith(".")) return void 0;
+    const candidate = path28.resolve(path28.dirname(importer), specifier);
+    const candidates = [
+      candidate,
+      ...[...SOURCE_EXTENSIONS, ".json"].map(
+        (extension) => `${candidate}${extension}`
+      ),
+      ...[...SOURCE_EXTENSIONS, ".json"].map(
+        (extension) => path28.join(candidate, `index${extension}`)
+      )
+    ];
+    return candidates.find((file) => {
+      const relative = path28.relative(projectRoot, file);
+      return relative !== ".." && !relative.startsWith(`..${path28.sep}`) && !path28.isAbsolute(relative) && fs31.existsSync(file) && fs31.statSync(file).isFile();
+    });
+  };
+  while (pending.length > 0) {
+    const file = path28.resolve(pending.pop());
+    if (visited.has(file) || !fs31.existsSync(file) || !fs31.statSync(file).isFile()) {
+      continue;
+    }
+    visited.add(file);
+    const content = fs31.readFileSync(file);
+    result.push({
+      path: path28.relative(projectRoot, file),
+      sha256: crypto2.createHash("sha256").update(content).digest("hex")
+    });
+    if (SOURCE_EXTENSIONS.includes(path28.extname(file))) {
+      const source = content.toString("utf8");
+      for (const match of source.matchAll(
+        /(?:from\s*|import\s*\(|require\s*\()\s*["']([^"']+)["']/g
+      )) {
+        const dependency = resolveRelativeConfig(match[1], file);
+        if (dependency) pending.push(dependency);
+      }
+    } else if (path28.extname(file) === ".json") {
+      try {
+        const json = JSON.parse(content.toString("utf8"));
+        for (const specifier of [
+          json.extends,
+          ...(json.references ?? []).map((reference) => reference.path)
+        ]) {
+          if (!specifier) continue;
+          const dependency = resolveRelativeConfig(specifier, file);
+          if (dependency) pending.push(dependency);
+        }
+      } catch {
+      }
+    }
+  }
+  return result.sort((left, right) => left.path.localeCompare(right.path));
+}
+function clientConfigEnvironment() {
+  const names = [
+    "APP_FLAGS",
+    "ASSETS_CDN_PATH",
+    "BUILD_TOOL",
+    "CLIENT_BASE_PATH",
+    "DISABLE_INSPECTOR",
+    "FORCE_FRAMEWORK_BUILD_LOOSE_MODE",
+    "FORCE_FRAMEWORK_DOMAIN_MAIN",
+    "FORCE_FRAMEWORK_ENVIRONMENT",
+    "MIAODA_APP_ARCH_TYPE",
+    "MIAODA_APP_SOURCE",
+    "MIAODA_APP_TYPE",
+    "MIAODA_FONTS_MIRROR_OFF",
+    "NEED_ROUTES",
+    "STATIC_ASSETS_BASE_URL",
+    "__API_ROUTE_DEFINITIONS__",
+    "__PAGE_ROUTE_DEFINITIONS__"
+  ];
+  return Object.fromEntries(
+    names.map((name) => [
+      name,
+      crypto2.createHash("sha256").update(process.env[name] ?? "").digest("hex")
+    ])
+  );
+}
+function installedDependencyLockFile(projectRoot) {
+  const hiddenLock = path28.join(
+    projectRoot,
+    "node_modules",
+    ".package-lock.json"
+  );
+  if (fs31.existsSync(hiddenLock)) {
+    if (fs31.lstatSync(hiddenLock).isSymbolicLink() || !fs31.statSync(hiddenLock).isFile()) {
+      throw new Error("MIAODA_NPM_HIDDEN_PACKAGE_LOCK_INVALID");
+    }
+    return hiddenLock;
+  }
+  return path28.join(projectRoot, "package-lock.json");
+}
+function buildClientDependencyGraph(options) {
+  const projectRoot = path28.resolve(options.projectRoot);
+  const packageLockFile = installedDependencyLockFile(projectRoot);
+  const lock = JSON.parse(
+    fs31.readFileSync(packageLockFile, "utf8")
+  );
+  if (!lock.packages || (lock.lockfileVersion ?? 0) < 2) {
+    throw new Error("MIAODA_NPM_PACKAGE_LOCK_V2_REQUIRED");
+  }
+  const discovery = discoverClientSpecifiers(
+    projectRoot,
+    options.includeAllProductionDependencies === true
+  );
+  if (options.includeAllProductionDependencies) {
+    const packageJson = JSON.parse(
+      fs31.readFileSync(path28.join(projectRoot, "package.json"), "utf8")
+    );
+    for (const specifier of Object.keys(packageJson.dependencies ?? {})) {
+      if (!lock.packages[`node_modules/${specifier}`]?.version) continue;
+      if (!discovery.specifiers.includes(specifier)) {
+        discovery.specifiers.push(specifier);
+      }
+    }
+  }
+  const implicitSpecifiers = [
+    "react",
+    "react-dom",
+    "react/jsx-runtime",
+    "react/jsx-dev-runtime",
+    "clsx",
+    "echarts",
+    "echarts-for-react",
+    "@lark-apaas/client-toolkit/runtime",
+    ...process.env.DISABLE_INSPECTOR === "true" ? [] : ["@lark-apaas/miaoda-inspector"]
+  ];
+  for (const specifier of implicitSpecifiers) {
+    const packageName = packageNameFromSpecifier(specifier);
+    if (lock.packages[`node_modules/${packageName}`]?.version && !discovery.specifiers.includes(specifier)) {
+      discovery.specifiers.push(specifier);
+      discovery.optimizeDependencies.push(specifier);
+    }
+  }
+  discovery.specifiers.sort();
+  discovery.optimizeDependencies.sort();
+  const entries = discovery.specifiers.map((specifier) => {
+    const packageName = packageNameFromSpecifier(specifier);
+    const packagePath = resolveLockedPackagePath(
+      lock.packages,
+      "",
+      packageName
+    );
+    if (!packagePath) {
+      throw new Error(`MIAODA_CLIENT_DEPENDENCY_LOCK_MISSING: ${specifier}`);
+    }
+    return { specifier, packagePath };
+  });
+  const pending = [...new Set(entries.map((entry) => entry.packagePath))];
+  const graphPackages = /* @__PURE__ */ new Map();
+  while (pending.length > 0) {
+    const packagePath = pending.pop();
+    if (graphPackages.has(packagePath)) continue;
+    const lockedPackage = lock.packages[packagePath];
+    if (!lockedPackage?.version) {
+      throw new Error(`MIAODA_CLIENT_DEPENDENCY_LOCK_MISSING: ${packagePath}`);
+    }
+    const edges = {};
+    const addEdge = (name, required) => {
+      const resolvedPath = resolveLockedPackagePath(
+        lock.packages,
+        packagePath,
+        name
+      );
+      if (!resolvedPath) {
+        if (required) {
+          throw new Error(
+            `MIAODA_CLIENT_DEPENDENCY_EDGE_MISSING: ${packagePath} -> ${name}`
+          );
+        }
+        return;
+      }
+      edges[name] = resolvedPath;
+      pending.push(resolvedPath);
+    };
+    for (const name of Object.keys(lockedPackage.dependencies ?? {}).sort()) {
+      addEdge(name, true);
+    }
+    for (const name of Object.keys(
+      lockedPackage.optionalDependencies ?? {}
+    ).sort()) {
+      addEdge(name, false);
+    }
+    for (const name of Object.keys(
+      lockedPackage.peerDependencies ?? {}
+    ).sort()) {
+      addEdge(
+        name,
+        lockedPackage.peerDependenciesMeta?.[name]?.optional !== true
+      );
+    }
+    graphPackages.set(packagePath, {
+      path: packagePath,
+      version: lockedPackage.version,
+      integrity: lockedPackage.integrity ?? null,
+      edges: Object.fromEntries(
+        Object.entries(edges).sort(
+          ([left], [right]) => left.localeCompare(right)
+        )
+      )
+    });
+  }
+  const graph = {
+    schemaVersion: 1,
+    algorithm: "npm-installed-client-closure-v2",
+    runtimeAbiHash: options.runtimeAbiHash,
+    resolveConditions: ["browser", "development", "module", "import"],
+    configFiles: clientConfigFiles(projectRoot),
+    configEnvironment: clientConfigEnvironment(),
+    entries,
+    packages: [...graphPackages.values()].sort(
+      (left, right) => left.path.localeCompare(right.path)
+    )
+  };
+  return {
+    graph,
+    hash: crypto2.createHash("sha256").update(canonicalize(graph)).digest("hex"),
+    optimizeDependencies: discovery.optimizeDependencies
+  };
+}
+
+// src/commands/build/app-runtime-manifest.handler.ts
+var VITE_PRESETS = [
+  "@lark-apaas/coding-preset-vite-react",
+  "@lark-apaas/coding-vite-preset",
+  "@lark-apaas/fullstack-vite-preset"
+];
+function detectApplicationRuntime(projectRoot, packageJson) {
+  const features = packageJson?.mclaw?.features;
+  const declaredPackages = {
+    ...packageJson?.dependencies ?? {},
+    ...packageJson?.devDependencies ?? {}
+  };
+  const usesCodingVitePreset = VITE_PRESETS.slice(0, 2).some(
+    (name) => declaredPackages[name] !== void 0
+  );
+  const hasServerRuntime = packageJson?.scripts?.["dev:server"] !== void 0 || declaredPackages["@nestjs/core"] !== void 0 || fs32.existsSync(path29.join(projectRoot, "server", "main.ts")) || fs32.existsSync(path29.join(projectRoot, "server", "src", "main.ts"));
+  const hasClientOnlyMetadata = Array.isArray(features) && features.includes("client") && !features.includes("server");
+  const applicationKind = !hasServerRuntime && (hasClientOnlyMetadata || usesCodingVitePreset) ? "frontend-only" : "fullstack";
+  const vitePreset = VITE_PRESETS.find((name) => declaredPackages[name] !== void 0) ?? "@lark-apaas/fullstack-vite-preset";
+  const entryCandidates = [
+    "client/src/index.tsx",
+    "client/src/main.tsx",
+    "src/index.tsx",
+    "src/main.tsx"
+  ];
+  const clientEntry = entryCandidates.find(
+    (relativePath) => fs32.existsSync(path29.join(projectRoot, relativePath))
+  );
+  if (!clientEntry) {
+    throw new Error("client entry missing");
+  }
+  return {
+    applicationKind,
+    vitePreset,
+    clientRoot: clientEntry.startsWith("client/") ? "client" : ".",
+    clientEntry
+  };
+}
+function buildAppRuntimeManifest(options) {
+  const projectRoot = path29.resolve(options.projectRoot);
+  const outfile = path29.resolve(
+    projectRoot,
+    options.outfile ?? ".miaoda-cache/app-runtime.json"
+  );
+  const runtimeManifestFile = path29.isAbsolute(options.runtimeManifestFile) ? options.runtimeManifestFile : path29.resolve(projectRoot, options.runtimeManifestFile);
+  const requiredFiles = [
+    path29.join(projectRoot, "package.json"),
+    path29.join(projectRoot, "package-lock.json"),
+    runtimeManifestFile
+  ];
+  fs32.rmSync(outfile, { force: true });
+  const missing = requiredFiles.filter((file) => !fs32.existsSync(file));
+  if (missing.length > 0) {
+    return {
+      built: false,
+      reasons: missing.map((file) => `input missing: ${file}`)
+    };
+  }
+  try {
+    const packageJson = JSON.parse(
+      fs32.readFileSync(path29.join(projectRoot, "package.json"), "utf8")
+    );
+    const runtime = JSON.parse(
+      fs32.readFileSync(runtimeManifestFile, "utf8")
+    );
+    if (runtime.schemaVersion !== 1 || !runtime.runtimeAbiHash) {
+      return {
+        built: false,
+        reasons: ["unsupported platform runtime manifest"]
+      };
+    }
+    const applicationRuntime = detectApplicationRuntime(
+      projectRoot,
+      packageJson
+    );
+    const client = buildClientDependencyGraph({
+      projectRoot,
+      runtimeAbiHash: runtime.runtimeAbiHash,
+      includeAllProductionDependencies: applicationRuntime.applicationKind === "frontend-only"
+    });
+    const manifest = {
+      schemaVersion: 1,
+      runtimeAbiHash: runtime.runtimeAbiHash,
+      ...applicationRuntime,
+      clientDependencyGraphHash: client.hash,
+      clientDependencyGraph: client.graph,
+      optimizeDependencies: client.optimizeDependencies
+    };
+    fs32.mkdirSync(path29.dirname(outfile), { recursive: true });
+    const temporaryFile = `${outfile}.${process.pid}.${Date.now()}.tmp`;
+    fs32.writeFileSync(temporaryFile, `${JSON.stringify(manifest, null, 2)}
+`);
+    fs32.renameSync(temporaryFile, outfile);
+    return {
+      built: true,
+      outfile,
+      runtimeAbiHash: runtime.runtimeAbiHash,
+      ...applicationRuntime,
+      clientDependencyGraphHash: client.hash,
+      clientDependencyGraph: client.graph,
+      optimizeDependencies: client.optimizeDependencies,
+      reasons: []
+    };
+  } catch (error) {
+    fs32.rmSync(outfile, { force: true });
+    return {
+      built: false,
+      reasons: [error instanceof Error ? error.message : String(error)]
+    };
+  }
+}
+
+// src/commands/build/cache-generation.handler.ts
+import crypto3 from "crypto";
+import fs33 from "fs";
+import path30 from "path";
+function sha2562(file) {
+  return crypto3.createHash("sha256").update(fs33.readFileSync(file)).digest("hex");
+}
+function listRegularFiles(root) {
+  const files = [];
+  const visit = (directory) => {
+    for (const entry of fs33.readdirSync(directory, { withFileTypes: true })) {
+      const file = path30.join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`vite cache symlink is not supported: ${file}`);
+      }
+      if (entry.isDirectory()) {
+        visit(file);
+      } else if (entry.isFile()) {
+        files.push(file);
+      }
+    }
+  };
+  visit(root);
+  return files.sort();
+}
+var WORKSPACE_SOURCE_ROOTS = ["client", "server", "shared", "src"];
+var WORKSPACE_SOURCE_FILES = [
+  ".env",
+  ".env.development",
+  ".env.development.local",
+  "drizzle.config.ts",
+  "nest-cli.json",
+  "postcss.config.js",
+  "postcss.config.cjs",
+  "postcss.config.mjs",
+  "tailwind.config.ts",
+  "tailwind.config.js",
+  "tailwind.config.cjs",
+  "tailwind.config.mjs",
+  "tsconfig.json",
+  "tsconfig.app.json",
+  "tsconfig.node.json",
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.cjs"
+];
+function listWorkspaceSourceFiles(projectRoot) {
+  const files = WORKSPACE_SOURCE_ROOTS.flatMap((relativeRoot) => {
+    const root = path30.join(projectRoot, relativeRoot);
+    return fs33.existsSync(root) ? listRegularFiles(root) : [];
+  });
+  for (const relativeFile of WORKSPACE_SOURCE_FILES) {
+    const file = path30.join(projectRoot, relativeFile);
+    if (!fs33.existsSync(file)) continue;
+    if (fs33.lstatSync(file).isSymbolicLink() || !fs33.statSync(file).isFile()) {
+      throw new Error(`workspace source file is invalid: ${file}`);
+    }
+    files.push(file);
+  }
+  return [...new Set(files)].sort().map((file) => ({
+    path: path30.relative(projectRoot, file).split(path30.sep).join("/"),
+    sha256: sha2562(file),
+    size: fs33.statSync(file).size
+  }));
+}
+function canonicalJson(value) {
+  if (Array.isArray(value)) return value.map(canonicalJson);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, canonicalJson(child)])
+    );
+  }
+  return value;
+}
+function workspaceBuildInputs(projectRoot) {
+  const packageJsonFile = path30.join(projectRoot, "package.json");
+  const packageJson = fs33.existsSync(packageJsonFile) ? JSON.parse(fs33.readFileSync(packageJsonFile, "utf8")) : {};
+  return {
+    // Dependency versions deliberately remain governed by the recursive
+    // client graph and bundled server artifact. Only package.json fields that
+    // directly change bundle construction belong in this source binding.
+    actionPlugins: canonicalJson(packageJson.actionPlugins ?? {})
+  };
+}
+function packageNameFromOptimizerId(id) {
+  const specifier = id.split(" > ").at(-1) ?? id;
+  if (!specifier || specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("\0") || specifier.includes("://")) {
+    return void 0;
+  }
+  const parts = specifier.split("/");
+  return specifier.startsWith("@") ? parts.length >= 2 ? `${parts[0]}/${parts[1]}` : void 0 : parts[0];
+}
+function isPathInside3(root, candidate) {
+  const relative = path30.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path30.isAbsolute(relative);
+}
+function isCanonicalRelativeAssetPath(candidate) {
+  return typeof candidate === "string" && candidate.length > 0 && candidate === path30.posix.normalize(candidate) && candidate !== "." && !candidate.startsWith("../") && !path30.posix.isAbsolute(candidate) && !candidate.includes("\\");
+}
+function optimizerEntryUsesRuntimePackage(options) {
+  const variants = options.runtime.packages?.[options.packageName];
+  if (!Array.isArray(variants) || variants.length === 0) return false;
+  if (typeof options.entry?.src !== "string" || !options.entry.src)
+    return false;
+  const source = path30.isAbsolute(options.entry.src) ? options.entry.src : path30.resolve(options.projectRoot, options.entry.src);
+  if (!fs33.existsSync(source)) return false;
+  const realSource = fs33.realpathSync(source);
+  const runtimeRoot = path30.dirname(path30.resolve(options.runtimeManifestFile));
+  return variants.some((variant) => {
+    if (typeof variant.relativePath !== "string" || !variant.relativePath) {
+      return false;
+    }
+    const packageRoot2 = path30.resolve(runtimeRoot, variant.relativePath);
+    if (!isPathInside3(runtimeRoot, packageRoot2) || !fs33.existsSync(packageRoot2)) {
+      return false;
+    }
+    return isPathInside3(fs33.realpathSync(packageRoot2), realSource);
+  });
+}
+var REQUIRED_SERVER_PROBE_CHECKS = [
+  "isolated-node-modules",
+  "runtime-assets",
+  "http-readiness",
+  "business-api",
+  "process-alive",
+  "module-resolution"
+];
+function serverMetadataIsConsumable(serverMetadata) {
+  const warningsAreValid = Array.isArray(serverMetadata?.dynamicImportWarnings) && serverMetadata.dynamicImportWarnings.every(
+    (warning) => typeof warning?.kind === "string" && typeof warning?.source === "string" && /^[a-f0-9]{16}$/.test(warning?.expressionHash ?? "") && typeof warning?.message === "string"
+  );
+  const runtimeAssetWarningsAreValid = Array.isArray(serverMetadata?.runtimeAssetWarnings) && serverMetadata.runtimeAssetWarnings.every(
+    (warning) => typeof warning?.kind === "string" && typeof warning?.source === "string" && /^[a-f0-9]{16}$/.test(warning?.expressionHash ?? "") && typeof warning?.message === "string"
+  );
+  const actionPluginsAreValid = Array.isArray(serverMetadata?.actionPlugins) && serverMetadata.actionPlugins.every(
+    (plugin) => typeof plugin?.name === "string" && plugin.name.length > 0 && typeof plugin?.version === "string" && plugin.version.length > 0
+  );
+  const checks = serverMetadata?.availabilityProbe?.checks;
+  const checkNames = Array.isArray(checks) ? checks.map((check2) => check2?.name) : [];
+  const checksAreValid = Array.isArray(checks) && checks.every(
+    (check2) => typeof check2?.name === "string" && check2?.success === true
+  ) && new Set(checkNames).size === checkNames.length && REQUIRED_SERVER_PROBE_CHECKS.every((name) => checkNames.includes(name)) && (serverMetadata.actionPlugins?.length === 0 || checkNames.includes("action-plugin-registry"));
+  return serverMetadata?.schemaVersion === 2 && serverMetadata?.consumable === true && serverMetadata?.availabilityProbe?.success === true && serverMetadata?.availabilityProbe?.nodeModulesPresent === false && checksAreValid && warningsAreValid && runtimeAssetWarningsAreValid && actionPluginsAreValid && Array.isArray(serverMetadata?.runtimeAssets) && Array.isArray(serverMetadata?.externalImports) && serverMetadata.externalImports.length === 0;
+}
+function stableServerMetadataIdentity(serverMetadata) {
+  const availabilityProbe = serverMetadata?.availabilityProbe ?? {};
+  const checks = Array.isArray(availabilityProbe.checks) ? availabilityProbe.checks.map((check2) => {
+    const { elapsedMs: _elapsedMs, ...stableCheck } = check2;
+    return stableCheck;
+  }) : availabilityProbe.checks;
+  const {
+    startupMs: _startupMs,
+    stdout: _stdout,
+    stderr: _stderr,
+    ...stableProbe
+  } = availabilityProbe;
+  return canonicalJson({
+    ...serverMetadata,
+    availabilityProbe: { ...stableProbe, checks }
+  });
+}
+function serverDependenciesAreConsumable(serverDependencies) {
+  if (serverDependencies?.schemaVersion !== 1 || typeof serverDependencies?.sourceEntry !== "string" || serverDependencies.sourceEntry.length === 0 || typeof serverDependencies?.compiledEntry !== "string" || serverDependencies.compiledEntry.length === 0 || !Array.isArray(serverDependencies?.bootstrapModules) || serverDependencies.bootstrapModules.length === 0 || !Array.isArray(serverDependencies?.packages) || serverDependencies.packages.length === 0 || !Array.isArray(serverDependencies?.actionPlugins) || !Array.isArray(serverDependencies?.files) || serverDependencies.files.length === 0 || !/^[a-f0-9]{64}$/.test(serverDependencies?.treeSha256 ?? "") || serverDependencies.fileCount !== serverDependencies.files.length || !Number.isSafeInteger(serverDependencies.totalBytes) || serverDependencies.totalBytes <= 0) {
+    return false;
+  }
+  const packageRecordsAreValid = (packages) => packages.every(
+    (pkg2) => typeof pkg2?.name === "string" && pkg2.name.length > 0 && typeof pkg2?.version === "string" && pkg2.version.length > 0
+  );
+  const paths = /* @__PURE__ */ new Set();
+  const filesAreValid = serverDependencies.files.every((file) => {
+    if (!isCanonicalRelativeAssetPath(file?.path) || !/^[a-f0-9]{64}$/.test(file?.sha256 ?? "") || !Number.isSafeInteger(file?.size) || file.size < 0 || paths.has(file.path)) {
+      return false;
+    }
+    paths.add(file.path);
+    return true;
+  });
+  const expectedTreeSha256 = crypto3.createHash("sha256").update(JSON.stringify(serverDependencies.files)).digest("hex");
+  return packageRecordsAreValid(serverDependencies.packages) && packageRecordsAreValid(serverDependencies.actionPlugins) && filesAreValid && expectedTreeSha256 === serverDependencies.treeSha256 && serverDependencies.files.reduce(
+    (total, file) => total + file.size,
+    0
+  ) === serverDependencies.totalBytes;
+}
+function sealCacheGeneration(options) {
+  const projectRoot = path30.resolve(options.projectRoot);
+  const cacheRoot = path30.resolve(
+    projectRoot,
+    options.cacheRoot ?? ".miaoda-cache"
+  );
+  const outfile = path30.resolve(
+    projectRoot,
+    options.outfile ?? path30.join(cacheRoot, "generation.json")
+  );
+  const runtimeManifestFile = path30.isAbsolute(options.runtimeManifestFile) ? options.runtimeManifestFile : path30.resolve(projectRoot, options.runtimeManifestFile);
+  const files = {
+    serverBundle: path30.join(cacheRoot, "server", "server.bundle.cjs"),
+    serverMetadata: path30.join(
+      cacheRoot,
+      "server",
+      "server.bundle.cjs.meta.json"
+    ),
+    serverDependencies: path30.join(
+      cacheRoot,
+      "server",
+      "dependencies.json"
+    ),
+    appRuntime: path30.join(cacheRoot, "app-runtime.json"),
+    viteMetadata: path30.join(cacheRoot, "vite", "deps", "_metadata.json")
+  };
+  const viteRoot = path30.join(cacheRoot, "vite");
+  fs33.rmSync(outfile, { force: true });
+  const baseInputs = [
+    runtimeManifestFile,
+    files.appRuntime,
+    files.viteMetadata
+  ];
+  const missingBaseInputs = baseInputs.filter((file) => !fs33.existsSync(file));
+  if (missingBaseInputs.length > 0) {
+    return {
+      sealed: false,
+      reasons: missingBaseInputs.map(
+        (file) => `cache generation input missing: ${file}`
+      )
+    };
+  }
+  let applicationKind;
+  try {
+    const appRuntime = JSON.parse(fs33.readFileSync(files.appRuntime, "utf8"));
+    applicationKind = appRuntime.applicationKind === "frontend-only" ? "frontend-only" : "fullstack";
+  } catch (error) {
+    return {
+      sealed: false,
+      reasons: [error instanceof Error ? error.message : String(error)]
+    };
+  }
+  const hasServerDependencies = fs33.existsSync(files.serverDependencies);
+  const serverFiles = hasServerDependencies ? [files.serverDependencies, path30.join(cacheRoot, "server", "node_modules")] : [files.serverBundle, files.serverMetadata];
+  const missing = (applicationKind === "fullstack" ? serverFiles : []).filter(
+    (file) => !fs33.existsSync(file)
+  );
+  if (missing.length > 0) {
+    return {
+      sealed: false,
+      reasons: missing.map((file) => `cache generation input missing: ${file}`)
+    };
+  }
+  try {
+    const runtime = JSON.parse(fs33.readFileSync(runtimeManifestFile, "utf8"));
+    const appRuntime = JSON.parse(fs33.readFileSync(files.appRuntime, "utf8"));
+    const viteMetadata = JSON.parse(
+      fs33.readFileSync(files.viteMetadata, "utf8")
+    );
+    const serverMetadata = applicationKind === "fullstack" && !hasServerDependencies ? JSON.parse(fs33.readFileSync(files.serverMetadata, "utf8")) : void 0;
+    const serverDependencies = applicationKind === "fullstack" && hasServerDependencies ? JSON.parse(fs33.readFileSync(files.serverDependencies, "utf8")) : void 0;
+    const reasons = [];
+    const serverRuntimeAssetFiles = [];
+    if (runtime.schemaVersion !== 1 || !runtime.runtimeAbiHash) {
+      reasons.push("unsupported platform runtime manifest");
+    }
+    if (appRuntime.schemaVersion !== 1 || appRuntime.runtimeAbiHash !== runtime.runtimeAbiHash) {
+      reasons.push("application/runtime ABI mismatch");
+    }
+    if (!/^[a-f0-9]{64}$/.test(appRuntime.clientDependencyGraphHash ?? "") || appRuntime.clientDependencyGraph?.schemaVersion !== 1 || appRuntime.clientDependencyGraph?.runtimeAbiHash !== runtime.runtimeAbiHash) {
+      reasons.push("application client dependency graph is invalid");
+    }
+    if (applicationKind === "fullstack" && hasServerDependencies && !serverDependenciesAreConsumable(serverDependencies)) {
+      reasons.push("server runtime dependency metadata is not consumable");
+    }
+    if (applicationKind === "fullstack" && !hasServerDependencies && !serverMetadataIsConsumable(serverMetadata)) {
+      reasons.push("server cache metadata is not consumable");
+    }
+    if (applicationKind === "fullstack" && !hasServerDependencies && sha2562(files.serverBundle) !== serverMetadata.bundleSha256) {
+      reasons.push("server bundle SHA-256 mismatch");
+    }
+    if (applicationKind === "fullstack" && !hasServerDependencies && !Array.isArray(serverMetadata.runtimeAssets)) {
+      reasons.push("server runtime asset manifest is missing");
+    } else if (applicationKind === "fullstack" && !hasServerDependencies) {
+      const runtimeAssetPaths = /* @__PURE__ */ new Set();
+      for (const asset of serverMetadata.runtimeAssets) {
+        if (!isCanonicalRelativeAssetPath(asset?.path)) {
+          reasons.push(`server runtime asset path is invalid: ${asset?.path}`);
+          continue;
+        }
+        if (runtimeAssetPaths.has(asset.path)) {
+          reasons.push(
+            `server runtime asset path is duplicated: ${asset.path}`
+          );
+          continue;
+        }
+        runtimeAssetPaths.add(asset.path);
+        const file = path30.join(cacheRoot, "server", ...asset.path.split("/"));
+        if (!fs33.existsSync(file) || !fs33.statSync(file).isFile()) {
+          reasons.push(`server runtime asset is missing: ${asset.path}`);
+          continue;
+        }
+        const actualSha256 = sha2562(file);
+        const actualSize = fs33.statSync(file).size;
+        if (asset.sha256 !== actualSha256 || asset.size !== actualSize) {
+          reasons.push(
+            `server runtime asset integrity mismatch: ${asset.path}`
+          );
+          continue;
+        }
+        serverRuntimeAssetFiles.push({
+          key: `serverRuntimeAsset:${asset.path}`,
+          file,
+          path: asset.path
+        });
+      }
+    }
+    if (applicationKind === "fullstack" && hasServerDependencies) {
+      const nodeModulesRoot = path30.join(cacheRoot, "server", "node_modules");
+      const actualFiles = listRegularFiles(nodeModulesRoot).map((file) => ({
+        path: path30.relative(nodeModulesRoot, file).split(path30.sep).join("/"),
+        sha256: sha2562(file),
+        size: fs33.statSync(file).size
+      })).sort((left, right) => left.path.localeCompare(right.path));
+      if (JSON.stringify(actualFiles) !== JSON.stringify(serverDependencies.files)) {
+        reasons.push("server runtime dependency file set or integrity mismatch");
+      }
+      const currentActionPlugins = workspaceBuildInputs(projectRoot).actionPlugins;
+      const cachedActionPlugins = Object.fromEntries(
+        serverDependencies.actionPlugins.map(
+          (plugin) => [
+            plugin.name,
+            plugin.version
+          ]
+        )
+      );
+      if (JSON.stringify(currentActionPlugins) !== JSON.stringify(canonicalJson(cachedActionPlugins))) {
+        reasons.push("server runtime ActionPlugin dependency mismatch");
+      }
+    }
+    const optimizedDependencies = new Set(
+      Object.keys(viteMetadata.optimized ?? {})
+    );
+    const missingViteDependencies = Array.from(
+      new Set(appRuntime.optimizeDependencies ?? [])
+    ).filter((specifier) => !optimizedDependencies.has(specifier));
+    if (missingViteDependencies.length > 0) {
+      reasons.push(
+        `vite cache dependency coverage missing: ${missingViteDependencies.join(", ")}`
+      );
+    }
+    const graphPackageNames = new Set(
+      (appRuntime.clientDependencyGraph?.entries ?? []).map(
+        (entry) => packageNameFromOptimizerId(entry.specifier ?? "")
+      ).filter(Boolean)
+    );
+    const optimizerEntries = [
+      ...Object.entries(viteMetadata.optimized ?? {}),
+      ...Object.entries(viteMetadata.discovered ?? {})
+    ];
+    const uncoveredOptimizerPackages = Array.from(
+      new Set(
+        optimizerEntries.flatMap(([id, entry]) => {
+          const name = packageNameFromOptimizerId(id);
+          if (!name || graphPackageNames.has(name)) return [];
+          return optimizerEntryUsesRuntimePackage({
+            projectRoot,
+            runtimeManifestFile,
+            runtime,
+            packageName: name,
+            entry
+          }) ? [] : [name];
+        })
+      )
+    ).sort();
+    if (uncoveredOptimizerPackages.length > 0) {
+      reasons.push(
+        `vite optimizer graph/toolchain coverage missing: ${uncoveredOptimizerPackages.join(", ")}`
+      );
+    }
+    if (reasons.length > 0) return { sealed: false, reasons };
+    const artifactFiles = {
+      appRuntime: files.appRuntime,
+      viteMetadata: files.viteMetadata,
+      ...applicationKind === "fullstack" ? hasServerDependencies ? { serverDependencies: files.serverDependencies } : {
+        serverBundle: files.serverBundle,
+        serverMetadata: files.serverMetadata
+      } : {}
+    };
+    const artifacts = Object.fromEntries([
+      ...Object.entries(artifactFiles).map(([name, file]) => [
+        name,
+        {
+          path: path30.relative(cacheRoot, file),
+          sha256: sha2562(file),
+          size: fs33.statSync(file).size
+        }
+      ]),
+      ...serverRuntimeAssetFiles.map((asset) => [
+        asset.key,
+        {
+          path: path30.posix.join("server", asset.path),
+          sha256: sha2562(asset.file),
+          size: fs33.statSync(asset.file).size
+        }
+      ])
+    ]);
+    const viteFiles = listRegularFiles(viteRoot).map((file) => ({
+      path: path30.relative(cacheRoot, file),
+      sha256: sha2562(file),
+      size: fs33.statSync(file).size
+    }));
+    if (viteFiles.length === 0) {
+      return { sealed: false, reasons: ["vite cache is empty"] };
+    }
+    const stableMetadata = applicationKind === "fullstack" && !hasServerDependencies ? JSON.stringify(stableServerMetadataIdentity(serverMetadata)) : void 0;
+    const serverMetadataIdentity = stableMetadata ? {
+      sha256: crypto3.createHash("sha256").update(stableMetadata).digest("hex"),
+      size: Buffer.byteLength(stableMetadata)
+    } : void 0;
+    const serverDependencyFiles = applicationKind === "fullstack" && hasServerDependencies ? listRegularFiles(path30.join(cacheRoot, "server")).map((file) => ({
+      path: path30.relative(cacheRoot, file).split(path30.sep).join("/"),
+      sha256: sha2562(file),
+      size: fs33.statSync(file).size
+    })) : void 0;
+    const identity = {
+      schemaVersion: hasServerDependencies ? 4 : 3,
+      runtimeAbiHash: runtime.runtimeAbiHash,
+      applicationKind,
+      ...applicationKind === "fullstack" ? {
+        serverRuntime: {
+          nodeVersion: (serverDependencies ?? serverMetadata).nodeVersion,
+          nodeModuleAbi: (serverDependencies ?? serverMetadata).nodeModuleAbi,
+          platform: (serverDependencies ?? serverMetadata).platform,
+          arch: (serverDependencies ?? serverMetadata).arch
+        },
+        ...hasServerDependencies ? {
+          serverRuntimeMode: "workspace-source-dependencies",
+          serverFiles: serverDependencyFiles
+        } : {}
+      } : {},
+      artifacts,
+      ...serverMetadataIdentity ? { serverMetadataIdentity } : {},
+      viteFiles,
+      ...hasServerDependencies ? {} : { sourceFiles: listWorkspaceSourceFiles(projectRoot) },
+      workspaceBuildInputs: workspaceBuildInputs(projectRoot)
+    };
+    const generationIdentity = serverMetadataIdentity ? {
+      ...identity,
+      artifacts: {
+        ...identity.artifacts,
+        serverMetadata: {
+          ...identity.artifacts.serverMetadata,
+          ...serverMetadataIdentity
+        }
+      }
+    } : identity;
+    const generationId = crypto3.createHash("sha256").update(JSON.stringify(generationIdentity)).digest("hex");
+    fs33.mkdirSync(path30.dirname(outfile), { recursive: true });
+    const tempFile = `${outfile}.${process.pid}.${Date.now()}.tmp`;
+    fs33.writeFileSync(
+      tempFile,
+      `${JSON.stringify({ ...identity, generationId }, null, 2)}
+`
+    );
+    fs33.renameSync(tempFile, outfile);
+    return { sealed: true, outfile, generationId, reasons: [] };
+  } catch (error) {
+    fs33.rmSync(outfile, { force: true });
+    return {
+      sealed: false,
+      reasons: [error instanceof Error ? error.message : String(error)]
+    };
+  }
+}
+
+// src/commands/build/index.ts
+var getTokenCommand = {
+  name: "get-token",
+  description: "Get artifact upload credential (STI token)",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(
+      async (options) => {
+        await getToken(options);
+      }
+    );
+  }
+};
+var uploadStaticCommand = {
+  name: "upload-static",
+  description: "Upload shared/static files to TOS",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option(
+      "--static-dir <dir>",
+      "Static files directory",
+      UPLOAD_STATIC_DEFAULTS.staticDir
+    ).option(
+      "--tosutil-path <path>",
+      "Path to tosutil binary",
+      UPLOAD_STATIC_DEFAULTS.tosutilPath
+    ).option(
+      "--endpoint <endpoint>",
+      "TOS endpoint",
+      UPLOAD_STATIC_DEFAULTS.endpoint
+    ).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
+      await uploadStatic(options);
+    });
+  }
+};
+var preUploadStaticCommand = {
+  name: "pre-upload-static",
+  description: "Get TOS upload info and output as env vars for build.sh eval",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").action(async (options) => {
+      await preUploadStatic(options);
+    });
+  }
+};
+var serverCacheBundleCommand = {
+  name: "server-cache-bundle",
+  description: "Build and probe a node_modules-free single-file NestJS cache bundle",
+  register(program) {
+    program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).option(
+      "--entry <file>",
+      "Compiled Nest entry (auto-detects dist/server/main.js or dist/main.js)"
+    ).option(
+      "--outfile <file>",
+      "Output bundle",
+      ".miaoda-cache/server/server.bundle.cjs"
+    ).option("--metadata-file <file>", "Output metadata file").action(
+      async (options) => {
+        const result = await buildServerCacheBundle(options);
+        console.log(JSON.stringify(result));
+        if (!result.built) process.exitCode = 2;
+      }
+    );
+  }
+};
+var serverRuntimeDependenciesCommand = {
+  name: "server-runtime-dependencies",
+  description: "Build the automatically traced npm dependency cache used by transition Nest",
+  register(program) {
+    program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).option(
+      "--entry <file>",
+      "Compiled Nest entry (auto-detects dist/server/main.js or dist/main.js)"
+    ).option(
+      "--source-entry <file>",
+      "Workspace Nest source entry (auto-detects server/main.ts or src/main.ts)"
+    ).option(
+      "--outdir <dir>",
+      "Output node_modules directory",
+      ".miaoda-cache/server/node_modules"
+    ).option("--metadata-file <file>", "Output dependency metadata file").action(
+      async (options) => {
+        const result = await buildServerRuntimeDependencies(options);
+        console.log(JSON.stringify(result));
+        if (!result.built) process.exitCode = 2;
+      }
+    );
+  }
+};
+var appRuntimeManifestCommand = {
+  name: "app-runtime-manifest",
+  description: "Freeze the browser dependency closure used by cache-only Vite",
+  register(program) {
+    program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).requiredOption(
+      "--runtime-manifest-file <file>",
+      "Image platform runtime manifest"
+    ).option("--outfile <file>", "Application runtime manifest output").action(
+      (options) => {
+        const result = buildAppRuntimeManifest(options);
+        console.log(JSON.stringify(result));
+        if (!result.built) process.exitCode = 2;
+      }
+    );
+  }
+};
+var cacheGenerationCommand = {
+  name: "cache-generation",
+  description: "Seal Vite, Nest and runtime manifests into one immutable cache generation",
+  register(program) {
+    program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).requiredOption(
+      "--runtime-manifest-file <file>",
+      "Image platform runtime manifest"
+    ).option("--cache-root <dir>", "Cache root", ".miaoda-cache").option("--outfile <file>", "Generation manifest output").action(
+      (options) => {
+        const result = sealCacheGeneration(options);
+        console.log(JSON.stringify(result));
+        if (!result.sealed) process.exitCode = 2;
+      }
+    );
+  }
+};
+var buildCommandGroup = {
+  name: "build",
+  description: "Build related commands",
+  commands: [
+    getTokenCommand,
+    uploadStaticCommand,
+    preUploadStaticCommand,
+    serverCacheBundleCommand,
+    serverRuntimeDependenciesCommand,
+    appRuntimeManifestCommand,
+    cacheGenerationCommand
+  ]
+};
+
+// src/commands/index.ts
+var commands = [
+  genDbSchemaCommand,
+  syncCommand,
+  upgradeCommand,
+  actionPluginCommandGroup,
+  capabilityCommandGroup,
+  componentCommandGroup,
+  migrationCommand,
+  readLogsCommand,
+  buildCommandGroup
+];
+
+// src/utils/workspace-env.ts
+import fs34 from "fs";
+import path31 from "path";
+import { config as dotenvConfig } from "dotenv";
+function loadWorkspaceEnv(cwd = process.cwd(), targetEnv = process.env) {
+  if (targetEnv.FULLSTACK_CLI_SKIP_DOTENV === "1") {
+    return;
+  }
+  for (const filename of [".env.local", ".env"]) {
+    const envPath = path31.join(cwd, filename);
+    if (fs34.existsSync(envPath)) {
+      dotenvConfig({ path: envPath, processEnv: targetEnv });
+    }
+  }
+}
+
+// src/index.ts
+loadWorkspaceEnv();
+var __dirname = path32.dirname(fileURLToPath5(import.meta.url));
+var pkg = JSON.parse(fs35.readFileSync(path32.join(__dirname, "../package.json"), "utf-8"));
 var cli = new FullstackCLI(pkg.version);
 cli.useAll(commands);
 cli.run();