@lark-apaas/fullstack-cli 1.1.68-alpha.20260930060426 → 1.1.68-alpha.20261002212123

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
-import fs31 from "fs";
-import path26 from "path";
+import fs32 from "fs";
+import path27 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { config as dotenvConfig } from "dotenv";
 
@@ -5201,7 +5201,7 @@ var PROMPT_PATTERNS = [
   { pattern: /proceed\?/i, answer: "y\n" }
 ];
 async function executeShadcnAdd(registryItemPath) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let output = "";
     const args = ["--yes", "shadcn@3.8.2", "add", registryItemPath];
     const ptyProcess = pty.spawn("npx", args, {
@@ -5227,7 +5227,7 @@ async function executeShadcnAdd(registryItemPath) {
     });
     const timeoutId = setTimeout(() => {
       ptyProcess.kill();
-      resolve2({
+      resolve3({
         success: false,
         files: [],
         error: "\u6267\u884C\u8D85\u65F6"
@@ -5238,7 +5238,7 @@ async function executeShadcnAdd(registryItemPath) {
       const success = exitCode === 0;
       const filePaths = parseOutput(output);
       const files = filePaths.map(toFileInfo);
-      resolve2({
+      resolve3({
         success,
         files,
         error: success ? void 0 : output || `Process exited with code ${exitCode}`
@@ -5249,12 +5249,12 @@ async function executeShadcnAdd(registryItemPath) {
 
 // src/commands/component/add.handler.ts
 function runActionPluginInit() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     execFile("fullstack-cli", ["action-plugin", "init"], { cwd: process.cwd(), stdio: "ignore" }, (error) => {
       if (error) {
         debug("action-plugin init \u5931\u8D25: %s", error.message);
       }
-      resolve2();
+      resolve3();
     });
   });
 }
@@ -8429,6 +8429,875 @@ var buildCommandGroup = {
   commands: [getTokenCommand, uploadStaticCommand, preUploadStaticCommand]
 };
 
+// src/output-lease.ts
+import * as crypto from "crypto";
+import * as fs31 from "fs";
+import * as os3 from "os";
+import * as path26 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+var OUTPUT_LEASE_PROTOCOL_VERSION = 1;
+var OUTPUT_LEASE_ENV = "MIAODA_PREVIEW_OUTPUT_LEASE_V1";
+var OUTPUT_LEASE_CONFLICT = "MIAODA_PREVIEW_OUTPUT_CONFLICT";
+var OUTPUT_LEASE_STATE_UNKNOWN = "MIAODA_PREVIEW_STATE_UNKNOWN";
+var DEFAULT_HEARTBEAT_INTERVAL_MS = 2e3;
+var DEFAULT_STALE_AFTER_MS = 15e3;
+var TRANSITION_RETRY_COUNT = 200;
+var TRANSITION_RETRY_MS = 5;
+var OWNER_FILE = "owner.json";
+var TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+var KEY_PATTERN = /^[a-f0-9]{64}$/;
+var TEMP_OWNER_PATTERN = /^\.owner-[0-9]+-[a-f0-9]{16}\.tmp$/;
+var OutputLeaseProtocolError = class extends Error {
+  constructor(code, detail) {
+    super(`${code}: ${detail}`);
+    this.name = "OutputLeaseProtocolError";
+    this.code = code;
+  }
+};
+function unknown(detail, cause) {
+  const suffix = cause instanceof Error && cause.message ? ` (${cause.message})` : "";
+  return new OutputLeaseProtocolError(
+    OUTPUT_LEASE_STATE_UNKNOWN,
+    `${detail}${suffix}`
+  );
+}
+function conflict(target, owner) {
+  return new OutputLeaseProtocolError(
+    OUTPUT_LEASE_CONFLICT,
+    `${target.canonicalOutDir} is held by an active ${owner.kind} owner`
+  );
+}
+function errnoCode(error) {
+  return error instanceof Error && "code" in error ? error.code : void 0;
+}
+function isMissing(error) {
+  const code = errnoCode(error);
+  return code === "ENOENT" || code === "ESRCH";
+}
+function sleepSync(milliseconds) {
+  const signal = new Int32Array(new SharedArrayBuffer(4));
+  Atomics.wait(signal, 0, 0, milliseconds);
+}
+function canonicalizeWithoutCreating(input) {
+  let cursor = path26.resolve(input);
+  const missing = [];
+  for (; ; ) {
+    try {
+      fs31.lstatSync(cursor);
+    } catch (error) {
+      if (!isMissing(error))
+        throw unknown(`cannot inspect path ${cursor}`, error);
+      const parent = path26.dirname(cursor);
+      if (parent === cursor) {
+        throw unknown(`cannot find an existing ancestor for ${input}`);
+      }
+      missing.unshift(path26.basename(cursor));
+      cursor = parent;
+      continue;
+    }
+    try {
+      return path26.resolve(fs31.realpathSync.native(cursor), ...missing);
+    } catch (error) {
+      throw unknown(`cannot canonicalize existing ancestor ${cursor}`, error);
+    }
+  }
+}
+function currentUserComponent() {
+  if (typeof process.getuid === "function") return `uid-${process.getuid()}`;
+  return `user-${crypto.createHash("sha256").update(os3.userInfo().username).digest("hex").slice(0, 16)}`;
+}
+function defaultLockRootForCurrentUser(temporaryRoot = os3.tmpdir()) {
+  return path26.join(
+    temporaryRoot,
+    `miaoda-preview-output-leases-v${OUTPUT_LEASE_PROTOCOL_VERSION}-${currentUserComponent()}`
+  );
+}
+function validatePrivateDirectory(directory, label, expected) {
+  let link;
+  let stat;
+  try {
+    link = fs31.lstatSync(directory);
+    if (link.isSymbolicLink() || !link.isDirectory()) {
+      throw new Error("not a direct directory");
+    }
+    stat = fs31.statSync(directory);
+  } catch (error) {
+    throw unknown(`untrusted ${label} ${directory}`, error);
+  }
+  if (!stat.isDirectory() || stat.dev !== link.dev || stat.ino !== link.ino) {
+    throw unknown(`untrusted ${label} identity ${directory}`);
+  }
+  if (expected && (stat.dev !== expected.device || stat.ino !== expected.inode)) {
+    throw unknown(`${label} changed identity ${directory}`);
+  }
+  if (process.platform !== "win32") {
+    if (typeof process.getuid !== "function" || stat.uid !== process.getuid()) {
+      throw unknown(`unexpected owner for ${label} ${directory}`);
+    }
+    if ((stat.mode & 63) !== 0) {
+      throw unknown(`insecure permissions for ${label} ${directory}`);
+    }
+  }
+  return { device: stat.dev, inode: stat.ino };
+}
+function prepareTrustedLockRoot(lockRoot) {
+  try {
+    fs31.mkdirSync(lockRoot, { mode: 448 });
+  } catch (error) {
+    if (errnoCode(error) !== "EEXIST") {
+      throw unknown(`cannot prepare lease storage ${lockRoot}`, error);
+    }
+  }
+  return validatePrivateDirectory(lockRoot, "lease root");
+}
+function assertTrustedRoot(target) {
+  validatePrivateDirectory(target.lockRoot, "lease root", {
+    device: target.lockRootDevice,
+    inode: target.lockRootInode
+  });
+}
+function resolveOutputLeaseTarget(rootDir, outDir, lockRoot = defaultLockRootForCurrentUser()) {
+  const canonicalRoot = canonicalizeWithoutCreating(rootDir);
+  const absoluteOutDir = path26.isAbsolute(outDir) ? outDir : path26.resolve(canonicalRoot, outDir);
+  const canonicalOutDir = canonicalizeWithoutCreating(absoluteOutDir);
+  const key = crypto.createHash("sha256").update(`miaoda-preview-output-lease:v${OUTPUT_LEASE_PROTOCOL_VERSION}\0`).update(canonicalOutDir).digest("hex");
+  const canonicalLockRoot = path26.resolve(lockRoot);
+  const identity = prepareTrustedLockRoot(canonicalLockRoot);
+  const lockDir = path26.join(canonicalLockRoot, `${key}.lease`);
+  return {
+    key,
+    canonicalRoot,
+    canonicalOutDir,
+    lockRoot: canonicalLockRoot,
+    lockRootDevice: identity.device,
+    lockRootInode: identity.inode,
+    lockDir,
+    ownerFile: path26.join(lockDir, OWNER_FILE),
+    transitionDir: path26.join(canonicalLockRoot, `${key}.transition`)
+  };
+}
+function acquireTransitionGuard(target) {
+  for (let attempt = 0; attempt < TRANSITION_RETRY_COUNT; attempt += 1) {
+    assertTrustedRoot(target);
+    try {
+      fs31.mkdirSync(target.transitionDir, { mode: 448 });
+      const identity = validatePrivateDirectory(
+        target.transitionDir,
+        "transition guard"
+      );
+      assertTrustedRoot(target);
+      return {
+        path: target.transitionDir,
+        device: identity.device,
+        inode: identity.inode,
+        poisoned: false
+      };
+    } catch (error) {
+      if (errnoCode(error) !== "EEXIST") {
+        if (error instanceof OutputLeaseProtocolError) throw error;
+        throw unknown(
+          `cannot acquire transition guard for ${target.key}`,
+          error
+        );
+      }
+      try {
+        validatePrivateDirectory(target.transitionDir, "transition guard");
+      } catch (validationError) {
+        if (!fs31.existsSync(target.transitionDir)) continue;
+        throw validationError;
+      }
+      sleepSync(TRANSITION_RETRY_MS);
+    }
+  }
+  throw unknown(
+    `transition guard is unavailable for ${target.canonicalOutDir}`
+  );
+}
+function assertTransitionGuard(target, guard) {
+  assertTrustedRoot(target);
+  validatePrivateDirectory(guard.path, "transition guard", guard);
+}
+function releaseTransitionGuard(target, guard) {
+  assertTransitionGuard(target, guard);
+  try {
+    fs31.rmdirSync(guard.path);
+  } catch (error) {
+    throw unknown(`cannot release transition guard for ${target.key}`, error);
+  }
+}
+function withTransitionGuard(target, operation) {
+  const guard = acquireTransitionGuard(target);
+  let result;
+  let failure;
+  try {
+    result = operation(guard);
+  } catch (error) {
+    failure = error;
+  }
+  if (!guard.poisoned) {
+    try {
+      releaseTransitionGuard(target, guard);
+    } catch (error) {
+      failure = error;
+    }
+  }
+  if (failure !== void 0) throw failure;
+  return result;
+}
+function parseLinuxStat(contents) {
+  const end = contents.lastIndexOf(")");
+  if (end < 0) throw new Error("missing process command terminator");
+  const fields = contents.slice(end + 2).trim().split(/\s+/);
+  if (fields.length < 20) throw new Error("incomplete process stat");
+  const parentPid = Number(fields[1]);
+  const startTime = fields[19];
+  if (!Number.isSafeInteger(parentPid) || parentPid < 0 || !/^\d+$/.test(startTime)) {
+    throw new Error("invalid process stat");
+  }
+  return { parentPid, startIdentity: `linux-proc-start:${startTime}` };
+}
+function inspectProcess(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return { state: "unknown" };
+  if (process.platform === "linux") {
+    try {
+      return {
+        state: "alive",
+        startIdentity: parseLinuxStat(
+          fs31.readFileSync(`/proc/${pid}/stat`, "utf8")
+        ).startIdentity
+      };
+    } catch (error) {
+      return isMissing(error) ? { state: "dead" } : { state: "unknown" };
+    }
+  }
+  if (process.platform !== "win32") {
+    try {
+      const value = execFileSync2("ps", ["-o", "lstart=", "-p", String(pid)], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim();
+      return value ? { state: "alive", startIdentity: `posix-ps-start:${value}` } : { state: "dead" };
+    } catch {
+      try {
+        process.kill(pid, 0);
+        return { state: "unknown" };
+      } catch (error) {
+        return isMissing(error) ? { state: "dead" } : { state: "unknown" };
+      }
+    }
+  }
+  return { state: "unknown" };
+}
+function readParentPid(pid) {
+  if (process.platform === "linux") {
+    try {
+      return parseLinuxStat(fs31.readFileSync(`/proc/${pid}/stat`, "utf8")).parentPid;
+    } catch {
+      return null;
+    }
+  }
+  if (process.platform !== "win32") {
+    try {
+      const parent = Number(
+        execFileSync2("ps", ["-o", "ppid=", "-p", String(pid)], {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"]
+        }).trim()
+      );
+      return Number.isSafeInteger(parent) && parent >= 0 ? parent : null;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function isProcessOrDescendant(pid, ancestorPid) {
+  let cursor = pid;
+  const seen = /* @__PURE__ */ new Set();
+  for (let depth = 0; depth < 256; depth += 1) {
+    if (cursor === ancestorPid) return true;
+    if (cursor <= 1 || seen.has(cursor)) return false;
+    seen.add(cursor);
+    const parent = readParentPid(cursor);
+    if (parent === null) return false;
+    cursor = parent;
+  }
+  return false;
+}
+function validateOwner(value, target) {
+  if (!value || typeof value !== "object") {
+    throw unknown(`malformed owner for ${target.canonicalOutDir}`);
+  }
+  const owner = value;
+  const valid = owner.version === OUTPUT_LEASE_PROTOCOL_VERSION && (owner.kind === "dev" || owner.kind === "production") && owner.key === target.key && typeof owner.canonicalRoot === "string" && path26.isAbsolute(owner.canonicalRoot) && owner.canonicalOutDir === target.canonicalOutDir && typeof owner.generation === "string" && TOKEN_PATTERN.test(owner.generation) && typeof owner.token === "string" && TOKEN_PATTERN.test(owner.token) && Number.isSafeInteger(owner.pid) && Number(owner.pid) > 0 && typeof owner.processStartIdentity === "string" && owner.processStartIdentity.length > 0 && Number.isFinite(owner.createdAt) && Number(owner.createdAt) > 0 && Number.isFinite(owner.heartbeatAt) && Number(owner.heartbeatAt) > 0;
+  if (!valid) throw unknown(`malformed owner for ${target.canonicalOutDir}`);
+  return owner;
+}
+function validateRegularPrivateFile(file, label) {
+  try {
+    const link = fs31.lstatSync(file);
+    const stat = fs31.statSync(file);
+    if (link.isSymbolicLink() || !link.isFile() || !stat.isFile() || link.dev !== stat.dev || link.ino !== stat.ino || stat.nlink !== 1) {
+      throw new Error("not a direct single-link file");
+    }
+    if (process.platform !== "win32") {
+      if (typeof process.getuid !== "function" || stat.uid !== process.getuid()) {
+        throw new Error("unexpected file owner");
+      }
+      if ((stat.mode & 63) !== 0) throw new Error("insecure file mode");
+    }
+  } catch (error) {
+    throw unknown(`untrusted ${label} ${file}`, error);
+  }
+}
+function readOwnerFromDirectory(target, directory) {
+  assertTrustedRoot(target);
+  validatePrivateDirectory(directory, "lease generation");
+  const ownerFile = path26.join(directory, OWNER_FILE);
+  validateRegularPrivateFile(ownerFile, "owner record");
+  try {
+    return validateOwner(
+      JSON.parse(fs31.readFileSync(ownerFile, "utf8")),
+      target
+    );
+  } catch (error) {
+    if (error instanceof OutputLeaseProtocolError) throw error;
+    throw unknown(`cannot read owner for ${target.canonicalOutDir}`, error);
+  }
+}
+function readOwner(target) {
+  return readOwnerFromDirectory(target, target.lockDir);
+}
+function sameGeneration(owner, expected) {
+  return owner.generation === expected.generation && owner.token === expected.token;
+}
+function writeOwnerAtomically(target, owner, guard) {
+  assertTransitionGuard(target, guard);
+  const temporary = path26.join(
+    target.lockDir,
+    `.owner-${process.pid}-${crypto.randomBytes(8).toString("hex")}.tmp`
+  );
+  try {
+    fs31.writeFileSync(temporary, `${JSON.stringify(owner)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    validateRegularPrivateFile(temporary, "temporary owner record");
+    assertTransitionGuard(target, guard);
+    fs31.renameSync(temporary, target.ownerFile);
+  } catch (error) {
+    try {
+      assertTransitionGuard(target, guard);
+      if (fs31.existsSync(temporary)) {
+        validateRegularPrivateFile(temporary, "temporary owner record");
+        fs31.unlinkSync(temporary);
+      }
+    } catch {
+      guard.poisoned = true;
+    }
+    throw unknown(`cannot update owner for ${target.canonicalOutDir}`, error);
+  }
+}
+function createOwner(target, kind, ownerPid, now) {
+  const inspection = inspectProcess(ownerPid);
+  if (inspection.state !== "alive") {
+    throw unknown(`cannot verify lease owner process ${ownerPid}`);
+  }
+  return {
+    version: OUTPUT_LEASE_PROTOCOL_VERSION,
+    kind,
+    key: target.key,
+    canonicalRoot: target.canonicalRoot,
+    canonicalOutDir: target.canonicalOutDir,
+    generation: crypto.randomBytes(32).toString("base64url"),
+    token: crypto.randomBytes(32).toString("base64url"),
+    pid: ownerPid,
+    processStartIdentity: inspection.startIdentity,
+    createdAt: now,
+    heartbeatAt: now
+  };
+}
+function serializeInheritedToken(owner) {
+  return Buffer.from(
+    JSON.stringify({
+      version: OUTPUT_LEASE_PROTOCOL_VERSION,
+      key: owner.key,
+      generation: owner.generation,
+      token: owner.token
+    }),
+    "utf8"
+  ).toString("base64url");
+}
+function parseInheritedToken(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(
+      Buffer.from(value, "base64url").toString("utf8")
+    );
+  } catch (error) {
+    throw unknown("malformed inherited output lease token", error);
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw unknown("malformed inherited output lease token");
+  }
+  const token = parsed;
+  if (token.version !== OUTPUT_LEASE_PROTOCOL_VERSION || typeof token.key !== "string" || !KEY_PATTERN.test(token.key) || typeof token.generation !== "string" || !TOKEN_PATTERN.test(token.generation) || typeof token.token !== "string" || !TOKEN_PATTERN.test(token.token)) {
+    throw unknown("malformed inherited output lease token");
+  }
+  return {
+    version: token.version,
+    key: token.key,
+    generation: token.generation,
+    token: token.token
+  };
+}
+function verifyOwnerIsCurrent(owner) {
+  const inspection = inspectProcess(owner.pid);
+  return inspection.state === "alive" && inspection.startIdentity === owner.processStartIdentity;
+}
+function verifyInheritedGuarded(target, kind, encoded, guard) {
+  const inherited = parseInheritedToken(encoded);
+  if (inherited.key !== target.key) return null;
+  assertTransitionGuard(target, guard);
+  const owner = readOwner(target);
+  if (owner.generation !== inherited.generation || owner.token !== inherited.token || owner.kind !== kind) {
+    throw conflict(target, owner);
+  }
+  if (owner.canonicalRoot !== target.canonicalRoot) {
+    throw unknown(
+      `inherited owner root does not match ${target.canonicalRoot}`
+    );
+  }
+  if (!verifyOwnerIsCurrent(owner)) {
+    throw unknown(
+      `inherited owner is not current for ${target.canonicalOutDir}`
+    );
+  }
+  if (!isProcessOrDescendant(process.pid, owner.pid)) {
+    throw unknown(
+      `inherited token is not in the owner process tree for ${target.canonicalOutDir}`
+    );
+  }
+  return owner;
+}
+function ownerState(owner, now, staleAfterMs) {
+  const heartbeatAge = now - owner.heartbeatAt;
+  if (!Number.isFinite(heartbeatAge) || heartbeatAge < -staleAfterMs) {
+    return "unknown";
+  }
+  const inspection = inspectProcess(owner.pid);
+  if (inspection.state === "alive" && inspection.startIdentity === owner.processStartIdentity) {
+    return "active";
+  }
+  if (heartbeatAge <= staleAfterMs) return "unknown";
+  if (inspection.state === "dead") return "stale";
+  if (inspection.state === "alive" && inspection.startIdentity !== owner.processStartIdentity) {
+    return "stale";
+  }
+  return "unknown";
+}
+function safeRemoveLeaseDirectory(target, directory, guard) {
+  assertTransitionGuard(target, guard);
+  if (path26.dirname(directory) !== target.lockRoot) {
+    throw unknown("refusing to remove lease path outside trusted root");
+  }
+  validatePrivateDirectory(directory, "retired lease generation");
+  for (const entry of fs31.readdirSync(directory)) {
+    if (entry !== OWNER_FILE && !TEMP_OWNER_PATTERN.test(entry)) {
+      throw unknown(`unexpected entry in retired lease generation ${entry}`);
+    }
+    const file = path26.join(directory, entry);
+    validateRegularPrivateFile(file, "retired lease file");
+    fs31.unlinkSync(file);
+  }
+  fs31.rmdirSync(directory);
+}
+function retireStaleGeneration(target, expected, guard) {
+  assertTransitionGuard(target, guard);
+  const current = readOwner(target);
+  if (!sameGeneration(current, expected)) throw conflict(target, current);
+  const retiredDir = path26.join(
+    target.lockRoot,
+    `${target.key}.stale-${expected.generation.slice(0, 12)}-${crypto.randomBytes(8).toString("hex")}`
+  );
+  try {
+    fs31.renameSync(target.lockDir, retiredDir);
+    guard.poisoned = true;
+    const moved = readOwnerFromDirectory(target, retiredDir);
+    if (!sameGeneration(moved, expected)) {
+      throw unknown(`owner changed while retiring ${target.canonicalOutDir}`);
+    }
+    safeRemoveLeaseDirectory(target, retiredDir, guard);
+    guard.poisoned = false;
+  } catch (error) {
+    if (error instanceof OutputLeaseProtocolError) throw error;
+    throw unknown(
+      `cannot atomically retire stale owner for ${target.canonicalOutDir}`,
+      error
+    );
+  }
+}
+function releaseGenerationGuarded(target, expected, guard) {
+  assertTransitionGuard(target, guard);
+  if (!fs31.existsSync(target.lockDir)) return false;
+  const current = readOwner(target);
+  if (!sameGeneration(current, expected)) return false;
+  const releasedDir = path26.join(
+    target.lockRoot,
+    `${target.key}.released-${expected.generation.slice(0, 12)}-${crypto.randomBytes(8).toString("hex")}`
+  );
+  try {
+    assertTransitionGuard(target, guard);
+    const exact = readOwner(target);
+    if (!sameGeneration(exact, expected)) return false;
+    fs31.renameSync(target.lockDir, releasedDir);
+    guard.poisoned = true;
+    const moved = readOwnerFromDirectory(target, releasedDir);
+    if (!sameGeneration(moved, expected)) {
+      throw unknown(`owner changed while releasing ${target.canonicalOutDir}`);
+    }
+    safeRemoveLeaseDirectory(target, releasedDir, guard);
+    guard.poisoned = false;
+    return true;
+  } catch (error) {
+    if (error instanceof OutputLeaseProtocolError) throw error;
+    throw unknown(`cannot release owner for ${target.canonicalOutDir}`, error);
+  }
+}
+function releaseByGeneration(target, expected) {
+  return withTransitionGuard(
+    target,
+    (guard) => releaseGenerationGuarded(target, expected, guard)
+  );
+}
+function refreshGenerationGuarded(target, expected, now, guard) {
+  assertTransitionGuard(target, guard);
+  const current = readOwner(target);
+  if (!sameGeneration(current, expected)) {
+    throw unknown(`owner changed while refreshing ${target.canonicalOutDir}`);
+  }
+  writeOwnerAtomically(target, { ...current, heartbeatAt: now }, guard);
+}
+function refreshByGeneration(target, expected, now) {
+  withTransitionGuard(
+    target,
+    (guard) => refreshGenerationGuarded(target, expected, now, guard)
+  );
+}
+function createLeaseHandle(target, owner, reentrant, options) {
+  const now = options.now ?? Date.now;
+  const manageLifetime = options.manageLifetime !== false && !reentrant;
+  const heartbeatIntervalMs = options.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS;
+  const generation = {
+    generation: owner.generation,
+    token: owner.token
+  };
+  let released = false;
+  let heartbeat;
+  const signalHandlers = /* @__PURE__ */ new Map();
+  const release = () => {
+    if (released || reentrant) return false;
+    released = true;
+    if (heartbeat) clearInterval(heartbeat);
+    process.removeListener("exit", onExit);
+    for (const [signal, handler] of signalHandlers) {
+      process.removeListener(signal, handler);
+    }
+    return releaseByGeneration(target, generation);
+  };
+  const onExit = () => {
+    try {
+      releaseByGeneration(target, generation);
+    } catch {
+    }
+  };
+  if (manageLifetime) {
+    heartbeat = setInterval(() => {
+      try {
+        refreshByGeneration(target, generation, now());
+      } catch {
+        setImmediate(() => process.exit(1));
+      }
+    }, heartbeatIntervalMs);
+    heartbeat.unref();
+    process.once("exit", onExit);
+    const signalExitCodes = {
+      SIGHUP: 129,
+      SIGINT: 130,
+      SIGTERM: 143
+    };
+    for (const signal of Object.keys(signalExitCodes)) {
+      const handler = () => {
+        try {
+          release();
+        } finally {
+          setImmediate(() => process.exit(signalExitCodes[signal] ?? 1));
+        }
+      };
+      signalHandlers.set(signal, handler);
+      process.once(signal, handler);
+    }
+  }
+  return {
+    target,
+    owner,
+    inheritedToken: serializeInheritedToken(owner),
+    reentrant,
+    refresh() {
+      if (!reentrant && !released) {
+        refreshByGeneration(target, generation, now());
+      }
+    },
+    release
+  };
+}
+function acquireOutputLease(options) {
+  const now = options.now ?? Date.now;
+  const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
+  const env = options.env ?? process.env;
+  const target = resolveOutputLeaseTarget(
+    options.rootDir,
+    options.outDir,
+    options.lockRoot
+  );
+  return withTransitionGuard(target, (guard) => {
+    const inheritedValue = env[OUTPUT_LEASE_ENV];
+    if (inheritedValue) {
+      const inheritedOwner = verifyInheritedGuarded(
+        target,
+        options.kind,
+        inheritedValue,
+        guard
+      );
+      if (inheritedOwner) {
+        return createLeaseHandle(target, inheritedOwner, true, options);
+      }
+    }
+    const ownerPid = options.ownerPid ?? process.pid;
+    if (ownerPid !== process.pid) {
+      if (options.manageLifetime !== false) {
+        throw unknown("an external owner requires externally managed lifetime");
+      }
+      if (!isProcessOrDescendant(process.pid, ownerPid)) {
+        throw unknown(`process ${ownerPid} is not an ancestor of the acquirer`);
+      }
+    }
+    if (fs31.existsSync(target.lockDir)) {
+      const existing = readOwner(target);
+      const state = ownerState(existing, now(), staleAfterMs);
+      if (state === "active") throw conflict(target, existing);
+      if (state === "unknown") {
+        throw unknown(`cannot prove owner state for ${target.canonicalOutDir}`);
+      }
+      retireStaleGeneration(target, existing, guard);
+    }
+    assertTransitionGuard(target, guard);
+    try {
+      fs31.mkdirSync(target.lockDir, { mode: 448 });
+      validatePrivateDirectory(target.lockDir, "lease generation");
+      const owner = createOwner(target, options.kind, ownerPid, now());
+      fs31.writeFileSync(target.ownerFile, `${JSON.stringify(owner)}
+`, {
+        encoding: "utf8",
+        flag: "wx",
+        mode: 384
+      });
+      validateRegularPrivateFile(target.ownerFile, "owner record");
+      return createLeaseHandle(target, owner, false, options);
+    } catch (error) {
+      if (error instanceof OutputLeaseProtocolError) throw error;
+      throw unknown(`cannot create owner for ${target.canonicalOutDir}`, error);
+    }
+  });
+}
+function targetAndEncoded(options) {
+  const encoded = (options.env ?? process.env)[OUTPUT_LEASE_ENV];
+  if (!encoded) throw unknown("inherited output lease token is missing");
+  return {
+    target: resolveOutputLeaseTarget(
+      options.rootDir,
+      options.outDir,
+      options.lockRoot
+    ),
+    encoded
+  };
+}
+function verifyInheritedOutputLease(options) {
+  const { target, encoded } = targetAndEncoded(options);
+  return withTransitionGuard(target, (guard) => {
+    const owner = verifyInheritedGuarded(target, options.kind, encoded, guard);
+    if (!owner) {
+      throw unknown("inherited token targets a different output directory");
+    }
+    return owner;
+  });
+}
+function refreshInheritedOutputLease(options) {
+  const { target, encoded } = targetAndEncoded(options);
+  withTransitionGuard(target, (guard) => {
+    const owner = verifyInheritedGuarded(target, options.kind, encoded, guard);
+    if (!owner) {
+      throw unknown("inherited token targets a different output directory");
+    }
+    refreshGenerationGuarded(
+      target,
+      { generation: owner.generation, token: owner.token },
+      (options.now ?? Date.now)(),
+      guard
+    );
+  });
+}
+function poisonInheritedOutputLease(options) {
+  const { target, encoded } = targetAndEncoded(options);
+  withTransitionGuard(target, (guard) => {
+    const owner = verifyInheritedGuarded(target, options.kind, encoded, guard);
+    if (!owner) {
+      throw unknown("inherited token targets a different output directory");
+    }
+    guard.poisoned = true;
+  });
+}
+function releaseInheritedOutputLease(options) {
+  const env = options.env ?? process.env;
+  const encoded = env[OUTPUT_LEASE_ENV];
+  if (!encoded) return false;
+  const target = resolveOutputLeaseTarget(
+    options.rootDir,
+    options.outDir,
+    options.lockRoot
+  );
+  return withTransitionGuard(target, (guard) => {
+    const owner = verifyInheritedGuarded(target, options.kind, encoded, guard);
+    if (!owner) return false;
+    return releaseGenerationGuarded(
+      target,
+      { generation: owner.generation, token: owner.token },
+      guard
+    );
+  });
+}
+
+// src/commands/output-lease/index.ts
+function leaseOptions(options) {
+  return {
+    rootDir: options.root,
+    outDir: options.outDir,
+    kind: "production"
+  };
+}
+function parseOwnerPid(value) {
+  const pid = Number(value);
+  if (!Number.isSafeInteger(pid) || pid <= 0) {
+    throw new Error("MIAODA_PREVIEW_STATE_UNKNOWN: invalid wrapper owner PID");
+  }
+  return pid;
+}
+function acquireWrapperOutputLease(options) {
+  const lease = acquireOutputLease({
+    ...leaseOptions(options),
+    ownerPid: parseOwnerPid(options.ownerPid),
+    manageLifetime: false,
+    // Only Vite children may reenter. A second wrapper must contend normally.
+    env: {}
+  });
+  return lease.inheritedToken;
+}
+function verifyWrapperOutputLease(options) {
+  verifyInheritedOutputLease(leaseOptions(options));
+}
+function releaseWrapperOutputLease(options) {
+  return releaseInheritedOutputLease(leaseOptions(options));
+}
+function poisonWrapperOutputLease(options) {
+  poisonInheritedOutputLease(leaseOptions(options));
+}
+function startWrapperOutputLeaseHeartbeat(options, intervalMs = 2e3) {
+  refreshInheritedOutputLease(leaseOptions(options));
+  const heartbeat = setInterval(() => {
+    try {
+      refreshInheritedOutputLease(leaseOptions(options));
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+  }, intervalMs);
+  return heartbeat;
+}
+function addTargetOptions(command) {
+  return command.requiredOption("--root <dir>", "Project root").requiredOption("--out-dir <dir>", "Managed output directory");
+}
+var acquireCommand = {
+  name: "acquire",
+  description: "Acquire a private production output lease for the build wrapper",
+  register(program) {
+    addTargetOptions(program.command(this.name)).requiredOption("--owner-pid <pid>", "PID of the wrapper shell").action((options) => {
+      process.stdout.write(`${acquireWrapperOutputLease(options)}
+`);
+    });
+  }
+};
+var verifyCommand = {
+  name: "verify",
+  description: "Verify the inherited wrapper lease",
+  register(program) {
+    addTargetOptions(program.command(this.name)).action(
+      (options) => {
+        verifyWrapperOutputLease(options);
+      }
+    );
+  }
+};
+var heartbeatCommand = {
+  name: "heartbeat",
+  description: "Maintain the inherited wrapper lease",
+  register(program) {
+    addTargetOptions(program.command(this.name)).action(
+      (options) => {
+        startWrapperOutputLeaseHeartbeat(options);
+      }
+    );
+  }
+};
+var poisonCommand = {
+  name: "poison",
+  description: "Durably quarantine an inherited wrapper lease",
+  register(program) {
+    addTargetOptions(program.command(this.name)).action(
+      (options) => {
+        poisonWrapperOutputLease(options);
+      }
+    );
+  }
+};
+var releaseCommand = {
+  name: "release",
+  description: "Release the inherited wrapper lease",
+  register(program) {
+    addTargetOptions(program.command(this.name)).action(
+      (options) => {
+        if (!releaseWrapperOutputLease(options)) {
+          throw new Error(
+            `${OUTPUT_LEASE_ENV}: the current token does not own this lease`
+          );
+        }
+      }
+    );
+  }
+};
+var outputLeaseCommandGroup = {
+  name: "output-lease",
+  description: "Private build output ownership protocol",
+  commands: [
+    acquireCommand,
+    verifyCommand,
+    heartbeatCommand,
+    poisonCommand,
+    releaseCommand
+  ]
+};
+
 // src/commands/index.ts
 var commands = [
   genDbSchemaCommand,
@@ -8439,18 +9308,19 @@ var commands = [
   componentCommandGroup,
   migrationCommand,
   readLogsCommand,
-  buildCommandGroup
+  buildCommandGroup,
+  outputLeaseCommandGroup
 ];
 
 // src/index.ts
 for (const filename of [".env.local", ".env"]) {
-  const envPath = path26.join(process.cwd(), filename);
-  if (fs31.existsSync(envPath)) {
+  const envPath = path27.join(process.cwd(), filename);
+  if (fs32.existsSync(envPath)) {
     dotenvConfig({ path: envPath });
   }
 }
-var __dirname = path26.dirname(fileURLToPath5(import.meta.url));
-var pkg = JSON.parse(fs31.readFileSync(path26.join(__dirname, "../package.json"), "utf-8"));
+var __dirname = path27.dirname(fileURLToPath5(import.meta.url));
+var pkg = JSON.parse(fs32.readFileSync(path27.join(__dirname, "../package.json"), "utf-8"));
 var cli = new FullstackCLI(pkg.version);
 cli.useAll(commands);
 cli.run();