@lark-apaas/fullstack-cli 1.1.64-alpha.20260901065806 → 1.1.64-alpha.20260901212526

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
-import fs30 from "fs";
-import path26 from "path";
+import fs31 from "fs";
+import path27 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { config as dotenvConfig } from "dotenv";
 
@@ -8261,532 +8261,640 @@ async function preUploadStatic(options) {
 }
 
 // src/commands/build/server-startup-bundle.handler.ts
-import fs29 from "fs";
+import fs30 from "fs";
 import http from "http";
 import net from "net";
 import os3 from "os";
-import path25 from "path";
+import path26 from "path";
 import { builtinModules, createRequire as createRequire3 } from "module";
 import { spawn as spawn2 } from "child_process";
 import { createHash, randomUUID } from "crypto";
 import { build } from "esbuild";
 import { parse } from "acorn";
 import { ancestor as walkAncestor, simple as walkSimple } from "acorn-walk";
-var OPTIONAL_NEST_DEPENDENCIES = [
-  "@nestjs/microservices",
-  "@nestjs/microservices/microservices-module",
-  "@nestjs/websockets/socket-module",
-  "@node-rs/xxhash",
-  "fsevents"
-];
+
+// src/commands/build/server-startup-module-guard.ts
+import fs29 from "fs";
+import path25 from "path";
+var STARTUP_BUNDLE_FILE = "payload/server.bundle.cjs";
+var STARTUP_ENTRY_FILE = "payload/server.start.cjs";
+var MODULE_GUARD_FILE = "module-resolution-guard.cjs";
+var MODULE_GUARD_SOURCE = `'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const Module = require('node:module');
+
+const payloadRoot = fs.realpathSync(__dirname);
+const payloadRequire = Module.createRequire(path.join(payloadRoot, 'package.json'));
+const builtins = new Set([
+  ...Module.builtinModules,
+  ...Module.builtinModules.map(name => 'node:' + name),
+]);
+const originalResolveFilename = Module._resolveFilename;
+
+function isInside(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function isBareSpecifier(request) {
+  return typeof request === 'string' &&
+    !request.startsWith('.') &&
+    !path.isAbsolute(request) &&
+    !request.startsWith('file:');
+}
+
+function assertPayloadResolution(request, resolved) {
+  if (builtins.has(resolved)) return resolved;
+  const realResolved = typeof resolved === 'string' && fs.existsSync(resolved)
+    ? fs.realpathSync(resolved)
+    : resolved;
+  if (typeof realResolved !== 'string' || !isInside(payloadRoot, realResolved)) {
+    const error = new Error('MIAODA_STARTUP_MODULE_OUTSIDE_PAYLOAD:' + request);
+    error.code = 'MIAODA_STARTUP_MODULE_OUTSIDE_PAYLOAD';
+    throw error;
+  }
+  return realResolved;
+}
+
+Module._resolveFilename = function miaodaResolveFilename(request, parent, isMain, options) {
+  if (builtins.has(request)) {
+    return originalResolveFilename.call(this, request, parent, isMain, options);
+  }
+  const parentFilename = parent && typeof parent.filename === 'string'
+    ? parent.filename
+    : '';
+  if (!isInside(payloadRoot, parentFilename)) {
+    if (typeof request === 'string' && path.isAbsolute(request)) {
+      return assertPayloadResolution(
+        request,
+        originalResolveFilename.call(this, request, parent, isMain, options)
+      );
+    }
+    if (!isBareSpecifier(request)) {
+      return assertPayloadResolution(request, undefined);
+    }
+    return assertPayloadResolution(request, payloadRequire.resolve(request));
+  }
+  return assertPayloadResolution(
+    request,
+    originalResolveFilename.call(this, request, parent, isMain, options)
+  );
+};
+`;
+function writeServerStartupLauncher(payloadRoot) {
+  fs29.writeFileSync(
+    path25.join(payloadRoot, MODULE_GUARD_FILE),
+    MODULE_GUARD_SOURCE,
+    {
+      mode: 420
+    }
+  );
+  fs29.writeFileSync(
+    path25.join(payloadRoot, path25.basename(STARTUP_ENTRY_FILE)),
+    `require('./${MODULE_GUARD_FILE}');
+require('./${path25.basename(STARTUP_BUNDLE_FILE)}');
+`,
+    { mode: 420 }
+  );
+}
+
+// src/commands/build/server-startup-bundle.handler.ts
+var SCHEMA_VERSION = 4;
+var BUILDER_POLICY_VERSION = 4;
+var ARTIFACT_FORMAT = "hybrid-bundle-dynamic-islands";
+var DEPENDENCY_MODE = "dynamic-islands";
+var MAX_ISLAND_DISCOVERY_PASSES = 128;
+var MAX_GENERATION_FILES = 5e4;
+var MAX_GENERATION_BYTES = 256 * 1024 * 1024;
+var MAX_GENERATION_FILE_BYTES = 64 * 1024 * 1024;
+var MAX_FILE_INDEX_BYTES = 16 * 1024 * 1024;
+var MAX_MANIFEST_BYTES = 1024 * 1024;
+var MAX_PROBE_BYTES = 64 * 1024;
+var MAX_DEPENDENCY_METADATA_BYTES = 64 * 1024 * 1024;
+var MAX_PACKAGE_MANIFEST_BYTES = 1024 * 1024;
+var MAX_READINESS_RESPONSE_BYTES = 64 * 1024;
 var BUILTINS = /* @__PURE__ */ new Set([
   ...builtinModules,
   ...builtinModules.map((name) => `node:${name}`)
 ]);
-var BUILDER_POLICY_VERSION = 5;
-var RUNTIME_ASSET_READ_METHODS = /* @__PURE__ */ new Set([
-  "access",
-  "accessSync",
-  "createReadStream",
-  "open",
-  "openSync",
-  "readFile",
-  "readFileSync",
-  "stat",
-  "statSync"
-]);
-var SOURCE_HASH_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
+var ROOT_SOURCE_HASH_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".git",
   ".miaoda-cache",
   ".turbo",
   "coverage",
   "dist",
-  "logs",
-  "node_modules"
+  "logs"
 ]);
-var AUDITED_FRAMEWORK_DYNAMIC_LOADER_HASHES = {
-  "/@nestjs/common/utils/load-package.util.js": [
-    "8fc26b273fe5499285e25355b4368fe8e1527ae217ede53144219c17cf1aa721"
-  ],
-  "/@nestjs/core/helpers/optional-require.js": [
-    "c8a109dab1b2461e866fe04b8be5988ccc199a2239c730abc05fc28c0f85d7f2"
-  ],
-  "/@nestjs/core/helpers/load-adapter.js": [
-    "7970867a441f356a2e257a12e43dbb8022b58631b3076f298058abb46270009a"
-  ],
-  "/express/lib/view.js": [
-    "ec627880c1b43aee5887164ac2e9c58f01e4ee8086e23a829eddf1af3858c021"
-  ],
-  "/require-in-the-middle/index.js": [
-    "721b78e7afebc91a75ecc8b8d9a166775ef03fd8f96e7cbcad1b46f8b4e74a07"
-  ],
-  "/@opentelemetry/instrumentation/build/src/platform/node/instrumentation.js": ["098033348a2d1750e5722457fa56ccbe51c7df1aafe58f960ec20566a9a8b310"],
-  "/@lark-apaas/nestjs-capability/dist/index.cjs": [
-    "9a6aea944995f46adf9733daaf13ec6cd0d46decab044e2548e0f0b1ba54cde2"
-  ],
-  "/@lark-apaas/fullstack-nestjs-core/dist/index.cjs": [
-    "76fd8e2b4eaf762346e22919b229d81bc6c3848f1e7968e8e63e9493ca6127d9"
-  ],
-  "/pino/lib/transport.js": [
-    "c4857be63a0392312c9010fc222e7216fee0c216ef8dbcf133c61158528ab091"
-  ],
-  "/hbs/lib/hbs.js": [
-    "fdab192a37993e8643e5ce27698fc7e1138b0033e487270f77fd865fa00feab0"
-  ],
-  "/handlebars/lib/index.js": [
-    "76f96bd806c6b48987dd811de149be3d8c296eb440f9c91a3b8cad9fb2f9030a"
-  ]
-};
-var AUDITED_RUNTIME_FS_READER_HASHES = {
-  "/@grpc/grpc-js/build/src/tls-helpers.js": [
-    "9c3b00e23fca5e7996212778f151301eb202337da931f384fb1b60eb9d13f6c4"
-  ],
-  "/@grpc/proto-loader/build/src/util.js": [
-    "72101d764f31ece6d3c22cc6674c32ab3fb1f4975756d9ee4e39f3b155fb6f03"
-  ],
-  "/@lark-apaas/fullstack-nestjs-core/dist/index.cjs": [
-    "76fd8e2b4eaf762346e22919b229d81bc6c3848f1e7968e8e63e9493ca6127d9"
-  ],
-  "/@lark-apaas/nestjs-capability/dist/index.cjs": [
-    "9a6aea944995f46adf9733daaf13ec6cd0d46decab044e2548e0f0b1ba54cde2"
-  ],
-  "/@nestjs/config/dist/config.module.js": [
-    "6d907e32437d1c922d5dcd17e3a0daf052d7d95a56adfc2972965e47cca31ff4"
-  ],
-  "/@nestjs/config/dist/config.service.js": [
-    "a6febcebd600bf8468ffa15e736266407404b5c281f2b1ddcec466245e889a72"
-  ],
-  "/dotenv/lib/main.js": [
-    "0d55d84f7ae79c6752b9b6ffd6f083c32a72d1d6ca2e3606f9161ffa441c3f52"
-  ],
-  "/express/lib/view.js": [
-    "ec627880c1b43aee5887164ac2e9c58f01e4ee8086e23a829eddf1af3858c021"
-  ],
-  "/send/index.js": [
-    "614d9bdd1944cc51663785b0e74c245296830f014a6f8c6c48cdc6a26b56c01e"
-  ],
-  "/@opentelemetry/otlp-exporter-base/build/esm/configuration/otlp-node-http-env-configuration.js": ["d4397f98b3cea799130dd26fee05ce2f27811e5643244e9d59264d218ac9f364"],
-  "/@opentelemetry/otlp-grpc-exporter-base/build/src/configuration/otlp-grpc-env-configuration.js": ["901d2348bf46babe99c7b13cf1aea5bf76f44e5ab45c6f5f1aefbed525938696"],
-  "/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-bsd.js": [
-    "e4cef35e2b61c3471154414de9b9b3dc21b0778e8e728c56ae0f1cdf2558b8ed",
-    "e56af724ce673fe33e83aec425822f5211cd368afcba0d04be41f47da728115f"
-  ],
-  "/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-linux.js": [
-    "d62c5a539558002a63a05093f4f3a0820a35ebf95d51966725fb92110beefc95",
-    "631b352f8994ff3cccf365473127b1dfa97f95bb0d0c70e3ce1137c744b92830"
-  ],
-  "/@protobufjs/fetch/index.js": [
-    "5e8c1d65ee1857327528c5b3fc807c3647324f3097a6cb9358f9e2c328c143fe"
-  ],
-  "/axios/dist/node/axios.cjs": [
-    "241146620c67551291fef242d9ab9fd9b28f1e0e14ae311e7db759d36942b574"
-  ],
-  "/chokidar/index.js": [
-    "18ce2effe87d6379aa1d3756e5694c57c72cf97804056d688499a2bffcec66fd"
-  ],
-  "/chokidar/lib/fsevents-handler.js": [
-    "c2e15baebf066bf8531cbf82a324631a40b218d073274429edb50b4bdbbb0265"
-  ],
-  "/chokidar/lib/nodefs-handler.js": [
-    "60be035e7ea64858a0144230d5073b18a69f3b0eefba62a9b032c6d2f179d807"
-  ],
-  "/form-data/lib/form_data.js": [
-    "c63c99e10e2c3f46fa990787d7dc4a4f65ea90211c422e19626fecb3d767c41d"
-  ],
-  "/handlebars/lib/index.js": [
-    "76f96bd806c6b48987dd811de149be3d8c296eb440f9c91a3b8cad9fb2f9030a"
-  ],
-  "/hbs/lib/hbs.js": [
-    "fdab192a37993e8643e5ce27698fc7e1138b0033e487270f77fd865fa00feab0"
-  ],
-  "/mime/mime.js": [
-    "a121a0b9e780e9ae349a26227a0d25c33ebac2d52a85aae5affa84ba0f53f16c"
-  ],
-  "/mkdirp/index.js": [
-    "df33312136061eee26701a34ca4f9be043b9675d359a115503dc2df909106432"
-  ],
-  "/postgres/cjs/src/index.js": [
-    "d8fea1a5311c47e65004646bc81f57305ac64d48f99004a5b3ca27bcfc6babf8"
-  ],
-  "/protobufjs/src/root.js": [
-    "1f610f79137dff45ce2ec4e0f742ae43f26b296f2518f4ba41e0a497af5ad624"
-  ],
-  "/sonic-boom/index.js": [
-    "cd3f77b5b75366df3f0a9c27dc18c4f8c47478a7cc982a2bbdc70bfded3c1221"
-  ],
-  "/undici/lib/mock/snapshot-recorder.js": [
-    "9bf63c8b207b6f6e7fe4400b32d8322cfc185735d6ecfbd87a2691a8fba82922"
-  ]
-};
 var probeIdentities = /* @__PURE__ */ new WeakMap();
 function sha256(contents) {
   return createHash("sha256").update(contents).digest("hex");
 }
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function isCapabilityReadinessPayload(contents) {
+  if (contents.length > MAX_READINESS_RESPONSE_BYTES) return false;
+  try {
+    const payload = JSON.parse(contents.toString("utf8"));
+    return Boolean(
+      payload && typeof payload === "object" && payload.status_code === "0" && payload.data && typeof payload.data === "object" && !Array.isArray(payload.data) && Array.isArray(payload.data.capabilities)
+    );
+  } catch {
+    return false;
+  }
+}
 function isInside(root, candidate) {
-  const relative = path25.relative(root, candidate);
-  return relative === "" || !relative.startsWith("..") && !path25.isAbsolute(relative);
+  const relative = path26.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path26.isAbsolute(relative);
+}
+function toPosixRelative(root, file) {
+  return path26.relative(root, file).split(path26.sep).join("/");
 }
 function assertNoSymlinkComponents(root, candidate, message) {
-  const relative = path25.relative(root, candidate);
-  if (!isInside(root, candidate))
-    throw new Error(`${message}: path escaped root`);
+  if (!isInside(root, candidate)) throw new Error(`${message}: escaped root`);
   let current = root;
-  for (const segment of relative.split(path25.sep).filter(Boolean)) {
-    current = path25.join(current, segment);
-    if (fs29.existsSync(current) && fs29.lstatSync(current).isSymbolicLink()) {
+  for (const segment of path26.relative(root, candidate).split(path26.sep)) {
+    if (!segment) continue;
+    current = path26.join(current, segment);
+    if (fs30.existsSync(current) && fs30.lstatSync(current).isSymbolicLink()) {
       throw new Error(message);
     }
   }
 }
-function walkFiles(root, directory, output) {
-  if (!fs29.existsSync(directory)) return;
-  for (const entry of fs29.readdirSync(directory, { withFileTypes: true })) {
-    if (SOURCE_HASH_IGNORED_DIRECTORIES.has(entry.name)) continue;
-    const candidate = path25.join(directory, entry.name);
+function walkSourceFiles(root, directory, output) {
+  if (!fs30.existsSync(directory)) return;
+  for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || directory === root && ROOT_SOURCE_HASH_IGNORED_DIRECTORIES.has(entry.name)) {
+      continue;
+    }
+    const candidate = path26.join(directory, entry.name);
     if (entry.isSymbolicLink()) {
       throw new Error(
-        `source symlink is unsupported: ${path25.relative(root, candidate)}`
+        `source symlink is unsupported: ${toPosixRelative(root, candidate)}`
       );
     }
-    if (entry.isDirectory()) walkFiles(root, candidate, output);
+    if (entry.isDirectory()) walkSourceFiles(root, candidate, output);
     else if (entry.isFile()) output.push(candidate);
+    else {
+      throw new Error(
+        `source special file is unsupported: ${toPosixRelative(root, candidate)}`
+      );
+    }
   }
 }
 function workspaceSourceSha256(projectRoot) {
   const files = [];
-  walkFiles(projectRoot, projectRoot, files);
+  walkSourceFiles(projectRoot, projectRoot, files);
   const hash = createHash("sha256");
   for (const file of files.sort()) {
-    hash.update(path25.relative(projectRoot, file).split(path25.sep).join("/"));
+    hash.update(toPosixRelative(projectRoot, file));
     hash.update("\0");
-    hash.update(fs29.readFileSync(file));
+    updateHashFromFile(hash, file);
     hash.update("\0");
   }
   return hash.digest("hex");
 }
-function workspaceLockfileSha256(projectRoot) {
-  const names = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"];
-  const hash = createHash("sha256");
-  let found = false;
-  for (const name of names) {
-    const file = path25.join(projectRoot, name);
-    if (!fs29.existsSync(file)) continue;
-    found = true;
-    hash.update(name);
-    hash.update("\0");
-    hash.update(fs29.readFileSync(file));
-    hash.update("\0");
+function updateHashFromFile(hash, file) {
+  const descriptor = fs30.openSync(file, "r");
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  try {
+    const before = fs30.fstatSync(descriptor);
+    let position = 0;
+    while (position < before.size) {
+      const bytesRead = fs30.readSync(
+        descriptor,
+        buffer,
+        0,
+        Math.min(buffer.length, before.size - position),
+        position
+      );
+      if (bytesRead === 0) break;
+      hash.update(buffer.subarray(0, bytesRead));
+      position += bytesRead;
+    }
+    const after = fs30.fstatSync(descriptor);
+    if (position !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) {
+      throw new Error(`source changed while hashing: ${file}`);
+    }
+  } finally {
+    fs30.closeSync(descriptor);
   }
-  return found ? hash.digest("hex") : sha256("");
+}
+function runtimeIdentity() {
+  const report = process.report?.getReport();
+  const header = report?.header;
+  return {
+    nodeVersion: process.versions.node,
+    nodeModulesAbi: process.versions.modules,
+    platform: process.platform,
+    arch: process.arch,
+    libc: typeof header?.glibcVersionRuntime === "string" ? `glibc-${header.glibcVersionRuntime}` : process.platform === "linux" ? "linux-unknown-libc" : "not-applicable"
+  };
 }
 function resolveEntry(projectRoot, requested) {
-  const entry = path25.resolve(projectRoot, requested);
+  const entry = path26.resolve(projectRoot, requested);
   if (!isInside(projectRoot, entry))
     throw new Error("compiled entry escaped project root");
-  if (!fs29.existsSync(entry))
+  if (!fs30.existsSync(entry))
     throw new Error(`compiled entry is not a file: ${entry}`);
-  if (fs29.lstatSync(entry).isSymbolicLink()) {
+  if (fs30.lstatSync(entry).isSymbolicLink()) {
     throw new Error("compiled entry symlink is unsupported");
   }
-  const realEntry = fs29.realpathSync(entry);
+  const realEntry = fs30.realpathSync(entry);
   if (!isInside(projectRoot, realEntry))
     throw new Error("compiled entry escaped project root");
-  if (!fs29.statSync(realEntry).isFile())
+  if (!fs30.statSync(realEntry).isFile())
     throw new Error(`compiled entry is not a file: ${entry}`);
   return realEntry;
 }
-function optionalNestDependencyStubs() {
-  const escaped = OPTIONAL_NEST_DEPENDENCIES.map(
-    (name) => name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
-  );
-  const filter = new RegExp(`^(?:${escaped.join("|")})$`);
-  return {
-    name: "miaoda-optional-nest-dependency-stubs",
-    setup(esbuild) {
-      esbuild.onResolve({ filter }, (args) => ({
-        path: args.path,
-        namespace: "miaoda-optional-nest-dependency"
-      }));
-      esbuild.onLoad(
-        { filter: /.*/, namespace: "miaoda-optional-nest-dependency" },
-        (args) => ({
-          contents: `const error = new Error(${JSON.stringify(
-            `Optional dependency is unavailable in startup bundle: ${args.path}`
-          )}); error.code = 'MODULE_NOT_FOUND'; throw error;`,
-          loader: "js"
-        })
+function resolveNestTsconfig(projectRoot) {
+  const nestConfigFile = path26.join(projectRoot, "nest-cli.json");
+  let configured;
+  if (fs30.existsSync(nestConfigFile)) {
+    const nestConfig = JSON.parse(fs30.readFileSync(nestConfigFile, "utf8"));
+    configured = nestConfig.compilerOptions?.tsConfigPath;
+    if (configured !== void 0 && typeof configured !== "string") {
+      throw new Error("nest-cli.json compilerOptions.tsConfigPath is invalid");
+    }
+  }
+  const candidates = typeof configured === "string" ? [configured] : ["tsconfig.build.json", "tsconfig.node.json", "tsconfig.json"];
+  const selected = candidates.map((candidate) => path26.resolve(projectRoot, candidate)).find((candidate) => fs30.existsSync(candidate));
+  if (!selected) {
+    throw new Error(`Nest TypeScript config missing: ${candidates.join(", ")}`);
+  }
+  if (!isInside(projectRoot, selected))
+    throw new Error("Nest TypeScript config escaped project root");
+  if (fs30.lstatSync(selected).isSymbolicLink())
+    throw new Error("Nest TypeScript config symlink is unsupported");
+  const realConfig = fs30.realpathSync(selected);
+  if (!isInside(projectRoot, realConfig) || !fs30.statSync(realConfig).isFile()) {
+    throw new Error("Nest TypeScript config escaped project root");
+  }
+  return realConfig;
+}
+function resolveNestCli(projectRoot) {
+  const projectRequire = createRequire3(path26.join(projectRoot, "package.json"));
+  try {
+    return projectRequire.resolve("@nestjs/cli/bin/nest.js");
+  } catch (directError) {
+    try {
+      const packageFile = projectRequire.resolve("@nestjs/cli/package.json");
+      const packageJson = JSON.parse(fs30.readFileSync(packageFile, "utf8"));
+      const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.nest;
+      if (!relativeBin) throw new Error("@nestjs/cli has no nest binary");
+      const cliFile = path26.resolve(path26.dirname(packageFile), relativeBin);
+      if (!fs30.statSync(cliFile).isFile())
+        throw new Error("@nestjs/cli nest binary is not a file");
+      return cliFile;
+    } catch (packageError) {
+      throw new Error(
+        `project @nestjs/cli is unavailable: ${packageError instanceof Error ? packageError.message : String(packageError)}; direct=${directError instanceof Error ? directError.message : String(directError)}`
       );
     }
-  };
+  }
 }
-function neutralizeDynamicLoads(code) {
-  const replacements = [];
-  const ast = parse(code, {
-    ecmaVersion: "latest",
-    sourceType: "module",
-    allowHashBang: true,
-    allowReturnOutsideFunction: true
+function readLinuxProcessIdentity(pid) {
+  if (process.platform !== "linux") return void 0;
+  try {
+    const stat = fs30.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd < 0) return void 0;
+    const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
+    return /^\d+$/.test(fields[19] || "") && /^\d+$/.test(fields[2] || "") ? { processStartTicks: fields[19], processGroupId: Number(fields[2]) } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function registerProbe(child) {
+  if (!child.pid) throw new Error("isolated process pid unavailable");
+  const identity = readLinuxProcessIdentity(child.pid);
+  if (process.platform === "linux" && !identity) {
+    child.kill("SIGKILL");
+    throw new Error("isolated process birth identity unavailable");
+  }
+  probeIdentities.set(child, {
+    pid: child.pid,
+    processStartTicks: identity?.processStartTicks
   });
-  const isCreateRequireReference = (node) => {
-    if (!node || typeof node !== "object") return false;
-    const candidate = node;
-    if (candidate.type === "Identifier")
-      return candidate.name === "createRequire";
-    if (candidate.type === "MemberExpression") {
-      return candidate.property?.type === "Identifier" && candidate.property.name === "createRequire" || candidate.property?.type === "Literal" && candidate.property.value === "createRequire";
-    }
-    if (candidate.type === "SequenceExpression") {
-      return candidate.expressions?.some(isCreateRequireReference) ?? false;
-    }
-    return false;
-  };
-  walkSimple(ast, {
-    CallExpression(node) {
-      const isCreateRequire = isCreateRequireReference(node.callee);
-      const isRequire = node.callee.type === "Identifier" && (node.callee.name === "require" || node.callee.name === "__require") || node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "module" && (node.callee.property.type === "Identifier" && node.callee.property.name === "require" || node.callee.property.type === "Literal" && node.callee.property.value === "require");
-      const isRequireResolve = node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && (node.callee.object.name === "require" || node.callee.object.name === "__require") && node.callee.property.type === "Identifier" && node.callee.property.name === "resolve";
-      if (isCreateRequire) {
-        replacements.push({
-          start: node.start,
-          end: node.end,
-          kind: "create-require"
-        });
-      } else if ((isRequire || isRequireResolve) && (node.arguments[0]?.type !== "Literal" || typeof node.arguments[0].value !== "string")) {
-        replacements.push({
-          start: node.start,
-          end: node.end,
-          kind: "dynamic-load"
-        });
-      }
-    },
-    ImportExpression(node) {
-      if (node.source.type !== "Literal" || typeof node.source.value !== "string") {
-        replacements.push({
-          start: node.start,
-          end: node.end,
-          kind: "dynamic-load"
-        });
-      }
-    },
-    MemberExpression(node) {
-      if (node.object.type !== "Identifier" || node.object.name !== "require" && node.object.name !== "__require") {
-        return;
+}
+function probeGroupRunning(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return false;
+  if (process.platform === "linux") {
+    const current = readLinuxProcessIdentity(registered.pid);
+    if (current) {
+      if (current.processStartTicks !== registered.processStartTicks || current.processGroupId !== registered.pid) {
+        return false;
       }
-      const property = memberPropertyName(node.property);
-      if (property === "cache") {
-        replacements.push({
-          start: node.start,
-          end: node.end,
-          kind: "require-cache"
-        });
-      } else if (property === "main") {
-        replacements.push({
-          start: node.start,
-          end: node.end,
-          kind: "require-main"
-        });
-      } else if (property === "extensions") {
-        replacements.push({
-          start: node.start,
-          end: node.end,
-          kind: "require-extensions"
-        });
+    } else {
+      try {
+        process.kill(registered.pid, 0);
+        return false;
+      } catch (error) {
+        if (error.code !== "ESRCH") return false;
       }
     }
-  });
-  const unavailable = '(()=>{const error=new Error("dynamic dependency unavailable in startup bundle");error.code="MODULE_NOT_FOUND";throw error})()';
-  const disabledCreateRequire = '(()=>{const disabled=()=>{const error=new Error("dynamic dependency unavailable in startup bundle");error.code="MODULE_NOT_FOUND";throw error};disabled.resolve=disabled;return disabled})()';
-  let output = code;
-  for (const replacement of replacements.sort(
-    (left, right) => right.start - left.start
-  )) {
-    const value = replacement.kind === "create-require" ? disabledCreateRequire : replacement.kind === "dynamic-load" ? unavailable : replacement.kind === "require-main" ? "undefined" : "Object.create(null)";
-    output = `${output.slice(0, replacement.start)}${value}${output.slice(
-      replacement.end
-    )}`;
-  }
-  return output.replace(
-    /\bcreateRequire\b/g,
-    "__miaoda_disabled_create_require"
-  );
+  }
+  try {
+    process.kill(-registered.pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
 }
-function knownFrameworkDynamicLoaderStubs() {
-  return {
-    name: "miaoda-known-framework-dynamic-loader-stubs",
-    setup(esbuild) {
-      esbuild.onLoad({ filter: /\.(?:cjs|js)$/ }, (args) => {
-        const normalized = args.path.split(path25.sep).join("/");
-        const source = fs29.readFileSync(args.path, "utf8");
-        if (!normalized.includes("/node_modules/") || !Object.entries(AUDITED_FRAMEWORK_DYNAMIC_LOADER_HASHES).some(
-          ([suffix, hashes]) => normalized.endsWith(suffix) && hashes.includes(sha256(source))
-        )) {
-          return void 0;
-        }
-        return {
-          contents: neutralizeDynamicLoads(source),
-          loader: "js",
-          resolveDir: path25.dirname(args.path)
-        };
-      });
-    }
-  };
+async function waitForProbeGroup(child, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (probeGroupRunning(child) && Date.now() < deadline) {
+    await new Promise((resolve2) => setTimeout(resolve2, 25));
+  }
+  return !probeGroupRunning(child);
 }
-function classTransformerStorageResolver(projectRoot) {
-  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
-  return {
-    name: "miaoda-class-transformer-storage-resolver",
-    setup(esbuild) {
-      esbuild.onResolve({ filter: /^class-transformer\/storage$/ }, () => {
-        try {
-          return {
-            path: projectRequire.resolve("class-transformer/cjs/storage.js")
-          };
-        } catch {
-          return void 0;
-        }
-      });
+async function stopProbe(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return;
+  if (probeGroupRunning(child)) {
+    try {
+      process.kill(-registered.pid, "SIGTERM");
+    } catch {
     }
-  };
-}
-function resolveProjectPackage(projectRoot, specifier) {
-  return createRequire3(path25.join(projectRoot, "package.json")).resolve(
-    specifier
-  );
-}
-function fullstackNestRuntimeResolver(projectRoot) {
-  return {
-    name: "miaoda-fullstack-nest-runtime-resolver",
-    setup(esbuild) {
-      esbuild.onResolve(
-        { filter: /^@lark-apaas\/fullstack-nestjs-core$/ },
-        () => {
-          try {
-            return {
-              path: resolveProjectPackage(
-                projectRoot,
-                "@lark-apaas/fullstack-nestjs-core/runtime"
-              )
-            };
-          } catch {
-            try {
-              return {
-                path: resolveProjectPackage(
-                  projectRoot,
-                  "@lark-apaas/fullstack-nestjs-core"
-                )
-              };
-            } catch (error) {
-              return {
-                errors: [
-                  {
-                    text: `@lark-apaas/fullstack-nestjs-core cannot be resolved from project: ${error instanceof Error ? error.message : String(error)}`
-                  }
-                ]
-              };
-            }
-          }
-        }
+  }
+  if (!await waitForProbeGroup(child, 500)) {
+    if (probeGroupRunning(child)) {
+      try {
+        process.kill(-registered.pid, "SIGKILL");
+      } catch {
+      }
+    }
+    if (!await waitForProbeGroup(child, 500)) {
+      throw new Error(
+        `isolated probe process group did not exit: ${registered.pid}`
       );
     }
-  };
-}
-function legacyFullstackNestOpenApiStub(projectRoot) {
-  let runtimeOnlyEntryAvailable = false;
-  try {
-    resolveProjectPackage(
-      projectRoot,
-      "@lark-apaas/fullstack-nestjs-core/runtime"
-    );
-    runtimeOnlyEntryAvailable = true;
-  } catch {
   }
-  return {
-    name: "miaoda-legacy-nest-openapi-stub",
-    setup(esbuild) {
-      if (runtimeOnlyEntryAvailable) return;
-      esbuild.onResolve(
-        { filter: /^@lark-apaas\/nestjs-openapi-devtools$/ },
-        () => ({
-          path: "@lark-apaas/nestjs-openapi-devtools",
-          namespace: "miaoda-legacy-nest-openapi-stub"
-        })
-      );
-      esbuild.onLoad(
-        { filter: /.*/, namespace: "miaoda-legacy-nest-openapi-stub" },
-        () => ({
-          contents: "class DisabledOpenApiModule { static async mount() {} }\nmodule.exports = { DevToolsModule: DisabledOpenApiModule, DevToolsV2Module: DisabledOpenApiModule };",
-          loader: "js"
-        })
+  if (child.exitCode === null && child.signalCode === null) {
+    const exited = await new Promise((resolve2) => {
+      let settled = false;
+      let timer;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        child.off("exit", onExit);
+        child.off("error", onError);
+        resolve2(result);
+      };
+      const onExit = () => finish(true);
+      const onError = () => finish(false);
+      child.once("exit", onExit);
+      child.once("error", onError);
+      timer = setTimeout(() => finish(false), 5e3);
+      if (child.exitCode !== null || child.signalCode !== null) finish(true);
+    });
+    if (!exited) {
+      throw new Error(
+        `isolated probe child did not publish exit after group cleanup: ${registered.pid}`
       );
     }
-  };
+  }
 }
-function findDynamicModuleLoads(code) {
-  const warnings = [];
-  const ast = parse(code, { ecmaVersion: "latest", sourceType: "script" });
-  walkSimple(ast, {
-    Identifier(node) {
-      if (node.name === "createRequire") {
-        warnings.push("node createRequire remains in bundle");
-      }
-    },
-    MemberExpression(node) {
-      if (node.computed && node.property.type === "Literal" && node.property.value === "createRequire") {
-        warnings.push("node createRequire remains in bundle");
-      }
-    },
-    CallExpression(node) {
-      const args = node.arguments;
-      const isRequire = node.callee.type === "Identifier" && (node.callee.name === "require" || node.callee.name === "__require") || node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "module" && (node.callee.property.type === "Identifier" && node.callee.property.name === "require" || node.callee.property.type === "Literal" && node.callee.property.value === "require");
-      const isRequireResolve = node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && (node.callee.object.name === "require" || node.callee.object.name === "__require") && node.callee.property.type === "Identifier" && node.callee.property.name === "resolve";
-      if (isRequire && args[0]?.type !== "Literal") {
-        warnings.push("dynamic require remains in bundle");
-      } else if (isRequireResolve && args[0]?.type === "Literal" && typeof args[0].value === "string" && !BUILTINS.has(args[0].value)) {
-        warnings.push(`require.resolve remains in bundle: ${args[0].value}`);
-      } else if (isRequireResolve && (args[0]?.type !== "Literal" || typeof args[0].value !== "string")) {
-        warnings.push("dynamic require.resolve remains in bundle");
-      }
-    },
-    ImportExpression(node) {
-      if (node.source.type !== "Literal" || typeof node.source.value !== "string") {
-        warnings.push("dynamic import remains in bundle");
-      }
-    }
+function collectChildOutput(child, stream) {
+  let output = "";
+  child[stream]?.setEncoding("utf8");
+  child[stream]?.on("data", (chunk) => {
+    output = `${output}${String(chunk)}`.slice(-64 * 1024);
   });
-  walkAncestor(ast, {
-    Identifier(node, _state, ancestors) {
-      if (node.name !== "require" && node.name !== "__require") return;
-      const parent = ancestors.at(-2);
-      const grandparent = ancestors.at(-3);
-      if (node.name === "__require" && (parent?.type === "FunctionExpression" || parent?.type === "FunctionDeclaration") && parent.id === node) {
-        return;
-      }
-      if (parent?.type === "CallExpression" && parent.callee === node && parent.arguments[0]?.type === "Literal" && typeof parent.arguments[0].value === "string" && BUILTINS.has(parent.arguments[0].value)) {
-        return;
-      }
-      if (parent?.type === "MemberExpression" && parent.object === node && memberPropertyName(parent.property) === "resolve" && grandparent?.type === "CallExpression" && grandparent.callee === parent && grandparent.arguments[0]?.type === "Literal" && typeof grandparent.arguments[0].value === "string" && BUILTINS.has(grandparent.arguments[0].value)) {
-        return;
-      }
-      if (parent?.type === "UnaryExpression" && parent.operator === "typeof") {
-        return;
-      }
-      const member = parent?.type === "MemberExpression" && parent.object === node ? memberPropertyName(parent.property) : void 0;
-      warnings.push(
-        `${node.name} value escapes static call${member ? ` via ${member}` : ""}`
+  return () => output;
+}
+async function waitForCommand(child, timeoutMs, description) {
+  let timer;
+  try {
+    return await new Promise((resolve2, reject) => {
+      let settled = false;
+      const finish = (callback) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        callback();
+      };
+      child.once("error", (error) => finish(() => reject(error)));
+      child.once(
+        "exit",
+        (code, signal) => finish(
+          () => signal ? reject(new Error(`${description} exited by ${signal}`)) : resolve2(code ?? 1)
+        )
       );
-    },
-    MemberExpression(node, _state, ancestors) {
-      if (node.object.type !== "Identifier" || node.object.name !== "module" || memberPropertyName(node.property) !== "require") {
-        return;
+      timer = setTimeout(
+        () => finish(() => reject(new Error(`${description} timeout`))),
+        timeoutMs
+      );
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function compileNestSource(projectRoot, stagingRoot, timeoutMs, sourceConfig) {
+  const cliFile = resolveNestCli(projectRoot);
+  const compileRoot = path26.join(stagingRoot, ".compiled");
+  const outputRoot = path26.join(compileRoot, "output");
+  fs30.mkdirSync(outputRoot, { recursive: true });
+  const isolatedConfig = path26.join(compileRoot, "tsconfig.json");
+  fs30.writeFileSync(
+    isolatedConfig,
+    `${JSON.stringify(
+      {
+        extends: sourceConfig,
+        compilerOptions: {
+          outDir: outputRoot,
+          incremental: false,
+          composite: false,
+          declaration: false,
+          declarationMap: false,
+          sourceMap: false,
+          inlineSourceMap: false
+        }
+      },
+      null,
+      2
+    )}
+`,
+    { mode: 384 }
+  );
+  const child = spawn2(
+    process.execPath,
+    [cliFile, "build", "--path", path26.relative(projectRoot, isolatedConfig)],
+    {
+      cwd: projectRoot,
+      detached: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, NODE_ENV: "production" }
+    }
+  );
+  registerProbe(child);
+  const stdout = collectChildOutput(child, "stdout");
+  const stderr = collectChildOutput(child, "stderr");
+  try {
+    const code = await waitForCommand(
+      child,
+      timeoutMs,
+      "isolated Nest compilation"
+    );
+    if (code !== 0) {
+      throw new Error(
+        `isolated Nest compilation failed with exit ${code}: ${stderr().trim() || stdout().trim()}`
+      );
+    }
+  } finally {
+    await stopProbe(child);
+  }
+  const candidates = [
+    path26.join(outputRoot, "server", "main.js"),
+    path26.join(outputRoot, "main.js")
+  ].filter((candidate) => fs30.existsSync(candidate));
+  if (candidates.length !== 1) {
+    throw new Error(
+      candidates.length === 0 ? "isolated Nest compiled entry missing; checked server/main.js and main.js" : "isolated Nest compiled entry is ambiguous"
+    );
+  }
+  const entry = fs30.realpathSync(candidates[0]);
+  if (!isInside(fs30.realpathSync(outputRoot), entry) || !fs30.statSync(entry).isFile()) {
+    throw new Error("isolated Nest compiled entry escaped output root");
+  }
+  return { entry, applicationRoot: outputRoot };
+}
+function copyRegularFile(source, target) {
+  const stats = fs30.lstatSync(source);
+  if (stats.isSymbolicLink()) {
+    throw new Error(`runtime tree symlink is unsupported: ${source}`);
+  }
+  if (!stats.isFile()) {
+    throw new Error(`runtime tree special file is unsupported: ${source}`);
+  }
+  fs30.mkdirSync(path26.dirname(target), { recursive: true });
+  fs30.copyFileSync(source, target, fs30.constants.COPYFILE_FICLONE);
+  fs30.chmodSync(target, stats.mode & 73 ? 493 : 420);
+}
+function copyDirectoryContents(sourceRoot, targetRoot, skipNestedNodeModules, budget, inspectFile) {
+  const visit = (source, target) => {
+    const stats = fs30.lstatSync(source);
+    if (stats.isSymbolicLink()) {
+      throw new Error(`runtime tree symlink is unsupported: ${source}`);
+    }
+    if (stats.isFile()) {
+      if (budget) {
+        reserveGenerationBudget(source, stats.size, budget);
       }
-      const parent = ancestors.at(-2);
-      if (parent?.type === "CallExpression" && parent.callee === node && parent.arguments[0]?.type === "Literal" && typeof parent.arguments[0].value === "string" && BUILTINS.has(parent.arguments[0].value)) {
-        return;
+      inspectFile?.(source, stats);
+      copyRegularFile(source, target);
+      return;
+    }
+    if (!stats.isDirectory()) {
+      throw new Error(`runtime tree special file is unsupported: ${source}`);
+    }
+    fs30.mkdirSync(target, { recursive: true, mode: 493 });
+    for (const entry of fs30.readdirSync(source, { withFileTypes: true })) {
+      if (skipNestedNodeModules && entry.name === "node_modules") continue;
+      visit(path26.join(source, entry.name), path26.join(target, entry.name));
+    }
+  };
+  visit(sourceRoot, targetRoot);
+}
+function reserveGenerationBudget(file, size, budget) {
+  if (size > MAX_GENERATION_FILE_BYTES) {
+    throw new Error(`generation file exceeds 64 MiB: ${file}`);
+  }
+  if (budget.fileCount + 1 > MAX_GENERATION_FILES) {
+    throw new Error(`generation exceeds ${MAX_GENERATION_FILES} files`);
+  }
+  if (budget.totalBytes + size > MAX_GENERATION_BYTES) {
+    throw new Error("generation exceeds 256 MiB");
+  }
+  budget.fileCount += 1;
+  budget.totalBytes += size;
+}
+function measurePayload(payloadRoot) {
+  const budget = { fileCount: 0, totalBytes: 0 };
+  const visit = (directory) => {
+    for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path26.join(directory, entry.name);
+      const stats = fs30.lstatSync(candidate);
+      if (stats.isSymbolicLink()) {
+        throw new Error(`generation symlink is unsupported: ${candidate}`);
+      }
+      if (stats.isDirectory()) visit(candidate);
+      else if (stats.isFile()) {
+        reserveGenerationBudget(candidate, stats.size, budget);
+      } else {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
       }
-      warnings.push("module.require value escapes static call");
     }
-  });
-  return [...new Set(warnings)];
+  };
+  visit(payloadRoot);
+  return budget;
+}
+function copyProbeWorkspace(projectRoot, probeProjectRoot) {
+  const files = [];
+  walkSourceFiles(projectRoot, projectRoot, files);
+  const budget = { fileCount: 0, totalBytes: 0 };
+  for (const file of files) {
+    reserveGenerationBudget(file, fs30.lstatSync(file).size, budget);
+    copyRegularFile(
+      file,
+      path26.join(
+        probeProjectRoot,
+        ...toPosixRelative(projectRoot, file).split("/")
+      )
+    );
+  }
+}
+function readJsonObject(file, description) {
+  const parsed = JSON.parse(
+    readBoundedFile(file, MAX_PACKAGE_MANIFEST_BYTES, description).toString(
+      "utf8"
+    )
+  );
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${description} must be a JSON object`);
+  }
+  return parsed;
+}
+function readBoundedFile(file, maxBytes, description) {
+  const stats = fs30.lstatSync(file);
+  if (stats.isSymbolicLink() || !stats.isFile() || stats.size > maxBytes) {
+    throw new Error(`${description} exceeds the supported metadata size`);
+  }
+  const contents = fs30.readFileSync(file);
+  if (contents.length !== stats.size) {
+    throw new Error(`${description} changed while reading`);
+  }
+  return contents;
+}
+function lockPackages(lock, description) {
+  if (typeof lock.lockfileVersion !== "number" || lock.lockfileVersion < 2 || !lock.packages || typeof lock.packages !== "object" || Array.isArray(lock.packages)) {
+    throw new Error(`${description} must be an npm lockfile v2 or v3`);
+  }
+  return lock.packages;
+}
+function comparableLockRecord(record) {
+  return {
+    integrity: record.integrity,
+    link: record.link,
+    resolved: record.resolved,
+    version: record.version
+  };
+}
+function isSafePackageLockPath(relative) {
+  if (!relative.startsWith("node_modules/") || relative.includes("\\") || path26.posix.isAbsolute(relative)) {
+    return false;
+  }
+  const segments = relative.split("/");
+  return segments.every(
+    (segment) => segment && segment !== "." && segment !== ".."
+  );
 }
 function memberPropertyName(node) {
   if (!node || typeof node !== "object") return void 0;
@@ -8795,520 +8903,1039 @@ function memberPropertyName(node) {
   if (candidate.type === "Literal" && typeof candidate.value === "string") {
     return candidate.value;
   }
-  if (candidate.type === "MemberExpression") {
-    return memberPropertyName(candidate.property);
-  }
   return void 0;
 }
-function expressionContainsNodeModulesPath(node) {
-  const fragments = [];
-  const visit = (value) => {
-    if (!value || typeof value !== "object") return;
-    if (Array.isArray(value)) {
-      for (const item of value) visit(item);
-      return;
-    }
-    const candidate = value;
-    if (candidate.type === "Literal" && typeof candidate.value === "string") {
-      fragments.push(candidate.value);
-      return;
-    }
-    if (candidate.type === "TemplateElement") {
-      const templateValue = candidate.value;
-      const text = templateValue?.cooked ?? templateValue?.raw;
-      if (typeof text === "string") fragments.push(text);
-      return;
-    }
-    for (const [key, child] of Object.entries(candidate)) {
-      if (key === "start" || key === "end" || key === "loc") continue;
-      visit(child);
-    }
-  };
-  visit(node);
-  return /(?:^|[\\/])node_modules(?:[\\/]|$)/.test(
-    fragments.join("/").replace(/\\\\/g, "/")
+function isLiteralString(node) {
+  return Boolean(
+    node && typeof node === "object" && node.type === "Literal" && typeof node.value === "string"
+  );
+}
+function isRuntimeTypeScriptSpecifier(node) {
+  return Boolean(
+    isLiteralString(node) && /\.(?:cts|mts|ts|tsx)(?:$|[?#])/.test(
+      String(node.value)
+    )
   );
 }
-function expressionContainsIdentifier(node, name) {
+function isPackageRelativeDynamicTarget(node) {
   if (!node || typeof node !== "object") return false;
-  if (Array.isArray(node)) {
-    return node.some((item) => expressionContainsIdentifier(item, name));
-  }
   const candidate = node;
-  if (candidate.type === "Identifier" && candidate.name === name) return true;
-  return Object.entries(candidate).some(
-    ([key, child]) => key !== "start" && key !== "end" && key !== "loc" && expressionContainsIdentifier(child, name)
+  if (candidate.type === "Literal" && typeof candidate.value === "string") {
+    return candidate.value.startsWith("./");
+  }
+  if (candidate.type === "TemplateLiteral") {
+    const prefix = candidate.quasis?.[0]?.value?.cooked;
+    return typeof prefix === "string" && prefix.startsWith("./");
+  }
+  if (candidate.type === "BinaryExpression" && candidate.operator === "+") {
+    return isPackageRelativeDynamicTarget(candidate.left);
+  }
+  if (candidate.type === "ConditionalExpression") {
+    return isPackageRelativeDynamicTarget(candidate.consequent) && isPackageRelativeDynamicTarget(candidate.alternate);
+  }
+  if (candidate.type === "LogicalExpression" && (candidate.operator === "||" || candidate.operator === "??")) {
+    return isPackageRelativeDynamicTarget(candidate.left) && isPackageRelativeDynamicTarget(candidate.right);
+  }
+  if (candidate.type !== "CallExpression") return false;
+  const callee = candidate.callee;
+  if (callee?.type !== "MemberExpression") return false;
+  const property = memberPropertyName(callee.property);
+  if (property !== "join" && property !== "resolve") return false;
+  const firstArgument = candidate.arguments?.[0];
+  return Boolean(
+    firstArgument && (firstArgument.type === "Identifier" && (firstArgument.name === "__dirname" || firstArgument.name === "__filename") || isPackageRelativeDynamicTarget(firstArgument))
   );
 }
-function findNodeModulesRuntimeAssetReads(code, origin, rejectEveryRead) {
-  const warnings = [];
-  const ast = parse(code, {
-    ecmaVersion: "latest",
-    sourceType: "module",
-    allowHashBang: true,
-    allowReturnOutsideFunction: true
-  });
-  walkSimple(ast, {
-    CallExpression(node) {
-      const method = memberPropertyName(node.callee);
-      if (method && RUNTIME_ASSET_READ_METHODS.has(method) && rejectEveryRead) {
-        warnings.push(`dependency runtime fs read in input: ${origin}`);
-      } else if (method && RUNTIME_ASSET_READ_METHODS.has(method) && expressionContainsNodeModulesPath(node.arguments[0])) {
-        warnings.push(`node_modules runtime asset read in input: ${origin}`);
-      } else if (method && RUNTIME_ASSET_READ_METHODS.has(method) && expressionContainsIdentifier(node.arguments[0], "__dirname")) {
-        warnings.push(`__dirname runtime asset read in input: ${origin}`);
-      }
-    }
-  });
-  return warnings;
-}
-function findUnsafeApplicationModuleLoads(projectRoot, applicationRoot, inputFiles) {
-  const realApplicationRoot = fs29.realpathSync(applicationRoot);
-  const warnings = [];
-  for (const input of inputFiles) {
-    const candidate = path25.isAbsolute(input) ? input : path25.resolve(projectRoot, input);
-    if (!fs29.existsSync(candidate)) continue;
-    const realInput = fs29.realpathSync(candidate);
-    if (!/\.(?:cjs|mjs|js)$/.test(realInput)) continue;
-    const source = fs29.readFileSync(realInput, "utf8");
-    const isDependencyInput = realInput.split(path25.sep).includes("node_modules");
-    const normalizedInput = realInput.split(path25.sep).join("/");
-    const auditedRuntimeFsReader = isDependencyInput && Object.entries(AUDITED_RUNTIME_FS_READER_HASHES).some(
-      ([suffix, hashes]) => normalizedInput.endsWith(suffix) && hashes.includes(sha256(source))
-    );
-    const origin = path25.relative(projectRoot, realInput).split(path25.sep).join("/");
-    warnings.push(
-      ...findNodeModulesRuntimeAssetReads(
-        source,
-        origin,
-        isDependencyInput && !auditedRuntimeFsReader
-      )
+function isProvablyPackageEscapingPath(node) {
+  if (!node || typeof node !== "object") return false;
+  const candidate = node;
+  if (candidate.type === "BinaryExpression" && candidate.operator === "+") {
+    const left = candidate.left;
+    const right = candidate.right;
+    return Boolean(
+      left?.type === "Identifier" && left.name === "__dirname" && right?.type === "Literal" && typeof right.value === "string" && path26.posix.normalize(path26.posix.join("/package", right.value)).startsWith("/package/") === false
     );
-    if (!isInside(realApplicationRoot, realInput) || isDependencyInput) {
-      continue;
+  }
+  if (candidate.type !== "CallExpression") return false;
+  const callee = candidate.callee;
+  if (callee?.type !== "MemberExpression" || !["join", "resolve"].includes(memberPropertyName(callee.property) || "")) {
+    return false;
+  }
+  const [base, ...segments] = candidate.arguments || [];
+  if (!base || typeof base !== "object" || base.type !== "Identifier" || base.name !== "__dirname" || segments.some(
+    (segment) => !segment || typeof segment !== "object" || segment.type !== "Literal" || typeof segment.value !== "string"
+  )) {
+    return false;
+  }
+  const normalized = path26.posix.normalize(
+    path26.posix.join(
+      "/package",
+      ...segments.map((segment) => String(segment.value))
+    )
+  );
+  return normalized !== "/package" && !normalized.startsWith("/package/");
+}
+function dynamicCodeEvaluatorKind(node) {
+  if (!node || typeof node !== "object") return void 0;
+  const candidate = node;
+  if (candidate.type === "Identifier") {
+    if (candidate.name === "eval") return "eval";
+    if (candidate.name === "Function") return "function";
+    return void 0;
+  }
+  if (candidate.type === "SequenceExpression") {
+    for (const expression of candidate.expressions ?? []) {
+      const kind = dynamicCodeEvaluatorKind(expression);
+      if (kind) return kind;
     }
-    const ast = parse(source, {
+    return void 0;
+  }
+  if (candidate.type === "MemberExpression") {
+    const property = memberPropertyName(candidate.property);
+    if (property === "eval") return "eval";
+    if (property === "Function") return "function";
+  }
+  return void 0;
+}
+function isLiteralEvalImport(node) {
+  if (node.callee.type !== "Identifier" || node.callee.name !== "eval" || node.arguments.length !== 1 || !isLiteralString(node.arguments[0])) {
+    return false;
+  }
+  const source = String(node.arguments[0].value).trim();
+  const match = source.match(/^import\s*\(\s*(['"])([^'"\\]+)\1\s*\)\s*;?$/);
+  return Boolean(match && isBareSpecifier(match[2]));
+}
+function isLiteralEvalWithoutUnboundedModuleLoading(node) {
+  if (node.callee.type !== "Identifier" && node.callee.type !== "SequenceExpression") {
+    return false;
+  }
+  if (dynamicCodeEvaluatorKind(node.callee) !== "eval" || node.arguments.length !== 1 || !isLiteralString(node.arguments[0])) {
+    return false;
+  }
+  const source = String(node.arguments[0].value).trim();
+  return source === "require" || isLiteralEvalImport(node) || !/\b(?:import|require)\b|\b(?:dlopen|_load|_resolveFilename)\b/.test(source);
+}
+function isEvalRequireFactory(node) {
+  if (!node || typeof node !== "object") return false;
+  const candidate = node;
+  return Boolean(
+    candidate.type === "CallExpression" && candidate.callee.type === "Identifier" && candidate.callee.name === "eval" && candidate.arguments.length === 1 && isLiteralString(candidate.arguments[0]) && String(candidate.arguments[0].value).trim() === "require"
+  );
+}
+function packageLayoutCapabilityReasons(source) {
+  const reasons = /* @__PURE__ */ new Set();
+  if (/\brequire\s*\(\s*['"](?:node:)?fs(?:\/promises)?['"]\s*\)/.test(source) || /\bfrom\s*['"](?:node:)?fs(?:\/promises)?['"]/.test(source) || /\bimport\s*['"](?:node:)?fs(?:\/promises)?['"]/.test(source)) {
+    reasons.add("uses filesystem APIs");
+  }
+  if (/\brequire\s*\(\s*['"](?:node:)?vm['"]\s*\)/.test(source) || /\bfrom\s*['"](?:node:)?vm['"]/.test(source) || /\bimport\s*['"](?:node:)?vm['"]/.test(source)) {
+    reasons.add("uses VM code evaluation");
+  }
+  let ast;
+  try {
+    ast = parse(source, {
       ecmaVersion: "latest",
       sourceType: "module",
       allowHashBang: true,
       allowReturnOutsideFunction: true
     });
-    walkSimple(ast, {
-      CallExpression(node) {
-        const isRequire = node.callee.type === "Identifier" && (node.callee.name === "require" || node.callee.name === "__require") || node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "module" && (node.callee.property.type === "Identifier" && node.callee.property.name === "require" || node.callee.property.type === "Literal" && node.callee.property.value === "require");
-        const isRequireResolve = node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && (node.callee.object.name === "require" || node.callee.object.name === "__require") && node.callee.property.type === "Identifier" && node.callee.property.name === "resolve";
-        if (isRequire && node.arguments[0]?.type !== "Literal") {
-          warnings.push(`dynamic require in application input: ${origin}`);
+  } catch {
+    try {
+      ast = parse(source, {
+        ecmaVersion: "latest",
+        sourceType: "script",
+        allowHashBang: true,
+        allowReturnOutsideFunction: true
+      });
+    } catch {
+      return [...reasons, "requires a package-local JavaScript loader"];
+    }
+  }
+  const requireAliases = /* @__PURE__ */ new Set(["require"]);
+  walkSimple(ast, {
+    VariableDeclarator(node) {
+      if (node.id.type === "Identifier" && node.init?.type === "Identifier" && requireAliases.has(node.init.name)) {
+        requireAliases.add(node.id.name);
+      }
+    }
+  });
+  walkSimple(ast, {
+    CallExpression(node) {
+      const callee = node.callee;
+      const evaluatorKind = dynamicCodeEvaluatorKind(callee);
+      if (evaluatorKind === "eval" && !isLiteralEvalWithoutUnboundedModuleLoading(node)) {
+        reasons.add("uses eval-generated code");
+      } else if (evaluatorKind === "function") {
+        reasons.add("uses Function constructor");
+      }
+      if (callee.type === "MemberExpression") {
+        const property = memberPropertyName(callee.property);
+        if (property === "_load" || property === "_resolveFilename") {
+          reasons.add("uses unbounded Node module loader");
         }
-        if (isRequireResolve && (node.arguments[0]?.type !== "Literal" || typeof node.arguments[0].value !== "string")) {
-          warnings.push(
-            `dynamic require.resolve in application input: ${origin}`
-          );
+        if (property === "dlopen" && callee.object.type === "Identifier" && callee.object.name === "process") {
+          reasons.add("uses native dynamic loader");
         }
-      },
-      ImportExpression(node) {
-        if (node.source.type !== "Literal" || typeof node.source.value !== "string") {
-          warnings.push(`dynamic import in application input: ${origin}`);
+      }
+      if (isEvalRequireFactory(callee)) {
+        reasons.add("uses unbounded dynamic require");
+      }
+      const directRequire = callee.type === "Identifier" && requireAliases.has(callee.name);
+      const moduleRequire = callee.type === "MemberExpression" && callee.object.type === "Identifier" && callee.object.name === "module" && memberPropertyName(callee.property) === "require";
+      const requireResolve = callee.type === "MemberExpression" && callee.object.type === "Identifier" && callee.object.name === "require" && memberPropertyName(callee.property) === "resolve";
+      if ((directRequire || moduleRequire) && !isLiteralString(node.arguments[0])) {
+        reasons.add(
+          isPackageRelativeDynamicTarget(node.arguments[0]) ? "uses package-relative dynamic require" : "uses unbounded dynamic require"
+        );
+      }
+      if ((directRequire || moduleRequire || requireResolve) && isRuntimeTypeScriptSpecifier(node.arguments[0])) {
+        reasons.add("loads runtime TypeScript");
+      }
+      if (requireResolve) {
+        reasons.add(
+          isLiteralString(node.arguments[0]) || isPackageRelativeDynamicTarget(node.arguments[0]) ? "uses package-relative require.resolve" : "uses unbounded dynamic require.resolve"
+        );
+      }
+    },
+    ImportExpression(node) {
+      if (isRuntimeTypeScriptSpecifier(node.source)) {
+        reasons.add("loads runtime TypeScript");
+      } else if (!isLiteralString(node.source)) {
+        reasons.add(
+          isPackageRelativeDynamicTarget(node.source) ? "uses package-relative dynamic import" : "uses unbounded dynamic import"
+        );
+      }
+    },
+    ImportDeclaration(node) {
+      if (isRuntimeTypeScriptSpecifier(node.source)) {
+        reasons.add("loads runtime TypeScript");
+      }
+    },
+    VariableDeclarator(node) {
+      if (node.id.type !== "ObjectPattern") return;
+      const init2 = node.init;
+      const moduleConstructor = Boolean(
+        init2?.type === "MemberExpression" && memberPropertyName(init2.property) === "constructor" && init2.object?.type === "Identifier" && init2.object.name === "module"
+      );
+      const nodeModuleNamespace = Boolean(
+        init2?.type === "Identifier" && init2.name === "Module"
+      );
+      if (!moduleConstructor && !nodeModuleNamespace) return;
+      for (const property of node.id.properties) {
+        if (property.type !== "Property") continue;
+        const name = memberPropertyName(property.key);
+        if (name === "_load" || name === "_resolveFilename") {
+          reasons.add("uses unbounded Node module loader");
         }
+        if (name === "dlopen") reasons.add("uses native dynamic loader");
       }
-    });
-  }
-  return [...new Set(warnings)].sort();
-}
-function reservePort() {
-  return new Promise((resolve2, reject) => {
-    const server = net.createServer();
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        server.close(
-          () => reject(new Error("isolated probe failed to reserve a port"))
+    },
+    NewExpression(node) {
+      if (dynamicCodeEvaluatorKind(node.callee) === "function") {
+        reasons.add("uses Function constructor");
+      }
+    },
+    MetaProperty(node) {
+      if (node.meta.name === "import" && node.property.name === "meta") {
+        reasons.add("uses import.meta package location");
+      }
+    }
+  });
+  const fsNamespaces = /* @__PURE__ */ new Set();
+  const fsPathFunctions = /* @__PURE__ */ new Set();
+  const fsPathMethods = /* @__PURE__ */ new Set([
+    "access",
+    "accessSync",
+    "createReadStream",
+    "existsSync",
+    "lstat",
+    "lstatSync",
+    "open",
+    "openSync",
+    "readFile",
+    "readFileSync",
+    "readdir",
+    "readdirSync",
+    "realpath",
+    "realpathSync",
+    "stat",
+    "statSync"
+  ]);
+  walkSimple(ast, {
+    ImportDeclaration(node) {
+      if (typeof node.source.value !== "string" || !["fs", "node:fs", "fs/promises", "node:fs/promises"].includes(
+        node.source.value
+      )) {
+        return;
+      }
+      for (const specifier of node.specifiers) {
+        if (specifier.type === "ImportSpecifier") {
+          if (fsPathMethods.has(specifier.imported.name)) {
+            fsPathFunctions.add(specifier.local.name);
+          }
+        } else {
+          fsNamespaces.add(specifier.local.name);
+        }
+      }
+    },
+    VariableDeclarator(node) {
+      const init2 = node.init;
+      const required = init2?.type === "CallExpression" && init2.callee?.type === "Identifier" && init2.callee.name === "require" && isLiteralString(init2.arguments?.[0]) && ["fs", "node:fs", "fs/promises", "node:fs/promises"].includes(
+        String((init2.arguments?.[0]).value)
+      );
+      if (!required) return;
+      if (node.id.type === "Identifier") fsNamespaces.add(node.id.name);
+      if (node.id.type === "ObjectPattern") {
+        for (const property of node.id.properties) {
+          if (property.type === "Property" && property.value.type === "Identifier" && fsPathMethods.has(memberPropertyName(property.key) || "")) {
+            fsPathFunctions.add(property.value.name);
+          }
+        }
+      }
+    }
+  });
+  walkSimple(ast, {
+    CallExpression(node) {
+      const callee = node.callee;
+      let isFsPathCall = callee.type === "Identifier" && fsPathFunctions.has(callee.name);
+      if (callee.type === "MemberExpression") {
+        const method = memberPropertyName(callee.property);
+        const object = callee.object;
+        const namespace = object.type === "Identifier" ? object.name : object.type === "MemberExpression" && memberPropertyName(object.property) === "promises" && object.object.type === "Identifier" ? object.object.name : void 0;
+        isFsPathCall = Boolean(
+          namespace && fsNamespaces.has(namespace) && fsPathMethods.has(method || "")
         );
+      }
+      if (isFsPathCall && isProvablyPackageEscapingPath(node.arguments[0])) {
+        reasons.add("uses filesystem path outside the proven package boundary");
+      }
+    }
+  });
+  walkAncestor(ast, {
+    Identifier(node, _state, ancestors) {
+      const parent = ancestors.at(-2);
+      const grandparent = ancestors.at(-3);
+      if (node.name === "__dirname" || node.name === "__filename") {
+        if (parent?.type === "MemberExpression" && parent.property === node && !parent.computed) {
+          return;
+        }
+        reasons.add("uses package-relative file location");
         return;
       }
-      server.close((error) => error ? reject(error) : resolve2(address.port));
-    });
+      if (node.name === "createRequire") {
+        reasons.add("uses createRequire");
+        return;
+      }
+      if (node.name !== "require") return;
+      if (parent?.type === "CallExpression" && parent.callee === node) return;
+      if (parent?.type === "UnaryExpression" && parent.operator === "typeof") {
+        return;
+      }
+      if (parent?.type === "MemberExpression" && parent.object === node) {
+        const property = memberPropertyName(parent.property);
+        if (property === "resolve" && grandparent?.type === "CallExpression" && grandparent.callee === parent) {
+          return;
+        }
+        reasons.add(`uses require.${property ?? "unknown"} runtime state`);
+        return;
+      }
+      reasons.add("escapes the require function");
+    },
+    MemberExpression(node, _state, ancestors) {
+      const property = memberPropertyName(node.property);
+      const object = node.object;
+      const moduleConstructor = Boolean(
+        object.type === "MemberExpression" && memberPropertyName(object.property) === "constructor" && object.object?.type === "Identifier" && object.object.name === "module"
+      );
+      if ((property === "_load" || property === "_resolveFilename") && (moduleConstructor || object.type === "Identifier" && object.name === "Module")) {
+        reasons.add("uses unbounded Node module loader");
+      }
+      if (property === "dlopen" && object.type === "Identifier" && object.name === "process") {
+        reasons.add("uses native dynamic loader");
+      }
+      if (node.object.type !== "Identifier" || node.object.name !== "module" || property !== "require") {
+        return;
+      }
+      const parent = ancestors.at(-2);
+      if (parent?.type === "CallExpression" && parent.callee === node) return;
+      reasons.add("escapes module.require");
+    }
   });
-}
-function waitForExit(child) {
-  if (child.exitCode !== null || child.signalCode !== null)
-    return Promise.resolve();
-  return new Promise((resolve2) => child.once("exit", () => resolve2()));
-}
-function readLinuxProcessIdentity(pid) {
-  if (process.platform !== "linux") return void 0;
-  try {
-    const stat = fs29.readFileSync(`/proc/${pid}/stat`, "utf8");
-    const commandEnd = stat.lastIndexOf(")");
-    if (commandEnd < 0) return void 0;
-    const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
-    return /^\d+$/.test(fields[19] || "") && /^\d+$/.test(fields[2] || "") ? { processStartTicks: fields[19], processGroupId: Number(fields[2]) } : void 0;
-  } catch {
+  return [...reasons].sort();
+}
+function createPackageOwnerResolver(projectRoot) {
+  const nodeModulesRoot = path26.join(projectRoot, "node_modules");
+  const cache = /* @__PURE__ */ new Map();
+  return (file) => {
+    const absolute = path26.resolve(file);
+    const cached = cache.get(absolute);
+    if (cached !== void 0 || cache.has(absolute)) return cached;
+    if (!isInside(nodeModulesRoot, absolute)) {
+      cache.set(absolute, void 0);
+      return void 0;
+    }
+    let current = fs30.existsSync(absolute) && fs30.statSync(absolute).isDirectory() ? absolute : path26.dirname(absolute);
+    while (isInside(nodeModulesRoot, current) && current !== nodeModulesRoot) {
+      const manifest = path26.join(current, "package.json");
+      if (fs30.existsSync(manifest) && fs30.statSync(manifest).isFile()) {
+        cache.set(absolute, current);
+        return current;
+      }
+      current = path26.dirname(current);
+    }
+    cache.set(absolute, void 0);
     return void 0;
+  };
+}
+function readPackageIdentity(projectRoot, packageRoot) {
+  const packagePath = toPosixRelative(projectRoot, packageRoot);
+  if (!isSafePackageLockPath(packagePath)) {
+    throw new Error(`unsupported dynamic island path: ${packagePath}`);
+  }
+  const manifest = readJsonObject(
+    path26.join(packageRoot, "package.json"),
+    `dynamic island ${packagePath}`
+  );
+  if (typeof manifest.name !== "string" || !manifest.name) {
+    throw new Error(`dynamic island package name is invalid: ${packagePath}`);
   }
+  return { packagePath, packageName: manifest.name };
 }
-function registerProbe(child) {
-  if (!child.pid) throw new Error("isolated process pid unavailable");
-  const identity = readLinuxProcessIdentity(child.pid);
-  if (process.platform === "linux" && !identity) {
-    child.kill("SIGKILL");
-    throw new Error("isolated process birth identity unavailable");
+function addDynamicIsland(projectRoot, islands, packageRoot, reasons) {
+  const existing = islands.get(packageRoot);
+  if (existing) {
+    for (const reason of reasons) existing.reasons.add(reason);
+    return;
   }
-  probeIdentities.set(child, {
-    pid: child.pid,
-    processStartTicks: identity?.processStartTicks
+  const identity = readPackageIdentity(projectRoot, packageRoot);
+  islands.set(packageRoot, {
+    packageRoot,
+    ...identity,
+    reasons: new Set(reasons)
   });
 }
-function probeGroupRunning(child) {
-  const registered = probeIdentities.get(child);
-  if (!registered) return false;
-  if (process.platform === "linux") {
-    const current = readLinuxProcessIdentity(registered.pid);
-    if (current) {
-      if (current.processStartTicks !== registered.processStartTicks || current.processGroupId !== registered.pid) {
-        return false;
-      }
-    } else {
-      try {
-        process.kill(registered.pid, 0);
-        return false;
-      } catch (error) {
-        if (error.code !== "ESRCH") return false;
+function isBareSpecifier(specifier) {
+  return !specifier.startsWith(".") && !specifier.startsWith("/") && !specifier.startsWith("file:");
+}
+function isBundleableResolvedFile(file) {
+  const extension = path26.extname(file).toLowerCase();
+  return extension === "" || extension === ".js" || extension === ".cjs" || extension === ".cts" || extension === ".mjs" || extension === ".mts" || extension === ".json" || extension === ".jsx" || extension === ".ts" || extension === ".tsx";
+}
+function retryIslandDiscovery(packagePath, reasons) {
+  return {
+    errors: [
+      {
+        text: `retry with dynamic island ${packagePath}: ${reasons.join(", ")}`
       }
-    }
-  }
-  try {
-    process.kill(-registered.pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
+    ]
+  };
 }
-async function waitForProbeGroup(child, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (probeGroupRunning(child) && Date.now() < deadline) {
-    await new Promise((resolve2) => setTimeout(resolve2, 25));
-  }
-  return !probeGroupRunning(child);
+function hybridDynamicIslandPlugin(projectRoot, islands) {
+  const packageOwner = createPackageOwnerResolver(projectRoot);
+  const discover = (owner, reasons) => {
+    addDynamicIsland(projectRoot, islands, owner, reasons);
+    return retryIslandDiscovery(toPosixRelative(projectRoot, owner), reasons);
+  };
+  return {
+    name: "miaoda-hybrid-dynamic-islands",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /.*/ }, async (args) => {
+        const pluginData = args.pluginData;
+        if (pluginData?.miaodaHybridSkip) return void 0;
+        if (BUILTINS.has(args.path)) return { path: args.path, external: true };
+        if (args.kind === "entry-point") return void 0;
+        const importerOwner = args.importer ? packageOwner(args.importer) : void 0;
+        const resolved = await esbuild.resolve(args.path, {
+          importer: args.importer,
+          kind: args.kind,
+          namespace: args.namespace,
+          resolveDir: args.resolveDir,
+          pluginData: { miaodaHybridSkip: true }
+        });
+        if (resolved.errors.length > 0) {
+          return importerOwner ? discover(importerOwner, [`resolves ${args.path} at runtime`]) : { errors: resolved.errors };
+        }
+        if (resolved.external) return resolved;
+        const targetOwner = packageOwner(resolved.path);
+        if (targetOwner && islands.has(targetOwner)) {
+          if (isBareSpecifier(args.path)) {
+            const targetIdentity = readPackageIdentity(
+              projectRoot,
+              targetOwner
+            );
+            if (args.kind === "import-statement" || args.kind === "dynamic-import") {
+              if (importerOwner && importerOwner !== targetOwner) {
+                return discover(importerOwner, [
+                  `preserves ESM import conditions for ${targetIdentity.packagePath}`
+                ]);
+              }
+              return {
+                errors: [
+                  {
+                    text: `bundle entry cannot preserve ESM import conditions for dynamic island: ${targetIdentity.packagePath}`
+                  }
+                ]
+              };
+            }
+            const rootPackagePath = `node_modules/${targetIdentity.packageName}`;
+            if (targetIdentity.packagePath === rootPackagePath) {
+              return { path: args.path, external: true };
+            }
+            if (importerOwner && importerOwner !== targetOwner) {
+              return discover(importerOwner, [
+                `resolves nested dynamic island ${targetIdentity.packagePath}`
+              ]);
+            }
+            return {
+              errors: [
+                {
+                  text: `bundle entry cannot preserve nested package resolution: ${targetIdentity.packagePath}`
+                }
+              ]
+            };
+          }
+          if (importerOwner && importerOwner !== targetOwner) {
+            return discover(importerOwner, [
+              `depends on dynamic island ${toPosixRelative(
+                projectRoot,
+                targetOwner
+              )}`
+            ]);
+          }
+          if (!isBareSpecifier(args.path)) {
+            return {
+              errors: [
+                {
+                  text: `application relative import crosses into dynamic island: ${args.path}`
+                }
+              ]
+            };
+          }
+          return { path: args.path, external: true };
+        }
+        if (targetOwner && resolved.path && !isBundleableResolvedFile(resolved.path)) {
+          return discover(targetOwner, [
+            `loads runtime asset ${path26.extname(resolved.path) || "<no extension>"}`
+          ]);
+        }
+        return resolved;
+      });
+      esbuild.onLoad(
+        { filter: /\.(?:cjs|cts|js|jsx|mjs|mts|ts|tsx)$/ },
+        (args) => {
+          const source = fs30.readFileSync(args.path, "utf8");
+          const reasons = packageLayoutCapabilityReasons(source);
+          if (reasons.length === 0) return void 0;
+          const owner = packageOwner(args.path);
+          if (owner) {
+            if (/\.(?:cts|mts|ts|tsx)$/.test(args.path)) {
+              const identity = readPackageIdentity(projectRoot, owner);
+              return {
+                errors: [
+                  {
+                    text: `TypeScript dependency requires package layout but is not directly executable: ${identity.packagePath}/${toPosixRelative(owner, args.path)}: ${reasons.join(", ")}`
+                  }
+                ]
+              };
+            }
+            return discover(owner, reasons);
+          }
+          const applicationReasons = reasons.filter(
+            (reason) => reason !== "uses filesystem APIs" && reason !== "uses filesystem path outside the proven package boundary"
+          );
+          if (applicationReasons.length === 0) return void 0;
+          return {
+            errors: [
+              {
+                text: `application startup code cannot preserve dynamic layout: ${toPosixRelative(
+                  projectRoot,
+                  args.path
+                )}: ${applicationReasons.join(", ")}`
+              }
+            ]
+          };
+        }
+      );
+    }
+  };
 }
-async function stopProbe(child) {
-  const registered = probeIdentities.get(child);
-  if (!registered) return;
-  if (probeGroupRunning(child)) {
+async function buildHybridBundle(projectRoot, entryFile, outputFile) {
+  const islands = /* @__PURE__ */ new Map();
+  for (let pass = 0; pass < MAX_ISLAND_DISCOVERY_PASSES; pass += 1) {
+    const before = islands.size;
+    fs30.rmSync(outputFile, { force: true });
     try {
-      process.kill(-registered.pid, "SIGTERM");
-    } catch {
+      await build({
+        absWorkingDir: projectRoot,
+        entryPoints: [entryFile],
+        outfile: outputFile,
+        bundle: true,
+        platform: "node",
+        format: "cjs",
+        target: `node${process.versions.node.split(".")[0]}`,
+        keepNames: true,
+        legalComments: "none",
+        logLevel: "silent",
+        preserveSymlinks: true,
+        sourcemap: false,
+        plugins: [hybridDynamicIslandPlugin(projectRoot, islands)]
+      });
+      return islands;
+    } catch (error) {
+      if (islands.size > before) continue;
+      throw error;
     }
   }
-  if (!await waitForProbeGroup(child, 500)) {
-    if (probeGroupRunning(child)) {
-      try {
-        process.kill(-registered.pid, "SIGKILL");
-      } catch {
-      }
+  throw new Error(
+    `dynamic island discovery exceeded ${MAX_ISLAND_DISCOVERY_PASSES} passes`
+  );
+}
+function readDependencyState(projectRoot) {
+  const packageFile = path26.join(projectRoot, "package.json");
+  const lockFile = path26.join(projectRoot, "package-lock.json");
+  const installedLockFile = path26.join(
+    projectRoot,
+    "node_modules",
+    ".package-lock.json"
+  );
+  for (const [file, description] of [
+    [packageFile, "package.json"],
+    [lockFile, "package-lock.json"],
+    [installedLockFile, "installed node_modules lockfile"]
+  ]) {
+    if (!fs30.existsSync(file) || fs30.lstatSync(file).isSymbolicLink()) {
+      throw new Error(`${description} is unavailable`);
+    }
+  }
+  const packageContents = readBoundedFile(
+    packageFile,
+    MAX_PACKAGE_MANIFEST_BYTES,
+    "package.json"
+  );
+  const lockContents = readBoundedFile(
+    lockFile,
+    MAX_DEPENDENCY_METADATA_BYTES,
+    "package-lock.json"
+  );
+  const installedLockContents = readBoundedFile(
+    installedLockFile,
+    MAX_DEPENDENCY_METADATA_BYTES,
+    "installed node_modules lockfile"
+  );
+  const packageJson = readJsonObject(packageFile, "package.json");
+  const rootLock = JSON.parse(lockContents.toString("utf8"));
+  const installedLock = JSON.parse(
+    installedLockContents.toString("utf8")
+  );
+  const rootPackages = lockPackages(rootLock, "package-lock.json");
+  const installedPackages = lockPackages(
+    installedLock,
+    "installed node_modules lockfile"
+  );
+  const rootRecord = rootPackages[""];
+  if (!rootRecord) throw new Error("package-lock.json root package is missing");
+  for (const field of ["dependencies", "optionalDependencies"]) {
+    const declared = packageJson[field] ?? {};
+    const locked = rootRecord[field] ?? {};
+    if (stableJson(declared) !== stableJson(locked)) {
+      throw new Error(`package.json and package-lock.json ${field} disagree`);
+    }
+  }
+  let declaredDynamicDependencies;
+  const startupConfig = packageJson.miaodaStartupBundle;
+  if (startupConfig !== void 0) {
+    if (!startupConfig || typeof startupConfig !== "object" || Array.isArray(startupConfig)) {
+      throw new Error("package.json miaodaStartupBundle must be an object");
+    }
+    const configured = startupConfig.dynamicDependencies;
+    if (!Array.isArray(configured) || configured.some((item) => typeof item !== "string")) {
+      throw new Error(
+        "package.json miaodaStartupBundle.dynamicDependencies must be a string array"
+      );
     }
-    if (!await waitForProbeGroup(child, 500)) {
+    declaredDynamicDependencies = [...new Set(configured)].sort();
+    if (declaredDynamicDependencies.length !== configured.length) {
       throw new Error(
-        `isolated probe process group did not exit: ${registered.pid}`
+        "package.json miaodaStartupBundle.dynamicDependencies contains duplicates"
       );
     }
-  }
-  await waitForExit(child);
-}
-function resolveNestTsconfig(projectRoot) {
-  const nestConfigFile = path25.join(projectRoot, "nest-cli.json");
-  let configured;
-  if (fs29.existsSync(nestConfigFile)) {
-    const nestConfig = JSON.parse(fs29.readFileSync(nestConfigFile, "utf8"));
-    configured = nestConfig.compilerOptions?.tsConfigPath;
-    if (configured !== void 0 && typeof configured !== "string") {
-      throw new Error("nest-cli.json compilerOptions.tsConfigPath is invalid");
+    const rootRuntimeDependencies = /* @__PURE__ */ new Set([
+      ...Object.keys(stringRecord(packageJson.dependencies)),
+      ...Object.keys(stringRecord(packageJson.optionalDependencies))
+    ]);
+    for (const dependencyName of declaredDynamicDependencies) {
+      packageNameSegments(dependencyName);
+      if (!rootRuntimeDependencies.has(dependencyName)) {
+        throw new Error(
+          `declared startup dynamic dependency is not a root runtime dependency: ${dependencyName}`
+        );
+      }
     }
   }
-  const candidates = typeof configured === "string" ? [configured] : ["tsconfig.build.json", "tsconfig.node.json", "tsconfig.json"];
-  const selected = candidates.map((candidate) => path25.resolve(projectRoot, candidate)).find((candidate) => fs29.existsSync(candidate));
-  if (!selected) {
-    throw new Error(`Nest TypeScript config missing: ${candidates.join(", ")}`);
+  return {
+    packageJson,
+    packageContents,
+    lockContents,
+    rootPackages,
+    installedPackages,
+    declaredDynamicDependencies
+  };
+}
+function manifestContainsRuntimeTypeScript(value) {
+  if (typeof value === "string") {
+    return /\.(?:cts|mts|ts|tsx)(?:$|[?#])/.test(value);
   }
-  if (!isInside(projectRoot, selected))
-    throw new Error("Nest TypeScript config escaped project root");
-  if (fs29.lstatSync(selected).isSymbolicLink())
-    throw new Error("Nest TypeScript config symlink is unsupported");
-  const realConfig = fs29.realpathSync(selected);
-  if (!isInside(projectRoot, realConfig) || !fs29.statSync(realConfig).isFile()) {
-    throw new Error("Nest TypeScript config escaped project root");
+  if (Array.isArray(value))
+    return value.some(manifestContainsRuntimeTypeScript);
+  if (value && typeof value === "object") {
+    return Object.entries(value).some(
+      ([condition, target]) => condition !== "types" && !condition.startsWith("types@") && manifestContainsRuntimeTypeScript(target)
+    );
   }
-  return realConfig;
+  return false;
 }
-function resolveLocalTsconfigReference(projectRoot, fromFile, requested) {
-  if (!path25.isAbsolute(requested) && !requested.startsWith(".")) {
-    return void 0;
+function isPackageDevelopmentFile(relativeFile) {
+  const segments = relativeFile.split("/");
+  return segments.some(
+    (segment) => /^(?:__tests__|bench(?:mark)?s?|fixtures?|tests?)$/i.test(segment)
+  ) || /(?:^|\.)\b(?:spec|test)\.[cm]?[jt]sx?$/.test(path26.basename(relativeFile));
+}
+function createMaterializedPackageAuditor(packageRoot, identity) {
+  if (manifestContainsRuntimeTypeScript(identity.manifest.main) || manifestContainsRuntimeTypeScript(identity.manifest.exports) || manifestContainsRuntimeTypeScript(identity.manifest.bin)) {
+    throw new Error(
+      `TypeScript dependency is not directly executable in the startup runtime: ${identity.packagePath}`
+    );
   }
-  const base = path25.isAbsolute(requested) ? requested : path25.resolve(path25.dirname(fromFile), requested);
-  const candidate = [
-    base,
-    `${base}.json`,
-    path25.join(base, "tsconfig.json")
-  ].find((file) => fs29.existsSync(file));
-  if (!candidate) return void 0;
-  const realCandidate = fs29.realpathSync(candidate);
-  if (!isInside(projectRoot, realCandidate)) {
-    throw new Error("local TypeScript config escaped project root");
-  }
-  return realCandidate;
-}
-function sourceInputRecords(projectRoot, inputFiles) {
-  const records = /* @__PURE__ */ new Map();
-  for (const inputFile of inputFiles) {
-    if (!fs29.existsSync(inputFile)) continue;
-    if (fs29.lstatSync(inputFile).isSymbolicLink()) {
-      throw new Error(
-        `source input symlink is unsupported: ${path25.relative(projectRoot, inputFile)}`
+  let runtimeTypeScriptFile;
+  let packageRelativeDynamicLoader;
+  return {
+    inspect(candidate) {
+      const name = path26.basename(candidate);
+      const relativeFile = toPosixRelative(packageRoot, candidate);
+      if (isPackageDevelopmentFile(relativeFile)) return;
+      if (/\.(?:cts|mts|ts|tsx)$/.test(name) && !/\.d\.(?:cts|mts|ts)$/.test(name)) {
+        runtimeTypeScriptFile ?? (runtimeTypeScriptFile = relativeFile);
+        return;
+      }
+      if (!/\.(?:cjs|js|jsx|mjs)$/.test(name)) return;
+      const reasons = packageLayoutCapabilityReasons(
+        fs30.readFileSync(candidate, "utf8")
       );
+      for (const reason of reasons) {
+        if (reason === "loads runtime TypeScript") {
+          throw new Error(
+            `TypeScript dependency is not directly executable in the startup runtime: ${identity.packagePath}/${toPosixRelative(packageRoot, candidate)}`
+          );
+        }
+        if (reason.startsWith("uses package-relative dynamic")) {
+          packageRelativeDynamicLoader ?? (packageRelativeDynamicLoader = relativeFile);
+        }
+        if (reason === "uses filesystem path outside the proven package boundary") {
+          throw new Error(
+            `filesystem access escapes the startup island boundary: ${identity.packagePath}/${toPosixRelative(packageRoot, candidate)}`
+          );
+        }
+        if (reason === "uses unbounded dynamic import" || reason === "uses eval-generated code" || reason === "uses VM code evaluation" || reason === "uses native dynamic loader") {
+          throw new Error(
+            `startup island uses an unsupported executable loader: ${identity.packagePath}/${toPosixRelative(packageRoot, candidate)}: ${reason}`
+          );
+        }
+      }
+    },
+    assertComplete() {
+      if (runtimeTypeScriptFile && packageRelativeDynamicLoader) {
+        throw new Error(
+          `package-relative dynamic loader may select non-executable TypeScript: ${identity.packagePath}/${packageRelativeDynamicLoader} -> ${runtimeTypeScriptFile}`
+        );
+      }
     }
-    const realFile = fs29.realpathSync(inputFile);
-    if (!isInside(projectRoot, realFile) || !fs29.statSync(realFile).isFile()) {
-      throw new Error("source input escaped project root");
+  };
+}
+function packageNameSegments(name) {
+  const segments = name.split("/");
+  if (name.startsWith("@") && segments.length !== 2 || !name.startsWith("@") && segments.length !== 1 || segments.some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new Error(`unsupported dependency package name: ${name}`);
+  }
+  return segments;
+}
+function resolveInstalledDependencyRoot(projectRoot, packageRoot, dependencyName) {
+  const segments = packageNameSegments(dependencyName);
+  let current = packageRoot;
+  while (isInside(projectRoot, current)) {
+    const candidate = path26.join(current, "node_modules", ...segments);
+    if (fs30.existsSync(candidate)) {
+      if (fs30.lstatSync(candidate).isSymbolicLink()) {
+        throw new Error(
+          `linked runtime dependency is unsupported: ${toPosixRelative(
+            projectRoot,
+            candidate
+          )}`
+        );
+      }
+      if (fs30.statSync(candidate).isDirectory() && fs30.existsSync(path26.join(candidate, "package.json"))) {
+        return candidate;
+      }
     }
-    const relative = path25.relative(projectRoot, realFile).split(path25.sep).join("/");
-    const contents = fs29.readFileSync(realFile);
-    records.set(relative, {
-      path: relative,
-      sha256: sha256(contents),
-      size: contents.length
-    });
+    const parent = path26.dirname(current);
+    if (parent === current) break;
+    current = parent;
   }
-  return [...records.values()].sort(
-    (left, right) => left.path.localeCompare(right.path)
+  return void 0;
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      (entry) => typeof entry[1] === "string"
+    )
   );
 }
-function nestCompilationSourceInputs(projectRoot, sourceConfig) {
-  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
-  const typescript = projectRequire(
-    "typescript"
+function validateInstalledPackage(projectRoot, packageRoot, state) {
+  const { packagePath, packageName } = readPackageIdentity(
+    projectRoot,
+    packageRoot
   );
-  const configFiles = /* @__PURE__ */ new Set();
-  const visitConfig = (configFile) => {
-    const realConfig = fs29.realpathSync(configFile);
-    if (configFiles.has(realConfig)) return;
-    if (!isInside(projectRoot, realConfig)) return;
-    configFiles.add(realConfig);
-    const loaded2 = typescript.readConfigFile(
-      realConfig,
-      typescript.sys.readFile
+  const locked = state.rootPackages[packagePath];
+  const installed = state.installedPackages[packagePath];
+  if (!locked)
+    throw new Error(`package is absent from lockfile: ${packagePath}`);
+  if (locked.link === true) {
+    throw new Error(`linked runtime package is unsupported: ${packagePath}`);
+  }
+  if (!installed || stableJson(comparableLockRecord(installed)) !== stableJson(comparableLockRecord(locked))) {
+    throw new Error(
+      `installed package does not match lockfile: ${packagePath}`
     );
-    if (loaded2.error) {
-      throw new Error(`TypeScript config cannot be read: ${realConfig}`);
-    }
-    const extended = Array.isArray(loaded2.config?.extends) ? loaded2.config.extends : loaded2.config?.extends ? [loaded2.config.extends] : [];
-    for (const requested of extended) {
-      if (typeof requested !== "string") continue;
-      const local = resolveLocalTsconfigReference(
-        projectRoot,
-        realConfig,
-        requested
-      );
-      if (local) visitConfig(local);
-    }
-    for (const reference of loaded2.config?.references ?? []) {
-      if (typeof reference?.path !== "string") continue;
-      const local = resolveLocalTsconfigReference(
-        projectRoot,
-        realConfig,
-        reference.path
-      );
-      if (local) visitConfig(local);
-    }
-  };
-  visitConfig(sourceConfig);
-  const loaded = typescript.readConfigFile(
-    sourceConfig,
-    typescript.sys.readFile
-  );
-  if (loaded.error) {
-    throw new Error(`TypeScript config cannot be read: ${sourceConfig}`);
-  }
-  const parsed = typescript.parseJsonConfigFileContent(
-    loaded.config,
-    typescript.sys,
-    path25.dirname(sourceConfig),
-    { noEmit: true, incremental: false, composite: false },
-    sourceConfig
+  }
+  const manifest = readJsonObject(
+    path26.join(packageRoot, "package.json"),
+    `installed package ${packagePath}`
   );
-  if (parsed.errors.length > 0) {
-    throw new Error("TypeScript config contains errors");
+  if (manifest.name !== packageName) {
+    throw new Error(
+      `installed package name does not match path: ${packagePath}`
+    );
   }
-  const program = typescript.createProgram({
-    rootNames: parsed.fileNames,
-    options: parsed.options,
-    projectReferences: parsed.projectReferences
-  });
-  const inputs = new Set(configFiles);
-  for (const sourceFile of program.getSourceFiles()) {
-    if (!fs29.existsSync(sourceFile.fileName)) continue;
-    const realFile = fs29.realpathSync(sourceFile.fileName);
-    const relative = path25.relative(projectRoot, realFile);
-    if (isInside(projectRoot, realFile) && !relative.split(path25.sep).includes("node_modules")) {
-      inputs.add(realFile);
-    }
+  const version = manifest.version;
+  if (typeof version !== "string" || !version) {
+    throw new Error(`installed package version is invalid: ${packagePath}`);
   }
-  for (const name of ["package.json", "nest-cli.json"]) {
-    const file = path25.join(projectRoot, name);
-    if (fs29.existsSync(file)) inputs.add(file);
+  if (typeof locked.version === "string" && locked.version !== version) {
+    throw new Error(
+      `installed package version does not match lockfile: ${packagePath}`
+    );
   }
-  return sourceInputRecords(projectRoot, inputs);
-}
-function sourceIdentitySha256(workspaceTreeSha256, sourceInputs) {
-  return sha256(JSON.stringify({ sourceInputs, workspaceTreeSha256 }));
+  return { packagePath, packageName, version, manifest };
 }
-function resolveNestCli(projectRoot) {
-  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
-  try {
-    return projectRequire.resolve("@nestjs/cli/bin/nest.js");
-  } catch (directError) {
-    try {
-      const packageFile = projectRequire.resolve("@nestjs/cli/package.json");
-      const packageJson = JSON.parse(fs29.readFileSync(packageFile, "utf8"));
-      const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.nest;
-      if (!relativeBin) throw new Error("@nestjs/cli has no nest binary");
-      const cliFile = path25.resolve(path25.dirname(packageFile), relativeBin);
-      if (!fs29.statSync(cliFile).isFile())
-        throw new Error("@nestjs/cli nest binary is not a file");
-      return cliFile;
-    } catch (packageError) {
+function materializeDynamicIslands(projectRoot, payloadRoot, islands) {
+  const state = readDependencyState(projectRoot);
+  if (islands.size > 0 && state.declaredDynamicDependencies === void 0) {
+    throw new Error(
+      "startup bundle with dynamic islands requires package.json miaodaStartupBundle.dynamicDependencies (use [] when no non-relative dynamic package is allowed)"
+    );
+  }
+  const queue = [...islands.values()].sort((left, right) => left.packagePath.localeCompare(right.packagePath)).map((island) => island.packageRoot);
+  const dynamicDependencies = [];
+  for (const dependencyName of state.declaredDynamicDependencies ?? []) {
+    const dependencyRoot = resolveInstalledDependencyRoot(
+      projectRoot,
+      projectRoot,
+      dependencyName
+    );
+    if (!dependencyRoot) {
       throw new Error(
-        `project @nestjs/cli is unavailable: ${packageError instanceof Error ? packageError.message : String(packageError)}; direct=${directError instanceof Error ? directError.message : String(directError)}`
+        `declared startup dynamic dependency is not installed: ${dependencyName}`
       );
     }
-  }
-}
-function collectChildOutput(child, stream) {
-  let output = "";
-  child[stream]?.setEncoding("utf8");
-  child[stream]?.on("data", (chunk) => {
-    output = `${output}${String(chunk)}`.slice(-64 * 1024);
-  });
-  return () => output;
-}
-async function waitForCommand(child, timeoutMs, description) {
-  let timer;
-  try {
-    return await new Promise((resolve2, reject) => {
-      let settled = false;
-      const finish = (callback) => {
-        if (settled) return;
-        settled = true;
-        if (timer) clearTimeout(timer);
-        callback();
-      };
-      child.once("error", (error) => finish(() => reject(error)));
-      child.once(
-        "exit",
-        (code, signal) => finish(
-          () => signal ? reject(new Error(`${description} exited by ${signal}`)) : resolve2(code ?? 1)
-        )
-      );
-      timer = setTimeout(
-        () => finish(() => reject(new Error(`${description} timeout`))),
-        timeoutMs
-      );
+    dynamicDependencies.push({
+      specifier: dependencyName,
+      resolvedPackagePath: readPackageIdentity(projectRoot, dependencyRoot).packagePath
     });
-  } finally {
-    if (timer) clearTimeout(timer);
+    queue.push(dependencyRoot);
   }
-}
-async function compileNestSource(projectRoot, stagingRoot, timeoutMs, sourceConfig) {
-  const cliFile = resolveNestCli(projectRoot);
-  const compileRoot = path25.join(stagingRoot, ".compiled");
-  const outputRoot = path25.join(compileRoot, "output");
-  fs29.mkdirSync(outputRoot, { recursive: true });
-  const isolatedConfig = path25.join(compileRoot, "tsconfig.json");
-  fs29.writeFileSync(
-    isolatedConfig,
-    `${JSON.stringify(
-      {
-        extends: sourceConfig,
-        compilerOptions: {
-          outDir: outputRoot,
-          incremental: false,
-          composite: false,
-          declaration: false,
-          declarationMap: false,
-          sourceMap: false,
-          inlineSourceMap: false
-        }
-      },
-      null,
-      2
-    )}
+  const visited = /* @__PURE__ */ new Set();
+  const materializedPackages = [];
+  const selectedLockRecords = [];
+  fs30.mkdirSync(payloadRoot, { recursive: true, mode: 493 });
+  fs30.writeFileSync(
+    path26.join(payloadRoot, "package.json"),
+    `${JSON.stringify({ private: true, type: "commonjs" })}
 `,
-    { mode: 384 }
-  );
-  const child = spawn2(
-    process.execPath,
-    [cliFile, "build", "--path", path25.relative(projectRoot, isolatedConfig)],
-    {
-      cwd: projectRoot,
-      detached: true,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, NODE_ENV: "production" }
-    }
+    { mode: 420 }
   );
-  registerProbe(child);
-  const stdout = collectChildOutput(child, "stdout");
-  const stderr = collectChildOutput(child, "stderr");
-  try {
-    const code = await waitForCommand(
-      child,
-      timeoutMs,
-      "isolated Nest compilation"
+  const budget = measurePayload(payloadRoot);
+  while (queue.length > 0) {
+    const packageRoot = queue.shift();
+    if (visited.has(packageRoot)) continue;
+    visited.add(packageRoot);
+    const identity = validateInstalledPackage(projectRoot, packageRoot, state);
+    const auditor = createMaterializedPackageAuditor(packageRoot, identity);
+    copyDirectoryContents(
+      packageRoot,
+      path26.join(payloadRoot, ...identity.packagePath.split("/")),
+      true,
+      budget,
+      auditor.inspect
     );
-    if (code !== 0) {
-      throw new Error(
-        `isolated Nest compilation failed with exit ${code}: ${stderr().trim() || stdout().trim()}`
+    auditor.assertComplete();
+    const island = islands.has(packageRoot);
+    materializedPackages.push({
+      packagePath: identity.packagePath,
+      packageName: identity.packageName,
+      version: identity.version,
+      island
+    });
+    selectedLockRecords.push({
+      path: identity.packagePath,
+      record: comparableLockRecord(state.rootPackages[identity.packagePath])
+    });
+    const dependencies = stringRecord(identity.manifest.dependencies);
+    const optionalDependencies = stringRecord(
+      identity.manifest.optionalDependencies
+    );
+    const peerDependencies = stringRecord(identity.manifest.peerDependencies);
+    const peerMetadata = identity.manifest.peerDependenciesMeta && typeof identity.manifest.peerDependenciesMeta === "object" && !Array.isArray(identity.manifest.peerDependenciesMeta) ? identity.manifest.peerDependenciesMeta : {};
+    for (const dependencyName of [
+      .../* @__PURE__ */ new Set([
+        ...Object.keys(dependencies),
+        ...Object.keys(optionalDependencies),
+        ...Object.keys(peerDependencies)
+      ])
+    ].sort()) {
+      const dependencyRoot = resolveInstalledDependencyRoot(
+        projectRoot,
+        packageRoot,
+        dependencyName
+      );
+      const peerConfig = peerMetadata[dependencyName];
+      const optionalPeer = Boolean(
+        peerConfig && typeof peerConfig === "object" && peerConfig.optional === true
       );
+      const optional = Object.hasOwn(optionalDependencies, dependencyName) || optionalPeer;
+      if (!dependencyRoot) {
+        if (optional) continue;
+        throw new Error(
+          `runtime dependency is not installed: ${identity.packagePath} -> ${dependencyName}`
+        );
+      }
+      queue.push(dependencyRoot);
     }
-  } finally {
-    await stopProbe(child);
-  }
-  const candidates = [
-    path25.join(outputRoot, "server", "main.js"),
-    path25.join(outputRoot, "main.js")
-  ].filter((candidate) => fs29.existsSync(candidate));
-  if (candidates.length !== 1) {
-    throw new Error(
-      candidates.length === 0 ? "isolated Nest compiled entry missing; checked server/main.js and main.js" : "isolated Nest compiled entry is ambiguous"
-    );
-  }
-  const entry = fs29.realpathSync(candidates[0]);
-  if (!isInside(fs29.realpathSync(outputRoot), entry) || !fs29.statSync(entry).isFile()) {
-    throw new Error("isolated Nest compiled entry escaped output root");
   }
+  materializedPackages.sort(
+    (left, right) => left.packagePath.localeCompare(right.packagePath)
+  );
+  selectedLockRecords.sort(
+    (left, right) => left.path.localeCompare(right.path)
+  );
+  return {
+    lockfileSha256: sha256(state.lockContents),
+    dependencyViewSha256: sha256(
+      stableJson({
+        packageJsonSha256: sha256(state.packageContents),
+        lockfileSha256: sha256(state.lockContents),
+        runtime: runtimeIdentity(),
+        selectedLockRecords
+      })
+    ),
+    materializedPackages,
+    dynamicDependencies
+  };
+}
+function indexPayload(payloadRoot) {
+  const files = [];
+  const budget = { fileCount: 0, totalBytes: 0 };
+  const visit = (directory) => {
+    for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path26.join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`generation symlink is unsupported: ${candidate}`);
+      }
+      if (entry.isDirectory()) {
+        visit(candidate);
+        continue;
+      }
+      if (!entry.isFile()) {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
+      }
+      const stats = fs30.lstatSync(candidate);
+      if (!stats.isFile()) {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
+      }
+      reserveGenerationBudget(candidate, stats.size, budget);
+      const contents = fs30.readFileSync(candidate);
+      if (contents.length !== stats.size) {
+        throw new Error(
+          `generation file changed while indexing: ${toPosixRelative(payloadRoot, candidate)}`
+        );
+      }
+      files.push({
+        path: `payload/${toPosixRelative(payloadRoot, candidate)}`,
+        sha256: sha256(contents),
+        size: contents.length,
+        mode: stats.mode & 511
+      });
+    }
+  };
+  visit(payloadRoot);
+  files.sort((left, right) => left.path.localeCompare(right.path));
   return {
-    entry,
-    applicationRoot: outputRoot,
-    manifestEntry: `.isolated/${path25.relative(outputRoot, entry).split(path25.sep).join("/")}`
+    files,
+    treeSha256: sha256(stableJson(files)),
+    totalBytes: budget.totalBytes
   };
 }
-async function isolatedProbe(bundleFile, timeoutMs) {
-  const probeRoot = fs29.mkdtempSync(
-    path25.join(os3.tmpdir(), "miaoda-server-bundle-probe-")
+function reservePort() {
+  return new Promise((resolve2, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(
+          () => reject(new Error("isolated probe failed to reserve a port"))
+        );
+        return;
+      }
+      server.close((error) => error ? reject(error) : resolve2(address.port));
+    });
+  });
+}
+async function isolatedProbe(projectRoot, payloadRoot, entry, timeoutMs) {
+  const probeRoot = fs30.mkdtempSync(
+    path26.join(os3.tmpdir(), "miaoda-server-generation-probe-")
+  );
+  const probeWorkspaceRoot = path26.join(probeRoot, "workspace");
+  const probeProjectRoot = path26.join(probeWorkspaceRoot, "code");
+  copyProbeWorkspace(projectRoot, probeProjectRoot);
+  const probeGenerationRoot = path26.join(
+    probeProjectRoot,
+    ".miaoda-cache",
+    "server",
+    "generations",
+    "probe"
+  );
+  const probePayload = path26.join(probeGenerationRoot, "payload");
+  copyDirectoryContents(payloadRoot, probePayload, false);
+  const probeEntry = path26.join(probeGenerationRoot, ...entry.split("/"));
+  const probeModuleGuard = path26.join(
+    probePayload,
+    "module-resolution-guard.cjs"
   );
-  const probeBundle = path25.join(probeRoot, "server.bundle.cjs");
-  fs29.copyFileSync(bundleFile, probeBundle);
   const port = await reservePort();
   const configuredBasePath = process.env.CLIENT_BASE_PATH;
   const basePath = configuredBasePath?.startsWith("/") && !configuredBasePath.startsWith("//") ? configuredBasePath.replace(/\/+$/, "") : "";
   const readinessPath = `${basePath}/__innerapi__/capability/list`;
   const startedAt = Date.now();
-  const child = spawn2(process.execPath, [probeBundle], {
-    cwd: probeRoot,
+  const child = spawn2(process.execPath, [probeEntry], {
+    cwd: probeProjectRoot,
     detached: true,
     stdio: ["ignore", "pipe", "pipe"],
     env: {
       ...process.env,
-      NODE_PATH: "",
+      NODE_PATH: path26.join(probePayload, "node_modules"),
+      NODE_OPTIONS: `--require=${JSON.stringify(probeModuleGuard)}`,
+      PWD: probeProjectRoot,
+      WORKSPACE_DIR: probeWorkspaceRoot,
+      MIAODA_WORKSPACE_ROOT: probeProjectRoot,
       NODE_ENV: "development",
       SERVER_HOST: "127.0.0.1",
       SERVER_PORT: String(port),
@@ -9320,26 +9947,15 @@ async function isolatedProbe(bundleFile, timeoutMs) {
     }
   });
   registerProbe(child);
-  let stdout = "";
-  let stderr = "";
-  child.stdout?.setEncoding("utf8");
-  child.stdout?.on("data", (chunk) => {
-    stdout = `${stdout}${String(chunk)}`.slice(-64 * 1024);
-  });
-  child.stderr?.setEncoding("utf8");
-  child.stderr?.on("data", (chunk) => {
-    stderr += String(chunk);
-  });
+  const stdout = collectChildOutput(child, "stdout");
+  const stderr = collectChildOutput(child, "stderr");
   try {
     await new Promise((resolve2, reject) => {
       const deadline = Date.now() + timeoutMs;
-      const timeoutError = () => new Error(
-        `isolated bundle readiness timeout${`${stderr}
-${stdout}`.trim() ? `: ${`${stderr}
-${stdout}`.trim()}` : ""}`
-      );
       let settled = false;
       let retryTimer;
+      const detail = () => `${stderr()}
+${stdout()}`.trim();
       const finish = (error) => {
         if (settled) return;
         settled = true;
@@ -9348,10 +9964,13 @@ ${stdout}`.trim()}` : ""}`
         else resolve2();
       };
       const retry = () => {
-        if (settled) return;
         const remaining = deadline - Date.now();
         if (remaining <= 0) {
-          finish(timeoutError());
+          finish(
+            new Error(
+              `isolated generation readiness timeout${detail() ? `: ${detail()}` : ""}`
+            )
+          );
           return;
         }
         retryTimer = setTimeout(attempt, Math.min(25, remaining));
@@ -9361,124 +9980,104 @@ ${stdout}`.trim()}` : ""}`
         if (child.exitCode !== null || child.signalCode !== null) {
           finish(
             new Error(
-              `isolated bundle exited before readiness: ${stderr.trim()}`
+              `isolated generation exited before readiness${detail() ? `: ${detail()}` : ""}`
             )
           );
           return;
         }
         const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-          finish(timeoutError());
-          return;
-        }
-        let attemptSettled = false;
+        if (remaining <= 0) return retry();
+        let requestSettled = false;
         const request = http.get(
           { host: "127.0.0.1", port, path: readinessPath },
           (response) => {
-            if (attemptSettled || settled) {
+            if (requestSettled || settled) {
               response.destroy();
               return;
             }
-            attemptSettled = true;
-            response.resume();
-            if ((response.statusCode ?? 500) < 500) finish();
-            else retry();
+            if (response.statusCode !== 200) {
+              requestSettled = true;
+              response.resume();
+              retry();
+              return;
+            }
+            const chunks = [];
+            let responseBytes = 0;
+            response.on("data", (chunk) => {
+              if (requestSettled || settled) return;
+              const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+              responseBytes += buffer.length;
+              if (responseBytes > MAX_READINESS_RESPONSE_BYTES) {
+                requestSettled = true;
+                response.destroy();
+                retry();
+                return;
+              }
+              chunks.push(buffer);
+            });
+            response.once("end", () => {
+              if (requestSettled || settled) return;
+              requestSettled = true;
+              if (isCapabilityReadinessPayload(Buffer.concat(chunks))) finish();
+              else retry();
+            });
+            response.once("error", () => {
+              if (requestSettled || settled) return;
+              requestSettled = true;
+              retry();
+            });
           }
         );
-        request.setTimeout(remaining, () => {
-          request.destroy(new Error("isolated bundle readiness timeout"));
-        });
-        request.once("error", (error) => {
-          if (attemptSettled || settled) return;
-          attemptSettled = true;
-          if (Date.now() >= deadline || error.message === "isolated bundle readiness timeout") {
-            finish(timeoutError());
-          } else {
-            retry();
-          }
+        request.setTimeout(
+          remaining,
+          () => request.destroy(new Error("isolated generation readiness timeout"))
+        );
+        request.once("error", () => {
+          if (requestSettled || settled) return;
+          requestSettled = true;
+          retry();
         });
       };
       attempt();
     });
-    if (fs29.existsSync(path25.join(probeRoot, "node_modules"))) {
-      throw new Error("isolated probe unexpectedly contained node_modules");
-    }
     return Date.now() - startedAt;
   } finally {
     await stopProbe(child);
-    fs29.rmSync(probeRoot, { recursive: true, force: true });
+    fs30.rmSync(probeRoot, { recursive: true, force: true });
   }
 }
-function atomicWriteJson(file, value) {
-  fs29.mkdirSync(path25.dirname(file), { recursive: true });
-  const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-  fs29.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}
-`, {
+function writeBoundedJson(file, value, maxBytes, description) {
+  const contents = `${JSON.stringify(value, null, 2)}
+`;
+  if (Buffer.byteLength(contents) > maxBytes) {
+    throw new Error(`${description} exceeds ${maxBytes} bytes`);
+  }
+  fs30.writeFileSync(file, contents, {
     mode: 384
   });
-  fs29.renameSync(temporary, file);
-}
-function snapshotCurrentPointer(file) {
-  if (!fs29.existsSync(file)) return void 0;
-  if (fs29.lstatSync(file).isSymbolicLink()) {
-    throw new Error("current pointer symlink is unsupported");
-  }
-  const stats = fs29.statSync(file);
-  if (!stats.isFile()) throw new Error("current pointer is not a file");
-  return { file, dev: stats.dev, ino: stats.ino };
-}
-function invalidateCurrentPointerIfUnchanged(identity) {
-  if (!identity || !fs29.existsSync(identity.file)) return;
-  const stats = fs29.lstatSync(identity.file);
-  if (stats.isSymbolicLink() || !stats.isFile() || stats.dev !== identity.dev || stats.ino !== identity.ino) {
-    return;
-  }
-  fs29.unlinkSync(identity.file);
 }
-function stableJson(value) {
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
+function removeLegacyPointer(cacheRoot) {
+  fs30.rmSync(path26.join(cacheRoot, "current.json"), { force: true });
 }
-function assertExistingGenerationEquivalent(generationRoot, generationsRoot, expectedBundle, expectedManifest) {
-  const mismatch = () => new Error("immutable generation already exists with different content");
-  if (fs29.lstatSync(generationRoot).isSymbolicLink()) throw mismatch();
-  const realGenerationRoot = fs29.realpathSync(generationRoot);
-  if (!isInside(generationsRoot, realGenerationRoot) || !fs29.statSync(realGenerationRoot).isDirectory()) {
-    throw mismatch();
-  }
-  const bundleFile = path25.join(realGenerationRoot, "server.bundle.cjs");
-  const manifestFile = path25.join(realGenerationRoot, "manifest.json");
-  if (fs29.lstatSync(bundleFile).isSymbolicLink() || fs29.lstatSync(manifestFile).isSymbolicLink() || !fs29.statSync(bundleFile).isFile() || !fs29.statSync(manifestFile).isFile()) {
-    throw mismatch();
-  }
-  const existingBundle = fs29.readFileSync(bundleFile);
-  const existingManifest = JSON.parse(
-    fs29.readFileSync(manifestFile, "utf8")
-  );
-  const existingStartupMs = existingManifest?.isolatedProbe?.startupMs;
-  if (sha256(existingBundle) !== sha256(expectedBundle) || !Number.isFinite(existingStartupMs) || existingStartupMs < 0) {
-    throw mismatch();
-  }
-  const expectedWithExistingProbeTime = {
-    ...expectedManifest,
-    isolatedProbe: {
-      ...expectedManifest.isolatedProbe,
-      startupMs: existingStartupMs
+function removeStaleBuildArtifacts(cacheRoot) {
+  for (const entry of fs30.readdirSync(cacheRoot)) {
+    if (!/^\.(?:staging|retired)-[a-z0-9-]+$/.test(entry)) continue;
+    const target = path26.join(cacheRoot, entry);
+    const stats = fs30.lstatSync(target);
+    if (stats.isDirectory() && !stats.isSymbolicLink()) {
+      fs30.rmSync(target, { recursive: true, force: true });
+    } else {
+      fs30.rmSync(target, { force: true });
     }
-  };
-  if (stableJson(existingManifest) !== stableJson(expectedWithExistingProbeTime))
-    throw mismatch();
+  }
 }
 async function buildServerStartupBundle(options) {
   const startedAt = Date.now();
   let stagingRoot;
-  let currentPointerIdentity;
+  let cacheRoot;
   try {
-    const projectRoot = fs29.realpathSync(path25.resolve(options.projectRoot));
-    const cacheRoot = path25.resolve(
+    const projectRoot = fs30.realpathSync(path26.resolve(options.projectRoot));
+    cacheRoot = path26.resolve(
       projectRoot,
       options.cacheRoot ?? ".miaoda-cache/server"
     );
@@ -9489,170 +10088,186 @@ async function buildServerStartupBundle(options) {
       cacheRoot,
       "cache path symlink is unsupported"
     );
-    currentPointerIdentity = snapshotCurrentPointer(
-      path25.join(cacheRoot, "current.json")
-    );
+    fs30.mkdirSync(cacheRoot, { recursive: true, mode: 448 });
+    removeLegacyPointer(cacheRoot);
+    removeStaleBuildArtifacts(cacheRoot);
     const timeoutMs = options.probeTimeoutMs ?? 1e4;
+    const compileTimeoutMs = options.compileTimeoutMs ?? 12e4;
     if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
       throw new Error("probe timeout must be positive");
-    const compileTimeoutMs = options.compileTimeoutMs ?? 12e4;
     if (!Number.isFinite(compileTimeoutMs) || compileTimeoutMs <= 0)
       throw new Error("compile timeout must be positive");
+    const sourceSha256 = workspaceSourceSha256(projectRoot);
+    stagingRoot = path26.join(cacheRoot, `.staging-${randomUUID()}`);
+    fs30.mkdirSync(stagingRoot, { recursive: false, mode: 448 });
     const explicitEntry = options.entry ? resolveEntry(projectRoot, options.entry) : void 0;
-    const sourceConfig = explicitEntry ? void 0 : resolveNestTsconfig(projectRoot);
-    const readSourceInputs = () => explicitEntry ? sourceInputRecords(
-      projectRoot,
-      [
-        explicitEntry,
-        path25.join(projectRoot, "package.json"),
-        path25.join(projectRoot, "nest-cli.json")
-      ].filter((file) => fs29.existsSync(file))
-    ) : nestCompilationSourceInputs(projectRoot, sourceConfig);
-    const sourceInputs = readSourceInputs();
-    const readSourceIdentity = () => sourceIdentitySha256(
-      workspaceSourceSha256(projectRoot),
-      readSourceInputs()
-    );
-    const sourceSha256 = sourceIdentitySha256(
-      workspaceSourceSha256(projectRoot),
-      sourceInputs
-    );
-    const generationsRoot = path25.join(cacheRoot, "generations");
-    fs29.mkdirSync(generationsRoot, { recursive: true });
-    assertNoSymlinkComponents(
+    const distRoot = path26.join(projectRoot, "dist");
+    const compiled = explicitEntry ? {
+      entry: explicitEntry,
+      applicationRoot: isInside(distRoot, explicitEntry) ? distRoot : path26.dirname(explicitEntry)
+    } : await compileNestSource(
       projectRoot,
-      generationsRoot,
-      "cache path symlink is unsupported"
+      stagingRoot,
+      compileTimeoutMs,
+      resolveNestTsconfig(projectRoot)
     );
-    stagingRoot = fs29.mkdtempSync(path25.join(generationsRoot, ".staging-"));
-    let compiled;
-    if (explicitEntry) {
-      compiled = {
-        entry: explicitEntry,
-        applicationRoot: projectRoot,
-        manifestEntry: path25.relative(projectRoot, explicitEntry).split(path25.sep).join("/")
-      };
-    } else {
-      compiled = await compileNestSource(
-        projectRoot,
-        stagingRoot,
-        compileTimeoutMs,
-        sourceConfig
-      );
-    }
-    const entry = compiled.entry;
-    if (readSourceIdentity() !== sourceSha256) {
+    if (workspaceSourceSha256(projectRoot) !== sourceSha256) {
       throw new Error("source changed during isolated Nest compilation");
     }
-    const stagingBundle = path25.join(stagingRoot, "server.bundle.cjs");
-    const buildResult2 = await build({
-      absWorkingDir: projectRoot,
-      entryPoints: [entry],
-      outfile: stagingBundle,
-      bundle: true,
-      platform: "node",
-      format: "cjs",
-      target: `node${process.versions.node.split(".")[0]}`,
-      metafile: true,
-      logLevel: "silent",
-      sourcemap: false,
-      plugins: [
-        knownFrameworkDynamicLoaderStubs(),
-        optionalNestDependencyStubs(),
-        fullstackNestRuntimeResolver(projectRoot),
-        legacyFullstackNestOpenApiStub(projectRoot),
-        classTransformerStorageResolver(projectRoot)
-      ]
-    });
-    const output = buildResult2.metafile.outputs[stagingBundle] ?? Object.values(buildResult2.metafile.outputs)[0];
-    const unsafeApplicationLoads = findUnsafeApplicationModuleLoads(
+    const payloadRoot = path26.join(stagingRoot, "payload");
+    fs30.mkdirSync(payloadRoot, { recursive: true, mode: 493 });
+    const entry = STARTUP_ENTRY_FILE;
+    const bundleFile = path26.join(
+      stagingRoot,
+      ...STARTUP_BUNDLE_FILE.split("/")
+    );
+    const islands = await buildHybridBundle(
       projectRoot,
-      compiled.applicationRoot,
-      Object.keys(buildResult2.metafile.inputs)
+      compiled.entry,
+      bundleFile
     );
-    if (unsafeApplicationLoads.length > 0) {
-      throw new Error(unsafeApplicationLoads.join("; "));
-    }
-    const externalImports = (output?.imports ?? []).filter((item) => item.external && !BUILTINS.has(item.path)).map((item) => item.path).sort();
-    if (externalImports.length > 0) {
-      throw new Error(
-        `bundle contains external imports: ${externalImports.join(", ")}`
-      );
-    }
-    const bundle = fs29.readFileSync(stagingBundle);
-    const dynamicLoads = findDynamicModuleLoads(bundle.toString("utf8"));
-    if (dynamicLoads.length > 0) throw new Error(dynamicLoads.join("; "));
-    const startupMs = await isolatedProbe(stagingBundle, timeoutMs);
-    if (readSourceIdentity() !== sourceSha256) {
-      throw new Error("source changed while building startup bundle");
+    const dynamicIslands = [...islands.values()].map((island) => ({
+      packagePath: island.packagePath,
+      packageName: island.packageName,
+      reasons: [...island.reasons].sort()
+    })).sort((left, right) => left.packagePath.localeCompare(right.packagePath));
+    const {
+      lockfileSha256,
+      dependencyViewSha256,
+      materializedPackages,
+      dynamicDependencies
+    } = materializeDynamicIslands(projectRoot, payloadRoot, islands);
+    writeServerStartupLauncher(payloadRoot);
+    const { files, treeSha256, totalBytes } = indexPayload(payloadRoot);
+    const fileIndexContents = `${JSON.stringify(files, null, 2)}
+`;
+    if (Buffer.byteLength(fileIndexContents) > MAX_FILE_INDEX_BYTES) {
+      throw new Error("generation file index exceeds 16 MiB");
     }
-    const lockfileSha256 = workspaceLockfileSha256(projectRoot);
-    const bundleSha256 = sha256(bundle);
-    const nodeMajor = Number(process.versions.node.split(".")[0]);
+    fs30.writeFileSync(
+      path26.join(stagingRoot, "files.mtree.json"),
+      fileIndexContents,
+      { mode: 384 }
+    );
+    const runtime = runtimeIdentity();
     const generationId = sha256(
-      [
-        BUILDER_POLICY_VERSION,
-        sourceSha256,
+      stableJson({
+        artifactFormat: ARTIFACT_FORMAT,
+        builderPolicyVersion: BUILDER_POLICY_VERSION,
+        dependencyMode: DEPENDENCY_MODE,
+        dependencyViewSha256,
+        dynamicDependencies,
+        dynamicIslands,
+        entry,
         lockfileSha256,
-        bundleSha256,
-        nodeMajor,
-        process.platform,
-        process.arch
-      ].join("\0")
+        materializedPackages,
+        runtime,
+        schemaVersion: SCHEMA_VERSION,
+        sourceSha256,
+        treeSha256
+      })
+    );
+    const startupMs = await isolatedProbe(
+      projectRoot,
+      payloadRoot,
+      entry,
+      timeoutMs
     );
+    if (workspaceSourceSha256(projectRoot) !== sourceSha256) {
+      throw new Error("source changed while building startup generation");
+    }
     const manifest = {
-      schemaVersion: 1,
+      schemaVersion: SCHEMA_VERSION,
       builderPolicyVersion: BUILDER_POLICY_VERSION,
+      artifactFormat: ARTIFACT_FORMAT,
       generationId,
-      entry: compiled.manifestEntry,
+      entry,
       sourceSha256,
-      sourceInputs,
       lockfileSha256,
-      bundleSha256,
-      nodeMajor,
-      platform: process.platform,
-      arch: process.arch,
-      externalImports: [],
-      runtimeAssets: [],
+      dependencyViewSha256,
+      dependencyMode: DEPENDENCY_MODE,
+      dynamicDependencies,
+      dynamicIslands,
+      materializedPackages,
+      runtime,
+      artifact: {
+        fileIndex: "files.mtree.json",
+        fileIndexSha256: sha256(fileIndexContents),
+        treeSha256,
+        fileCount: files.length,
+        totalBytes
+      },
       isolatedProbe: {
         success: true,
-        nodeModulesPresent: false,
+        workspaceNodeModulesVisible: false,
         startupMs
       }
     };
-    fs29.rmSync(path25.join(stagingRoot, ".compiled"), {
+    writeBoundedJson(
+      path26.join(stagingRoot, "manifest.json"),
+      manifest,
+      MAX_MANIFEST_BYTES,
+      "startup generation manifest"
+    );
+    writeBoundedJson(
+      path26.join(stagingRoot, "probe.json"),
+      {
+        schemaVersion: SCHEMA_VERSION,
+        generationId,
+        success: true,
+        workspaceNodeModulesVisible: false,
+        startupMs
+      },
+      MAX_PROBE_BYTES,
+      "startup generation probe"
+    );
+    fs30.rmSync(path26.join(stagingRoot, ".compiled"), {
       recursive: true,
       force: true
     });
-    atomicWriteJson(path25.join(stagingRoot, "manifest.json"), manifest);
-    const generationRoot = path25.join(generationsRoot, generationId);
-    if (fs29.existsSync(generationRoot)) {
-      assertExistingGenerationEquivalent(
-        generationRoot,
-        generationsRoot,
-        bundle,
-        manifest
-      );
-      fs29.rmSync(stagingRoot, { recursive: true, force: true });
-    } else {
-      fs29.renameSync(stagingRoot, generationRoot);
+    const generationsRoot = path26.join(cacheRoot, "generations");
+    fs30.mkdirSync(generationsRoot, { recursive: true, mode: 448 });
+    const generationRoot = path26.join(generationsRoot, generationId);
+    const previousGenerations = fs30.readdirSync(generationsRoot);
+    if (previousGenerations.length > 1) {
+      throw new Error("startup generation directory is ambiguous");
+    }
+    const previous = previousGenerations[0];
+    const previousRoot = previous ? path26.join(generationsRoot, previous) : void 0;
+    const retiredRoot = previousRoot ? path26.join(cacheRoot, `.retired-${randomUUID()}`) : void 0;
+    if (previousRoot && retiredRoot) {
+      fs30.renameSync(previousRoot, retiredRoot);
+    }
+    try {
+      fs30.renameSync(stagingRoot, generationRoot);
+    } catch (publishError) {
+      if (previousRoot && retiredRoot && fs30.existsSync(retiredRoot)) {
+        fs30.renameSync(retiredRoot, previousRoot);
+      }
+      throw publishError;
+    }
+    if (previousRoot && retiredRoot) {
+      try {
+        fs30.rmSync(retiredRoot, { recursive: true, force: true });
+      } catch (pruneError) {
+        fs30.rmSync(generationRoot, { recursive: true, force: true });
+        fs30.renameSync(retiredRoot, previousRoot);
+        throw pruneError;
+      }
     }
     stagingRoot = void 0;
-    atomicWriteJson(path25.join(cacheRoot, "current.json"), {
-      schemaVersion: 1,
-      generationId
-    });
     return {
       built: true,
       generationId,
-      bundleFile: path25.join(generationRoot, "server.bundle.cjs"),
-      manifestFile: path25.join(generationRoot, "manifest.json"),
+      generationRoot,
+      entryFile: path26.join(generationRoot, ...entry.split("/")),
+      manifestFile: path26.join(generationRoot, "manifest.json"),
       reasons: [],
       elapsedMs: Date.now() - startedAt
     };
   } catch (error) {
-    if (stagingRoot) fs29.rmSync(stagingRoot, { recursive: true, force: true });
-    invalidateCurrentPointerIfUnchanged(currentPointerIdentity);
+    if (stagingRoot) fs30.rmSync(stagingRoot, { recursive: true, force: true });
+    if (cacheRoot) removeLegacyPointer(cacheRoot);
     return {
       built: false,
       reasons: [error instanceof Error ? error.message : String(error)],
@@ -9705,24 +10320,21 @@ var preUploadStaticCommand = {
 };
 var serverStartupBundleCommand = {
   name: "server-startup-bundle",
-  description: "Build and isolate-probe a node_modules-free NestJS startup bundle",
+  description: "Build and isolate-probe a recycle-only NestJS startup generation",
   register(program) {
     program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).option(
-      "--entry <file>",
-      "Advanced: bundle an existing compiled entry instead of isolated Nest compilation"
-    ).option(
-      "--cache-root <dir>",
-      "Server startup cache root",
-      ".miaoda-cache/server"
-    ).option(
       "--probe-timeout-ms <ms>",
       "Isolated availability probe timeout in milliseconds",
       "10000"
     ).action(
       async (options) => {
+        const probeTimeoutMs = Number(options.probeTimeoutMs);
+        if (!Number.isFinite(probeTimeoutMs) || probeTimeoutMs <= 0) {
+          throw new Error("--probe-timeout-ms must be a positive number");
+        }
         const result = await buildServerStartupBundle({
-          ...options,
-          probeTimeoutMs: Number(options.probeTimeoutMs)
+          projectRoot: options.projectRoot,
+          probeTimeoutMs
         });
         console.log(JSON.stringify(result));
         if (!result.built) process.exitCode = 2;
@@ -9756,13 +10368,13 @@ var commands = [
 
 // src/index.ts
 for (const filename of [".env.local", ".env"]) {
-  const envPath = path26.join(process.cwd(), filename);
-  if (fs30.existsSync(envPath)) {
+  const envPath = path27.join(process.cwd(), filename);
+  if (fs31.existsSync(envPath)) {
     dotenvConfig({ path: envPath });
   }
 }
-var __dirname = path26.dirname(fileURLToPath5(import.meta.url));
-var pkg = JSON.parse(fs30.readFileSync(path26.join(__dirname, "../package.json"), "utf-8"));
+var __dirname = path27.dirname(fileURLToPath5(import.meta.url));
+var pkg = JSON.parse(fs31.readFileSync(path27.join(__dirname, "../package.json"), "utf-8"));
 var cli = new FullstackCLI(pkg.version);
 cli.useAll(commands);
 cli.run();