@locode2/harness 0.1.0-preview.1

package/apps/host/dist/frontend-runtime-worker.js

@@ -0,0 +1,1755 @@
+// apps/host/src/runtime-diagnostics.ts
+import { existsSync as existsSync3, realpathSync as realpathSync3 } from "node:fs";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join5, resolve as resolve3 } from "node:path";
+import ts2 from "typescript";
+
+// apps/host/src/runtime-business-source.ts
+import { lstatSync, statSync } from "node:fs";
+import { lstat, readdir } from "node:fs/promises";
+import { extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+function filesystemErrorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+function normalizedRelative(value) {
+  const normalized = value.replaceAll("\\", "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
+  return normalized === "." ? "" : normalized;
+}
+function containsPath(root, candidate) {
+  const nested = relative(root, candidate);
+  return nested === "" || !nested.startsWith(`..${sep}`) && nested !== ".." && !isAbsolute(nested);
+}
+function sameFilesystemPath(left, right) {
+  return filesystemPathKey(left) === filesystemPathKey(right);
+}
+function filesystemPathKey(value) {
+  const normalized = resolve(value).replaceAll("\\", "/").replace(/\/+$/u, "");
+  return process.platform === "win32" ? normalized.toLocaleLowerCase("en-US") : normalized;
+}
+function relativeProjectPath(projectRoot, path) {
+  if (!containsPath(projectRoot, path)) return void 0;
+  return normalizedRelative(relative(projectRoot, path));
+}
+function allowedProjectPath(args, candidate) {
+  const relativePath = relativeProjectPath(args.projectRoot, candidate);
+  if (relativePath === void 0) return false;
+  const key = process.platform === "win32" ? relativePath.toLocaleLowerCase("en-US") : relativePath;
+  return [...args.readablePaths, ...args.editablePaths].some((pattern) => {
+    const root = normalizedRelative(pattern.replace(/\/\*\*$/u, ""));
+    const rootKey = process.platform === "win32" ? root.toLocaleLowerCase("en-US") : root;
+    return key === rootKey || key.startsWith(`${rootKey}/`);
+  });
+}
+function assertRegularContainedFile(root, relativePath, label) {
+  const absolute = resolve(root, normalizedRelative(relativePath));
+  if (!containsPath(root, absolute)) throw new Error(`${label} escaped its root`);
+  const info = statSync(absolute);
+  if (!info.isFile()) throw new Error(`${label} is not a regular file`);
+  return absolute;
+}
+async function walkBusinessFiles(root) {
+  const files = [];
+  const queue = [root];
+  while (queue.length > 0) {
+    const directory = queue.shift();
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      const absolute = join(directory, entry.name);
+      if (entry.isSymbolicLink()) throw new Error(`\u4E1A\u52A1\u6E90\u7801\u4E0D\u80FD\u5305\u542B\u7B26\u53F7\u94FE\u63A5/junction\uFF1A${normalizedRelative(relative(root, absolute))}`);
+      if (entry.isDirectory()) queue.push(absolute);
+      else if (entry.isFile()) files.push(absolute);
+    }
+  }
+  return files;
+}
+function editableProjectPath(args, relativePath) {
+  const key = process.platform === "win32" ? relativePath.toLocaleLowerCase("en-US") : relativePath;
+  return args.editablePaths.some((pattern) => {
+    const root = normalizedRelative(pattern.replace(/\/\*\*$/u, ""));
+    const rootKey = process.platform === "win32" ? root.toLocaleLowerCase("en-US") : root;
+    return key === rootKey || key.startsWith(`${rootKey}/`);
+  });
+}
+async function businessFilesIfPresent(root) {
+  let info;
+  try {
+    info = await lstat(root);
+  } catch (error) {
+    if (filesystemErrorCode(error) === "ENOENT") return [];
+    throw error;
+  }
+  return info.isDirectory() && !info.isSymbolicLink() ? await walkBusinessFiles(root) : [];
+}
+function businessModuleCandidate(root, requested) {
+  const variants = extname(requested) ? [requested] : [
+    requested,
+    ...[".ts", ".tsx", ".js", ".jsx", ".json", ".css"].map((extension) => `${requested}${extension}`),
+    ...[".ts", ".tsx", ".js", ".jsx", ".json", ".css"].map((extension) => posix.join(requested, `index${extension}`))
+  ];
+  for (const relativePath of variants) {
+    const absolute = resolve(root, relativePath);
+    if (!containsPath(root, absolute)) continue;
+    const info = (() => {
+      try {
+        return lstatSync(absolute);
+      } catch (error) {
+        const code = filesystemErrorCode(error);
+        if (code === "ENOENT" || code === "ENOTDIR") return void 0;
+        throw error;
+      }
+    })();
+    if (info?.isFile() && !info.isSymbolicLink()) return normalizedRelative(relative(root, absolute));
+  }
+  return void 0;
+}
+
+// apps/host/src/runtime-code-diagnostics.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve2 } from "node:path";
+import ts from "typescript";
+
+// apps/host/src/runtime-dependencies.ts
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var VIRTUAL_REGISTRY = "virtual:harness-business-registry";
+var requireFromHost = createRequire(import.meta.url);
+var workerModulePath = fileURLToPath(import.meta.url);
+var BUSINESS_DEPENDENCIES = /* @__PURE__ */ new Set([
+  "@ant-design/charts",
+  "@ant-design/icons",
+  "antd",
+  "dayjs",
+  "react",
+  "react-dom",
+  "react-router-dom"
+]);
+function packageName(source) {
+  if (source.startsWith("@")) return source.split("/").slice(0, 2).join("/");
+  return source.split("/")[0];
+}
+function safeBareSpecifier(source, dependency) {
+  if (source.includes("\\") || source !== dependency && !source.startsWith(`${dependency}/`)) return false;
+  return !source.split("/").some((segment) => segment === "." || segment === "..");
+}
+function exactSpecifierPattern(source) {
+  return new RegExp(`^${source.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}$`, "u");
+}
+function fixedDependencyResolution(source, dependency) {
+  if (!safeBareSpecifier(source, dependency)) throw new Error(`\u4F9D\u8D56\u5B50\u8DEF\u5F84\u4E0D\u5B89\u5168\uFF1A${source}`);
+  const dependencyRoot = dependencyPackage(dependency).root;
+  const resolved = requireFromHost.resolve(source);
+  const canonical = realpathSync(resolved);
+  if (!containsPath(dependencyRoot, canonical)) throw new Error(`\u4F9D\u8D56\u5B50\u8DEF\u5F84\u9003\u9038\u56FA\u5B9A\u5305\u6839\uFF1A${source}`);
+  return resolved;
+}
+function browserDependencySource(source, dependency) {
+  if (dependency === "antd" && /^antd\/locale\/[a-zA-Z0-9_-]+$/u.test(source)) {
+    return source.replace(/^antd\/locale\//u, "antd/es/locale/");
+  }
+  return source;
+}
+function dependencyTypeTarget(source) {
+  try {
+    const resolved = requireFromHost.resolve(source);
+    return resolved;
+  } catch {
+    return void 0;
+  }
+}
+var dependencyPackageCache = /* @__PURE__ */ new Map();
+function dependencyPackage(name) {
+  const cached = dependencyPackageCache.get(name);
+  if (cached) return cached;
+  try {
+    const packagePath = requireFromHost.resolve(`${name}/package.json`);
+    const value = JSON.parse(readFileSync(packagePath, "utf8"));
+    if (value.name === name && typeof value.version === "string") {
+      const result = { root: dirname(packagePath), version: value.version };
+      dependencyPackageCache.set(name, result);
+      return result;
+    }
+  } catch {
+  }
+  const entry = requireFromHost.resolve(name);
+  let current = dirname(entry);
+  for (; ; ) {
+    const packagePath = join2(current, "package.json");
+    if (existsSync(packagePath)) {
+      const value = JSON.parse(readFileSync(packagePath, "utf8"));
+      if (value.name === name && typeof value.version === "string") {
+        const result = { root: current, version: value.version };
+        dependencyPackageCache.set(name, result);
+        return result;
+      }
+    }
+    const parent = dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  throw new Error(`\u65E0\u6CD5\u5B9A\u4F4D Host \u56FA\u5B9A\u4F9D\u8D56\uFF1A${name}`);
+}
+function verifyDependencies(args) {
+  const roots = /* @__PURE__ */ new Set();
+  for (const [name, expected] of Object.entries(args.dependencies)) {
+    const actual = dependencyPackage(name);
+    if (actual.version !== expected) throw new Error(`Host \u56FA\u5B9A\u4F9D\u8D56\u7248\u672C\u4E0D\u5339\u914D\uFF1A${name} expected ${expected}, got ${actual.version}`);
+    roots.add(actual.root);
+  }
+  return [...roots];
+}
+
+// apps/host/src/runtime-code-diagnostics.ts
+function safeGeneratedCssUrl(value) {
+  const trimmed = value.trim().replace(/^(["'])(.*)\1$/u, "$2");
+  if (trimmed.startsWith("data:")) return true;
+  if (!trimmed.startsWith("/generated/") || /[%\\?#\u0000-\u001F]/u.test(trimmed)) return false;
+  const segments = trimmed.slice("/generated/".length).split("/");
+  return segments.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+function cssBoundaryViolations(source) {
+  const withoutComments = source.replace(/\/\*[\s\S]*?\*\//gu, "");
+  const violations = [];
+  if (/@import\b/iu.test(withoutComments)) violations.push("\u4E1A\u52A1 CSS \u4E0D\u5141\u8BB8 @import");
+  for (const match of withoutComments.matchAll(/url\(\s*([^)]*?)\s*\)/giu)) {
+    if (!safeGeneratedCssUrl(match[1] ?? "")) {
+      violations.push("\u4E1A\u52A1 CSS \u7684 url() \u53EA\u5141\u8BB8 data: \u6216\u4E25\u683C\u7684 /generated/** \u8DEF\u5F84");
+    }
+  }
+  return violations;
+}
+function tsDiagnostic(args, diagnostic, virtualTargets = /* @__PURE__ */ new Map()) {
+  const target = diagnostic.file ? virtualTargets.get(filesystemPathKey(diagnostic.file.fileName)) : void 0;
+  const detail = ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n");
+  const message = `${target ? "\u9ED8\u8BA4\u5BFC\u51FA\u4E0D\u7B26\u5408 Runtime \u7EC4\u4EF6\u5951\u7EA6\uFF1A" : ""}${detail}`.slice(0, 1e3);
+  const file = diagnostic.file;
+  if (!file || diagnostic.start === void 0) return { severity: "error", source: "typescript", code: diagnostic.code, message };
+  const start = file.getLineAndCharacterOfPosition(diagnostic.start);
+  const endPosition = diagnostic.start + (diagnostic.length ?? 0);
+  const end = file.getLineAndCharacterOfPosition(Math.min(endPosition, file.text.length));
+  return {
+    severity: diagnostic.category === ts.DiagnosticCategory.Error ? "error" : diagnostic.category === ts.DiagnosticCategory.Warning ? "warning" : "info",
+    source: "typescript",
+    code: diagnostic.code,
+    message,
+    ...(() => {
+      const reportedFile = target ?? file.fileName;
+      const projectPath = relativeProjectPath(args.projectRoot, reportedFile);
+      if (projectPath) return { path: projectPath.slice(0, 1024) };
+      return containsPath(args.runtimeRoot, resolve2(reportedFile)) ? { path: `runtime/${normalizedRelative(relative2(args.runtimeRoot, reportedFile))}`.slice(0, 1024) } : {};
+    })(),
+    line: start.line + 1,
+    column: start.character + 1,
+    endLine: end.line + 1,
+    endColumn: end.character + 1
+  };
+}
+function businessImportDiagnostics(args, businessFiles, compilerOptions) {
+  const diagnostics = [];
+  const add = (file, node, source, message) => {
+    const start = file.getLineAndCharacterOfPosition(node.getStart(file));
+    diagnostics.push({
+      severity: "error",
+      source: "typescript",
+      code: "HARNESS_IMPORT_BOUNDARY",
+      message: `${message}\uFF1A${source}`.slice(0, 1e3),
+      ...relativeProjectPath(args.projectRoot, file.fileName) ? { path: relativeProjectPath(args.projectRoot, file.fileName).slice(0, 1024) } : {},
+      line: start.line + 1,
+      column: start.character + 1
+    });
+  };
+  const validate = (file, node, source) => {
+    const normalizedSource = source.replaceAll("\\", "/");
+    if (normalizedSource === "@harness/frontend-runtime") return;
+    if (/^(?:node:|https?:|data:)/iu.test(normalizedSource)) {
+      add(file, node, source, "\u5FEB\u901F\u524D\u53F0\u4E0D\u5141\u8BB8\u5BFC\u5165");
+      return;
+    }
+    if (normalizedSource.startsWith(".") || normalizedSource.startsWith("/") || isAbsolute2(source)) {
+      if (normalizedSource.startsWith("/") || isAbsolute2(source)) {
+        add(file, node, source, "\u4E1A\u52A1\u4EE3\u7801\u4E0D\u80FD\u4F7F\u7528\u7EDD\u5BF9\u5BFC\u5165");
+        return;
+      }
+      const candidate = resolve2(dirname2(file.fileName), normalizedSource);
+      if (!allowedProjectPath(args, candidate)) {
+        add(file, node, source, "\u4E1A\u52A1\u5BFC\u5165\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C");
+        return;
+      }
+      const resolvedModule = ts.resolveModuleName(source, file.fileName, compilerOptions, ts.sys).resolvedModule;
+      if (resolvedModule && existsSync2(resolvedModule.resolvedFileName)) {
+        const canonical = realpathSync2(resolvedModule.resolvedFileName);
+        if (!allowedProjectPath(args, canonical)) add(file, node, source, "\u4E1A\u52A1\u5BFC\u5165 canonical \u8DEF\u5F84\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C");
+      }
+      return;
+    }
+    const dependency = packageName(normalizedSource);
+    if (!BUSINESS_DEPENDENCIES.has(dependency)) add(file, node, source, "Runtime \u672A\u5411\u4E1A\u52A1\u4EE3\u7801\u516C\u5F00\u4F9D\u8D56");
+    else if (!safeBareSpecifier(normalizedSource, dependency)) add(file, node, source, "\u4F9D\u8D56\u5B50\u8DEF\u5F84\u4E0D\u5B89\u5168");
+  };
+  for (const path of businessFiles) {
+    const file = ts.createSourceFile(
+      path,
+      readFileSync2(path, "utf8"),
+      ts.ScriptTarget.ESNext,
+      true,
+      path.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
+    );
+    for (const reference of file.referencedFiles) {
+      validate(file, file, reference.fileName);
+    }
+    for (const reference of [...file.typeReferenceDirectives, ...file.libReferenceDirectives]) {
+      add(file, file, reference.fileName, "\u4E1A\u52A1\u4EE3\u7801\u4E0D\u5141\u8BB8\u4E09\u659C\u7EBF\u7C7B\u578B\u6216 lib \u5F15\u7528");
+    }
+    if (file.moduleName || file.amdDependencies.length > 0) {
+      add(file, file, file.moduleName ?? file.amdDependencies[0]?.name ?? "amd", "\u4E1A\u52A1\u4EE3\u7801\u4E0D\u5141\u8BB8 AMD \u6307\u4EE4");
+    }
+    const visit = (node) => {
+      if (ts.isMetaProperty(node) && node.keywordToken === ts.SyntaxKind.ImportKeyword) {
+        add(file, node, "import.meta", "\u4E1A\u52A1\u4EE3\u7801\u4E0D\u5141\u8BB8\u4F7F\u7528 import.meta\uFF08\u5305\u62EC glob \u4E0E\u57FA\u4E8E URL \u7684\u6587\u4EF6\u8BFB\u53D6\uFF09");
+      } else if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) {
+        validate(file, node.moduleSpecifier, node.moduleSpecifier.text);
+      } else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference) && node.moduleReference.expression && ts.isStringLiteralLike(node.moduleReference.expression)) {
+        validate(file, node.moduleReference.expression, node.moduleReference.expression.text);
+      } else if (ts.isImportTypeNode(node) && ts.isLiteralTypeNode(node.argument) && ts.isStringLiteralLike(node.argument.literal)) {
+        validate(file, node.argument.literal, node.argument.literal.text);
+      } else if (ts.isCallExpression(node) && node.arguments.length > 0 && ts.isStringLiteralLike(node.arguments[0]) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
+        validate(file, node.arguments[0], node.arguments[0].text);
+      }
+      if (diagnostics.length < 20) ts.forEachChild(node, visit);
+    };
+    visit(file);
+    if (diagnostics.length >= 20) break;
+  }
+  return diagnostics.slice(0, 20);
+}
+var WEB_STORAGE_NAMES = /* @__PURE__ */ new Set(["localStorage", "sessionStorage"]);
+var WEB_STORAGE_GLOBALS = /* @__PURE__ */ new Set(["globalThis", "self", "window"]);
+function businessWebStorageDiagnostics(args, program, businessFiles) {
+  const diagnostics = [];
+  const checker = program.getTypeChecker();
+  const add = (file, node, storageName) => {
+    if (diagnostics.length >= 20) return;
+    const start = file.getLineAndCharacterOfPosition(node.getStart(file));
+    diagnostics.push({
+      severity: "error",
+      source: "runtime",
+      code: "HARNESS_UNSAFE_WEB_STORAGE",
+      message: `\u5FEB\u901F\u524D\u53F0\u9884\u89C8\u4E0D\u80FD\u76F4\u63A5\u8BBF\u95EE ${storageName}\uFF1B\u8BF7\u4ECE @harness/frontend-runtime \u5BFC\u5165 getFrontendStorage(namespace) \u5E76\u4F7F\u7528\u5176\u540C\u6B65\u5B58\u50A8\u63A5\u53E3\u3002`,
+      ...relativeProjectPath(args.projectRoot, file.fileName) ? { path: relativeProjectPath(args.projectRoot, file.fileName).slice(0, 1024) } : {},
+      line: start.line + 1,
+      column: start.character + 1
+    });
+  };
+  const isBusinessDeclaration = (node) => {
+    const declarations = checker.getSymbolAtLocation(node)?.declarations ?? [];
+    return declarations.some((declaration) => containsPath(args.projectRoot, resolve2(declaration.getSourceFile().fileName)));
+  };
+  const isDomStorageProperty = (node) => {
+    const declarations = checker.getSymbolAtLocation(node)?.declarations ?? [];
+    return declarations.some((declaration) => /(?:^|[/\\])lib\.dom\.d\.ts$/u.test(declaration.getSourceFile().fileName));
+  };
+  const unwrapExpression = (expression) => {
+    let current = expression;
+    while (ts.isParenthesizedExpression(current) || ts.isAsExpression(current) || ts.isTypeAssertionExpression(current) || ts.isNonNullExpression(current)) {
+      current = current.expression;
+    }
+    return current;
+  };
+  const referencesBrowserGlobal = (expression, seen = /* @__PURE__ */ new Set()) => {
+    const current = unwrapExpression(expression);
+    if (ts.isIdentifier(current)) {
+      const symbol = checker.getSymbolAtLocation(current);
+      if (WEB_STORAGE_GLOBALS.has(current.text) && !isBusinessDeclaration(current)) return true;
+      if (symbol === void 0 || seen.has(symbol)) return false;
+      seen.add(symbol);
+      for (const declaration of symbol.declarations ?? []) {
+        if (ts.isVariableDeclaration(declaration) && declaration.initializer !== void 0 && referencesBrowserGlobal(declaration.initializer, seen)) return true;
+      }
+      return false;
+    }
+    if (ts.isConditionalExpression(current)) {
+      return referencesBrowserGlobal(current.whenTrue, new Set(seen)) || referencesBrowserGlobal(current.whenFalse, new Set(seen));
+    }
+    if (ts.isBinaryExpression(current) && (current.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken || current.operatorToken.kind === ts.SyntaxKind.BarBarToken)) {
+      return referencesBrowserGlobal(current.left, new Set(seen)) || referencesBrowserGlobal(current.right, new Set(seen));
+    }
+    return false;
+  };
+  const destructuresGlobalStorage = (node) => {
+    const element = node.parent;
+    if (!ts.isBindingElement(element) || element.name !== node && element.propertyName !== node || !ts.isObjectBindingPattern(element.parent)) return false;
+    const declaration = element.parent.parent;
+    return ts.isVariableDeclaration(declaration) && declaration.initializer !== void 0 && referencesBrowserGlobal(declaration.initializer);
+  };
+  for (const path of businessFiles) {
+    const file = program.getSourceFile(path);
+    if (file === void 0) continue;
+    const visit = (node) => {
+      if (diagnostics.length >= 20) return;
+      if (ts.isIdentifier(node) && WEB_STORAGE_NAMES.has(node.text)) {
+        const parent = node.parent;
+        if (ts.isPropertyAccessExpression(parent) && parent.name === node) {
+          if (referencesBrowserGlobal(parent.expression) || isDomStorageProperty(node)) {
+            add(file, node, node.text);
+          }
+        } else if (destructuresGlobalStorage(node) || !isBusinessDeclaration(node)) {
+          add(file, node, node.text);
+        }
+      } else if (ts.isStringLiteralLike(node) && WEB_STORAGE_NAMES.has(node.text) && ts.isElementAccessExpression(node.parent) && node.parent.argumentExpression === node && referencesBrowserGlobal(node.parent.expression)) {
+        add(file, node, node.text);
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(file);
+    if (diagnostics.length >= 20) break;
+  }
+  return diagnostics;
+}
+async function businessCssDiagnostics(args) {
+  const srcRoot = join3(args.projectRoot, "src");
+  const files = await businessFilesIfPresent(srcRoot);
+  const diagnostics = [];
+  for (const path of files.filter((entry) => entry.endsWith(".css"))) {
+    for (const message of cssBoundaryViolations(await readFile(path, "utf8"))) {
+      diagnostics.push({
+        severity: "error",
+        source: "runtime",
+        code: "HARNESS_CSS_BOUNDARY",
+        message,
+        ...relativeProjectPath(args.projectRoot, path) ? { path: relativeProjectPath(args.projectRoot, path) } : {}
+      });
+      if (diagnostics.length >= 20) return diagnostics;
+    }
+  }
+  return diagnostics;
+}
+
+// apps/host/src/runtime-route-diagnostics.ts
+import { statSync as statSync2 } from "node:fs";
+import { lstat as lstat2, readFile as readFile2 } from "node:fs/promises";
+import { dirname as dirname3, join as join4, relative as relative3, sep as sep2 } from "node:path";
+var ROUTE_KEYS = /* @__PURE__ */ new Set(["id", "path", "title", "icon", "order", "parentId", "hidden"]);
+var ROUTE_ICONS = /* @__PURE__ */ new Set([
+  "AppstoreOutlined",
+  "BarChartOutlined",
+  "DashboardOutlined",
+  "FileTextOutlined",
+  "FormOutlined",
+  "HomeOutlined",
+  "SettingOutlined",
+  "TeamOutlined",
+  "UnorderedListOutlined"
+]);
+async function appManifest(args) {
+  const appPath = join4(args.projectRoot, "src", "app.json");
+  const relativePath = "src/app.json";
+  try {
+    const value = JSON.parse(await readFile2(appPath, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("app.json \u5FC5\u987B\u662F\u5BF9\u8C61");
+    const raw = value;
+    const extra = Object.keys(raw).find((key) => !(/* @__PURE__ */ new Set(["name", "logo", "theme"])).has(key));
+    if (extra) throw new Error(`\u4E0D\u652F\u6301\u7684\u5E94\u7528\u5B57\u6BB5\uFF1A${extra}`);
+    if (raw.name !== void 0 && (typeof raw.name !== "string" || raw.name.trim().length === 0 || raw.name.length > 160)) {
+      throw new Error("name \u5FC5\u987B\u4E3A 1\u2013160 \u5B57\u7B26");
+    }
+    if (raw.logo !== void 0 && (typeof raw.logo !== "string" || raw.logo.length > 2048 || !/^\.\/generated\/(?:[^./][^/]*\/)*[^./][^/]*$/u.test(raw.logo))) {
+      throw new Error("logo \u5FC5\u987B\u662F ./generated/** \u4E0B\u7684\u76F8\u5BF9\u8D44\u6E90\u8DEF\u5F84");
+    }
+    if (raw.theme !== void 0) {
+      if (!raw.theme || typeof raw.theme !== "object" || Array.isArray(raw.theme)) throw new Error("theme \u5FC5\u987B\u662F\u5BF9\u8C61");
+      const theme = raw.theme;
+      const themeExtra = Object.keys(theme).find((key) => !(/* @__PURE__ */ new Set(["colorPrimary", "borderRadius", "compact"])).has(key));
+      if (themeExtra) throw new Error(`\u4E0D\u652F\u6301\u7684\u4E3B\u9898\u5B57\u6BB5\uFF1A${themeExtra}`);
+      if (theme.colorPrimary !== void 0 && (typeof theme.colorPrimary !== "string" || !/^#[0-9a-fA-F]{6}$/u.test(theme.colorPrimary))) {
+        throw new Error("theme.colorPrimary \u5FC5\u987B\u662F\u516D\u4F4D\u5341\u516D\u8FDB\u5236\u989C\u8272");
+      }
+      if (theme.borderRadius !== void 0 && (typeof theme.borderRadius !== "number" || !Number.isSafeInteger(theme.borderRadius) || theme.borderRadius < 0 || theme.borderRadius > 24)) {
+        throw new Error("theme.borderRadius \u5FC5\u987B\u662F 0\u201324 \u7684\u6574\u6570");
+      }
+      if (theme.compact !== void 0 && typeof theme.compact !== "boolean") throw new Error("theme.compact \u5FC5\u987B\u662F\u5E03\u5C14\u503C");
+    }
+    return { manifest: raw, diagnostics: [] };
+  } catch (error) {
+    const code = filesystemErrorCode(error);
+    if (code === "ENOENT") return { manifest: {}, diagnostics: [] };
+    if (code) throw error;
+    return {
+      manifest: {},
+      diagnostics: [{
+        severity: "error",
+        source: "route",
+        message: (error instanceof Error ? error.message : "app.json \u65E0\u6548").slice(0, 8e3),
+        path: relativePath
+      }]
+    };
+  }
+}
+async function routeRegistry(args) {
+  const diagnostics = [];
+  const pagesRoot = join4(args.projectRoot, "src", "pages");
+  const info = await lstat2(pagesRoot).catch((error) => {
+    if (filesystemErrorCode(error) === "ENOENT") return void 0;
+    throw error;
+  });
+  if (!info?.isDirectory() || info.isSymbolicLink()) return { routes: [], diagnostics };
+  const pageFiles = await walkBusinessFiles(pagesRoot);
+  const routeFiles = pageFiles.filter((path) => path.endsWith(`${sep2}route.json`));
+  const routeDirectories = new Set(routeFiles.map((path) => dirname3(path)));
+  for (const pagePath of pageFiles.filter((path) => path.endsWith(`${sep2}page.tsx`))) {
+    if (!routeDirectories.has(dirname3(pagePath))) diagnostics.push({
+      severity: "error",
+      source: "route",
+      code: "HARNESS_MISSING_ROUTE",
+      message: "\u9875\u9762\u7F3A\u5C11\u540C\u76EE\u5F55\u7684 route.json",
+      path: normalizedRelative(relative3(args.projectRoot, pagePath))
+    });
+  }
+  const routes = [];
+  const ids = /* @__PURE__ */ new Map();
+  const paths = /* @__PURE__ */ new Map();
+  for (const routePath of routeFiles) {
+    const path = normalizedRelative(relative3(args.projectRoot, routePath));
+    try {
+      const raw = JSON.parse(await readFile2(routePath, "utf8"));
+      const extra = Object.keys(raw).find((key) => !ROUTE_KEYS.has(key));
+      if (extra) throw new Error(`\u4E0D\u652F\u6301\u7684\u8DEF\u7531\u5B57\u6BB5\uFF1A${extra}`);
+      if (typeof raw.id !== "string" || raw.id.length > 160 || !/^[a-zA-Z0-9][a-zA-Z0-9._:-]*$/u.test(raw.id)) throw new Error("id \u5FC5\u987B\u662F 160 \u5B57\u7B26\u5185\u7684\u7A33\u5B9A\u6807\u8BC6\u7B26");
+      if (typeof raw.path !== "string" || raw.path.length > 1024 || !raw.path.startsWith("/") || raw.path.includes("..")) throw new Error("path \u5FC5\u987B\u662F 1024 \u5B57\u7B26\u5185\u3001\u4EE5 / \u5F00\u5934\u7684\u5E94\u7528\u8DEF\u7531");
+      if (typeof raw.title !== "string" || raw.title.trim().length === 0 || raw.title.length > 160) throw new Error("title \u5FC5\u987B\u4E3A 1\u2013160 \u5B57\u7B26");
+      if (raw.icon !== void 0 && (typeof raw.icon !== "string" || !ROUTE_ICONS.has(raw.icon))) throw new Error("icon \u4E0D\u5728 Runtime \u652F\u6301\u5217\u8868\u4E2D");
+      if (raw.parentId !== void 0 && (typeof raw.parentId !== "string" || raw.parentId.length > 160 || !/^[a-zA-Z0-9][a-zA-Z0-9._:-]*$/u.test(raw.parentId))) throw new Error("parentId \u5FC5\u987B\u662F\u6709\u6548\u8DEF\u7531\u6807\u8BC6\u7B26");
+      if (raw.order !== void 0 && (typeof raw.order !== "number" || !Number.isSafeInteger(raw.order))) throw new Error("order \u5FC5\u987B\u662F\u6574\u6570");
+      if (raw.hidden !== void 0 && typeof raw.hidden !== "boolean") throw new Error("hidden \u5FC5\u987B\u662F\u5E03\u5C14\u503C");
+      const pagePath = join4(dirname3(routePath), "page.tsx");
+      let pageInfo;
+      try {
+        pageInfo = statSync2(pagePath);
+      } catch (error) {
+        const code = filesystemErrorCode(error);
+        if (code === "ENOENT" || code === "ENOTDIR") throw new Error("\u540C\u76EE\u5F55\u7F3A\u5C11 page.tsx");
+        throw error;
+      }
+      if (!pageInfo.isFile()) throw new Error("\u540C\u76EE\u5F55\u7F3A\u5C11 page.tsx");
+      const priorId = ids.get(raw.id);
+      if (priorId) throw new Error(`\u8DEF\u7531 id \u4E0E ${priorId} \u91CD\u590D`);
+      const priorPath = paths.get(raw.path);
+      if (priorPath) throw new Error(`\u8DEF\u7531 path \u4E0E ${priorPath} \u91CD\u590D`);
+      ids.set(raw.id, path);
+      paths.set(raw.path, path);
+      routes.push({
+        metadata: {
+          id: raw.id,
+          path: raw.path,
+          title: raw.title,
+          ...typeof raw.icon === "string" ? { icon: raw.icon } : {},
+          ...typeof raw.order === "number" && Number.isFinite(raw.order) ? { order: raw.order } : {},
+          ...typeof raw.parentId === "string" ? { parentId: raw.parentId } : {},
+          ...typeof raw.hidden === "boolean" ? { hidden: raw.hidden } : {}
+        },
+        pagePath
+      });
+    } catch (error) {
+      if (filesystemErrorCode(error)) throw error;
+      diagnostics.push({
+        severity: "error",
+        source: "route",
+        message: (error instanceof Error ? error.message : "\u8DEF\u7531 JSON \u65E0\u6548").slice(0, 8e3),
+        path
+      });
+    }
+  }
+  for (const route of routes) {
+    if (route.metadata.parentId && !ids.has(route.metadata.parentId)) {
+      diagnostics.push({
+        severity: "error",
+        source: "route",
+        message: `parentId \u4E0D\u5B58\u5728\uFF1A${route.metadata.parentId}`,
+        ...ids.get(route.metadata.id) ? { path: ids.get(route.metadata.id) } : {}
+      });
+      continue;
+    }
+    const visited = /* @__PURE__ */ new Set();
+    let current = route.metadata;
+    while (current?.parentId) {
+      if (visited.has(current.id)) {
+        diagnostics.push({
+          severity: "error",
+          source: "route",
+          message: "\u8DEF\u7531\u7236\u5B50\u5173\u7CFB\u5B58\u5728\u5FAA\u73AF",
+          ...ids.get(route.metadata.id) ? { path: ids.get(route.metadata.id) } : {}
+        });
+        break;
+      }
+      visited.add(current.id);
+      current = routes.find((entry) => entry.metadata.id === current.parentId)?.metadata;
+    }
+  }
+  routes.sort((left, right) => (left.metadata.order ?? 0) - (right.metadata.order ?? 0) || left.metadata.id.localeCompare(right.metadata.id));
+  return { routes, diagnostics };
+}
+
+// apps/host/src/runtime-diagnostics.ts
+var RuntimeDiagnosticEngine = class {
+  #previousProgram;
+  dispose() {
+    this.#previousProgram = void 0;
+  }
+  async collect(args) {
+    const [routes, app, css] = await Promise.all([routeRegistry(args), appManifest(args), businessCssDiagnostics(args)]);
+    const types = await this.#typeDiagnostics(args, routes.routes.map((route) => route.pagePath));
+    const diagnostics = [...routes.diagnostics, ...app.diagnostics, ...css, ...types];
+    if (routes.routes.length === 0 && !diagnostics.some((diagnostic) => diagnostic.severity === "error")) {
+      diagnostics.push({ severity: "info", source: "runtime", code: "HARNESS_NO_PAGES", message: "\u5C1A\u65E0\u53EF\u9884\u89C8\u9875\u9762\u3002\u53EF\u4EE5\u7EE7\u7EED\u5BF9\u8BDD\uFF0C\u6309\u9700\u521B\u5EFA\u9875\u9762\u3002" });
+    }
+    return diagnostics.slice(0, 20).map((diagnostic) => ({
+      ...diagnostic,
+      message: diagnostic.message.slice(0, 1e3),
+      ...diagnostic.path ? { path: diagnostic.path.slice(0, 1024) } : {}
+    }));
+  }
+  async #typeDiagnostics(args, routedPages) {
+    const srcRoot = join5(args.projectRoot, "src");
+    const files = await businessFilesIfPresent(srcRoot);
+    const businessRootNames = files.filter((path) => /\.(?:ts|tsx)$/u.test(path));
+    const declarationFile = assertRegularContainedFile(args.runtimeRoot, args.typeDeclarations, "Runtime type declarations");
+    const options = {
+      allowJs: false,
+      esModuleInterop: true,
+      jsx: ts2.JsxEmit.ReactJSX,
+      module: ts2.ModuleKind.ESNext,
+      moduleResolution: ts2.ModuleResolutionKind.Bundler,
+      noEmit: true,
+      resolveJsonModule: true,
+      skipLibCheck: true,
+      strict: true,
+      target: ts2.ScriptTarget.ES2022,
+      types: []
+    };
+    const importDiagnostics = businessImportDiagnostics(args, businessRootNames, options);
+    if (importDiagnostics.length > 0) return importDiagnostics;
+    const host = ts2.createCompilerHost(options);
+    const resolutionCache = ts2.createModuleResolutionCache(args.projectRoot, host.getCanonicalFileName, options);
+    const virtualFiles = /* @__PURE__ */ new Map();
+    for (const [index, pagePath] of routedPages.entries()) {
+      virtualFiles.set(join5(dirname4(pagePath), ".harness-page-contract.ts"), {
+        source: [
+          'import type { FrontendPageComponent } from "@harness/frontend-runtime";',
+          'import Page from "./page";',
+          `const page${index}: FrontendPageComponent = Page;`,
+          ""
+        ].join("\n"),
+        target: pagePath
+      });
+    }
+    const providerPath = join5(args.projectRoot, "src", "app", "providers.tsx");
+    if (existsSync3(providerPath)) {
+      virtualFiles.set(join5(dirname4(providerPath), ".harness-provider-contract.ts"), {
+        source: [
+          'import type { FrontendRuntimeProvider } from "@harness/frontend-runtime";',
+          'import Provider from "./providers";',
+          "const provider: FrontendRuntimeProvider = Provider;",
+          ""
+        ].join("\n"),
+        target: providerPath
+      });
+    }
+    const virtualFilesByKey = new Map([...virtualFiles].map(([fileName, value]) => [filesystemPathKey(fileName), value]));
+    const originalFileExists = host.fileExists.bind(host);
+    const originalReadFile = host.readFile.bind(host);
+    const originalGetSourceFile = host.getSourceFile.bind(host);
+    host.fileExists = (fileName) => virtualFilesByKey.has(filesystemPathKey(fileName)) || originalFileExists(fileName);
+    host.readFile = (fileName) => virtualFilesByKey.get(filesystemPathKey(fileName))?.source ?? originalReadFile(fileName);
+    host.getSourceFile = (fileName, languageVersionOrOptions, onError, shouldCreateNewSourceFile) => {
+      const virtual = virtualFilesByKey.get(filesystemPathKey(fileName));
+      return virtual ? ts2.createSourceFile(fileName, virtual.source, languageVersionOrOptions, true, ts2.ScriptKind.TS) : originalGetSourceFile(fileName, languageVersionOrOptions, onError, shouldCreateNewSourceFile);
+    };
+    const originalResolve = host.resolveModuleNames;
+    host.resolveModuleNames = (moduleNames, containingFile, reusedNames, redirectedReference, compilerOptions) => moduleNames.map((moduleName) => {
+      const businessImporter = containsPath(args.projectRoot, resolve3(containingFile));
+      const runtimeImporter = containsPath(args.runtimeRoot, resolve3(containingFile));
+      if (moduleName === "@harness/frontend-runtime") {
+        return { resolvedFileName: declarationFile, extension: ts2.Extension.Dts };
+      }
+      if ((businessImporter || runtimeImporter) && !moduleName.startsWith(".") && !isAbsolute3(moduleName)) {
+        const dependency = packageName(moduleName);
+        if (moduleName === VIRTUAL_REGISTRY) return void 0;
+        if (businessImporter ? !BUSINESS_DEPENDENCIES.has(dependency) : !Object.hasOwn(args.dependencies, dependency)) return void 0;
+        if (!safeBareSpecifier(moduleName, dependency)) return void 0;
+        const fromHost = ts2.resolveModuleName(moduleName, workerModulePath, compilerOptions, ts2.sys, resolutionCache).resolvedModule;
+        if (fromHost) {
+          const roots = [dependencyPackage(dependency).root];
+          const typeDependency = dependency === "react" ? "@types/react" : dependency === "react-dom" ? "@types/react-dom" : dependency === "node" ? "@types/node" : void 0;
+          if (typeDependency && Object.hasOwn(args.dependencies, typeDependency)) roots.push(dependencyPackage(typeDependency).root);
+          const canonical = realpathSync3(fromHost.resolvedFileName);
+          if (roots.some((root) => containsPath(root, canonical))) return fromHost;
+          return void 0;
+        }
+        const target = dependencyTypeTarget(moduleName);
+        if (target) return { resolvedFileName: target, extension: ts2.Extension.Js };
+      }
+      const resolvedModule = originalResolve?.(moduleNames, containingFile, reusedNames, redirectedReference, compilerOptions)?.[moduleNames.indexOf(moduleName)] ?? ts2.resolveModuleName(moduleName, containingFile, compilerOptions, ts2.sys, resolutionCache).resolvedModule;
+      if (!businessImporter || !resolvedModule) return resolvedModule;
+      if (!moduleName.startsWith(".") && !isAbsolute3(moduleName)) return resolvedModule;
+      const candidate = resolve3(dirname4(containingFile), moduleName);
+      if (!allowedProjectPath(args, candidate) || !existsSync3(resolvedModule.resolvedFileName)) return void 0;
+      return allowedProjectPath(args, realpathSync3(resolvedModule.resolvedFileName)) ? resolvedModule : void 0;
+    });
+    const runtimeRootNames = (await walkBusinessFiles(args.runtimeRoot)).filter((path) => /\.(?:ts|tsx)$/u.test(path));
+    const rootNames = [.../* @__PURE__ */ new Set([...businessRootNames, ...runtimeRootNames, declarationFile, ...virtualFiles.keys()])];
+    const program = ts2.createProgram({ rootNames, options, host, ...this.#previousProgram ? { oldProgram: this.#previousProgram } : {} });
+    this.#previousProgram = program;
+    const virtualTargets = new Map([...virtualFiles].map(([path, value]) => [filesystemPathKey(path), value.target]));
+    return [
+      ...businessWebStorageDiagnostics(args, program, businessRootNames),
+      ...ts2.getPreEmitDiagnostics(program).map((diagnostic) => tsDiagnostic(args, diagnostic, virtualTargets))
+    ].slice(0, 20);
+  }
+};
+
+// apps/host/src/runtime-compile-session.ts
+var RuntimeCompileSession = class {
+  constructor(publish) {
+    this.publish = publish;
+  }
+  publish;
+  #diagnostics = new RuntimeDiagnosticEngine();
+  #sourceRevision = 0;
+  #successfulSourceRevision;
+  #diagnosticsRevision = 0;
+  #tail = Promise.resolve();
+  get sourceRevision() {
+    return this.#sourceRevision;
+  }
+  get successfulSourceRevision() {
+    return this.#successfulSourceRevision;
+  }
+  async #inspect(args) {
+    const revision = ++this.#sourceRevision;
+    this.publish(this.#state("compiling", revision, [], false));
+    return { revision, diagnostics: await this.#diagnostics.collect(args) };
+  }
+  #enqueue(operation) {
+    const running = this.#tail.then(operation);
+    this.#tail = running.catch(() => void 0);
+    return running;
+  }
+  inspectCandidate(args) {
+    return this.#enqueue(() => this.#inspect(args));
+  }
+  compile(args) {
+    return this.#enqueue(async () => {
+      try {
+        const { revision, diagnostics } = await this.#inspect(args);
+        return this.finish(revision, diagnostics, !diagnostics.some((diagnostic) => diagnostic.severity === "error"));
+      } catch (error) {
+        this.reportRuntimeFailure(error);
+        throw error;
+      }
+    });
+  }
+  /** Only accept after the preview controller successfully publishes its candidate. */
+  finish(revision, diagnostics, accepted) {
+    if (accepted) this.#successfulSourceRevision = revision;
+    const state = this.#state(accepted ? "success" : "failed", revision, diagnostics, true);
+    this.publish(state);
+    return state;
+  }
+  reportRuntimeFailure(error) {
+    this.finish(++this.#sourceRevision, [{
+      severity: "error",
+      source: "runtime",
+      code: "HARNESS_RUNTIME_INFRASTRUCTURE",
+      message: (error instanceof Error ? error.message : String(error)).slice(0, 8e3)
+    }], false);
+  }
+  #state(status, revision, diagnostics, completed) {
+    return {
+      status,
+      sourceRevision: revision,
+      ...this.#successfulSourceRevision === void 0 ? {} : { successfulSourceRevision: this.#successfulSourceRevision },
+      diagnosticsRevision: completed ? ++this.#diagnosticsRevision : this.#diagnosticsRevision,
+      diagnostics,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  async dispose() {
+    await this.#tail;
+    this.#diagnostics.dispose();
+  }
+};
+
+// apps/host/src/runtime-preview-contracts.ts
+import "vite";
+var RESOLVED_REGISTRY = "\0virtual:harness-business-registry";
+var VIRTUAL_BUSINESS_PREFIX = "virtual:harness-business/";
+var RESOLVED_BUSINESS_PREFIX = "/@harness-business/";
+var EVENT_PREFIX = "HARNESS_RUNTIME_EVENT ";
+
+// apps/host/src/runtime-export-assets.ts
+import { realpathSync as realpathSync4 } from "node:fs";
+import { copyFile, lstat as lstat3, mkdir, readFile as readFile3, writeFile } from "node:fs/promises";
+import { dirname as dirname5, join as join6, relative as relative4 } from "node:path";
+async function copyGeneratedAssets(args) {
+  if (!args.outDir) return;
+  const sourceRoot = join6(args.projectRoot, "public", "generated");
+  const info = await lstat3(sourceRoot).catch(() => void 0);
+  if (!info) return;
+  if (!info.isDirectory() || info.isSymbolicLink() || !sameFilesystemPath(sourceRoot, realpathSync4(sourceRoot))) {
+    throw new Error("public/generated \u5FC5\u987B\u662F\u672A\u91CD\u5B9A\u5411\u7684\u666E\u901A\u76EE\u5F55");
+  }
+  const destinationRoot = join6(args.outDir, "generated");
+  for (const source of await walkBusinessFiles(sourceRoot)) {
+    const canonical = realpathSync4(source);
+    if (!containsPath(sourceRoot, canonical) || !sameFilesystemPath(source, canonical)) {
+      throw new Error(`\u751F\u6210\u8D44\u6E90\u8D8A\u8FC7\u5141\u8BB8\u8FB9\u754C\uFF1A${normalizedRelative(relative4(sourceRoot, source))}`);
+    }
+    const destination = join6(destinationRoot, relative4(sourceRoot, source));
+    await mkdir(dirname5(destination), { recursive: true });
+    await copyFile(source, destination);
+  }
+}
+async function rewriteExportedGeneratedCss(args) {
+  if (!args.outDir) return;
+  const info = await lstat3(args.outDir).catch(() => void 0);
+  if (!info?.isDirectory() || info.isSymbolicLink()) return;
+  for (const path of await walkBusinessFiles(args.outDir)) {
+    if (!path.endsWith(".css")) continue;
+    const source = await readFile3(path, "utf8");
+    const rewritten = source.replace(
+      /url\(\s*(["']?)\/generated\/([^)'"\r\n]+)\1\s*\)/gu,
+      (_match, quote, asset) => `url(${quote}../generated/${asset}${quote})`
+    );
+    if (rewritten !== source) await writeFile(path, rewritten, "utf8");
+  }
+}
+
+// apps/host/src/runtime-vite-config.ts
+import { existsSync as existsSync6, realpathSync as realpathSync7 } from "node:fs";
+import { join as join9, resolve as resolve7 } from "node:path";
+import react from "@vitejs/plugin-react";
+import { normalizePath as normalizePath2 } from "vite";
+
+// apps/host/src/runtime-vite-business.ts
+import { readFile as readFile4 } from "node:fs/promises";
+import { posix as posix2, resolve as resolve4 } from "node:path";
+import "vite";
+
+// apps/host/src/preview-jsx-instrumentation.ts
+import { createHash } from "node:crypto";
+import MagicString from "magic-string";
+import ts3 from "typescript";
+
+// apps/host/src/preview-source-token.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+var PREVIEW_SOURCE_ATTRIBUTE = "data-harness-source";
+var PREVIEW_SOURCE_TOKEN_VERSION = 1;
+function validDescriptor(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const descriptor = value;
+  return descriptor.v === PREVIEW_SOURCE_TOKEN_VERSION && typeof descriptor.path === "string" && descriptor.path.length > 0 && descriptor.path.length <= 1024 && !descriptor.path.startsWith("/") && !descriptor.path.includes("\\") && !descriptor.path.split("/").some((segment) => segment === "" || segment === "." || segment === "..") && typeof descriptor.hash === "string" && /^[a-f0-9]{64}$/u.test(descriptor.hash) && Number.isSafeInteger(descriptor.startLine) && descriptor.startLine > 0 && Number.isSafeInteger(descriptor.endLine) && descriptor.endLine >= descriptor.startLine;
+}
+function signPreviewSourceToken(secret, descriptor) {
+  if (!validDescriptor(descriptor) || secret.length < 32) throw new Error("Invalid preview source token input");
+  const payload = Buffer.from(JSON.stringify(descriptor), "utf8").toString("base64url");
+  const signature = createHmac("sha256", secret).update(payload).digest("base64url");
+  return `${payload}.${signature}`;
+}
+
+// apps/host/src/preview-jsx-instrumentation.ts
+function instrumentBusinessJsx(source, relativePath, secret) {
+  const sourceFile = ts3.createSourceFile(
+    relativePath,
+    source,
+    ts3.ScriptTarget.ESNext,
+    true,
+    relativePath.toLowerCase().endsWith(".tsx") ? ts3.ScriptKind.TSX : ts3.ScriptKind.JSX
+  );
+  const hash = createHash("sha256").update(source).digest("hex");
+  const magic = new MagicString(source);
+  const insertions = [];
+  const visit = (node) => {
+    if (ts3.isJsxOpeningElement(node) || ts3.isJsxSelfClosingElement(node)) {
+      for (const property of node.attributes.properties) {
+        if (ts3.isJsxAttribute(property) && property.name.getText(sourceFile) === PREVIEW_SOURCE_ATTRIBUTE) {
+          throw new Error(`\u4E1A\u52A1 JSX \u4E0D\u5141\u8BB8\u58F0\u660E\u4FDD\u7559\u5C5E\u6027 ${PREVIEW_SOURCE_ATTRIBUTE}\uFF1A${relativePath}`);
+        }
+      }
+      const rangeNode = ts3.isJsxOpeningElement(node) && ts3.isJsxElement(node.parent) ? node.parent : node;
+      const start = sourceFile.getLineAndCharacterOfPosition(rangeNode.getStart(sourceFile));
+      const end = sourceFile.getLineAndCharacterOfPosition(Math.max(rangeNode.getStart(sourceFile), rangeNode.getEnd() - 1));
+      const token = signPreviewSourceToken(secret, {
+        v: 1,
+        path: relativePath,
+        hash,
+        startLine: start.line + 1,
+        endLine: end.line + 1
+      });
+      insertions.push({
+        position: node.attributes.end,
+        text: ` ${PREVIEW_SOURCE_ATTRIBUTE}=${JSON.stringify(token)}`
+      });
+    }
+    ts3.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  for (const insertion of insertions.reverse()) magic.appendLeft(insertion.position, insertion.text);
+  return {
+    code: magic.toString(),
+    map: magic.generateMap({ source: relativePath, includeContent: true, hires: true })
+  };
+}
+
+// apps/host/src/runtime-business-ids.ts
+import { isAbsolute as isAbsolute4 } from "node:path";
+function virtualBusinessRelative(id) {
+  const clean = id.split("?", 1)[0];
+  const prefix = clean.startsWith(RESOLVED_BUSINESS_PREFIX) ? RESOLVED_BUSINESS_PREFIX : clean.startsWith(VIRTUAL_BUSINESS_PREFIX) ? VIRTUAL_BUSINESS_PREFIX : void 0;
+  if (!prefix) return void 0;
+  const candidate = normalizedRelative(clean.slice(prefix.length));
+  if (!candidate || candidate.startsWith("../") || candidate.includes("/../") || isAbsolute4(candidate)) return void 0;
+  return candidate;
+}
+function virtualBusinessId(relativePath) {
+  return `${VIRTUAL_BUSINESS_PREFIX}${normalizedRelative(relativePath)}`;
+}
+
+// apps/host/src/runtime-vite-business.ts
+function businessSourcePlugin(args, sources) {
+  return {
+    name: "harness-accepted-business-source",
+    enforce: "pre",
+    resolveId(source, importer) {
+      const direct = virtualBusinessRelative(source);
+      if (direct) {
+        if (!allowedProjectPath(args, resolve4(args.projectRoot, direct))) throw new Error(`\u4E1A\u52A1\u6A21\u5757\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C\uFF1A${direct}`);
+        const resolved2 = businessModuleCandidate(sources.currentRoot, direct);
+        if (!resolved2) throw new Error(`\u5DF2\u63A5\u53D7\u7684\u4E1A\u52A1\u6A21\u5757\u4E0D\u5B58\u5728\uFF1A${direct}`);
+        return `${RESOLVED_BUSINESS_PREFIX}${resolved2}`;
+      }
+      const importerPath = importer ? virtualBusinessRelative(importer) : void 0;
+      if (!importerPath || !source.startsWith(".")) return null;
+      const requested = normalizedRelative(posix2.normalize(posix2.join(posix2.dirname(importerPath), source)));
+      if (!requested || requested.startsWith("../") || requested.includes("/../") || !allowedProjectPath(args, resolve4(args.projectRoot, requested))) {
+        throw new Error(`\u4E1A\u52A1\u5BFC\u5165\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C\uFF1A${source}`);
+      }
+      const resolved = businessModuleCandidate(sources.currentRoot, requested);
+      if (!resolved) return null;
+      return `${RESOLVED_BUSINESS_PREFIX}${resolved}`;
+    },
+    async load(id) {
+      const path = virtualBusinessRelative(id);
+      if (!path) return null;
+      const source = await readFile4(sources.acceptedPath(path), "utf8");
+      const secret = process.env.HARNESS_PREVIEW_SOURCE_TOKEN_SECRET;
+      if (!secret || !editableProjectPath(args, path) || !/\.(?:jsx|tsx)$/iu.test(path)) return source;
+      return instrumentBusinessJsx(source, path, secret);
+    }
+  };
+}
+
+// apps/host/src/runtime-vite-dependencies.ts
+import { existsSync as existsSync4, lstatSync as lstatSync2, realpathSync as realpathSync5 } from "node:fs";
+import { dirname as dirname7, isAbsolute as isAbsolute5, resolve as resolve5 } from "node:path";
+import ts4 from "typescript";
+import "vite";
+var LAZY_PREBUNDLED_DEPENDENCY_SOURCES = ["@ant-design/charts"];
+function dependencyResolver(args, sources) {
+  const sdkEntry = assertRegularContainedFile(args.runtimeRoot, args.runtimeSdkEntry, "Runtime SDK entry");
+  return {
+    name: "harness-runtime-import-boundary",
+    enforce: "pre",
+    transform(code, id) {
+      const cleanId = id.split("?", 1)[0];
+      const virtualPath = virtualBusinessRelative(cleanId);
+      const physicalBusiness = containsPath(args.projectRoot, cleanId);
+      if (!physicalBusiness && !virtualPath) return null;
+      const canonical = virtualPath && sources ? sources.acceptedPath(virtualPath) : realpathSync5(cleanId);
+      const relativePath = virtualPath ?? relativeProjectPath(args.projectRoot, canonical);
+      if (!relativePath || !allowedProjectPath(args, resolve5(args.projectRoot, relativePath))) {
+        throw new Error(`\u4E1A\u52A1\u6A21\u5757 canonical \u8DEF\u5F84\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C\uFF1A${cleanId}`);
+      }
+      if (/\.css$/iu.test(cleanId)) {
+        const violations = cssBoundaryViolations(code);
+        if (violations.length > 0) throw new Error(violations[0]);
+        return null;
+      }
+      if (/\.(?:[cm]?[jt]sx?)$/iu.test(cleanId)) {
+        const sourceFile = ts4.createSourceFile(
+          cleanId,
+          code,
+          ts4.ScriptTarget.ESNext,
+          true,
+          /x$/iu.test(cleanId) ? ts4.ScriptKind.TSX : ts4.ScriptKind.TS
+        );
+        let usesImportMeta = false;
+        const visit = (node) => {
+          if (ts4.isMetaProperty(node) && node.keywordToken === ts4.SyntaxKind.ImportKeyword) usesImportMeta = true;
+          if (!usesImportMeta) ts4.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        if (usesImportMeta) throw new Error("\u4E1A\u52A1\u4EE3\u7801\u4E0D\u5141\u8BB8\u4F7F\u7528 import.meta\uFF08\u5305\u62EC glob \u4E0E\u57FA\u4E8E URL \u7684\u6587\u4EF6\u8BFB\u53D6\uFF09");
+      }
+      return null;
+    },
+    async resolveId(source, importer) {
+      const resolveFixedDependency = async (dependency2) => {
+        fixedDependencyResolution(source, dependency2);
+        const browserSource = browserDependencySource(source, dependency2);
+        if (browserSource !== source) fixedDependencyResolution(browserSource, dependency2);
+        const resolved = await this.resolve(browserSource, workerModulePath, { skipSelf: true });
+        if (!resolved || resolved.external) throw new Error(`Host \u65E0\u6CD5\u901A\u8FC7 Vite \u89E3\u6790\u56FA\u5B9A\u4F9D\u8D56\uFF1A${source}`);
+        const cleanResolved = resolved.id.split(/[?#]/u, 1)[0];
+        const absoluteResolved = resolve5(cleanResolved);
+        if (containsPath(args.cacheDir, absoluteResolved)) return resolved;
+        let canonical;
+        try {
+          canonical = realpathSync5(absoluteResolved);
+        } catch (error) {
+          throw new Error(`Vite \u8FD4\u56DE\u4E86\u65E0\u6548\u7684\u56FA\u5B9A\u4F9D\u8D56\u8DEF\u5F84\uFF1A${source}`, { cause: error });
+        }
+        if (!containsPath(dependencyPackage(dependency2).root, canonical)) {
+          throw new Error(`Vite \u56FA\u5B9A\u4F9D\u8D56\u89E3\u6790\u8D8A\u8FC7\u5305\u6839\uFF1A${source}`);
+        }
+        return resolved;
+      };
+      const cleanImporter = importer?.split("?", 1)[0];
+      const cleanSource = source.split(/[?#]/u, 1)[0];
+      const virtualImporter = cleanImporter ? virtualBusinessRelative(cleanImporter) : void 0;
+      const businessImporter = Boolean(virtualImporter || cleanImporter && containsPath(args.projectRoot, cleanImporter));
+      const runtimeImporter = cleanImporter ? containsPath(args.runtimeRoot, cleanImporter) : false;
+      if (source === VIRTUAL_REGISTRY) {
+        if (businessImporter) throw new Error("\u4E1A\u52A1\u4EE3\u7801\u4E0D\u80FD\u5BFC\u5165 Runtime \u5185\u90E8\u6CE8\u518C\u8868");
+        return RESOLVED_REGISTRY;
+      }
+      if (source === "@harness/frontend-runtime") return sdkEntry;
+      if (!importer || importer.startsWith("\0") && !virtualImporter) return null;
+      const resolvedImporter = virtualImporter && sources ? sources.acceptedPath(virtualImporter) : cleanImporter;
+      const filesystemAbsoluteSource = /^(?:[a-zA-Z]:[\\/]|[\\/]{2})/u.test(cleanSource) || isAbsolute5(cleanSource) && existsSync4(cleanSource);
+      if (filesystemAbsoluteSource) {
+        let canonical;
+        try {
+          const info = lstatSync2(cleanSource);
+          canonical = realpathSync5(cleanSource);
+          if (!info.isFile() || info.isSymbolicLink() || !sameFilesystemPath(cleanSource, canonical)) {
+            throw new Error("module path is redirected");
+          }
+        } catch (error) {
+          throw new Error(`\u7EDD\u5BF9\u6A21\u5757\u8DEF\u5F84\u65E0\u6548\uFF1A${source}`, { cause: error });
+        }
+        const fixedAliasedDependency = LAZY_PREBUNDLED_DEPENDENCY_SOURCES.some((dependency2) => containsPath(dependencyPackage(dependency2).root, canonical));
+        if ((businessImporter || runtimeImporter) && fixedAliasedDependency) {
+          return null;
+        }
+        if (businessImporter) {
+          const acceptedRelative = sources ? relativeProjectPath(sources.currentRoot, canonical) : void 0;
+          if (!(acceptedRelative && allowedProjectPath(args, resolve5(args.projectRoot, acceptedRelative))) && !allowedProjectPath(args, canonical)) throw new Error(`\u4E1A\u52A1\u7EDD\u5BF9\u5BFC\u5165\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C\uFF1A${source}`);
+          return null;
+        }
+        if (runtimeImporter) {
+          if (!containsPath(args.runtimeRoot, canonical)) throw new Error(`Runtime \u7EDD\u5BF9\u5BFC\u5165\u8D8A\u8FC7\u8FD0\u884C\u65F6\u6839\uFF1A${source}`);
+          return null;
+        }
+        return null;
+      }
+      if (!businessImporter && !runtimeImporter) {
+        if (!source.startsWith(".") && !source.startsWith("/") && !source.startsWith("\0") && !/^(?:node:|https?:|data:)/iu.test(source)) {
+          const dependency2 = packageName(source);
+          if (Object.hasOwn(args.dependencies, dependency2)) return await resolveFixedDependency(dependency2);
+        }
+        return null;
+      }
+      if (runtimeImporter) {
+        if (source === "vite/modulepreload-polyfill") return null;
+        if (source.startsWith(".") || source.startsWith("/") || source.startsWith("\0")) return null;
+        const dependency2 = packageName(source);
+        if (!Object.hasOwn(args.dependencies, dependency2)) throw new Error(`Runtime \u4F7F\u7528\u4E86\u672A\u56FA\u5B9A\u4F9D\u8D56\uFF1A${dependency2}`);
+        return await resolveFixedDependency(dependency2);
+      }
+      if (/^(?:node:|https?:|data:)/iu.test(source)) throw new Error(`\u5FEB\u901F\u524D\u53F0\u4E0D\u5141\u8BB8\u5BFC\u5165\uFF1A${source}`);
+      if (source.startsWith(".") || source.startsWith("/")) {
+        if (source.startsWith("/")) throw new Error(`\u4E1A\u52A1\u4EE3\u7801\u4E0D\u80FD\u5BFC\u5165 Runtime \u7EDD\u5BF9\u8DEF\u5F84\uFF1A${source}`);
+        const candidate = resolve5(dirname7(resolvedImporter), source);
+        const candidateRelative = sources ? relativeProjectPath(sources.currentRoot, candidate) : void 0;
+        if (!(candidateRelative && allowedProjectPath(args, resolve5(args.projectRoot, candidateRelative))) && !allowedProjectPath(args, candidate)) throw new Error(`\u4E1A\u52A1\u5BFC\u5165\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C\uFF1A${source}`);
+        const resolvedImport = await this.resolve(source, importer, { skipSelf: true });
+        if (!resolvedImport || resolvedImport.external) return resolvedImport;
+        if (virtualBusinessRelative(resolvedImport.id)) return resolvedImport;
+        const resolvedPath = resolvedImport.id.split("?", 1)[0];
+        const canonical = realpathSync5(resolvedPath);
+        if (!allowedProjectPath(args, canonical)) throw new Error(`\u4E1A\u52A1\u5BFC\u5165 canonical \u8DEF\u5F84\u8D8A\u8FC7\u53EF\u8BFB\u8FB9\u754C\uFF1A${source}`);
+        return resolvedImport;
+      }
+      const dependency = packageName(source);
+      if (!BUSINESS_DEPENDENCIES.has(dependency)) throw new Error(`Runtime \u672A\u5411\u4E1A\u52A1\u4EE3\u7801\u516C\u5F00\u4F9D\u8D56\uFF1A${dependency}`);
+      try {
+        return await resolveFixedDependency(dependency);
+      } catch (error) {
+        throw new Error(`Host \u65E0\u6CD5\u89E3\u6790\u56FA\u5B9A\u4F9D\u8D56\uFF1A${source}`, { cause: error });
+      }
+    }
+  };
+}
+
+// apps/host/src/runtime-vite-registry.ts
+import { createReadStream, existsSync as existsSync5, lstatSync as lstatSync3, realpathSync as realpathSync6 } from "node:fs";
+import { extname as extname2, join as join8, resolve as resolve6 } from "node:path";
+import { normalizePath } from "vite";
+var GENERATED_CONTENT_TYPES = {
+  ".gif": "image/gif",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".json": "application/json; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+function registryPlugin(args, sources) {
+  let server;
+  return {
+    name: "harness-business-registry",
+    resolveId(source) {
+      return source === VIRTUAL_REGISTRY ? RESOLVED_REGISTRY : null;
+    },
+    async load(id) {
+      if (id !== RESOLVED_REGISTRY) return null;
+      const sourceArgs = sources ? { ...args, projectRoot: sources.currentRoot } : args;
+      const registry = await routeRegistry(sourceArgs);
+      const app = await appManifest(sourceArgs);
+      const providerPath = join8(sourceArgs.projectRoot, "src", "app", "providers.tsx");
+      const stylesPath = join8(sourceArgs.projectRoot, "src", "styles.css");
+      const routeSource = registry.routes.map((route) => `{ metadata: ${JSON.stringify(route.metadata)}, Component: lazy(() => import(${JSON.stringify(
+        sources ? virtualBusinessId(relativeProjectPath(sourceArgs.projectRoot, route.pagePath)) : normalizePath(route.pagePath)
+      )}).then((module) => ({ default: module.default }))) }`);
+      return [
+        `import { lazy } from "react";`,
+        ...existsSync5(providerPath) ? [`const BusinessProvider = lazy(() => import(${JSON.stringify(
+          sources ? virtualBusinessId("src/app/providers.tsx") : normalizePath(providerPath)
+        )}).then((module) => ({ default: module.default })));`] : [],
+        ...existsSync5(stylesPath) ? [`import ${JSON.stringify(
+          sources ? virtualBusinessId("src/styles.css") : normalizePath(stylesPath)
+        )};`] : [],
+        `export const routes = [${routeSource.join(",\n")}];`,
+        `export const appManifest = ${JSON.stringify(app.manifest)};`,
+        existsSync5(providerPath) ? `export const providers = [BusinessProvider];` : `export const providers = [];`,
+        `export const stylesUrl = undefined;`
+      ].join("\n");
+    },
+    configureServer(viteServer) {
+      server = viteServer;
+      sources?.bindServer(viteServer);
+      viteServer.watcher.add(args.projectRoot);
+      viteServer.watcher.on("all", (event, path) => {
+        if (!allowedProjectPath(args, resolve6(path))) return;
+        sources?.recordFileChange(event, resolve6(path));
+      });
+      viteServer.middlewares.use((request, response, next) => {
+        const pathname = new URL(request.url ?? "/", "http://127.0.0.1").pathname;
+        if (!pathname.startsWith("/generated/")) {
+          try {
+            const requested = decodeURIComponent(pathname.replace(/^\/+/, ""));
+            const publicRoot = join8(args.projectRoot, "public");
+            const unmanaged = resolve6(publicRoot, requested);
+            if (requested && !requested.includes("\\") && containsPath(publicRoot, unmanaged) && existsSync5(unmanaged)) {
+              response.statusCode = 404;
+              response.end("Not found");
+              return;
+            }
+          } catch {
+            response.statusCode = 404;
+            response.end("Not found");
+            return;
+          }
+          next();
+          return;
+        }
+        try {
+          const sourceRoot = join8(sources?.currentRoot ?? args.projectRoot, "public", "generated");
+          if (!sameFilesystemPath(sourceRoot, realpathSync6(sourceRoot))) throw new Error("generated root redirected");
+          const requested = decodeURIComponent(pathname.slice("/generated/".length));
+          if (!requested || requested.includes("\\")) throw new Error("invalid generated path");
+          const source = resolve6(sourceRoot, requested);
+          const info = lstatSync3(source);
+          const canonical = realpathSync6(source);
+          if (!info.isFile() || info.isSymbolicLink() || !containsPath(sourceRoot, source) || !containsPath(sourceRoot, canonical) || !sameFilesystemPath(source, canonical)) {
+            throw new Error("generated asset escaped its root");
+          }
+          response.statusCode = 200;
+          response.setHeader("Cache-Control", "no-store");
+          response.setHeader("Content-Type", GENERATED_CONTENT_TYPES[extname2(source).toLowerCase()] ?? "application/octet-stream");
+          response.setHeader("X-Content-Type-Options", "nosniff");
+          createReadStream(source).once("error", next).pipe(response);
+        } catch {
+          response.statusCode = 404;
+          response.end("Not found");
+        }
+      });
+    },
+    closeBundle() {
+      void server;
+    }
+  };
+}
+function runtimeStorageBootstrapPlugin() {
+  return {
+    name: "harness-runtime-storage-bootstrap",
+    transformIndexHtml: {
+      order: "pre",
+      handler() {
+        return [{
+          tag: "script",
+          injectTo: "head-prepend",
+          children: [
+            "(() => {",
+            "  const channelId = new URL(window.location.href).searchParams.get('__harness_runtime_storage_channel');",
+            "  const announce = () => {",
+            "    if (channelId && channelId.length <= 128) {",
+            "      window.parent.postMessage({ type: 'harness.runtime-storage.ready', version: 1, channelId }, '*');",
+            "    }",
+            "  };",
+            "  announce();",
+            "  window.addEventListener('load', announce, { once: true });",
+            "})();"
+          ].join("\n")
+        }, {
+          tag: "script",
+          attrs: { type: "module", src: "/src/inspector/index.ts" },
+          injectTo: "head"
+        }];
+      }
+    }
+  };
+}
+
+// apps/host/src/runtime-vite-config.ts
+function config(args, sources) {
+  assertRegularContainedFile(args.runtimeRoot, args.runtimeEntry, "Runtime entry");
+  const dependencyRoots = verifyDependencies(args);
+  return {
+    root: args.runtimeRoot,
+    configFile: false,
+    appType: "spa",
+    base: args.mode === "export" ? "./" : "/",
+    cacheDir: args.cacheDir,
+    publicDir: false,
+    plugins: [
+      ...sources ? [runtimeStorageBootstrapPlugin()] : [],
+      ...sources ? [businessSourcePlugin(args, sources)] : [],
+      dependencyResolver(args, sources),
+      registryPlugin(args, sources),
+      react()
+    ],
+    resolve: {
+      // Vite resolves optimizeDeps.include from the Runtime root before user
+      // plugins run. Exact aliases let that resolver reach Host-pinned package
+      // entries without making arbitrary package subpaths available.
+      alias: [
+        ...LAZY_PREBUNDLED_DEPENDENCY_SOURCES.map((source) => ({
+          find: exactSpecifierPattern(source),
+          replacement: normalizePath2(fixedDependencyResolution(source, packageName(source)))
+        })),
+        {
+          find: exactSpecifierPattern("tslib"),
+          replacement: normalizePath2(requireFromHost.resolve("tslib/tslib.es6.mjs"))
+        }
+      ],
+      dedupe: ["react", "react-dom", "react-router", "react-router-dom", "antd", "@ant-design/icons"]
+    },
+    // Business pages are exposed through a generated registry of lazy imports, so Vite's
+    // initial HTML crawl cannot see the chart package. Pre-bundle that heavy dependency up
+    // front; otherwise its first request can restart the optimizer while React.lazy is
+    // fetching the page module and leave the browser holding a rejected dynamic import.
+    optimizeDeps: {
+      include: [...LAZY_PREBUNDLED_DEPENDENCY_SOURCES],
+      rolldownOptions: {
+        plugins: [
+          {
+            name: "harness-runtime-tslib-optimizer-resolution",
+            resolveId(source) {
+              if (source === "tslib") {
+                return normalizePath2(requireFromHost.resolve("tslib/tslib.es6.mjs"));
+              }
+              return null;
+            }
+          }
+        ]
+      }
+    },
+    server: {
+      host: args.host,
+      port: args.port,
+      strictPort: args.strictPort,
+      headers: {
+        // The workspace deliberately embeds the preview without
+        // `allow-same-origin`, so every module request originates from the
+        // opaque `null` origin. Keep the iframe isolated while allowing that
+        // exact origin to load Vite's ESM graph.
+        "Access-Control-Allow-Origin": "null",
+        "Referrer-Policy": "no-referrer",
+        "Content-Security-Policy": "default-src 'self'; base-uri 'none'; object-src 'none'; frame-src 'none'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws://127.0.0.1:* ws://localhost:*"
+      },
+      fs: {
+        strict: true,
+        allow: [
+          args.runtimeRoot,
+          ...sources ? [] : args.readablePaths.flatMap((path) => {
+            const candidate = resolve7(args.projectRoot, normalizedRelative(path.replace(/\/\*\*$/u, "")));
+            return existsSync6(candidate) ? [realpathSync7(candidate)] : [];
+          }),
+          ...dependencyRoots
+        ]
+      }
+    },
+    build: {
+      ...args.outDir ? { outDir: args.outDir } : {},
+      emptyOutDir: false,
+      sourcemap: args.mode !== "export",
+      rollupOptions: { input: join9(args.runtimeRoot, "index.html") }
+    }
+  };
+}
+
+// apps/host/src/runtime-worker-events.ts
+function publishPreviewUpdate(kind, paths, sourceRevision) {
+  process.stdout.write(`${EVENT_PREFIX}${JSON.stringify({ type: "preview-update", kind, sourceRevision, paths: paths.slice(0, 100) })}
+`);
+}
+
+// apps/host/src/runtime-preview-source.ts
+import { createHash as createHash3 } from "node:crypto";
+import { lstatSync as lstatSync4, realpathSync as realpathSync8 } from "node:fs";
+import { mkdir as mkdir3, readFile as readFile6 } from "node:fs/promises";
+import { join as join11, resolve as resolve9 } from "node:path";
+import "vite";
+
+// apps/host/src/runtime-source-snapshot.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { copyFile as copyFile2, lstat as lstat4, mkdir as mkdir2, readFile as readFile5, readdir as readdir2, rename, rm } from "node:fs/promises";
+import { dirname as dirname8, join as join10, relative as relative5, resolve as resolve8 } from "node:path";
+var MAX_PREVIEW_SOURCE_FILES = 2048;
+var MAX_PREVIEW_SOURCE_BYTES = 32 * 1024 * 1024;
+var MAX_PREVIEW_SNAPSHOTS = 8;
+async function businessSnapshotFiles(args, root) {
+  const paths = /* @__PURE__ */ new Set();
+  const roots = [...args.readablePaths, ...args.editablePaths].map((pattern) => normalizedRelative(pattern.replace(/\/\*\*$/u, ""))).filter((path) => path && path !== "README.md" && !path.startsWith(".harness/"));
+  for (const relativeRoot of [...new Set(roots)]) {
+    const absoluteRoot = resolve8(root, relativeRoot);
+    if (!containsPath(root, absoluteRoot)) throw new Error("\u4E1A\u52A1\u5FEB\u7167\u8DEF\u5F84\u8D8A\u8FC7\u5DE5\u4F5C\u533A");
+    const info = await lstat4(absoluteRoot).catch(() => void 0);
+    if (!info) continue;
+    if (info.isSymbolicLink()) throw new Error(`\u4E1A\u52A1\u6E90\u7801\u4E0D\u80FD\u5305\u542B\u7B26\u53F7\u94FE\u63A5/junction\uFF1A${relativeRoot}`);
+    if (info.isFile()) {
+      paths.add(normalizedRelative(relative5(root, absoluteRoot)));
+      continue;
+    }
+    if (!info.isDirectory()) throw new Error(`\u4E1A\u52A1\u6E90\u7801\u5FC5\u987B\u662F\u666E\u901A\u6587\u4EF6\u6216\u76EE\u5F55\uFF1A${relativeRoot}`);
+    for (const file of await walkBusinessFiles(absoluteRoot)) {
+      paths.add(normalizedRelative(relative5(root, file)));
+    }
+  }
+  return [...paths].sort((left, right) => left.localeCompare(right));
+}
+async function businessSnapshotHash(args, root, files) {
+  const selected = files ?? await businessSnapshotFiles(args, root);
+  const hash = createHash2("sha256");
+  for (const path of selected) {
+    hash.update(path);
+    hash.update("\0");
+    hash.update(await readFile5(join10(root, path)));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function transientCaptureError(error) {
+  const code = typeof error === "object" && error !== null && "code" in error ? String(error.code ?? "") : "";
+  return code === "ENOENT" || code === "ENOTDIR" || code === "EBUSY" || code === "EPERM" || code === "EACCES";
+}
+async function captureBusinessCandidateAttempt(args, candidatesRoot) {
+  if (process.env.NODE_ENV === "test" && process.env.HARNESS_TEST_PREVIEW_CAPTURE_ALWAYS_FAIL === "1") {
+    throw Object.assign(new Error("Injected transient preview capture failure"), { code: "ENOENT" });
+  }
+  const files = await businessSnapshotFiles(args, args.projectRoot);
+  if (files.length > MAX_PREVIEW_SOURCE_FILES) {
+    throw new Error(`\u4E1A\u52A1\u9884\u89C8\u6E90\u7801\u8D85\u8FC7 ${MAX_PREVIEW_SOURCE_FILES} \u4E2A\u6587\u4EF6\u7684\u5B89\u5168\u4E0A\u9650`);
+  }
+  let totalBytes = 0;
+  for (const path of files) {
+    totalBytes += (await lstat4(join10(args.projectRoot, path))).size;
+    if (totalBytes > MAX_PREVIEW_SOURCE_BYTES) {
+      throw new Error(`\u4E1A\u52A1\u9884\u89C8\u6E90\u7801\u8D85\u8FC7 ${MAX_PREVIEW_SOURCE_BYTES / 1024 / 1024} MiB \u7684\u5B89\u5168\u4E0A\u9650`);
+    }
+  }
+  const beforeHash = await businessSnapshotHash(args, args.projectRoot, files);
+  const capturePauseMs = process.env.NODE_ENV === "test" ? Number.parseInt(process.env.HARNESS_TEST_PREVIEW_CAPTURE_PAUSE_AFTER_HASH_MS ?? "0", 10) : 0;
+  if (Number.isSafeInteger(capturePauseMs) && capturePauseMs > 0 && capturePauseMs <= 1e3) {
+    process.stdout.write(`${EVENT_PREFIX}${JSON.stringify({ type: "capture-test-window", hash: beforeHash })}
+`);
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, capturePauseMs));
+  }
+  const candidateRoot = join10(candidatesRoot, beforeHash);
+  const existing = await lstat4(candidateRoot).catch(() => void 0);
+  if (existing?.isDirectory() && !existing.isSymbolicLink()) {
+    const existingHash = await businessSnapshotHash(args, candidateRoot);
+    const afterHash = await businessSnapshotHash(args, args.projectRoot);
+    if (existingHash === beforeHash && afterHash === beforeHash) return { root: candidateRoot, hash: beforeHash, files };
+  }
+  const stagingRoot = join10(candidatesRoot, `.staging-${randomUUID()}`);
+  try {
+    await mkdir2(stagingRoot, { recursive: false });
+    for (const path of files) {
+      const destination = join10(stagingRoot, path);
+      await mkdir2(dirname8(destination), { recursive: true });
+      await copyFile2(join10(args.projectRoot, path), destination);
+    }
+    const [snapshotHash, afterHash] = await Promise.all([
+      businessSnapshotHash(args, stagingRoot),
+      businessSnapshotHash(args, args.projectRoot)
+    ]);
+    if (snapshotHash !== beforeHash || afterHash !== beforeHash) return void 0;
+    try {
+      await rename(stagingRoot, candidateRoot);
+    } catch (error) {
+      const adopted = await lstat4(candidateRoot).catch(() => void 0);
+      if (!adopted?.isDirectory() || adopted.isSymbolicLink() || await businessSnapshotHash(args, candidateRoot) !== beforeHash) throw error;
+    }
+    return { root: candidateRoot, hash: beforeHash, files };
+  } finally {
+    await rm(stagingRoot, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+async function captureBusinessCandidate(args) {
+  const candidatesRoot = join10(args.cacheDir, "preview-sources");
+  await mkdir2(candidatesRoot, { recursive: true });
+  let lastTransientError;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      const candidate = await captureBusinessCandidateAttempt(args, candidatesRoot);
+      if (candidate) return candidate;
+    } catch (error) {
+      if (!transientCaptureError(error)) throw error;
+      lastTransientError = error;
+    }
+  }
+  const detail = lastTransientError instanceof Error ? `\uFF1A${lastTransientError.message}` : "";
+  throw new Error(`\u6355\u83B7\u4E1A\u52A1\u6E90\u7801\u671F\u95F4\u6587\u4EF6\u6301\u7EED\u53D8\u5316\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5${detail}`, { cause: lastTransientError });
+}
+async function pruneBusinessCandidates(cacheDir, keep) {
+  const root = join10(cacheDir, "preview-sources");
+  const entries = await readdir2(root, { withFileTypes: true }).catch(() => []);
+  const candidates = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.isSymbolicLink() || !/^[0-9a-f]{64}$/u.test(entry.name)) continue;
+    const path = join10(root, entry.name);
+    if (keep.has(path)) continue;
+    const info = await lstat4(path).catch(() => void 0);
+    if (info?.isDirectory() && !info.isSymbolicLink()) candidates.push({ path, updatedAt: info.mtimeMs });
+  }
+  candidates.sort((left, right) => right.updatedAt - left.updatedAt);
+  for (const candidate of candidates.slice(Math.max(0, MAX_PREVIEW_SNAPSHOTS - keep.size))) {
+    await rm(candidate.path, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+
+// apps/host/src/runtime-preview-source.ts
+var PreviewSourceController = class _PreviewSourceController {
+  constructor(args, emptyRoot, compilation2) {
+    this.args = args;
+    this.compilation = compilation2;
+    this.workingRoot = args.projectRoot;
+    this.#currentRoot = emptyRoot;
+  }
+  args;
+  compilation;
+  workingRoot;
+  #currentRoot;
+  #server;
+  #timer;
+  #batchDepth = 0;
+  #epoch = 0;
+  #lastControlSequence = 0;
+  #lastObservedHash;
+  #acceptedFiles = /* @__PURE__ */ new Map();
+  #pendingEvents = /* @__PURE__ */ new Map();
+  #refreshTail = Promise.resolve();
+  #disposed = false;
+  async dispose() {
+    this.#disposed = true;
+    if (this.#timer) clearTimeout(this.#timer);
+    this.#timer = void 0;
+    await this.#refreshTail;
+  }
+  static async create(args, compilation2) {
+    const emptyHash = createHash3("sha256").digest("hex");
+    const emptyRoot = join11(args.cacheDir, "preview-sources", emptyHash);
+    await mkdir3(emptyRoot, { recursive: true });
+    return new _PreviewSourceController(args, emptyRoot, compilation2);
+  }
+  get currentRoot() {
+    return this.#currentRoot;
+  }
+  get epoch() {
+    return this.#epoch;
+  }
+  acceptedPath(relativePath) {
+    const path = resolve9(this.#currentRoot, normalizedRelative(relativePath));
+    if (!containsPath(this.#currentRoot, path)) throw new Error("\u4E1A\u52A1\u6A21\u5757\u8D8A\u8FC7\u5DF2\u63A5\u53D7\u5FEB\u7167");
+    const info = lstatSync4(path);
+    const canonical = realpathSync8(path);
+    if (!info.isFile() || info.isSymbolicLink() || !containsPath(this.#currentRoot, canonical) || !sameFilesystemPath(path, canonical)) throw new Error("\u4E1A\u52A1\u6A21\u5757\u4E0D\u662F\u5DF2\u63A5\u53D7\u5FEB\u7167\u4E2D\u7684\u666E\u901A\u6587\u4EF6");
+    return path;
+  }
+  bindServer(server) {
+    this.#server = server;
+  }
+  recordFileChange(event, absolutePath) {
+    const path = relativeProjectPath(this.args.projectRoot, absolutePath);
+    if (!path) return;
+    this.#pendingEvents.set(path, event);
+    if (this.#batchDepth === 0) this.scheduleExternalChange();
+  }
+  scheduleExternalChange() {
+    this.#schedule(250);
+  }
+  handleControl(message) {
+    if (!Number.isSafeInteger(message.epoch) || message.epoch <= 0 || !Number.isSafeInteger(message.sequence) || message.sequence <= 0) return;
+    if (message.epoch < this.#epoch || message.epoch === this.#epoch && message.sequence <= this.#lastControlSequence) return;
+    if (message.epoch > this.#epoch) {
+      this.#epoch = message.epoch;
+      this.#lastControlSequence = 0;
+      this.#batchDepth = 0;
+    }
+    this.#lastControlSequence = message.sequence;
+    if (message.type === "batch.begin") {
+      this.#batchDepth += 1;
+      if (this.#timer) clearTimeout(this.#timer);
+      this.#timer = void 0;
+      return;
+    }
+    if (message.type === "batch.end") this.#batchDepth = Math.max(0, this.#batchDepth - 1);
+    else this.#batchDepth = 0;
+    if (this.#batchDepth === 0) this.#schedule(0);
+  }
+  refresh() {
+    if (this.#disposed) return Promise.resolve();
+    const running = this.#refreshTail.then(async () => {
+      try {
+        await this.#refreshNow();
+      } catch (error) {
+        this.#pendingEvents.clear();
+        this.compilation.reportRuntimeFailure(error);
+      }
+    });
+    this.#refreshTail = running;
+    return running;
+  }
+  #schedule(delayMs) {
+    if (this.#disposed || this.#batchDepth > 0) return;
+    if (this.#timer) clearTimeout(this.#timer);
+    this.#timer = setTimeout(() => {
+      this.#timer = void 0;
+      void this.refresh().catch((error) => {
+        this.compilation.finish(this.compilation.sourceRevision, [{ severity: "error", source: "runtime", message: (error instanceof Error ? error.message : String(error)).slice(0, 8e3) }], false);
+      });
+    }, delayMs);
+    this.#timer.unref();
+  }
+  async #refreshNow() {
+    const candidate = await captureBusinessCandidate(this.args);
+    if (candidate.hash === this.#lastObservedHash) {
+      this.#pendingEvents.clear();
+      return;
+    }
+    this.#lastObservedHash = candidate.hash;
+    const { revision, diagnostics } = await this.compilation.inspectCandidate({ ...this.args, projectRoot: candidate.root });
+    if (diagnostics.some((diagnostic) => diagnostic.severity === "error")) {
+      this.compilation.finish(revision, diagnostics, false);
+      await pruneBusinessCandidates(this.args.cacheDir, /* @__PURE__ */ new Set([this.#currentRoot, candidate.root]));
+      this.#pendingEvents.clear();
+      return;
+    }
+    const previousFiles = this.#acceptedFiles;
+    const nextFiles = /* @__PURE__ */ new Map();
+    for (const path of candidate.files) {
+      nextFiles.set(path, createHash3("sha256").update(await readFile6(join11(candidate.root, path))).digest("hex"));
+    }
+    const changed = [.../* @__PURE__ */ new Set([...previousFiles.keys(), ...nextFiles.keys()])].filter((path) => previousFiles.get(path) !== nextFiles.get(path));
+    const fileSetChanged = changed.some((path) => previousFiles.has(path) !== nextFiles.has(path));
+    const hadAcceptedSource = this.compilation.successfulSourceRevision !== void 0;
+    const previousRoot = this.#currentRoot;
+    this.#currentRoot = candidate.root;
+    this.#acceptedFiles = nextFiles;
+    try {
+      await this.#publishAcceptedChange(changed, hadAcceptedSource, fileSetChanged);
+    } catch (error) {
+      this.#currentRoot = previousRoot;
+      this.#acceptedFiles = previousFiles;
+      try {
+        this.#server?.ws.send({ type: "full-reload" });
+      } catch {
+      }
+      this.compilation.finish(revision, [{
+        severity: "error",
+        source: "runtime",
+        code: "HARNESS_HMR_PUBLICATION",
+        message: `Vite \u65E0\u6CD5\u8F7D\u5165\u5019\u9009\u7248\u672C\uFF0C\u5DF2\u6062\u590D\u6700\u8FD1\u53EF\u7528\u9884\u89C8\uFF1A${error instanceof Error ? error.message : String(error)}`.slice(0, 1e3)
+      }], false);
+      await pruneBusinessCandidates(this.args.cacheDir, /* @__PURE__ */ new Set([previousRoot, candidate.root]));
+      this.#pendingEvents.clear();
+      return;
+    }
+    this.compilation.finish(revision, diagnostics, true);
+    await pruneBusinessCandidates(this.args.cacheDir, /* @__PURE__ */ new Set([candidate.root]));
+    this.#pendingEvents.clear();
+  }
+  async #publishAcceptedChange(changed, hadAcceptedSource, fileSetChanged) {
+    const server = this.#server;
+    if (!server || changed.length === 0) return;
+    if (process.env.NODE_ENV === "test" && process.env.HARNESS_TEST_PREVIEW_PUBLICATION_FAILURE_REVISION === String(this.compilation.sourceRevision)) {
+      throw new Error("Injected preview publication failure");
+    }
+    const structural = !hadAcceptedSource || fileSetChanged || changed.some((path) => /(?:^|\/)(?:route|app)\.json$/u.test(path) || /(?:^|\/)providers\.tsx$/u.test(path) || path.startsWith("public/generated/") || this.#pendingEvents.get(path) === "add" || this.#pendingEvents.get(path) === "unlink");
+    const registry = server.moduleGraph.getModuleById(RESOLVED_REGISTRY);
+    if (registry && changed.some((path) => /(?:^|\/)(?:route|app)\.json$/u.test(path) || /(?:^|\/)providers\.tsx$/u.test(path))) server.moduleGraph.invalidateModule(registry);
+    if (structural) {
+      for (const path of changed) {
+        const module = server.moduleGraph.getModuleById(`${RESOLVED_BUSINESS_PREFIX}${path}`);
+        if (module) server.moduleGraph.invalidateModule(module);
+      }
+      server.ws.send({ type: "full-reload" });
+      publishPreviewUpdate("full-reload", changed, this.compilation.sourceRevision);
+      return;
+    }
+    for (const path of changed) {
+      const module = server.moduleGraph.getModuleById(`${RESOLVED_BUSINESS_PREFIX}${path}`);
+      if (!module) continue;
+      server.moduleGraph.invalidateModule(module);
+      await server.reloadModule(module);
+    }
+    publishPreviewUpdate("hmr", changed, this.compilation.sourceRevision);
+  }
+};
+
+// apps/host/src/runtime-worker-arguments.ts
+import { resolve as resolve10 } from "node:path";
+function valueAfter(argv, name, fallback) {
+  const index = argv.indexOf(name);
+  const value = index >= 0 ? argv[index + 1] : fallback;
+  if (value === void 0) throw new Error(`Missing worker argument: ${name}`);
+  return value;
+}
+function parseArguments(argv) {
+  const mode = valueAfter(argv, "--mode");
+  if (!["preview", "check", "export"].includes(mode)) throw new Error(`Invalid worker mode: ${mode}`);
+  const port = Number.parseInt(valueAfter(argv, "--port", "0"), 10);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error("Invalid preview port");
+  const parseJson = (name, fallback) => JSON.parse(valueAfter(argv, name, fallback));
+  return {
+    mode,
+    projectRoot: resolve10(valueAfter(argv, "--project-root")),
+    runtimeRoot: resolve10(valueAfter(argv, "--runtime-root")),
+    runtimeEntry: valueAfter(argv, "--runtime-entry"),
+    runtimeSdkEntry: valueAfter(argv, "--runtime-sdk-entry"),
+    typeDeclarations: valueAfter(argv, "--type-declarations"),
+    cacheDir: resolve10(valueAfter(argv, "--cache-dir")),
+    dependencies: parseJson("--dependencies", "{}"),
+    readablePaths: parseJson("--readable-paths", "[]"),
+    editablePaths: parseJson("--editable-paths", "[]"),
+    ...argv.includes("--out-dir") ? { outDir: resolve10(valueAfter(argv, "--out-dir")) } : {},
+    host: valueAfter(argv, "--host", "127.0.0.1"),
+    port,
+    strictPort: argv.includes("--strictPort")
+  };
+}
+
+// apps/host/src/frontend-runtime-worker.ts
+import { build as build2, createServer as createServer2 } from "vite";
+
+// apps/host/src/runtime-timing.ts
+async function measureRuntimeStage(stage, operation) {
+  if (process.env.HARNESS_RUNTIME_TRACE !== "1") return await operation();
+  const start = performance.now();
+  const startedAt = Date.now();
+  let status = "failed";
+  try {
+    const result = await operation();
+    status = "completed";
+    return result;
+  } finally {
+    process.stderr.write(`HARNESS_RUNTIME_TIMING ${JSON.stringify({ stage, status, startedAt, finishedAt: Date.now(), durationMs: performance.now() - start })}
+`);
+  }
+}
+
+// apps/host/src/frontend-runtime-worker.ts
+function attachControlInput(controller) {
+  process.stdin.setEncoding("utf8");
+  let buffer = "";
+  process.stdin.on("data", (chunk) => {
+    buffer = `${buffer}${chunk}`;
+    if (buffer.length > 128 * 1024) buffer = buffer.slice(-128 * 1024);
+    const lines = buffer.split(/\r?\n/u);
+    buffer = lines.pop() ?? "";
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      try {
+        const value = JSON.parse(line);
+        if ((value.type === "batch.begin" || value.type === "batch.end" || value.type === "flush") && typeof value.epoch === "number" && typeof value.sequence === "number") {
+          controller.handleControl(value);
+        }
+      } catch {
+      }
+    }
+  });
+}
+var compilation = new RuntimeCompileSession((state) => {
+  process.stdout.write(`${EVENT_PREFIX}${JSON.stringify({ type: "compile-state", state })}
+`);
+});
+async function main() {
+  const args = parseArguments(process.argv.slice(2));
+  verifyDependencies(args);
+  if (args.mode === "check") {
+    const state = await measureRuntimeStage("typescript", () => compilation.compile(args));
+    process.exitCode = state.status === "failed" ? 1 : 0;
+    return;
+  }
+  if (args.mode === "export") {
+    if (!args.outDir) throw new Error("Export requires --out-dir");
+    const state = await measureRuntimeStage("typescript", () => compilation.compile(args));
+    if (state.status === "failed") {
+      process.exitCode = 1;
+      return;
+    }
+    await measureRuntimeStage("vite-build", () => build2(config(args)));
+    await measureRuntimeStage("export-assets", async () => {
+      await rewriteExportedGeneratedCss(args);
+      await copyGeneratedAssets(args);
+    });
+    return;
+  }
+  const sources = await PreviewSourceController.create(args, compilation);
+  attachControlInput(sources);
+  const server = await createServer2(config(args, sources));
+  await server.listen();
+  await sources.refresh();
+  const close = async () => {
+    await sources.dispose();
+    await compilation.dispose();
+    await server.close();
+    process.exit(0);
+  };
+  process.once("SIGINT", () => {
+    void close();
+  });
+  process.once("SIGTERM", () => {
+    void close();
+  });
+}
+void main().catch((error) => {
+  compilation.reportRuntimeFailure(error);
+  process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}
+`);
+  process.exitCode = 1;
+});