@lark-apaas/fullstack-cli 1.1.64-alpha.20260901133248 → 1.1.64-alpha.20260902011518

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
-import fs29 from "fs";
-import path25 from "path";
+import fs31 from "fs";
+import path27 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { config as dotenvConfig } from "dotenv";
 
@@ -8260,38 +8260,2100 @@ async function preUploadStatic(options) {
   }
 }
 
-// src/commands/build/index.ts
-var getTokenCommand = {
-  name: "get-token",
-  description: "Get artifact upload credential (STI token)",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(async (options) => {
-      await getToken(options);
-    });
+// src/commands/build/server-startup-bundle.handler.ts
+import fs30 from "fs";
+import http from "http";
+import net from "net";
+import os3 from "os";
+import path26 from "path";
+import { builtinModules, createRequire as createRequire3 } from "module";
+import { spawn as spawn2 } from "child_process";
+import { createHash, randomUUID } from "crypto";
+import { build } from "esbuild";
+import { parse } from "acorn";
+import { ancestor as walkAncestor, simple as walkSimple } from "acorn-walk";
+
+// src/commands/build/server-startup-module-guard.ts
+import fs29 from "fs";
+import path25 from "path";
+var STARTUP_BUNDLE_FILE = "payload/server.bundle.cjs";
+var STARTUP_ENTRY_FILE = "payload/server.start.cjs";
+var MODULE_GUARD_FILE = "module-resolution-guard.cjs";
+var MODULE_GUARD_SOURCE = `'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const Module = require('node:module');
+
+const payloadRoot = fs.realpathSync(__dirname);
+const payloadRequire = Module.createRequire(path.join(payloadRoot, 'package.json'));
+const builtins = new Set([
+  ...Module.builtinModules,
+  ...Module.builtinModules.map(name => 'node:' + name),
+]);
+const originalResolveFilename = Module._resolveFilename;
+
+function isInside(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function isBareSpecifier(request) {
+  return typeof request === 'string' &&
+    !request.startsWith('.') &&
+    !path.isAbsolute(request) &&
+    !request.startsWith('file:');
+}
+
+function assertPayloadResolution(request, resolved) {
+  if (builtins.has(resolved)) return resolved;
+  const realResolved = typeof resolved === 'string' && fs.existsSync(resolved)
+    ? fs.realpathSync(resolved)
+    : resolved;
+  if (typeof realResolved !== 'string' || !isInside(payloadRoot, realResolved)) {
+    const error = new Error('MIAODA_STARTUP_MODULE_OUTSIDE_PAYLOAD:' + request);
+    error.code = 'MIAODA_STARTUP_MODULE_OUTSIDE_PAYLOAD';
+    throw error;
+  }
+  return realResolved;
+}
+
+Module._resolveFilename = function miaodaResolveFilename(request, parent, isMain, options) {
+  if (builtins.has(request)) {
+    return originalResolveFilename.call(this, request, parent, isMain, options);
+  }
+  const parentFilename = parent && typeof parent.filename === 'string'
+    ? parent.filename
+    : '';
+  if (!isInside(payloadRoot, parentFilename)) {
+    if (typeof request === 'string' && path.isAbsolute(request)) {
+      return assertPayloadResolution(
+        request,
+        originalResolveFilename.call(this, request, parent, isMain, options)
+      );
+    }
+    if (!isBareSpecifier(request)) {
+      return assertPayloadResolution(request, undefined);
+    }
+    return assertPayloadResolution(request, payloadRequire.resolve(request));
   }
+  return assertPayloadResolution(
+    request,
+    originalResolveFilename.call(this, request, parent, isMain, options)
+  );
 };
-var uploadStaticCommand = {
-  name: "upload-static",
-  description: "Upload shared/static files to TOS",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option("--static-dir <dir>", "Static files directory", UPLOAD_STATIC_DEFAULTS.staticDir).option("--tosutil-path <path>", "Path to tosutil binary", UPLOAD_STATIC_DEFAULTS.tosutilPath).option("--endpoint <endpoint>", "TOS endpoint", UPLOAD_STATIC_DEFAULTS.endpoint).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
-      await uploadStatic(options);
+`;
+function writeServerStartupLauncher(payloadRoot) {
+  fs29.writeFileSync(
+    path25.join(payloadRoot, MODULE_GUARD_FILE),
+    MODULE_GUARD_SOURCE,
+    {
+      mode: 420
+    }
+  );
+  fs29.writeFileSync(
+    path25.join(payloadRoot, path25.basename(STARTUP_ENTRY_FILE)),
+    `require('./${MODULE_GUARD_FILE}');
+require('./${path25.basename(STARTUP_BUNDLE_FILE)}');
+`,
+    { mode: 420 }
+  );
+}
+
+// src/commands/build/server-startup-bundle.handler.ts
+var SCHEMA_VERSION = 4;
+var BUILDER_POLICY_VERSION = 5;
+var ARTIFACT_FORMAT = "hybrid-bundle-dynamic-islands";
+var DEPENDENCY_MODE = "dynamic-islands";
+var MAX_ISLAND_DISCOVERY_PASSES = 128;
+var MAX_GENERATION_FILES = 5e4;
+var MAX_GENERATION_BYTES = 256 * 1024 * 1024;
+var MAX_GENERATION_FILE_BYTES = 64 * 1024 * 1024;
+var MAX_FILE_INDEX_BYTES = 16 * 1024 * 1024;
+var MAX_MANIFEST_BYTES = 1024 * 1024;
+var MAX_PROBE_BYTES = 64 * 1024;
+var MAX_DEPENDENCY_METADATA_BYTES = 64 * 1024 * 1024;
+var MAX_PACKAGE_MANIFEST_BYTES = 1024 * 1024;
+var MAX_READINESS_RESPONSE_BYTES = 64 * 1024;
+var BUILTINS = /* @__PURE__ */ new Set([
+  ...builtinModules,
+  ...builtinModules.map((name) => `node:${name}`)
+]);
+var ROOT_SOURCE_HASH_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".agents",
+  ".claude",
+  ".git",
+  ".miaoda-cache",
+  ".miaoda-runtime",
+  ".turbo",
+  "coverage",
+  "dist",
+  "logs"
+]);
+var probeIdentities = /* @__PURE__ */ new WeakMap();
+function sha256(contents) {
+  return createHash("sha256").update(contents).digest("hex");
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function isCapabilityReadinessPayload(contents) {
+  if (contents.length > MAX_READINESS_RESPONSE_BYTES) return false;
+  try {
+    const payload = JSON.parse(contents.toString("utf8"));
+    return Boolean(
+      payload && typeof payload === "object" && payload.status_code === "0" && payload.data && typeof payload.data === "object" && !Array.isArray(payload.data) && Array.isArray(payload.data.capabilities)
+    );
+  } catch {
+    return false;
+  }
+}
+function isInside(root, candidate) {
+  const relative = path26.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path26.isAbsolute(relative);
+}
+function toPosixRelative(root, file) {
+  return path26.relative(root, file).split(path26.sep).join("/");
+}
+function assertNoSymlinkComponents(root, candidate, message) {
+  if (!isInside(root, candidate)) throw new Error(`${message}: escaped root`);
+  let current = root;
+  for (const segment of path26.relative(root, candidate).split(path26.sep)) {
+    if (!segment) continue;
+    current = path26.join(current, segment);
+    if (fs30.existsSync(current) && fs30.lstatSync(current).isSymbolicLink()) {
+      throw new Error(message);
+    }
+  }
+}
+function walkSourceFiles(root, directory, output) {
+  if (!fs30.existsSync(directory)) return;
+  for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || directory === root && ROOT_SOURCE_HASH_IGNORED_DIRECTORIES.has(entry.name)) {
+      continue;
+    }
+    const candidate = path26.join(directory, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new Error(
+        `source symlink is unsupported: ${toPosixRelative(root, candidate)}`
+      );
+    }
+    if (entry.isDirectory()) walkSourceFiles(root, candidate, output);
+    else if (entry.isFile()) output.push(candidate);
+    else {
+      throw new Error(
+        `source special file is unsupported: ${toPosixRelative(root, candidate)}`
+      );
+    }
+  }
+}
+function workspaceSourceSha256(projectRoot) {
+  const files = [];
+  walkSourceFiles(projectRoot, projectRoot, files);
+  const hash = createHash("sha256");
+  for (const file of files.sort()) {
+    hash.update(toPosixRelative(projectRoot, file));
+    hash.update("\0");
+    updateHashFromFile(hash, file);
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function updateHashFromFile(hash, file) {
+  const descriptor = fs30.openSync(file, "r");
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  try {
+    const before = fs30.fstatSync(descriptor);
+    let position = 0;
+    while (position < before.size) {
+      const bytesRead = fs30.readSync(
+        descriptor,
+        buffer,
+        0,
+        Math.min(buffer.length, before.size - position),
+        position
+      );
+      if (bytesRead === 0) break;
+      hash.update(buffer.subarray(0, bytesRead));
+      position += bytesRead;
+    }
+    const after = fs30.fstatSync(descriptor);
+    if (position !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) {
+      throw new Error(`source changed while hashing: ${file}`);
+    }
+  } finally {
+    fs30.closeSync(descriptor);
+  }
+}
+function runtimeIdentity() {
+  const report = process.report?.getReport();
+  const header = report?.header;
+  return {
+    nodeVersion: process.versions.node,
+    nodeModulesAbi: process.versions.modules,
+    platform: process.platform,
+    arch: process.arch,
+    libc: typeof header?.glibcVersionRuntime === "string" ? `glibc-${header.glibcVersionRuntime}` : process.platform === "linux" ? "linux-unknown-libc" : "not-applicable"
+  };
+}
+function resolveEntry(projectRoot, requested) {
+  const entry = path26.resolve(projectRoot, requested);
+  if (!isInside(projectRoot, entry))
+    throw new Error("compiled entry escaped project root");
+  if (!fs30.existsSync(entry))
+    throw new Error(`compiled entry is not a file: ${entry}`);
+  if (fs30.lstatSync(entry).isSymbolicLink()) {
+    throw new Error("compiled entry symlink is unsupported");
+  }
+  const realEntry = fs30.realpathSync(entry);
+  if (!isInside(projectRoot, realEntry))
+    throw new Error("compiled entry escaped project root");
+  if (!fs30.statSync(realEntry).isFile())
+    throw new Error(`compiled entry is not a file: ${entry}`);
+  return realEntry;
+}
+function resolveNestTsconfig(projectRoot) {
+  const nestConfigFile = path26.join(projectRoot, "nest-cli.json");
+  let configured;
+  if (fs30.existsSync(nestConfigFile)) {
+    const nestConfig = JSON.parse(fs30.readFileSync(nestConfigFile, "utf8"));
+    configured = nestConfig.compilerOptions?.tsConfigPath;
+    if (configured !== void 0 && typeof configured !== "string") {
+      throw new Error("nest-cli.json compilerOptions.tsConfigPath is invalid");
+    }
+  }
+  const candidates = typeof configured === "string" ? [configured] : ["tsconfig.build.json", "tsconfig.node.json", "tsconfig.json"];
+  const selected = candidates.map((candidate) => path26.resolve(projectRoot, candidate)).find((candidate) => fs30.existsSync(candidate));
+  if (!selected) {
+    throw new Error(`Nest TypeScript config missing: ${candidates.join(", ")}`);
+  }
+  if (!isInside(projectRoot, selected))
+    throw new Error("Nest TypeScript config escaped project root");
+  if (fs30.lstatSync(selected).isSymbolicLink())
+    throw new Error("Nest TypeScript config symlink is unsupported");
+  const realConfig = fs30.realpathSync(selected);
+  if (!isInside(projectRoot, realConfig) || !fs30.statSync(realConfig).isFile()) {
+    throw new Error("Nest TypeScript config escaped project root");
+  }
+  return realConfig;
+}
+function resolveNestCli(projectRoot) {
+  const projectRequire = createRequire3(path26.join(projectRoot, "package.json"));
+  try {
+    return projectRequire.resolve("@nestjs/cli/bin/nest.js");
+  } catch (directError) {
+    try {
+      const packageFile = projectRequire.resolve("@nestjs/cli/package.json");
+      const packageJson = JSON.parse(fs30.readFileSync(packageFile, "utf8"));
+      const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.nest;
+      if (!relativeBin) throw new Error("@nestjs/cli has no nest binary");
+      const cliFile = path26.resolve(path26.dirname(packageFile), relativeBin);
+      if (!fs30.statSync(cliFile).isFile())
+        throw new Error("@nestjs/cli nest binary is not a file");
+      return cliFile;
+    } catch (packageError) {
+      throw new Error(
+        `project @nestjs/cli is unavailable: ${packageError instanceof Error ? packageError.message : String(packageError)}; direct=${directError instanceof Error ? directError.message : String(directError)}`
+      );
+    }
+  }
+}
+function readLinuxProcessIdentity(pid) {
+  if (process.platform !== "linux") return void 0;
+  try {
+    const stat = fs30.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd < 0) return void 0;
+    const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
+    return /^\d+$/.test(fields[19] || "") && /^\d+$/.test(fields[2] || "") ? { processStartTicks: fields[19], processGroupId: Number(fields[2]) } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function registerProbe(child) {
+  if (!child.pid) throw new Error("isolated process pid unavailable");
+  const identity = readLinuxProcessIdentity(child.pid);
+  if (process.platform === "linux" && !identity) {
+    child.kill("SIGKILL");
+    throw new Error("isolated process birth identity unavailable");
+  }
+  probeIdentities.set(child, {
+    pid: child.pid,
+    processStartTicks: identity?.processStartTicks
+  });
+}
+function probeGroupRunning(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return false;
+  if (process.platform === "linux") {
+    const current = readLinuxProcessIdentity(registered.pid);
+    if (current) {
+      if (current.processStartTicks !== registered.processStartTicks || current.processGroupId !== registered.pid) {
+        return false;
+      }
+    } else {
+      try {
+        process.kill(registered.pid, 0);
+        return false;
+      } catch (error) {
+        if (error.code !== "ESRCH") return false;
+      }
+    }
+  }
+  try {
+    process.kill(-registered.pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function waitForProbeGroup(child, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (probeGroupRunning(child) && Date.now() < deadline) {
+    await new Promise((resolve2) => setTimeout(resolve2, 25));
+  }
+  return !probeGroupRunning(child);
+}
+async function stopProbe(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return;
+  if (probeGroupRunning(child)) {
+    try {
+      process.kill(-registered.pid, "SIGTERM");
+    } catch {
+    }
+  }
+  if (!await waitForProbeGroup(child, 500)) {
+    if (probeGroupRunning(child)) {
+      try {
+        process.kill(-registered.pid, "SIGKILL");
+      } catch {
+      }
+    }
+    if (!await waitForProbeGroup(child, 500)) {
+      throw new Error(
+        `isolated probe process group did not exit: ${registered.pid}`
+      );
+    }
+  }
+  if (child.exitCode === null && child.signalCode === null) {
+    const exited = await new Promise((resolve2) => {
+      let settled = false;
+      let timer;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        child.off("exit", onExit);
+        child.off("error", onError);
+        resolve2(result);
+      };
+      const onExit = () => finish(true);
+      const onError = () => finish(false);
+      child.once("exit", onExit);
+      child.once("error", onError);
+      timer = setTimeout(() => finish(false), 5e3);
+      if (child.exitCode !== null || child.signalCode !== null) finish(true);
     });
+    if (!exited) {
+      throw new Error(
+        `isolated probe child did not publish exit after group cleanup: ${registered.pid}`
+      );
+    }
   }
-};
-var preUploadStaticCommand = {
-  name: "pre-upload-static",
-  description: "Get TOS upload info and output as env vars for build.sh eval",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").action(async (options) => {
-      await preUploadStatic(options);
+}
+function collectChildOutput(child, stream) {
+  let output = "";
+  child[stream]?.setEncoding("utf8");
+  child[stream]?.on("data", (chunk) => {
+    output = `${output}${String(chunk)}`.slice(-64 * 1024);
+  });
+  return () => output;
+}
+async function waitForCommand(child, timeoutMs, description) {
+  let timer;
+  try {
+    return await new Promise((resolve2, reject) => {
+      let settled = false;
+      const finish = (callback) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        callback();
+      };
+      child.once("error", (error) => finish(() => reject(error)));
+      child.once(
+        "exit",
+        (code, signal) => finish(
+          () => signal ? reject(new Error(`${description} exited by ${signal}`)) : resolve2(code ?? 1)
+        )
+      );
+      timer = setTimeout(
+        () => finish(() => reject(new Error(`${description} timeout`))),
+        timeoutMs
+      );
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function compileNestSource(projectRoot, stagingRoot, timeoutMs, sourceConfig) {
+  const cliFile = resolveNestCli(projectRoot);
+  const compileRoot = path26.join(stagingRoot, ".compiled");
+  const outputRoot = path26.join(compileRoot, "output");
+  fs30.mkdirSync(outputRoot, { recursive: true });
+  const isolatedConfig = path26.join(compileRoot, "tsconfig.json");
+  fs30.writeFileSync(
+    isolatedConfig,
+    `${JSON.stringify(
+      {
+        extends: sourceConfig,
+        compilerOptions: {
+          outDir: outputRoot,
+          incremental: false,
+          composite: false,
+          declaration: false,
+          declarationMap: false,
+          sourceMap: false,
+          inlineSourceMap: false
+        }
+      },
+      null,
+      2
+    )}
+`,
+    { mode: 384 }
+  );
+  const child = spawn2(
+    process.execPath,
+    [cliFile, "build", "--path", path26.relative(projectRoot, isolatedConfig)],
+    {
+      cwd: projectRoot,
+      detached: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, NODE_ENV: "production" }
+    }
+  );
+  registerProbe(child);
+  const stdout = collectChildOutput(child, "stdout");
+  const stderr = collectChildOutput(child, "stderr");
+  try {
+    const code = await waitForCommand(
+      child,
+      timeoutMs,
+      "isolated Nest compilation"
+    );
+    if (code !== 0) {
+      throw new Error(
+        `isolated Nest compilation failed with exit ${code}: ${stderr().trim() || stdout().trim()}`
+      );
+    }
+  } finally {
+    await stopProbe(child);
+  }
+  const candidates = [
+    path26.join(outputRoot, "server", "main.js"),
+    path26.join(outputRoot, "main.js")
+  ].filter((candidate) => fs30.existsSync(candidate));
+  if (candidates.length !== 1) {
+    throw new Error(
+      candidates.length === 0 ? "isolated Nest compiled entry missing; checked server/main.js and main.js" : "isolated Nest compiled entry is ambiguous"
+    );
+  }
+  const entry = fs30.realpathSync(candidates[0]);
+  if (!isInside(fs30.realpathSync(outputRoot), entry) || !fs30.statSync(entry).isFile()) {
+    throw new Error("isolated Nest compiled entry escaped output root");
+  }
+  return { entry, applicationRoot: outputRoot };
+}
+function copyRegularFile(source, target) {
+  const stats = fs30.lstatSync(source);
+  if (stats.isSymbolicLink()) {
+    throw new Error(`runtime tree symlink is unsupported: ${source}`);
+  }
+  if (!stats.isFile()) {
+    throw new Error(`runtime tree special file is unsupported: ${source}`);
+  }
+  fs30.mkdirSync(path26.dirname(target), { recursive: true });
+  fs30.copyFileSync(source, target, fs30.constants.COPYFILE_FICLONE);
+  fs30.chmodSync(target, stats.mode & 73 ? 493 : 420);
+}
+function copyDirectoryContents(sourceRoot, targetRoot, skipNestedNodeModules, budget, inspectFile) {
+  const visit = (source, target) => {
+    const stats = fs30.lstatSync(source);
+    if (stats.isSymbolicLink()) {
+      throw new Error(`runtime tree symlink is unsupported: ${source}`);
+    }
+    if (stats.isFile()) {
+      if (budget) {
+        reserveGenerationBudget(source, stats.size, budget);
+      }
+      inspectFile?.(source, stats);
+      copyRegularFile(source, target);
+      return;
+    }
+    if (!stats.isDirectory()) {
+      throw new Error(`runtime tree special file is unsupported: ${source}`);
+    }
+    fs30.mkdirSync(target, { recursive: true, mode: 493 });
+    for (const entry of fs30.readdirSync(source, { withFileTypes: true })) {
+      if (skipNestedNodeModules && entry.name === "node_modules") continue;
+      visit(path26.join(source, entry.name), path26.join(target, entry.name));
+    }
+  };
+  visit(sourceRoot, targetRoot);
+}
+function reserveGenerationBudget(file, size, budget) {
+  if (size > MAX_GENERATION_FILE_BYTES) {
+    throw new Error(`generation file exceeds 64 MiB: ${file}`);
+  }
+  if (budget.fileCount + 1 > MAX_GENERATION_FILES) {
+    throw new Error(`generation exceeds ${MAX_GENERATION_FILES} files`);
+  }
+  if (budget.totalBytes + size > MAX_GENERATION_BYTES) {
+    throw new Error("generation exceeds 256 MiB");
+  }
+  budget.fileCount += 1;
+  budget.totalBytes += size;
+}
+function measurePayload(payloadRoot) {
+  const budget = { fileCount: 0, totalBytes: 0 };
+  const visit = (directory) => {
+    for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path26.join(directory, entry.name);
+      const stats = fs30.lstatSync(candidate);
+      if (stats.isSymbolicLink()) {
+        throw new Error(`generation symlink is unsupported: ${candidate}`);
+      }
+      if (stats.isDirectory()) visit(candidate);
+      else if (stats.isFile()) {
+        reserveGenerationBudget(candidate, stats.size, budget);
+      } else {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
+      }
+    }
+  };
+  visit(payloadRoot);
+  return budget;
+}
+function copyProbeWorkspace(projectRoot, probeProjectRoot) {
+  const files = [];
+  walkSourceFiles(projectRoot, projectRoot, files);
+  const budget = { fileCount: 0, totalBytes: 0 };
+  for (const file of files) {
+    reserveGenerationBudget(file, fs30.lstatSync(file).size, budget);
+    copyRegularFile(
+      file,
+      path26.join(
+        probeProjectRoot,
+        ...toPosixRelative(projectRoot, file).split("/")
+      )
+    );
+  }
+}
+function readJsonObject(file, description) {
+  const parsed = JSON.parse(
+    readBoundedFile(file, MAX_PACKAGE_MANIFEST_BYTES, description).toString(
+      "utf8"
+    )
+  );
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${description} must be a JSON object`);
+  }
+  return parsed;
+}
+function readBoundedFile(file, maxBytes, description) {
+  const stats = fs30.lstatSync(file);
+  if (stats.isSymbolicLink() || !stats.isFile() || stats.size > maxBytes) {
+    throw new Error(`${description} exceeds the supported metadata size`);
+  }
+  const contents = fs30.readFileSync(file);
+  if (contents.length !== stats.size) {
+    throw new Error(`${description} changed while reading`);
+  }
+  return contents;
+}
+function lockPackages(lock, description) {
+  if (typeof lock.lockfileVersion !== "number" || lock.lockfileVersion < 2 || !lock.packages || typeof lock.packages !== "object" || Array.isArray(lock.packages)) {
+    throw new Error(`${description} must be an npm lockfile v2 or v3`);
+  }
+  return lock.packages;
+}
+function comparableLockRecord(record) {
+  return {
+    integrity: record.integrity,
+    link: record.link,
+    resolved: record.resolved,
+    version: record.version
+  };
+}
+function isSafePackageLockPath(relative) {
+  if (!relative.startsWith("node_modules/") || relative.includes("\\") || path26.posix.isAbsolute(relative)) {
+    return false;
+  }
+  const segments = relative.split("/");
+  return segments.every(
+    (segment) => segment && segment !== "." && segment !== ".."
+  );
+}
+function memberPropertyName(node) {
+  if (!node || typeof node !== "object") return void 0;
+  const candidate = node;
+  if (candidate.type === "Identifier") return candidate.name;
+  if (candidate.type === "Literal" && typeof candidate.value === "string") {
+    return candidate.value;
+  }
+  return void 0;
+}
+function isLiteralString(node) {
+  return Boolean(
+    node && typeof node === "object" && node.type === "Literal" && typeof node.value === "string"
+  );
+}
+function isRuntimeTypeScriptSpecifier(node) {
+  return Boolean(
+    isLiteralString(node) && /\.(?:cts|mts|ts|tsx)(?:$|[?#])/.test(
+      String(node.value)
+    )
+  );
+}
+function isPackageRelativeDynamicTarget(node) {
+  if (!node || typeof node !== "object") return false;
+  const candidate = node;
+  if (candidate.type === "Literal" && typeof candidate.value === "string") {
+    return candidate.value.startsWith("./");
+  }
+  if (candidate.type === "TemplateLiteral") {
+    const prefix = candidate.quasis?.[0]?.value?.cooked;
+    return typeof prefix === "string" && prefix.startsWith("./");
+  }
+  if (candidate.type === "BinaryExpression" && candidate.operator === "+") {
+    return isPackageRelativeDynamicTarget(candidate.left);
+  }
+  if (candidate.type === "ConditionalExpression") {
+    return isPackageRelativeDynamicTarget(candidate.consequent) && isPackageRelativeDynamicTarget(candidate.alternate);
+  }
+  if (candidate.type === "LogicalExpression" && (candidate.operator === "||" || candidate.operator === "??")) {
+    return isPackageRelativeDynamicTarget(candidate.left) && isPackageRelativeDynamicTarget(candidate.right);
+  }
+  if (candidate.type !== "CallExpression") return false;
+  const callee = candidate.callee;
+  if (callee?.type !== "MemberExpression") return false;
+  const property = memberPropertyName(callee.property);
+  if (property !== "join" && property !== "resolve") return false;
+  const firstArgument = candidate.arguments?.[0];
+  return Boolean(
+    firstArgument && (firstArgument.type === "Identifier" && (firstArgument.name === "__dirname" || firstArgument.name === "__filename") || isPackageRelativeDynamicTarget(firstArgument))
+  );
+}
+function isProvablyPackageEscapingPath(node) {
+  if (!node || typeof node !== "object") return false;
+  const candidate = node;
+  if (candidate.type === "BinaryExpression" && candidate.operator === "+") {
+    const left = candidate.left;
+    const right = candidate.right;
+    return Boolean(
+      left?.type === "Identifier" && left.name === "__dirname" && right?.type === "Literal" && typeof right.value === "string" && path26.posix.normalize(path26.posix.join("/package", right.value)).startsWith("/package/") === false
+    );
+  }
+  if (candidate.type !== "CallExpression") return false;
+  const callee = candidate.callee;
+  if (callee?.type !== "MemberExpression" || !["join", "resolve"].includes(memberPropertyName(callee.property) || "")) {
+    return false;
+  }
+  const [base, ...segments] = candidate.arguments || [];
+  if (!base || typeof base !== "object" || base.type !== "Identifier" || base.name !== "__dirname" || segments.some(
+    (segment) => !segment || typeof segment !== "object" || segment.type !== "Literal" || typeof segment.value !== "string"
+  )) {
+    return false;
+  }
+  const normalized = path26.posix.normalize(
+    path26.posix.join(
+      "/package",
+      ...segments.map((segment) => String(segment.value))
+    )
+  );
+  return normalized !== "/package" && !normalized.startsWith("/package/");
+}
+function dynamicCodeEvaluatorKind(node) {
+  if (!node || typeof node !== "object") return void 0;
+  const candidate = node;
+  if (candidate.type === "Identifier") {
+    if (candidate.name === "eval") return "eval";
+    if (candidate.name === "Function") return "function";
+    return void 0;
+  }
+  if (candidate.type === "SequenceExpression") {
+    for (const expression of candidate.expressions ?? []) {
+      const kind = dynamicCodeEvaluatorKind(expression);
+      if (kind) return kind;
+    }
+    return void 0;
+  }
+  if (candidate.type === "MemberExpression") {
+    const property = memberPropertyName(candidate.property);
+    if (property === "eval") return "eval";
+    if (property === "Function") return "function";
+  }
+  return void 0;
+}
+function isLiteralEvalImport(node) {
+  if (node.callee.type !== "Identifier" || node.callee.name !== "eval" || node.arguments.length !== 1 || !isLiteralString(node.arguments[0])) {
+    return false;
+  }
+  const source = String(node.arguments[0].value).trim();
+  const match = source.match(/^import\s*\(\s*(['"])([^'"\\]+)\1\s*\)\s*;?$/);
+  return Boolean(match && isBareSpecifier(match[2]));
+}
+function isLiteralEvalWithoutUnboundedModuleLoading(node) {
+  if (node.callee.type !== "Identifier" && node.callee.type !== "SequenceExpression") {
+    return false;
+  }
+  if (dynamicCodeEvaluatorKind(node.callee) !== "eval" || node.arguments.length !== 1 || !isLiteralString(node.arguments[0])) {
+    return false;
+  }
+  const source = String(node.arguments[0].value).trim();
+  return source === "require" || isLiteralEvalImport(node) || !/\b(?:import|require)\b|\b(?:dlopen|_load|_resolveFilename)\b/.test(source);
+}
+function isEvalRequireFactory(node) {
+  if (!node || typeof node !== "object") return false;
+  const candidate = node;
+  return Boolean(
+    candidate.type === "CallExpression" && candidate.callee.type === "Identifier" && candidate.callee.name === "eval" && candidate.arguments.length === 1 && isLiteralString(candidate.arguments[0]) && String(candidate.arguments[0].value).trim() === "require"
+  );
+}
+function packageLayoutCapabilityReasons(source) {
+  const reasons = /* @__PURE__ */ new Set();
+  if (/\brequire\s*\(\s*['"](?:node:)?fs(?:\/promises)?['"]\s*\)/.test(source) || /\bfrom\s*['"](?:node:)?fs(?:\/promises)?['"]/.test(source) || /\bimport\s*['"](?:node:)?fs(?:\/promises)?['"]/.test(source)) {
+    reasons.add("uses filesystem APIs");
+  }
+  if (/\brequire\s*\(\s*['"](?:node:)?vm['"]\s*\)/.test(source) || /\bfrom\s*['"](?:node:)?vm['"]/.test(source) || /\bimport\s*['"](?:node:)?vm['"]/.test(source)) {
+    reasons.add("uses VM code evaluation");
+  }
+  let ast;
+  try {
+    ast = parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      allowHashBang: true,
+      allowReturnOutsideFunction: true
     });
+  } catch {
+    try {
+      ast = parse(source, {
+        ecmaVersion: "latest",
+        sourceType: "script",
+        allowHashBang: true,
+        allowReturnOutsideFunction: true
+      });
+    } catch {
+      return [...reasons, "requires a package-local JavaScript loader"];
+    }
+  }
+  const requireAliases = /* @__PURE__ */ new Set(["require"]);
+  walkSimple(ast, {
+    VariableDeclarator(node) {
+      if (node.id.type === "Identifier" && node.init?.type === "Identifier" && requireAliases.has(node.init.name)) {
+        requireAliases.add(node.id.name);
+      }
+    }
+  });
+  walkSimple(ast, {
+    CallExpression(node) {
+      const callee = node.callee;
+      const evaluatorKind = dynamicCodeEvaluatorKind(callee);
+      if (evaluatorKind === "eval" && !isLiteralEvalWithoutUnboundedModuleLoading(node)) {
+        reasons.add("uses eval-generated code");
+      } else if (evaluatorKind === "function") {
+        reasons.add("uses Function constructor");
+      }
+      if (callee.type === "MemberExpression") {
+        const property = memberPropertyName(callee.property);
+        if (property === "_load" || property === "_resolveFilename") {
+          reasons.add("uses unbounded Node module loader");
+        }
+        if (property === "dlopen" && callee.object.type === "Identifier" && callee.object.name === "process") {
+          reasons.add("uses native dynamic loader");
+        }
+      }
+      if (isEvalRequireFactory(callee)) {
+        reasons.add("uses unbounded dynamic require");
+      }
+      const directRequire = callee.type === "Identifier" && requireAliases.has(callee.name);
+      const moduleRequire = callee.type === "MemberExpression" && callee.object.type === "Identifier" && callee.object.name === "module" && memberPropertyName(callee.property) === "require";
+      const requireResolve = callee.type === "MemberExpression" && callee.object.type === "Identifier" && callee.object.name === "require" && memberPropertyName(callee.property) === "resolve";
+      if ((directRequire || moduleRequire) && !isLiteralString(node.arguments[0])) {
+        reasons.add(
+          isPackageRelativeDynamicTarget(node.arguments[0]) ? "uses package-relative dynamic require" : "uses unbounded dynamic require"
+        );
+      }
+      if ((directRequire || moduleRequire || requireResolve) && isRuntimeTypeScriptSpecifier(node.arguments[0])) {
+        reasons.add("loads runtime TypeScript");
+      }
+      if (requireResolve) {
+        reasons.add(
+          isLiteralString(node.arguments[0]) || isPackageRelativeDynamicTarget(node.arguments[0]) ? "uses package-relative require.resolve" : "uses unbounded dynamic require.resolve"
+        );
+      }
+    },
+    ImportExpression(node) {
+      if (isRuntimeTypeScriptSpecifier(node.source)) {
+        reasons.add("loads runtime TypeScript");
+      } else if (!isLiteralString(node.source)) {
+        reasons.add(
+          isPackageRelativeDynamicTarget(node.source) ? "uses package-relative dynamic import" : "uses unbounded dynamic import"
+        );
+      }
+    },
+    ImportDeclaration(node) {
+      if (isRuntimeTypeScriptSpecifier(node.source)) {
+        reasons.add("loads runtime TypeScript");
+      }
+    },
+    VariableDeclarator(node) {
+      if (node.id.type !== "ObjectPattern") return;
+      const init2 = node.init;
+      const moduleConstructor = Boolean(
+        init2?.type === "MemberExpression" && memberPropertyName(init2.property) === "constructor" && init2.object?.type === "Identifier" && init2.object.name === "module"
+      );
+      const nodeModuleNamespace = Boolean(
+        init2?.type === "Identifier" && init2.name === "Module"
+      );
+      if (!moduleConstructor && !nodeModuleNamespace) return;
+      for (const property of node.id.properties) {
+        if (property.type !== "Property") continue;
+        const name = memberPropertyName(property.key);
+        if (name === "_load" || name === "_resolveFilename") {
+          reasons.add("uses unbounded Node module loader");
+        }
+        if (name === "dlopen") reasons.add("uses native dynamic loader");
+      }
+    },
+    NewExpression(node) {
+      if (dynamicCodeEvaluatorKind(node.callee) === "function") {
+        reasons.add("uses Function constructor");
+      }
+    },
+    MetaProperty(node) {
+      if (node.meta.name === "import" && node.property.name === "meta") {
+        reasons.add("uses import.meta package location");
+      }
+    }
+  });
+  const fsNamespaces = /* @__PURE__ */ new Set();
+  const fsPathFunctions = /* @__PURE__ */ new Set();
+  const fsPathMethods = /* @__PURE__ */ new Set([
+    "access",
+    "accessSync",
+    "createReadStream",
+    "existsSync",
+    "lstat",
+    "lstatSync",
+    "open",
+    "openSync",
+    "readFile",
+    "readFileSync",
+    "readdir",
+    "readdirSync",
+    "realpath",
+    "realpathSync",
+    "stat",
+    "statSync"
+  ]);
+  walkSimple(ast, {
+    ImportDeclaration(node) {
+      if (typeof node.source.value !== "string" || !["fs", "node:fs", "fs/promises", "node:fs/promises"].includes(
+        node.source.value
+      )) {
+        return;
+      }
+      for (const specifier of node.specifiers) {
+        if (specifier.type === "ImportSpecifier") {
+          if (fsPathMethods.has(specifier.imported.name)) {
+            fsPathFunctions.add(specifier.local.name);
+          }
+        } else {
+          fsNamespaces.add(specifier.local.name);
+        }
+      }
+    },
+    VariableDeclarator(node) {
+      const init2 = node.init;
+      const required = init2?.type === "CallExpression" && init2.callee?.type === "Identifier" && init2.callee.name === "require" && isLiteralString(init2.arguments?.[0]) && ["fs", "node:fs", "fs/promises", "node:fs/promises"].includes(
+        String((init2.arguments?.[0]).value)
+      );
+      if (!required) return;
+      if (node.id.type === "Identifier") fsNamespaces.add(node.id.name);
+      if (node.id.type === "ObjectPattern") {
+        for (const property of node.id.properties) {
+          if (property.type === "Property" && property.value.type === "Identifier" && fsPathMethods.has(memberPropertyName(property.key) || "")) {
+            fsPathFunctions.add(property.value.name);
+          }
+        }
+      }
+    }
+  });
+  walkSimple(ast, {
+    CallExpression(node) {
+      const callee = node.callee;
+      let isFsPathCall = callee.type === "Identifier" && fsPathFunctions.has(callee.name);
+      if (callee.type === "MemberExpression") {
+        const method = memberPropertyName(callee.property);
+        const object = callee.object;
+        const namespace = object.type === "Identifier" ? object.name : object.type === "MemberExpression" && memberPropertyName(object.property) === "promises" && object.object.type === "Identifier" ? object.object.name : void 0;
+        isFsPathCall = Boolean(
+          namespace && fsNamespaces.has(namespace) && fsPathMethods.has(method || "")
+        );
+      }
+      if (isFsPathCall && isProvablyPackageEscapingPath(node.arguments[0])) {
+        reasons.add("uses filesystem path outside the proven package boundary");
+      }
+    }
+  });
+  walkAncestor(ast, {
+    Identifier(node, _state, ancestors) {
+      const parent = ancestors.at(-2);
+      const grandparent = ancestors.at(-3);
+      if (node.name === "__dirname" || node.name === "__filename") {
+        if (parent?.type === "MemberExpression" && parent.property === node && !parent.computed) {
+          return;
+        }
+        reasons.add("uses package-relative file location");
+        return;
+      }
+      if (node.name === "createRequire") {
+        reasons.add("uses createRequire");
+        return;
+      }
+      if (node.name !== "require") return;
+      if (parent?.type === "CallExpression" && parent.callee === node) return;
+      if (parent?.type === "UnaryExpression" && parent.operator === "typeof") {
+        return;
+      }
+      if (parent?.type === "MemberExpression" && parent.object === node) {
+        const property = memberPropertyName(parent.property);
+        if (property === "resolve" && grandparent?.type === "CallExpression" && grandparent.callee === parent) {
+          return;
+        }
+        reasons.add(`uses require.${property ?? "unknown"} runtime state`);
+        return;
+      }
+      reasons.add("escapes the require function");
+    },
+    MemberExpression(node, _state, ancestors) {
+      const property = memberPropertyName(node.property);
+      const object = node.object;
+      const moduleConstructor = Boolean(
+        object.type === "MemberExpression" && memberPropertyName(object.property) === "constructor" && object.object?.type === "Identifier" && object.object.name === "module"
+      );
+      if ((property === "_load" || property === "_resolveFilename") && (moduleConstructor || object.type === "Identifier" && object.name === "Module")) {
+        reasons.add("uses unbounded Node module loader");
+      }
+      if (property === "dlopen" && object.type === "Identifier" && object.name === "process") {
+        reasons.add("uses native dynamic loader");
+      }
+      if (node.object.type !== "Identifier" || node.object.name !== "module" || property !== "require") {
+        return;
+      }
+      const parent = ancestors.at(-2);
+      if (parent?.type === "CallExpression" && parent.callee === node) return;
+      reasons.add("escapes module.require");
+    }
+  });
+  return [...reasons].sort();
+}
+function createPackageOwnerResolver(projectRoot) {
+  const nodeModulesRoot = path26.join(projectRoot, "node_modules");
+  const cache = /* @__PURE__ */ new Map();
+  return (file) => {
+    const absolute = path26.resolve(file);
+    const cached = cache.get(absolute);
+    if (cached !== void 0 || cache.has(absolute)) return cached;
+    if (!isInside(nodeModulesRoot, absolute)) {
+      cache.set(absolute, void 0);
+      return void 0;
+    }
+    let current = fs30.existsSync(absolute) && fs30.statSync(absolute).isDirectory() ? absolute : path26.dirname(absolute);
+    while (isInside(nodeModulesRoot, current) && current !== nodeModulesRoot) {
+      const manifest = path26.join(current, "package.json");
+      if (fs30.existsSync(manifest) && fs30.statSync(manifest).isFile()) {
+        cache.set(absolute, current);
+        return current;
+      }
+      current = path26.dirname(current);
+    }
+    cache.set(absolute, void 0);
+    return void 0;
+  };
+}
+function readPackageIdentity(projectRoot, packageRoot) {
+  const packagePath = toPosixRelative(projectRoot, packageRoot);
+  if (!isSafePackageLockPath(packagePath)) {
+    throw new Error(`unsupported dynamic island path: ${packagePath}`);
+  }
+  const manifest = readJsonObject(
+    path26.join(packageRoot, "package.json"),
+    `dynamic island ${packagePath}`
+  );
+  if (typeof manifest.name !== "string" || !manifest.name) {
+    throw new Error(`dynamic island package name is invalid: ${packagePath}`);
+  }
+  return { packagePath, packageName: manifest.name };
+}
+function addDynamicIsland(projectRoot, islands, packageRoot, reasons) {
+  const existing = islands.get(packageRoot);
+  if (existing) {
+    for (const reason of reasons) existing.reasons.add(reason);
+    return;
+  }
+  const identity = readPackageIdentity(projectRoot, packageRoot);
+  islands.set(packageRoot, {
+    packageRoot,
+    ...identity,
+    reasons: new Set(reasons)
+  });
+}
+function isBareSpecifier(specifier) {
+  return !specifier.startsWith(".") && !specifier.startsWith("/") && !specifier.startsWith("file:");
+}
+function isBundleableResolvedFile(file) {
+  const extension = path26.extname(file).toLowerCase();
+  return extension === "" || extension === ".js" || extension === ".cjs" || extension === ".cts" || extension === ".mjs" || extension === ".mts" || extension === ".json" || extension === ".jsx" || extension === ".ts" || extension === ".tsx";
+}
+function retryIslandDiscovery(packagePath, reasons) {
+  return {
+    errors: [
+      {
+        text: `retry with dynamic island ${packagePath}: ${reasons.join(", ")}`
+      }
+    ]
+  };
+}
+function hybridDynamicIslandPlugin(projectRoot, islands) {
+  const packageOwner = createPackageOwnerResolver(projectRoot);
+  const discover = (owner, reasons) => {
+    addDynamicIsland(projectRoot, islands, owner, reasons);
+    return retryIslandDiscovery(toPosixRelative(projectRoot, owner), reasons);
+  };
+  return {
+    name: "miaoda-hybrid-dynamic-islands",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /.*/ }, async (args) => {
+        const pluginData = args.pluginData;
+        if (pluginData?.miaodaHybridSkip) return void 0;
+        if (BUILTINS.has(args.path)) return { path: args.path, external: true };
+        if (args.kind === "entry-point") return void 0;
+        const importerOwner = args.importer ? packageOwner(args.importer) : void 0;
+        const resolved = await esbuild.resolve(args.path, {
+          importer: args.importer,
+          kind: args.kind,
+          namespace: args.namespace,
+          resolveDir: args.resolveDir,
+          pluginData: { miaodaHybridSkip: true }
+        });
+        if (resolved.errors.length > 0) {
+          return importerOwner ? discover(importerOwner, [`resolves ${args.path} at runtime`]) : { errors: resolved.errors };
+        }
+        if (resolved.external) return resolved;
+        const targetOwner = packageOwner(resolved.path);
+        if (targetOwner && islands.has(targetOwner)) {
+          if (isBareSpecifier(args.path)) {
+            const targetIdentity = readPackageIdentity(
+              projectRoot,
+              targetOwner
+            );
+            if (args.kind === "import-statement" || args.kind === "dynamic-import") {
+              if (importerOwner && importerOwner !== targetOwner) {
+                return discover(importerOwner, [
+                  `preserves ESM import conditions for ${targetIdentity.packagePath}`
+                ]);
+              }
+              return {
+                errors: [
+                  {
+                    text: `bundle entry cannot preserve ESM import conditions for dynamic island: ${targetIdentity.packagePath}`
+                  }
+                ]
+              };
+            }
+            const rootPackagePath = `node_modules/${targetIdentity.packageName}`;
+            if (targetIdentity.packagePath === rootPackagePath) {
+              return { path: args.path, external: true };
+            }
+            if (importerOwner && importerOwner !== targetOwner) {
+              return discover(importerOwner, [
+                `resolves nested dynamic island ${targetIdentity.packagePath}`
+              ]);
+            }
+            return {
+              errors: [
+                {
+                  text: `bundle entry cannot preserve nested package resolution: ${targetIdentity.packagePath}`
+                }
+              ]
+            };
+          }
+          if (importerOwner && importerOwner !== targetOwner) {
+            return discover(importerOwner, [
+              `depends on dynamic island ${toPosixRelative(
+                projectRoot,
+                targetOwner
+              )}`
+            ]);
+          }
+          if (!isBareSpecifier(args.path)) {
+            return {
+              errors: [
+                {
+                  text: `application relative import crosses into dynamic island: ${args.path}`
+                }
+              ]
+            };
+          }
+          return { path: args.path, external: true };
+        }
+        if (targetOwner && resolved.path && !isBundleableResolvedFile(resolved.path)) {
+          return discover(targetOwner, [
+            `loads runtime asset ${path26.extname(resolved.path) || "<no extension>"}`
+          ]);
+        }
+        return resolved;
+      });
+      esbuild.onLoad(
+        { filter: /\.(?:cjs|cts|js|jsx|mjs|mts|ts|tsx)$/ },
+        (args) => {
+          const source = fs30.readFileSync(args.path, "utf8");
+          const reasons = packageLayoutCapabilityReasons(source);
+          if (reasons.length === 0) return void 0;
+          const owner = packageOwner(args.path);
+          if (owner) {
+            if (/\.(?:cts|mts|ts|tsx)$/.test(args.path)) {
+              const identity = readPackageIdentity(projectRoot, owner);
+              return {
+                errors: [
+                  {
+                    text: `TypeScript dependency requires package layout but is not directly executable: ${identity.packagePath}/${toPosixRelative(owner, args.path)}: ${reasons.join(", ")}`
+                  }
+                ]
+              };
+            }
+            return discover(owner, reasons);
+          }
+          const applicationReasons = reasons.filter(
+            (reason) => reason !== "uses filesystem APIs" && reason !== "uses filesystem path outside the proven package boundary"
+          );
+          if (applicationReasons.length === 0) return void 0;
+          return {
+            errors: [
+              {
+                text: `application startup code cannot preserve dynamic layout: ${toPosixRelative(
+                  projectRoot,
+                  args.path
+                )}: ${applicationReasons.join(", ")}`
+              }
+            ]
+          };
+        }
+      );
+    }
+  };
+}
+async function buildHybridBundle(projectRoot, entryFile, outputFile) {
+  const islands = /* @__PURE__ */ new Map();
+  for (let pass = 0; pass < MAX_ISLAND_DISCOVERY_PASSES; pass += 1) {
+    const before = islands.size;
+    fs30.rmSync(outputFile, { force: true });
+    try {
+      await build({
+        absWorkingDir: projectRoot,
+        entryPoints: [entryFile],
+        outfile: outputFile,
+        bundle: true,
+        platform: "node",
+        format: "cjs",
+        target: `node${process.versions.node.split(".")[0]}`,
+        keepNames: true,
+        legalComments: "none",
+        logLevel: "silent",
+        preserveSymlinks: true,
+        sourcemap: false,
+        plugins: [hybridDynamicIslandPlugin(projectRoot, islands)]
+      });
+      return islands;
+    } catch (error) {
+      if (islands.size > before) continue;
+      throw error;
+    }
+  }
+  throw new Error(
+    `dynamic island discovery exceeded ${MAX_ISLAND_DISCOVERY_PASSES} passes`
+  );
+}
+function readDependencyState(projectRoot) {
+  const packageFile = path26.join(projectRoot, "package.json");
+  const lockFile = path26.join(projectRoot, "package-lock.json");
+  const installedLockFile = path26.join(
+    projectRoot,
+    "node_modules",
+    ".package-lock.json"
+  );
+  for (const [file, description] of [
+    [packageFile, "package.json"],
+    [lockFile, "package-lock.json"],
+    [installedLockFile, "installed node_modules lockfile"]
+  ]) {
+    if (!fs30.existsSync(file) || fs30.lstatSync(file).isSymbolicLink()) {
+      throw new Error(`${description} is unavailable`);
+    }
+  }
+  const packageContents = readBoundedFile(
+    packageFile,
+    MAX_PACKAGE_MANIFEST_BYTES,
+    "package.json"
+  );
+  const lockContents = readBoundedFile(
+    lockFile,
+    MAX_DEPENDENCY_METADATA_BYTES,
+    "package-lock.json"
+  );
+  const installedLockContents = readBoundedFile(
+    installedLockFile,
+    MAX_DEPENDENCY_METADATA_BYTES,
+    "installed node_modules lockfile"
+  );
+  const packageJson = readJsonObject(packageFile, "package.json");
+  const rootLock = JSON.parse(lockContents.toString("utf8"));
+  const installedLock = JSON.parse(
+    installedLockContents.toString("utf8")
+  );
+  const rootPackages = lockPackages(rootLock, "package-lock.json");
+  const installedPackages = lockPackages(
+    installedLock,
+    "installed node_modules lockfile"
+  );
+  const rootRecord = rootPackages[""];
+  if (!rootRecord) throw new Error("package-lock.json root package is missing");
+  for (const field of ["dependencies", "optionalDependencies"]) {
+    const declared = packageJson[field] ?? {};
+    const locked = rootRecord[field] ?? {};
+    if (stableJson(declared) !== stableJson(locked)) {
+      throw new Error(`package.json and package-lock.json ${field} disagree`);
+    }
+  }
+  let declaredDynamicDependencies;
+  const startupConfig = packageJson.miaodaStartupBundle;
+  if (startupConfig !== void 0) {
+    if (!startupConfig || typeof startupConfig !== "object" || Array.isArray(startupConfig)) {
+      throw new Error("package.json miaodaStartupBundle must be an object");
+    }
+    const configured = startupConfig.dynamicDependencies;
+    if (!Array.isArray(configured) || configured.some((item) => typeof item !== "string")) {
+      throw new Error(
+        "package.json miaodaStartupBundle.dynamicDependencies must be a string array"
+      );
+    }
+    declaredDynamicDependencies = [...new Set(configured)].sort();
+    if (declaredDynamicDependencies.length !== configured.length) {
+      throw new Error(
+        "package.json miaodaStartupBundle.dynamicDependencies contains duplicates"
+      );
+    }
+    const rootRuntimeDependencies = /* @__PURE__ */ new Set([
+      ...Object.keys(stringRecord(packageJson.dependencies)),
+      ...Object.keys(stringRecord(packageJson.optionalDependencies))
+    ]);
+    for (const dependencyName of declaredDynamicDependencies) {
+      packageNameSegments(dependencyName);
+      if (!rootRuntimeDependencies.has(dependencyName)) {
+        throw new Error(
+          `declared startup dynamic dependency is not a root runtime dependency: ${dependencyName}`
+        );
+      }
+    }
+  }
+  return {
+    packageJson,
+    packageContents,
+    lockContents,
+    rootPackages,
+    installedPackages,
+    declaredDynamicDependencies
+  };
+}
+function manifestContainsRuntimeTypeScript(value) {
+  if (typeof value === "string") {
+    return /\.(?:cts|mts|ts|tsx)(?:$|[?#])/.test(value);
+  }
+  if (Array.isArray(value))
+    return value.some(manifestContainsRuntimeTypeScript);
+  if (value && typeof value === "object") {
+    return Object.entries(value).some(
+      ([condition, target]) => condition !== "types" && !condition.startsWith("types@") && manifestContainsRuntimeTypeScript(target)
+    );
+  }
+  return false;
+}
+function isPackageDevelopmentFile(relativeFile) {
+  const segments = relativeFile.split("/");
+  return segments.some(
+    (segment) => /^(?:__tests__|bench(?:mark)?s?|fixtures?|tests?)$/i.test(segment)
+  ) || /(?:^|\.)\b(?:spec|test)\.[cm]?[jt]sx?$/.test(path26.basename(relativeFile));
+}
+function createMaterializedPackageAuditor(packageRoot, identity) {
+  if (manifestContainsRuntimeTypeScript(identity.manifest.main) || manifestContainsRuntimeTypeScript(identity.manifest.exports) || manifestContainsRuntimeTypeScript(identity.manifest.bin)) {
+    throw new Error(
+      `TypeScript dependency is not directly executable in the startup runtime: ${identity.packagePath}`
+    );
+  }
+  let runtimeTypeScriptFile;
+  let packageRelativeDynamicLoader;
+  return {
+    inspect(candidate) {
+      const name = path26.basename(candidate);
+      const relativeFile = toPosixRelative(packageRoot, candidate);
+      if (isPackageDevelopmentFile(relativeFile)) return;
+      if (/\.(?:cts|mts|ts|tsx)$/.test(name) && !/\.d\.(?:cts|mts|ts)$/.test(name)) {
+        runtimeTypeScriptFile ?? (runtimeTypeScriptFile = relativeFile);
+        return;
+      }
+      if (!/\.(?:cjs|js|jsx|mjs)$/.test(name)) return;
+      const reasons = packageLayoutCapabilityReasons(
+        fs30.readFileSync(candidate, "utf8")
+      );
+      for (const reason of reasons) {
+        if (reason === "loads runtime TypeScript") {
+          throw new Error(
+            `TypeScript dependency is not directly executable in the startup runtime: ${identity.packagePath}/${toPosixRelative(packageRoot, candidate)}`
+          );
+        }
+        if (reason.startsWith("uses package-relative dynamic")) {
+          packageRelativeDynamicLoader ?? (packageRelativeDynamicLoader = relativeFile);
+        }
+        if (reason === "uses filesystem path outside the proven package boundary") {
+          throw new Error(
+            `filesystem access escapes the startup island boundary: ${identity.packagePath}/${toPosixRelative(packageRoot, candidate)}`
+          );
+        }
+        if (reason === "uses unbounded dynamic import" || reason === "uses eval-generated code" || reason === "uses VM code evaluation" || reason === "uses native dynamic loader") {
+          throw new Error(
+            `startup island uses an unsupported executable loader: ${identity.packagePath}/${toPosixRelative(packageRoot, candidate)}: ${reason}`
+          );
+        }
+      }
+    },
+    assertComplete() {
+      if (runtimeTypeScriptFile && packageRelativeDynamicLoader) {
+        throw new Error(
+          `package-relative dynamic loader may select non-executable TypeScript: ${identity.packagePath}/${packageRelativeDynamicLoader} -> ${runtimeTypeScriptFile}`
+        );
+      }
+    }
+  };
+}
+function packageNameSegments(name) {
+  const segments = name.split("/");
+  if (name.startsWith("@") && segments.length !== 2 || !name.startsWith("@") && segments.length !== 1 || segments.some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new Error(`unsupported dependency package name: ${name}`);
+  }
+  return segments;
+}
+function resolveInstalledDependencyRoot(projectRoot, packageRoot, dependencyName) {
+  const segments = packageNameSegments(dependencyName);
+  let current = packageRoot;
+  while (isInside(projectRoot, current)) {
+    const candidate = path26.join(current, "node_modules", ...segments);
+    if (fs30.existsSync(candidate)) {
+      if (fs30.lstatSync(candidate).isSymbolicLink()) {
+        throw new Error(
+          `linked runtime dependency is unsupported: ${toPosixRelative(
+            projectRoot,
+            candidate
+          )}`
+        );
+      }
+      if (fs30.statSync(candidate).isDirectory() && fs30.existsSync(path26.join(candidate, "package.json"))) {
+        return candidate;
+      }
+    }
+    const parent = path26.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return void 0;
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
+}
+function validateInstalledPackage(projectRoot, packageRoot, state) {
+  const { packagePath, packageName } = readPackageIdentity(
+    projectRoot,
+    packageRoot
+  );
+  const locked = state.rootPackages[packagePath];
+  const installed = state.installedPackages[packagePath];
+  if (!locked)
+    throw new Error(`package is absent from lockfile: ${packagePath}`);
+  if (locked.link === true) {
+    throw new Error(`linked runtime package is unsupported: ${packagePath}`);
+  }
+  if (!installed || stableJson(comparableLockRecord(installed)) !== stableJson(comparableLockRecord(locked))) {
+    throw new Error(
+      `installed package does not match lockfile: ${packagePath}`
+    );
+  }
+  const manifest = readJsonObject(
+    path26.join(packageRoot, "package.json"),
+    `installed package ${packagePath}`
+  );
+  if (manifest.name !== packageName) {
+    throw new Error(
+      `installed package name does not match path: ${packagePath}`
+    );
+  }
+  const version = manifest.version;
+  if (typeof version !== "string" || !version) {
+    throw new Error(`installed package version is invalid: ${packagePath}`);
+  }
+  if (typeof locked.version === "string" && locked.version !== version) {
+    throw new Error(
+      `installed package version does not match lockfile: ${packagePath}`
+    );
+  }
+  return { packagePath, packageName, version, manifest };
+}
+function materializeDynamicIslands(projectRoot, payloadRoot, islands) {
+  const state = readDependencyState(projectRoot);
+  if (islands.size > 0 && state.declaredDynamicDependencies === void 0) {
+    throw new Error(
+      "startup bundle with dynamic islands requires package.json miaodaStartupBundle.dynamicDependencies (use [] when no non-relative dynamic package is allowed)"
+    );
+  }
+  const queue = [...islands.values()].sort((left, right) => left.packagePath.localeCompare(right.packagePath)).map((island) => island.packageRoot);
+  const dynamicDependencies = [];
+  for (const dependencyName of state.declaredDynamicDependencies ?? []) {
+    const dependencyRoot = resolveInstalledDependencyRoot(
+      projectRoot,
+      projectRoot,
+      dependencyName
+    );
+    if (!dependencyRoot) {
+      throw new Error(
+        `declared startup dynamic dependency is not installed: ${dependencyName}`
+      );
+    }
+    dynamicDependencies.push({
+      specifier: dependencyName,
+      resolvedPackagePath: readPackageIdentity(projectRoot, dependencyRoot).packagePath
+    });
+    queue.push(dependencyRoot);
+  }
+  const visited = /* @__PURE__ */ new Set();
+  const materializedPackages = [];
+  const selectedLockRecords = [];
+  fs30.mkdirSync(payloadRoot, { recursive: true, mode: 493 });
+  fs30.writeFileSync(
+    path26.join(payloadRoot, "package.json"),
+    `${JSON.stringify({ private: true, type: "commonjs" })}
+`,
+    { mode: 420 }
+  );
+  const budget = measurePayload(payloadRoot);
+  while (queue.length > 0) {
+    const packageRoot = queue.shift();
+    if (visited.has(packageRoot)) continue;
+    visited.add(packageRoot);
+    const identity = validateInstalledPackage(projectRoot, packageRoot, state);
+    const auditor = createMaterializedPackageAuditor(packageRoot, identity);
+    copyDirectoryContents(
+      packageRoot,
+      path26.join(payloadRoot, ...identity.packagePath.split("/")),
+      true,
+      budget,
+      auditor.inspect
+    );
+    auditor.assertComplete();
+    const island = islands.has(packageRoot);
+    materializedPackages.push({
+      packagePath: identity.packagePath,
+      packageName: identity.packageName,
+      version: identity.version,
+      island
+    });
+    selectedLockRecords.push({
+      path: identity.packagePath,
+      record: comparableLockRecord(state.rootPackages[identity.packagePath])
+    });
+    const dependencies = stringRecord(identity.manifest.dependencies);
+    const optionalDependencies = stringRecord(
+      identity.manifest.optionalDependencies
+    );
+    const peerDependencies = stringRecord(identity.manifest.peerDependencies);
+    const peerMetadata = identity.manifest.peerDependenciesMeta && typeof identity.manifest.peerDependenciesMeta === "object" && !Array.isArray(identity.manifest.peerDependenciesMeta) ? identity.manifest.peerDependenciesMeta : {};
+    for (const dependencyName of [
+      .../* @__PURE__ */ new Set([
+        ...Object.keys(dependencies),
+        ...Object.keys(optionalDependencies),
+        ...Object.keys(peerDependencies)
+      ])
+    ].sort()) {
+      const dependencyRoot = resolveInstalledDependencyRoot(
+        projectRoot,
+        packageRoot,
+        dependencyName
+      );
+      const peerConfig = peerMetadata[dependencyName];
+      const optionalPeer = Boolean(
+        peerConfig && typeof peerConfig === "object" && peerConfig.optional === true
+      );
+      const optional = Object.hasOwn(optionalDependencies, dependencyName) || optionalPeer;
+      if (!dependencyRoot) {
+        if (optional) continue;
+        throw new Error(
+          `runtime dependency is not installed: ${identity.packagePath} -> ${dependencyName}`
+        );
+      }
+      queue.push(dependencyRoot);
+    }
+  }
+  materializedPackages.sort(
+    (left, right) => left.packagePath.localeCompare(right.packagePath)
+  );
+  selectedLockRecords.sort(
+    (left, right) => left.path.localeCompare(right.path)
+  );
+  return {
+    lockfileSha256: sha256(state.lockContents),
+    dependencyViewSha256: sha256(
+      stableJson({
+        packageJsonSha256: sha256(state.packageContents),
+        lockfileSha256: sha256(state.lockContents),
+        runtime: runtimeIdentity(),
+        selectedLockRecords
+      })
+    ),
+    materializedPackages,
+    dynamicDependencies
+  };
+}
+function indexPayload(payloadRoot) {
+  const files = [];
+  const budget = { fileCount: 0, totalBytes: 0 };
+  const visit = (directory) => {
+    for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path26.join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`generation symlink is unsupported: ${candidate}`);
+      }
+      if (entry.isDirectory()) {
+        visit(candidate);
+        continue;
+      }
+      if (!entry.isFile()) {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
+      }
+      const stats = fs30.lstatSync(candidate);
+      if (!stats.isFile()) {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
+      }
+      reserveGenerationBudget(candidate, stats.size, budget);
+      const contents = fs30.readFileSync(candidate);
+      if (contents.length !== stats.size) {
+        throw new Error(
+          `generation file changed while indexing: ${toPosixRelative(payloadRoot, candidate)}`
+        );
+      }
+      files.push({
+        path: `payload/${toPosixRelative(payloadRoot, candidate)}`,
+        sha256: sha256(contents),
+        size: contents.length,
+        mode: stats.mode & 511
+      });
+    }
+  };
+  visit(payloadRoot);
+  files.sort((left, right) => left.path.localeCompare(right.path));
+  return {
+    files,
+    treeSha256: sha256(stableJson(files)),
+    totalBytes: budget.totalBytes
+  };
+}
+function reservePort() {
+  return new Promise((resolve2, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(
+          () => reject(new Error("isolated probe failed to reserve a port"))
+        );
+        return;
+      }
+      server.close((error) => error ? reject(error) : resolve2(address.port));
+    });
+  });
+}
+async function isolatedProbe(projectRoot, payloadRoot, entry, timeoutMs) {
+  const probeRoot = fs30.mkdtempSync(
+    path26.join(os3.tmpdir(), "miaoda-server-generation-probe-")
+  );
+  const probeWorkspaceRoot = path26.join(probeRoot, "workspace");
+  const probeProjectRoot = path26.join(probeWorkspaceRoot, "code");
+  copyProbeWorkspace(projectRoot, probeProjectRoot);
+  const probeGenerationRoot = path26.join(
+    probeProjectRoot,
+    ".miaoda-cache",
+    "server",
+    "generations",
+    "probe"
+  );
+  const probePayload = path26.join(probeGenerationRoot, "payload");
+  copyDirectoryContents(payloadRoot, probePayload, false);
+  const probeEntry = path26.join(probeGenerationRoot, ...entry.split("/"));
+  const probeModuleGuard = path26.join(
+    probePayload,
+    "module-resolution-guard.cjs"
+  );
+  const port = await reservePort();
+  const configuredBasePath = process.env.CLIENT_BASE_PATH;
+  const basePath = configuredBasePath?.startsWith("/") && !configuredBasePath.startsWith("//") ? configuredBasePath.replace(/\/+$/, "") : "";
+  const readinessPath = `${basePath}/__innerapi__/capability/list`;
+  const startedAt = Date.now();
+  const child = spawn2(process.execPath, [probeEntry], {
+    cwd: probeProjectRoot,
+    detached: true,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...process.env,
+      NODE_PATH: path26.join(probePayload, "node_modules"),
+      NODE_OPTIONS: `--require=${JSON.stringify(probeModuleGuard)}`,
+      PWD: probeProjectRoot,
+      WORKSPACE_DIR: probeWorkspaceRoot,
+      MIAODA_WORKSPACE_ROOT: probeProjectRoot,
+      NODE_ENV: "development",
+      SERVER_HOST: "127.0.0.1",
+      SERVER_PORT: String(port),
+      MIAODA_SERVER_CACHE_PROBE: "true",
+      DEPRECATED_SKIP_INIT_DB_CONNECTION: process.env.DEPRECATED_SKIP_INIT_DB_CONNECTION ?? "true",
+      FORCE_AUTHN_INNERAPI_DOMAIN: process.env.FORCE_AUTHN_INNERAPI_DOMAIN ?? "http://127.0.0.1",
+      FORCE_AUTHN_ACCESS_KEY: process.env.FORCE_AUTHN_ACCESS_KEY ?? "server-startup-probe",
+      FORCE_AUTHN_ACCESS_SECRET: process.env.FORCE_AUTHN_ACCESS_SECRET ?? "server-startup-probe"
+    }
+  });
+  registerProbe(child);
+  const stdout = collectChildOutput(child, "stdout");
+  const stderr = collectChildOutput(child, "stderr");
+  try {
+    await new Promise((resolve2, reject) => {
+      const deadline = Date.now() + timeoutMs;
+      let settled = false;
+      let retryTimer;
+      const detail = () => `${stderr()}
+${stdout()}`.trim();
+      const finish = (error) => {
+        if (settled) return;
+        settled = true;
+        if (retryTimer) clearTimeout(retryTimer);
+        if (error) reject(error);
+        else resolve2();
+      };
+      const retry = () => {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+          finish(
+            new Error(
+              `isolated generation readiness timeout${detail() ? `: ${detail()}` : ""}`
+            )
+          );
+          return;
+        }
+        retryTimer = setTimeout(attempt, Math.min(25, remaining));
+      };
+      const attempt = () => {
+        if (settled) return;
+        if (child.exitCode !== null || child.signalCode !== null) {
+          finish(
+            new Error(
+              `isolated generation exited before readiness${detail() ? `: ${detail()}` : ""}`
+            )
+          );
+          return;
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) return retry();
+        let requestSettled = false;
+        const request = http.get(
+          { host: "127.0.0.1", port, path: readinessPath },
+          (response) => {
+            if (requestSettled || settled) {
+              response.destroy();
+              return;
+            }
+            if (response.statusCode !== 200) {
+              requestSettled = true;
+              response.resume();
+              retry();
+              return;
+            }
+            const chunks = [];
+            let responseBytes = 0;
+            response.on("data", (chunk) => {
+              if (requestSettled || settled) return;
+              const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+              responseBytes += buffer.length;
+              if (responseBytes > MAX_READINESS_RESPONSE_BYTES) {
+                requestSettled = true;
+                response.destroy();
+                retry();
+                return;
+              }
+              chunks.push(buffer);
+            });
+            response.once("end", () => {
+              if (requestSettled || settled) return;
+              requestSettled = true;
+              if (isCapabilityReadinessPayload(Buffer.concat(chunks))) finish();
+              else retry();
+            });
+            response.once("error", () => {
+              if (requestSettled || settled) return;
+              requestSettled = true;
+              retry();
+            });
+          }
+        );
+        request.setTimeout(
+          remaining,
+          () => request.destroy(new Error("isolated generation readiness timeout"))
+        );
+        request.once("error", () => {
+          if (requestSettled || settled) return;
+          requestSettled = true;
+          retry();
+        });
+      };
+      attempt();
+    });
+    return Date.now() - startedAt;
+  } finally {
+    await stopProbe(child);
+    fs30.rmSync(probeRoot, { recursive: true, force: true });
+  }
+}
+function writeBoundedJson(file, value, maxBytes, description) {
+  const contents = `${JSON.stringify(value, null, 2)}
+`;
+  if (Buffer.byteLength(contents) > maxBytes) {
+    throw new Error(`${description} exceeds ${maxBytes} bytes`);
+  }
+  fs30.writeFileSync(file, contents, {
+    mode: 384
+  });
+}
+function removeLegacyPointer(cacheRoot) {
+  fs30.rmSync(path26.join(cacheRoot, "current.json"), { force: true });
+}
+function removeStaleBuildArtifacts(cacheRoot) {
+  for (const entry of fs30.readdirSync(cacheRoot)) {
+    if (!/^\.(?:staging|retired)-[a-z0-9-]+$/.test(entry)) continue;
+    const target = path26.join(cacheRoot, entry);
+    const stats = fs30.lstatSync(target);
+    if (stats.isDirectory() && !stats.isSymbolicLink()) {
+      fs30.rmSync(target, { recursive: true, force: true });
+    } else {
+      fs30.rmSync(target, { force: true });
+    }
+  }
+}
+async function buildServerStartupBundle(options) {
+  const startedAt = Date.now();
+  let stagingRoot;
+  let cacheRoot;
+  try {
+    const projectRoot = fs30.realpathSync(path26.resolve(options.projectRoot));
+    cacheRoot = path26.resolve(
+      projectRoot,
+      options.cacheRoot ?? ".miaoda-cache/server"
+    );
+    if (!isInside(projectRoot, cacheRoot))
+      throw new Error("cache root escaped project root");
+    assertNoSymlinkComponents(
+      projectRoot,
+      cacheRoot,
+      "cache path symlink is unsupported"
+    );
+    fs30.mkdirSync(cacheRoot, { recursive: true, mode: 448 });
+    removeLegacyPointer(cacheRoot);
+    removeStaleBuildArtifacts(cacheRoot);
+    const timeoutMs = options.probeTimeoutMs ?? 1e4;
+    const compileTimeoutMs = options.compileTimeoutMs ?? 12e4;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+      throw new Error("probe timeout must be positive");
+    if (!Number.isFinite(compileTimeoutMs) || compileTimeoutMs <= 0)
+      throw new Error("compile timeout must be positive");
+    const sourceSha256 = workspaceSourceSha256(projectRoot);
+    stagingRoot = path26.join(cacheRoot, `.staging-${randomUUID()}`);
+    fs30.mkdirSync(stagingRoot, { recursive: false, mode: 448 });
+    const explicitEntry = options.entry ? resolveEntry(projectRoot, options.entry) : void 0;
+    const distRoot = path26.join(projectRoot, "dist");
+    const compiled = explicitEntry ? {
+      entry: explicitEntry,
+      applicationRoot: isInside(distRoot, explicitEntry) ? distRoot : path26.dirname(explicitEntry)
+    } : await compileNestSource(
+      projectRoot,
+      stagingRoot,
+      compileTimeoutMs,
+      resolveNestTsconfig(projectRoot)
+    );
+    if (workspaceSourceSha256(projectRoot) !== sourceSha256) {
+      throw new Error("source changed during isolated Nest compilation");
+    }
+    const payloadRoot = path26.join(stagingRoot, "payload");
+    fs30.mkdirSync(payloadRoot, { recursive: true, mode: 493 });
+    const entry = STARTUP_ENTRY_FILE;
+    const bundleFile = path26.join(
+      stagingRoot,
+      ...STARTUP_BUNDLE_FILE.split("/")
+    );
+    const islands = await buildHybridBundle(
+      projectRoot,
+      compiled.entry,
+      bundleFile
+    );
+    const dynamicIslands = [...islands.values()].map((island) => ({
+      packagePath: island.packagePath,
+      packageName: island.packageName,
+      reasons: [...island.reasons].sort()
+    })).sort((left, right) => left.packagePath.localeCompare(right.packagePath));
+    const {
+      lockfileSha256,
+      dependencyViewSha256,
+      materializedPackages,
+      dynamicDependencies
+    } = materializeDynamicIslands(projectRoot, payloadRoot, islands);
+    writeServerStartupLauncher(payloadRoot);
+    const { files, treeSha256, totalBytes } = indexPayload(payloadRoot);
+    const fileIndexContents = `${JSON.stringify(files, null, 2)}
+`;
+    if (Buffer.byteLength(fileIndexContents) > MAX_FILE_INDEX_BYTES) {
+      throw new Error("generation file index exceeds 16 MiB");
+    }
+    fs30.writeFileSync(
+      path26.join(stagingRoot, "files.mtree.json"),
+      fileIndexContents,
+      { mode: 384 }
+    );
+    const runtime = runtimeIdentity();
+    const generationId = sha256(
+      stableJson({
+        artifactFormat: ARTIFACT_FORMAT,
+        builderPolicyVersion: BUILDER_POLICY_VERSION,
+        dependencyMode: DEPENDENCY_MODE,
+        dependencyViewSha256,
+        dynamicDependencies,
+        dynamicIslands,
+        entry,
+        lockfileSha256,
+        materializedPackages,
+        runtime,
+        schemaVersion: SCHEMA_VERSION,
+        sourceSha256,
+        treeSha256
+      })
+    );
+    const startupMs = await isolatedProbe(
+      projectRoot,
+      payloadRoot,
+      entry,
+      timeoutMs
+    );
+    if (workspaceSourceSha256(projectRoot) !== sourceSha256) {
+      throw new Error("source changed while building startup generation");
+    }
+    const manifest = {
+      schemaVersion: SCHEMA_VERSION,
+      builderPolicyVersion: BUILDER_POLICY_VERSION,
+      artifactFormat: ARTIFACT_FORMAT,
+      generationId,
+      entry,
+      sourceSha256,
+      lockfileSha256,
+      dependencyViewSha256,
+      dependencyMode: DEPENDENCY_MODE,
+      dynamicDependencies,
+      dynamicIslands,
+      materializedPackages,
+      runtime,
+      artifact: {
+        fileIndex: "files.mtree.json",
+        fileIndexSha256: sha256(fileIndexContents),
+        treeSha256,
+        fileCount: files.length,
+        totalBytes
+      },
+      isolatedProbe: {
+        success: true,
+        workspaceNodeModulesVisible: false,
+        startupMs
+      }
+    };
+    writeBoundedJson(
+      path26.join(stagingRoot, "manifest.json"),
+      manifest,
+      MAX_MANIFEST_BYTES,
+      "startup generation manifest"
+    );
+    writeBoundedJson(
+      path26.join(stagingRoot, "probe.json"),
+      {
+        schemaVersion: SCHEMA_VERSION,
+        generationId,
+        success: true,
+        workspaceNodeModulesVisible: false,
+        startupMs
+      },
+      MAX_PROBE_BYTES,
+      "startup generation probe"
+    );
+    fs30.rmSync(path26.join(stagingRoot, ".compiled"), {
+      recursive: true,
+      force: true
+    });
+    const generationsRoot = path26.join(cacheRoot, "generations");
+    fs30.mkdirSync(generationsRoot, { recursive: true, mode: 448 });
+    const generationRoot = path26.join(generationsRoot, generationId);
+    const previousGenerations = fs30.readdirSync(generationsRoot);
+    if (previousGenerations.length > 1) {
+      throw new Error("startup generation directory is ambiguous");
+    }
+    const previous = previousGenerations[0];
+    const previousRoot = previous ? path26.join(generationsRoot, previous) : void 0;
+    const retiredRoot = previousRoot ? path26.join(cacheRoot, `.retired-${randomUUID()}`) : void 0;
+    if (previousRoot && retiredRoot) {
+      fs30.renameSync(previousRoot, retiredRoot);
+    }
+    try {
+      fs30.renameSync(stagingRoot, generationRoot);
+    } catch (publishError) {
+      if (previousRoot && retiredRoot && fs30.existsSync(retiredRoot)) {
+        fs30.renameSync(retiredRoot, previousRoot);
+      }
+      throw publishError;
+    }
+    if (previousRoot && retiredRoot) {
+      try {
+        fs30.rmSync(retiredRoot, { recursive: true, force: true });
+      } catch (pruneError) {
+        fs30.rmSync(generationRoot, { recursive: true, force: true });
+        fs30.renameSync(retiredRoot, previousRoot);
+        throw pruneError;
+      }
+    }
+    stagingRoot = void 0;
+    return {
+      built: true,
+      generationId,
+      generationRoot,
+      entryFile: path26.join(generationRoot, ...entry.split("/")),
+      manifestFile: path26.join(generationRoot, "manifest.json"),
+      reasons: [],
+      elapsedMs: Date.now() - startedAt
+    };
+  } catch (error) {
+    if (stagingRoot) fs30.rmSync(stagingRoot, { recursive: true, force: true });
+    if (cacheRoot) removeLegacyPointer(cacheRoot);
+    return {
+      built: false,
+      reasons: [error instanceof Error ? error.message : String(error)],
+      elapsedMs: Date.now() - startedAt
+    };
+  }
+}
+
+// src/commands/build/index.ts
+var getTokenCommand = {
+  name: "get-token",
+  description: "Get artifact upload credential (STI token)",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(
+      async (options) => {
+        await getToken(options);
+      }
+    );
+  }
+};
+var uploadStaticCommand = {
+  name: "upload-static",
+  description: "Upload shared/static files to TOS",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option(
+      "--static-dir <dir>",
+      "Static files directory",
+      UPLOAD_STATIC_DEFAULTS.staticDir
+    ).option(
+      "--tosutil-path <path>",
+      "Path to tosutil binary",
+      UPLOAD_STATIC_DEFAULTS.tosutilPath
+    ).option(
+      "--endpoint <endpoint>",
+      "TOS endpoint",
+      UPLOAD_STATIC_DEFAULTS.endpoint
+    ).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
+      await uploadStatic(options);
+    });
+  }
+};
+var preUploadStaticCommand = {
+  name: "pre-upload-static",
+  description: "Get TOS upload info and output as env vars for build.sh eval",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").action(async (options) => {
+      await preUploadStatic(options);
+    });
+  }
+};
+var serverStartupBundleCommand = {
+  name: "server-startup-bundle",
+  description: "Build and isolate-probe a recycle-only NestJS startup generation",
+  register(program) {
+    program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).option(
+      "--probe-timeout-ms <ms>",
+      "Isolated availability probe timeout in milliseconds",
+      "10000"
+    ).action(
+      async (options) => {
+        const probeTimeoutMs = Number(options.probeTimeoutMs);
+        if (!Number.isFinite(probeTimeoutMs) || probeTimeoutMs <= 0) {
+          throw new Error("--probe-timeout-ms must be a positive number");
+        }
+        const result = await buildServerStartupBundle({
+          projectRoot: options.projectRoot,
+          probeTimeoutMs
+        });
+        console.log(JSON.stringify(result));
+        if (!result.built) process.exitCode = 2;
+      }
+    );
   }
 };
 var buildCommandGroup = {
   name: "build",
   description: "Build related commands",
-  commands: [getTokenCommand, uploadStaticCommand, preUploadStaticCommand]
+  commands: [
+    getTokenCommand,
+    uploadStaticCommand,
+    preUploadStaticCommand,
+    serverStartupBundleCommand
+  ]
 };
 
 // src/commands/index.ts
@@ -8309,13 +10371,13 @@ var commands = [
 
 // src/index.ts
 for (const filename of [".env.local", ".env"]) {
-  const envPath = path25.join(process.cwd(), filename);
-  if (fs29.existsSync(envPath)) {
+  const envPath = path27.join(process.cwd(), filename);
+  if (fs31.existsSync(envPath)) {
     dotenvConfig({ path: envPath });
   }
 }
-var __dirname = path25.dirname(fileURLToPath5(import.meta.url));
-var pkg = JSON.parse(fs29.readFileSync(path25.join(__dirname, "../package.json"), "utf-8"));
+var __dirname = path27.dirname(fileURLToPath5(import.meta.url));
+var pkg = JSON.parse(fs31.readFileSync(path27.join(__dirname, "../package.json"), "utf-8"));
 var cli = new FullstackCLI(pkg.version);
 cli.useAll(commands);
 cli.run();