@lark-apaas/fullstack-cli 1.1.64-alpha.20260901063858 → 1.1.64-alpha.20260901065806

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
-import fs29 from "fs";
-import path25 from "path";
+import fs30 from "fs";
+import path26 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { config as dotenvConfig } from "dotenv";
 
@@ -8260,21 +8260,1436 @@ async function preUploadStatic(options) {
   }
 }
 
+// src/commands/build/server-startup-bundle.handler.ts
+import fs29 from "fs";
+import http from "http";
+import net from "net";
+import os3 from "os";
+import path25 from "path";
+import { builtinModules, createRequire as createRequire3 } from "module";
+import { spawn as spawn2 } from "child_process";
+import { createHash, randomUUID } from "crypto";
+import { build } from "esbuild";
+import { parse } from "acorn";
+import { ancestor as walkAncestor, simple as walkSimple } from "acorn-walk";
+var OPTIONAL_NEST_DEPENDENCIES = [
+  "@nestjs/microservices",
+  "@nestjs/microservices/microservices-module",
+  "@nestjs/websockets/socket-module",
+  "@node-rs/xxhash",
+  "fsevents"
+];
+var BUILTINS = /* @__PURE__ */ new Set([
+  ...builtinModules,
+  ...builtinModules.map((name) => `node:${name}`)
+]);
+var BUILDER_POLICY_VERSION = 5;
+var RUNTIME_ASSET_READ_METHODS = /* @__PURE__ */ new Set([
+  "access",
+  "accessSync",
+  "createReadStream",
+  "open",
+  "openSync",
+  "readFile",
+  "readFileSync",
+  "stat",
+  "statSync"
+]);
+var SOURCE_HASH_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".miaoda-cache",
+  ".turbo",
+  "coverage",
+  "dist",
+  "logs",
+  "node_modules"
+]);
+var AUDITED_FRAMEWORK_DYNAMIC_LOADER_HASHES = {
+  "/@nestjs/common/utils/load-package.util.js": [
+    "8fc26b273fe5499285e25355b4368fe8e1527ae217ede53144219c17cf1aa721"
+  ],
+  "/@nestjs/core/helpers/optional-require.js": [
+    "c8a109dab1b2461e866fe04b8be5988ccc199a2239c730abc05fc28c0f85d7f2"
+  ],
+  "/@nestjs/core/helpers/load-adapter.js": [
+    "7970867a441f356a2e257a12e43dbb8022b58631b3076f298058abb46270009a"
+  ],
+  "/express/lib/view.js": [
+    "ec627880c1b43aee5887164ac2e9c58f01e4ee8086e23a829eddf1af3858c021"
+  ],
+  "/require-in-the-middle/index.js": [
+    "721b78e7afebc91a75ecc8b8d9a166775ef03fd8f96e7cbcad1b46f8b4e74a07"
+  ],
+  "/@opentelemetry/instrumentation/build/src/platform/node/instrumentation.js": ["098033348a2d1750e5722457fa56ccbe51c7df1aafe58f960ec20566a9a8b310"],
+  "/@lark-apaas/nestjs-capability/dist/index.cjs": [
+    "9a6aea944995f46adf9733daaf13ec6cd0d46decab044e2548e0f0b1ba54cde2"
+  ],
+  "/@lark-apaas/fullstack-nestjs-core/dist/index.cjs": [
+    "76fd8e2b4eaf762346e22919b229d81bc6c3848f1e7968e8e63e9493ca6127d9"
+  ],
+  "/pino/lib/transport.js": [
+    "c4857be63a0392312c9010fc222e7216fee0c216ef8dbcf133c61158528ab091"
+  ],
+  "/hbs/lib/hbs.js": [
+    "fdab192a37993e8643e5ce27698fc7e1138b0033e487270f77fd865fa00feab0"
+  ],
+  "/handlebars/lib/index.js": [
+    "76f96bd806c6b48987dd811de149be3d8c296eb440f9c91a3b8cad9fb2f9030a"
+  ]
+};
+var AUDITED_RUNTIME_FS_READER_HASHES = {
+  "/@grpc/grpc-js/build/src/tls-helpers.js": [
+    "9c3b00e23fca5e7996212778f151301eb202337da931f384fb1b60eb9d13f6c4"
+  ],
+  "/@grpc/proto-loader/build/src/util.js": [
+    "72101d764f31ece6d3c22cc6674c32ab3fb1f4975756d9ee4e39f3b155fb6f03"
+  ],
+  "/@lark-apaas/fullstack-nestjs-core/dist/index.cjs": [
+    "76fd8e2b4eaf762346e22919b229d81bc6c3848f1e7968e8e63e9493ca6127d9"
+  ],
+  "/@lark-apaas/nestjs-capability/dist/index.cjs": [
+    "9a6aea944995f46adf9733daaf13ec6cd0d46decab044e2548e0f0b1ba54cde2"
+  ],
+  "/@nestjs/config/dist/config.module.js": [
+    "6d907e32437d1c922d5dcd17e3a0daf052d7d95a56adfc2972965e47cca31ff4"
+  ],
+  "/@nestjs/config/dist/config.service.js": [
+    "a6febcebd600bf8468ffa15e736266407404b5c281f2b1ddcec466245e889a72"
+  ],
+  "/dotenv/lib/main.js": [
+    "0d55d84f7ae79c6752b9b6ffd6f083c32a72d1d6ca2e3606f9161ffa441c3f52"
+  ],
+  "/express/lib/view.js": [
+    "ec627880c1b43aee5887164ac2e9c58f01e4ee8086e23a829eddf1af3858c021"
+  ],
+  "/send/index.js": [
+    "614d9bdd1944cc51663785b0e74c245296830f014a6f8c6c48cdc6a26b56c01e"
+  ],
+  "/@opentelemetry/otlp-exporter-base/build/esm/configuration/otlp-node-http-env-configuration.js": ["d4397f98b3cea799130dd26fee05ce2f27811e5643244e9d59264d218ac9f364"],
+  "/@opentelemetry/otlp-grpc-exporter-base/build/src/configuration/otlp-grpc-env-configuration.js": ["901d2348bf46babe99c7b13cf1aea5bf76f44e5ab45c6f5f1aefbed525938696"],
+  "/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-bsd.js": [
+    "e4cef35e2b61c3471154414de9b9b3dc21b0778e8e728c56ae0f1cdf2558b8ed",
+    "e56af724ce673fe33e83aec425822f5211cd368afcba0d04be41f47da728115f"
+  ],
+  "/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-linux.js": [
+    "d62c5a539558002a63a05093f4f3a0820a35ebf95d51966725fb92110beefc95",
+    "631b352f8994ff3cccf365473127b1dfa97f95bb0d0c70e3ce1137c744b92830"
+  ],
+  "/@protobufjs/fetch/index.js": [
+    "5e8c1d65ee1857327528c5b3fc807c3647324f3097a6cb9358f9e2c328c143fe"
+  ],
+  "/axios/dist/node/axios.cjs": [
+    "241146620c67551291fef242d9ab9fd9b28f1e0e14ae311e7db759d36942b574"
+  ],
+  "/chokidar/index.js": [
+    "18ce2effe87d6379aa1d3756e5694c57c72cf97804056d688499a2bffcec66fd"
+  ],
+  "/chokidar/lib/fsevents-handler.js": [
+    "c2e15baebf066bf8531cbf82a324631a40b218d073274429edb50b4bdbbb0265"
+  ],
+  "/chokidar/lib/nodefs-handler.js": [
+    "60be035e7ea64858a0144230d5073b18a69f3b0eefba62a9b032c6d2f179d807"
+  ],
+  "/form-data/lib/form_data.js": [
+    "c63c99e10e2c3f46fa990787d7dc4a4f65ea90211c422e19626fecb3d767c41d"
+  ],
+  "/handlebars/lib/index.js": [
+    "76f96bd806c6b48987dd811de149be3d8c296eb440f9c91a3b8cad9fb2f9030a"
+  ],
+  "/hbs/lib/hbs.js": [
+    "fdab192a37993e8643e5ce27698fc7e1138b0033e487270f77fd865fa00feab0"
+  ],
+  "/mime/mime.js": [
+    "a121a0b9e780e9ae349a26227a0d25c33ebac2d52a85aae5affa84ba0f53f16c"
+  ],
+  "/mkdirp/index.js": [
+    "df33312136061eee26701a34ca4f9be043b9675d359a115503dc2df909106432"
+  ],
+  "/postgres/cjs/src/index.js": [
+    "d8fea1a5311c47e65004646bc81f57305ac64d48f99004a5b3ca27bcfc6babf8"
+  ],
+  "/protobufjs/src/root.js": [
+    "1f610f79137dff45ce2ec4e0f742ae43f26b296f2518f4ba41e0a497af5ad624"
+  ],
+  "/sonic-boom/index.js": [
+    "cd3f77b5b75366df3f0a9c27dc18c4f8c47478a7cc982a2bbdc70bfded3c1221"
+  ],
+  "/undici/lib/mock/snapshot-recorder.js": [
+    "9bf63c8b207b6f6e7fe4400b32d8322cfc185735d6ecfbd87a2691a8fba82922"
+  ]
+};
+var probeIdentities = /* @__PURE__ */ new WeakMap();
+function sha256(contents) {
+  return createHash("sha256").update(contents).digest("hex");
+}
+function isInside(root, candidate) {
+  const relative = path25.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path25.isAbsolute(relative);
+}
+function assertNoSymlinkComponents(root, candidate, message) {
+  const relative = path25.relative(root, candidate);
+  if (!isInside(root, candidate))
+    throw new Error(`${message}: path escaped root`);
+  let current = root;
+  for (const segment of relative.split(path25.sep).filter(Boolean)) {
+    current = path25.join(current, segment);
+    if (fs29.existsSync(current) && fs29.lstatSync(current).isSymbolicLink()) {
+      throw new Error(message);
+    }
+  }
+}
+function walkFiles(root, directory, output) {
+  if (!fs29.existsSync(directory)) return;
+  for (const entry of fs29.readdirSync(directory, { withFileTypes: true })) {
+    if (SOURCE_HASH_IGNORED_DIRECTORIES.has(entry.name)) continue;
+    const candidate = path25.join(directory, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new Error(
+        `source symlink is unsupported: ${path25.relative(root, candidate)}`
+      );
+    }
+    if (entry.isDirectory()) walkFiles(root, candidate, output);
+    else if (entry.isFile()) output.push(candidate);
+  }
+}
+function workspaceSourceSha256(projectRoot) {
+  const files = [];
+  walkFiles(projectRoot, projectRoot, files);
+  const hash = createHash("sha256");
+  for (const file of files.sort()) {
+    hash.update(path25.relative(projectRoot, file).split(path25.sep).join("/"));
+    hash.update("\0");
+    hash.update(fs29.readFileSync(file));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function workspaceLockfileSha256(projectRoot) {
+  const names = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"];
+  const hash = createHash("sha256");
+  let found = false;
+  for (const name of names) {
+    const file = path25.join(projectRoot, name);
+    if (!fs29.existsSync(file)) continue;
+    found = true;
+    hash.update(name);
+    hash.update("\0");
+    hash.update(fs29.readFileSync(file));
+    hash.update("\0");
+  }
+  return found ? hash.digest("hex") : sha256("");
+}
+function resolveEntry(projectRoot, requested) {
+  const entry = path25.resolve(projectRoot, requested);
+  if (!isInside(projectRoot, entry))
+    throw new Error("compiled entry escaped project root");
+  if (!fs29.existsSync(entry))
+    throw new Error(`compiled entry is not a file: ${entry}`);
+  if (fs29.lstatSync(entry).isSymbolicLink()) {
+    throw new Error("compiled entry symlink is unsupported");
+  }
+  const realEntry = fs29.realpathSync(entry);
+  if (!isInside(projectRoot, realEntry))
+    throw new Error("compiled entry escaped project root");
+  if (!fs29.statSync(realEntry).isFile())
+    throw new Error(`compiled entry is not a file: ${entry}`);
+  return realEntry;
+}
+function optionalNestDependencyStubs() {
+  const escaped = OPTIONAL_NEST_DEPENDENCIES.map(
+    (name) => name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  );
+  const filter = new RegExp(`^(?:${escaped.join("|")})$`);
+  return {
+    name: "miaoda-optional-nest-dependency-stubs",
+    setup(esbuild) {
+      esbuild.onResolve({ filter }, (args) => ({
+        path: args.path,
+        namespace: "miaoda-optional-nest-dependency"
+      }));
+      esbuild.onLoad(
+        { filter: /.*/, namespace: "miaoda-optional-nest-dependency" },
+        (args) => ({
+          contents: `const error = new Error(${JSON.stringify(
+            `Optional dependency is unavailable in startup bundle: ${args.path}`
+          )}); error.code = 'MODULE_NOT_FOUND'; throw error;`,
+          loader: "js"
+        })
+      );
+    }
+  };
+}
+function neutralizeDynamicLoads(code) {
+  const replacements = [];
+  const ast = parse(code, {
+    ecmaVersion: "latest",
+    sourceType: "module",
+    allowHashBang: true,
+    allowReturnOutsideFunction: true
+  });
+  const isCreateRequireReference = (node) => {
+    if (!node || typeof node !== "object") return false;
+    const candidate = node;
+    if (candidate.type === "Identifier")
+      return candidate.name === "createRequire";
+    if (candidate.type === "MemberExpression") {
+      return candidate.property?.type === "Identifier" && candidate.property.name === "createRequire" || candidate.property?.type === "Literal" && candidate.property.value === "createRequire";
+    }
+    if (candidate.type === "SequenceExpression") {
+      return candidate.expressions?.some(isCreateRequireReference) ?? false;
+    }
+    return false;
+  };
+  walkSimple(ast, {
+    CallExpression(node) {
+      const isCreateRequire = isCreateRequireReference(node.callee);
+      const isRequire = node.callee.type === "Identifier" && (node.callee.name === "require" || node.callee.name === "__require") || node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "module" && (node.callee.property.type === "Identifier" && node.callee.property.name === "require" || node.callee.property.type === "Literal" && node.callee.property.value === "require");
+      const isRequireResolve = node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && (node.callee.object.name === "require" || node.callee.object.name === "__require") && node.callee.property.type === "Identifier" && node.callee.property.name === "resolve";
+      if (isCreateRequire) {
+        replacements.push({
+          start: node.start,
+          end: node.end,
+          kind: "create-require"
+        });
+      } else if ((isRequire || isRequireResolve) && (node.arguments[0]?.type !== "Literal" || typeof node.arguments[0].value !== "string")) {
+        replacements.push({
+          start: node.start,
+          end: node.end,
+          kind: "dynamic-load"
+        });
+      }
+    },
+    ImportExpression(node) {
+      if (node.source.type !== "Literal" || typeof node.source.value !== "string") {
+        replacements.push({
+          start: node.start,
+          end: node.end,
+          kind: "dynamic-load"
+        });
+      }
+    },
+    MemberExpression(node) {
+      if (node.object.type !== "Identifier" || node.object.name !== "require" && node.object.name !== "__require") {
+        return;
+      }
+      const property = memberPropertyName(node.property);
+      if (property === "cache") {
+        replacements.push({
+          start: node.start,
+          end: node.end,
+          kind: "require-cache"
+        });
+      } else if (property === "main") {
+        replacements.push({
+          start: node.start,
+          end: node.end,
+          kind: "require-main"
+        });
+      } else if (property === "extensions") {
+        replacements.push({
+          start: node.start,
+          end: node.end,
+          kind: "require-extensions"
+        });
+      }
+    }
+  });
+  const unavailable = '(()=>{const error=new Error("dynamic dependency unavailable in startup bundle");error.code="MODULE_NOT_FOUND";throw error})()';
+  const disabledCreateRequire = '(()=>{const disabled=()=>{const error=new Error("dynamic dependency unavailable in startup bundle");error.code="MODULE_NOT_FOUND";throw error};disabled.resolve=disabled;return disabled})()';
+  let output = code;
+  for (const replacement of replacements.sort(
+    (left, right) => right.start - left.start
+  )) {
+    const value = replacement.kind === "create-require" ? disabledCreateRequire : replacement.kind === "dynamic-load" ? unavailable : replacement.kind === "require-main" ? "undefined" : "Object.create(null)";
+    output = `${output.slice(0, replacement.start)}${value}${output.slice(
+      replacement.end
+    )}`;
+  }
+  return output.replace(
+    /\bcreateRequire\b/g,
+    "__miaoda_disabled_create_require"
+  );
+}
+function knownFrameworkDynamicLoaderStubs() {
+  return {
+    name: "miaoda-known-framework-dynamic-loader-stubs",
+    setup(esbuild) {
+      esbuild.onLoad({ filter: /\.(?:cjs|js)$/ }, (args) => {
+        const normalized = args.path.split(path25.sep).join("/");
+        const source = fs29.readFileSync(args.path, "utf8");
+        if (!normalized.includes("/node_modules/") || !Object.entries(AUDITED_FRAMEWORK_DYNAMIC_LOADER_HASHES).some(
+          ([suffix, hashes]) => normalized.endsWith(suffix) && hashes.includes(sha256(source))
+        )) {
+          return void 0;
+        }
+        return {
+          contents: neutralizeDynamicLoads(source),
+          loader: "js",
+          resolveDir: path25.dirname(args.path)
+        };
+      });
+    }
+  };
+}
+function classTransformerStorageResolver(projectRoot) {
+  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
+  return {
+    name: "miaoda-class-transformer-storage-resolver",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /^class-transformer\/storage$/ }, () => {
+        try {
+          return {
+            path: projectRequire.resolve("class-transformer/cjs/storage.js")
+          };
+        } catch {
+          return void 0;
+        }
+      });
+    }
+  };
+}
+function resolveProjectPackage(projectRoot, specifier) {
+  return createRequire3(path25.join(projectRoot, "package.json")).resolve(
+    specifier
+  );
+}
+function fullstackNestRuntimeResolver(projectRoot) {
+  return {
+    name: "miaoda-fullstack-nest-runtime-resolver",
+    setup(esbuild) {
+      esbuild.onResolve(
+        { filter: /^@lark-apaas\/fullstack-nestjs-core$/ },
+        () => {
+          try {
+            return {
+              path: resolveProjectPackage(
+                projectRoot,
+                "@lark-apaas/fullstack-nestjs-core/runtime"
+              )
+            };
+          } catch {
+            try {
+              return {
+                path: resolveProjectPackage(
+                  projectRoot,
+                  "@lark-apaas/fullstack-nestjs-core"
+                )
+              };
+            } catch (error) {
+              return {
+                errors: [
+                  {
+                    text: `@lark-apaas/fullstack-nestjs-core cannot be resolved from project: ${error instanceof Error ? error.message : String(error)}`
+                  }
+                ]
+              };
+            }
+          }
+        }
+      );
+    }
+  };
+}
+function legacyFullstackNestOpenApiStub(projectRoot) {
+  let runtimeOnlyEntryAvailable = false;
+  try {
+    resolveProjectPackage(
+      projectRoot,
+      "@lark-apaas/fullstack-nestjs-core/runtime"
+    );
+    runtimeOnlyEntryAvailable = true;
+  } catch {
+  }
+  return {
+    name: "miaoda-legacy-nest-openapi-stub",
+    setup(esbuild) {
+      if (runtimeOnlyEntryAvailable) return;
+      esbuild.onResolve(
+        { filter: /^@lark-apaas\/nestjs-openapi-devtools$/ },
+        () => ({
+          path: "@lark-apaas/nestjs-openapi-devtools",
+          namespace: "miaoda-legacy-nest-openapi-stub"
+        })
+      );
+      esbuild.onLoad(
+        { filter: /.*/, namespace: "miaoda-legacy-nest-openapi-stub" },
+        () => ({
+          contents: "class DisabledOpenApiModule { static async mount() {} }\nmodule.exports = { DevToolsModule: DisabledOpenApiModule, DevToolsV2Module: DisabledOpenApiModule };",
+          loader: "js"
+        })
+      );
+    }
+  };
+}
+function findDynamicModuleLoads(code) {
+  const warnings = [];
+  const ast = parse(code, { ecmaVersion: "latest", sourceType: "script" });
+  walkSimple(ast, {
+    Identifier(node) {
+      if (node.name === "createRequire") {
+        warnings.push("node createRequire remains in bundle");
+      }
+    },
+    MemberExpression(node) {
+      if (node.computed && node.property.type === "Literal" && node.property.value === "createRequire") {
+        warnings.push("node createRequire remains in bundle");
+      }
+    },
+    CallExpression(node) {
+      const args = node.arguments;
+      const isRequire = node.callee.type === "Identifier" && (node.callee.name === "require" || node.callee.name === "__require") || node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "module" && (node.callee.property.type === "Identifier" && node.callee.property.name === "require" || node.callee.property.type === "Literal" && node.callee.property.value === "require");
+      const isRequireResolve = node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && (node.callee.object.name === "require" || node.callee.object.name === "__require") && node.callee.property.type === "Identifier" && node.callee.property.name === "resolve";
+      if (isRequire && args[0]?.type !== "Literal") {
+        warnings.push("dynamic require remains in bundle");
+      } else if (isRequireResolve && args[0]?.type === "Literal" && typeof args[0].value === "string" && !BUILTINS.has(args[0].value)) {
+        warnings.push(`require.resolve remains in bundle: ${args[0].value}`);
+      } else if (isRequireResolve && (args[0]?.type !== "Literal" || typeof args[0].value !== "string")) {
+        warnings.push("dynamic require.resolve remains in bundle");
+      }
+    },
+    ImportExpression(node) {
+      if (node.source.type !== "Literal" || typeof node.source.value !== "string") {
+        warnings.push("dynamic import remains in bundle");
+      }
+    }
+  });
+  walkAncestor(ast, {
+    Identifier(node, _state, ancestors) {
+      if (node.name !== "require" && node.name !== "__require") return;
+      const parent = ancestors.at(-2);
+      const grandparent = ancestors.at(-3);
+      if (node.name === "__require" && (parent?.type === "FunctionExpression" || parent?.type === "FunctionDeclaration") && parent.id === node) {
+        return;
+      }
+      if (parent?.type === "CallExpression" && parent.callee === node && parent.arguments[0]?.type === "Literal" && typeof parent.arguments[0].value === "string" && BUILTINS.has(parent.arguments[0].value)) {
+        return;
+      }
+      if (parent?.type === "MemberExpression" && parent.object === node && memberPropertyName(parent.property) === "resolve" && grandparent?.type === "CallExpression" && grandparent.callee === parent && grandparent.arguments[0]?.type === "Literal" && typeof grandparent.arguments[0].value === "string" && BUILTINS.has(grandparent.arguments[0].value)) {
+        return;
+      }
+      if (parent?.type === "UnaryExpression" && parent.operator === "typeof") {
+        return;
+      }
+      const member = parent?.type === "MemberExpression" && parent.object === node ? memberPropertyName(parent.property) : void 0;
+      warnings.push(
+        `${node.name} value escapes static call${member ? ` via ${member}` : ""}`
+      );
+    },
+    MemberExpression(node, _state, ancestors) {
+      if (node.object.type !== "Identifier" || node.object.name !== "module" || memberPropertyName(node.property) !== "require") {
+        return;
+      }
+      const parent = ancestors.at(-2);
+      if (parent?.type === "CallExpression" && parent.callee === node && parent.arguments[0]?.type === "Literal" && typeof parent.arguments[0].value === "string" && BUILTINS.has(parent.arguments[0].value)) {
+        return;
+      }
+      warnings.push("module.require value escapes static call");
+    }
+  });
+  return [...new Set(warnings)];
+}
+function memberPropertyName(node) {
+  if (!node || typeof node !== "object") return void 0;
+  const candidate = node;
+  if (candidate.type === "Identifier") return candidate.name;
+  if (candidate.type === "Literal" && typeof candidate.value === "string") {
+    return candidate.value;
+  }
+  if (candidate.type === "MemberExpression") {
+    return memberPropertyName(candidate.property);
+  }
+  return void 0;
+}
+function expressionContainsNodeModulesPath(node) {
+  const fragments = [];
+  const visit = (value) => {
+    if (!value || typeof value !== "object") return;
+    if (Array.isArray(value)) {
+      for (const item of value) visit(item);
+      return;
+    }
+    const candidate = value;
+    if (candidate.type === "Literal" && typeof candidate.value === "string") {
+      fragments.push(candidate.value);
+      return;
+    }
+    if (candidate.type === "TemplateElement") {
+      const templateValue = candidate.value;
+      const text = templateValue?.cooked ?? templateValue?.raw;
+      if (typeof text === "string") fragments.push(text);
+      return;
+    }
+    for (const [key, child] of Object.entries(candidate)) {
+      if (key === "start" || key === "end" || key === "loc") continue;
+      visit(child);
+    }
+  };
+  visit(node);
+  return /(?:^|[\\/])node_modules(?:[\\/]|$)/.test(
+    fragments.join("/").replace(/\\\\/g, "/")
+  );
+}
+function expressionContainsIdentifier(node, name) {
+  if (!node || typeof node !== "object") return false;
+  if (Array.isArray(node)) {
+    return node.some((item) => expressionContainsIdentifier(item, name));
+  }
+  const candidate = node;
+  if (candidate.type === "Identifier" && candidate.name === name) return true;
+  return Object.entries(candidate).some(
+    ([key, child]) => key !== "start" && key !== "end" && key !== "loc" && expressionContainsIdentifier(child, name)
+  );
+}
+function findNodeModulesRuntimeAssetReads(code, origin, rejectEveryRead) {
+  const warnings = [];
+  const ast = parse(code, {
+    ecmaVersion: "latest",
+    sourceType: "module",
+    allowHashBang: true,
+    allowReturnOutsideFunction: true
+  });
+  walkSimple(ast, {
+    CallExpression(node) {
+      const method = memberPropertyName(node.callee);
+      if (method && RUNTIME_ASSET_READ_METHODS.has(method) && rejectEveryRead) {
+        warnings.push(`dependency runtime fs read in input: ${origin}`);
+      } else if (method && RUNTIME_ASSET_READ_METHODS.has(method) && expressionContainsNodeModulesPath(node.arguments[0])) {
+        warnings.push(`node_modules runtime asset read in input: ${origin}`);
+      } else if (method && RUNTIME_ASSET_READ_METHODS.has(method) && expressionContainsIdentifier(node.arguments[0], "__dirname")) {
+        warnings.push(`__dirname runtime asset read in input: ${origin}`);
+      }
+    }
+  });
+  return warnings;
+}
+function findUnsafeApplicationModuleLoads(projectRoot, applicationRoot, inputFiles) {
+  const realApplicationRoot = fs29.realpathSync(applicationRoot);
+  const warnings = [];
+  for (const input of inputFiles) {
+    const candidate = path25.isAbsolute(input) ? input : path25.resolve(projectRoot, input);
+    if (!fs29.existsSync(candidate)) continue;
+    const realInput = fs29.realpathSync(candidate);
+    if (!/\.(?:cjs|mjs|js)$/.test(realInput)) continue;
+    const source = fs29.readFileSync(realInput, "utf8");
+    const isDependencyInput = realInput.split(path25.sep).includes("node_modules");
+    const normalizedInput = realInput.split(path25.sep).join("/");
+    const auditedRuntimeFsReader = isDependencyInput && Object.entries(AUDITED_RUNTIME_FS_READER_HASHES).some(
+      ([suffix, hashes]) => normalizedInput.endsWith(suffix) && hashes.includes(sha256(source))
+    );
+    const origin = path25.relative(projectRoot, realInput).split(path25.sep).join("/");
+    warnings.push(
+      ...findNodeModulesRuntimeAssetReads(
+        source,
+        origin,
+        isDependencyInput && !auditedRuntimeFsReader
+      )
+    );
+    if (!isInside(realApplicationRoot, realInput) || isDependencyInput) {
+      continue;
+    }
+    const ast = parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      allowHashBang: true,
+      allowReturnOutsideFunction: true
+    });
+    walkSimple(ast, {
+      CallExpression(node) {
+        const isRequire = node.callee.type === "Identifier" && (node.callee.name === "require" || node.callee.name === "__require") || node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "module" && (node.callee.property.type === "Identifier" && node.callee.property.name === "require" || node.callee.property.type === "Literal" && node.callee.property.value === "require");
+        const isRequireResolve = node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && (node.callee.object.name === "require" || node.callee.object.name === "__require") && node.callee.property.type === "Identifier" && node.callee.property.name === "resolve";
+        if (isRequire && node.arguments[0]?.type !== "Literal") {
+          warnings.push(`dynamic require in application input: ${origin}`);
+        }
+        if (isRequireResolve && (node.arguments[0]?.type !== "Literal" || typeof node.arguments[0].value !== "string")) {
+          warnings.push(
+            `dynamic require.resolve in application input: ${origin}`
+          );
+        }
+      },
+      ImportExpression(node) {
+        if (node.source.type !== "Literal" || typeof node.source.value !== "string") {
+          warnings.push(`dynamic import in application input: ${origin}`);
+        }
+      }
+    });
+  }
+  return [...new Set(warnings)].sort();
+}
+function reservePort() {
+  return new Promise((resolve2, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(
+          () => reject(new Error("isolated probe failed to reserve a port"))
+        );
+        return;
+      }
+      server.close((error) => error ? reject(error) : resolve2(address.port));
+    });
+  });
+}
+function waitForExit(child) {
+  if (child.exitCode !== null || child.signalCode !== null)
+    return Promise.resolve();
+  return new Promise((resolve2) => child.once("exit", () => resolve2()));
+}
+function readLinuxProcessIdentity(pid) {
+  if (process.platform !== "linux") return void 0;
+  try {
+    const stat = fs29.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd < 0) return void 0;
+    const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
+    return /^\d+$/.test(fields[19] || "") && /^\d+$/.test(fields[2] || "") ? { processStartTicks: fields[19], processGroupId: Number(fields[2]) } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function registerProbe(child) {
+  if (!child.pid) throw new Error("isolated process pid unavailable");
+  const identity = readLinuxProcessIdentity(child.pid);
+  if (process.platform === "linux" && !identity) {
+    child.kill("SIGKILL");
+    throw new Error("isolated process birth identity unavailable");
+  }
+  probeIdentities.set(child, {
+    pid: child.pid,
+    processStartTicks: identity?.processStartTicks
+  });
+}
+function probeGroupRunning(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return false;
+  if (process.platform === "linux") {
+    const current = readLinuxProcessIdentity(registered.pid);
+    if (current) {
+      if (current.processStartTicks !== registered.processStartTicks || current.processGroupId !== registered.pid) {
+        return false;
+      }
+    } else {
+      try {
+        process.kill(registered.pid, 0);
+        return false;
+      } catch (error) {
+        if (error.code !== "ESRCH") return false;
+      }
+    }
+  }
+  try {
+    process.kill(-registered.pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function waitForProbeGroup(child, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (probeGroupRunning(child) && Date.now() < deadline) {
+    await new Promise((resolve2) => setTimeout(resolve2, 25));
+  }
+  return !probeGroupRunning(child);
+}
+async function stopProbe(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return;
+  if (probeGroupRunning(child)) {
+    try {
+      process.kill(-registered.pid, "SIGTERM");
+    } catch {
+    }
+  }
+  if (!await waitForProbeGroup(child, 500)) {
+    if (probeGroupRunning(child)) {
+      try {
+        process.kill(-registered.pid, "SIGKILL");
+      } catch {
+      }
+    }
+    if (!await waitForProbeGroup(child, 500)) {
+      throw new Error(
+        `isolated probe process group did not exit: ${registered.pid}`
+      );
+    }
+  }
+  await waitForExit(child);
+}
+function resolveNestTsconfig(projectRoot) {
+  const nestConfigFile = path25.join(projectRoot, "nest-cli.json");
+  let configured;
+  if (fs29.existsSync(nestConfigFile)) {
+    const nestConfig = JSON.parse(fs29.readFileSync(nestConfigFile, "utf8"));
+    configured = nestConfig.compilerOptions?.tsConfigPath;
+    if (configured !== void 0 && typeof configured !== "string") {
+      throw new Error("nest-cli.json compilerOptions.tsConfigPath is invalid");
+    }
+  }
+  const candidates = typeof configured === "string" ? [configured] : ["tsconfig.build.json", "tsconfig.node.json", "tsconfig.json"];
+  const selected = candidates.map((candidate) => path25.resolve(projectRoot, candidate)).find((candidate) => fs29.existsSync(candidate));
+  if (!selected) {
+    throw new Error(`Nest TypeScript config missing: ${candidates.join(", ")}`);
+  }
+  if (!isInside(projectRoot, selected))
+    throw new Error("Nest TypeScript config escaped project root");
+  if (fs29.lstatSync(selected).isSymbolicLink())
+    throw new Error("Nest TypeScript config symlink is unsupported");
+  const realConfig = fs29.realpathSync(selected);
+  if (!isInside(projectRoot, realConfig) || !fs29.statSync(realConfig).isFile()) {
+    throw new Error("Nest TypeScript config escaped project root");
+  }
+  return realConfig;
+}
+function resolveLocalTsconfigReference(projectRoot, fromFile, requested) {
+  if (!path25.isAbsolute(requested) && !requested.startsWith(".")) {
+    return void 0;
+  }
+  const base = path25.isAbsolute(requested) ? requested : path25.resolve(path25.dirname(fromFile), requested);
+  const candidate = [
+    base,
+    `${base}.json`,
+    path25.join(base, "tsconfig.json")
+  ].find((file) => fs29.existsSync(file));
+  if (!candidate) return void 0;
+  const realCandidate = fs29.realpathSync(candidate);
+  if (!isInside(projectRoot, realCandidate)) {
+    throw new Error("local TypeScript config escaped project root");
+  }
+  return realCandidate;
+}
+function sourceInputRecords(projectRoot, inputFiles) {
+  const records = /* @__PURE__ */ new Map();
+  for (const inputFile of inputFiles) {
+    if (!fs29.existsSync(inputFile)) continue;
+    if (fs29.lstatSync(inputFile).isSymbolicLink()) {
+      throw new Error(
+        `source input symlink is unsupported: ${path25.relative(projectRoot, inputFile)}`
+      );
+    }
+    const realFile = fs29.realpathSync(inputFile);
+    if (!isInside(projectRoot, realFile) || !fs29.statSync(realFile).isFile()) {
+      throw new Error("source input escaped project root");
+    }
+    const relative = path25.relative(projectRoot, realFile).split(path25.sep).join("/");
+    const contents = fs29.readFileSync(realFile);
+    records.set(relative, {
+      path: relative,
+      sha256: sha256(contents),
+      size: contents.length
+    });
+  }
+  return [...records.values()].sort(
+    (left, right) => left.path.localeCompare(right.path)
+  );
+}
+function nestCompilationSourceInputs(projectRoot, sourceConfig) {
+  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
+  const typescript = projectRequire(
+    "typescript"
+  );
+  const configFiles = /* @__PURE__ */ new Set();
+  const visitConfig = (configFile) => {
+    const realConfig = fs29.realpathSync(configFile);
+    if (configFiles.has(realConfig)) return;
+    if (!isInside(projectRoot, realConfig)) return;
+    configFiles.add(realConfig);
+    const loaded2 = typescript.readConfigFile(
+      realConfig,
+      typescript.sys.readFile
+    );
+    if (loaded2.error) {
+      throw new Error(`TypeScript config cannot be read: ${realConfig}`);
+    }
+    const extended = Array.isArray(loaded2.config?.extends) ? loaded2.config.extends : loaded2.config?.extends ? [loaded2.config.extends] : [];
+    for (const requested of extended) {
+      if (typeof requested !== "string") continue;
+      const local = resolveLocalTsconfigReference(
+        projectRoot,
+        realConfig,
+        requested
+      );
+      if (local) visitConfig(local);
+    }
+    for (const reference of loaded2.config?.references ?? []) {
+      if (typeof reference?.path !== "string") continue;
+      const local = resolveLocalTsconfigReference(
+        projectRoot,
+        realConfig,
+        reference.path
+      );
+      if (local) visitConfig(local);
+    }
+  };
+  visitConfig(sourceConfig);
+  const loaded = typescript.readConfigFile(
+    sourceConfig,
+    typescript.sys.readFile
+  );
+  if (loaded.error) {
+    throw new Error(`TypeScript config cannot be read: ${sourceConfig}`);
+  }
+  const parsed = typescript.parseJsonConfigFileContent(
+    loaded.config,
+    typescript.sys,
+    path25.dirname(sourceConfig),
+    { noEmit: true, incremental: false, composite: false },
+    sourceConfig
+  );
+  if (parsed.errors.length > 0) {
+    throw new Error("TypeScript config contains errors");
+  }
+  const program = typescript.createProgram({
+    rootNames: parsed.fileNames,
+    options: parsed.options,
+    projectReferences: parsed.projectReferences
+  });
+  const inputs = new Set(configFiles);
+  for (const sourceFile of program.getSourceFiles()) {
+    if (!fs29.existsSync(sourceFile.fileName)) continue;
+    const realFile = fs29.realpathSync(sourceFile.fileName);
+    const relative = path25.relative(projectRoot, realFile);
+    if (isInside(projectRoot, realFile) && !relative.split(path25.sep).includes("node_modules")) {
+      inputs.add(realFile);
+    }
+  }
+  for (const name of ["package.json", "nest-cli.json"]) {
+    const file = path25.join(projectRoot, name);
+    if (fs29.existsSync(file)) inputs.add(file);
+  }
+  return sourceInputRecords(projectRoot, inputs);
+}
+function sourceIdentitySha256(workspaceTreeSha256, sourceInputs) {
+  return sha256(JSON.stringify({ sourceInputs, workspaceTreeSha256 }));
+}
+function resolveNestCli(projectRoot) {
+  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
+  try {
+    return projectRequire.resolve("@nestjs/cli/bin/nest.js");
+  } catch (directError) {
+    try {
+      const packageFile = projectRequire.resolve("@nestjs/cli/package.json");
+      const packageJson = JSON.parse(fs29.readFileSync(packageFile, "utf8"));
+      const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.nest;
+      if (!relativeBin) throw new Error("@nestjs/cli has no nest binary");
+      const cliFile = path25.resolve(path25.dirname(packageFile), relativeBin);
+      if (!fs29.statSync(cliFile).isFile())
+        throw new Error("@nestjs/cli nest binary is not a file");
+      return cliFile;
+    } catch (packageError) {
+      throw new Error(
+        `project @nestjs/cli is unavailable: ${packageError instanceof Error ? packageError.message : String(packageError)}; direct=${directError instanceof Error ? directError.message : String(directError)}`
+      );
+    }
+  }
+}
+function collectChildOutput(child, stream) {
+  let output = "";
+  child[stream]?.setEncoding("utf8");
+  child[stream]?.on("data", (chunk) => {
+    output = `${output}${String(chunk)}`.slice(-64 * 1024);
+  });
+  return () => output;
+}
+async function waitForCommand(child, timeoutMs, description) {
+  let timer;
+  try {
+    return await new Promise((resolve2, reject) => {
+      let settled = false;
+      const finish = (callback) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        callback();
+      };
+      child.once("error", (error) => finish(() => reject(error)));
+      child.once(
+        "exit",
+        (code, signal) => finish(
+          () => signal ? reject(new Error(`${description} exited by ${signal}`)) : resolve2(code ?? 1)
+        )
+      );
+      timer = setTimeout(
+        () => finish(() => reject(new Error(`${description} timeout`))),
+        timeoutMs
+      );
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function compileNestSource(projectRoot, stagingRoot, timeoutMs, sourceConfig) {
+  const cliFile = resolveNestCli(projectRoot);
+  const compileRoot = path25.join(stagingRoot, ".compiled");
+  const outputRoot = path25.join(compileRoot, "output");
+  fs29.mkdirSync(outputRoot, { recursive: true });
+  const isolatedConfig = path25.join(compileRoot, "tsconfig.json");
+  fs29.writeFileSync(
+    isolatedConfig,
+    `${JSON.stringify(
+      {
+        extends: sourceConfig,
+        compilerOptions: {
+          outDir: outputRoot,
+          incremental: false,
+          composite: false,
+          declaration: false,
+          declarationMap: false,
+          sourceMap: false,
+          inlineSourceMap: false
+        }
+      },
+      null,
+      2
+    )}
+`,
+    { mode: 384 }
+  );
+  const child = spawn2(
+    process.execPath,
+    [cliFile, "build", "--path", path25.relative(projectRoot, isolatedConfig)],
+    {
+      cwd: projectRoot,
+      detached: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, NODE_ENV: "production" }
+    }
+  );
+  registerProbe(child);
+  const stdout = collectChildOutput(child, "stdout");
+  const stderr = collectChildOutput(child, "stderr");
+  try {
+    const code = await waitForCommand(
+      child,
+      timeoutMs,
+      "isolated Nest compilation"
+    );
+    if (code !== 0) {
+      throw new Error(
+        `isolated Nest compilation failed with exit ${code}: ${stderr().trim() || stdout().trim()}`
+      );
+    }
+  } finally {
+    await stopProbe(child);
+  }
+  const candidates = [
+    path25.join(outputRoot, "server", "main.js"),
+    path25.join(outputRoot, "main.js")
+  ].filter((candidate) => fs29.existsSync(candidate));
+  if (candidates.length !== 1) {
+    throw new Error(
+      candidates.length === 0 ? "isolated Nest compiled entry missing; checked server/main.js and main.js" : "isolated Nest compiled entry is ambiguous"
+    );
+  }
+  const entry = fs29.realpathSync(candidates[0]);
+  if (!isInside(fs29.realpathSync(outputRoot), entry) || !fs29.statSync(entry).isFile()) {
+    throw new Error("isolated Nest compiled entry escaped output root");
+  }
+  return {
+    entry,
+    applicationRoot: outputRoot,
+    manifestEntry: `.isolated/${path25.relative(outputRoot, entry).split(path25.sep).join("/")}`
+  };
+}
+async function isolatedProbe(bundleFile, timeoutMs) {
+  const probeRoot = fs29.mkdtempSync(
+    path25.join(os3.tmpdir(), "miaoda-server-bundle-probe-")
+  );
+  const probeBundle = path25.join(probeRoot, "server.bundle.cjs");
+  fs29.copyFileSync(bundleFile, probeBundle);
+  const port = await reservePort();
+  const configuredBasePath = process.env.CLIENT_BASE_PATH;
+  const basePath = configuredBasePath?.startsWith("/") && !configuredBasePath.startsWith("//") ? configuredBasePath.replace(/\/+$/, "") : "";
+  const readinessPath = `${basePath}/__innerapi__/capability/list`;
+  const startedAt = Date.now();
+  const child = spawn2(process.execPath, [probeBundle], {
+    cwd: probeRoot,
+    detached: true,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...process.env,
+      NODE_PATH: "",
+      NODE_ENV: "development",
+      SERVER_HOST: "127.0.0.1",
+      SERVER_PORT: String(port),
+      MIAODA_SERVER_CACHE_PROBE: "true",
+      DEPRECATED_SKIP_INIT_DB_CONNECTION: process.env.DEPRECATED_SKIP_INIT_DB_CONNECTION ?? "true",
+      FORCE_AUTHN_INNERAPI_DOMAIN: process.env.FORCE_AUTHN_INNERAPI_DOMAIN ?? "http://127.0.0.1",
+      FORCE_AUTHN_ACCESS_KEY: process.env.FORCE_AUTHN_ACCESS_KEY ?? "server-startup-probe",
+      FORCE_AUTHN_ACCESS_SECRET: process.env.FORCE_AUTHN_ACCESS_SECRET ?? "server-startup-probe"
+    }
+  });
+  registerProbe(child);
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.setEncoding("utf8");
+  child.stdout?.on("data", (chunk) => {
+    stdout = `${stdout}${String(chunk)}`.slice(-64 * 1024);
+  });
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk) => {
+    stderr += String(chunk);
+  });
+  try {
+    await new Promise((resolve2, reject) => {
+      const deadline = Date.now() + timeoutMs;
+      const timeoutError = () => new Error(
+        `isolated bundle readiness timeout${`${stderr}
+${stdout}`.trim() ? `: ${`${stderr}
+${stdout}`.trim()}` : ""}`
+      );
+      let settled = false;
+      let retryTimer;
+      const finish = (error) => {
+        if (settled) return;
+        settled = true;
+        if (retryTimer) clearTimeout(retryTimer);
+        if (error) reject(error);
+        else resolve2();
+      };
+      const retry = () => {
+        if (settled) return;
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+          finish(timeoutError());
+          return;
+        }
+        retryTimer = setTimeout(attempt, Math.min(25, remaining));
+      };
+      const attempt = () => {
+        if (settled) return;
+        if (child.exitCode !== null || child.signalCode !== null) {
+          finish(
+            new Error(
+              `isolated bundle exited before readiness: ${stderr.trim()}`
+            )
+          );
+          return;
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+          finish(timeoutError());
+          return;
+        }
+        let attemptSettled = false;
+        const request = http.get(
+          { host: "127.0.0.1", port, path: readinessPath },
+          (response) => {
+            if (attemptSettled || settled) {
+              response.destroy();
+              return;
+            }
+            attemptSettled = true;
+            response.resume();
+            if ((response.statusCode ?? 500) < 500) finish();
+            else retry();
+          }
+        );
+        request.setTimeout(remaining, () => {
+          request.destroy(new Error("isolated bundle readiness timeout"));
+        });
+        request.once("error", (error) => {
+          if (attemptSettled || settled) return;
+          attemptSettled = true;
+          if (Date.now() >= deadline || error.message === "isolated bundle readiness timeout") {
+            finish(timeoutError());
+          } else {
+            retry();
+          }
+        });
+      };
+      attempt();
+    });
+    if (fs29.existsSync(path25.join(probeRoot, "node_modules"))) {
+      throw new Error("isolated probe unexpectedly contained node_modules");
+    }
+    return Date.now() - startedAt;
+  } finally {
+    await stopProbe(child);
+    fs29.rmSync(probeRoot, { recursive: true, force: true });
+  }
+}
+function atomicWriteJson(file, value) {
+  fs29.mkdirSync(path25.dirname(file), { recursive: true });
+  const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+  fs29.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}
+`, {
+    mode: 384
+  });
+  fs29.renameSync(temporary, file);
+}
+function snapshotCurrentPointer(file) {
+  if (!fs29.existsSync(file)) return void 0;
+  if (fs29.lstatSync(file).isSymbolicLink()) {
+    throw new Error("current pointer symlink is unsupported");
+  }
+  const stats = fs29.statSync(file);
+  if (!stats.isFile()) throw new Error("current pointer is not a file");
+  return { file, dev: stats.dev, ino: stats.ino };
+}
+function invalidateCurrentPointerIfUnchanged(identity) {
+  if (!identity || !fs29.existsSync(identity.file)) return;
+  const stats = fs29.lstatSync(identity.file);
+  if (stats.isSymbolicLink() || !stats.isFile() || stats.dev !== identity.dev || stats.ino !== identity.ino) {
+    return;
+  }
+  fs29.unlinkSync(identity.file);
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function assertExistingGenerationEquivalent(generationRoot, generationsRoot, expectedBundle, expectedManifest) {
+  const mismatch = () => new Error("immutable generation already exists with different content");
+  if (fs29.lstatSync(generationRoot).isSymbolicLink()) throw mismatch();
+  const realGenerationRoot = fs29.realpathSync(generationRoot);
+  if (!isInside(generationsRoot, realGenerationRoot) || !fs29.statSync(realGenerationRoot).isDirectory()) {
+    throw mismatch();
+  }
+  const bundleFile = path25.join(realGenerationRoot, "server.bundle.cjs");
+  const manifestFile = path25.join(realGenerationRoot, "manifest.json");
+  if (fs29.lstatSync(bundleFile).isSymbolicLink() || fs29.lstatSync(manifestFile).isSymbolicLink() || !fs29.statSync(bundleFile).isFile() || !fs29.statSync(manifestFile).isFile()) {
+    throw mismatch();
+  }
+  const existingBundle = fs29.readFileSync(bundleFile);
+  const existingManifest = JSON.parse(
+    fs29.readFileSync(manifestFile, "utf8")
+  );
+  const existingStartupMs = existingManifest?.isolatedProbe?.startupMs;
+  if (sha256(existingBundle) !== sha256(expectedBundle) || !Number.isFinite(existingStartupMs) || existingStartupMs < 0) {
+    throw mismatch();
+  }
+  const expectedWithExistingProbeTime = {
+    ...expectedManifest,
+    isolatedProbe: {
+      ...expectedManifest.isolatedProbe,
+      startupMs: existingStartupMs
+    }
+  };
+  if (stableJson(existingManifest) !== stableJson(expectedWithExistingProbeTime))
+    throw mismatch();
+}
+async function buildServerStartupBundle(options) {
+  const startedAt = Date.now();
+  let stagingRoot;
+  let currentPointerIdentity;
+  try {
+    const projectRoot = fs29.realpathSync(path25.resolve(options.projectRoot));
+    const cacheRoot = path25.resolve(
+      projectRoot,
+      options.cacheRoot ?? ".miaoda-cache/server"
+    );
+    if (!isInside(projectRoot, cacheRoot))
+      throw new Error("cache root escaped project root");
+    assertNoSymlinkComponents(
+      projectRoot,
+      cacheRoot,
+      "cache path symlink is unsupported"
+    );
+    currentPointerIdentity = snapshotCurrentPointer(
+      path25.join(cacheRoot, "current.json")
+    );
+    const timeoutMs = options.probeTimeoutMs ?? 1e4;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+      throw new Error("probe timeout must be positive");
+    const compileTimeoutMs = options.compileTimeoutMs ?? 12e4;
+    if (!Number.isFinite(compileTimeoutMs) || compileTimeoutMs <= 0)
+      throw new Error("compile timeout must be positive");
+    const explicitEntry = options.entry ? resolveEntry(projectRoot, options.entry) : void 0;
+    const sourceConfig = explicitEntry ? void 0 : resolveNestTsconfig(projectRoot);
+    const readSourceInputs = () => explicitEntry ? sourceInputRecords(
+      projectRoot,
+      [
+        explicitEntry,
+        path25.join(projectRoot, "package.json"),
+        path25.join(projectRoot, "nest-cli.json")
+      ].filter((file) => fs29.existsSync(file))
+    ) : nestCompilationSourceInputs(projectRoot, sourceConfig);
+    const sourceInputs = readSourceInputs();
+    const readSourceIdentity = () => sourceIdentitySha256(
+      workspaceSourceSha256(projectRoot),
+      readSourceInputs()
+    );
+    const sourceSha256 = sourceIdentitySha256(
+      workspaceSourceSha256(projectRoot),
+      sourceInputs
+    );
+    const generationsRoot = path25.join(cacheRoot, "generations");
+    fs29.mkdirSync(generationsRoot, { recursive: true });
+    assertNoSymlinkComponents(
+      projectRoot,
+      generationsRoot,
+      "cache path symlink is unsupported"
+    );
+    stagingRoot = fs29.mkdtempSync(path25.join(generationsRoot, ".staging-"));
+    let compiled;
+    if (explicitEntry) {
+      compiled = {
+        entry: explicitEntry,
+        applicationRoot: projectRoot,
+        manifestEntry: path25.relative(projectRoot, explicitEntry).split(path25.sep).join("/")
+      };
+    } else {
+      compiled = await compileNestSource(
+        projectRoot,
+        stagingRoot,
+        compileTimeoutMs,
+        sourceConfig
+      );
+    }
+    const entry = compiled.entry;
+    if (readSourceIdentity() !== sourceSha256) {
+      throw new Error("source changed during isolated Nest compilation");
+    }
+    const stagingBundle = path25.join(stagingRoot, "server.bundle.cjs");
+    const buildResult2 = await build({
+      absWorkingDir: projectRoot,
+      entryPoints: [entry],
+      outfile: stagingBundle,
+      bundle: true,
+      platform: "node",
+      format: "cjs",
+      target: `node${process.versions.node.split(".")[0]}`,
+      metafile: true,
+      logLevel: "silent",
+      sourcemap: false,
+      plugins: [
+        knownFrameworkDynamicLoaderStubs(),
+        optionalNestDependencyStubs(),
+        fullstackNestRuntimeResolver(projectRoot),
+        legacyFullstackNestOpenApiStub(projectRoot),
+        classTransformerStorageResolver(projectRoot)
+      ]
+    });
+    const output = buildResult2.metafile.outputs[stagingBundle] ?? Object.values(buildResult2.metafile.outputs)[0];
+    const unsafeApplicationLoads = findUnsafeApplicationModuleLoads(
+      projectRoot,
+      compiled.applicationRoot,
+      Object.keys(buildResult2.metafile.inputs)
+    );
+    if (unsafeApplicationLoads.length > 0) {
+      throw new Error(unsafeApplicationLoads.join("; "));
+    }
+    const externalImports = (output?.imports ?? []).filter((item) => item.external && !BUILTINS.has(item.path)).map((item) => item.path).sort();
+    if (externalImports.length > 0) {
+      throw new Error(
+        `bundle contains external imports: ${externalImports.join(", ")}`
+      );
+    }
+    const bundle = fs29.readFileSync(stagingBundle);
+    const dynamicLoads = findDynamicModuleLoads(bundle.toString("utf8"));
+    if (dynamicLoads.length > 0) throw new Error(dynamicLoads.join("; "));
+    const startupMs = await isolatedProbe(stagingBundle, timeoutMs);
+    if (readSourceIdentity() !== sourceSha256) {
+      throw new Error("source changed while building startup bundle");
+    }
+    const lockfileSha256 = workspaceLockfileSha256(projectRoot);
+    const bundleSha256 = sha256(bundle);
+    const nodeMajor = Number(process.versions.node.split(".")[0]);
+    const generationId = sha256(
+      [
+        BUILDER_POLICY_VERSION,
+        sourceSha256,
+        lockfileSha256,
+        bundleSha256,
+        nodeMajor,
+        process.platform,
+        process.arch
+      ].join("\0")
+    );
+    const manifest = {
+      schemaVersion: 1,
+      builderPolicyVersion: BUILDER_POLICY_VERSION,
+      generationId,
+      entry: compiled.manifestEntry,
+      sourceSha256,
+      sourceInputs,
+      lockfileSha256,
+      bundleSha256,
+      nodeMajor,
+      platform: process.platform,
+      arch: process.arch,
+      externalImports: [],
+      runtimeAssets: [],
+      isolatedProbe: {
+        success: true,
+        nodeModulesPresent: false,
+        startupMs
+      }
+    };
+    fs29.rmSync(path25.join(stagingRoot, ".compiled"), {
+      recursive: true,
+      force: true
+    });
+    atomicWriteJson(path25.join(stagingRoot, "manifest.json"), manifest);
+    const generationRoot = path25.join(generationsRoot, generationId);
+    if (fs29.existsSync(generationRoot)) {
+      assertExistingGenerationEquivalent(
+        generationRoot,
+        generationsRoot,
+        bundle,
+        manifest
+      );
+      fs29.rmSync(stagingRoot, { recursive: true, force: true });
+    } else {
+      fs29.renameSync(stagingRoot, generationRoot);
+    }
+    stagingRoot = void 0;
+    atomicWriteJson(path25.join(cacheRoot, "current.json"), {
+      schemaVersion: 1,
+      generationId
+    });
+    return {
+      built: true,
+      generationId,
+      bundleFile: path25.join(generationRoot, "server.bundle.cjs"),
+      manifestFile: path25.join(generationRoot, "manifest.json"),
+      reasons: [],
+      elapsedMs: Date.now() - startedAt
+    };
+  } catch (error) {
+    if (stagingRoot) fs29.rmSync(stagingRoot, { recursive: true, force: true });
+    invalidateCurrentPointerIfUnchanged(currentPointerIdentity);
+    return {
+      built: false,
+      reasons: [error instanceof Error ? error.message : String(error)],
+      elapsedMs: Date.now() - startedAt
+    };
+  }
+}
+
 // src/commands/build/index.ts
 var getTokenCommand = {
   name: "get-token",
   description: "Get artifact upload credential (STI token)",
   register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(async (options) => {
-      await getToken(options);
-    });
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(
+      async (options) => {
+        await getToken(options);
+      }
+    );
   }
 };
 var uploadStaticCommand = {
   name: "upload-static",
   description: "Upload shared/static files to TOS",
   register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option("--static-dir <dir>", "Static files directory", UPLOAD_STATIC_DEFAULTS.staticDir).option("--tosutil-path <path>", "Path to tosutil binary", UPLOAD_STATIC_DEFAULTS.tosutilPath).option("--endpoint <endpoint>", "TOS endpoint", UPLOAD_STATIC_DEFAULTS.endpoint).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option(
+      "--static-dir <dir>",
+      "Static files directory",
+      UPLOAD_STATIC_DEFAULTS.staticDir
+    ).option(
+      "--tosutil-path <path>",
+      "Path to tosutil binary",
+      UPLOAD_STATIC_DEFAULTS.tosutilPath
+    ).option(
+      "--endpoint <endpoint>",
+      "TOS endpoint",
+      UPLOAD_STATIC_DEFAULTS.endpoint
+    ).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
       await uploadStatic(options);
     });
   }
@@ -8288,10 +9703,42 @@ var preUploadStaticCommand = {
     });
   }
 };
+var serverStartupBundleCommand = {
+  name: "server-startup-bundle",
+  description: "Build and isolate-probe a node_modules-free NestJS startup bundle",
+  register(program) {
+    program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).option(
+      "--entry <file>",
+      "Advanced: bundle an existing compiled entry instead of isolated Nest compilation"
+    ).option(
+      "--cache-root <dir>",
+      "Server startup cache root",
+      ".miaoda-cache/server"
+    ).option(
+      "--probe-timeout-ms <ms>",
+      "Isolated availability probe timeout in milliseconds",
+      "10000"
+    ).action(
+      async (options) => {
+        const result = await buildServerStartupBundle({
+          ...options,
+          probeTimeoutMs: Number(options.probeTimeoutMs)
+        });
+        console.log(JSON.stringify(result));
+        if (!result.built) process.exitCode = 2;
+      }
+    );
+  }
+};
 var buildCommandGroup = {
   name: "build",
   description: "Build related commands",
-  commands: [getTokenCommand, uploadStaticCommand, preUploadStaticCommand]
+  commands: [
+    getTokenCommand,
+    uploadStaticCommand,
+    preUploadStaticCommand,
+    serverStartupBundleCommand
+  ]
 };
 
 // src/commands/index.ts
@@ -8309,13 +9756,13 @@ var commands = [
 
 // src/index.ts
 for (const filename of [".env.local", ".env"]) {
-  const envPath = path25.join(process.cwd(), filename);
-  if (fs29.existsSync(envPath)) {
+  const envPath = path26.join(process.cwd(), filename);
+  if (fs30.existsSync(envPath)) {
     dotenvConfig({ path: envPath });
   }
 }
-var __dirname = path25.dirname(fileURLToPath5(import.meta.url));
-var pkg = JSON.parse(fs29.readFileSync(path25.join(__dirname, "../package.json"), "utf-8"));
+var __dirname = path26.dirname(fileURLToPath5(import.meta.url));
+var pkg = JSON.parse(fs30.readFileSync(path26.join(__dirname, "../package.json"), "utf-8"));
 var cli = new FullstackCLI(pkg.version);
 cli.useAll(commands);
 cli.run();