@lark-base-open/base-database-cli 1.3.9 → 1.4.3

package/dist/app-builder/core.mjs

@@ -0,0 +1,673 @@
+import { createHash } from 'node:crypto';
+import { createRequire, isBuiltin } from 'node:module';
+import { existsSync, lstatSync, realpathSync, readdirSync, readFileSync, mkdirSync, rmSync, writeFileSync, } from 'node:fs';
+import { resolve, join, relative, isAbsolute, dirname } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { build as esbuild, version as esbuildVersion } from 'esbuild';
+import { parse as parseJS } from '@babel/parser';
+import babelTraverse from '@babel/traverse';
+import { parse as parseJSONC } from 'jsonc-parser';
+// Shared by CLI contract discovery and the builder. Comments and unrelated
+// identifiers never determine the runtime ABI.
+export function defineFunctionCall(ast) {
+    const bindings = new Set(), namespaces = new Set();
+    for (const statement of ast.program.body) {
+        if (statement.type !== 'ImportDeclaration' ||
+            statement.importKind === 'type' ||
+            statement.source.value !== '@lark-base-open/base-database-app-sdk/server')
+            continue;
+        for (const specifier of statement.specifiers) {
+            if (specifier.type === 'ImportNamespaceSpecifier')
+                namespaces.add(specifier.local.name);
+            if (specifier.type === 'ImportSpecifier' &&
+                specifier.importKind !== 'type' &&
+                (specifier.imported.name ?? specifier.imported.value) ===
+                    'defineFunction')
+                bindings.add(specifier.local.name);
+        }
+    }
+    const unwrap = (value) => {
+        while (value &&
+            [
+                'TSAsExpression',
+                'TSSatisfiesExpression',
+                'TSNonNullExpression',
+                'ParenthesizedExpression',
+            ].includes(value.type))
+            value = value.expression;
+        return value;
+    };
+    const exported = ast.program.body.find((s) => s.type === 'ExportDefaultDeclaration');
+    const specifier = ast.program.body
+        .flatMap((s) => s.type === 'ExportNamedDeclaration' && !s.source ? s.specifiers : [])
+        .find((s) => (s.exported?.name ?? s.exported?.value) === 'default');
+    let value = unwrap(exported?.declaration ?? specifier?.local);
+    const seen = new Set();
+    while (value?.type === 'Identifier' && !seen.has(value.name)) {
+        seen.add(value.name);
+        const name = value.name;
+        value = unwrap(ast.program.body
+            .flatMap((s) => {
+            const d = s.type === 'ExportNamedDeclaration' ? s.declaration : s;
+            return d?.type === 'VariableDeclaration' && d.kind === 'const'
+                ? d.declarations
+                : [];
+        })
+            .find((d) => d.id.type === 'Identifier' && d.id.name === name)?.init);
+    }
+    if (value?.type !== 'CallExpression')
+        return undefined;
+    const callee = value.callee;
+    const matches = callee.type === 'Identifier'
+        ? bindings.has(callee.name)
+        : callee.type === 'MemberExpression' &&
+            !callee.computed &&
+            callee.object.type === 'Identifier' &&
+            namespaces.has(callee.object.name) &&
+            callee.property.type === 'Identifier' &&
+            callee.property.name === 'defineFunction';
+    return matches ? value : undefined;
+}
+export function classifyFunctionAST(ast) {
+    if (defineFunctionCall(ast))
+        return 'sdk';
+    const hasSDK = ast.program.body.some((s) => s.type === 'ImportDeclaration' &&
+        s.importKind !== 'type' &&
+        s.source.value === '@lark-base-open/base-database-app-sdk/server');
+    const exported = ast.program.body.find((s) => s.type === 'ExportDefaultDeclaration');
+    if (exported &&
+        [
+            'FunctionDeclaration',
+            'FunctionExpression',
+            'ArrowFunctionExpression',
+        ].includes(exported.declaration.type))
+        return 'handler';
+    return hasSDK || !exported ? 'unknown' : 'handler';
+}
+export function isDefineFunctionSource(source) {
+    const kind = classifyFunctionAST(parseJS(source, { sourceType: 'module', plugins: ['typescript', 'jsx'] }));
+    if (kind === 'unknown')
+        fail('FUNCTION_ENTRY_UNKNOWN: 无法确认默认导出；请直接默认导出 SDK defineFunction(...) 或函数 handler，再运行 contracts generate 和 check。');
+    return kind === 'sdk';
+}
+export function parseProjectConfig(source, label = 'base-database.jsonc') {
+    const errors = [];
+    const value = parseJSONC(source, errors, { allowTrailingComma: true });
+    if (errors.length ||
+        !value ||
+        typeof value !== 'object' ||
+        Array.isArray(value))
+        fail(`Invalid ${label}: expected a JSONC object without parse errors`);
+    if (value.template !== undefined &&
+        (!value.template ||
+            typeof value.template !== 'object' ||
+            Array.isArray(value.template) ||
+            ![1, 2].includes(value.template.version) ||
+            (value.template.name !== undefined &&
+                value.template.name !== 'database-starter')))
+        fail(`Invalid ${label}: unsupported template. Fix template only for a known starter version; otherwise use a CLI that supports this template. Do not remove it to bypass validation`);
+    return value;
+}
+export const BUILDER_VERSION = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version;
+export const ERROR_MARKER = 'BASE_DATABASE_BUILD_ERROR:';
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const readJSON = (file) => JSON.parse(readFileSync(file, 'utf8'));
+function fail(message) {
+    throw new Error(message);
+}
+export function diagnostic(error, stage = 'build', functionId = null) {
+    const loc = error.errors?.[0]?.location;
+    const match = String(error.message).match(/([^\n]+)\((\d+),(\d+)\): error/);
+    functionId ??=
+        match?.[1]?.match(/functions[\/\\]([^\/\\]+)[\/\\]/)?.[1] ?? null;
+    return {
+        builderVersion: BUILDER_VERSION,
+        stage,
+        functionId,
+        file: loc?.file ?? match?.[1] ?? null,
+        line: loc?.line ?? (match ? +match[2] : null),
+        column: loc?.column ?? (match ? +match[3] : null),
+        message: String(error.message),
+        hint: `builderVersion=${BUILDER_VERSION}; 修复源码、依赖或产物错误。`,
+    };
+}
+export function layout(root) {
+    const config = existsSync(join(root, 'base-database.jsonc'))
+        ? parseProjectConfig(readFileSync(join(root, 'base-database.jsonc'), 'utf8'))
+        : {};
+    const version = config.template === undefined ? 1 : config.template?.version;
+    if (![1, 2].includes(version))
+        fail('Unknown template.version');
+    return {
+        version,
+        server: version === 2 ? 'server' : 'server-functions',
+        config,
+    };
+}
+export function safePath(root, name) {
+    if (typeof name !== 'string' ||
+        !name ||
+        isAbsolute(name) ||
+        name.includes('\\') ||
+        name.split('/').some((p) => p === '..' || p === '.' || !p))
+        fail(`Invalid artifact path: ${name}`);
+    let file = root;
+    if (lstatSync(root).isSymbolicLink())
+        fail('Artifact root is a symlink');
+    for (const part of name.split('/')) {
+        file = join(file, part);
+        if (lstatSync(file).isSymbolicLink())
+            fail(`Artifact symlink: ${name}`);
+    }
+    if (!lstatSync(file).isFile())
+        fail(`Not a regular file: ${name}`);
+    return file;
+}
+export function inventory(root, exclude = []) {
+    const files = [];
+    let total = 0;
+    const visit = (dir, depth = 0) => {
+        if (lstatSync(dir).isSymbolicLink())
+            fail(`Artifact symlink: ${relative(root, dir)}`);
+        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = join(dir, entry.name), name = relative(root, file);
+            if (entry.isSymbolicLink())
+                fail(`Artifact symlink: ${name}`);
+            if (entry.isDirectory())
+                visit(file, depth + 1);
+            else {
+                safePath(root, name);
+                if (exclude.includes(name))
+                    continue;
+                const bytes = readFileSync(file);
+                total += bytes.length;
+                files.push({ path: name, bytes: bytes.length, sha256: hash(bytes) });
+            }
+        }
+    };
+    visit(root);
+    return files;
+}
+export function functionInventory(directory, requiredFiles = []) {
+    if (!existsSync(directory))
+        return [];
+    if (lstatSync(directory).isSymbolicLink())
+        fail('Function directory is a symlink');
+    return readdirSync(directory, { withFileTypes: true })
+        .filter((e) => !e.isFile())
+        .map((e) => {
+        if (!e.isDirectory() ||
+            e.isSymbolicLink() ||
+            !/^[A-Za-z0-9_-]{1,64}$/.test(e.name))
+            fail(`Invalid Function ID: ${e.name}`);
+        for (const file of requiredFiles) {
+            const path = join(directory, e.name, file);
+            if (!existsSync(path) ||
+                lstatSync(path).isSymbolicLink() ||
+                !lstatSync(path).isFile())
+                fail(`FUNCTION_SOURCE_INCOMPLETE: ${path} is required; restore the declaration or remove the entire Function directory`);
+        }
+        return e.name;
+    })
+        .sort();
+}
+export function ids(root, server) {
+    return functionInventory(join(root, server, 'functions'), [
+        'index.ts',
+        'meta.json',
+    ]);
+}
+function walk(value, fn) {
+    if (!value || typeof value !== 'object')
+        return;
+    if (typeof value.type === 'string')
+        fn(value);
+    for (const [key, child] of Object.entries(value))
+        if (!['loc', 'start', 'end', 'tokens', 'comments'].includes(key)) {
+            if (Array.isArray(child))
+                child.forEach((v) => walk(v, fn));
+            else
+                walk(child, fn);
+        }
+}
+export function run(command, args, cwd) {
+    const result = spawnSync(command, args, {
+        cwd,
+        encoding: 'utf8',
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    if (result.error || result.status !== 0)
+        fail(result.error?.message ??
+            `${command} failed (${result.status})\n${result.stdout}\n${result.stderr}`);
+}
+// Package ownership comes from resolved package installations, never a substring
+// in a source path. Canonical roots also cover pnpm and workspace symlinks.
+function optionalDependencyResolver(root, server) {
+    const owners = new Set();
+    const missing = new Set();
+    const approved = new Set();
+    const stubbed = new Set();
+    const canonical = (file) => realpathSync(file);
+    const excluded = new Set([canonical(root), canonical(server)]);
+    const packageName = (name) => /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9_][a-zA-Z0-9_.-]*(?:\/|$)/.exec(name)?.[0].replace(/\/$/, '');
+    const key = (importer, name, kind) => JSON.stringify([canonical(importer), name, kind]);
+    function owner(file) {
+        let dir = dirname(canonical(file));
+        while (true) {
+            if (owners.has(dir))
+                return dir;
+            const parent = dirname(dir);
+            if (parent === dir)
+                return null;
+            dir = parent;
+        }
+    }
+    function installation(name, importer) {
+        // Node package self-references are installed even without a node_modules
+        // link. Nested manifest copies do not define dependency ownership.
+        if (existsSync(importer)) {
+            let dir = dirname(canonical(importer));
+            while (true) {
+                const manifest = join(dir, 'package.json');
+                if (existsSync(manifest)) {
+                    if (readJSON(manifest).name === name)
+                        return dir;
+                    break;
+                }
+                const parent = dirname(dir);
+                if (parent === dir)
+                    break;
+                dir = parent;
+            }
+        }
+        const req = createRequire(importer);
+        for (const dir of req.resolve.paths(name) ?? []) {
+            const candidate = join(dir, name);
+            // Include broken symlinks: an installed but broken package is not absent.
+            if (existsSync(candidate) || lstatSync(candidate, { throwIfNoEntry: false }))
+                return candidate;
+        }
+        return null;
+    }
+    return {
+        stubbed,
+        approve(metafile) {
+            for (const [file, input] of Object.entries(metafile.inputs)) {
+                if (!existsSync(resolve(root, file)))
+                    continue;
+                for (const item of input.imports) {
+                    if (!item.external || isBuiltin(item.path))
+                        continue;
+                    const k = key(resolve(root, file), item.path, item.kind);
+                    if (!missing.has(k) || !owners.has(owner(resolve(root, file))))
+                        fail(`Only Node built-ins may be external: ${file}: ${item.path}`);
+                    // esbuild only preserves unresolved imports when it recognizes error
+                    // handling. A required use (even of the same name) fails pass one.
+                    approved.add(k);
+                }
+            }
+            return approved.size > 0;
+        },
+        setup(b) {
+            b.onResolve({ filter: /.*/ }, async (args) => {
+                if (args.pluginData?.optionalResolution || args.namespace === 'optional-missing')
+                    return;
+                if (args.importer && existsSync(args.importer) && approved.has(key(args.importer, args.path, args.kind))) {
+                    stubbed.add(args.path);
+                    return { path: args.path, namespace: 'optional-missing' };
+                }
+                const name = packageName(args.path);
+                if (!name || isBuiltin(args.path) || !args.importer)
+                    return;
+                const result = await b.resolve(args.path, {
+                    importer: args.importer, resolveDir: args.resolveDir,
+                    kind: args.kind, namespace: args.namespace,
+                    pluginData: { optionalResolution: true },
+                });
+                const installed = installation(name, args.importer);
+                if (!result.errors.length && result.path && !result.external) {
+                    if (installed) {
+                        const dir = canonical(installed);
+                        const file = canonical(result.path);
+                        const rel = relative(dir, file);
+                        if (!excluded.has(dir) && rel && !rel.startsWith('../') && !isAbsolute(rel))
+                            owners.add(dir);
+                    }
+                    // Use esbuild's original result; no custom resolution or externals.
+                    return result;
+                }
+                if (result.errors.length && !installed && existsSync(args.importer) &&
+                    ['require-call', 'dynamic-import'].includes(args.kind))
+                    missing.add(key(args.importer, args.path, args.kind));
+                // Let esbuild classify failure itself, including its try/import.catch
+                // handling. Returning resolver errors here would erase that distinction.
+            });
+            // ESM initialization retries after a throw. A CommonJS stub would cache
+            // its partial exports and incorrectly succeed on the second require.
+            b.onLoad({ filter: /.*/, namespace: 'optional-missing' }, (args) => ({
+                contents: `const error = new Error(${JSON.stringify("Cannot find module '")} + ${JSON.stringify(args.path)} + "'"); error.code = 'MODULE_NOT_FOUND'; throw error; export {};`,
+                loader: 'js',
+            }));
+        },
+    };
+}
+export async function buildProject(root, options = {}) {
+    root = resolve(root);
+    const info = layout(root), server = join(root, info.server), output = join(server, 'dist');
+    let stage = 'typecheck', functionId = null;
+    try {
+        if (existsSync(server) && lstatSync(server).isSymbolicLink())
+            fail('Server directory is a symlink');
+        const functions = ids(root, info.server);
+        if (functions.length) {
+            const require = createRequire(join(server, 'package.json'));
+            const tsc = join(dirname(require.resolve('typescript/package.json')), 'bin/tsc');
+            run(process.execPath, [
+                tsc,
+                '--noEmit',
+                '--noCheck',
+                'false',
+                '--project',
+                join(server, 'tsconfig.json'),
+            ], root);
+        }
+        stage = 'bundle';
+        if (existsSync(output) && lstatSync(output).isSymbolicLink())
+            fail('Output directory is a symlink');
+        const cacheFile = join(root, '.base-database-cli/state/platform-builder-cache.json');
+        let previous;
+        if (options.incremental &&
+            existsSync(join(output, 'build-manifest.json'))) {
+            const cached = readJSON(join(output, 'build-manifest.json'));
+            if (cached.functions?.some((fn) => typeof fn.id !== 'string' || !/^[A-Za-z0-9_-]{1,64}$/.test(fn.id)))
+                fail('Invalid cached Function ID');
+            try {
+                previous = readBuildCache(output);
+                const cache = readJSON(cacheFile);
+                if (cache.manifestDigest !==
+                    hash(readFileSync(join(output, 'build-manifest.json'))))
+                    fail('Build cache mismatch');
+                previous.functions = previous.functions.map((fn) => ({
+                    ...fn,
+                    inputHashes: cache.functions.find((item) => item.id === fn.id)
+                        ?.inputHashes,
+                }));
+                if (previous.builderVersion !== BUILDER_VERSION ||
+                    previous.esbuildVersion !== esbuildVersion)
+                    previous = undefined;
+            }
+            catch {
+                previous = undefined;
+            }
+        }
+        if (!previous)
+            rmSync(output, { recursive: true, force: true });
+        else
+            for (const fn of previous.functions)
+                if (!functions.includes(fn.id))
+                    rmSync(join(output, 'functions', fn.id), {
+                        recursive: true,
+                        force: true,
+                    });
+        mkdirSync(output, { recursive: true });
+        rmSync(join(output, 'build-manifest.json'), { force: true });
+        writeFileSync(join(output, 'package.json'), '{"type":"commonjs"}\n');
+        const entries = [];
+        const sourceHashes = {};
+        let rebuilt = 0;
+        for (const id of functions) {
+            options.signal?.throwIfAborted();
+            functionId = id;
+            const entry = safePath(server, `functions/${id}/index.ts`);
+            const cached = previous?.functions.find((fn) => fn.id === id);
+            if (cached?.inputHashes &&
+                !cached.stubbedModules?.length &&
+                !isDefineFunctionSource(readFileSync(entry, 'utf8')) &&
+                Object.entries(cached.inputHashes).every(([p, h]) => existsSync(resolve(root, p)) &&
+                    hash(readFileSync(resolve(root, p))) === h)) {
+                entries.push(cached);
+                Object.assign(sourceHashes, cached.inputHashes);
+                continue;
+            }
+            rebuilt++;
+            rmSync(join(output, 'functions', id), { recursive: true, force: true });
+            const source = readFileSync(entry, 'utf8');
+            const sdk = isDefineFunctionSource(source);
+            let profile = options.profile ?? {
+                platformEnv: info.config.runtimeProfile ?? 'online',
+                brand: options.env?.LARKSUITE_CLI_BRAND ?? 'feishu',
+            };
+            const profilePath = join(server, 'generated/runtime-profile.ts');
+            if (sdk && existsSync(profilePath)) {
+                const ast = parseJS(readFileSync(profilePath, 'utf8'), {
+                    sourceType: 'module',
+                    plugins: ['typescript'],
+                });
+                const declaration = ast.program.body[0]?.declaration?.declarations?.[0];
+                const expression = declaration?.init?.type === 'TSAsExpression'
+                    ? declaration.init.expression
+                    : declaration?.init;
+                if (declaration?.id?.name !== 'runtimeProfile' ||
+                    expression?.type !== 'ObjectExpression')
+                    fail('FAAS_RUNTIME_PROFILE_INVALID');
+                profile = {};
+                for (const property of expression.properties) {
+                    if (property.type !== 'ObjectProperty' ||
+                        property.computed ||
+                        property.key.type !== 'Identifier' ||
+                        property.value.type !== 'StringLiteral')
+                        fail('FAAS_RUNTIME_PROFILE_INVALID');
+                    profile[property.key.name] = property.value.value;
+                }
+            }
+            if (typeof profile.platformEnv !== 'string' ||
+                !/^[a-z][a-z0-9_-]*$/.test(profile.platformEnv) ||
+                !['feishu', 'lark'].includes(profile.brand))
+                fail('FAAS_RUNTIME_PROFILE_INVALID');
+            const stdin = sdk
+                ? {
+                    contents: `import handler from ${JSON.stringify(entry)}; import {bindFunctionRuntime} from '@lark-base-open/base-database-app-sdk/server'; export default bindFunctionRuntime(handler, ${JSON.stringify(profile)});`,
+                    resolveDir: server,
+                    sourcefile: 'platform-entry.ts',
+                    loader: 'ts',
+                }
+                : undefined;
+            const optional = optionalDependencyResolver(root, server);
+            const buildOptions = {
+                absWorkingDir: root,
+                ...(stdin ? { stdin } : { entryPoints: [entry] }),
+                outfile: join(output, 'functions', id, 'index.js'),
+                bundle: true,
+                format: 'cjs',
+                platform: 'node',
+                target: 'node22',
+                metafile: true,
+                logLevel: 'silent',
+                sourcemap: 'external',
+                sourcesContent: false,
+                assetNames: 'assets/[name]-[hash]',
+                loader: {
+                    '.json': 'json',
+                    '.txt': 'file',
+                    '.wasm': 'file',
+                    '.bin': 'file',
+                    '.png': 'file',
+                    '.svg': 'file',
+                },
+                plugins: [
+                    {
+                        name: 'platform-contract',
+                        setup(b) {
+                            b.onResolve({
+                                filter: /^(react(?:-dom)?(?:\/|$)|@lark-base-open\/base-database-app-sdk\/(page|components|testing|vite)(?:\/|$))/,
+                            }, (args) => {
+                                fail(`FAAS_UI_DEPENDENCY_UNSUPPORTED: ${args.path}`);
+                            });
+                            b.onResolve({ filter: /\.node$/ }, (args) => {
+                                fail(`DEPENDENCY_RUNTIME_UNSUPPORTED: ${args.path}`);
+                            });
+                            b.onLoad({ filter: /\.node$/ }, (args) => {
+                                fail(`DEPENDENCY_RUNTIME_UNSUPPORTED: ${args.path}`);
+                            });
+                            b.onLoad({ filter: /\.[cm]?[jt]sx?$/, namespace: 'file' }, (args) => {
+                                const ast = parseJS(readFileSync(args.path, 'utf8'), {
+                                    sourceType: 'unambiguous',
+                                    plugins: ['typescript', 'jsx'],
+                                });
+                                const traverse = babelTraverse.default ?? babelTraverse;
+                                traverse(ast, {
+                                    enter(path) {
+                                        const n = path.node;
+                                        const call = n.type === 'CallExpression' &&
+                                            ((n.callee?.name === 'require' &&
+                                                !path.scope.getBinding('require')) ||
+                                                n.callee?.type === 'Import');
+                                        if ((call &&
+                                            (n.arguments?.length !== 1 ||
+                                                n.arguments[0]?.type !== 'StringLiteral')) ||
+                                            (n.type === 'ImportExpression' &&
+                                                n.source?.type !== 'StringLiteral'))
+                                            fail(`${n.callee?.name === 'require' ? 'FAAS_DYNAMIC_REQUIRE_UNSUPPORTED' : 'FAAS_DYNAMIC_IMPORT_UNSUPPORTED'}: ${args.path}:${n.loc?.start.line}`);
+                                        if (n.type === 'MetaProperty' &&
+                                            n.meta?.name === 'import' &&
+                                            n.property?.name === 'meta')
+                                            fail(`FAAS_IMPORT_META_UNSUPPORTED: ${args.path}:${n.loc?.start.line}`);
+                                    },
+                                });
+                                return undefined;
+                            });
+                        },
+                    },
+                    { name: 'optional-dependencies', setup: optional.setup },
+                ],
+            };
+            // Pass one must succeed without stubs. Its input edges, not our AST,
+            // determine whether esbuild accepted a missing import as optional.
+            let result = await esbuild({ ...buildOptions, write: false });
+            if (optional.approve(result.metafile))
+                result = await esbuild(buildOptions);
+            else
+                for (const file of result.outputFiles) {
+                    mkdirSync(dirname(file.path), { recursive: true });
+                    writeFileSync(file.path, file.contents);
+                }
+            const externalModules = [
+                ...new Set(Object.values(result.metafile.outputs).flatMap((o) => o.imports.filter((i) => i.external).map((i) => i.path))),
+            ].sort();
+            if (externalModules.some((p) => !isBuiltin(p)))
+                fail('Only Node built-ins may be external');
+            const inputHashes = {};
+            for (const file of [
+                ...Object.keys(result.metafile.inputs),
+                'base-database.jsonc',
+                'package.json',
+                'package-lock.json',
+                `${info.server}/package.json`,
+                `${info.server}/tsconfig.json`,
+                `${info.server}/package-lock.json`,
+                `${info.server}/generated/runtime-profile.ts`,
+            ])
+                if (existsSync(resolve(root, file)))
+                    inputHashes[file] = hash(readFileSync(resolve(root, file)));
+            Object.assign(sourceHashes, inputHashes);
+            const files = Object.keys(result.metafile.outputs).map((p) => {
+                const name = relative(output, resolve(root, p)), bytes = readFileSync(safePath(output, name));
+                return { path: name, bytes: bytes.length, sha256: hash(bytes) };
+            });
+            entries.push({
+                id,
+                entry: `functions/${id}/index.js`,
+                export: 'default',
+                type: sdk ? 'defineFunction' : 'handler',
+                externalModules,
+                stubbedModules: [...optional.stubbed].sort(),
+                files,
+                inputHashes,
+            });
+        }
+        const commonFiles = inventory(output).filter((f) => !entries.some((e) => e.files.some((g) => g.path === f.path)));
+        const lock = join(info.version === 2 ? root : server, 'package-lock.json');
+        const manifest = {
+            contract: 'base-database-functions',
+            contractVersion: 1,
+            nodeMajor: 22,
+            format: 'cjs',
+            builderVersion: BUILDER_VERSION,
+            esbuildVersion,
+            templateVersion: info.version,
+            serverDirectory: info.server,
+            sourceDigest: hash(JSON.stringify(sourceHashes)),
+            lockfileDigest: existsSync(lock) ? hash(readFileSync(lock)) : null,
+            runtimeBindingABI: 'bindFunctionRuntime@1',
+            functions: entries.map(({ inputHashes, ...fn }) => fn),
+            commonFiles,
+            totalBytes: inventory(output).reduce((sum, f) => sum + f.bytes, 0),
+        };
+        writeFileSync(join(output, 'build-manifest.json'), JSON.stringify(manifest, null, 2) + '\n');
+        stage = 'verify';
+        readBuildCache(output, functions);
+        if (options.incremental) {
+            for (const path of [
+                join(root, '.base-database-cli'),
+                dirname(cacheFile),
+                cacheFile,
+            ])
+                if (existsSync(path) && lstatSync(path).isSymbolicLink())
+                    fail('Build cache symlink');
+            mkdirSync(dirname(cacheFile), { recursive: true });
+            writeFileSync(cacheFile, JSON.stringify({
+                manifestDigest: hash(readFileSync(join(output, 'build-manifest.json'))),
+                functions: entries.map(({ id, inputHashes }) => ({
+                    id,
+                    inputHashes,
+                })),
+            }));
+        }
+        return {
+            ok: true,
+            functions: functions.length,
+            rebuilt,
+            output,
+            builderVersion: BUILDER_VERSION,
+            stubbedModules: [...new Set(entries.flatMap((fn) => fn.stubbedModules ?? []))].sort(),
+        };
+    }
+    catch (error) {
+        if (existsSync(server) &&
+            !lstatSync(server).isSymbolicLink() &&
+            existsSync(output) &&
+            !lstatSync(output).isSymbolicLink())
+            rmSync(output, { recursive: true, force: true });
+        error.diagnostic = diagnostic(error, stage, functionId);
+        throw error;
+    }
+}
+/** Local cache integrity only; deployment policy belongs to the platform. */
+export function readBuildCache(output, expectedIds) {
+    const manifest = readJSON(safePath(output, 'build-manifest.json'));
+    if (manifest.contract !== 'base-database-functions' ||
+        manifest.contractVersion !== 1 ||
+        !Array.isArray(manifest.functions) ||
+        !Array.isArray(manifest.commonFiles))
+        fail('Invalid build manifest schema');
+    const files = [...manifest.commonFiles];
+    for (const fn of manifest.functions) {
+        if (typeof fn.id !== 'string' ||
+            !/^[A-Za-z0-9_-]{1,64}$/.test(fn.id) ||
+            fn.entry !== `functions/${fn.id}/index.js` ||
+            !Array.isArray(fn.files))
+            fail('Invalid cached Function ID');
+        files.push(...fn.files);
+    }
+    if (expectedIds &&
+        JSON.stringify(manifest.functions.map((f) => f.id).sort()) !==
+            JSON.stringify([...expectedIds].sort()))
+        fail('Function entry set mismatch');
+    for (const file of files) {
+        const data = readFileSync(safePath(output, file.path));
+        if (data.length !== file.bytes || hash(data) !== file.sha256)
+            fail(`Artifact hash/size mismatch: ${file.path}`);
+    }
+    return manifest;
+}
+//# sourceMappingURL=core.mjs.map