@lark-apaas/fullstack-cli 1.1.64-beta.0 → 1.1.65-alpha.20260902125800

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/index.ts
-import fs29 from "fs";
-import path25 from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import fs31 from "fs";
+import path27 from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 import { config as dotenvConfig } from "dotenv";
 
 // src/cli.ts
@@ -2483,12 +2483,36 @@ import fs7 from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/config/sync.ts
+function hasStartupBundleEnrollment(packageJson) {
+  if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
+    return false;
+  }
+  const config = packageJson.miaodaStartupBundle;
+  return Boolean(
+    config && typeof config === "object" && !Array.isArray(config) && config.schemaVersion === 1
+  );
+}
+var DEFAULT_SYNCED_SCRIPT_FILES = [
+  "build.sh",
+  "dev-local.js",
+  "dev.sh",
+  "lint.js",
+  "prune-smart.js",
+  "run.sh"
+];
 function buildDefaultRules(opts) {
   const rules = [
-    // 1. 派生 scripts 目录（总是覆盖；递归同步，包含 scripts/hooks/run-precommit.js）
+    // 1. 显式同步通用 scripts。禁止目录级 wholesale copy，避免将今后新增的
+    //    冷启动专属文件意外回灌到未入组的存量应用。
+    ...DEFAULT_SYNCED_SCRIPT_FILES.map((file) => ({
+      from: `templates/scripts/${file}`,
+      to: `scripts/${file}`,
+      type: "file",
+      overwrite: true
+    })),
     {
-      from: "templates/scripts",
-      to: "scripts",
+      from: "templates/scripts/hooks",
+      to: "scripts/hooks",
       type: "directory",
       overwrite: true
     },
@@ -2590,6 +2614,14 @@ function buildDefaultRules(opts) {
       ifStartsWith: "concurrently "
     }
   ];
+  if (opts.startupBundleEnrolled) {
+    rules.unshift({
+      from: "templates/scripts/dev.js",
+      to: "scripts/dev.js",
+      type: "file",
+      overwrite: true
+    });
+  }
   if (!opts.disableGenOpenapi) {
     rules.push({
       from: "templates/helper/gen-openapi.ts",
@@ -2766,10 +2798,14 @@ async function run2(options) {
     process.exit(0);
   }
   const stack = resolveStack(userProjectRoot);
+  const startupBundleEnrolled = resolveStartupBundleEnrollment(userPackageJson);
   try {
-    console.log(`[fullstack-cli] Starting sync${stack ? ` (stack: ${stack})` : ""}...`);
+    console.log(
+      `[fullstack-cli] Starting sync${stack ? ` (stack: ${stack})` : ""}...`
+    );
     const config = genSyncConfig(stack, {
-      disableGenOpenapi: options.disableGenOpenapi ?? false
+      disableGenOpenapi: options.disableGenOpenapi ?? false,
+      startupBundleEnrolled
     });
     if (!config || !config.sync) {
       console.warn("[fullstack-cli] No sync configuration found");
@@ -2786,7 +2822,9 @@ async function run2(options) {
         activateGitHooks(userProjectRoot);
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        console.warn(`[fullstack-cli] \u26A0 Failed to activate git hooks: ${message}`);
+        console.warn(
+          `[fullstack-cli] \u26A0 Failed to activate git hooks: ${message}`
+        );
       }
     }
     console.log("[fullstack-cli] Sync completed successfully \u2705");
@@ -2796,6 +2834,19 @@ async function run2(options) {
     process.exit(1);
   }
 }
+function resolveStartupBundleEnrollment(packageJsonPath) {
+  try {
+    return hasStartupBundleEnrollment(
+      JSON.parse(fs7.readFileSync(packageJsonPath, "utf-8"))
+    );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(
+      `[fullstack-cli] \u26A0 Failed to inspect startup bundle enrollment, using legacy sync: ${message}`
+    );
+    return false;
+  }
+}
 function resolveStack(userProjectRoot) {
   const sparkMetaPath = path5.join(userProjectRoot, ".spark", "meta.json");
   if (!fs7.existsSync(sparkMetaPath)) {
@@ -2806,7 +2857,9 @@ function resolveStack(userProjectRoot) {
     return typeof meta.stack === "string" ? meta.stack : void 0;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    console.warn(`[fullstack-cli] \u26A0 Failed to read .spark/meta.json, fallback to default sync: ${message}`);
+    console.warn(
+      `[fullstack-cli] \u26A0 Failed to read .spark/meta.json, fallback to default sync: ${message}`
+    );
     return void 0;
   }
 }
@@ -2827,7 +2880,12 @@ async function syncRule(rule, pluginRoot, userProjectRoot) {
   }
   if (rule.type === "add-script") {
     const packageJsonPath = path5.join(userProjectRoot, "package.json");
-    addScript(packageJsonPath, rule.name, rule.command, rule.overwrite ?? false);
+    addScript(
+      packageJsonPath,
+      rule.name,
+      rule.command,
+      rule.overwrite ?? false
+    );
     return;
   }
   if (rule.type === "patch-script") {
@@ -2860,7 +2918,12 @@ async function syncRule(rule, pluginRoot, userProjectRoot) {
       syncDirectory(srcPath, destPath, rule.overwrite ?? true);
       break;
     case "file":
-      syncFile(srcPath, destPath, rule.overwrite ?? true, rule.onlyIfExists ?? false);
+      syncFile(
+        srcPath,
+        destPath,
+        rule.overwrite ?? true,
+        rule.onlyIfExists ?? false
+      );
       break;
     case "append":
       appendToFile(srcPath, destPath);
@@ -2869,7 +2932,9 @@ async function syncRule(rule, pluginRoot, userProjectRoot) {
 }
 function syncFile(src, dest, overwrite = true, onlyIfExists = false) {
   if (onlyIfExists && !fs7.existsSync(dest)) {
-    console.log(`[fullstack-cli] \u25CB ${path5.basename(dest)} (skipped, target not exists)`);
+    console.log(
+      `[fullstack-cli] \u25CB ${path5.basename(dest)} (skipped, target not exists)`
+    );
     return;
   }
   const destDir = path5.dirname(dest);
@@ -2877,7 +2942,9 @@ function syncFile(src, dest, overwrite = true, onlyIfExists = false) {
     fs7.mkdirSync(destDir, { recursive: true });
   }
   if (fs7.existsSync(dest) && !overwrite) {
-    console.log(`[fullstack-cli] \u25CB ${path5.basename(dest)} (skipped, already exists)`);
+    console.log(
+      `[fullstack-cli] \u25CB ${path5.basename(dest)} (skipped, already exists)`
+    );
     return;
   }
   fs7.copyFileSync(src, dest);
@@ -2904,7 +2971,9 @@ function syncDirectory(src, dest, overwrite = true) {
     }
   });
   if (count > 0) {
-    console.log(`[fullstack-cli] Synced ${count} files to ${path5.basename(dest)}/`);
+    console.log(
+      `[fullstack-cli] Synced ${count} files to ${path5.basename(dest)}/`
+    );
   }
 }
 function appendToFile(src, dest) {
@@ -2914,7 +2983,9 @@ function appendToFile(src, dest) {
     existingContent = fs7.readFileSync(dest, "utf-8");
   }
   if (existingContent.includes(content.trim())) {
-    console.log(`[fullstack-cli] \u25CB ${path5.basename(dest)} (already contains content)`);
+    console.log(
+      `[fullstack-cli] \u25CB ${path5.basename(dest)} (already contains content)`
+    );
     return;
   }
   fs7.appendFileSync(dest, content);
@@ -3000,7 +3071,9 @@ function patchScript(packageJsonPath, name, to, ifStartsWith) {
     console.log(`[fullstack-cli] \u2713 Patched scripts.${name}`);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    console.warn(`[fullstack-cli] \u26A0 Could not patch scripts.${name}: ${message}`);
+    console.warn(
+      `[fullstack-cli] \u26A0 Could not patch scripts.${name}: ${message}`
+    );
   }
 }
 function addLineToFile(filePath, line) {
@@ -3298,8 +3371,11 @@ function getCliVersion() {
 }
 
 // src/commands/upgrade/get-upgrade-files.ts
-function getUpgradeFilesToStage(disableGenOpenapi = true) {
-  const syncConfig = genSyncConfig(void 0, { disableGenOpenapi });
+function getUpgradeFilesToStage(disableGenOpenapi = true, startupBundleEnrolled = false) {
+  const syncConfig = genSyncConfig(void 0, {
+    disableGenOpenapi,
+    startupBundleEnrolled
+  });
   const filesToStage = /* @__PURE__ */ new Set();
   syncConfig.sync.forEach((rule) => {
     if (rule.type === "file" || rule.type === "directory" || rule.type === "merge-json") {
@@ -3333,10 +3409,15 @@ async function run3(options = {}) {
     if (shouldCommit) {
       console.log("[fullstack-cli] Step 3/3: Committing changes...");
       const version = getCliVersion();
-      const filesToStage = getUpgradeFilesToStage(options.disableGenOpenapi ?? true);
+      const filesToStage = getUpgradeFilesToStage(
+        options.disableGenOpenapi ?? true,
+        hasStartupBundleEnrollment(readPackageJson(userProjectRoot))
+      );
       autoCommitUpgradeChanges(version, userProjectRoot, filesToStage);
     } else {
-      console.log("[fullstack-cli] Step 3/3: Skipping commit (--no-commit flag)");
+      console.log(
+        "[fullstack-cli] Step 3/3: Skipping commit (--no-commit flag)"
+      );
     }
     console.log("[fullstack-cli] Upgrade completed successfully \u2705");
   } catch (error) {
@@ -8260,38 +8341,2533 @@ async function preUploadStatic(options) {
   }
 }
 
-// src/commands/build/index.ts
-var getTokenCommand = {
-  name: "get-token",
-  description: "Get artifact upload credential (STI token)",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(async (options) => {
-      await getToken(options);
-    });
+// src/commands/build/server-startup-bundle.handler.ts
+import fs30 from "fs";
+import http from "http";
+import net from "net";
+import os3 from "os";
+import path26 from "path";
+import { createRequire as createRequire4 } from "module";
+import { spawn as spawn2 } from "child_process";
+import { createHash, randomUUID } from "crypto";
+
+// src/commands/build/server-startup-static-bundle.ts
+import fs29 from "fs";
+import path25 from "path";
+import { builtinModules, createRequire as createRequire3 } from "module";
+import { fileURLToPath as fileURLToPath5, pathToFileURL } from "url";
+import { build } from "esbuild";
+import { parse } from "acorn";
+import { simple as walkSimple } from "acorn-walk";
+var ACTION_PLUGIN_LOADER_PACKAGE = "@lark-apaas/nestjs-capability";
+var ENROLLMENT_SCHEMA_VERSION = 1;
+var MAX_PACKAGE_JSON_BYTES = 1024 * 1024;
+var BUILTINS = /* @__PURE__ */ new Set([
+  ...builtinModules,
+  ...builtinModules.map((name) => `node:${name}`)
+]);
+function isInside(root, candidate) {
+  const relative = path25.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path25.isAbsolute(relative);
+}
+function readBounded(file, maximum, description) {
+  if (!fs29.existsSync(file)) throw new Error(`${description} is unavailable`);
+  const stats = fs29.lstatSync(file);
+  if (stats.isSymbolicLink() || !stats.isFile() || stats.size > maximum) {
+    throw new Error(`${description} exceeds the supported metadata size`);
+  }
+  const contents = fs29.readFileSync(file);
+  if (contents.length !== stats.size) {
+    throw new Error(`${description} changed while reading`);
+  }
+  return contents;
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
+}
+function packageNameIsValid(name) {
+  return /^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/i.test(
+    name
+  );
+}
+function findPackageRoot(projectRoot, entry) {
+  const nodeModulesRoot = path25.join(projectRoot, "node_modules");
+  let current = path25.dirname(entry);
+  while (isInside(nodeModulesRoot, current) && current !== nodeModulesRoot) {
+    const packageFile = path25.join(current, "package.json");
+    if (fs29.existsSync(packageFile) && fs29.statSync(packageFile).isFile()) {
+      return current;
+    }
+    current = path25.dirname(current);
   }
-};
-var uploadStaticCommand = {
-  name: "upload-static",
-  description: "Upload shared/static files to TOS",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option("--static-dir <dir>", "Static files directory", UPLOAD_STATIC_DEFAULTS.staticDir).option("--tosutil-path <path>", "Path to tosutil binary", UPLOAD_STATIC_DEFAULTS.tosutilPath).option("--endpoint <endpoint>", "TOS endpoint", UPLOAD_STATIC_DEFAULTS.endpoint).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
-      await uploadStatic(options);
-    });
+  return void 0;
+}
+function assertSafePackageRoot(projectRoot, packageRoot) {
+  const nodeModulesRoot = path25.join(projectRoot, "node_modules");
+  if (!isInside(nodeModulesRoot, packageRoot)) {
+    throw new Error(`package escaped project node_modules: ${packageRoot}`);
   }
-};
-var preUploadStaticCommand = {
-  name: "pre-upload-static",
-  description: "Get TOS upload info and output as env vars for build.sh eval",
-  register(program) {
-    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").action(async (options) => {
-      await preUploadStatic(options);
+  let current = projectRoot;
+  for (const segment of path25.relative(projectRoot, packageRoot).split(path25.sep)) {
+    if (!segment) continue;
+    current = path25.join(current, segment);
+    if (fs29.lstatSync(current).isSymbolicLink()) {
+      throw new Error(`package symlink is unsupported: ${packageRoot}`);
+    }
+  }
+}
+function resolveActionPlugins(projectRoot, configured) {
+  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
+  return Object.entries(configured).sort(([left], [right]) => left.localeCompare(right)).map(([specifier, version]) => {
+    if (!packageNameIsValid(specifier) || !version) {
+      throw new Error(
+        `Action Plugin has an invalid configured version: ${specifier}`
+      );
+    }
+    let entry;
+    try {
+      entry = projectRequire.resolve(specifier);
+    } catch (error) {
+      throw new Error(
+        `Action Plugin cannot be statically resolved: ${specifier}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    const packageRoot = findPackageRoot(projectRoot, entry);
+    if (!packageRoot) {
+      throw new Error(`Action Plugin package root not found: ${specifier}`);
+    }
+    assertSafePackageRoot(projectRoot, packageRoot);
+    const packageContents = readBounded(
+      path25.join(packageRoot, "package.json"),
+      MAX_PACKAGE_JSON_BYTES,
+      `Action Plugin package.json ${specifier}`
+    );
+    const packageJson = JSON.parse(packageContents.toString("utf8"));
+    if (packageJson.name !== specifier || packageJson.version !== version) {
+      throw new Error(
+        `Action Plugin identity mismatch: ${specifier}@${version}`
+      );
+    }
+    const manifestContents = readBounded(
+      path25.join(packageRoot, "manifest.json"),
+      MAX_PACKAGE_JSON_BYTES,
+      `Action Plugin manifest ${specifier}`
+    );
+    const manifest = JSON.parse(manifestContents.toString("utf8"));
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+      throw new Error(
+        `Action Plugin manifest must be an object: ${specifier}`
+      );
+    }
+    const manifestObject = manifest;
+    if (manifestObject.name !== void 0 && manifestObject.name !== specifier || manifestObject.version !== void 0 && manifestObject.version !== version) {
+      throw new Error(
+        `Action Plugin manifest identity mismatch: ${specifier}`
+      );
+    }
+    return {
+      specifier,
+      version,
+      entry,
+      packageRoot,
+      manifest: manifestObject
+    };
+  });
+}
+function readDependencyState(projectRoot) {
+  const packageFile = path25.join(projectRoot, "package.json");
+  const packageContents = readBounded(
+    packageFile,
+    MAX_PACKAGE_JSON_BYTES,
+    "package.json"
+  );
+  const packageJson = JSON.parse(packageContents.toString("utf8"));
+  if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
+    throw new Error("package.json must contain an object");
+  }
+  const packageObject = packageJson;
+  const enrollment = packageObject.miaodaStartupBundle;
+  if (!enrollment || typeof enrollment !== "object" || Array.isArray(enrollment) || enrollment.schemaVersion !== ENROLLMENT_SCHEMA_VERSION) {
+    throw new Error(
+      `package.json miaodaStartupBundle.schemaVersion must be ${ENROLLMENT_SCHEMA_VERSION}`
+    );
+  }
+  const configuredPlugins = packageObject.actionPlugins;
+  if (configuredPlugins !== void 0 && (!configuredPlugins || typeof configuredPlugins !== "object" || Array.isArray(configuredPlugins))) {
+    throw new Error("package.json actionPlugins must be an object");
+  }
+  const actionPlugins = stringRecord(configuredPlugins);
+  if (configuredPlugins && Object.keys(actionPlugins).length !== Object.keys(configuredPlugins).length) {
+    throw new Error("package.json actionPlugins versions must be strings");
+  }
+  return {
+    plugins: resolveActionPlugins(projectRoot, actionPlugins)
+  };
+}
+function parseJavaScript(source) {
+  try {
+    return parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      allowHashBang: true
     });
+  } catch {
+    try {
+      return parse(source, {
+        ecmaVersion: "latest",
+        sourceType: "script",
+        allowHashBang: true,
+        allowReturnOutsideFunction: true
+      });
+    } catch {
+      return void 0;
+    }
+  }
+}
+function staticPropertyName(node) {
+  if (node?.type !== "MemberExpression") return void 0;
+  if (!node.computed && node.property?.type === "Identifier") {
+    return node.property.name;
+  }
+  if (node.computed && node.property?.type === "Literal" && typeof node.property.value === "string") {
+    return node.property.value;
+  }
+  return void 0;
+}
+function staticString(node, bindings) {
+  if (!node) return void 0;
+  if (node.type === "Literal" && typeof node.value === "string")
+    return node.value;
+  if (node.type === "Identifier") return bindings.get(node.name);
+  if (node.type === "TemplateLiteral") {
+    let value = "";
+    for (let index = 0; index < node.quasis.length; index += 1) {
+      value += node.quasis[index]?.value?.cooked ?? "";
+      if (index < node.expressions.length) {
+        const expression = staticString(node.expressions[index], bindings);
+        if (expression === void 0) return void 0;
+        value += expression;
+      }
+    }
+    return value;
+  }
+  if (node.type === "BinaryExpression" && node.operator === "+") {
+    const left = staticString(node.left, bindings);
+    const right = staticString(node.right, bindings);
+    return left === void 0 || right === void 0 ? void 0 : left + right;
+  }
+  return void 0;
+}
+function recordBindingPattern(node, counts) {
+  if (!node) return;
+  if (node.type === "Identifier") {
+    counts.set(node.name, (counts.get(node.name) ?? 0) + 1);
+    return;
+  }
+  if (node.type === "RestElement") {
+    recordBindingPattern(node.argument, counts);
+    return;
+  }
+  if (node.type === "AssignmentPattern") {
+    recordBindingPattern(node.left, counts);
+    return;
+  }
+  if (node.type === "ArrayPattern") {
+    for (const element of node.elements ?? [])
+      recordBindingPattern(element, counts);
+    return;
+  }
+  if (node.type === "ObjectPattern") {
+    for (const property of node.properties ?? []) {
+      recordBindingPattern(
+        property.type === "RestElement" ? property.argument : property.value,
+        counts
+      );
+    }
+  }
+}
+function declaredBindingCounts(ast) {
+  const counts = /* @__PURE__ */ new Map();
+  walkSimple(ast, {
+    VariableDeclarator(node) {
+      recordBindingPattern(node.id, counts);
+    },
+    FunctionDeclaration(node) {
+      recordBindingPattern(node.id, counts);
+      for (const parameter of node.params ?? [])
+        recordBindingPattern(parameter, counts);
+    },
+    FunctionExpression(node) {
+      recordBindingPattern(node.id, counts);
+      for (const parameter of node.params ?? [])
+        recordBindingPattern(parameter, counts);
+    },
+    ArrowFunctionExpression(node) {
+      for (const parameter of node.params ?? [])
+        recordBindingPattern(parameter, counts);
+    },
+    ClassDeclaration(node) {
+      recordBindingPattern(node.id, counts);
+    },
+    ClassExpression(node) {
+      recordBindingPattern(node.id, counts);
+    },
+    ImportDeclaration(node) {
+      for (const specifier of node.specifiers ?? []) {
+        recordBindingPattern(specifier.local, counts);
+      }
+    },
+    CatchClause(node) {
+      recordBindingPattern(node.param, counts);
+    },
+    AssignmentExpression(node) {
+      recordBindingPattern(node.left, counts);
+    },
+    UpdateExpression(node) {
+      recordBindingPattern(node.argument, counts);
+    }
+  });
+  return counts;
+}
+function collectStaticBindings(ast, counts) {
+  const declarations = [];
+  for (const statement of ast.body ?? []) {
+    const declaration = statement.type === "VariableDeclaration" ? statement : statement.type === "ExportNamedDeclaration" && statement.declaration?.type === "VariableDeclaration" ? statement.declaration : void 0;
+    if (declaration?.kind !== "const") continue;
+    for (const item of declaration.declarations ?? []) {
+      if (item.id?.type === "Identifier" && item.init && counts.get(item.id.name) === 1) {
+        declarations.push({ name: item.id.name, value: item.init });
+      }
+    }
+  }
+  const bindings = /* @__PURE__ */ new Map();
+  for (let pass = 0; pass <= declarations.length; pass += 1) {
+    let changed = false;
+    for (const declaration of declarations) {
+      if (bindings.has(declaration.name)) continue;
+      const value = staticString(declaration.value, bindings);
+      if (value !== void 0) {
+        bindings.set(declaration.name, value);
+        changed = true;
+      }
+    }
+    if (!changed) break;
+  }
+  return bindings;
+}
+function runtimeBuiltinModule(specifier) {
+  if (typeof specifier !== "string") return void 0;
+  const normalized = specifier.startsWith("node:") ? specifier.slice("node:".length) : specifier;
+  return [
+    "child_process",
+    "fs",
+    "fs/promises",
+    "path",
+    "url",
+    "worker_threads"
+  ].includes(normalized) ? normalized : void 0;
+}
+function literalString(node) {
+  return node?.type === "Literal" && typeof node.value === "string" ? node.value : void 0;
+}
+function builtinRequire(node, bindingCounts) {
+  if (node?.type !== "CallExpression" || node.callee?.type !== "Identifier" || node.callee.name !== "require" || bindingCounts.has("require") || node.arguments.length !== 1) {
+    return void 0;
+  }
+  const module = runtimeBuiltinModule(literalString(node.arguments[0]));
+  return module ? { module, members: [] } : void 0;
+}
+function recordBuiltinPattern(pattern, origin, counts, bindings) {
+  if (!pattern) return;
+  if (pattern.type === "Identifier") {
+    if (counts.get(pattern.name) === 1) bindings.set(pattern.name, origin);
+    return;
+  }
+  if (pattern.type === "AssignmentPattern") {
+    recordBuiltinPattern(pattern.left, origin, counts, bindings);
+    return;
+  }
+  if (pattern.type !== "ObjectPattern") return;
+  for (const property of pattern.properties ?? []) {
+    if (property.type !== "Property") continue;
+    const member = property.key?.type === "Identifier" ? property.key.name : literalString(property.key);
+    if (!member) continue;
+    recordBuiltinPattern(
+      property.value,
+      { module: origin.module, members: [...origin.members, member] },
+      counts,
+      bindings
+    );
+  }
+}
+function collectBuiltinBindings(ast, counts) {
+  const bindings = /* @__PURE__ */ new Map();
+  for (const statement of ast.body ?? []) {
+    if (statement.type === "ImportDeclaration") {
+      const module = runtimeBuiltinModule(literalString(statement.source));
+      if (!module) continue;
+      for (const specifier of statement.specifiers ?? []) {
+        if (specifier.local?.type !== "Identifier") continue;
+        const origin = specifier.type === "ImportSpecifier" ? {
+          module,
+          members: [
+            specifier.imported?.type === "Identifier" ? specifier.imported.name : literalString(specifier.imported) ?? ""
+          ]
+        } : { module, members: [] };
+        if (origin.members.every(Boolean) && counts.get(specifier.local.name) === 1) {
+          bindings.set(specifier.local.name, origin);
+        }
+      }
+      continue;
+    }
+    const declaration = statement.type === "VariableDeclaration" ? statement : statement.type === "ExportNamedDeclaration" && statement.declaration?.type === "VariableDeclaration" ? statement.declaration : void 0;
+    if (!declaration) continue;
+    for (const item of declaration.declarations ?? []) {
+      let origin = builtinRequire(item.init, counts);
+      if (!origin && item.init?.type === "MemberExpression" && staticPropertyName(item.init)) {
+        const required = builtinRequire(item.init.object, counts);
+        if (required) {
+          origin = {
+            module: required.module,
+            members: [...required.members, staticPropertyName(item.init)]
+          };
+        }
+      }
+      if (origin) recordBuiltinPattern(item.id, origin, counts, bindings);
+    }
+  }
+  return bindings;
+}
+function analyzeSource(ast) {
+  const bindingCounts = declaredBindingCounts(ast);
+  return {
+    bindingCounts,
+    builtinBindings: collectBuiltinBindings(ast, bindingCounts),
+    strings: collectStaticBindings(ast, bindingCounts)
+  };
+}
+function unwrapZeroSequence(node) {
+  if (node?.type === "SequenceExpression" && node.expressions.length === 2 && node.expressions[0]?.type === "Literal" && node.expressions[0].value === 0) {
+    return node.expressions[1];
+  }
+  return node;
+}
+function builtinReference(node, analysis) {
+  const target = unwrapZeroSequence(node);
+  if (!target) return void 0;
+  if (target.type === "Identifier") {
+    return analysis.builtinBindings.get(target.name);
+  }
+  if (target.type !== "MemberExpression")
+    return builtinRequire(target, analysis.bindingCounts);
+  const member = staticPropertyName(target);
+  if (!member) return void 0;
+  const parent = builtinReference(target.object, analysis);
+  return parent ? { module: parent.module, members: [...parent.members, member] } : void 0;
+}
+function builtinMethod(node, analysis, module) {
+  const reference = builtinReference(node, analysis);
+  if (!reference || reference.module !== module) return void 0;
+  return reference.members.length === 1 ? reference.members[0] : void 0;
+}
+function fsMethod(node, analysis) {
+  const reference = builtinReference(node, analysis);
+  if (!reference) return void 0;
+  if (reference.module === "fs/promises" && reference.members.length === 1) {
+    return reference.members[0];
+  }
+  if (reference.module !== "fs") return void 0;
+  if (reference.members.length === 1) return reference.members[0];
+  return reference.members.length === 2 && reference.members[0] === "promises" ? reference.members[1] : void 0;
+}
+function isDirectRequire(node, analysis) {
+  return isUnshadowedIdentifier(node, "require", analysis);
+}
+function isRequireResolve(node, analysis) {
+  return node?.type === "MemberExpression" && staticPropertyName(node) === "resolve" && isDirectRequire(node.object, analysis);
+}
+function isLayoutHelperCall(node, analysis) {
+  const pathMethod = builtinMethod(node, analysis, "path");
+  const urlMethod = builtinMethod(node, analysis, "url");
+  return pathMethod === "dirname" || pathMethod === "join" || pathMethod === "resolve" || urlMethod === "fileURLToPath";
+}
+function staticModuleReference(sourceFile, node, analysis) {
+  const specifier = staticString(node, analysis.strings);
+  if (specifier !== void 0) return specifier;
+  if (isUrlObjectExpression(node, analysis) && isImportMetaUrl(node?.arguments[1])) {
+    const relative = staticString(node.arguments[0], analysis.strings);
+    if (relative !== void 0) {
+      const moduleUrl = new URL(relative, pathToFileURL(sourceFile));
+      if (moduleUrl.search || moduleUrl.hash) {
+        throw new Error(
+          `module URL search or hash is unsupported in a static startup bundle: ${sourceFile}`
+        );
+      }
+    }
+  }
+  const layout = evaluateLayoutPath(sourceFile, node, analysis);
+  return layout?.kind === "static" && layout.anchor === "directory" ? layout.value : void 0;
+}
+function isUrlObjectExpression(node, analysis) {
+  return Boolean(
+    node?.type === "NewExpression" && (isUnshadowedIdentifier(node.callee, "URL", analysis) || builtinMethod(node.callee, analysis, "url") === "URL")
+  );
+}
+function staticModuleReferencePlugin() {
+  return {
+    name: "miaoda-static-module-references",
+    setup(esbuild) {
+      esbuild.onLoad({ filter: /\.(?:cjs|mjs|js)$/ }, (args) => {
+        const source = fs29.readFileSync(args.path, "utf8");
+        const ast = parseJavaScript(source);
+        if (!ast) return void 0;
+        const analysis = analyzeSource(ast);
+        const replacements = [];
+        const rewriteCode = (node, value) => {
+          if (!node) return;
+          replacements.push({
+            start: node.start,
+            end: node.end,
+            value
+          });
+        };
+        const rewriteString = (node, value) => {
+          if (node?.type === "Literal" && node.value === value) return;
+          rewriteCode(node, JSON.stringify(value));
+        };
+        walkSimple(ast, {
+          CallExpression(node) {
+            const directRequire = isDirectRequire(node.callee, analysis);
+            const requireResolve = isRequireResolve(node.callee, analysis);
+            if (directRequire || requireResolve) {
+              const argument2 = node.arguments[0];
+              if (directRequire && isUrlObjectExpression(argument2, analysis)) {
+                throw new Error(
+                  `require(URL) is unsupported in a static startup bundle: ${args.path}`
+                );
+              }
+              const specifier = staticModuleReference(
+                args.path,
+                argument2,
+                analysis
+              );
+              if (specifier === void 0) return;
+              if (requireResolve) {
+                throw new Error(
+                  `require.resolve is unsupported in a static startup bundle: ${args.path}`
+                );
+              }
+              rewriteString(argument2, specifier);
+              return;
+            }
+            const method = fsMethod(node.callee, analysis);
+            if (!method || !COPYABLE_FS_METHODS.has(method) || !readOptionsAreSafe(method, node, analysis) || !canRewritePayloadPath(analysis)) {
+              return;
+            }
+            const argument = node.arguments[0];
+            const layout = classifyLayoutPath(args.path, argument, analysis);
+            if (layout.kind !== "static") return;
+            rewriteCode(
+              argument,
+              `require("node:path").join(__dirname, ${JSON.stringify(
+                layout.asset.destination
+              )})`
+            );
+          },
+          ImportExpression(node) {
+            const specifier = staticModuleReference(
+              args.path,
+              node.source,
+              analysis
+            );
+            if (specifier !== void 0) rewriteString(node.source, specifier);
+          }
+        });
+        if (replacements.length === 0) return void 0;
+        let contents = source;
+        for (const replacement of replacements.sort(
+          (left, right) => right.start - left.start
+        )) {
+          contents = contents.slice(0, replacement.start) + replacement.value + contents.slice(replacement.end);
+        }
+        return { contents, loader: "js", resolveDir: path25.dirname(args.path) };
+      });
+    }
+  };
+}
+function isImportMetaUrl(node) {
+  return Boolean(
+    node?.type === "MemberExpression" && staticPropertyName(node) === "url" && node.object?.type === "MetaProperty" && node.object.meta?.name === "import" && node.object.property?.name === "meta"
+  );
+}
+function isUnshadowedIdentifier(node, name, analysis) {
+  return node?.type === "Identifier" && node.name === name && !analysis.bindingCounts.has(name);
+}
+function containsRawLayoutPrimitive(node) {
+  if (!node) return false;
+  if (node.type === "Identifier" && (node.name === "__dirname" || node.name === "__filename") || isImportMetaUrl(node)) {
+    return true;
+  }
+  if (node.type === "BinaryExpression" || node.type === "LogicalExpression") {
+    return containsRawLayoutPrimitive(node.left) || containsRawLayoutPrimitive(node.right);
+  }
+  if (node.type === "ConditionalExpression") {
+    return containsRawLayoutPrimitive(node.test) || containsRawLayoutPrimitive(node.consequent) || containsRawLayoutPrimitive(node.alternate);
+  }
+  if (node.type === "TemplateLiteral") {
+    return node.expressions.some(containsRawLayoutPrimitive);
+  }
+  if (node.type === "MemberExpression") {
+    return containsRawLayoutPrimitive(node.object) || node.computed && containsRawLayoutPrimitive(node.property);
+  }
+  if (node.type === "CallExpression" || node.type === "NewExpression") {
+    return containsRawLayoutPrimitive(node.callee) || node.arguments.some(containsRawLayoutPrimitive);
+  }
+  if (node.type === "ChainExpression") {
+    return containsRawLayoutPrimitive(node.expression);
+  }
+  return false;
+}
+function canRewritePayloadPath(analysis) {
+  return !analysis.bindingCounts.has("require") && !analysis.bindingCounts.has("__dirname");
+}
+function canonicalAssetPath(value) {
+  const normalized = value.split(path25.sep).join("/").replace(/^\.\//, "");
+  if (!normalized || normalized === "." || normalized !== path25.posix.normalize(normalized) || normalized.startsWith("../") || path25.posix.isAbsolute(normalized) || normalized.includes("\\")) {
+    return void 0;
+  }
+  return normalized;
+}
+function evaluateLayoutPath(sourceFile, node, analysis) {
+  if (!node) return void 0;
+  if (isUnshadowedIdentifier(node, "__dirname", analysis)) {
+    return {
+      kind: "static",
+      value: path25.dirname(sourceFile),
+      anchor: "directory"
+    };
+  }
+  if (isUnshadowedIdentifier(node, "__filename", analysis) || isImportMetaUrl(node)) {
+    return { kind: "static", value: sourceFile, anchor: "file" };
+  }
+  if (node.type === "NewExpression" && (isUnshadowedIdentifier(node.callee, "URL", analysis) || builtinMethod(node.callee, analysis, "url") === "URL") && isImportMetaUrl(node.arguments[1])) {
+    const relative = staticString(node.arguments[0], analysis.strings);
+    if (relative === void 0) return { kind: "dynamic" };
+    try {
+      const value = fileURLToPath5(new URL(relative, pathToFileURL(sourceFile)));
+      return {
+        kind: "static",
+        value,
+        anchor: path25.resolve(value) === path25.resolve(sourceFile) ? "file" : "directory"
+      };
+    } catch {
+      throw new Error(`static runtime URL is unsupported: ${sourceFile}`);
+    }
+  }
+  if (node.type === "BinaryExpression" && node.operator === "+") {
+    const leftLayout = evaluateLayoutPath(sourceFile, node.left, analysis);
+    const rightLayout = evaluateLayoutPath(sourceFile, node.right, analysis);
+    if (leftLayout?.kind === "dynamic" || rightLayout?.kind === "dynamic") {
+      return { kind: "dynamic" };
+    }
+    if (!leftLayout && !rightLayout) return void 0;
+    const left = leftLayout?.value ?? staticString(node.left, analysis.strings);
+    const right = rightLayout?.value ?? staticString(node.right, analysis.strings);
+    if (left === void 0 || right === void 0) {
+      return { kind: "dynamic" };
+    }
+    return {
+      kind: "static",
+      value: left + right,
+      anchor: leftLayout?.anchor === "file" || rightLayout?.anchor === "file" ? "file" : "directory"
+    };
+  }
+  if (node.type === "TemplateLiteral") {
+    let value = node.quasis[0]?.value?.cooked ?? "";
+    let hasLayout = false;
+    let anchor = "directory";
+    let dynamic = false;
+    for (let index = 0; index < node.expressions.length; index += 1) {
+      const expression = node.expressions[index];
+      const layout = evaluateLayoutPath(sourceFile, expression, analysis);
+      if (layout?.kind === "dynamic") {
+        dynamic = true;
+      } else if (layout) {
+        hasLayout = true;
+        if (layout.anchor === "file") anchor = "file";
+        value += layout.value;
+      } else {
+        const plain = staticString(expression, analysis.strings);
+        if (plain === void 0) dynamic = true;
+        else value += plain;
+      }
+      value += node.quasis[index + 1]?.value?.cooked ?? "";
+    }
+    if (!hasLayout) return void 0;
+    return dynamic ? { kind: "dynamic" } : { kind: "static", value, anchor };
+  }
+  if (node.type !== "CallExpression") {
+    return void 0;
+  }
+  const urlMethod = builtinMethod(node.callee, analysis, "url");
+  if (urlMethod === "fileURLToPath") {
+    return evaluateLayoutPath(sourceFile, node.arguments[0], analysis);
+  }
+  const pathMethod = builtinMethod(node.callee, analysis, "path");
+  if (pathMethod === "dirname") {
+    const target = evaluateLayoutPath(sourceFile, node.arguments[0], analysis);
+    if (!target || target.kind === "dynamic") return target;
+    return {
+      kind: "static",
+      value: path25.dirname(target.value),
+      anchor: "directory"
+    };
+  }
+  if (pathMethod === "join" || pathMethod === "resolve") {
+    const values = [];
+    let hasLayout = false;
+    let anchor = "directory";
+    let hasUnknownSegment = false;
+    for (const argument of node.arguments) {
+      const layout = evaluateLayoutPath(sourceFile, argument, analysis);
+      if (layout?.kind === "dynamic") return layout;
+      if (layout) {
+        hasLayout = true;
+        if (layout.anchor === "file") anchor = "file";
+        values.push(layout.value);
+        continue;
+      }
+      const value = staticString(argument, analysis.strings);
+      if (value === void 0) {
+        hasUnknownSegment = true;
+        continue;
+      }
+      values.push(value);
+    }
+    if (!hasLayout) return void 0;
+    if (hasUnknownSegment) return { kind: "dynamic" };
+    return {
+      kind: "static",
+      value: pathMethod === "resolve" ? path25.resolve(...values) : path25.join(...values),
+      anchor
+    };
+  }
+  return node.arguments.some(
+    (argument) => evaluateLayoutPath(sourceFile, argument, analysis) !== void 0
+  ) ? { kind: "dynamic" } : void 0;
+}
+function classifyLayoutPath(sourceFile, node, analysis) {
+  const evaluated = evaluateLayoutPath(sourceFile, node, analysis);
+  if (!evaluated) {
+    return containsRawLayoutPrimitive(node) ? { kind: "unsafe" } : { kind: "none" };
+  }
+  if (evaluated.kind === "dynamic" || evaluated.anchor === "file") {
+    return { kind: "unsafe" };
+  }
+  const sourceDirectory = path25.dirname(sourceFile);
+  const relative = path25.relative(sourceDirectory, evaluated.value);
+  const destination = canonicalAssetPath(relative);
+  if (!destination) {
+    throw new Error(
+      `static runtime asset must be a strict descendant: ${sourceFile}`
+    );
+  }
+  return {
+    kind: "static",
+    asset: { source: evaluated.value, destination }
+  };
+}
+var COPYABLE_FS_METHODS = /* @__PURE__ */ new Set([
+  "readFile",
+  "readFileSync",
+  "createReadStream",
+  "readdir",
+  "readdirSync",
+  "opendir",
+  "opendirSync",
+  "exists",
+  "existsSync"
+]);
+var NON_COPYABLE_FS_METHODS = /* @__PURE__ */ new Set([
+  "access",
+  "accessSync",
+  "appendFile",
+  "appendFileSync",
+  "chmod",
+  "chmodSync",
+  "chown",
+  "chownSync",
+  "copyFile",
+  "copyFileSync",
+  "cp",
+  "cpSync",
+  "createWriteStream",
+  "glob",
+  "globSync",
+  "link",
+  "linkSync",
+  "lstat",
+  "lstatSync",
+  "mkdir",
+  "mkdirSync",
+  "open",
+  "openSync",
+  "readlink",
+  "readlinkSync",
+  "realpath",
+  "realpathSync",
+  "rename",
+  "renameSync",
+  "rm",
+  "rmSync",
+  "rmdir",
+  "rmdirSync",
+  "stat",
+  "statSync",
+  "statfs",
+  "statfsSync",
+  "symlink",
+  "symlinkSync",
+  "truncate",
+  "truncateSync",
+  "unlink",
+  "unlinkSync",
+  "unwatchFile",
+  "utimes",
+  "utimesSync",
+  "watch",
+  "watchFile",
+  "writeFile",
+  "writeFileSync"
+]);
+function isFsPathMethod(method) {
+  return Boolean(
+    method && (COPYABLE_FS_METHODS.has(method) || NON_COPYABLE_FS_METHODS.has(method))
+  );
+}
+function readOptionsAreSafe(method, call, analysis) {
+  if (!["readFile", "readFileSync", "createReadStream"].includes(method)) {
+    return true;
+  }
+  const options = call.arguments[1];
+  if (!options) return true;
+  if (method === "readFile" && ["ArrowFunctionExpression", "FunctionExpression"].includes(options.type)) {
+    return true;
+  }
+  if (options.type === "Identifier" && options.name === "undefined" && !analysis.bindingCounts.has("undefined")) {
+    return true;
+  }
+  if (options.type === "Literal") {
+    return options.value === null || typeof options.value === "string";
+  }
+  if (options.type !== "ObjectExpression") return false;
+  const accessFlagKey = method === "createReadStream" ? "flags" : "flag";
+  for (const property of options.properties ?? []) {
+    if (property.type !== "Property" || property.kind !== "init") return false;
+    const key = !property.computed && property.key?.type === "Identifier" ? property.key.name : literalString(property.key);
+    if (!key) return false;
+    const stringValue = staticString(property.value, analysis.strings);
+    const literalValue = property.value?.type === "Literal" && (property.value.value === null || ["boolean", "number", "string"].includes(typeof property.value.value));
+    if (key === accessFlagKey) {
+      if (stringValue !== "r" && stringValue !== "rs") return false;
+    } else if (stringValue === void 0 && !literalValue) {
+      return false;
+    }
+  }
+  return true;
+}
+function reserveAssetBudget(file, size, budget, limits) {
+  if (size > limits.maxFileBytes) {
+    throw new Error(`generation file exceeds 64 MiB: ${file}`);
+  }
+  if (budget.fileCount + 1 > limits.maxFiles) {
+    throw new Error(`generation exceeds ${limits.maxFiles} files`);
+  }
+  if (budget.totalBytes + size > limits.maxTotalBytes) {
+    throw new Error("generation exceeds 256 MiB");
+  }
+  budget.fileCount += 1;
+  budget.totalBytes += size;
+}
+function assertSafeAssetPath(projectRoot, source) {
+  if (!isInside(projectRoot, source)) {
+    throw new Error(`static runtime asset escaped project: ${source}`);
+  }
+  let current = projectRoot;
+  for (const segment of path25.relative(projectRoot, source).split(path25.sep)) {
+    if (!segment) continue;
+    current = path25.join(current, segment);
+    if (fs29.lstatSync(current).isSymbolicLink()) {
+      throw new Error(`static runtime asset symlink is unsupported: ${source}`);
+    }
+  }
+}
+function normalizeAssetCandidates(candidates) {
+  const byDestination = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const source = path25.resolve(candidate.source);
+    const previous = byDestination.get(candidate.destination);
+    if (previous && previous !== source) {
+      throw new Error(
+        `static runtime asset collision: ${candidate.destination}`
+      );
+    }
+    byDestination.set(candidate.destination, source);
+  }
+  const normalized = [...byDestination].map(([destination, source]) => ({
+    destination,
+    source
+  }));
+  normalized.sort((left, right) => {
+    const depth = left.destination.split("/").length - right.destination.split("/").length;
+    return depth || left.destination.localeCompare(right.destination);
+  });
+  const accepted = /* @__PURE__ */ new Map();
+  for (const candidate of normalized) {
+    const segments = candidate.destination.split("/");
+    for (let length = segments.length - 1; length > 0; length -= 1) {
+      const ancestor = segments.slice(0, length).join("/");
+      const ancestorSource = accepted.get(ancestor);
+      if (!ancestorSource) continue;
+      const expected = path25.resolve(ancestorSource, ...segments.slice(length));
+      if (expected !== candidate.source) {
+        throw new Error(
+          `static runtime asset tree collision: ${candidate.destination}`
+        );
+      }
+      break;
+    }
+    accepted.set(candidate.destination, candidate.source);
+  }
+  return normalized;
+}
+function seedPayloadBudget(payloadRoot, limits, budget) {
+  const files = /* @__PURE__ */ new Set();
+  const visit = (current) => {
+    for (const entry of fs29.readdirSync(current, { withFileTypes: true })) {
+      const target = path25.join(current, entry.name);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`generation symlink is unsupported: ${target}`);
+      }
+      if (entry.isDirectory()) {
+        visit(target);
+        continue;
+      }
+      if (!entry.isFile()) {
+        throw new Error(`generation special file is unsupported: ${target}`);
+      }
+      const stats = fs29.lstatSync(target);
+      if (!stats.isFile()) {
+        throw new Error(`generation special file is unsupported: ${target}`);
+      }
+      reserveAssetBudget(target, stats.size, budget, limits);
+      files.add(path25.relative(payloadRoot, target).split(path25.sep).join("/"));
+    }
+  };
+  visit(payloadRoot);
+  return files;
+}
+function planAssetFiles(projectRoot, candidates, reserved, limits, budget) {
+  const planned = /* @__PURE__ */ new Map();
+  const visit = (source, destination) => {
+    if (!fs29.existsSync(source)) {
+      throw new Error(`static runtime asset is unavailable: ${source}`);
+    }
+    assertSafeAssetPath(projectRoot, source);
+    const reservedCollision = [...reserved].find(
+      (item) => item === destination || item.startsWith(`${destination}/`) || destination.startsWith(`${item}/`)
+    );
+    if (reservedCollision) {
+      throw new Error(
+        `static runtime asset collides with bundle output: ${reservedCollision}`
+      );
+    }
+    const stats = fs29.lstatSync(source);
+    if (stats.isDirectory()) {
+      const entries = fs29.readdirSync(source).sort();
+      if (entries.length === 0) {
+        throw new Error(
+          `static runtime asset empty directory is unsupported: ${source}`
+        );
+      }
+      for (const entry of entries) {
+        visit(path25.join(source, entry), path25.posix.join(destination, entry));
+      }
+      return;
+    }
+    if (!stats.isFile()) {
+      throw new Error(`static runtime asset type is unsupported: ${source}`);
+    }
+    const previous = planned.get(destination);
+    if (previous && previous.source !== source) {
+      throw new Error(`static runtime asset collision: ${destination}`);
+    }
+    if (previous) return;
+    reserveAssetBudget(source, stats.size, budget, limits);
+    planned.set(destination, {
+      destination,
+      mode: stats.mode & 73 ? 493 : 420,
+      size: stats.size,
+      source
+    });
+  };
+  for (const candidate of candidates) {
+    visit(candidate.source, candidate.destination);
+  }
+  return [...planned.values()].sort(
+    (left, right) => left.destination.localeCompare(right.destination)
+  );
+}
+function copyPlannedAssets(projectRoot, assets, destinationRoot) {
+  for (const asset of assets) {
+    assertSafeAssetPath(projectRoot, asset.source);
+    const stats = fs29.lstatSync(asset.source);
+    if (stats.isSymbolicLink() || !stats.isFile() || stats.size !== asset.size) {
+      throw new Error(
+        `static runtime asset changed before copy: ${asset.source}`
+      );
+    }
+    const contents = fs29.readFileSync(asset.source);
+    if (contents.length !== asset.size) {
+      throw new Error(
+        `static runtime asset changed while reading: ${asset.source}`
+      );
+    }
+    const target = path25.join(destinationRoot, ...asset.destination.split("/"));
+    fs29.mkdirSync(path25.dirname(target), { recursive: true });
+    fs29.writeFileSync(target, contents, { mode: asset.mode });
+  }
+}
+function materializeStaticAssets(projectRoot, metafile, payloadRoot, limits) {
+  const budget = { fileCount: 0, totalBytes: 0 };
+  const reserved = seedPayloadBudget(payloadRoot, limits, budget);
+  const candidates = [];
+  for (const input of Object.keys(metafile.inputs).sort()) {
+    if (!/\.(?:cjs|mjs|js)$/.test(input)) continue;
+    const sourceFile = path25.isAbsolute(input) ? input : path25.resolve(projectRoot, input);
+    if (!fs29.existsSync(sourceFile) || !fs29.statSync(sourceFile).isFile())
+      continue;
+    const source = fs29.readFileSync(sourceFile, "utf8");
+    const ast = parseJavaScript(source);
+    if (!ast) continue;
+    const analysis = analyzeSource(ast);
+    const classify = (node) => classifyLayoutPath(sourceFile, node, analysis);
+    walkSimple(ast, {
+      CallExpression(node) {
+        const method = fsMethod(node.callee, analysis);
+        const forkMethod = builtinMethod(
+          node.callee,
+          analysis,
+          "child_process"
+        );
+        if (forkMethod === "fork") {
+          const target = node.arguments[0];
+          const layout = classify(target);
+          if (staticString(target, analysis.strings) !== void 0 || layout.kind === "static") {
+            throw new Error(
+              `static child runtime entry is unsupported: ${sourceFile}`
+            );
+          }
+          if (layout.kind === "unsafe") {
+            throw new Error(
+              `child runtime entry has an unknown bundle-relative path: ${sourceFile}`
+            );
+          }
+          return;
+        }
+        if (method && COPYABLE_FS_METHODS.has(method)) {
+          const layout = classify(node.arguments[0]);
+          if (layout.kind === "none") return;
+          if (layout.kind === "unsafe") {
+            throw new Error(
+              `runtime asset has an unknown bundle-relative path: ${sourceFile}`
+            );
+          }
+          if (!readOptionsAreSafe(method, node, analysis)) {
+            throw new Error(
+              `runtime filesystem read options are not statically read-only: ${sourceFile}`
+            );
+          }
+          if (!canRewritePayloadPath(analysis)) {
+            throw new Error(
+              `runtime asset path cannot be rewritten without capturing a local binding: ${sourceFile}`
+            );
+          }
+          candidates.push(layout.asset);
+          return;
+        }
+        if (method && NON_COPYABLE_FS_METHODS.has(method)) {
+          if (node.arguments.some((argument) => classify(argument).kind !== "none")) {
+            throw new Error(
+              `runtime filesystem operation cannot preserve a bundle-relative path: ${sourceFile}`
+            );
+          }
+          return;
+        }
+        if (isDirectRequire(node.callee, analysis) || isRequireResolve(node.callee, analysis) || isLayoutHelperCall(node.callee, analysis)) {
+          return;
+        }
+        if (node.arguments.some((argument) => classify(argument).kind !== "none")) {
+          throw new Error(
+            `unknown runtime call observes a bundle-relative path: ${sourceFile}`
+          );
+        }
+      },
+      NewExpression(node) {
+        const workerMethod = builtinMethod(
+          node.callee,
+          analysis,
+          "worker_threads"
+        );
+        const isWorker = workerMethod === "Worker";
+        const isSharedWorker = isUnshadowedIdentifier(
+          node.callee,
+          "SharedWorker",
+          analysis
+        );
+        const isUrl = isUnshadowedIdentifier(node.callee, "URL", analysis) || builtinMethod(node.callee, analysis, "url") === "URL";
+        if (isUrl) return;
+        if (!isWorker && !isSharedWorker) {
+          if (node.arguments.some((argument) => classify(argument).kind !== "none")) {
+            throw new Error(
+              `unknown runtime constructor observes a bundle-relative path: ${sourceFile}`
+            );
+          }
+          return;
+        }
+        const options = node.arguments[1];
+        const evaluatesSource = Boolean(
+          isWorker && options?.type === "ObjectExpression" && options.properties?.some(
+            (property) => property.type === "Property" && (property.key?.type === "Identifier" && property.key.name === "eval" || property.key?.type === "Literal" && property.key.value === "eval") && property.value?.type === "Literal" && property.value.value === true
+          )
+        );
+        if (evaluatesSource) return;
+        const target = node.arguments[0];
+        const layout = classify(target);
+        if (staticString(target, analysis.strings) !== void 0 || layout.kind === "static") {
+          throw new Error(
+            `static child runtime entry is unsupported: ${sourceFile}`
+          );
+        }
+        if (layout.kind === "unsafe") {
+          throw new Error(
+            `child runtime entry has an unknown bundle-relative path: ${sourceFile}`
+          );
+        }
+      }
+    });
+  }
+  const normalized = normalizeAssetCandidates(candidates);
+  const assets = planAssetFiles(
+    projectRoot,
+    normalized,
+    reserved,
+    limits,
+    budget
+  );
+  copyPlannedAssets(projectRoot, assets, payloadRoot);
+}
+function isBareSpecifier(specifier) {
+  return !specifier.startsWith(".") && !specifier.startsWith("/") && !specifier.startsWith("file:");
+}
+function expressionSignalsRelativeSpecifier(node, analysis) {
+  const known = staticString(node, analysis.strings);
+  if (known !== void 0)
+    return known.startsWith(".") || known.startsWith("/");
+  if (node?.type === "TemplateLiteral") {
+    return (node.quasis[0]?.value?.cooked ?? "").startsWith(".");
+  }
+  if (node?.type === "BinaryExpression" && node.operator === "+") {
+    return expressionSignalsRelativeSpecifier(node.left, analysis) || expressionSignalsRelativeSpecifier(node.right, analysis);
+  }
+  if (node?.type === "CallExpression" && builtinMethod(node.callee, analysis, "path") === "join") {
+    const prefix = [];
+    for (const argument of node.arguments) {
+      const value = staticString(argument, analysis.strings);
+      if (value === void 0) break;
+      prefix.push(value);
+    }
+    if (prefix.length > 0) {
+      const normalized = path25.join(...prefix);
+      return normalized === "." || normalized === ".." || normalized.startsWith(`.${path25.sep}`) || normalized.startsWith(`..${path25.sep}`) || path25.isAbsolute(normalized);
+    }
+  }
+  return false;
+}
+function hasUnknownBundleRelativeReference(file) {
+  if (!/\.(?:cjs|mjs|js)$/.test(file) || !fs29.existsSync(file)) return false;
+  const source = fs29.readFileSync(file, "utf8");
+  const ast = parseJavaScript(source);
+  if (!ast) return false;
+  const analysis = analyzeSource(ast);
+  let unsafe = false;
+  walkSimple(ast, {
+    CallExpression(node) {
+      const directRequire = isDirectRequire(node.callee, analysis);
+      const requireResolve = isRequireResolve(node.callee, analysis);
+      if (directRequire || requireResolve) {
+        const layout = classifyLayoutPath(file, node.arguments[0], analysis);
+        const staticTarget = staticModuleReference(
+          file,
+          node.arguments[0],
+          analysis
+        );
+        if (staticTarget === void 0 && (layout.kind === "unsafe" || expressionSignalsRelativeSpecifier(node.arguments[0], analysis))) {
+          unsafe = true;
+        }
+        return;
+      }
+      const method = fsMethod(node.callee, analysis);
+      if (isFsPathMethod(method)) {
+        const layouts = node.arguments.map(
+          (argument) => classifyLayoutPath(file, argument, analysis)
+        );
+        const pathLayout = layouts[0] ?? { kind: "none" };
+        if (pathLayout.kind === "unsafe" || method !== void 0 && COPYABLE_FS_METHODS.has(method) && pathLayout.kind === "static" && (!readOptionsAreSafe(method, node, analysis) || !canRewritePayloadPath(analysis)) || method !== void 0 && NON_COPYABLE_FS_METHODS.has(method) && layouts.some((layout) => layout.kind !== "none")) {
+          unsafe = true;
+        }
+        return;
+      }
+      if (isLayoutHelperCall(node.callee, analysis)) return;
+      if (node.arguments.some(
+        (argument) => classifyLayoutPath(file, argument, analysis).kind !== "none"
+      )) {
+        unsafe = true;
+      }
+    },
+    ImportExpression(node) {
+      const layout = classifyLayoutPath(file, node.source, analysis);
+      const staticTarget = staticModuleReference(file, node.source, analysis);
+      if (staticTarget === void 0 && (layout.kind === "unsafe" || expressionSignalsRelativeSpecifier(node.source, analysis))) {
+        unsafe = true;
+      }
+    }
+  });
+  return unsafe;
+}
+function hasUnbundleableNativeEdge(file) {
+  if (!/\.(?:cjs|mjs|js)$/.test(file) || !fs29.existsSync(file)) return false;
+  const source = fs29.readFileSync(file, "utf8");
+  const ast = parseJavaScript(source);
+  if (!ast) return false;
+  const analysis = analyzeSource(ast);
+  let nativeEdge = false;
+  walkSimple(ast, {
+    CallExpression(node) {
+      if (!isDirectRequire(node.callee, analysis)) {
+        return;
+      }
+      const specifier = staticString(node.arguments[0], analysis.strings);
+      if (specifier?.endsWith(".node")) nativeEdge = true;
+    }
+  });
+  return nativeEdge;
+}
+function runtimeBoundaryPlugin(projectRoot) {
+  const decisions = /* @__PURE__ */ new Map();
+  const realProjectRoot = fs29.realpathSync(projectRoot);
+  const resolutionError = (candidate) => {
+    if (!isInside(projectRoot, candidate)) {
+      return `runtime dependency resolved outside project root: ${candidate}`;
+    }
+    let current = projectRoot;
+    try {
+      for (const segment of path25.relative(projectRoot, candidate).split(path25.sep)) {
+        if (!segment) continue;
+        current = path25.join(current, segment);
+        if (fs29.lstatSync(current).isSymbolicLink()) {
+          return `runtime dependency symlink is unsupported: ${candidate}`;
+        }
+      }
+      const realCandidate = fs29.realpathSync(candidate);
+      if (!isInside(realProjectRoot, realCandidate)) {
+        return `runtime dependency resolved outside project root: ${candidate}`;
+      }
+    } catch (error) {
+      return `runtime dependency path is unavailable: ${candidate}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+    return void 0;
+  };
+  return {
+    name: "miaoda-runtime-owner-boundary",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /.*/ }, async (args) => {
+        const pluginData = args.pluginData;
+        if (pluginData?.miaodaBoundarySkip || args.kind === "entry-point")
+          return void 0;
+        if (BUILTINS.has(args.path)) return { path: args.path, external: true };
+        const importerOwner = args.importer ? findPackageRoot(projectRoot, args.importer) : void 0;
+        const resolved = await esbuild.resolve(args.path, {
+          importer: args.importer,
+          kind: args.kind,
+          namespace: args.namespace,
+          resolveDir: isBareSpecifier(args.path) && !importerOwner ? projectRoot : args.resolveDir,
+          pluginData: { miaodaBoundarySkip: true }
+        });
+        if (resolved.errors.length > 0) {
+          return isBareSpecifier(args.path) ? { path: args.path, external: true } : resolved;
+        }
+        if (resolved.external) return resolved;
+        const unsafeResolution = resolutionError(resolved.path);
+        if (unsafeResolution) {
+          return {
+            errors: [
+              {
+                text: `${unsafeResolution}: ${args.path}`
+              }
+            ]
+          };
+        }
+        const owner = findPackageRoot(projectRoot, resolved.path);
+        if (!owner) {
+          if (hasUnknownBundleRelativeReference(resolved.path)) {
+            return {
+              errors: [
+                {
+                  text: `application runtime has an unknown bundle-relative reference: ${resolved.path}`
+                }
+              ]
+            };
+          }
+          return resolved;
+        }
+        const decisionKey = `${owner}\0${resolved.path}`;
+        let external = decisions.get(decisionKey);
+        if (external === void 0) {
+          external = hasUnknownBundleRelativeReference(resolved.path) || hasUnbundleableNativeEdge(resolved.path);
+          decisions.set(decisionKey, external);
+        }
+        if (!external) return resolved;
+        if (!isBareSpecifier(args.path)) {
+          return {
+            errors: [
+              {
+                text: `runtime owner with an unknown bundle-relative reference must be imported by package name: ${args.path}`
+              }
+            ]
+          };
+        }
+        if (importerOwner) {
+          const rootResolved = await esbuild.resolve(args.path, {
+            kind: args.kind,
+            namespace: "file",
+            resolveDir: projectRoot,
+            pluginData: { miaodaBoundarySkip: true }
+          });
+          let resolvesToSameRootPackage = false;
+          if (rootResolved.errors.length === 0 && !rootResolved.external) {
+            try {
+              resolvesToSameRootPackage = fs29.realpathSync(rootResolved.path) === fs29.realpathSync(resolved.path);
+            } catch {
+              resolvesToSameRootPackage = false;
+            }
+          }
+          if (!resolvesToSameRootPackage) {
+            return {
+              errors: [
+                {
+                  text: `runtime owner with an unknown bundle-relative reference must resolve to the same package from the bundle root: ${args.path}`
+                }
+              ]
+            };
+          }
+        }
+        return { path: args.path, external: true };
+      });
+    }
+  };
+}
+function staticActionPluginRegistry(projectRoot, plugins) {
+  if (plugins.length === 0) {
+    return { name: "miaoda-static-action-plugin-registry", setup() {
+    } };
+  }
+  const projectRequire = createRequire3(path25.join(projectRoot, "package.json"));
+  const capabilityEntry = projectRequire.resolve(ACTION_PLUGIN_LOADER_PACKAGE);
+  const imports = plugins.map(
+    (plugin, index) => `const __miaodaPlugin${index} = require(${JSON.stringify(plugin.entry)});`
+  );
+  const registrations = plugins.map(
+    (plugin, index) => `{ pluginKey: ${JSON.stringify(plugin.specifier)}, manifest: ${JSON.stringify(
+      plugin.manifest
+    )}, module: __miaodaPlugin${index} }`
+  );
+  const contents = [
+    `const __miaodaCapability = require(${JSON.stringify(capabilityEntry)});`,
+    "module.exports = __miaodaCapability;",
+    ...imports,
+    `const __miaodaRegistrations = [${registrations.join(",")}];`,
+    "if (typeof __miaodaCapability.registerStaticActionPlugins !== 'function') throw new Error('MIAODA_STATIC_ACTION_PLUGIN_REGISTRY_UNSUPPORTED');",
+    "__miaodaCapability.registerStaticActionPlugins(__miaodaRegistrations);"
+  ].join("\n");
+  return {
+    name: "miaoda-static-action-plugin-registry",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /^@lark-apaas\/nestjs-capability$/ }, () => ({
+        path: ACTION_PLUGIN_LOADER_PACKAGE,
+        namespace: "miaoda-static-action-plugin-registry"
+      }));
+      esbuild.onLoad(
+        { filter: /.*/, namespace: "miaoda-static-action-plugin-registry" },
+        () => ({ contents, loader: "js", resolveDir: projectRoot })
+      );
+    }
+  };
+}
+function startupEntryPlugin(entryFile, hasActionPlugins) {
+  const contents = hasActionPlugins ? [
+    `require(${JSON.stringify(ACTION_PLUGIN_LOADER_PACKAGE)});`,
+    `require(${JSON.stringify(entryFile)});`
+  ].join("\n") : `require(${JSON.stringify(entryFile)});`;
+  return {
+    name: "miaoda-startup-entry",
+    setup(esbuild) {
+      esbuild.onResolve({ filter: /^miaoda:startup-entry$/ }, () => ({
+        path: "miaoda:startup-entry",
+        namespace: "miaoda-startup-entry"
+      }));
+      esbuild.onLoad(
+        { filter: /.*/, namespace: "miaoda-startup-entry" },
+        () => ({ contents, loader: "js", resolveDir: path25.dirname(entryFile) })
+      );
+    }
+  };
+}
+async function buildStaticStartupPayload(options) {
+  const state = readDependencyState(options.projectRoot);
+  fs29.rmSync(options.outputFile, { force: true });
+  const result = await build({
+    absWorkingDir: options.projectRoot,
+    entryPoints: ["miaoda:startup-entry"],
+    outfile: options.outputFile,
+    bundle: true,
+    platform: "node",
+    format: "cjs",
+    target: `node${process.versions.node.split(".")[0]}`,
+    conditions: ["miaoda-startup"],
+    treeShaking: true,
+    keepNames: true,
+    legalComments: "none",
+    logLevel: "silent",
+    preserveSymlinks: true,
+    sourcemap: false,
+    metafile: true,
+    define: {
+      "import.meta.url": "__miaoda_startup_import_meta_url__"
+    },
+    banner: {
+      js: 'const __miaoda_startup_import_meta_url__ = require("node:url").pathToFileURL(__filename).href;'
+    },
+    plugins: [
+      startupEntryPlugin(options.entryFile, state.plugins.length > 0),
+      staticActionPluginRegistry(options.projectRoot, state.plugins),
+      staticModuleReferencePlugin(),
+      runtimeBoundaryPlugin(options.projectRoot)
+    ]
+  });
+  if (!result.metafile) throw new Error("esbuild metafile missing");
+  const nativeInputs = Object.keys(result.metafile.inputs).filter(
+    (input) => input.endsWith(".node")
+  );
+  if (nativeInputs.length > 0) {
+    throw new Error(
+      `native addons are unsupported: ${nativeInputs.join(", ")}`
+    );
+  }
+  materializeStaticAssets(
+    options.projectRoot,
+    result.metafile,
+    options.payloadRoot,
+    options.limits
+  );
+}
+
+// src/commands/build/server-startup-bundle.handler.ts
+var SCHEMA_VERSION = 7;
+var STARTUP_BUNDLE_ENROLLMENT_SCHEMA_VERSION = 1;
+var STARTUP_BUNDLE_FILE = "payload/server.bundle.cjs";
+var MAX_GENERATION_FILES = 5e4;
+var MAX_GENERATION_BYTES = 256 * 1024 * 1024;
+var MAX_GENERATION_FILE_BYTES = 64 * 1024 * 1024;
+var MAX_FILE_INDEX_BYTES = 16 * 1024 * 1024;
+var MAX_MANIFEST_BYTES = 1024 * 1024;
+var MAX_PACKAGE_MANIFEST_BYTES = 1024 * 1024;
+var MAX_READINESS_RESPONSE_BYTES = 64 * 1024;
+var ROOT_SOURCE_HASH_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".agents",
+  ".claude",
+  ".git",
+  ".miaoda-cache",
+  ".miaoda-runtime",
+  ".turbo",
+  "coverage",
+  "dist",
+  "logs"
+]);
+var probeIdentities = /* @__PURE__ */ new WeakMap();
+function sha256(contents) {
+  return createHash("sha256").update(contents).digest("hex");
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => compareCodeUnits(left, right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function compareCodeUnits(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function isCapabilityReadinessPayload(contents, expectedCapabilityIds = []) {
+  if (contents.length > MAX_READINESS_RESPONSE_BYTES) return false;
+  try {
+    const payload = JSON.parse(contents.toString("utf8"));
+    if (!(payload && typeof payload === "object" && payload.status_code === "0" && payload.data && typeof payload.data === "object" && !Array.isArray(payload.data) && Array.isArray(payload.data.capabilities))) {
+      return false;
+    }
+    const actualIds = new Set(
+      (payload.data.capabilities ?? []).map(
+        (capability) => capability && typeof capability === "object" ? capability.id : void 0
+      ).filter((id) => typeof id === "string" && id.length > 0)
+    );
+    return expectedCapabilityIds.every((id) => actualIds.has(id));
+  } catch {
+    return false;
+  }
+}
+function resolveExpectedCapabilityIds(projectRoot) {
+  const capabilitiesRoot = path26.join(projectRoot, "server", "capabilities");
+  if (!fs30.existsSync(capabilitiesRoot)) return [];
+  const rootStats = fs30.lstatSync(capabilitiesRoot);
+  if (rootStats.isSymbolicLink() || !rootStats.isDirectory()) {
+    throw new Error("workspace capability directory is unsafe");
+  }
+  const realRoot = fs30.realpathSync(capabilitiesRoot);
+  if (!isInside2(projectRoot, realRoot)) {
+    throw new Error("workspace capability directory escaped project root");
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const entry of fs30.readdirSync(realRoot, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+    if (!entry.name.endsWith(".json") || entry.name === "capabilities.json") {
+      continue;
+    }
+    const file = path26.join(realRoot, entry.name);
+    if (entry.isSymbolicLink() || !entry.isFile()) {
+      throw new Error(`workspace capability file is unsafe: ${entry.name}`);
+    }
+    const config = readJsonObject(file, `workspace capability ${entry.name}`);
+    if (typeof config.id !== "string" || config.id.length === 0 || config.id.length > 256) {
+      throw new Error(
+        `workspace capability file has no valid id: ${entry.name}`
+      );
+    }
+    if (ids.has(config.id)) {
+      throw new Error(`workspace capability id is duplicated: ${config.id}`);
+    }
+    ids.add(config.id);
+  }
+  return [...ids].sort();
+}
+function isInside2(root, candidate) {
+  const relative = path26.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path26.isAbsolute(relative);
+}
+function toPosixRelative(root, file) {
+  return path26.relative(root, file).split(path26.sep).join("/");
+}
+function assertNoSymlinkComponents(root, candidate, message) {
+  if (!isInside2(root, candidate)) throw new Error(`${message}: escaped root`);
+  let current = root;
+  for (const segment of path26.relative(root, candidate).split(path26.sep)) {
+    if (!segment) continue;
+    current = path26.join(current, segment);
+    if (fs30.existsSync(current) && fs30.lstatSync(current).isSymbolicLink()) {
+      throw new Error(message);
+    }
+  }
+}
+function walkSourceFiles(root, directory, output) {
+  if (!fs30.existsSync(directory)) return;
+  for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || directory === root && ROOT_SOURCE_HASH_IGNORED_DIRECTORIES.has(entry.name)) {
+      continue;
+    }
+    const candidate = path26.join(directory, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new Error(
+        `source symlink is unsupported: ${toPosixRelative(root, candidate)}`
+      );
+    }
+    if (entry.isDirectory()) walkSourceFiles(root, candidate, output);
+    else if (entry.isFile()) output.push(candidate);
+    else {
+      throw new Error(
+        `source special file is unsupported: ${toPosixRelative(root, candidate)}`
+      );
+    }
+  }
+}
+function workspaceSourceSha256(projectRoot) {
+  const files = [];
+  walkSourceFiles(projectRoot, projectRoot, files);
+  const hash = createHash("sha256");
+  for (const file of files.sort()) {
+    hash.update(toPosixRelative(projectRoot, file));
+    hash.update("\0");
+    updateHashFromFile(hash, file);
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function updateHashFromFile(hash, file) {
+  const descriptor = fs30.openSync(file, "r");
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  try {
+    const before = fs30.fstatSync(descriptor);
+    let position = 0;
+    while (position < before.size) {
+      const bytesRead = fs30.readSync(
+        descriptor,
+        buffer,
+        0,
+        Math.min(buffer.length, before.size - position),
+        position
+      );
+      if (bytesRead === 0) break;
+      hash.update(buffer.subarray(0, bytesRead));
+      position += bytesRead;
+    }
+    const after = fs30.fstatSync(descriptor);
+    if (position !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) {
+      throw new Error(`source changed while hashing: ${file}`);
+    }
+  } finally {
+    fs30.closeSync(descriptor);
+  }
+}
+function runtimeIdentity() {
+  const report = process.report?.getReport();
+  const header = report?.header;
+  return {
+    nodeVersion: process.versions.node,
+    nodeModulesAbi: process.versions.modules,
+    platform: process.platform,
+    arch: process.arch,
+    libc: typeof header?.glibcVersionRuntime === "string" ? `glibc-${header.glibcVersionRuntime}` : process.platform === "linux" ? "linux-unknown-libc" : "not-applicable"
+  };
+}
+function resolveEntry(projectRoot, requested) {
+  const entry = path26.resolve(projectRoot, requested);
+  if (!isInside2(projectRoot, entry))
+    throw new Error("compiled entry escaped project root");
+  if (!fs30.existsSync(entry))
+    throw new Error(`compiled entry is not a file: ${entry}`);
+  if (fs30.lstatSync(entry).isSymbolicLink()) {
+    throw new Error("compiled entry symlink is unsupported");
+  }
+  const realEntry = fs30.realpathSync(entry);
+  if (!isInside2(projectRoot, realEntry))
+    throw new Error("compiled entry escaped project root");
+  if (!fs30.statSync(realEntry).isFile())
+    throw new Error(`compiled entry is not a file: ${entry}`);
+  return realEntry;
+}
+function resolveNestTsconfig(projectRoot) {
+  const nestConfigFile = path26.join(projectRoot, "nest-cli.json");
+  let configured;
+  if (fs30.existsSync(nestConfigFile)) {
+    const nestConfig = JSON.parse(fs30.readFileSync(nestConfigFile, "utf8"));
+    configured = nestConfig.compilerOptions?.tsConfigPath;
+    if (configured !== void 0 && typeof configured !== "string") {
+      throw new Error("nest-cli.json compilerOptions.tsConfigPath is invalid");
+    }
+  }
+  const candidates = typeof configured === "string" ? [configured] : ["tsconfig.build.json", "tsconfig.node.json", "tsconfig.json"];
+  const selected = candidates.map((candidate) => path26.resolve(projectRoot, candidate)).find((candidate) => fs30.existsSync(candidate));
+  if (!selected) {
+    throw new Error(`Nest TypeScript config missing: ${candidates.join(", ")}`);
+  }
+  if (!isInside2(projectRoot, selected))
+    throw new Error("Nest TypeScript config escaped project root");
+  if (fs30.lstatSync(selected).isSymbolicLink())
+    throw new Error("Nest TypeScript config symlink is unsupported");
+  const realConfig = fs30.realpathSync(selected);
+  if (!isInside2(projectRoot, realConfig) || !fs30.statSync(realConfig).isFile()) {
+    throw new Error("Nest TypeScript config escaped project root");
+  }
+  return realConfig;
+}
+function resolveNestCli(projectRoot) {
+  const projectRequire = createRequire4(path26.join(projectRoot, "package.json"));
+  try {
+    return projectRequire.resolve("@nestjs/cli/bin/nest.js");
+  } catch (directError) {
+    try {
+      const packageFile = projectRequire.resolve("@nestjs/cli/package.json");
+      const packageJson = JSON.parse(fs30.readFileSync(packageFile, "utf8"));
+      const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.nest;
+      if (!relativeBin) throw new Error("@nestjs/cli has no nest binary");
+      const cliFile = path26.resolve(path26.dirname(packageFile), relativeBin);
+      if (!fs30.statSync(cliFile).isFile())
+        throw new Error("@nestjs/cli nest binary is not a file");
+      return cliFile;
+    } catch (packageError) {
+      throw new Error(
+        `project @nestjs/cli is unavailable: ${packageError instanceof Error ? packageError.message : String(packageError)}; direct=${directError instanceof Error ? directError.message : String(directError)}`
+      );
+    }
+  }
+}
+function readLinuxProcessIdentity(pid) {
+  if (process.platform !== "linux") return void 0;
+  try {
+    const stat = fs30.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd < 0) return void 0;
+    const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
+    return /^\d+$/.test(fields[19] || "") && /^\d+$/.test(fields[2] || "") ? { processStartTicks: fields[19], processGroupId: Number(fields[2]) } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function registerProbe(child) {
+  if (!child.pid) throw new Error("isolated process pid unavailable");
+  const identity = readLinuxProcessIdentity(child.pid);
+  if (process.platform === "linux" && !identity) {
+    child.kill("SIGKILL");
+    throw new Error("isolated process birth identity unavailable");
+  }
+  probeIdentities.set(child, {
+    pid: child.pid,
+    processStartTicks: identity?.processStartTicks
+  });
+}
+function probeGroupRunning(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return false;
+  if (process.platform === "linux") {
+    const current = readLinuxProcessIdentity(registered.pid);
+    if (current) {
+      if (current.processStartTicks !== registered.processStartTicks || current.processGroupId !== registered.pid) {
+        return false;
+      }
+    } else {
+      try {
+        process.kill(registered.pid, 0);
+        return false;
+      } catch (error) {
+        if (error.code !== "ESRCH") return false;
+      }
+    }
+  }
+  try {
+    process.kill(-registered.pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function waitForProbeGroup(child, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (probeGroupRunning(child) && Date.now() < deadline) {
+    await new Promise((resolve2) => setTimeout(resolve2, 25));
+  }
+  return !probeGroupRunning(child);
+}
+async function stopProbe(child) {
+  const registered = probeIdentities.get(child);
+  if (!registered) return;
+  if (probeGroupRunning(child)) {
+    try {
+      process.kill(-registered.pid, "SIGTERM");
+    } catch {
+    }
+  }
+  if (!await waitForProbeGroup(child, 500)) {
+    if (probeGroupRunning(child)) {
+      try {
+        process.kill(-registered.pid, "SIGKILL");
+      } catch {
+      }
+    }
+    if (!await waitForProbeGroup(child, 500)) {
+      throw new Error(
+        `isolated probe process group did not exit: ${registered.pid}`
+      );
+    }
+  }
+  if (child.exitCode === null && child.signalCode === null) {
+    const exited = await new Promise((resolve2) => {
+      let settled = false;
+      let timer;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        child.off("exit", onExit);
+        child.off("error", onError);
+        resolve2(result);
+      };
+      const onExit = () => finish(true);
+      const onError = () => finish(false);
+      child.once("exit", onExit);
+      child.once("error", onError);
+      timer = setTimeout(() => finish(false), 5e3);
+      if (child.exitCode !== null || child.signalCode !== null) finish(true);
+    });
+    if (!exited) {
+      throw new Error(
+        `isolated probe child did not publish exit after group cleanup: ${registered.pid}`
+      );
+    }
+  }
+}
+function collectChildOutput(child, stream) {
+  let output = "";
+  child[stream]?.setEncoding("utf8");
+  child[stream]?.on("data", (chunk) => {
+    output = `${output}${String(chunk)}`.slice(-64 * 1024);
+  });
+  return () => output;
+}
+async function waitForCommand(child, timeoutMs, description) {
+  let timer;
+  try {
+    return await new Promise((resolve2, reject) => {
+      let settled = false;
+      const finish = (callback) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        callback();
+      };
+      child.once("error", (error) => finish(() => reject(error)));
+      child.once(
+        "exit",
+        (code, signal) => finish(
+          () => signal ? reject(new Error(`${description} exited by ${signal}`)) : resolve2(code ?? 1)
+        )
+      );
+      timer = setTimeout(
+        () => finish(() => reject(new Error(`${description} timeout`))),
+        timeoutMs
+      );
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function compileNestSource(projectRoot, stagingRoot, timeoutMs, sourceConfig) {
+  const cliFile = resolveNestCli(projectRoot);
+  const compileRoot = path26.join(stagingRoot, ".compiled");
+  const outputRoot = path26.join(compileRoot, "output");
+  fs30.mkdirSync(outputRoot, { recursive: true });
+  const isolatedConfig = path26.join(compileRoot, "tsconfig.json");
+  fs30.writeFileSync(
+    isolatedConfig,
+    `${JSON.stringify(
+      {
+        extends: sourceConfig,
+        compilerOptions: {
+          outDir: outputRoot,
+          incremental: false,
+          composite: false,
+          declaration: false,
+          declarationMap: false,
+          sourceMap: false,
+          inlineSourceMap: false
+        }
+      },
+      null,
+      2
+    )}
+`,
+    { mode: 384 }
+  );
+  const child = spawn2(
+    process.execPath,
+    [cliFile, "build", "--path", path26.relative(projectRoot, isolatedConfig)],
+    {
+      cwd: projectRoot,
+      detached: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, NODE_ENV: "production" }
+    }
+  );
+  registerProbe(child);
+  const stdout = collectChildOutput(child, "stdout");
+  const stderr = collectChildOutput(child, "stderr");
+  try {
+    const code = await waitForCommand(
+      child,
+      timeoutMs,
+      "isolated Nest compilation"
+    );
+    if (code !== 0) {
+      throw new Error(
+        `isolated Nest compilation failed with exit ${code}: ${stderr().trim() || stdout().trim()}`
+      );
+    }
+  } finally {
+    await stopProbe(child);
+  }
+  const candidates = [
+    path26.join(outputRoot, "server", "main.js"),
+    path26.join(outputRoot, "main.js")
+  ].filter((candidate) => fs30.existsSync(candidate));
+  if (candidates.length !== 1) {
+    throw new Error(
+      candidates.length === 0 ? "isolated Nest compiled entry missing; checked server/main.js and main.js" : "isolated Nest compiled entry is ambiguous"
+    );
+  }
+  const entry = fs30.realpathSync(candidates[0]);
+  if (!isInside2(fs30.realpathSync(outputRoot), entry) || !fs30.statSync(entry).isFile()) {
+    throw new Error("isolated Nest compiled entry escaped output root");
+  }
+  return { entry, applicationRoot: outputRoot };
+}
+function copyRegularFile(source, target) {
+  const stats = fs30.lstatSync(source);
+  if (stats.isSymbolicLink()) {
+    throw new Error(`runtime tree symlink is unsupported: ${source}`);
+  }
+  if (!stats.isFile()) {
+    throw new Error(`runtime tree special file is unsupported: ${source}`);
+  }
+  fs30.mkdirSync(path26.dirname(target), { recursive: true });
+  fs30.copyFileSync(source, target, fs30.constants.COPYFILE_FICLONE);
+  fs30.chmodSync(target, stats.mode & 73 ? 493 : 420);
+}
+function copyDirectoryContents(sourceRoot, targetRoot) {
+  const visit = (source, target) => {
+    const stats = fs30.lstatSync(source);
+    if (stats.isSymbolicLink()) {
+      throw new Error(`runtime tree symlink is unsupported: ${source}`);
+    }
+    if (stats.isFile()) {
+      copyRegularFile(source, target);
+      return;
+    }
+    if (!stats.isDirectory()) {
+      throw new Error(`runtime tree special file is unsupported: ${source}`);
+    }
+    fs30.mkdirSync(target, { recursive: true, mode: 493 });
+    for (const entry of fs30.readdirSync(source, { withFileTypes: true })) {
+      if (entry.name === "node_modules") {
+        throw new Error("startup payload must not contain node_modules");
+      }
+      visit(path26.join(source, entry.name), path26.join(target, entry.name));
+    }
+  };
+  visit(sourceRoot, targetRoot);
+}
+function reserveGenerationBudget(file, size, budget) {
+  if (size > MAX_GENERATION_FILE_BYTES) {
+    throw new Error(`generation file exceeds 64 MiB: ${file}`);
+  }
+  if (budget.fileCount + 1 > MAX_GENERATION_FILES) {
+    throw new Error(`generation exceeds ${MAX_GENERATION_FILES} files`);
+  }
+  if (budget.totalBytes + size > MAX_GENERATION_BYTES) {
+    throw new Error("generation exceeds 256 MiB");
+  }
+  budget.fileCount += 1;
+  budget.totalBytes += size;
+}
+function copyProbeWorkspace(projectRoot, probeProjectRoot) {
+  const files = [];
+  walkSourceFiles(projectRoot, projectRoot, files);
+  const budget = { fileCount: 0, totalBytes: 0 };
+  for (const file of files) {
+    reserveGenerationBudget(file, fs30.lstatSync(file).size, budget);
+    copyRegularFile(
+      file,
+      path26.join(
+        probeProjectRoot,
+        ...toPosixRelative(projectRoot, file).split("/")
+      )
+    );
+  }
+}
+function readJsonObject(file, description) {
+  const parsed = JSON.parse(
+    readBoundedFile(file, MAX_PACKAGE_MANIFEST_BYTES, description).toString(
+      "utf8"
+    )
+  );
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${description} must be a JSON object`);
+  }
+  return parsed;
+}
+function readBoundedFile(file, maxBytes, description) {
+  const stats = fs30.lstatSync(file);
+  if (stats.isSymbolicLink() || !stats.isFile() || stats.size > maxBytes) {
+    throw new Error(`${description} exceeds the supported metadata size`);
+  }
+  const contents = fs30.readFileSync(file);
+  if (contents.length !== stats.size) {
+    throw new Error(`${description} changed while reading`);
+  }
+  return contents;
+}
+function assertStartupBundleEnrollment(projectRoot) {
+  const packageFile = path26.join(projectRoot, "package.json");
+  if (!fs30.existsSync(packageFile) || fs30.lstatSync(packageFile).isSymbolicLink()) {
+    throw new Error("package.json is unavailable");
+  }
+  const packageJson = readJsonObject(packageFile, "package.json");
+  const enrollment = packageJson.miaodaStartupBundle;
+  if (!enrollment || typeof enrollment !== "object" || Array.isArray(enrollment) || enrollment.schemaVersion !== STARTUP_BUNDLE_ENROLLMENT_SCHEMA_VERSION) {
+    throw new Error(
+      `package.json miaodaStartupBundle.schemaVersion must be ${STARTUP_BUNDLE_ENROLLMENT_SCHEMA_VERSION}`
+    );
+  }
+}
+function indexPayload(payloadRoot) {
+  const files = [];
+  const budget = { fileCount: 0, totalBytes: 0 };
+  const visit = (directory) => {
+    for (const entry of fs30.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path26.join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`generation symlink is unsupported: ${candidate}`);
+      }
+      if (entry.isDirectory()) {
+        visit(candidate);
+        continue;
+      }
+      if (!entry.isFile()) {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
+      }
+      const stats = fs30.lstatSync(candidate);
+      if (!stats.isFile()) {
+        throw new Error(`generation special file is unsupported: ${candidate}`);
+      }
+      reserveGenerationBudget(candidate, stats.size, budget);
+      const contents = fs30.readFileSync(candidate);
+      if (contents.length !== stats.size) {
+        throw new Error(
+          `generation file changed while indexing: ${toPosixRelative(payloadRoot, candidate)}`
+        );
+      }
+      files.push({
+        path: `payload/${toPosixRelative(payloadRoot, candidate)}`,
+        sha256: sha256(contents),
+        size: contents.length,
+        mode: stats.mode & 511
+      });
+    }
+  };
+  visit(payloadRoot);
+  files.sort((left, right) => compareCodeUnits(left.path, right.path));
+  return files;
+}
+function reservePort() {
+  return new Promise((resolve2, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(
+          () => reject(new Error("isolated probe failed to reserve a port"))
+        );
+        return;
+      }
+      server.close((error) => error ? reject(error) : resolve2(address.port));
+    });
+  });
+}
+async function isolatedProbe(projectRoot, payloadRoot, entry, timeoutMs, expectedCapabilityIds) {
+  const probeRoot = fs30.mkdtempSync(
+    path26.join(os3.tmpdir(), "miaoda-server-generation-probe-")
+  );
+  const probeWorkspaceRoot = path26.join(probeRoot, "workspace");
+  const probeProjectRoot = path26.join(probeWorkspaceRoot, "code");
+  copyProbeWorkspace(projectRoot, probeProjectRoot);
+  const probeGenerationRoot = path26.join(
+    probeProjectRoot,
+    ".miaoda-cache",
+    "server",
+    "generations",
+    "probe"
+  );
+  const probePayload = path26.join(probeGenerationRoot, "payload");
+  copyDirectoryContents(payloadRoot, probePayload);
+  const probeEntry = path26.join(probeGenerationRoot, ...entry.split("/"));
+  const probeResolutionGuard = path26.join(
+    probeRoot,
+    "probe-module-resolution-guard.cjs"
+  );
+  const probeEsmResolutionLoader = path26.join(
+    probeRoot,
+    "probe-module-resolution-loader.mjs"
+  );
+  const allowedPayloadRoot = fs30.realpathSync(probePayload);
+  fs30.writeFileSync(
+    probeResolutionGuard,
+    `'use strict';
+const fs = require('node:fs');
+const Module = require('node:module');
+const path = require('node:path');
+const allowedRoot = ${JSON.stringify(allowedPayloadRoot)};
+const builtins = new Set(Module.builtinModules.flatMap(name => [name, 'node:' + name]));
+const originalResolveFilename = Module._resolveFilename;
+Module._resolveFilename = function miaodaProbeResolve(request, parent, isMain, options) {
+  const resolved = originalResolveFilename.call(this, request, parent, isMain, options);
+  if (builtins.has(request)) return resolved;
+  if (typeof resolved !== 'string' || !path.isAbsolute(resolved)) {
+    const error = new Error('MIAODA_ISOLATED_PROBE_MODULE_REJECTED:' + request + ':' + resolved);
+    error.code = 'MODULE_NOT_FOUND';
+    throw error;
+  }
+  const realResolved = fs.realpathSync(resolved);
+  const relative = path.relative(allowedRoot, realResolved);
+  if (relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))) {
+    return resolved;
+  }
+  const error = new Error('MIAODA_ISOLATED_PROBE_MODULE_REJECTED:' + request + ':' + realResolved);
+  error.code = 'MODULE_NOT_FOUND';
+  throw error;
+};
+`,
+    { mode: 384 }
+  );
+  fs30.writeFileSync(
+    probeEsmResolutionLoader,
+    `import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const allowedRoot = ${JSON.stringify(allowedPayloadRoot)};
+
+export async function resolve(specifier, context, nextResolve) {
+  const resolved = await nextResolve(specifier, context);
+  if (resolved.url.startsWith('node:')) return resolved;
+  if (!resolved.url.startsWith('file:')) {
+    throw new Error('MIAODA_ISOLATED_PROBE_ESM_REJECTED:' + specifier + ':' + resolved.url);
+  }
+  const realResolved = fs.realpathSync(fileURLToPath(resolved.url));
+  const relative = path.relative(allowedRoot, realResolved);
+  if (relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))) {
+    return resolved;
+  }
+  const error = new Error('MIAODA_ISOLATED_PROBE_ESM_REJECTED:' + specifier + ':' + resolved.url);
+  error.code = 'ERR_MODULE_NOT_FOUND';
+  throw error;
+}
+`,
+    { mode: 384 }
+  );
+  const port = await reservePort();
+  const configuredBasePath = process.env.CLIENT_BASE_PATH;
+  const basePath = configuredBasePath?.startsWith("/") && !configuredBasePath.startsWith("//") ? configuredBasePath.replace(/\/+$/, "") : "";
+  const readinessPath = `${basePath}/__innerapi__/capability/list`;
+  const probeNodeOptions = [
+    `--require=${JSON.stringify(probeResolutionGuard)}`,
+    `--experimental-loader=${JSON.stringify(probeEsmResolutionLoader)}`
+  ].join(" ");
+  const child = spawn2(process.execPath, [probeEntry], {
+    cwd: probeProjectRoot,
+    detached: true,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...process.env,
+      NODE_PATH: "",
+      NODE_OPTIONS: probeNodeOptions,
+      PWD: probeProjectRoot,
+      WORKSPACE_DIR: probeWorkspaceRoot,
+      MIAODA_WORKSPACE_ROOT: probeProjectRoot,
+      NODE_ENV: "development",
+      SERVER_HOST: "127.0.0.1",
+      SERVER_PORT: String(port),
+      DEPRECATED_SKIP_INIT_DB_CONNECTION: process.env.DEPRECATED_SKIP_INIT_DB_CONNECTION ?? "true",
+      FORCE_AUTHN_INNERAPI_DOMAIN: process.env.FORCE_AUTHN_INNERAPI_DOMAIN ?? "http://127.0.0.1",
+      FORCE_AUTHN_ACCESS_KEY: process.env.FORCE_AUTHN_ACCESS_KEY ?? "server-startup-probe",
+      FORCE_AUTHN_ACCESS_SECRET: process.env.FORCE_AUTHN_ACCESS_SECRET ?? "server-startup-probe"
+    }
+  });
+  registerProbe(child);
+  const stdout = collectChildOutput(child, "stdout");
+  const stderr = collectChildOutput(child, "stderr");
+  try {
+    await new Promise((resolve2, reject) => {
+      const deadline = Date.now() + timeoutMs;
+      let settled = false;
+      let retryTimer;
+      const detail = () => `${stderr()}
+${stdout()}`.trim();
+      const finish = (error) => {
+        if (settled) return;
+        settled = true;
+        if (retryTimer) clearTimeout(retryTimer);
+        if (error) reject(error);
+        else resolve2();
+      };
+      const retry = () => {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+          finish(
+            new Error(
+              `isolated generation readiness timeout${detail() ? `: ${detail()}` : ""}`
+            )
+          );
+          return;
+        }
+        retryTimer = setTimeout(attempt, Math.min(25, remaining));
+      };
+      const attempt = () => {
+        if (settled) return;
+        if (child.exitCode !== null || child.signalCode !== null) {
+          finish(
+            new Error(
+              `isolated generation exited before readiness${detail() ? `: ${detail()}` : ""}`
+            )
+          );
+          return;
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) return retry();
+        let requestSettled = false;
+        const request = http.get(
+          { host: "127.0.0.1", port, path: readinessPath },
+          (response) => {
+            if (requestSettled || settled) {
+              response.destroy();
+              return;
+            }
+            if (response.statusCode !== 200) {
+              requestSettled = true;
+              response.resume();
+              retry();
+              return;
+            }
+            const chunks = [];
+            let responseBytes = 0;
+            response.on("data", (chunk) => {
+              if (requestSettled || settled) return;
+              const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+              responseBytes += buffer.length;
+              if (responseBytes > MAX_READINESS_RESPONSE_BYTES) {
+                requestSettled = true;
+                response.destroy();
+                retry();
+                return;
+              }
+              chunks.push(buffer);
+            });
+            response.once("end", () => {
+              if (requestSettled || settled) return;
+              requestSettled = true;
+              if (isCapabilityReadinessPayload(
+                Buffer.concat(chunks),
+                expectedCapabilityIds
+              ))
+                finish();
+              else retry();
+            });
+            response.once("error", () => {
+              if (requestSettled || settled) return;
+              requestSettled = true;
+              retry();
+            });
+          }
+        );
+        request.setTimeout(
+          remaining,
+          () => request.destroy(new Error("isolated generation readiness timeout"))
+        );
+        request.once("error", () => {
+          if (requestSettled || settled) return;
+          requestSettled = true;
+          retry();
+        });
+      };
+      attempt();
+    });
+  } finally {
+    await stopProbe(child);
+    fs30.rmSync(probeRoot, { recursive: true, force: true });
+  }
+}
+function writeBoundedJson(file, value, maxBytes, description) {
+  const contents = `${JSON.stringify(value, null, 2)}
+`;
+  if (Buffer.byteLength(contents) > maxBytes) {
+    throw new Error(`${description} exceeds ${maxBytes} bytes`);
+  }
+  fs30.writeFileSync(file, contents, {
+    mode: 384
+  });
+}
+function removeLegacyPointer(cacheRoot) {
+  fs30.rmSync(path26.join(cacheRoot, "current.json"), { force: true });
+}
+function removeLegacyDependencyArtifacts(cacheRoot) {
+  for (const name of ["node_modules", "dependencies.json"]) {
+    const target = path26.join(cacheRoot, name);
+    if (!fs30.existsSync(target)) continue;
+    const stats = fs30.lstatSync(target);
+    if (stats.isDirectory() && !stats.isSymbolicLink()) {
+      fs30.rmSync(target, { recursive: true, force: true });
+    } else {
+      fs30.rmSync(target, { force: true });
+    }
+  }
+}
+function removeStaleBuildArtifacts(cacheRoot) {
+  for (const entry of fs30.readdirSync(cacheRoot)) {
+    if (!/^\.(?:staging|retired)-[a-z0-9-]+$/.test(entry)) continue;
+    const target = path26.join(cacheRoot, entry);
+    const stats = fs30.lstatSync(target);
+    if (stats.isDirectory() && !stats.isSymbolicLink()) {
+      fs30.rmSync(target, { recursive: true, force: true });
+    } else {
+      fs30.rmSync(target, { force: true });
+    }
+  }
+}
+async function buildServerStartupBundle(options) {
+  const startedAt = Date.now();
+  let stagingRoot;
+  let cacheRoot;
+  try {
+    const projectRoot = fs30.realpathSync(path26.resolve(options.projectRoot));
+    assertStartupBundleEnrollment(projectRoot);
+    cacheRoot = path26.resolve(
+      projectRoot,
+      options.cacheRoot ?? ".miaoda-cache/server"
+    );
+    if (!isInside2(projectRoot, cacheRoot))
+      throw new Error("cache root escaped project root");
+    assertNoSymlinkComponents(
+      projectRoot,
+      cacheRoot,
+      "cache path symlink is unsupported"
+    );
+    fs30.mkdirSync(cacheRoot, { recursive: true, mode: 448 });
+    removeLegacyPointer(cacheRoot);
+    removeLegacyDependencyArtifacts(cacheRoot);
+    removeStaleBuildArtifacts(cacheRoot);
+    const timeoutMs = options.probeTimeoutMs ?? 1e4;
+    const compileTimeoutMs = options.compileTimeoutMs ?? 12e4;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+      throw new Error("probe timeout must be positive");
+    if (!Number.isFinite(compileTimeoutMs) || compileTimeoutMs <= 0)
+      throw new Error("compile timeout must be positive");
+    const expectedCapabilityIds = resolveExpectedCapabilityIds(projectRoot);
+    const sourceSha256 = workspaceSourceSha256(projectRoot);
+    stagingRoot = path26.join(cacheRoot, `.staging-${randomUUID()}`);
+    fs30.mkdirSync(stagingRoot, { recursive: false, mode: 448 });
+    const explicitEntry = options.entry ? resolveEntry(projectRoot, options.entry) : void 0;
+    const distRoot = path26.join(projectRoot, "dist");
+    const compiled = explicitEntry ? {
+      entry: explicitEntry,
+      applicationRoot: isInside2(distRoot, explicitEntry) ? distRoot : path26.dirname(explicitEntry)
+    } : await compileNestSource(
+      projectRoot,
+      stagingRoot,
+      compileTimeoutMs,
+      resolveNestTsconfig(projectRoot)
+    );
+    if (workspaceSourceSha256(projectRoot) !== sourceSha256) {
+      throw new Error("source changed during isolated Nest compilation");
+    }
+    const payloadRoot = path26.join(stagingRoot, "payload");
+    fs30.mkdirSync(payloadRoot, { recursive: true, mode: 493 });
+    const entry = STARTUP_BUNDLE_FILE;
+    const bundleFile = path26.join(
+      stagingRoot,
+      ...STARTUP_BUNDLE_FILE.split("/")
+    );
+    await buildStaticStartupPayload({
+      projectRoot,
+      entryFile: compiled.entry,
+      outputFile: bundleFile,
+      payloadRoot,
+      limits: {
+        maxFileBytes: MAX_GENERATION_FILE_BYTES,
+        maxFiles: MAX_GENERATION_FILES,
+        maxTotalBytes: MAX_GENERATION_BYTES
+      }
+    });
+    const files = indexPayload(payloadRoot);
+    const fileIndexContents = `${JSON.stringify(files, null, 2)}
+`;
+    if (Buffer.byteLength(fileIndexContents) > MAX_FILE_INDEX_BYTES) {
+      throw new Error("generation file index exceeds 16 MiB");
+    }
+    fs30.writeFileSync(
+      path26.join(stagingRoot, "files.mtree.json"),
+      fileIndexContents,
+      { mode: 384 }
+    );
+    const runtime = runtimeIdentity();
+    const fileIndexSha256 = sha256(fileIndexContents);
+    const identity = {
+      schemaVersion: SCHEMA_VERSION,
+      sourceSha256,
+      expectedCapabilityIds,
+      runtime,
+      fileIndexSha256
+    };
+    const generationId = sha256(stableJson(identity));
+    await isolatedProbe(
+      projectRoot,
+      payloadRoot,
+      entry,
+      timeoutMs,
+      expectedCapabilityIds
+    );
+    if (workspaceSourceSha256(projectRoot) !== sourceSha256) {
+      throw new Error("source changed while building startup generation");
+    }
+    const manifest = {
+      generationId,
+      ...identity
+    };
+    writeBoundedJson(
+      path26.join(stagingRoot, "manifest.json"),
+      manifest,
+      MAX_MANIFEST_BYTES,
+      "startup generation manifest"
+    );
+    fs30.rmSync(path26.join(stagingRoot, ".compiled"), {
+      recursive: true,
+      force: true
+    });
+    const generationsRoot = path26.join(cacheRoot, "generations");
+    fs30.mkdirSync(generationsRoot, { recursive: true, mode: 448 });
+    const generationRoot = path26.join(generationsRoot, generationId);
+    const previousGenerations = fs30.readdirSync(generationsRoot);
+    if (previousGenerations.length > 1) {
+      throw new Error("startup generation directory is ambiguous");
+    }
+    const previous = previousGenerations[0];
+    const previousRoot = previous ? path26.join(generationsRoot, previous) : void 0;
+    const retiredRoot = previousRoot ? path26.join(cacheRoot, `.retired-${randomUUID()}`) : void 0;
+    if (previousRoot && retiredRoot) {
+      fs30.renameSync(previousRoot, retiredRoot);
+    }
+    try {
+      fs30.renameSync(stagingRoot, generationRoot);
+    } catch (publishError) {
+      if (previousRoot && retiredRoot && fs30.existsSync(retiredRoot)) {
+        fs30.renameSync(retiredRoot, previousRoot);
+      }
+      throw publishError;
+    }
+    if (previousRoot && retiredRoot) {
+      try {
+        fs30.rmSync(retiredRoot, { recursive: true, force: true });
+      } catch (pruneError) {
+        fs30.rmSync(generationRoot, { recursive: true, force: true });
+        fs30.renameSync(retiredRoot, previousRoot);
+        throw pruneError;
+      }
+    }
+    stagingRoot = void 0;
+    return {
+      built: true,
+      generationId,
+      generationRoot,
+      entryFile: path26.join(generationRoot, ...entry.split("/")),
+      manifestFile: path26.join(generationRoot, "manifest.json"),
+      reasons: [],
+      elapsedMs: Date.now() - startedAt
+    };
+  } catch (error) {
+    if (stagingRoot) fs30.rmSync(stagingRoot, { recursive: true, force: true });
+    if (cacheRoot) removeLegacyPointer(cacheRoot);
+    return {
+      built: false,
+      reasons: [error instanceof Error ? error.message : String(error)],
+      elapsedMs: Date.now() - startedAt
+    };
+  }
+}
+
+// src/commands/build/index.ts
+var getTokenCommand = {
+  name: "get-token",
+  description: "Get artifact upload credential (STI token)",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").requiredOption("--scene <scene>", "Build scene (pipeline, static)").option("--commit-id <id>", "Git commit ID (required for pipeline scene)").action(
+      async (options) => {
+        await getToken(options);
+      }
+    );
+  }
+};
+var uploadStaticCommand = {
+  name: "upload-static",
+  description: "Upload shared/static files to TOS",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").option(
+      "--static-dir <dir>",
+      "Static files directory",
+      UPLOAD_STATIC_DEFAULTS.staticDir
+    ).option(
+      "--tosutil-path <path>",
+      "Path to tosutil binary",
+      UPLOAD_STATIC_DEFAULTS.tosutilPath
+    ).option(
+      "--endpoint <endpoint>",
+      "TOS endpoint",
+      UPLOAD_STATIC_DEFAULTS.endpoint
+    ).option("--region <region>", "TOS region", UPLOAD_STATIC_DEFAULTS.region).action(async (options) => {
+      await uploadStatic(options);
+    });
+  }
+};
+var preUploadStaticCommand = {
+  name: "pre-upload-static",
+  description: "Get TOS upload info and output as env vars for build.sh eval",
+  register(program) {
+    program.command(this.name).description(this.description).requiredOption("--app-id <id>", "Application ID").action(async (options) => {
+      await preUploadStatic(options);
+    });
+  }
+};
+var serverStartupBundleCommand = {
+  name: "server-startup-bundle",
+  description: "Build and isolate-probe a recycle-only NestJS startup generation",
+  register(program) {
+    program.command(this.name).description(this.description).option("--project-root <dir>", "Application project root", process.cwd()).option(
+      "--probe-timeout-ms <ms>",
+      "Isolated availability probe timeout in milliseconds",
+      "10000"
+    ).action(
+      async (options) => {
+        const probeTimeoutMs = Number(options.probeTimeoutMs);
+        if (!Number.isFinite(probeTimeoutMs) || probeTimeoutMs <= 0) {
+          throw new Error("--probe-timeout-ms must be a positive number");
+        }
+        const result = await buildServerStartupBundle({
+          projectRoot: options.projectRoot,
+          probeTimeoutMs
+        });
+        console.log(JSON.stringify(result));
+        if (!result.built) process.exitCode = 2;
+      }
+    );
   }
 };
 var buildCommandGroup = {
   name: "build",
   description: "Build related commands",
-  commands: [getTokenCommand, uploadStaticCommand, preUploadStaticCommand]
+  commands: [
+    getTokenCommand,
+    uploadStaticCommand,
+    preUploadStaticCommand,
+    serverStartupBundleCommand
+  ]
 };
 
 // src/commands/index.ts
@@ -8309,13 +10885,13 @@ var commands = [
 
 // src/index.ts
 for (const filename of [".env.local", ".env"]) {
-  const envPath = path25.join(process.cwd(), filename);
-  if (fs29.existsSync(envPath)) {
+  const envPath = path27.join(process.cwd(), filename);
+  if (fs31.existsSync(envPath)) {
     dotenvConfig({ path: envPath });
   }
 }
-var __dirname = path25.dirname(fileURLToPath5(import.meta.url));
-var pkg = JSON.parse(fs29.readFileSync(path25.join(__dirname, "../package.json"), "utf-8"));
+var __dirname = path27.dirname(fileURLToPath6(import.meta.url));
+var pkg = JSON.parse(fs31.readFileSync(path27.join(__dirname, "../package.json"), "utf-8"));
 var cli = new FullstackCLI(pkg.version);
 cli.useAll(commands);
 cli.run();