@open-wxa/wxa-runner-core 0.10.1 → 0.11.0

package/dist/index.js

@@ -33,26 +33,106 @@ __export(src_exports, {
   AppBuilder: () => AppBuilder,
   DEFAULT_DEVICE: () => DEFAULT_DEVICE,
   DevServer: () => DevServer,
+  LOCAL_HOST_OF_ANY_ADDRESS: () => LOCAL_HOST_OF_ANY_ADDRESS,
   MiniProgram: () => MiniProgram,
-  createWxConfig: () => createWxConfig
+  bundleSetup: () => bundleSetup,
+  createWxConfig: () => createWxConfig,
+  findRuntimeDir: () => findRuntimeDir,
+  findSetupFile: () => findSetupFile,
+  handleProxy: () => handleProxy,
+  listen: () => listen
 });
 module.exports = __toCommonJS(src_exports);
 
 // src/server/DevServer.ts
-var import_crypto4 = require("crypto");
+var import_crypto3 = require("crypto");
 
 // src/server/FileStore.ts
-var import_crypto = require("crypto");
+var storeSequence = 0;
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder("utf-8", { ignoreBOM: true });
+function normalizeEncoding(encoding) {
+  switch (String(encoding).toLowerCase()) {
+    case "utf8":
+    case "utf-8":
+      return "utf8";
+    case "utf16le":
+    case "utf-16le":
+    case "ucs2":
+    case "ucs-2":
+      return "utf16le";
+    case "latin1":
+    case "binary":
+      return "latin1";
+    case "ascii":
+      return "ascii";
+    case "base64":
+    case "base64url":
+      return String(encoding).toLowerCase();
+    case "hex":
+      return "hex";
+    default:
+      throw new Error(`Unknown encoding: ${encoding}`);
+  }
+}
+function encodeText(text, encoding) {
+  const format = normalizeEncoding(encoding);
+  if (format === "utf8") return textEncoder.encode(text);
+  if (format === "base64" || format === "base64url") {
+    let base64 = text.split("=", 1)[0].replace(/-/g, "+").replace(/_/g, "/").replace(/[^A-Za-z0-9+/]/g, "");
+    if (base64.length % 4 === 1) base64 = base64.slice(0, -1);
+    base64 = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
+  }
+  if (format === "hex") {
+    const bytes2 = [];
+    for (let index = 0; index + 1 < text.length; index += 2) {
+      const pair = text.slice(index, index + 2);
+      if (!/^[\da-f]{2}$/i.test(pair)) break;
+      bytes2.push(parseInt(pair, 16));
+    }
+    return new Uint8Array(bytes2);
+  }
+  const bytes = new Uint8Array(text.length * (format === "utf16le" ? 2 : 1));
+  for (let index = 0; index < text.length; index++) {
+    const code = text.charCodeAt(index);
+    if (format === "utf16le") {
+      bytes[index * 2] = code & 255;
+      bytes[index * 2 + 1] = code >>> 8;
+    } else bytes[index] = code & 255;
+  }
+  return bytes;
+}
+function decodeText(bytes, encoding) {
+  const format = normalizeEncoding(encoding);
+  if (format === "utf8") return textDecoder.decode(bytes);
+  if (format === "hex") return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  const chunks = [];
+  for (let offset = 0; offset < bytes.length; offset += 32768) {
+    const chunk = bytes.subarray(offset, offset + 32768);
+    const codes = [];
+    for (let index = 0; index < chunk.length; index++) {
+      if (format === "utf16le") {
+        if (index + 1 < chunk.length) codes.push(chunk[index] | chunk[++index] << 8);
+      } else codes.push(format === "ascii" ? chunk[index] & 127 : chunk[index]);
+    }
+    chunks.push(String.fromCharCode(...codes));
+  }
+  const text = chunks.join("");
+  if (format === "base64") return btoa(text);
+  if (format === "base64url") return btoa(text).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return text;
+}
 var FileStore = class {
   /** @param roots 预先创建的目录（如用户目录）。rmdir 不能删除它们和它们的上级目录：删掉之后再写 USER_DATA_PATH 都会失败 */
   constructor(roots = []) {
-    this.etagPrefix = (0, import_crypto.randomUUID)();
+    this.etagPrefix = globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${++storeSequence}-${Math.random().toString(36).slice(2)}`;
     this.version = 0;
-    this.nodes = /* @__PURE__ */ new Map([["/", { dir: true, data: Buffer.alloc(0), mtime: Date.now(), etag: "" }]]);
+    this.nodes = /* @__PURE__ */ new Map([["/", { dir: true, data: new Uint8Array(0), mtime: Date.now(), etag: "" }]]);
     this.operations = {
       readFile: ({ filePath, encoding }) => {
         const data = this.read(filePath);
-        return encoding === void 0 ? { data: data.toString("base64"), binary: true } : { data: data.toString(encoding) };
+        return encoding === void 0 ? { data: decodeText(data, "base64"), binary: true } : { data: decodeText(data, encoding) };
       },
       writeFile: (args) => this.writeEncoded(args, false),
       appendFile: (args) => this.writeEncoded(args, true),
@@ -114,16 +194,21 @@ var FileStore = class {
       if (!recursive) throw new Error(`no such file or directory ${dirPath}`);
       this.mkdir(parent, true);
     }
-    this.nodes.set(target, { dir: true, data: Buffer.alloc(0), mtime: Date.now(), etag: "" });
+    this.nodes.set(target, { dir: true, data: new Uint8Array(0), mtime: Date.now(), etag: "" });
   }
   write(filePath, input, append = false) {
-    const data = Buffer.from(input);
+    const data = typeof input === "string" ? textEncoder.encode(input) : new Uint8Array(input);
     const target = this.normalize(filePath);
     const parent = target.slice(0, target.lastIndexOf("/")) || "/";
     if (!this.nodes.get(parent)?.dir) throw new Error(`no such file or directory ${filePath}`);
     const existing = this.nodes.get(target);
     if (existing?.dir) throw new Error(`illegal operation on a directory ${filePath}`);
-    const contents = append && existing ? Buffer.concat([existing.data, data]) : data;
+    let contents = data;
+    if (append && existing) {
+      contents = new Uint8Array(existing.data.length + data.length);
+      contents.set(existing.data);
+      contents.set(data, existing.data.length);
+    }
     this.nodes.set(target, { dir: false, data: contents, mtime: Date.now(), etag: `${this.etagPrefix}-${++this.version}` });
   }
   read(filePath) {
@@ -158,7 +243,7 @@ var FileStore = class {
     return this.operations[operation](args);
   }
   writeEncoded(args, append) {
-    this.write(args.filePath, Buffer.from(args.data ?? "", args.binary ? "base64" : args.encoding || "utf8"), append);
+    this.write(args.filePath, encodeText(args.data ?? "", args.binary ? "base64" : args.encoding || "utf8"), append);
     return {};
   }
   existing(filePath) {
@@ -347,6 +432,11 @@ function describeError(project, error) {
   return error?.message ?? String(error);
 }
 
+// src/project/toJs.ts
+function toJs(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+
 // src/project/wxConfig.ts
 var DEFAULT_WINDOW = {
   navigationBarBackgroundColor: "#000000",
@@ -686,9 +776,6 @@ try { require(${toJs(file)}); } catch (error) { console.error(${toJs("[wxa-runne
 function rewriteSafeAreaInsets(code) {
   return code.replace(/\b(?:env|constant)\(\s*safe-area-inset-(top|right|bottom|left)\b/g, "var(--wxa-safe-area-inset-$1");
 }
-function toJs(value) {
-  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-}
 function classifyFile(file) {
   if (file.endsWith(".json")) return "config";
   if (file.endsWith(".wxml") || file.endsWith(".wxs")) return "wxml";
@@ -882,155 +969,7 @@ function fromServerPath(prefix, serverPath) {
   }
 }
 
-// src/server/plugins.ts
-var import_wxa_runner_extractor2 = require("@open-wxa/wxa-runner-extractor");
-
-// src/server/wechatDev.ts
-var import_wxa_runner_extractor = require("@open-wxa/wxa-runner-extractor");
-var BASE_URL = "https://servicewechat.com";
-var CLIENT_VERSION = "1021810240";
-var DEFAULT_TIMEOUT = 1e4;
-var ERROR_HINTS = {
-  // 40001：开发者工具刷新过 ticket，旧的随即作废
-  40001: "\uFF08\u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u8BF7\u5728\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u91CC\u91CD\u65B0\u767B\u5F55\uFF09",
-  40029: "\uFF08\u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u8BF7\u5728\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u91CC\u91CD\u65B0\u767B\u5F55\uFF09",
-  85023: "\uFF08\u5F53\u524D\u5FAE\u4FE1\u8D26\u53F7\u4E0D\u662F\u8BE5\u5C0F\u7A0B\u5E8F\u7684\u5F00\u53D1\u8005\uFF09"
-};
-function requireUsableTicket(ticket) {
-  if (!ticket) throw new Error(`\u672A\u627E\u5230\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u7684\u767B\u5F55\u6001\uFF0C\u8BF7\u767B\u5F55\u5F00\u53D1\u8005\u5DE5\u5177\uFF0C\u6216\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ${import_wxa_runner_extractor.TICKET_ENV}`);
-  if (ticket.expiredAt !== void 0 && ticket.expiredAt <= Date.now()) {
-    throw new Error("\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u7684\u767B\u5F55\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u6253\u5F00\u5F00\u53D1\u8005\u5DE5\u5177\u5237\u65B0\u767B\u5F55\u6001");
-  }
-  return ticket.newticket;
-}
-function explainErrcode(errcode) {
-  return errcode !== void 0 && ERROR_HINTS[errcode] || "";
-}
-function requireOk(body, action) {
-  const errcode = body.baseresponse?.errcode;
-  if (errcode !== 0) throw new Error(`${action} ${errcode}: ${body.baseresponse?.errmsg || "\u672A\u77E5\u9519\u8BEF"}${explainErrcode(errcode)}`);
-  return body;
-}
-var WechatDevClient = class {
-  /**
-   * @param findTicket 每次请求都重新取：开发者工具重新登录、切换账号后不用重启服务器
-   */
-  constructor(appid, findTicket) {
-    this.appid = appid;
-    this.findTicket = findTicket;
-  }
-  /**
-   * POST JSON 到 path（如 wxa-dev-logic/jslogin），带上 appid 和开发者 ticket
-   *
-   * @throws 没有可用的登录态、超时、连不上、HTTP 状态不是 2xx 时，消息是给用户看的原因
-   */
-  async post(path7, body, timeout = DEFAULT_TIMEOUT) {
-    const query = new URLSearchParams({ appid: this.appid, newticket: requireUsableTicket(await this.findTicket()), clientversion: CLIENT_VERSION });
-    const response = await fetch(`${BASE_URL}/${path7}?${query}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(timeout)
-    }).catch((error) => {
-      throw new Error(error.name === "TimeoutError" ? `\u8BF7\u6C42\u5FAE\u4FE1\u670D\u52A1\u5668\u8D85\u65F6\uFF08${timeout / 1e3}s\uFF09` : `\u8BF7\u6C42\u5FAE\u4FE1\u670D\u52A1\u5668\u5931\u8D25\uFF1A${error.cause?.message ?? error.message}`);
-    });
-    if (!response.ok) throw new Error(`\u5FAE\u4FE1\u670D\u52A1\u5668\u8FD4\u56DE HTTP ${response.status}`);
-    return response;
-  }
-  /** 同 post，返回解析后的 JSON */
-  async postJson(path7, body) {
-    return (await this.post(path7, body)).json();
-  }
-};
-
-// src/server/plugins.ts
-var DOWNLOAD_TIMEOUT = 3e4;
-var PACKAGE_MAGIC = 190;
-var PluginStore = class {
-  /**
-   * @param wechat 开启 --devtools-login 时才有，没有时不下载插件
-   */
-  constructor(wechat, logger) {
-    this.wechat = wechat;
-    this.logger = logger;
-    /** provider@version → 下载结果；失败的不留，下次打开小程序时重试 */
-    this.downloads = /* @__PURE__ */ new Map();
-    /**
-     * 这次打开小程序时决定用哪些插件。同一次打开的逻辑层、业务模块、渲染层等请求都按它处理：
-     * 各自去下载的话，下载失败时每个请求都会重试，结果还可能前后不一，页面列表和逻辑层对不上
-     */
-    this.selection = null;
-    /** 没开 --devtools-login 的提示每个插件只说一次 */
-    this.warned = /* @__PURE__ */ new Set();
-  }
-  /** 打开小程序时（宿主取 app-info）调用：重新决定用哪些插件，下载过的直接用，上次失败的重试 */
-  async refresh(build2) {
-    this.selection = this.select(build2);
-    return withPlugins(build2, await this.selection);
-  }
-  /** 其余请求沿用这次打开时的决定，不触发下载；还没决定过时（如直接请求逻辑层）先决定一次 */
-  async current(build2) {
-    this.selection ??= this.select(build2);
-    return withPlugins(build2, await this.selection);
-  }
-  /** app.json 声明的插件；下载不了的跳过，在终端说明原因，小程序自己的页面照常可用 */
-  async select(build2) {
-    const declared = build2.wxConfig.plugins || {};
-    const results = await Promise.all(Object.entries(declared).map(
-      ([alias, { provider, version }]) => provider && version ? this.load(alias, provider, version) : null
-    ));
-    return results.filter((plugin) => !!plugin);
-  }
-  async load(alias, provider, version) {
-    const label = `\u63D2\u4EF6 ${alias}\uFF08${provider}@${version}\uFF09`;
-    if (!this.wechat) {
-      this.warnOnce(label, `[wxa-runner] ${label} \u7684\u4EE3\u7801\u8981\u7528\u5F00\u53D1\u8005\u7684\u767B\u5F55\u6001\u5411\u5FAE\u4FE1\u4E0B\u8F7D\uFF0C\u542F\u52A8\u65F6\u52A0 --devtools-login`);
-      return null;
-    }
-    const key = `${provider}@${version}`;
-    let download = this.downloads.get(key);
-    if (!download) {
-      download = this.download(this.wechat, alias, provider, version);
-      this.downloads.set(key, download);
-      download.catch(() => this.downloads.delete(key));
-    }
-    try {
-      return await download;
-    } catch (error) {
-      this.logger.warn(`[wxa-runner] ${label} \u4E0B\u8F7D\u5931\u8D25\uFF1A${error.message}`);
-      return null;
-    }
-  }
-  /** @throws 没有登录态、连不上、微信拒绝或返回的不是插件代码包时，消息是原因 */
-  async download(wechat, alias, provider, version) {
-    const response = await wechat.post("wxa-dev/getplugincode", { plugin_id: provider, plugin_version: version }, DOWNLOAD_TIMEOUT);
-    const data = Buffer.from(await response.arrayBuffer());
-    if (data[0] !== PACKAGE_MAGIC) {
-      let body = {};
-      try {
-        body = JSON.parse(data.toString("utf8"));
-      } catch {
-      }
-      if (body.baseresponse?.errcode) requireOk(body, "\u5FAE\u4FE1\u62D2\u7EDD\u4E0B\u8F7D");
-      throw new Error("\u5FAE\u4FE1\u6CA1\u6709\u8FD4\u56DE\u63D2\u4EF6\u4EE3\u7801");
-    }
-    const files = new Map((0, import_wxa_runner_extractor2.readWxvpkgIndex)(data).map((entry) => [entry.name, Buffer.from((0, import_wxa_runner_extractor2.readWxvpkgFile)(data, entry))]));
-    const pluginJson = JSON.parse(files.get("/plugin.json")?.toString("utf8") || "{}");
-    return {
-      alias,
-      provider,
-      version,
-      files,
-      pages: Object.values(pluginJson.pages || {}),
-      pageConfigs: pluginJson.page || {}
-    };
-  }
-  warnOnce(key, message) {
-    if (this.warned.has(key)) return;
-    this.warned.add(key);
-    this.logger.warn(message);
-  }
-};
+// src/server/pluginCode.ts
 function withPlugins(build2, plugins) {
   if (!plugins.length) return { ...build2, plugins };
   return {
@@ -1175,7 +1114,8 @@ importScripts(${modules.map((url) => toJs(url)).join(", ")});
 }
 function pluginWebviewHtml(build2, plugin, innerPath, pagePath, webviewId, options = {}) {
   const id = Number(webviewId) || 0;
-  const page = plugin.files.get(`/${innerPath}.html`)?.toString("utf8") ?? `<script>console.error(${JSON.stringify(`[wxa-runner] \u63D2\u4EF6 ${plugin.alias} \u91CC\u6CA1\u6709\u9875\u9762 ${innerPath}`)})</script>`;
+  const html2 = plugin.files.get(`/${innerPath}.html`);
+  const page = html2 ? new TextDecoder().decode(html2) : `<script>console.error(${JSON.stringify(`[wxa-runner] \u63D2\u4EF6 ${plugin.alias} \u91CC\u6CA1\u6709\u9875\u9762 ${innerPath}`)})</script>`;
   return `<!DOCTYPE html>
 <html>
 <head>
@@ -1218,6 +1158,94 @@ function escapeHtml(text) {
   return text.replace(/[&<>"]/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[ch]);
 }
 
+// src/server/appRoutes.ts
+var DEFAULT_DEVICE = {
+  model: "iPhone X",
+  screenWidth: 375,
+  screenHeight: 812,
+  pixelRatio: 3,
+  statusBarHeight: 44,
+  safeAreaBottom: 34,
+  system: "iOS 16.0",
+  platform: "devtools"
+};
+var PLUGIN_SCRIPT = /^\/__wxa__\/plugin\/([^/]+)\/([^/]+)\/(appservice\.js|pageframe\.js)$/;
+function routeApp(source, url) {
+  const { build: build2 } = source;
+  const pathname = safeDecode(url.pathname);
+  if (pathname === null) return null;
+  const query = url.searchParams;
+  switch (pathname) {
+    case "/__wxa__/appservice.html": {
+      const launchPath = (query.get("path") || "").replace(/^\//, "");
+      const launch = build2.pages.includes(launchPath) ? { path: launchPath, query: Object.fromEntries(new URLSearchParams(query.get("query") || "")) } : { path: build2.pages[0], query: {} };
+      return html(appserviceHtml(build2, launch, { hot: source.hot, isolated: source.isolated }));
+    }
+    case "/__wxa__/subcontext.html": {
+      const id = Number(query.get("id"));
+      if (!Number.isInteger(id) || id <= 0) return { status: 400, type: "text", body: "\u5B50\u4E0A\u4E0B\u6587 id \u65E0\u6548" };
+      return html(subcontextHtml(id, query.get("empty") === "1"));
+    }
+    case "/__wxa__/worker.js":
+      return js(workerScript(build2, source.baseLib));
+    case "/__wxa__/service-bootstrap.js":
+      return js(build2.serviceBootstrap);
+    case "/__wxa__/service-templates.js":
+      return js(build2.serviceTemplates);
+    case "/__wxa__/page-templates.js":
+      return js(build2.pageTemplates);
+    case "/__wxa__/page-styles.js":
+      return js(build2.pageStyles);
+    case "/__wxa__/page-frame.js":
+      return js(build2.pageFrame);
+  }
+  const webview = /^\/__wxa__\/webview\/(.+)\.html$/.exec(pathname);
+  if (webview) {
+    const pagePath = webview[1];
+    if (!build2.pages.includes(pagePath)) return null;
+    const webviewId = Number(query.get("id"));
+    const pluginPage = findPluginPage(build2, pagePath);
+    return html(pluginPage ? pluginWebviewHtml(build2, pluginPage.plugin, pluginPage.innerPath, pagePath, webviewId, { scripts: source.webviewScripts }) : webviewHtml(build2, pagePath, webviewId, { hot: source.hot, scripts: source.webviewScripts }));
+  }
+  const pluginScript = PLUGIN_SCRIPT.exec(pathname);
+  if (pluginScript) {
+    const [, provider, version, file] = pluginScript;
+    const code = build2.plugins.find((plugin) => plugin.provider === provider && plugin.version === version)?.files.get(`/${file}`);
+    return code ? { status: 200, type: "js", body: code } : null;
+  }
+  const pluginFile = /^\/__plugin__\/([^/]+)(\/.+)$/.exec(pathname);
+  if (pluginFile) {
+    const file = build2.plugins.find((plugin) => plugin.provider === pluginFile[1])?.files.get(pluginFile[2]);
+    return file ? { status: 200, type: extname(pluginFile[2]) || "application/octet-stream", body: file } : null;
+  }
+  const module2 = /^\/__wxa__\/module\/(.+\.js)$/.exec(pathname);
+  if (module2) {
+    const id = module2[1];
+    if (!build2.modules.includes(id) && !build2.workerModules.includes(id)) {
+      return { status: 404, type: "js", body: `console.error(${JSON.stringify(`[wxa-runner] \u6A21\u5757 ${id} \u4E0D\u5B58\u5728`)})` };
+    }
+    return js(source.moduleScript(id));
+  }
+  return null;
+}
+function extname(filePath) {
+  const match = /\.[^./]+$/.exec(filePath);
+  return match ? match[0] : "";
+}
+function html(body) {
+  return { status: 200, type: "html", body };
+}
+function js(body) {
+  return { status: 200, type: "js", body };
+}
+function safeDecode(pathname) {
+  try {
+    return decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+}
+
 // src/server/ignoreList.ts
 var STRIDE = 100;
 var BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
@@ -1296,48 +1324,64 @@ function ignoreConsoleHook(sourceMap) {
 // src/server/proxy.ts
 var import_node_stream = require("stream");
 var import_promises = require("stream/promises");
+
+// src/server/proxyFetch.ts
 var DROPPED_REQUEST_HEADERS = /* @__PURE__ */ new Set(["host", "connection", "content-length", "transfer-encoding", "keep-alive", "upgrade", "expect"]);
 var DROPPED_RESPONSE_HEADERS = /* @__PURE__ */ new Set(["content-encoding", "content-length", "transfer-encoding", "connection", "set-cookie"]);
-async function handleProxy(req, res) {
-  const target = fromServerPath(PROXY_PREFIX, req.originalUrl);
-  if (!target) {
-    sendProxyError(res, 400, `invalid url "${req.originalUrl}"`);
-    return;
-  }
-  const controller = new AbortController();
-  const cancel = () => controller.abort();
-  res.once("close", cancel);
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+async function proxyFetch(request, options = {}) {
+  const url = new URL(request.url);
+  const path7 = url.pathname + url.search;
+  const target = fromServerPath(PROXY_PREFIX, path7);
+  if (!target) return proxyError(400, `invalid url "${path7}"`);
   try {
+    let current = new URL(target);
+    if (options.isAllowed && !options.isAllowed(current)) return forbiddenHost(current, 0);
+    const headers = new Headers(
+      forwardedRequestHeaders(request.headers.get("x-wxa-headers") ?? void 0, request.headers.get("content-type") ?? "")
+    );
+    let method = request.method;
+    let body = request.body && !["GET", "HEAD"].includes(method) ? await request.arrayBuffer() : void 0;
+    const send = options.fetch ?? fetch;
     let upstream;
-    try {
-      upstream = await fetch(target, {
-        method: req.method,
-        headers: forwardedRequestHeaders(req.get("x-wxa-headers"), req.get("content-type")),
-        body: requestBody(req),
-        redirect: "follow",
-        signal: controller.signal
+    for (let hop = 0; ; hop++) {
+      upstream = await send(current.href, {
+        method,
+        headers,
+        body,
+        redirect: options.isAllowed ? "manual" : "follow",
+        signal: request.signal
       });
-    } catch (error) {
-      if (res.destroyed || controller.signal.aborted) return;
-      sendProxyError(res, 502, fetchErrorMessage(error));
-      return;
+      const location = upstream.headers.get("location");
+      if (!options.isAllowed || !REDIRECT_STATUSES.has(upstream.status) || location === null) break;
+      await upstream.body?.cancel();
+      const next = new URL(location, current);
+      if (hop >= 20) return proxyError(403, `host "${next.hostname}": redirect hop ${hop + 1} exceeds limit 20`);
+      if (!["http:", "https:"].includes(next.protocol) || !options.isAllowed(next)) return forbiddenHost(next, hop + 1);
+      if (upstream.status === 303 && method !== "GET" && method !== "HEAD" || (upstream.status === 301 || upstream.status === 302) && method === "POST") {
+        method = "GET";
+        body = void 0;
+        for (const name of ["content-type", "content-encoding", "content-language", "content-location"]) headers.delete(name);
+      }
+      if (next.origin !== current.origin) {
+        for (const name of ["authorization", "proxy-authorization", "cookie"]) headers.delete(name);
+      }
+      current = next;
     }
-    await relayResponse(upstream, res);
+    return relayResponse(upstream);
   } catch (error) {
-    if (!res.destroyed) res.destroy(error);
-  } finally {
-    res.off("close", cancel);
+    return proxyError(502, fetchErrorMessage(error));
   }
 }
-function requestBody(req) {
-  const hasBody = !["GET", "HEAD"].includes(req.method) && Buffer.isBuffer(req.body) && req.body.length > 0;
-  return hasBody ? req.body : void 0;
+function forbiddenHost(url, hop) {
+  return proxyError(403, `host "${url.hostname}" is not in the allowlist (redirect hop ${hop})`);
 }
-function fetchErrorMessage(error) {
-  return error?.cause?.message || error.message;
+function proxyError(status, message) {
+  return new Response(message, { status, headers: { "x-wxa-proxy-error": "1", "content-type": "text/html; charset=utf-8" } });
 }
-function sendProxyError(res, status, message) {
-  res.status(status).set("x-wxa-proxy-error", "1").send(message);
+function fetchErrorMessage(error) {
+  const detail = error;
+  return detail?.cause?.message || detail?.message || String(error);
 }
 function forwardedRequestHeaders(encoded, browserContentType = "") {
   const multipart = browserContentType.startsWith("multipart/form-data");
@@ -1352,27 +1396,61 @@ function forwardedRequestHeaders(encoded, browserContentType = "") {
 }
 function parseHeaders(encoded = "{}") {
   try {
-    return JSON.parse(encoded);
+    const parsed = JSON.parse(encoded);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
   }
 }
-async function relayResponse(upstream, res) {
+function relayResponse(upstream) {
   const responseHeaders = {};
+  const headers = new Headers();
   upstream.headers.forEach((value, key) => {
     responseHeaders[key] = value;
-    if (!DROPPED_RESPONSE_HEADERS.has(key)) res.setHeader(key, value);
+    if (!DROPPED_RESPONSE_HEADERS.has(key)) headers.set(key, value);
   });
-  res.status(upstream.status);
-  res.setHeader("x-wxa-headers", encodeURIComponent(JSON.stringify(responseHeaders)));
+  headers.set("x-wxa-headers", encodeURIComponent(JSON.stringify(responseHeaders)));
   const setCookies = typeof upstream.headers.getSetCookie === "function" ? upstream.headers.getSetCookie() : [];
-  res.setHeader("x-wxa-set-cookie", encodeURIComponent(JSON.stringify(setCookies)));
-  res.flushHeaders();
-  if (!upstream.body) {
-    res.end();
-    return;
+  headers.set("x-wxa-set-cookie", encodeURIComponent(JSON.stringify(setCookies)));
+  return new Response(upstream.body, { status: upstream.status, statusText: upstream.statusText, headers });
+}
+
+// src/server/proxy.ts
+async function handleProxy(req, res) {
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  res.once("close", cancel);
+  try {
+    const headers = new Headers();
+    for (const name of ["x-wxa-headers", "content-type"]) {
+      const value = req.get(name);
+      if (value !== void 0) headers.set(name, value);
+    }
+    const hasBody = !["GET", "HEAD"].includes(req.method) && Buffer.isBuffer(req.body) && req.body.length > 0;
+    const request = new globalThis.Request(`http://localhost${req.originalUrl}`, {
+      method: req.method,
+      headers,
+      body: hasBody ? req.body : void 0,
+      signal: controller.signal
+    });
+    const response = await proxyFetch(request);
+    if (res.destroyed || controller.signal.aborted) {
+      await response.body?.cancel();
+      return;
+    }
+    response.headers.forEach((value, name) => res.setHeader(name, value));
+    res.status(response.status);
+    res.flushHeaders();
+    if (!response.body) {
+      res.end();
+      return;
+    }
+    await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(response.body), res);
+  } catch (error) {
+    if (!res.destroyed) res.destroy(error);
+  } finally {
+    res.off("close", cancel);
   }
-  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(upstream.body), res);
 }
 
 // src/server/hmr.ts
@@ -1391,18 +1469,18 @@ function planHotUpdate(files, units) {
 
 // src/server/developerTicket.ts
 var import_child_process = require("child_process");
-var import_crypto2 = require("crypto");
+var import_crypto = require("crypto");
 var import_promises2 = require("timers/promises");
 var import_ws = require("ws");
-var import_wxa_runner_extractor3 = require("@open-wxa/wxa-runner-extractor");
+var import_wxa_runner_extractor = require("@open-wxa/wxa-runner-extractor");
 var AUTO_PORT = 9420;
 var CLI_TIMEOUT = 6e4;
 var AUTOMATOR_TIMEOUT = 5e3;
 var WINDOW_TIMEOUT = 1e4;
 var WINDOW_RETRY_INTERVAL = 500;
 function developerTicketSource(projectPath, logger) {
-  const cli = (0, import_wxa_runner_extractor3.findElectronDevtoolsCli)();
-  if (!cli) return async () => (0, import_wxa_runner_extractor3.findDeveloperTicket)();
+  const cli = (0, import_wxa_runner_extractor.findElectronDevtoolsCli)();
+  if (!cli) return async () => (0, import_wxa_runner_extractor.findDeveloperTicket)();
   let automatorPort = null;
   const startOnce = () => {
     if (!automatorPort) {
@@ -1418,7 +1496,7 @@ function developerTicketSource(projectPath, logger) {
     return automatorPort;
   };
   return async () => {
-    if (process.env[import_wxa_runner_extractor3.TICKET_ENV]) return { newticket: process.env[import_wxa_runner_extractor3.TICKET_ENV] };
+    if (process.env[import_wxa_runner_extractor.TICKET_ENV]) return { newticket: process.env[import_wxa_runner_extractor.TICKET_ENV] };
     const port = startOnce();
     try {
       return await requestTicketOnceWindowReady(await port, projectPath);
@@ -1483,7 +1561,7 @@ function cliErrorMessage(stdout) {
 }
 function requestTicket(port) {
   return new Promise((resolve, reject) => {
-    const id = `wxa-runner-${(0, import_crypto2.randomUUID)()}`;
+    const id = `wxa-runner-${(0, import_crypto.randomUUID)()}`;
     const socket = new import_ws.WebSocket(`ws://127.0.0.1:${port}`);
     const settle = (finish) => {
       clearTimeout(timer);
@@ -1523,6 +1601,156 @@ function explainAutomatorError(message) {
   return new Error(`\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u8FD4\u56DE\u9519\u8BEF\uFF1A${message}`);
 }
 
+// src/server/plugins.ts
+var import_wxa_runner_extractor3 = require("@open-wxa/wxa-runner-extractor");
+
+// src/server/wechatDev.ts
+var import_wxa_runner_extractor2 = require("@open-wxa/wxa-runner-extractor");
+var BASE_URL = "https://servicewechat.com";
+var CLIENT_VERSION = "1021810240";
+var DEFAULT_TIMEOUT = 1e4;
+var ERROR_HINTS = {
+  // 40001：开发者工具刷新过 ticket，旧的随即作废
+  40001: "\uFF08\u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u8BF7\u5728\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u91CC\u91CD\u65B0\u767B\u5F55\uFF09",
+  40029: "\uFF08\u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u8BF7\u5728\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u91CC\u91CD\u65B0\u767B\u5F55\uFF09",
+  85023: "\uFF08\u5F53\u524D\u5FAE\u4FE1\u8D26\u53F7\u4E0D\u662F\u8BE5\u5C0F\u7A0B\u5E8F\u7684\u5F00\u53D1\u8005\uFF09"
+};
+function requireUsableTicket(ticket) {
+  if (!ticket) throw new Error(`\u672A\u627E\u5230\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u7684\u767B\u5F55\u6001\uFF0C\u8BF7\u767B\u5F55\u5F00\u53D1\u8005\u5DE5\u5177\uFF0C\u6216\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ${import_wxa_runner_extractor2.TICKET_ENV}`);
+  if (ticket.expiredAt !== void 0 && ticket.expiredAt <= Date.now()) {
+    throw new Error("\u5FAE\u4FE1\u5F00\u53D1\u8005\u5DE5\u5177\u7684\u767B\u5F55\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u6253\u5F00\u5F00\u53D1\u8005\u5DE5\u5177\u5237\u65B0\u767B\u5F55\u6001");
+  }
+  return ticket.newticket;
+}
+function explainErrcode(errcode) {
+  return errcode !== void 0 && ERROR_HINTS[errcode] || "";
+}
+function requireOk(body, action) {
+  const errcode = body.baseresponse?.errcode;
+  if (errcode !== 0) throw new Error(`${action} ${errcode}: ${body.baseresponse?.errmsg || "\u672A\u77E5\u9519\u8BEF"}${explainErrcode(errcode)}`);
+  return body;
+}
+var WechatDevClient = class {
+  /**
+   * @param findTicket 每次请求都重新取：开发者工具重新登录、切换账号后不用重启服务器
+   */
+  constructor(appid, findTicket) {
+    this.appid = appid;
+    this.findTicket = findTicket;
+  }
+  /**
+   * POST JSON 到 path（如 wxa-dev-logic/jslogin），带上 appid 和开发者 ticket
+   *
+   * @throws 没有可用的登录态、超时、连不上、HTTP 状态不是 2xx 时，消息是给用户看的原因
+   */
+  async post(path7, body, timeout = DEFAULT_TIMEOUT) {
+    const query = new URLSearchParams({ appid: this.appid, newticket: requireUsableTicket(await this.findTicket()), clientversion: CLIENT_VERSION });
+    const response = await fetch(`${BASE_URL}/${path7}?${query}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeout)
+    }).catch((error) => {
+      throw new Error(error.name === "TimeoutError" ? `\u8BF7\u6C42\u5FAE\u4FE1\u670D\u52A1\u5668\u8D85\u65F6\uFF08${timeout / 1e3}s\uFF09` : `\u8BF7\u6C42\u5FAE\u4FE1\u670D\u52A1\u5668\u5931\u8D25\uFF1A${error.cause?.message ?? error.message}`);
+    });
+    if (!response.ok) throw new Error(`\u5FAE\u4FE1\u670D\u52A1\u5668\u8FD4\u56DE HTTP ${response.status}`);
+    return response;
+  }
+  /** 同 post，返回解析后的 JSON */
+  async postJson(path7, body) {
+    return (await this.post(path7, body)).json();
+  }
+};
+
+// src/server/plugins.ts
+var DOWNLOAD_TIMEOUT = 3e4;
+var PACKAGE_MAGIC = 190;
+var PluginStore = class {
+  /**
+   * @param wechat 开启 --devtools-login 时才有，没有时不下载插件
+   */
+  constructor(wechat, logger) {
+    this.wechat = wechat;
+    this.logger = logger;
+    /** provider@version → 下载结果；失败的不留，下次打开小程序时重试 */
+    this.downloads = /* @__PURE__ */ new Map();
+    /**
+     * 这次打开小程序时决定用哪些插件。同一次打开的逻辑层、业务模块、渲染层等请求都按它处理：
+     * 各自去下载的话，下载失败时每个请求都会重试，结果还可能前后不一，页面列表和逻辑层对不上
+     */
+    this.selection = null;
+    /** 没开 --devtools-login 的提示每个插件只说一次 */
+    this.warned = /* @__PURE__ */ new Set();
+  }
+  /** 打开小程序时（宿主取 app-info）调用：重新决定用哪些插件，下载过的直接用，上次失败的重试 */
+  async refresh(build2) {
+    this.selection = this.select(build2);
+    return withPlugins(build2, await this.selection);
+  }
+  /** 其余请求沿用这次打开时的决定，不触发下载；还没决定过时（如直接请求逻辑层）先决定一次 */
+  async current(build2) {
+    this.selection ??= this.select(build2);
+    return withPlugins(build2, await this.selection);
+  }
+  /** app.json 声明的插件；下载不了的跳过，在终端说明原因，小程序自己的页面照常可用 */
+  async select(build2) {
+    const declared = build2.wxConfig.plugins || {};
+    const results = await Promise.all(Object.entries(declared).map(
+      ([alias, { provider, version }]) => provider && version ? this.load(alias, provider, version) : null
+    ));
+    return results.filter((plugin) => !!plugin);
+  }
+  async load(alias, provider, version) {
+    const label = `\u63D2\u4EF6 ${alias}\uFF08${provider}@${version}\uFF09`;
+    if (!this.wechat) {
+      this.warnOnce(label, `[wxa-runner] ${label} \u7684\u4EE3\u7801\u8981\u7528\u5F00\u53D1\u8005\u7684\u767B\u5F55\u6001\u5411\u5FAE\u4FE1\u4E0B\u8F7D\uFF0C\u542F\u52A8\u65F6\u52A0 --devtools-login`);
+      return null;
+    }
+    const key = `${provider}@${version}`;
+    let download = this.downloads.get(key);
+    if (!download) {
+      download = this.download(this.wechat, alias, provider, version);
+      this.downloads.set(key, download);
+      download.catch(() => this.downloads.delete(key));
+    }
+    try {
+      return await download;
+    } catch (error) {
+      this.logger.warn(`[wxa-runner] ${label} \u4E0B\u8F7D\u5931\u8D25\uFF1A${error.message}`);
+      return null;
+    }
+  }
+  /** @throws 没有登录态、连不上、微信拒绝或返回的不是插件代码包时，消息是原因 */
+  async download(wechat, alias, provider, version) {
+    const response = await wechat.post("wxa-dev/getplugincode", { plugin_id: provider, plugin_version: version }, DOWNLOAD_TIMEOUT);
+    const data = Buffer.from(await response.arrayBuffer());
+    if (data[0] !== PACKAGE_MAGIC) {
+      let body = {};
+      try {
+        body = JSON.parse(data.toString("utf8"));
+      } catch {
+      }
+      if (body.baseresponse?.errcode) requireOk(body, "\u5FAE\u4FE1\u62D2\u7EDD\u4E0B\u8F7D");
+      throw new Error("\u5FAE\u4FE1\u6CA1\u6709\u8FD4\u56DE\u63D2\u4EF6\u4EE3\u7801");
+    }
+    const files = new Map((0, import_wxa_runner_extractor3.readWxvpkgIndex)(data).map((entry) => [entry.name, Buffer.from((0, import_wxa_runner_extractor3.readWxvpkgFile)(data, entry))]));
+    const pluginJson = JSON.parse(files.get("/plugin.json")?.toString("utf8") || "{}");
+    return {
+      alias,
+      provider,
+      version,
+      files,
+      pages: Object.values(pluginJson.pages || {}),
+      pageConfigs: pluginJson.page || {}
+    };
+  }
+  warnOnce(key, message) {
+    if (this.warned.has(key)) return;
+    this.warned.add(key);
+    this.logger.warn(message);
+  }
+};
+
 // src/server/devtoolsLogin.ts
 var import_express = __toESM(require("express"));
 var import_wxa_runner_extractor4 = require("@open-wxa/wxa-runner-extractor");
@@ -1589,8 +1817,13 @@ function respond(action) {
 var import_fs4 = __toESM(require("fs"));
 var import_path4 = __toESM(require("path"));
 var import_esbuild2 = require("esbuild");
-var SETUP_FILE_NAMES = ["wxa.setup.ts", "wxa.setup.js", "wxa.setup.mjs"];
+
+// src/runtime/setupModule.ts
 var SETUP_MODULE = "@open-wxa/wxa-runner-core/setup";
+var SETUP_MODULE_SOURCE = "export function defineSetup(setup) { return setup; }";
+
+// src/server/setup.ts
+var SETUP_FILE_NAMES = ["wxa.setup.ts", "wxa.setup.js", "wxa.setup.mjs"];
 var ENV_PREFIX = "WXA_";
 function findSetupFile(projectPath) {
   for (const name of SETUP_FILE_NAMES) {
@@ -1625,8 +1858,7 @@ function builtinSetupModule() {
     setup(pluginBuild) {
       pluginBuild.onResolve({ filter: new RegExp(`^${SETUP_MODULE}$`) }, () => ({ path: SETUP_MODULE, namespace: "wxa-setup" }));
       pluginBuild.onLoad({ filter: /.*/, namespace: "wxa-setup" }, () => ({
-        // 与 src/setup.ts 的 defineSetup 一致：只为类型提示，运行时原样返回
-        contents: "export function defineSetup(setup) { return setup; }",
+        contents: SETUP_MODULE_SOURCE,
         loader: "js"
       }));
     }
@@ -1634,7 +1866,7 @@ function builtinSetupModule() {
 }
 
 // src/server/watcher.ts
-var import_crypto3 = require("crypto");
+var import_crypto2 = require("crypto");
 var import_fs5 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
 var import_chokidar = __toESM(require("chokidar"));
@@ -1678,7 +1910,7 @@ function updateFingerprint(fingerprints, file, event) {
   if (event !== "add" && event !== "change" || !FINGERPRINTED.test(file)) return false;
   let next;
   try {
-    next = (0, import_crypto3.createHash)("sha1").update(import_fs5.default.readFileSync(file)).digest("hex");
+    next = (0, import_crypto2.createHash)("sha1").update(import_fs5.default.readFileSync(file)).digest("hex");
   } catch {
     return false;
   }
@@ -1711,16 +1943,7 @@ function applyExtensions(base, extensions, context) {
 
 // src/server/DevServer.ts
 var RESERVED_PREFIXES = ["/__wxa__", "/__baselib__", "/__plugin__"];
-var DEFAULT_DEVICE = {
-  model: "iPhone X",
-  screenWidth: 375,
-  screenHeight: 812,
-  pixelRatio: 3,
-  statusBarHeight: 44,
-  safeAreaBottom: 34,
-  system: "iOS 16.0",
-  platform: "devtools"
-};
+var APP_ROUTES = /^\/(?:__wxa__\/(?:appservice\.html|subcontext\.html|worker\.js|service-|page-|webview\/.+\.html$|plugin\/|module\/)|__plugin__\/)/;
 var DevServer = class {
   constructor(options) {
     this.options = options;
@@ -1856,63 +2079,11 @@ ${error.message}`);
         res.status(500).type("text").send(error.message);
       }
     });
-    app.get("/__wxa__/appservice.html", this.withBuild((build2, req, res) => {
-      const launchPath = String(req.query.path || "").replace(/^\//, "");
-      const launch = build2.pages.includes(launchPath) ? { path: launchPath, query: Object.fromEntries(new URLSearchParams(String(req.query.query || ""))) } : { path: build2.pages[0], query: {} };
-      res.type("html").send(appserviceHtml(build2, launch, { hot: this.hotEnabled, isolated: (0, import_wxa_runner_extractor5.usesIsolatedContext)(this.baseLib.version) }));
-    }));
-    app.get("/__wxa__/subcontext.html", (req, res) => {
-      const id = Number(req.query.id);
-      if (!Number.isInteger(id) || id <= 0) {
-        res.status(400).type("text").send("\u5B50\u4E0A\u4E0B\u6587 id \u65E0\u6548");
-        return;
-      }
-      res.type("html").send(subcontextHtml(id, req.query.empty === "1"));
-    });
-    app.get(/^\/__wxa__\/webview\/(.+)\.html$/, this.withBuild((build2, req, res, next) => {
-      const pagePath = decodeURIComponent(req.params[0]);
-      if (!build2.pages.includes(pagePath)) return next();
-      const pluginPage = findPluginPage(build2, pagePath);
-      const scripts = this.webviewScripts;
-      res.type("html").send(pluginPage ? pluginWebviewHtml(build2, pluginPage.plugin, pluginPage.innerPath, pagePath, Number(req.query.id), { scripts }) : webviewHtml(build2, pagePath, Number(req.query.id), { hot: this.hotEnabled, scripts }));
-    }));
-    app.get("/__wxa__/plugin/:provider/:version/:file(appservice.js|pageframe.js)", this.withBuild((build2, req, res, next) => {
-      const { provider, version, file } = req.params;
-      const code = build2.plugins.find((plugin) => plugin.provider === provider && plugin.version === version)?.files.get(`/${file}`);
-      if (!code) return next();
-      res.type("js").send(code);
-    }));
-    app.get(/^\/__plugin__\/([^/]+)(\/.+)$/, this.withBuild((build2, req, res, next) => {
-      const file = build2.plugins.find((plugin) => plugin.provider === req.params[0])?.files.get(decodeURIComponent(req.params[1]));
-      if (!file) return next();
-      res.type(import_path6.default.extname(req.params[1]) || "application/octet-stream").send(file);
-    }));
-    app.get(/^\/__wxa__\/module\/(.+\.js)$/, this.withBuild((build2, req, res) => {
-      const id = decodeURIComponent(req.params[0]);
-      if (!build2.modules.includes(id) && !build2.workerModules.includes(id)) {
-        res.status(404).type("js").send(`console.error(${JSON.stringify(`[wxa-runner] \u6A21\u5757 ${id} \u4E0D\u5B58\u5728`)})`);
-        return;
-      }
-      res.type("js").send(this.builder.getModuleScript(id));
-    }));
-    app.get("/__wxa__/worker.js", this.withBuild((build2, _req, res) => {
-      const hasWorker = import_fs6.default.existsSync(import_path6.default.join(this.baseLib.dir, "WAWorker.js"));
-      res.type("js").send(workerScript(build2, { version: this.baseLib.version, hasWorker }));
-    }));
-    app.get("/__wxa__/service-bootstrap.js", this.withBuild((build2, _req, res) => {
-      res.type("js").send(build2.serviceBootstrap);
-    }));
-    app.get("/__wxa__/service-templates.js", this.withBuild((build2, _req, res) => {
-      res.type("js").send(build2.serviceTemplates);
-    }));
-    app.get("/__wxa__/page-templates.js", this.withBuild((build2, _req, res) => {
-      res.type("js").send(build2.pageTemplates);
-    }));
-    app.get("/__wxa__/page-styles.js", this.withBuild((build2, _req, res) => {
-      res.type("js").send(build2.pageStyles);
-    }));
-    app.get("/__wxa__/page-frame.js", this.withBuild((build2, _req, res) => {
-      res.type("js").send(build2.pageFrame);
+    app.get(APP_ROUTES, this.withBuild((build2, req, res, next) => {
+      const response = routeApp(this.appSource(build2), new URL(req.originalUrl, "http://localhost"));
+      if (!response) return next();
+      res.status(response.status).type(response.type);
+      res.send(typeof response.body === "string" ? response.body : Buffer.from(response.body.buffer, response.body.byteOffset, response.body.byteLength));
     }));
     app.get("/__wxa__/runtime/frame.js.map", (_req, res, next) => {
       const file = import_path6.default.join(this.runtimeDir(), "frame.js.map");
@@ -1975,7 +2146,7 @@ ${error.message}`);
         res.status(400).type("text").send(`\u975E\u6CD5\u7684\u4F1A\u8BDD\u6807\u8BC6 ${req.params.session}`);
         return;
       }
-      const filePath = `/__wxa__/tmp/${req.params.session}/${(0, import_crypto4.randomUUID)()}.${type}`;
+      const filePath = `/__wxa__/tmp/${req.params.session}/${(0, import_crypto3.randomUUID)()}.${type}`;
       files.write(filePath, Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0));
       res.json({ url: `${req.protocol}://${req.get("host")}${filePath}` });
     });
@@ -1995,7 +2166,7 @@ ${error.message}`);
         res.status(404).end();
         return;
       }
-      const data = node.data;
+      const data = Buffer.from(node.data.buffer, node.data.byteOffset, node.data.byteLength);
       res.type(import_path6.default.extname(req.params[0]));
       res.setHeader("ETag", `"${node.etag}"`);
       res.setHeader("Accept-Ranges", "bytes");
@@ -2046,6 +2217,16 @@ ${error.message}`);
     return this.plugins.current(await this.builder.build());
   }
   /** 需要构建结果的路由；构建失败时返回错误文本 */
+  appSource(build2) {
+    return {
+      build: build2,
+      moduleScript: (id) => this.builder.getModuleScript(id),
+      baseLib: { version: this.baseLib.version, hasWorker: import_fs6.default.existsSync(import_path6.default.join(this.baseLib.dir, "WAWorker.js")) },
+      isolated: (0, import_wxa_runner_extractor5.usesIsolatedContext)(this.baseLib.version),
+      hot: this.hotEnabled,
+      webviewScripts: this.webviewScripts
+    };
+  }
   withBuild(handler) {
     return async (req, res, next) => {
       res.setHeader("Cache-Control", "no-store");
@@ -2064,17 +2245,7 @@ ${error.message}`);
     };
   }
   runtimeDir() {
-    const candidates = [
-      this.options.runtimeDir,
-      import_path6.default.join(__dirname, "runtime"),
-      import_path6.default.join(__dirname, "../runtime"),
-      import_path6.default.join(__dirname, "../../dist/runtime")
-    ].filter((dir) => !!dir);
-    const found = candidates.find((dir) => import_fs6.default.existsSync(import_path6.default.join(dir, "host.js")));
-    if (!found) {
-      throw new Error("\u627E\u4E0D\u5230\u6D4F\u89C8\u5668\u7AEF\u8FD0\u884C\u65F6\uFF08host.js\uFF09\uFF0C\u8BF7\u5148\u6267\u884C pnpm build");
-    }
-    return found;
+    return findRuntimeDir(this.options.runtimeDir);
   }
   /** 只在监听文件变化时打开基础库的热更新开关，跑测试（watch: false）时运行环境与真机一致 */
   get hotEnabled() {
@@ -2162,12 +2333,31 @@ function resolveSetupFile(option, projectPath) {
   if (!import_fs6.default.existsSync(file)) throw new Error(`\u627E\u4E0D\u5230 setup \u6587\u4EF6\uFF1A${file}`);
   return file;
 }
+function findRuntimeDir(explicit) {
+  const candidates = [
+    explicit,
+    import_path6.default.join(__dirname, "runtime"),
+    import_path6.default.join(__dirname, "../runtime"),
+    import_path6.default.join(__dirname, "../../dist/runtime")
+  ].filter((dir) => !!dir);
+  const found = candidates.find((dir) => import_fs6.default.existsSync(import_path6.default.join(dir, "host.js")));
+  if (!found) {
+    throw new Error("\u627E\u4E0D\u5230\u6D4F\u89C8\u5668\u7AEF\u8FD0\u884C\u65F6\uFF08host.js\uFF09\uFF0C\u8BF7\u5148\u6267\u884C pnpm build");
+  }
+  return found;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AppBuilder,
   DEFAULT_DEVICE,
   DevServer,
+  LOCAL_HOST_OF_ANY_ADDRESS,
   MiniProgram,
-  createWxConfig
+  bundleSetup,
+  createWxConfig,
+  findRuntimeDir,
+  findSetupFile,
+  handleProxy,
+  listen
 });
 //# sourceMappingURL=index.js.map