@nasti-toolchain/nasti 2.4.3 → 2.4.4

package/dist/index.cjs

@@ -5,10 +5,10 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __glob = (map) => (path19) => {
-  var fn = map[path19];
+var __glob = (map) => (path20) => {
+  var fn = map[path20];
   if (fn) return fn();
-  throw new Error("Module not found in bundle: " + path19);
+  throw new Error("Module not found in bundle: " + path20);
 };
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
@@ -873,27 +873,27 @@ var require_process = __commonJS({
 var require_filesystem = __commonJS({
   "node_modules/detect-libc/lib/filesystem.js"(exports2, module2) {
     "use strict";
-    var fs14 = require("fs");
+    var fs15 = require("fs");
     var LDD_PATH = "/usr/bin/ldd";
     var SELF_PATH = "/proc/self/exe";
     var MAX_LENGTH = 2048;
-    var readFileSync = (path19) => {
-      const fd = fs14.openSync(path19, "r");
+    var readFileSync = (path20) => {
+      const fd = fs15.openSync(path20, "r");
       const buffer = Buffer.alloc(MAX_LENGTH);
-      const bytesRead = fs14.readSync(fd, buffer, 0, MAX_LENGTH, 0);
-      fs14.close(fd, () => {
+      const bytesRead = fs15.readSync(fd, buffer, 0, MAX_LENGTH, 0);
+      fs15.close(fd, () => {
       });
       return buffer.subarray(0, bytesRead);
     };
-    var readFile = (path19) => new Promise((resolve, reject) => {
-      fs14.open(path19, "r", (err, fd) => {
+    var readFile = (path20) => new Promise((resolve, reject) => {
+      fs15.open(path20, "r", (err, fd) => {
         if (err) {
           reject(err);
         } else {
           const buffer = Buffer.alloc(MAX_LENGTH);
-          fs14.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
+          fs15.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
             resolve(buffer.subarray(0, bytesRead));
-            fs14.close(fd, () => {
+            fs15.close(fd, () => {
             });
           });
         }
@@ -1005,11 +1005,11 @@ var require_detect_libc = __commonJS({
       }
       return null;
     };
-    var familyFromInterpreterPath = (path19) => {
-      if (path19) {
-        if (path19.includes("/ld-musl-")) {
+    var familyFromInterpreterPath = (path20) => {
+      if (path20) {
+        if (path20.includes("/ld-musl-")) {
           return MUSL;
-        } else if (path19.includes("/ld-linux-")) {
+        } else if (path20.includes("/ld-linux-")) {
           return GLIBC;
         }
       }
@@ -1056,8 +1056,8 @@ var require_detect_libc = __commonJS({
       cachedFamilyInterpreter = null;
       try {
         const selfContent = await readFile(SELF_PATH);
-        const path19 = interpreterPath(selfContent);
-        cachedFamilyInterpreter = familyFromInterpreterPath(path19);
+        const path20 = interpreterPath(selfContent);
+        cachedFamilyInterpreter = familyFromInterpreterPath(path20);
       } catch (e) {
       }
       return cachedFamilyInterpreter;
@@ -1069,8 +1069,8 @@ var require_detect_libc = __commonJS({
       cachedFamilyInterpreter = null;
       try {
         const selfContent = readFileSync(SELF_PATH);
-        const path19 = interpreterPath(selfContent);
-        cachedFamilyInterpreter = familyFromInterpreterPath(path19);
+        const path20 = interpreterPath(selfContent);
+        cachedFamilyInterpreter = familyFromInterpreterPath(path20);
       } catch (e) {
       }
       return cachedFamilyInterpreter;
@@ -2218,8 +2218,8 @@ function vuePlugin(config, environmentName = "client") {
       let cached2 = descriptorCache.get(filePath);
       if (!cached2) {
         try {
-          const fs14 = await import("fs");
-          const rawSource = fs14.readFileSync(filePath, "utf-8");
+          const fs15 = await import("fs");
+          const rawSource = fs15.readFileSync(filePath, "utf-8");
           const transformedSfc = await applySourceTransform(
             vueOptions.transformSfc,
             rawSource,
@@ -2887,6 +2887,24 @@ var init_module_graph = __esm({
       getModulesByFile(file) {
         return this.fileToModulesMap.get(file);
       }
+      /**
+       * Modules whose registered entry file lives under `dir` (inclusive).
+       * Used when a non-entry source inside a prebundled workspace package changes:
+       * only the package entry was registered, so getModulesByFile(changedFile)
+       * misses — we invalidate every /@modules entry rooted in that package.
+       */
+      getModulesWithFileUnder(dir) {
+        const result = /* @__PURE__ */ new Set();
+        const normDir = dir.replace(/\\/g, "/");
+        const normPrefix = normDir.endsWith("/") ? normDir : normDir + "/";
+        for (const [file, mods] of this.fileToModulesMap) {
+          const normFile = file.replace(/\\/g, "/");
+          if (normFile === normDir || normFile.startsWith(normPrefix)) {
+            for (const m of mods) result.add(m);
+          }
+        }
+        return result;
+      }
       async ensureEntryFromUrl(url) {
         const normalizedUrl = removeTimestampQuery(url);
         let mod = this.urlToModuleMap.get(normalizedUrl);
@@ -3857,7 +3875,7 @@ async function build(inlineConfig = {}) {
   const startTime = performance.now();
   logger.info(
     import_picocolors4.default.cyan(`
-nasti v${"2.4.3"} `) + import_picocolors4.default.green(`building for ${config.mode}...`)
+nasti v${"2.4.4"} `) + import_picocolors4.default.green(`building for ${config.mode}...`)
   );
   debug5?.(`root: ${config.root}`);
   const buildableNames = Object.keys(config.environments).filter((name) => {
@@ -4200,6 +4218,120 @@ var init_ws = __esm({
   }
 });
 
+// src/server/fs-allow.ts
+function isUnderRoot(abs, root) {
+  const rel = import_node_path12.default.relative(root, abs);
+  return !!rel && !rel.startsWith("..") && !import_node_path12.default.isAbsolute(rel);
+}
+function discoverLinkedPackageRoots(projectRoot, maxDepth = 4) {
+  const results = [];
+  const seenReal = /* @__PURE__ */ new Set();
+  const queued = /* @__PURE__ */ new Set([projectRoot]);
+  const queue = [projectRoot];
+  for (let depth = 0; depth < maxDepth && queue.length > 0; depth++) {
+    const levelCount = queue.length;
+    for (let i = 0; i < levelCount; i++) {
+      const dir = queue.shift();
+      const nm = import_node_path12.default.join(dir, "node_modules");
+      let entries;
+      try {
+        entries = import_node_fs9.default.readdirSync(nm, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const ent of entries) {
+        if (ent.name.startsWith(".") || ent.name === "node_modules") continue;
+        const pkgNames = ent.name.startsWith("@") ? listScopedPackages(nm, ent.name) : [ent.name];
+        for (const pkgName of pkgNames) {
+          const pkgPath = import_node_path12.default.join(nm, pkgName);
+          let real;
+          try {
+            real = import_node_fs9.default.realpathSync(pkgPath);
+          } catch {
+            continue;
+          }
+          if (seenReal.has(real)) continue;
+          seenReal.add(real);
+          if (!queued.has(real)) {
+            queued.add(real);
+            queue.push(real);
+          }
+          if (real !== projectRoot && !isUnderRoot(real, projectRoot) && !real.includes(NM)) {
+            results.push(real);
+          }
+        }
+      }
+    }
+  }
+  return results;
+}
+function listScopedPackages(nm, scope) {
+  try {
+    return import_node_fs9.default.readdirSync(import_node_path12.default.join(nm, scope)).filter((name) => !name.startsWith(".")).map((name) => import_node_path12.default.join(scope, name));
+  } catch {
+    return [];
+  }
+}
+function getLinkedPackageRoots(projectRoot) {
+  let mtimeMs = 0;
+  try {
+    mtimeMs = import_node_fs9.default.statSync(import_node_path12.default.join(projectRoot, "node_modules")).mtimeMs;
+  } catch {
+    mtimeMs = 0;
+  }
+  const cached2 = linkedRootsCache.get(projectRoot);
+  if (cached2 && cached2.mtimeMs === mtimeMs) {
+    return cached2.roots;
+  }
+  const roots = discoverLinkedPackageRoots(projectRoot);
+  linkedRootsCache.set(projectRoot, { roots, mtimeMs });
+  return roots;
+}
+function clearLinkedPackageRootsCache() {
+  linkedRootsCache.clear();
+}
+function isAllowedDevModulePath(realId, projectRoot) {
+  if (realId === projectRoot || isUnderRoot(realId, projectRoot)) return true;
+  for (const pkgRoot of getLinkedPackageRoots(projectRoot)) {
+    if (realId === pkgRoot || realId.startsWith(pkgRoot + import_node_path12.default.sep)) return true;
+  }
+  let dir = projectRoot;
+  for (; ; ) {
+    const nm = import_node_path12.default.join(dir, "node_modules");
+    if (realId === nm || realId.startsWith(nm + import_node_path12.default.sep)) return true;
+    const parent = import_node_path12.default.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return false;
+}
+function findNearestPackageRoot(file) {
+  let dir = import_node_path12.default.dirname(file);
+  for (; ; ) {
+    const pkgJson = import_node_path12.default.join(dir, "package.json");
+    if (import_node_fs9.default.existsSync(pkgJson)) {
+      try {
+        const pkg = JSON.parse(import_node_fs9.default.readFileSync(pkgJson, "utf-8"));
+        if (typeof pkg?.name === "string" && pkg.name) return dir;
+      } catch {
+      }
+    }
+    const parent = import_node_path12.default.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+var import_node_fs9, import_node_path12, NM, linkedRootsCache;
+var init_fs_allow = __esm({
+  "src/server/fs-allow.ts"() {
+    "use strict";
+    import_node_fs9 = __toESM(require("fs"), 1);
+    import_node_path12 = __toESM(require("path"), 1);
+    NM = `${import_node_path12.default.sep}node_modules${import_node_path12.default.sep}`;
+    linkedRootsCache = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/server/middleware.ts
 function getReactRefreshRuntimeEsm(includeBoundaryHelpers = false) {
   if (__refreshRuntimeCache) {
@@ -4208,10 +4340,10 @@ function getReactRefreshRuntimeEsm(includeBoundaryHelpers = false) {
   let cjsPath;
   try {
     const pkgPath = __require.resolve("react-refresh/package.json");
-    cjsPath = import_node_path12.default.join(import_node_path12.default.dirname(pkgPath), "cjs", "react-refresh-runtime.development.js");
+    cjsPath = import_node_path13.default.join(import_node_path13.default.dirname(pkgPath), "cjs", "react-refresh-runtime.development.js");
   } catch (err) {
-    cjsPath = import_node_path12.default.resolve(__dirname_esm, "../../node_modules/react-refresh/cjs/react-refresh-runtime.development.js");
-    if (!import_node_fs9.default.existsSync(cjsPath)) {
+    cjsPath = import_node_path13.default.resolve(__dirname_esm, "../../node_modules/react-refresh/cjs/react-refresh-runtime.development.js");
+    if (!import_node_fs10.default.existsSync(cjsPath)) {
       const origMsg = err instanceof Error ? err.message : String(err);
       throw new Error(
         `[nasti] Missing dependency "react-refresh". Install it with: npm install react-refresh
@@ -4219,7 +4351,7 @@ Original resolve error: ${origMsg}`
       );
     }
   }
-  const cjsSource = import_node_fs9.default.readFileSync(cjsPath, "utf-8");
+  const cjsSource = import_node_fs10.default.readFileSync(cjsPath, "utf-8");
   __refreshRuntimeCache = `// Wrapped react-refresh runtime -> ESM
 const exports = {};
 const module = { exports };
@@ -4390,8 +4522,8 @@ async function transformRequest(url, ctx) {
     let realIdValid = false;
     try {
       if (idParam) {
-        realId = import_node_fs9.default.realpathSync(idParam);
-        realIdValid = import_node_fs9.default.statSync(realId).isFile() && (realId.includes(`${import_node_path12.default.sep}node_modules${import_node_path12.default.sep}`) || isUnderRoot(realId, config.root));
+        realId = import_node_fs10.default.realpathSync(idParam);
+        realIdValid = import_node_fs10.default.statSync(realId).isFile() && isAllowedDevModulePath(realId, config.root);
       }
     } catch {
       realId = null;
@@ -4458,7 +4590,7 @@ async function transformRequest(url, ctx) {
     }
   }
   const filePath = resolveUrlToFile(url, config.root);
-  if (!filePath || !import_node_fs9.default.existsSync(filePath)) return null;
+  if (!filePath || !import_node_fs10.default.existsSync(filePath)) return null;
   const mod = await moduleGraph.ensureEntryFromUrl(url);
   moduleGraph.registerModule(mod, filePath);
   const transformVersion = mod.invalidationVersion;
@@ -4469,7 +4601,7 @@ async function transformRequest(url, ctx) {
     return transformResult2;
   }
   const loaded = await pluginContainer.load(filePath);
-  let code = loaded == null ? import_node_fs9.default.readFileSync(filePath, "utf-8") : typeof loaded === "string" ? loaded : loaded.code;
+  let code = loaded == null ? import_node_fs10.default.readFileSync(filePath, "utf-8") : typeof loaded === "string" ? loaded : loaded.code;
   let map = loaded && typeof loaded !== "string" ? loaded.map : void 0;
   const pluginResult = await pluginContainer.transform(code, filePath);
   if (pluginResult) {
@@ -4527,7 +4659,7 @@ async function loadVirtualModule(spec, ctx) {
   const resolved = await pluginContainer.resolveId(spec);
   if (resolved == null) return null;
   const resolvedId = typeof resolved === "string" ? resolved : resolved.id;
-  const looksVirtual = resolvedId.startsWith("\0") || !import_node_fs9.default.existsSync(resolvedId);
+  const looksVirtual = resolvedId.startsWith("\0") || !import_node_fs10.default.existsSync(resolvedId);
   if (!looksVirtual) return null;
   const loadResult = await pluginContainer.load(resolvedId);
   if (loadResult == null) return null;
@@ -4541,7 +4673,7 @@ async function loadVirtualModule(spec, ctx) {
     config.mode,
     ssrDefineOverrides(ctx.environment?.consumer ?? "client")
   ));
-  const anchor = import_node_path12.default.join(config.root, "__nasti_virtual__.ts");
+  const anchor = import_node_path13.default.join(config.root, "__nasti_virtual__.ts");
   code = rewriteImports(code, config, anchor);
   return { id: resolvedId, result: { code } };
 }
@@ -4567,7 +4699,7 @@ async function doBundlePackage(entryFile, root) {
   await bundle2.close();
   let code = result.output[0].code;
   code = code.replace(/process\.env\.NODE_ENV/g, '"development"');
-  const externalBaseDir = import_node_path12.default.dirname(entryFile);
+  const externalBaseDir = import_node_path13.default.dirname(entryFile);
   code = code.replace(
     /^(import\b[^;'"]*?\bfrom\s+)(['"])([^'"./][^'"]*)(\2)/gm,
     (_, prefix, q, spec) => `${prefix}${q}${externalSpecToModuleUrl(spec, externalBaseDir, root)}${q}`
@@ -4585,16 +4717,16 @@ async function doBundlePackage(entryFile, root) {
   return code;
 }
 async function tryGenerateSubpathShim(entryFile, root) {
-  const NM = `${import_node_path12.default.sep}node_modules${import_node_path12.default.sep}`;
-  if (!entryFile.includes(NM)) return null;
+  const NM2 = `${import_node_path13.default.sep}node_modules${import_node_path13.default.sep}`;
+  if (!entryFile.includes(NM2)) return null;
   let pkgDir = null;
   let pkgName = null;
-  let dir = import_node_path12.default.dirname(entryFile);
+  let dir = import_node_path13.default.dirname(entryFile);
   while (true) {
-    const pkgJsonPath = import_node_path12.default.join(dir, "package.json");
-    if (import_node_fs9.default.existsSync(pkgJsonPath)) {
+    const pkgJsonPath = import_node_path13.default.join(dir, "package.json");
+    if (import_node_fs10.default.existsSync(pkgJsonPath)) {
       try {
-        const pkg = JSON.parse(import_node_fs9.default.readFileSync(pkgJsonPath, "utf-8"));
+        const pkg = JSON.parse(import_node_fs10.default.readFileSync(pkgJsonPath, "utf-8"));
         if (typeof pkg?.name === "string" && pkg.name) {
           pkgDir = dir;
           pkgName = pkg.name;
@@ -4603,16 +4735,16 @@ async function tryGenerateSubpathShim(entryFile, root) {
       } catch {
       }
     }
-    const parent = import_node_path12.default.dirname(dir);
+    const parent = import_node_path13.default.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
-    if (!dir.includes(NM)) return null;
+    if (!dir.includes(NM2)) return null;
   }
   if (!pkgDir || !pkgName) return null;
-  const entryExt = import_node_path12.default.extname(entryFile);
+  const entryExt = import_node_path13.default.extname(entryFile);
   const mainEntry = pickMainEntryByExtension(pkgDir, entryExt);
   if (!mainEntry) return null;
-  if (import_node_path12.default.resolve(mainEntry) === import_node_path12.default.resolve(entryFile)) return null;
+  if (import_node_path13.default.resolve(mainEntry) === import_node_path13.default.resolve(entryFile)) return null;
   let mainNs;
   let subNs;
   try {
@@ -4636,7 +4768,7 @@ async function tryGenerateSubpathShim(entryFile, root) {
     if (mainNs["default"] !== subNs["default"]) return null;
   }
   const rootMain = resolveNodeModule(root, pkgName);
-  const mainEntryUrl = rootMain && rootMain.startsWith(pkgDir + import_node_path12.default.sep) ? `/@modules/${pkgName}` : `/@modules/${pkgName}?id=${encodeURIComponent(mainEntry)}`;
+  const mainEntryUrl = rootMain && rootMain.startsWith(pkgDir + import_node_path13.default.sep) ? `/@modules/${pkgName}` : `/@modules/${pkgName}?id=${encodeURIComponent(mainEntry)}`;
   const lines = [
     `// Nasti subpath shim \u2192 ${pkgName} (avoid duplicate bundling)`,
     `import * as __pkg from "${mainEntryUrl}";`
@@ -4650,10 +4782,10 @@ async function tryGenerateSubpathShim(entryFile, root) {
   return lines.join("\n") + "\n";
 }
 function pickMainEntryByExtension(pkgDir, preferredExt) {
-  const pkgJsonPath = import_node_path12.default.join(pkgDir, "package.json");
+  const pkgJsonPath = import_node_path13.default.join(pkgDir, "package.json");
   let pkg;
   try {
-    pkg = JSON.parse(import_node_fs9.default.readFileSync(pkgJsonPath, "utf-8"));
+    pkg = JSON.parse(import_node_fs10.default.readFileSync(pkgJsonPath, "utf-8"));
   } catch {
     return null;
   }
@@ -4672,14 +4804,14 @@ function pickMainEntryByExtension(pkgDir, preferredExt) {
   if (typeof pkg.module === "string") candidates.push(pkg.module);
   if (typeof pkg.main === "string") candidates.push(pkg.main);
   for (const cand of candidates) {
-    if (import_node_path12.default.extname(cand) === preferredExt) {
-      const full = import_node_path12.default.resolve(pkgDir, cand);
-      if (import_node_fs9.default.existsSync(full)) return full;
+    if (import_node_path13.default.extname(cand) === preferredExt) {
+      const full = import_node_path13.default.resolve(pkgDir, cand);
+      if (import_node_fs10.default.existsSync(full)) return full;
     }
   }
   for (const cand of candidates) {
-    const full = import_node_path12.default.resolve(pkgDir, cand);
-    if (import_node_fs9.default.existsSync(full)) return full;
+    const full = import_node_path13.default.resolve(pkgDir, cand);
+    if (import_node_fs10.default.existsSync(full)) return full;
   }
   return null;
 }
@@ -4704,8 +4836,8 @@ function rewriteExternalRequires(code, baseDir, root) {
 }
 async function injectCjsNamedExports(code, entryFile) {
   try {
-    const { createRequire: createRequire7 } = await import("module");
-    const req = createRequire7(entryFile);
+    const { createRequire: createRequire8 } = await import("module");
+    const req = createRequire8(entryFile);
     const cjsExports = req(entryFile);
     if (!cjsExports || typeof cjsExports !== "object" && typeof cjsExports !== "function" || Array.isArray(cjsExports)) return code;
     const namedKeys = Object.keys(cjsExports).filter(
@@ -4746,11 +4878,22 @@ function rewriteImports(code, config, filePath, importedUrls, moduleGraph) {
 }
 function createModuleSpecifierResolver(config, filePath) {
   const root = config.root;
-  const fileDir = import_node_path12.default.dirname(filePath);
+  const fileDir = import_node_path13.default.dirname(filePath);
   const aliasEntries = Object.entries(config.resolve.alias).sort(
     ([a], [b]) => b.length - a.length
   );
-  const toRootUrl = (abs) => "/" + import_node_path12.default.relative(root, abs).replace(/\\/g, "/");
+  const toServableUrl = (abs) => {
+    if (isUnderRoot(abs, root)) {
+      return "/" + import_node_path13.default.relative(root, abs).replace(/\\/g, "/");
+    }
+    for (const pkgRoot of getLinkedPackageRoots(root)) {
+      if (abs === pkgRoot || abs.startsWith(pkgRoot + import_node_path13.default.sep)) {
+        const normalized = abs.replace(/\\/g, "/");
+        return "/@fs/" + (normalized.startsWith("/") ? normalized.slice(1) : normalized);
+      }
+    }
+    return null;
+  };
   return (specifier) => {
     const suffixMatch = specifier.match(/[?#].*$/);
     const suffix = suffixMatch ? suffixMatch[0] : "";
@@ -4759,18 +4902,21 @@ function createModuleSpecifierResolver(config, filePath) {
       if (baseSpec === key || baseSpec.startsWith(key + "/")) {
         const aliasBase = resolveAliasTarget2(value, root);
         const sub = baseSpec.slice(key.length).replace(/^\//, "");
-        const target = sub ? import_node_path12.default.join(aliasBase, sub) : aliasBase;
+        const target = sub ? import_node_path13.default.join(aliasBase, sub) : aliasBase;
         const resolved = tryResolveDiskPath(target);
-        return resolved && isUnderRoot(resolved, root) ? toRootUrl(resolved) + suffix : specifier;
+        const url = resolved ? toServableUrl(resolved) : null;
+        return url ? url + suffix : specifier;
       }
     }
     if (baseSpec.startsWith("./") || baseSpec.startsWith("../")) {
-      const resolved = tryResolveDiskPath(import_node_path12.default.resolve(fileDir, baseSpec));
-      return resolved && isUnderRoot(resolved, root) ? toRootUrl(resolved) + suffix : specifier;
+      const resolved = tryResolveDiskPath(import_node_path13.default.resolve(fileDir, baseSpec));
+      const url = resolved ? toServableUrl(resolved) : null;
+      return url ? url + suffix : specifier;
     }
     if (baseSpec.startsWith("/") && !baseSpec.startsWith("/@")) {
-      const resolved = tryResolveDiskPath(import_node_path12.default.join(root, baseSpec.replace(/^\//, "")));
-      return resolved && isUnderRoot(resolved, root) ? toRootUrl(resolved) + suffix : specifier;
+      const resolved = tryResolveDiskPath(import_node_path13.default.join(root, baseSpec.replace(/^\//, "")));
+      const url = resolved ? toServableUrl(resolved) : null;
+      return url ? url + suffix : specifier;
     }
     if (baseSpec.startsWith("/")) return specifier;
     return `/@modules/${specifier}`;
@@ -4923,28 +5069,24 @@ function maskStringsAndComments(code) {
   return masked.join("");
 }
 function resolveAliasTarget2(value, root) {
-  if (import_node_path12.default.isAbsolute(value) && import_node_fs9.default.existsSync(value)) return value;
-  if (value.startsWith("/")) return import_node_path12.default.join(root, value.slice(1));
-  return import_node_path12.default.resolve(root, value);
+  if (import_node_path13.default.isAbsolute(value) && import_node_fs10.default.existsSync(value)) return value;
+  if (value.startsWith("/")) return import_node_path13.default.join(root, value.slice(1));
+  return import_node_path13.default.resolve(root, value);
 }
 function tryResolveDiskPath(target) {
-  if (import_node_fs9.default.existsSync(target) && import_node_fs9.default.statSync(target).isFile()) return target;
+  if (import_node_fs10.default.existsSync(target) && import_node_fs10.default.statSync(target).isFile()) return target;
   for (const ext of RESOLVE_EXTENSIONS) {
     const withExt = target + ext;
-    if (import_node_fs9.default.existsSync(withExt) && import_node_fs9.default.statSync(withExt).isFile()) return withExt;
+    if (import_node_fs10.default.existsSync(withExt) && import_node_fs10.default.statSync(withExt).isFile()) return withExt;
   }
-  if (import_node_fs9.default.existsSync(target) && import_node_fs9.default.statSync(target).isDirectory()) {
+  if (import_node_fs10.default.existsSync(target) && import_node_fs10.default.statSync(target).isDirectory()) {
     for (const ext of RESOLVE_EXTENSIONS) {
-      const idx = import_node_path12.default.join(target, "index" + ext);
-      if (import_node_fs9.default.existsSync(idx) && import_node_fs9.default.statSync(idx).isFile()) return idx;
+      const idx = import_node_path13.default.join(target, "index" + ext);
+      if (import_node_fs10.default.existsSync(idx) && import_node_fs10.default.statSync(idx).isFile()) return idx;
     }
   }
   return null;
 }
-function isUnderRoot(abs, root) {
-  const rel = import_node_path12.default.relative(root, abs);
-  return !!rel && !rel.startsWith("..") && !import_node_path12.default.isAbsolute(rel);
-}
 function appendTimestampQuery(url, timestamp) {
   const hashIndex = url.indexOf("#");
   const hash = hashIndex >= 0 ? url.slice(hashIndex) : "";
@@ -4962,7 +5104,7 @@ function resolveNodeModule(baseDir, moduleName) {
   const resolved = resolveNodeModuleEntry(baseDir, moduleName);
   if (!resolved) return null;
   try {
-    return import_node_fs9.default.realpathSync(resolved);
+    return import_node_fs10.default.realpathSync(resolved);
   } catch {
     return resolved;
   }
@@ -4982,21 +5124,21 @@ function resolveNodeModuleEntry(root, moduleName) {
   let pkgDir = null;
   let dir = root;
   for (; ; ) {
-    const candidate = import_node_path12.default.join(dir, "node_modules", pkgName);
-    if (import_node_fs9.default.existsSync(candidate)) {
+    const candidate = import_node_path13.default.join(dir, "node_modules", pkgName);
+    if (import_node_fs10.default.existsSync(candidate)) {
       pkgDir = candidate;
       break;
     }
-    const parent = import_node_path12.default.dirname(dir);
+    const parent = import_node_path13.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   if (!pkgDir) return null;
-  const pkgJsonPath = import_node_path12.default.join(pkgDir, "package.json");
-  if (!import_node_fs9.default.existsSync(pkgJsonPath)) return null;
+  const pkgJsonPath = import_node_path13.default.join(pkgDir, "package.json");
+  if (!import_node_fs10.default.existsSync(pkgJsonPath)) return null;
   let pkg;
   try {
-    pkg = JSON.parse(import_node_fs9.default.readFileSync(pkgJsonPath, "utf-8"));
+    pkg = JSON.parse(import_node_fs10.default.readFileSync(pkgJsonPath, "utf-8"));
   } catch {
     return null;
   }
@@ -5009,32 +5151,32 @@ function resolveNodeModuleEntry(root, moduleName) {
     const subDirs = [""];
     for (const field of ["module", "main"]) {
       if (typeof pkg[field] === "string") {
-        const dir2 = import_node_path12.default.dirname(pkg[field]);
+        const dir2 = import_node_path13.default.dirname(pkg[field]);
         if (dir2 && dir2 !== "." && !subDirs.includes(dir2)) subDirs.push(dir2);
       }
     }
     for (const dir2 of subDirs) {
-      const direct = import_node_path12.default.join(pkgDir, dir2, subpath);
-      if (import_node_fs9.default.existsSync(direct) && import_node_fs9.default.statSync(direct).isFile()) return direct;
+      const direct = import_node_path13.default.join(pkgDir, dir2, subpath);
+      if (import_node_fs10.default.existsSync(direct) && import_node_fs10.default.statSync(direct).isFile()) return direct;
       for (const ext of RESOLVE_EXTENSIONS) {
-        if (import_node_fs9.default.existsSync(direct + ext)) return direct + ext;
+        if (import_node_fs10.default.existsSync(direct + ext)) return direct + ext;
       }
     }
     return null;
   }
   for (const field of ["module", "jsnext:main", "jsnext", "main"]) {
     if (typeof pkg[field] === "string") {
-      const entry = import_node_path12.default.join(pkgDir, pkg[field]);
-      if (import_node_fs9.default.existsSync(entry)) return entry;
+      const entry = import_node_path13.default.join(pkgDir, pkg[field]);
+      if (import_node_fs10.default.existsSync(entry)) return entry;
     }
   }
-  const indexFallback = import_node_path12.default.join(pkgDir, "index.js");
-  if (import_node_fs9.default.existsSync(indexFallback)) return indexFallback;
+  const indexFallback = import_node_path13.default.join(pkgDir, "index.js");
+  if (import_node_fs10.default.existsSync(indexFallback)) return indexFallback;
   return null;
 }
 function resolvePackageExports(exports2, key, pkgDir) {
   if (typeof exports2 === "string") {
-    return key === "." ? import_node_path12.default.join(pkgDir, exports2) : null;
+    return key === "." ? import_node_path13.default.join(pkgDir, exports2) : null;
   }
   const entry = exports2[key];
   if (entry === void 0) {
@@ -5046,7 +5188,7 @@ function resolvePackageExports(exports2, key, pkgDir) {
   return resolveExportValue(entry, pkgDir);
 }
 function resolveExportValue(value, pkgDir) {
-  if (typeof value === "string") return import_node_path12.default.join(pkgDir, value);
+  if (typeof value === "string") return import_node_path13.default.join(pkgDir, value);
   if (Array.isArray(value)) {
     for (const item of value) {
       const r = resolveExportValue(item, pkgDir);
@@ -5065,35 +5207,54 @@ function resolveExportValue(value, pkgDir) {
   return null;
 }
 function resolveUrlToFile(url, root) {
-  const cleanUrl = url.split("?")[0];
+  const cleanUrl = url.split(/[?#]/)[0];
   if (cleanUrl.startsWith("/@modules/")) {
     const moduleName = cleanUrl.slice("/@modules/".length);
     return resolveNodeModule(root, moduleName);
   }
-  const filePath = import_node_path12.default.resolve(root, cleanUrl.replace(/^\//, ""));
-  if (import_node_fs9.default.existsSync(filePath) && import_node_fs9.default.statSync(filePath).isFile()) {
+  if (cleanUrl.startsWith("/@fs/")) {
+    let abs = cleanUrl.slice("/@fs/".length);
+    if (process.platform === "win32") {
+      abs = abs.replace(/\//g, import_node_path13.default.sep);
+    } else if (!abs.startsWith("/")) {
+      abs = "/" + abs;
+    }
+    try {
+      const real = import_node_fs10.default.realpathSync(abs);
+      if (import_node_fs10.default.statSync(real).isFile() && isAllowedDevModulePath(real, root)) return real;
+    } catch {
+      return null;
+    }
+    return null;
+  }
+  const filePath = import_node_path13.default.resolve(root, cleanUrl.replace(/^\//, ""));
+  if (import_node_fs10.default.existsSync(filePath) && import_node_fs10.default.statSync(filePath).isFile()) {
     return filePath;
   }
   for (const ext of RESOLVE_EXTENSIONS) {
     const withExt = filePath + ext;
-    if (import_node_fs9.default.existsSync(withExt)) return withExt;
+    if (import_node_fs10.default.existsSync(withExt)) return withExt;
   }
   for (const ext of RESOLVE_EXTENSIONS) {
-    const indexFile = import_node_path12.default.join(filePath, "index" + ext);
-    if (import_node_fs9.default.existsSync(indexFile)) return indexFile;
+    const indexFile = import_node_path13.default.join(filePath, "index" + ext);
+    if (import_node_fs10.default.existsSync(indexFile)) return indexFile;
   }
   return null;
 }
 function isModuleRequest(url, destination) {
-  const cleanUrl = url.split("?")[0];
+  const cleanUrl = url.split(/[?#]/)[0];
   if (/\.(ts|tsx|jsx|js|mjs|vue|css|json)$/.test(cleanUrl)) return true;
   if (cleanUrl.startsWith("/@modules/")) return true;
+  if (cleanUrl.startsWith("/@fs/")) return true;
   if (isAssetFile(cleanUrl)) {
-    const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+    const qIdx = url.indexOf("?");
+    const hIdx = url.indexOf("#");
+    const queryEnd = hIdx === -1 ? url.length : hIdx;
+    const query = qIdx === -1 || qIdx > queryEnd ? "" : url.slice(qIdx + 1, queryEnd);
     const isExplicitAssetModule = /(?:^|&)(?:url|raw)(?:&|$)/.test(query);
     return isExplicitAssetModule || destination === "script";
   }
-  if (!import_node_path12.default.extname(cleanUrl)) return true;
+  if (!import_node_path13.default.extname(cleanUrl)) return true;
   return false;
 }
 function getHmrClientCode() {
@@ -5323,13 +5484,13 @@ function clearCustomListeners(ownerPath) {
 }
 `;
 }
-var import_node_path12, import_node_fs9, import_node_module5, import_node_url3, import_picocolors6, import_meta, __dirname_esm, __require, __refreshRuntimeCache, REACT_REFRESH_BOUNDARY_HELPERS, REACT_REFRESH_GLOBAL_PREAMBLE, esmBundleCache, VALID_IDENT, RESOLVE_EXTENSIONS, ESM_CONDITIONS;
+var import_node_path13, import_node_fs10, import_node_module6, import_node_url3, import_picocolors6, import_meta, __dirname_esm, __require, __refreshRuntimeCache, REACT_REFRESH_BOUNDARY_HELPERS, REACT_REFRESH_GLOBAL_PREAMBLE, esmBundleCache, VALID_IDENT, RESOLVE_EXTENSIONS, ESM_CONDITIONS;
 var init_middleware = __esm({
   "src/server/middleware.ts"() {
     "use strict";
-    import_node_path12 = __toESM(require("path"), 1);
-    import_node_fs9 = __toESM(require("fs"), 1);
-    import_node_module5 = require("module");
+    import_node_path13 = __toESM(require("path"), 1);
+    import_node_fs10 = __toESM(require("fs"), 1);
+    import_node_module6 = require("module");
     import_node_url3 = require("url");
     import_picocolors6 = __toESM(require("picocolors"), 1);
     init_transformer();
@@ -5337,9 +5498,10 @@ var init_middleware = __esm({
     init_env();
     init_url();
     init_assets();
+    init_fs_allow();
     import_meta = {};
-    __dirname_esm = import_node_path12.default.dirname((0, import_node_url3.fileURLToPath)(import_meta.url));
-    __require = (0, import_node_module5.createRequire)(import_meta.url);
+    __dirname_esm = import_node_path13.default.dirname((0, import_node_url3.fileURLToPath)(import_meta.url));
+    __require = (0, import_node_module6.createRequire)(import_meta.url);
     __refreshRuntimeCache = null;
     REACT_REFRESH_BOUNDARY_HELPERS = `
 function __nastiIsPlainObject(obj) {
@@ -5427,9 +5589,26 @@ async function handleFileChange(file, server, environmentName = "client", timest
   }
   const moduleGraph = environment.moduleGraph;
   const logger = config.logger;
-  const relativePath = "/" + import_node_path13.default.relative(config.root, file);
-  const shortFile = import_node_path13.default.relative(config.root, file);
-  const mods = moduleGraph.getModulesByFile(file);
+  const relativePath = "/" + import_node_path14.default.relative(config.root, file);
+  const shortFile = import_node_path14.default.relative(config.root, file);
+  let mods = moduleGraph.getModulesByFile(file);
+  if (!mods || mods.size === 0) {
+    try {
+      const real = import_node_fs11.default.realpathSync(file);
+      if (real !== file) mods = moduleGraph.getModulesByFile(real);
+      if (mods && mods.size > 0) file = real;
+    } catch {
+    }
+  }
+  if (!mods || mods.size === 0) {
+    const packageRoot = findNearestPackageRoot(file);
+    if (packageRoot && getLinkedPackageRoots(config.root).some(
+      (r) => packageRoot === r || packageRoot.startsWith(r + import_node_path14.default.sep)
+    )) {
+      const under = moduleGraph.getModulesWithFileUnder(packageRoot);
+      if (under.size > 0) mods = under;
+    }
+  }
   if (!mods || mods.size === 0) {
     return null;
   }
@@ -5444,7 +5623,7 @@ async function handleFileChange(file, server, environmentName = "client", timest
       file,
       timestamp,
       modules: [mod],
-      read: () => import_node_fs10.default.readFileSync(file, "utf-8"),
+      read: () => import_node_fs11.default.readFileSync(file, "utf-8"),
       server,
       environment
     };
@@ -5505,13 +5684,14 @@ async function handleFileChange(file, server, environmentName = "client", timest
     fullReload
   };
 }
-var import_node_path13, import_node_fs10, import_picocolors7;
+var import_node_path14, import_node_fs11, import_picocolors7;
 var init_hmr = __esm({
   "src/server/hmr.ts"() {
     "use strict";
-    import_node_path13 = __toESM(require("path"), 1);
-    import_node_fs10 = __toESM(require("fs"), 1);
+    import_node_path14 = __toESM(require("path"), 1);
+    import_node_fs11 = __toESM(require("fs"), 1);
     import_picocolors7 = __toESM(require("picocolors"), 1);
+    init_fs_allow();
   }
 });
 
@@ -5529,19 +5709,19 @@ function createModuleRunner(environment) {
   }
   return new NastiModuleRunner(environment);
 }
-var import_node_path14, import_node_fs11, import_node_module6, import_node_url4, debug6, NODE_BUILTINS3, NastiModuleRunner, AsyncFunction;
+var import_node_path15, import_node_fs12, import_node_module7, import_node_url4, debug6, NODE_BUILTINS3, NastiModuleRunner, AsyncFunction;
 var init_runnable_environment = __esm({
   "src/server/runnable-environment.ts"() {
     "use strict";
-    import_node_path14 = __toESM(require("path"), 1);
-    import_node_fs11 = __toESM(require("fs"), 1);
-    import_node_module6 = require("module");
+    import_node_path15 = __toESM(require("path"), 1);
+    import_node_fs12 = __toESM(require("fs"), 1);
+    import_node_module7 = require("module");
     import_node_url4 = require("url");
     init_transformer();
     init_env();
     init_debug();
     debug6 = createDebugger("nasti:ssr");
-    NODE_BUILTINS3 = /* @__PURE__ */ new Set([...import_node_module6.builtinModules, ...import_node_module6.builtinModules.map((m) => `node:${m}`)]);
+    NODE_BUILTINS3 = /* @__PURE__ */ new Set([...import_node_module7.builtinModules, ...import_node_module7.builtinModules.map((m) => `node:${m}`)]);
     NastiModuleRunner = class {
       environment;
       config;
@@ -5556,10 +5736,10 @@ var init_runnable_environment = __esm({
           this.config.mode,
           ssrDefineOverrides(environment.consumer)
         );
-        this.require = (0, import_node_module6.createRequire)(import_node_path14.default.join(this.config.root, "package.json"));
+        this.require = (0, import_node_module7.createRequire)(import_node_path15.default.join(this.config.root, "package.json"));
         const handlers = {
           fetchModule: async (id, importer) => this.fetchModule(id, importer),
-          getBuiltins: () => [/^node:/, ...import_node_module6.builtinModules]
+          getBuiltins: () => [/^node:/, ...import_node_module7.builtinModules]
         };
         environment.hot.setInvokeHandler?.(handlers);
       }
@@ -5580,9 +5760,9 @@ var init_runnable_environment = __esm({
         this.cache.clear();
       }
       resolveToId(rawUrl) {
-        if (import_node_path14.default.isAbsolute(rawUrl) && import_node_fs11.default.existsSync(rawUrl.split("?")[0])) return rawUrl;
+        if (import_node_path15.default.isAbsolute(rawUrl) && import_node_fs12.default.existsSync(rawUrl.split("?")[0])) return rawUrl;
         const clean = rawUrl.replace(/^\//, "");
-        return import_node_path14.default.resolve(this.config.root, clean);
+        return import_node_path15.default.resolve(this.config.root, clean);
       }
       /**
        * fetchModule（invoke 契约方法）：环境管线产出 runner 可执行代码。
@@ -5591,14 +5771,14 @@ var init_runnable_environment = __esm({
        */
       async fetchModule(id, importer) {
         if (NODE_BUILTINS3.has(id)) return { externalize: id };
-        if (!id.startsWith(".") && !import_node_path14.default.isAbsolute(id) && !id.startsWith("\0")) {
+        if (!id.startsWith(".") && !import_node_path15.default.isAbsolute(id) && !id.startsWith("\0")) {
           return { externalize: id };
         }
         const container = this.environment.pluginContainer;
         let resolvedId = id;
         if (id.startsWith(".") && importer) {
           const resolved = await container.resolveId(id, importer);
-          resolvedId = resolved ? typeof resolved === "string" ? resolved : resolved.id : import_node_path14.default.resolve(import_node_path14.default.dirname(importer.split("?")[0]), id);
+          resolvedId = resolved ? typeof resolved === "string" ? resolved : resolved.id : import_node_path15.default.resolve(import_node_path15.default.dirname(importer.split("?")[0]), id);
         }
         resolvedId = this.completeExtension(resolvedId);
         const cleanId = resolvedId.split("?")[0];
@@ -5606,8 +5786,8 @@ var init_runnable_environment = __esm({
         const loaded = await container.load(resolvedId);
         if (loaded != null) {
           code = typeof loaded === "string" ? loaded : loaded.code;
-        } else if (import_node_fs11.default.existsSync(cleanId)) {
-          code = import_node_fs11.default.readFileSync(cleanId, "utf-8");
+        } else if (import_node_fs12.default.existsSync(cleanId)) {
+          code = import_node_fs12.default.readFileSync(cleanId, "utf-8");
         } else {
           throw new Error(`[nasti:ssr] cannot load module: ${resolvedId}`);
         }
@@ -5641,19 +5821,19 @@ var init_runnable_environment = __esm({
       completeExtension(id) {
         const clean = id.split("?")[0];
         const query = id.includes("?") ? id.slice(id.indexOf("?")) : "";
-        if (import_node_fs11.default.existsSync(clean) && import_node_fs11.default.statSync(clean).isFile()) return id;
+        if (import_node_fs12.default.existsSync(clean) && import_node_fs12.default.statSync(clean).isFile()) return id;
         const jsMatch = clean.match(/^(.*)\.([mc]?)jsx?$/);
         if (jsMatch) {
           for (const tsExt of [`.${jsMatch[2]}ts`, `.${jsMatch[2]}tsx`]) {
-            if (import_node_fs11.default.existsSync(jsMatch[1] + tsExt)) return jsMatch[1] + tsExt + query;
+            if (import_node_fs12.default.existsSync(jsMatch[1] + tsExt)) return jsMatch[1] + tsExt + query;
           }
         }
         for (const ext of this.config.resolve.extensions) {
-          if (import_node_fs11.default.existsSync(clean + ext)) return clean + ext + query;
+          if (import_node_fs12.default.existsSync(clean + ext)) return clean + ext + query;
         }
         for (const ext of this.config.resolve.extensions) {
-          const indexPath = import_node_path14.default.join(clean, `index${ext}`);
-          if (import_node_fs11.default.existsSync(indexPath)) return indexPath;
+          const indexPath = import_node_path15.default.join(clean, `index${ext}`);
+          if (import_node_fs12.default.existsSync(indexPath)) return indexPath;
         }
         return id;
       }
@@ -5680,10 +5860,10 @@ var init_runnable_environment = __esm({
           return;
         }
         const ssrImport = async (dep) => {
-          if (NODE_BUILTINS3.has(dep) || !dep.startsWith(".") && !import_node_path14.default.isAbsolute(dep) && !dep.startsWith("\0")) {
+          if (NODE_BUILTINS3.has(dep) || !dep.startsWith(".") && !import_node_path15.default.isAbsolute(dep) && !dep.startsWith("\0")) {
             return this.importExternal(dep);
           }
-          const depId = dep.startsWith(".") ? this.completeExtension(import_node_path14.default.resolve(import_node_path14.default.dirname(fetched.id.split("?")[0]), dep)) : this.completeExtension(dep);
+          const depId = dep.startsWith(".") ? this.completeExtension(import_node_path15.default.resolve(import_node_path15.default.dirname(fetched.id.split("?")[0]), dep)) : this.completeExtension(dep);
           return this.instantiate(depId);
         };
         const ssrExportAll = (sourceModule) => {
@@ -5715,7 +5895,7 @@ var init_runnable_environment = __esm({
       }
       async importExternal(spec) {
         try {
-          return await (spec.startsWith("node:") || !import_node_path14.default.isAbsolute(spec) ? import(this.resolveExternalSpecifier(spec)) : import((0, import_node_url4.pathToFileURL)(spec).href));
+          return await (spec.startsWith("node:") || !import_node_path15.default.isAbsolute(spec) ? import(this.resolveExternalSpecifier(spec)) : import((0, import_node_url4.pathToFileURL)(spec).href));
         } catch (err) {
           throw new Error(`[nasti:ssr] failed to import external "${spec}": ${err.message}`);
         }
@@ -5822,7 +6002,7 @@ async function createBundledDevServer(opts) {
       }
       const url = `/${patchPath}`;
       logger.info(
-        import_picocolors8.default.green("hmr update ") + import_picocolors8.default.dim(changedFiles.map((f) => import_node_path15.default.relative(config.root, f)).join(", ")),
+        import_picocolors8.default.green("hmr update ") + import_picocolors8.default.dim(changedFiles.map((f) => import_node_path16.default.relative(config.root, f)).join(", ")),
         { timestamp: true }
       );
       sendTo(clientId, { type: "hmr:update", path: url, url });
@@ -5977,7 +6157,7 @@ async function createBundledDevServer(opts) {
           return;
         }
         res.setHeader("ETag", hit.etag);
-        res.setHeader("Content-Type", MIME_TYPES[import_node_path15.default.extname(fileName)] ?? "application/octet-stream");
+        res.setHeader("Content-Type", MIME_TYPES[import_node_path16.default.extname(fileName)] ?? "application/octet-stream");
         res.setHeader("Cache-Control", "no-cache");
         res.once("finish", () => {
           void engine.notifyPayloadDelivered(fileName).catch(
@@ -6018,7 +6198,7 @@ function stripCatchAllLoad(plugins) {
   );
 }
 function createReactRefreshRuntimePlugin(entryPoints) {
-  const entryIds = new Set(entryPoints.map((p) => import_node_path15.default.resolve(p)));
+  const entryIds = new Set(entryPoints.map((p) => import_node_path16.default.resolve(p)));
   return {
     name: "nasti:bundled-react-refresh",
     resolveId(source) {
@@ -6036,7 +6216,7 @@ function createReactRefreshRuntimePlugin(entryPoints) {
       return null;
     },
     transform(code, id) {
-      if (!entryIds.has(import_node_path15.default.resolve(id.split("?")[0]))) return null;
+      if (!entryIds.has(import_node_path16.default.resolve(id.split("?")[0]))) return null;
       return { code: `import ${JSON.stringify(PREAMBLE_SPEC)};
 ${code}`, map: null };
     }
@@ -6083,11 +6263,11 @@ async function renderBundledIndexHtml(html, config, entryFileNames) {
   }
   return processed;
 }
-var import_node_path15, import_node_crypto3, import_ws2, import_picocolors8, debug7, MIME_TYPES, MemoryFiles, PREAMBLE_SPEC, RESOLVED_PREAMBLE_ID, REFRESH_RUNTIME_URL, BUNDLED_PREAMBLE_CODE, WRAPPER_RUNTIME_HELPERS;
+var import_node_path16, import_node_crypto3, import_ws2, import_picocolors8, debug7, MIME_TYPES, MemoryFiles, PREAMBLE_SPEC, RESOLVED_PREAMBLE_ID, REFRESH_RUNTIME_URL, BUNDLED_PREAMBLE_CODE, WRAPPER_RUNTIME_HELPERS;
 var init_dev_engine = __esm({
   "src/server/bundled/dev-engine.ts"() {
     "use strict";
-    import_node_path15 = __toESM(require("path"), 1);
+    import_node_path16 = __toESM(require("path"), 1);
     import_node_crypto3 = __toESM(require("crypto"), 1);
     import_ws2 = require("ws");
     import_picocolors8 = __toESM(require("picocolors"), 1);
@@ -6297,20 +6477,39 @@ async function createServer(inlineConfig = {}) {
     app.use(bundledServer.middleware);
   }
   const ignoredSegments = /* @__PURE__ */ new Set(["node_modules", ".git", ".nasti"]);
-  const outDirAbs = import_node_path16.default.resolve(config.root, config.build.outDir);
-  const watcher = (0, import_chokidar.watch)(config.root, {
+  const outDirAbs = import_node_path17.default.resolve(config.root, config.build.outDir);
+  const linkedPackageRoots = getLinkedPackageRoots(config.root).filter(
+    (r) => r !== config.root && !isUnderRoot(config.root, r)
+  );
+  const watchTargets = [config.root, ...linkedPackageRoots];
+  const watcher = (0, import_chokidar.watch)(watchTargets, {
     ignored: (filePath) => {
-      if (filePath === config.root) return false;
-      if (filePath === outDirAbs || filePath.startsWith(outDirAbs + import_node_path16.default.sep)) return true;
-      const rel = import_node_path16.default.relative(config.root, filePath);
-      if (!rel || rel.startsWith("..") || import_node_path16.default.isAbsolute(rel)) return false;
-      for (const seg of rel.split(import_node_path16.default.sep)) {
-        if (ignoredSegments.has(seg)) return true;
+      if (filePath === outDirAbs || filePath.startsWith(outDirAbs + import_node_path17.default.sep)) return true;
+      for (const watchRoot of watchTargets) {
+        if (filePath === watchRoot) return false;
+        const rel = import_node_path17.default.relative(watchRoot, filePath);
+        if (!rel || rel.startsWith("..") || import_node_path17.default.isAbsolute(rel)) continue;
+        for (const seg of rel.split(import_node_path17.default.sep)) {
+          if (ignoredSegments.has(seg)) return true;
+        }
+        return false;
       }
       return false;
     },
     ignoreInitial: true
   });
+  await new Promise((resolve, reject) => {
+    const onReady = () => {
+      watcher.off("error", onError);
+      resolve();
+    };
+    const onError = (err) => {
+      watcher.off("ready", onReady);
+      reject(err);
+    };
+    watcher.once("ready", onReady);
+    watcher.once("error", onError);
+  });
   let server;
   const environmentServices = {};
   let environmentDriversStarted = false;
@@ -6422,16 +6621,25 @@ async function createServer(inlineConfig = {}) {
     });
   };
   watcher.on("change", (file) => {
+    if (file.includes(`${import_node_path17.default.sep}node_modules${import_node_path17.default.sep}`) || file.endsWith(`${import_node_path17.default.sep}node_modules`)) {
+      clearLinkedPackageRootsCache();
+    }
     ssrRunner?.invalidateFile(file);
     queueClientEnvironmentUpdate(file);
     notifyEnvironmentDrivers(file, "change");
   });
   watcher.on("add", (file) => {
+    if (file.includes(`${import_node_path17.default.sep}node_modules${import_node_path17.default.sep}`) || file.endsWith(`${import_node_path17.default.sep}node_modules`)) {
+      clearLinkedPackageRootsCache();
+    }
     ssrRunner?.invalidateFile(file);
     queueClientEnvironmentUpdate(file);
     notifyEnvironmentDrivers(file, "add");
   });
   watcher.on("unlink", (file) => {
+    if (file.includes(`${import_node_path17.default.sep}node_modules${import_node_path17.default.sep}`) || file.endsWith(`${import_node_path17.default.sep}node_modules`)) {
+      clearLinkedPackageRootsCache();
+    }
     ssrRunner?.invalidateFile(file);
     notifyEnvironmentDrivers(file, "unlink");
   });
@@ -6461,7 +6669,7 @@ async function createServer(inlineConfig = {}) {
           const readyIn = Math.ceil(performance.now() - startTime);
           logger.info(
             `
-  ${import_picocolors9.default.cyan(import_picocolors9.default.bold("NASTI"))} ${import_picocolors9.default.cyan(`v${"2.4.3"}`)}  ${import_picocolors9.default.dim("ready in")} ${import_picocolors9.default.bold(readyIn)} ${import_picocolors9.default.dim("ms")}
+  ${import_picocolors9.default.cyan(import_picocolors9.default.bold("NASTI"))} ${import_picocolors9.default.cyan(`v${"2.4.4"}`)}  ${import_picocolors9.default.dim("ready in")} ${import_picocolors9.default.bold(readyIn)} ${import_picocolors9.default.dim("ms")}
 `
           );
           printServerUrls(
@@ -6558,7 +6766,7 @@ async function createServer(inlineConfig = {}) {
     throw error;
   }
   app.use(transformMiddleware(transformContexts.get("client")));
-  const publicDir = import_node_path16.default.resolve(config.root, "public");
+  const publicDir = import_node_path17.default.resolve(config.root, "public");
   app.use((0, import_sirv.default)(publicDir, { dev: true, etag: true }));
   app.use((0, import_sirv.default)(config.root, { dev: true, etag: true }));
   const postMiddlewares = [];
@@ -6584,12 +6792,12 @@ function getNetworkAddress() {
   }
   return "localhost";
 }
-var import_node_http, import_node_path16, import_node_os, import_connect, import_sirv, import_chokidar, import_picocolors9;
+var import_node_http, import_node_path17, import_node_os, import_connect, import_sirv, import_chokidar, import_picocolors9;
 var init_server = __esm({
   "src/server/index.ts"() {
     "use strict";
     import_node_http = __toESM(require("http"), 1);
-    import_node_path16 = __toESM(require("path"), 1);
+    import_node_path17 = __toESM(require("path"), 1);
     import_node_os = __toESM(require("os"), 1);
     import_connect = __toESM(require("connect"), 1);
     import_sirv = __toESM(require("sirv"), 1);
@@ -6605,6 +6813,7 @@ var init_server = __esm({
     init_builtins();
     init_plugin_api();
     init_env();
+    init_fs_allow();
   }
 });
 
@@ -6641,6 +6850,7 @@ init_build();
 // src/build/electron.ts
 var import_node_path11 = __toESM(require("path"), 1);
 var import_node_fs8 = __toESM(require("fs"), 1);
+var import_node_module5 = require("module");
 var import_rolldown2 = require("rolldown");
 var import_picocolors5 = __toESM(require("picocolors"), 1);
 init_config();
@@ -6686,7 +6896,7 @@ async function buildElectron(inlineConfig = {}) {
   const config = await resolveConfig({ ...inlineConfig, target: "electron" }, "build");
   const startTime = performance.now();
   assertElectronVersion(config);
-  console.log(import_picocolors5.default.cyan("\n\u26A1 nasti build (electron)") + import_picocolors5.default.dim(` v${"2.4.3"}`));
+  console.log(import_picocolors5.default.cyan("\n\u26A1 nasti build (electron)") + import_picocolors5.default.dim(` v${"2.4.4"}`));
   console.log(import_picocolors5.default.dim(`  root: ${config.root}`));
   console.log(import_picocolors5.default.dim(`  mode: ${config.mode}`));
   console.log(import_picocolors5.default.dim(`  target: electron (\u2265 ${config.electron.minVersion})`));
@@ -6830,13 +7040,21 @@ function assertElectronVersion(config) {
 }
 function detectInstalledElectron(root) {
   try {
-    const pkgPath = import_node_path11.default.resolve(root, "node_modules/electron/package.json");
-    if (!import_node_fs8.default.existsSync(pkgPath)) return null;
+    const require2 = (0, import_node_module5.createRequire)(import_node_path11.default.resolve(root, "package.json"));
+    const pkgPath = require2.resolve("electron/package.json");
     const pkg = JSON.parse(import_node_fs8.default.readFileSync(pkgPath, "utf-8"));
     const major = parseInt(String(pkg.version).split(".")[0], 10);
     return Number.isFinite(major) ? major : null;
   } catch {
-    return null;
+    try {
+      const pkgPath = import_node_path11.default.resolve(root, "node_modules/electron/package.json");
+      if (!import_node_fs8.default.existsSync(pkgPath)) return null;
+      const pkg = JSON.parse(import_node_fs8.default.readFileSync(pkgPath, "utf-8"));
+      const major = parseInt(String(pkg.version).split(".")[0], 10);
+      return Number.isFinite(major) ? major : null;
+    } catch {
+      return null;
+    }
   }
 }
 
@@ -6844,9 +7062,9 @@ function detectInstalledElectron(root) {
 init_server();
 
 // src/server/electron-dev.ts
-var import_node_path17 = __toESM(require("path"), 1);
-var import_node_fs12 = __toESM(require("fs"), 1);
-var import_node_module7 = require("module");
+var import_node_path18 = __toESM(require("path"), 1);
+var import_node_fs13 = __toESM(require("fs"), 1);
+var import_node_module8 = require("module");
 var import_node_child_process = require("child_process");
 var import_chokidar2 = __toESM(require("chokidar"), 1);
 var import_picocolors10 = __toESM(require("picocolors"), 1);
@@ -6859,7 +7077,7 @@ async function startElectronDev(inlineConfig = {}) {
   const { noSpawn, ...rest } = inlineConfig;
   const config = await resolveConfig({ ...rest, target: "electron" }, "serve");
   warnElectronVersion(config);
-  console.log(import_picocolors10.default.cyan("\n\u26A1 nasti electron dev") + import_picocolors10.default.dim(` v${"2.4.3"}`));
+  console.log(import_picocolors10.default.cyan("\n\u26A1 nasti electron dev") + import_picocolors10.default.dim(` v${"2.4.4"}`));
   const { createServer: createServer2 } = await Promise.resolve().then(() => (init_server(), server_exports));
   const server = await createServer2({
     ...rest,
@@ -6869,11 +7087,11 @@ async function startElectronDev(inlineConfig = {}) {
   await server.listen();
   const devUrl = `http://localhost:${server.config.server.port}` + electronRendererDevPath(config.electron.renderer);
   console.log(import_picocolors10.default.dim(`  renderer: ${devUrl}`));
-  const stageDir = import_node_path17.default.resolve(config.root, ".nasti");
-  import_node_fs12.default.mkdirSync(stageDir, { recursive: true });
-  const mainEntry = import_node_path17.default.resolve(config.root, config.electron.main);
+  const stageDir = import_node_path18.default.resolve(config.root, ".nasti");
+  import_node_fs13.default.mkdirSync(stageDir, { recursive: true });
+  const mainEntry = import_node_path18.default.resolve(config.root, config.electron.main);
   const preloadEntries = normalizePreload(config.electron.preload, config.root);
-  const builtMainFile = import_node_path17.default.join(stageDir, "main" + extFor(config.electron.mainFormat));
+  const builtMainFile = import_node_path18.default.join(stageDir, "main" + extFor(config.electron.mainFormat));
   const builtPreloadFiles = [];
   const compileAll = async () => {
     await compileNode(config, mainEntry, {
@@ -6883,9 +7101,9 @@ async function startElectronDev(inlineConfig = {}) {
     });
     builtPreloadFiles.length = 0;
     for (const entry of preloadEntries) {
-      if (!import_node_fs12.default.existsSync(entry)) continue;
-      const base = import_node_path17.default.basename(entry).replace(/\.[^.]+$/, "");
-      const out = import_node_path17.default.join(stageDir, base + extFor(config.electron.preloadFormat));
+      if (!import_node_fs13.default.existsSync(entry)) continue;
+      const base = import_node_path18.default.basename(entry).replace(/\.[^.]+$/, "");
+      const out = import_node_path18.default.join(stageDir, base + extFor(config.electron.preloadFormat));
       await compileNode(config, entry, {
         outFile: out,
         format: config.electron.preloadFormat,
@@ -6924,7 +7142,7 @@ async function startElectronDev(inlineConfig = {}) {
   };
   spawnElectron();
   if (config.electron.autoRestart) {
-    const watchTargets = [mainEntry, ...preloadEntries].filter(import_node_fs12.default.existsSync);
+    const watchTargets = [mainEntry, ...preloadEntries].filter(import_node_fs13.default.existsSync);
     const watcher = import_chokidar2.default.watch(watchTargets, { ignoreInitial: true });
     let restarting = null;
     let pending = false;
@@ -7004,7 +7222,7 @@ async function compileNode(config, entry, opts) {
     platform: "node",
     plugins: [oxcTransformPlugin, electronPlugin(config), resolvePlugin(config)]
   });
-  import_node_fs12.default.mkdirSync(import_node_path17.default.dirname(opts.outFile), { recursive: true });
+  import_node_fs13.default.mkdirSync(import_node_path18.default.dirname(opts.outFile), { recursive: true });
   await bundle2.write({
     file: opts.outFile,
     format: opts.format === "cjs" ? "cjs" : "esm",
@@ -7017,18 +7235,18 @@ async function compileNode(config, entry, opts) {
   await bundle2.close();
 }
 function electronRendererDevPath(renderer) {
-  const normalized = renderer.split(import_node_path17.default.sep).join("/").replace(/^\.?\//, "");
+  const normalized = renderer.split(import_node_path18.default.sep).join("/").replace(/^\.?\//, "");
   return normalized === "index.html" ? "/" : `/${normalized}`;
 }
 function resolveElectronBinary(config) {
-  if (config.electron.electronPath && import_node_fs12.default.existsSync(config.electron.electronPath)) {
+  if (config.electron.electronPath && import_node_fs13.default.existsSync(config.electron.electronPath)) {
     return config.electron.electronPath;
   }
   try {
-    const require2 = (0, import_node_module7.createRequire)(import_node_path17.default.resolve(config.root, "package.json"));
+    const require2 = (0, import_node_module8.createRequire)(import_node_path18.default.resolve(config.root, "package.json"));
     const pathFile = require2.resolve("electron");
     const electronModule = require2(pathFile);
-    if (typeof electronModule === "string" && import_node_fs12.default.existsSync(electronModule)) {
+    if (typeof electronModule === "string" && import_node_fs13.default.existsSync(electronModule)) {
       return electronModule;
     }
   } catch {
@@ -7055,10 +7273,10 @@ function warnElectronVersion(config) {
 }
 
 // src/plugins/monaco-editor.ts
-var import_node_path18 = __toESM(require("path"), 1);
-var import_node_fs13 = __toESM(require("fs"), 1);
+var import_node_path19 = __toESM(require("path"), 1);
+var import_node_fs14 = __toESM(require("fs"), 1);
 var import_node_crypto4 = __toESM(require("crypto"), 1);
-var import_node_module8 = require("module");
+var import_node_module9 = require("module");
 var DEFAULT_WORKERS = {
   editorWorkerService: "monaco-editor/esm/vs/editor/editor.worker",
   css: "monaco-editor/esm/vs/language/css/css.worker",
@@ -7077,9 +7295,9 @@ function normalizePublicPath(p) {
 }
 function readMonacoVersion(root) {
   try {
-    const require2 = (0, import_node_module8.createRequire)(import_node_path18.default.resolve(root, "package.json"));
+    const require2 = (0, import_node_module9.createRequire)(import_node_path19.default.resolve(root, "package.json"));
     const pkgJsonPath = require2.resolve("monaco-editor/package.json", { paths: [root] });
-    const pkg = JSON.parse(import_node_fs13.default.readFileSync(pkgJsonPath, "utf-8"));
+    const pkg = JSON.parse(import_node_fs14.default.readFileSync(pkgJsonPath, "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -7099,20 +7317,20 @@ function monacoEditorPlugin(options = {}) {
   let cacheDir = "";
   const building = /* @__PURE__ */ new Map();
   async function buildWorker(worker) {
-    const cacheFile = import_node_path18.default.join(cacheDir, `${worker.label}.worker.js`);
-    if (import_node_fs13.default.existsSync(cacheFile)) return cacheFile;
+    const cacheFile = import_node_path19.default.join(cacheDir, `${worker.label}.worker.js`);
+    if (import_node_fs14.default.existsSync(cacheFile)) return cacheFile;
     const existing = building.get(worker.label);
     if (existing) return existing;
     const task = (async () => {
       const { rolldown: rolldown4 } = await import("rolldown");
-      const require2 = (0, import_node_module8.createRequire)(import_node_path18.default.resolve(resolvedConfig.root, "package.json"));
+      const require2 = (0, import_node_module9.createRequire)(import_node_path19.default.resolve(resolvedConfig.root, "package.json"));
       let entry;
       try {
         entry = require2.resolve(worker.entry, { paths: [resolvedConfig.root] });
       } catch {
         entry = require2.resolve(worker.entry + ".js", { paths: [resolvedConfig.root] });
       }
-      import_node_fs13.default.mkdirSync(cacheDir, { recursive: true });
+      import_node_fs14.default.mkdirSync(cacheDir, { recursive: true });
       const bundle2 = await rolldown4({
         input: entry,
         platform: "browser"
@@ -7172,16 +7390,23 @@ function monacoEditorPlugin(options = {}) {
       resolvedConfig = config;
       const version = readMonacoVersion(config.root);
       const key = import_node_crypto4.default.createHash("sha1").update(version + "|" + publicPath).digest("hex").slice(0, 8);
-      cacheDir = import_node_path18.default.resolve(config.root, "node_modules/.nasti/monaco", key);
+      cacheDir = import_node_path19.default.resolve(config.root, "node_modules/.nasti/monaco", key);
     },
     async configureServer(server) {
       const shouldBuild = !isCDN(publicPath) || forceBuildCDN;
       const watcher = server.watcher;
-      const monacoDir = import_node_path18.default.resolve(resolvedConfig.root, "node_modules/monaco-editor");
+      const monacoLogical = import_node_path19.default.resolve(resolvedConfig.root, "node_modules/monaco-editor");
+      const monacoPaths = /* @__PURE__ */ new Set([monacoLogical]);
       try {
-        watcher?.unwatch?.(monacoDir);
+        monacoPaths.add(import_node_fs14.default.realpathSync(monacoLogical));
       } catch {
       }
+      for (const monacoDir of monacoPaths) {
+        try {
+          watcher?.unwatch?.(monacoDir);
+        } catch {
+        }
+      }
       if (!shouldBuild) return;
       void Promise.all(
         workers.map(
@@ -7207,7 +7432,7 @@ function monacoEditorPlugin(options = {}) {
             const file = await buildWorker(worker);
             res.setHeader("Content-Type", "application/javascript; charset=utf-8");
             res.setHeader("Cache-Control", "public, max-age=604800, immutable");
-            import_node_fs13.default.createReadStream(file).pipe(res);
+            import_node_fs14.default.createReadStream(file).pipe(res);
           } catch (e) {
             res.statusCode = 500;
             res.end(`Monaco worker build failed: ${e.message}`);
@@ -7242,16 +7467,16 @@ self.monaco = monaco;`,
         resolvedConfig.root,
         resolvedConfig.build.outDir,
         resolvedConfig.base
-      ) : isCDN(publicPath) ? import_node_path18.default.resolve(resolvedConfig.root, resolvedConfig.build.outDir, "monaco") : import_node_path18.default.resolve(
+      ) : isCDN(publicPath) ? import_node_path19.default.resolve(resolvedConfig.root, resolvedConfig.build.outDir, "monaco") : import_node_path19.default.resolve(
         resolvedConfig.root,
         resolvedConfig.build.outDir,
         publicPath.replace(/^\//, "")
       );
-      import_node_fs13.default.mkdirSync(outDir, { recursive: true });
+      import_node_fs14.default.mkdirSync(outDir, { recursive: true });
       for (const worker of workers) {
         try {
           const cacheFile = await buildWorker(worker);
-          import_node_fs13.default.copyFileSync(cacheFile, import_node_path18.default.join(outDir, `${worker.label}.worker.js`));
+          import_node_fs14.default.copyFileSync(cacheFile, import_node_path19.default.join(outDir, `${worker.label}.worker.js`));
         } catch (e) {
           throw new Error(
             `[nasti:monaco-editor] worker build failed for "${worker.label}": ${e.message}