fix(core): include plugin dynamic files in manifest (#5922)

## Summary
- Stack on top of PR #5921 / EGG-65 runtime mapping commit because that
dependency is not yet in origin/next.
- Complete generated startup manifests with convention-based plugin
dynamic files (agent, app, app/extend/*, and app/middleware) so bundled
single-mode workers can load files skipped by metadataOnly agent
startup.
- Add a security-like @eggjs/security fixture verifying agent, app,
app/extend/agent, app/extend/application, and app/middleware/securities
are present in the manifest.

## Validation
- pnpm exec vitest run
packages/core/test/loader/manifest_coverage.test.ts
- pnpm exec vitest run packages/core/test/loader/manifest.test.ts
packages/core/test/loader/manifest_roundtrip.test.ts
packages/core/test/loader/manifest_fingerprint.test.ts
packages/core/test/loader/manifest_query.test.ts
packages/core/test/loader/manifest_coverage.test.ts
- pnpm --filter @eggjs/egg-bundler test -- EntryGenerator.test.ts
- pnpm --filter @eggjs/core typecheck
- pnpm --filter @eggjs/egg-bundler typecheck
- pnpm exec oxfmt --check packages/core/src/loader/egg_loader.ts
packages/core/test/loader/manifest_coverage.test.ts
tools/egg-bundler/src/lib/EntryGenerator.ts
tools/egg-bundler/test/EntryGenerator.test.ts
- git diff --check origin/next...HEAD

Notes: targeted oxlint on changed files exits 0 with existing warnings
in pre-existing egg_loader.ts lines outside this patch.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Manifest post-processing now caches convention-based module resolution
and records directory-discovered middleware lists for metadata-only
runs.
* Bundler/runtime treats framework as a package specifier, validates
specifiers, and precomputes output↔original-app aliasing for
deterministic module lookup.

* **Documentation**
* Updated bundler docs, CLI help, and wiki to explain runtime path
mapping, output-dir semantics, and framework-specifier behavior.

* **Tests & Chores**
* Added fixtures and tests for manifest resolve-cache, file discovery,
deterministic worker generation, and framework-specifier validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: killagu

packages/core/src/loader/egg_loader.ts

@@ -8,6 +8,7 @@ import { Request, Response, Application, Context as KoaContext } from '@eggjs/ko
 import { pathMatching, type PathMatchingOptions } from '@eggjs/path-matching';
 import { isESM, isSupportTypeScript } from '@eggjs/utils';
 import type { Logger } from 'egg-logger';
+import globby from 'globby';
 import { isAsyncFunction, isClass, isGeneratorFunction, isObject, isPromise } from 'is-type-of';
 import { homedir } from 'node-homedir';
 import { now, diff } from 'performance-ms';
@@ -26,6 +27,12 @@ import { type FileLoaderOptions, CaseStyle, FULLPATH, FileLoader } from './file_
 import { ManifestStore, type StartupManifest } from './manifest.ts';
 
 const debug = debuglog('egg/core/loader/egg_loader');
+const CONVENTIONAL_MANIFEST_LOADS = [
+  { type: 'resolve', path: ['agent'] },
+  { type: 'resolve', path: ['app'] },
+  { type: 'discover', path: ['app', 'extend'], extensionlessResolve: true },
+  { type: 'discover', path: ['app', 'middleware'] },
+] as const;
 
 const originalPrototypes: Record<string, unknown> = {
   request: Request.prototype,
@@ -1764,11 +1771,69 @@ export class EggLoader {
    * Should be called after all loading phases complete.
    */
   generateManifest(): StartupManifest {
-    return this.manifest.generateManifest({
+    const manifest = this.manifest.generateManifest({
       serverEnv: this.serverEnv,
       serverScope: this.serverScope,
       typescriptEnabled: isSupportTypeScript(),
     });
+    this.#collectConventionalDynamicFiles(manifest);
+    return manifest;
+  }
+
+  /**
+   * metadataOnly startup intentionally skips the agent process, but bundled
+   * single-mode workers still load agent boot hooks and agent extends later.
+   * Record convention-based dynamic entry points so the bundle can satisfy
+   * those runtime lookups without running agent lifecycle hooks at manifest
+   * generation time.
+   */
+  #collectConventionalDynamicFiles(manifest: StartupManifest): void {
+    for (const unit of this.getLoadUnits()) {
+      for (const load of CONVENTIONAL_MANIFEST_LOADS) {
+        const target = path.join(unit.path, ...load.path);
+        if (load.type === 'resolve') {
+          this.#collectConventionResolve(manifest, target);
+        } else if ('extensionlessResolve' in load && load.extensionlessResolve) {
+          this.#collectConventionFileResolves(manifest, target);
+        } else {
+          this.#collectConventionFileDiscovery(manifest, target);
+        }
+      }
+    }
+  }
+
+  #collectConventionResolve(manifest: StartupManifest, request: string): void {
+    const requestKey = this.#toManifestRel(request);
+    if (Object.hasOwn(manifest.resolveCache, requestKey)) return;
+
+    const resolved = this.#doResolveModule(request);
+    manifest.resolveCache[requestKey] = resolved ? this.#toManifestRel(resolved) : null;
+  }
+
+  #collectConventionFileResolves(manifest: StartupManifest, directory: string): void {
+    const files = this.#collectConventionFileDiscovery(manifest, directory);
+    for (const file of files) {
+      const ext = path.extname(file);
+      if (!ext) continue;
+      const request = path.join(directory, file.slice(0, -ext.length));
+      this.#collectConventionResolve(manifest, request);
+    }
+  }
+
+  #collectConventionFileDiscovery(manifest: StartupManifest, directory: string): string[] {
+    const dirKey = this.#toManifestRel(directory);
+    if (Object.hasOwn(manifest.fileDiscovery, dirKey)) return manifest.fileDiscovery[dirKey];
+
+    manifest.fileDiscovery[dirKey] =
+      fs.existsSync(directory) && fs.statSync(directory).isDirectory()
+        ? globby.sync(FileLoader.getDefaultMatch(), { cwd: directory }).sort()
+        : [];
+    return manifest.fileDiscovery[dirKey];
+  }
+
+  #toManifestRel(filepath: string): string {
+    const rel = path.isAbsolute(filepath) ? path.relative(this.options.baseDir, filepath) : filepath;
+    return rel.replaceAll(path.sep, '/');
   }
 }
 

packages/core/src/loader/file_loader.ts

@@ -60,6 +60,10 @@ export interface FileLoaderParseItem {
   exports: object | Fun;
 }
 
+function getDefaultFileLoaderMatch(): string[] {
+  return isSupportTypeScript() ? ['**/*.(js|ts)', '!**/*.d.ts'] : ['**/*.js'];
+}
+
 /**
  * Load files from directory to target object.
  * @since 1.0.0
@@ -73,6 +77,10 @@ export class FileLoader {
     return EXPORTS;
   }
 
+  static getDefaultMatch(): string[] {
+    return getDefaultFileLoaderMatch();
+  }
+
   readonly options: FileLoaderOptions & Required<Pick<FileLoaderOptions, 'caseStyle'>>;
 
   /**
@@ -181,7 +189,7 @@ export class FileLoader {
     if (files) {
       files = Array.isArray(files) ? files : [files];
     } else {
-      files = isSupportTypeScript() ? ['**/*.(js|ts)', '!**/*.d.ts'] : ['**/*.js'];
+      files = FileLoader.getDefaultMatch();
     }
 
     let ignore = this.options.ignore;

packages/core/src/loader/manifest.ts

@@ -211,6 +211,12 @@ export class ManifestStore {
       return cached !== null ? this.#toAbsolute(cached) : undefined;
     }
 
+    const discovered = this.#resolveFromFileDiscovery(relKey);
+    if (discovered) {
+      debug('[resolveModule:fileDiscovery] %o => %o', filepath, discovered);
+      return discovered;
+    }
+
     const result = fallback();
     this.#resolveCacheCollector[relKey] = result !== undefined ? this.#toRelative(result) : null;
     return result;
@@ -343,6 +349,30 @@ export class ManifestStore {
     return path.join(this.baseDir, relPath);
   }
 
+  #resolveFromFileDiscovery(relKey: string): string | undefined {
+    let matchedDir: string | undefined;
+    for (const dir of Object.keys(this.data.fileDiscovery)) {
+      if ((relKey === dir || relKey.startsWith(dir + '/')) && (!matchedDir || dir.length > matchedDir.length)) {
+        matchedDir = dir;
+      }
+    }
+    if (!matchedDir || relKey === matchedDir) return;
+
+    const request = relKey.slice(matchedDir.length + 1);
+    const files = this.data.fileDiscovery[matchedDir];
+    const matchedFile = files.find((file) => {
+      if (file === request) return true;
+
+      const ext = path.posix.extname(file);
+      if (!ext || ext === '.map') return false;
+
+      const extensionlessFile = file.slice(0, -ext.length);
+      return extensionlessFile === request || extensionlessFile === `${request}/index`;
+    });
+
+    return matchedFile ? this.#toAbsolute(path.posix.join(matchedDir, matchedFile)) : undefined;
+  }
+
   // --- Fingerprint Utilities ---
 
   static #statFingerprint(filepath: string): string | null {

packages/core/test/fixtures/manifest-dynamic-plugin/config/plugin.js

@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = {
+  security: {
+    enable: true,
+    package: '@eggjs/security',
+  },
+};