@adep/cli 0.1.15 → 0.1.16

package/dist/index.js

@@ -2693,6 +2693,14 @@ function hmacSha256(key, message) {
 function hmacSha256Hex(key, message) {
   return [...hmacSha256(key, message)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
 var K, rotr;
 var init_hmac_sha256 = __esm({
   "packages/runtime/src/storage/hmac-sha256.ts"() {
@@ -2778,6 +2786,22 @@ function signDownloadUrl(config, projectId, path, ttlSeconds = DEFAULT_SIGN_TTL_
   const signature = sign(config.secret, projectId, path, expires);
   return `${base}?${SIGN_EXPIRES_KEY}=${expires}&${SIGN_SIGNATURE_KEY}=${signature}`;
 }
+function verifyDownloadSignature(config, projectId, path, query, nowSeconds2 = Math.floor(Date.now() / 1e3)) {
+  const expiresRaw = query.expires;
+  const signatureRaw = query.signature;
+  if (typeof expiresRaw !== "string" || typeof signatureRaw !== "string") {
+    return { ok: false, reason: "missing" };
+  }
+  if (!/^\d{1,15}$/.test(expiresRaw)) return { ok: false, reason: "malformed" };
+  const expires = Number(expiresRaw);
+  if (!Number.isFinite(expires)) return { ok: false, reason: "malformed" };
+  if (nowSeconds2 > expires) return { ok: false, reason: "expired" };
+  const expected = sign(config.secret, projectId, path, expires);
+  if (!constantTimeEqual(signatureRaw, expected)) {
+    return { ok: false, reason: "invalid" };
+  }
+  return { ok: true };
+}
 var DEFAULT_SIGN_TTL_SECONDS, SIGN_EXPIRES_KEY, SIGN_SIGNATURE_KEY;
 var init_signature = __esm({
   "packages/runtime/src/storage/signature.ts"() {
@@ -3006,7 +3030,7 @@ function createLocalStorageDriver(options) {
       assertStoragePrefix(prefix);
       const root = bucketDir(projectId);
       const metas = [];
-      const walk = async (dir, relative6) => {
+      const walk = async (dir, relative7) => {
         let entries;
         try {
           entries = await readdir3(dir, { withFileTypes: true });
@@ -3017,7 +3041,7 @@ function createLocalStorageDriver(options) {
         for (const entry of entries) {
           if (entry.name.endsWith(META_SUFFIX)) continue;
           const full = join6(dir, entry.name);
-          const rel = relative6 === "" ? entry.name : `${relative6}/${entry.name}`;
+          const rel = relative7 === "" ? entry.name : `${relative7}/${entry.name}`;
           if (entry.isFile()) {
             if (prefix !== void 0 && !rel.startsWith(prefix)) continue;
             tasks.push(
@@ -3071,17 +3095,19 @@ function createSimStorageCapability(options) {
   const dir = join7(options.cwd, ".adep", "sim", "storage");
   const driver = createLocalStorageDriver({ dir });
   const signer = {
-    secret: options.secret ?? "adep-sim-secret",
+    secret: options.secret ?? SIM_SIGN_SECRET,
     baseUrl: options.baseUrl ?? "http://127.0.0.1:8787"
   };
   const bundle = createStorageCapability(driver, signer, options.projectId ?? "sim-project");
   return { bundle, driver };
 }
+var SIM_SIGN_SECRET;
 var init_storage = __esm({
   "packages/cli/src/sim/storage.ts"() {
     "use strict";
     init_cloud2();
     init_local();
+    SIM_SIGN_SECRET = "adep-sim-secret";
   }
 });
 
@@ -3281,6 +3307,8 @@ async function createSimRuntime(options) {
     bundle,
     realtime: simRealtime.realtime,
     db,
+    /** 存储句柄（serve 的签名文件下载路由用它读对象；bundle 里的 capability 是同一驱动的 RPC 面）。 */
+    storage,
     dispose: async () => {
       await db.driver.close();
     }
@@ -3395,15 +3423,19 @@ var init_invoke = __esm({
 });
 
 // shared/builtin-deps.ts
-var CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER, BUILTIN_DEPS, BUILTIN_DEPS_CSV;
+var CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER, CRYPTO_SPECIFIER, ROUTE_SPECIFIER, BUILTIN_DEPS, BUILTIN_DEPS_CSV;
 var init_builtin_deps = __esm({
   "shared/builtin-deps.ts"() {
     "use strict";
     CF_COMPAT_SPECIFIER = "@adep/cf-compat";
     STATE_OBJECTS_SPECIFIER = "@adep/runtime/state-objects";
+    CRYPTO_SPECIFIER = "@adep/crypto";
+    ROUTE_SPECIFIER = "@adep/runtime/route";
     BUILTIN_DEPS = [
       CF_COMPAT_SPECIFIER,
       STATE_OBJECTS_SPECIFIER,
+      CRYPTO_SPECIFIER,
+      ROUTE_SPECIFIER,
       "axios",
       "lodash",
       "dayjs",
@@ -3419,7 +3451,12 @@ var init_builtin_deps2 = __esm({
   "packages/cli/src/builtin-deps.ts"() {
     "use strict";
     init_builtin_deps();
-    LOCAL_BUILTIN_DEPS = [CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER];
+    LOCAL_BUILTIN_DEPS = [
+      CF_COMPAT_SPECIFIER,
+      STATE_OBJECTS_SPECIFIER,
+      CRYPTO_SPECIFIER,
+      ROUTE_SPECIFIER
+    ];
   }
 });
 
@@ -5338,7 +5375,7 @@ function splitSqlStatements(source) {
   const lines = source.split("\n");
   for (const rawLine of lines) {
     const trimmed = rawLine.trim();
-    if (trimmed.length === 0 || trimmed.startsWith("--")) continue;
+    if (!inQuote && (trimmed.length === 0 || trimmed.startsWith("--"))) continue;
     for (let i = 0; i < rawLine.length; i++) {
       const ch = rawLine[i];
       if (inQuote) {
@@ -5367,7 +5404,7 @@ function splitSqlStatements(source) {
       }
       buffer += ch;
     }
-    buffer += " ";
+    buffer += inQuote ? "\n" : " ";
   }
   if (inQuote) {
     throw new Error(`SQL \u8FC1\u79FB\u6587\u4EF6\u5F15\u53F7\u672A\u95ED\u5408\uFF1A${buffer.trim().slice(0, 80)}\u2026`);
@@ -5844,9 +5881,66 @@ async function startServeServer(options) {
       return false;
     }
   };
+  const serveSignedFile = async (req, res, url, projectId, path) => {
+    const driver = runtime.storage.driver;
+    try {
+      const meta = await driver.getMeta(projectId, path);
+      if (meta.visibility === "private") {
+        const verification = verifyDownloadSignature(
+          { secret: SIM_SIGN_SECRET, baseUrl: "" },
+          projectId,
+          path,
+          {
+            expires: url.searchParams.get(SIGN_EXPIRES_KEY) ?? void 0,
+            signature: url.searchParams.get(SIGN_SIGNATURE_KEY) ?? void 0
+          }
+        );
+        if (!verification.ok) {
+          const message = verification.reason === "expired" ? "\u7B7E\u540D URL \u5DF2\u8FC7\u671F\uFF1A\u8BF7\u91CD\u65B0\u751F\u6210\uFF0815 \u5206\u949F\u6709\u6548\uFF09" : verification.reason === "missing" ? "\u79C1\u6709\u6587\u4EF6\u9700\u8981\u7B7E\u540D URL \u624D\u80FD\u8BBF\u95EE" : "\u7B7E\u540D\u65E0\u6548\uFF1AURL \u53EF\u80FD\u88AB\u7BE1\u6539";
+          writeJson(res, 403, { error: { code: "STORAGE_SIGNATURE_INVALID", message } });
+          log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> 403 (${verification.reason})`);
+          return true;
+        }
+      }
+      const { data } = await driver.get(projectId, path);
+      res.writeHead(200, {
+        "content-type": meta.contentType ?? "application/octet-stream",
+        "content-length": String(meta.size),
+        "cache-control": meta.visibility === "public" ? "public, max-age=3600" : "private, no-store"
+      });
+      res.end(data);
+      log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> 200\uFF08\u6587\u4EF6\u4E0B\u8F7D ${meta.size}B\uFF09`);
+    } catch (error) {
+      if (error instanceof StorageError) {
+        writeJson(res, error.status, { error: { code: error.code, message: error.message } });
+        log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> ${error.status} (${error.code})`);
+        return true;
+      }
+      writeJson(res, 500, {
+        error: {
+          code: "FILE_DOWNLOAD_ERROR",
+          message: error instanceof Error ? error.message : "\u6587\u4EF6\u4E0B\u8F7D\u5931\u8D25"
+        }
+      });
+      log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> 500\uFF08\u6587\u4EF6\u4E0B\u8F7D\u5F02\u5E38\uFF09`);
+    }
+    return true;
+  };
+  const SIGNED_FILES_ROUTE = /^\/api\/v1\/projects\/([^/]+)\/files\/([^/]+)$/;
   const handle = async (req, res) => {
     const url = new URL(req.url ?? "/", `http://${host}:${port}`);
     const pathname = url.pathname;
+    const filesMatch = SIGNED_FILES_ROUTE.exec(pathname);
+    if (filesMatch !== null && (req.method === "GET" || req.method === "HEAD")) {
+      await serveSignedFile(
+        req,
+        res,
+        url,
+        decodeURIComponent(filesMatch[1]),
+        decodeURIComponent(filesMatch[2])
+      );
+      return;
+    }
     const normalizedPrefix = config.functionsPrefix.replace(/^\/+|\/+$/g, "");
     const fnRest = normalizedPrefix.length > 0 ? pathname === `/${normalizedPrefix}` || pathname.startsWith(`/${normalizedPrefix}/`) ? pathname.slice(normalizedPrefix.length + 1) : null : pathname === "/api" ? "" : pathname.startsWith("/api/") ? pathname.slice("/api/".length) : null;
     if (fnRest !== null) {
@@ -5994,9 +6088,12 @@ var init_server = __esm({
     init_executor();
     init_http_envelope();
     init_worker_executor();
+    init_signature();
+    init_driver();
     init_builtin_deps2();
     init_db2();
     init_runtime();
+    init_storage();
     init_env();
     init_invoke();
     init_dev();
@@ -7172,6 +7269,189 @@ var init_storage2 = __esm({
   }
 });
 
+// packages/cli/src/sandbox-scan.ts
+import { readdir as readdir7, readFile as readFile16 } from "node:fs/promises";
+import { join as join20, relative as relative5, sep as sep3 } from "node:path";
+function extractSpecifiers(line) {
+  const out = [];
+  const patterns = [
+    /\bfrom\s+['"]([^'"]+)['"]/g,
+    // import x from '<spec>' / export … from '<spec>'
+    /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+    /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+    /^\s*import\s+['"]([^'"]+)['"]/g
+    // 副作用导入 import '<spec>'
+  ];
+  for (const pattern of patterns) {
+    for (const match of line.matchAll(pattern)) {
+      const spec = match[1];
+      if (spec !== void 0) out.push(spec);
+    }
+  }
+  return out;
+}
+function classify(specifier) {
+  if (specifier.startsWith("node:")) {
+    const bare = specifier.slice("node:".length);
+    const root = bare.split("/")[0];
+    const suggestion = BUILTIN_SUGGESTIONS[specifier] ?? BUILTIN_SUGGESTIONS[`node:${root}`];
+    return {
+      code: "NODE_BUILTIN",
+      message: `\u6C99\u7BB1\u6CA1\u6709 node \u5185\u7F6E\u6A21\u5757\uFF0C'${specifier}' \u5728\u53D1\u5E03\u540E\u8FD0\u884C\u65F6\u4F1A\u629B ERR_MODULE_NOT_FOUND\uFF08\u672C\u5730 adep dev \u80FD\u8DD1\uFF0C\u56E0\u4E3A\u5BBF\u4E3B\u5C31\u662F Node\uFF09\u3002${suggestion ?? `\u8BF7\u79FB\u9664\u5BF9 ${root} \u7684\u4F9D\u8D56\u3002`}`
+    };
+  }
+  if (NODE_BUILTINS.has(specifier)) {
+    return {
+      code: "NODE_BUILTIN",
+      message: `\u6C99\u7BB1\u6CA1\u6709 node \u5185\u7F6E\u6A21\u5757\uFF0C'${specifier}' \u5728\u53D1\u5E03\u540E\u8FD0\u884C\u65F6\u4F1A\u629B ERR_MODULE_NOT_FOUND\u3002${BUILTIN_SUGGESTIONS[specifier] ?? `\u8BF7\u79FB\u9664\u5BF9 ${specifier} \u7684\u4F9D\u8D56\u3002`}`
+    };
+  }
+  if (NATIVE_ADDON_PACKAGES.has(specifier)) {
+    return {
+      code: "NATIVE_ADDON",
+      message: `'${specifier}' \u9700\u8981\u539F\u751F C++ \u6269\u5C55\uFF0C\u4E91\u51FD\u6570\u6C99\u7BB1\u65E0\u6CD5\u52A0\u8F7D\uFF08\u4E5F\u4E0D\u662F registry \u767D\u540D\u5355\u80FD\u89E3\u51B3\u7684\u95EE\u9898\uFF09\u3002\u8BF7\u6362\u7EAF JS \u5B9E\u73B0\uFF08\u5982 bcrypt\u2192@adep/crypto \u7684 hashPassword\u3001sharp\u2192\u6784\u5EFA\u671F\u9884\u5904\u7406\u56FE\u7247\uFF09\u3002`
+    };
+  }
+  return null;
+}
+async function scanFunctionSources(rootDir, functionsDir) {
+  const base = join20(rootDir, functionsDir);
+  const findings = [];
+  async function walk(current) {
+    let entries;
+    try {
+      entries = await readdir7(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = join20(current, entry.name);
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        await walk(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (!SOURCE_EXTENSIONS.some((ext) => entry.name.endsWith(ext))) continue;
+      if (entry.name.endsWith(".d.ts")) continue;
+      let content;
+      try {
+        content = await readFile16(abs, "utf8");
+      } catch {
+        continue;
+      }
+      if (content.length > MAX_SCAN_BYTES) continue;
+      const relPath = relative5(rootDir, abs).split(sep3).join("/");
+      const lines = content.split("\n");
+      for (const [index, line] of lines.entries()) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*")) continue;
+        for (const specifier of extractSpecifiers(line)) {
+          const hit = classify(specifier);
+          if (hit !== null) {
+            findings.push({
+              file: relPath,
+              line: index + 1,
+              code: hit.code,
+              specifier,
+              message: hit.message
+            });
+          }
+        }
+      }
+    }
+  }
+  await walk(base);
+  return findings;
+}
+var NODE_BUILTINS, NATIVE_ADDON_PACKAGES, BUILTIN_SUGGESTIONS, SOURCE_EXTENSIONS, SKIP_DIRS, MAX_SCAN_BYTES;
+var init_sandbox_scan = __esm({
+  "packages/cli/src/sandbox-scan.ts"() {
+    "use strict";
+    NODE_BUILTINS = /* @__PURE__ */ new Set([
+      "assert",
+      "async_hooks",
+      "buffer",
+      "child_process",
+      "cluster",
+      "console",
+      "constants",
+      "crypto",
+      "dgram",
+      "diagnostics_channel",
+      "dns",
+      "domain",
+      "events",
+      "fs",
+      "http",
+      "http2",
+      "https",
+      "inspector",
+      "module",
+      "net",
+      "os",
+      "path",
+      "perf_hooks",
+      "process",
+      "punycode",
+      "querystring",
+      "readline",
+      "repl",
+      "stream",
+      "string_decoder",
+      "sys",
+      "timers",
+      "tls",
+      "trace_events",
+      "tty",
+      "url",
+      "util",
+      "v8",
+      "vm",
+      "wasi",
+      "worker_threads",
+      "zlib"
+    ]);
+    NATIVE_ADDON_PACKAGES = /* @__PURE__ */ new Set([
+      "bcrypt",
+      "better-sqlite3",
+      "sqlite3",
+      "sharp",
+      "canvas",
+      "argon2",
+      "node-gyp",
+      "farmhash",
+      "xxhash-addon",
+      "zeromq",
+      "grpc",
+      "@grpc/grpc-js",
+      "leveldown",
+      "rocksdb",
+      "node-canvas",
+      "microtime",
+      "sodium-native",
+      "re2"
+    ]);
+    BUILTIN_SUGGESTIONS = {
+      "node:crypto": "\u7528 WebCrypto\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165 crypto\uFF09\u6216 @adep/crypto \u7684 signJwt / hashPassword / encryptSecret",
+      crypto: "\u7528 WebCrypto\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165 crypto\uFF09\u6216 @adep/crypto",
+      "node:fs": "\u6C99\u7BB1\u65E0\u6587\u4EF6\u7CFB\u7EDF\uFF1B\u9879\u76EE\u6570\u636E\u8D70 ctx.cloud.db\uFF0C\u6587\u4EF6\u8D70 ctx.cloud.storage",
+      fs: "\u6C99\u7BB1\u65E0\u6587\u4EF6\u7CFB\u7EDF\uFF1B\u9879\u76EE\u6570\u636E\u8D70 ctx.cloud.db\uFF0C\u6587\u4EF6\u8D70 ctx.cloud.storage",
+      "node:path": "\u624B\u5199\u5B57\u7B26\u4E32\u62FC\u63A5\uFF08\u6C99\u7BB1\u91CC\u7684\u8DEF\u5F84\u90FD\u662F POSIX \u5F62\u5F0F\uFF09",
+      path: "\u624B\u5199\u5B57\u7B26\u4E32\u62FC\u63A5\uFF08\u6C99\u7BB1\u91CC\u7684\u8DEF\u5F84\u90FD\u662F POSIX \u5F62\u5F0F\uFF09",
+      "node:buffer": "\u7528 Uint8Array + TextEncoder/TextDecoder\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165\uFF09",
+      buffer: "\u7528 Uint8Array + TextEncoder/TextDecoder\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165\uFF09",
+      "node:process": "\u73AF\u5883\u53D8\u91CF\u8D70 ctx.env\uFF08adep.config.ts \u7684 environment\uFF09",
+      process: "\u73AF\u5883\u53D8\u91CF\u8D70 ctx.env\uFF08adep.config.ts \u7684 environment\uFF09",
+      "node:stream": "\u7528\u6C99\u7BB1\u6CE8\u5165\u7684 ReadableStream / WritableStream / TransformStream",
+      stream: "\u7528\u6C99\u7BB1\u6CE8\u5165\u7684 ReadableStream / WritableStream / TransformStream"
+    };
+    SOURCE_EXTENSIONS = [".ts", ".js", ".mjs", ".cjs", ".tsx", ".jsx"];
+    SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "__tests__", "dist", ".git", ".adep", "coverage"]);
+    MAX_SCAN_BYTES = 512 * 1024;
+  }
+});
+
 // packages/cli/src/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
@@ -7202,12 +7482,13 @@ async function credentialMode(file) {
     return void 0;
   }
 }
-async function runDoctor(paths) {
+async function runDoctor(paths, cwd = process.cwd()) {
   const credentials = await loadCredentials(paths);
   const server = credentials?.server ?? resolveServer();
   const mode = await credentialMode(paths.credentialsFile);
   const offline = await isOffline();
   const health = await probeServer(server);
+  const sandbox = await scanSandbox(cwd);
   const report = {
     server,
     credentials: {
@@ -7218,7 +7499,8 @@ async function runDoctor(paths) {
     network: { offline },
     serverHealth: health,
     offlineCommands: [...OFFLINE_COMMANDS],
-    boundaries: SIM_BOUNDARIES.map((b) => ({ kind: b.kind, title: b.title, detail: b.detail }))
+    boundaries: SIM_BOUNDARIES.map((b) => ({ kind: b.kind, title: b.title, detail: b.detail })),
+    sandbox
   };
   if (credentials !== null) report.credentials.email = credentials.email;
   if (mode !== void 0 && mode !== "600") {
@@ -7226,6 +7508,22 @@ async function runDoctor(paths) {
   }
   return report;
 }
+async function scanSandbox(cwd) {
+  let functionsDir = "functions";
+  try {
+    const config = await loadAdepConfigModule(cwd);
+    if (config?.functionsDir !== void 0 && config.functionsDir.length > 0) {
+      functionsDir = config.functionsDir;
+    }
+  } catch {
+  }
+  try {
+    const findings = await scanFunctionSources(cwd, functionsDir);
+    return { functionsDir, findings };
+  } catch {
+    return { functionsDir: null, findings: [] };
+  }
+}
 function formatDoctorReport(report) {
   const lines = ["adep doctor \xB7 \u73AF\u5883\u81EA\u68C0", ""];
   lines.push("\u51ED\u636E\u4E0E\u8EAB\u4EFD");
@@ -7253,6 +7551,28 @@ function formatDoctorReport(report) {
   }
   lines.push("", "\u79BB\u7EBF\u53EF\u7528\u8303\u56F4\uFF08\u65AD\u7F51\u65F6\u4ECD\u53EF\u6267\u884C\uFF09");
   for (const command of report.offlineCommands) lines.push(`  \xB7 ${command}`);
+  lines.push("", "\u4E91\u51FD\u6570\u6C99\u7BB1\u517C\u5BB9\u6027\uFF08\u53D1\u5E03\u524D\u5C31\u80FD\u6539\uFF0C\u522B\u7B49\u8FD0\u884C\u65F6\u70B8\uFF09");
+  if (report.sandbox.functionsDir === null) {
+    lines.push("  \xB7 \u672A\u627E\u5230\u51FD\u6570\u76EE\u5F55\uFF0C\u8DF3\u8FC7\u626B\u63CF");
+  } else if (report.sandbox.findings.length === 0) {
+    lines.push(`  \u2713 ${report.sandbox.functionsDir}/ \u5185\u672A\u53D1\u73B0 node \u5185\u7F6E\u6A21\u5757 / \u539F\u751F addon \u4F9D\u8D56`);
+  } else {
+    const byFile = /* @__PURE__ */ new Map();
+    for (const finding of report.sandbox.findings) {
+      const list = byFile.get(finding.file) ?? [];
+      list.push(finding);
+      byFile.set(finding.file, list);
+    }
+    lines.push(
+      `  \u2717 \u53D1\u73B0 ${report.sandbox.findings.length} \u5904\u6C99\u7BB1\u4E0D\u517C\u5BB9\uFF08\u672C\u5730 adep dev \u80FD\u8DD1\uFF0C\u53D1\u5E03\u540E\u4F1A\u5931\u8D25\uFF09\uFF1A`
+    );
+    for (const [file, findingList] of byFile) {
+      for (const finding of findingList) {
+        lines.push(`    ${file}:${finding.line}  [${finding.code}] ${finding.specifier}`);
+        lines.push(`      ${finding.message}`);
+      }
+    }
+  }
   lines.push("", "\u672C\u5730\u6A21\u62DF\u8FD0\u884C\u65F6\u7684\u80FD\u529B\u8FB9\u754C\uFF08\u4E0E adep dev \u542F\u52A8\u6A2A\u5E45\u540C\u6E90\uFF09");
   for (const boundary of report.boundaries) {
     lines.push(`  \xB7 [${boundary.kind}] ${boundary.title}\uFF1A${boundary.detail}`);
@@ -7267,6 +7587,8 @@ var init_doctor = __esm({
     init_config();
     init_boundary();
     init_net();
+    init_sandbox_scan();
+    init_ts_config();
     SERVER_PROBE_TIMEOUT_MS = 5e3;
     OFFLINE_COMMANDS = [
       "adep init",
@@ -7639,8 +7961,8 @@ __export(hosting_exports, {
   hostingInfo: () => hostingInfo,
   hostingPull: () => hostingPull
 });
-import { readdir as readdir7, readFile as readFile16, stat as stat13 } from "node:fs/promises";
-import { dirname as dirname11, join as join20, relative as relative5, resolve as resolve14, sep as sep3 } from "node:path";
+import { readdir as readdir8, readFile as readFile17, stat as stat13 } from "node:fs/promises";
+import { dirname as dirname11, join as join21, relative as relative6, resolve as resolve14, sep as sep4 } from "node:path";
 async function open4(paths, options) {
   const client = await createClient(paths);
   const project2 = await resolveSlug(resolve14(options.cwd), options.slug);
@@ -7661,16 +7983,16 @@ async function collectSiteFiles(dir) {
   const walk = async (sub) => {
     let entries;
     try {
-      entries = await readdir7(sub, { withFileTypes: true });
+      entries = await readdir8(sub, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = join20(sub, entry.name);
+      const full = join21(sub, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
       } else if (entry.isFile()) {
-        const rel = relative5(root, full).split(sep3).join("/");
+        const rel = relative6(root, full).split(sep4).join("/");
         files.set(rel, full);
       }
     }
@@ -7690,7 +8012,7 @@ async function hostingDeploy(paths, options) {
   for (const [rel, full] of files) {
     log(`[adep] \u4E0A\u4F20 site/${rel}`);
     const info2 = await stat13(full);
-    const bytes = await readFile16(full);
+    const bytes = await readFile17(full);
     const form = new FormData();
     form.set("path", `site/${rel}`);
     form.set("visibility", "public");
@@ -7728,7 +8050,7 @@ async function hostingPull(paths, options) {
     const response = await client.download(url, "HOSTING_DOWNLOAD_FAILED");
     const bytes = Buffer.from(await response.arrayBuffer());
     const rel = entry.path.replace(/^site\//, "");
-    const target = join20(outputDir, ...rel.split("/"));
+    const target = join21(outputDir, ...rel.split("/"));
     await mkdir12(dirname11(target), { recursive: true });
     await writeFile10(target, bytes);
     files.push({ path: entry.path, size: bytes.length });

package/dist/vite.js

@@ -2438,11 +2438,12 @@ function createLocalStorageDriver(options) {
 }
 
 // packages/cli/src/sim/storage.ts
+var SIM_SIGN_SECRET = "adep-sim-secret";
 function createSimStorageCapability(options) {
   const dir = join3(options.cwd, ".adep", "sim", "storage");
   const driver = createLocalStorageDriver({ dir });
   const signer = {
-    secret: options.secret ?? "adep-sim-secret",
+    secret: options.secret ?? SIM_SIGN_SECRET,
     baseUrl: options.baseUrl ?? "http://127.0.0.1:8787"
   };
   const bundle = createStorageCapability(driver, signer, options.projectId ?? "sim-project");
@@ -2631,6 +2632,8 @@ async function createSimRuntime(options) {
     bundle,
     realtime: simRealtime.realtime,
     db,
+    /** 存储句柄（serve 的签名文件下载路由用它读对象；bundle 里的 capability 是同一驱动的 RPC 面）。 */
+    storage,
     dispose: async () => {
       await db.driver.close();
     }
@@ -2726,9 +2729,13 @@ function createSimInvokeHandler(options) {
 // shared/builtin-deps.ts
 var CF_COMPAT_SPECIFIER = "@adep/cf-compat";
 var STATE_OBJECTS_SPECIFIER = "@adep/runtime/state-objects";
+var CRYPTO_SPECIFIER = "@adep/crypto";
+var ROUTE_SPECIFIER = "@adep/runtime/route";
 var BUILTIN_DEPS = [
   CF_COMPAT_SPECIFIER,
   STATE_OBJECTS_SPECIFIER,
+  CRYPTO_SPECIFIER,
+  ROUTE_SPECIFIER,
   "axios",
   "lodash",
   "dayjs",
@@ -2737,7 +2744,12 @@ var BUILTIN_DEPS = [
 var BUILTIN_DEPS_CSV = BUILTIN_DEPS.join(",");
 
 // packages/cli/src/builtin-deps.ts
-var LOCAL_BUILTIN_DEPS = [CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER];
+var LOCAL_BUILTIN_DEPS = [
+  CF_COMPAT_SPECIFIER,
+  STATE_OBJECTS_SPECIFIER,
+  CRYPTO_SPECIFIER,
+  ROUTE_SPECIFIER
+];
 
 // packages/cli/src/sim/boundary.ts
 var SIM_BOUNDARIES = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adep/cli",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "type": "module",
   "description": "`adep` 命令行工具包位：登录 / 初始化 / 本地调试 / 部署 / 数据库维护 / 云存储 / 静态托管 / 微前端组件（widget），实现见任务单 CLI-001 ~ CLI-003 与 FE-002；子路径 `@adep/cli/vite` 提供云函数 vite 插件（CLI-014）",
   "bin": {
@@ -21,10 +21,11 @@
     "commander": "14.0.2",
     "esbuild": "0.25.12",
     "@adep/cf-compat": "0.1.1",
-    "@adep/vite-plugin": "0.1.6"
+    "@adep/runtime": "0.2.7",
+    "@adep/crypto": "0.1.0",
+    "@adep/vite-plugin": "0.1.7"
   },
   "devDependencies": {
-    "@adep/runtime": "0.2.6",
     "@adep/types": "0.2.3"
   },
   "scripts": {