@adep/cli 0.1.15 → 0.1.17

package/dist/index.js

@@ -2693,6 +2693,14 @@ function hmacSha256(key, message) {
 function hmacSha256Hex(key, message) {
   return [...hmacSha256(key, message)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
 var K, rotr;
 var init_hmac_sha256 = __esm({
   "packages/runtime/src/storage/hmac-sha256.ts"() {
@@ -2778,6 +2786,22 @@ function signDownloadUrl(config, projectId, path, ttlSeconds = DEFAULT_SIGN_TTL_
   const signature = sign(config.secret, projectId, path, expires);
   return `${base}?${SIGN_EXPIRES_KEY}=${expires}&${SIGN_SIGNATURE_KEY}=${signature}`;
 }
+function verifyDownloadSignature(config, projectId, path, query, nowSeconds2 = Math.floor(Date.now() / 1e3)) {
+  const expiresRaw = query.expires;
+  const signatureRaw = query.signature;
+  if (typeof expiresRaw !== "string" || typeof signatureRaw !== "string") {
+    return { ok: false, reason: "missing" };
+  }
+  if (!/^\d{1,15}$/.test(expiresRaw)) return { ok: false, reason: "malformed" };
+  const expires = Number(expiresRaw);
+  if (!Number.isFinite(expires)) return { ok: false, reason: "malformed" };
+  if (nowSeconds2 > expires) return { ok: false, reason: "expired" };
+  const expected = sign(config.secret, projectId, path, expires);
+  if (!constantTimeEqual(signatureRaw, expected)) {
+    return { ok: false, reason: "invalid" };
+  }
+  return { ok: true };
+}
 var DEFAULT_SIGN_TTL_SECONDS, SIGN_EXPIRES_KEY, SIGN_SIGNATURE_KEY;
 var init_signature = __esm({
   "packages/runtime/src/storage/signature.ts"() {
@@ -3006,7 +3030,7 @@ function createLocalStorageDriver(options) {
       assertStoragePrefix(prefix);
       const root = bucketDir(projectId);
       const metas = [];
-      const walk = async (dir, relative6) => {
+      const walk = async (dir, relative8) => {
         let entries;
         try {
           entries = await readdir3(dir, { withFileTypes: true });
@@ -3017,7 +3041,7 @@ function createLocalStorageDriver(options) {
         for (const entry of entries) {
           if (entry.name.endsWith(META_SUFFIX)) continue;
           const full = join6(dir, entry.name);
-          const rel = relative6 === "" ? entry.name : `${relative6}/${entry.name}`;
+          const rel = relative8 === "" ? entry.name : `${relative8}/${entry.name}`;
           if (entry.isFile()) {
             if (prefix !== void 0 && !rel.startsWith(prefix)) continue;
             tasks.push(
@@ -3071,17 +3095,19 @@ function createSimStorageCapability(options) {
   const dir = join7(options.cwd, ".adep", "sim", "storage");
   const driver = createLocalStorageDriver({ dir });
   const signer = {
-    secret: options.secret ?? "adep-sim-secret",
+    secret: options.secret ?? SIM_SIGN_SECRET,
     baseUrl: options.baseUrl ?? "http://127.0.0.1:8787"
   };
   const bundle = createStorageCapability(driver, signer, options.projectId ?? "sim-project");
   return { bundle, driver };
 }
+var SIM_SIGN_SECRET;
 var init_storage = __esm({
   "packages/cli/src/sim/storage.ts"() {
     "use strict";
     init_cloud2();
     init_local();
+    SIM_SIGN_SECRET = "adep-sim-secret";
   }
 });
 
@@ -3281,6 +3307,8 @@ async function createSimRuntime(options) {
     bundle,
     realtime: simRealtime.realtime,
     db,
+    /** 存储句柄（serve 的签名文件下载路由用它读对象；bundle 里的 capability 是同一驱动的 RPC 面）。 */
+    storage,
     dispose: async () => {
       await db.driver.close();
     }
@@ -3298,185 +3326,665 @@ var init_runtime = __esm({
   }
 });
 
-// packages/cli/src/sim/env.ts
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join9 } from "node:path";
-function parseEnv(content) {
-  const env = {};
-  for (const raw of content.split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line.length === 0 || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq === -1) continue;
-    const key = line.slice(0, eq).trim();
-    if (key.length === 0) continue;
-    env[key] = line.slice(eq + 1).trim();
-  }
-  return env;
+// packages/cli/src/client.ts
+var client_exports = {};
+__export(client_exports, {
+  createClient: () => createClient,
+  resolveSlug: () => resolveSlug
+});
+async function envelopeError(response, fallbackCode, parsed) {
+  const payload = parsed ?? null;
+  return new CliError(
+    payload?.error?.code ?? fallbackCode,
+    payload?.error?.message ?? `\u5E73\u53F0\u8FD4\u56DE HTTP ${response.status}`
+  );
 }
-async function loadSimEnv(cwd, config = {}) {
-  const envRoot = await readFile6(join9(cwd, ".env"), "utf8").catch(() => "");
-  const envLocal = await readFile6(join9(cwd, ".env.local"), "utf8").catch(() => "");
-  const merged = { ...parseEnv(envRoot), ...parseEnv(envLocal) };
-  for (const secret of config.secrets ?? []) {
-    if (merged[secret] !== void 0) continue;
-    if (process.env[secret] !== void 0) {
-      merged[secret] = process.env[secret];
-      continue;
-    }
-    throw new Error(
-      `secret "${secret}" \u672A\u914D\u7F6E\uFF1A\u8BF7\u5728 .env.local \u6DFB\u52A0 ${secret}=<value>\uFF0C\u6216\u7528\u73AF\u5883\u53D8\u91CF\u5BFC\u51FA\u540E\u91CD\u8BD5 adep dev\uFF08\u6A21\u62DF\u73AF\u5883\u6C38\u4E0D\u843D\u76D8\u8BE5\u503C\uFF09`
-    );
+async function parseBody(response) {
+  const text = await response.text();
+  if (text.length === 0) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
   }
-  return merged;
 }
-var init_env = __esm({
-  "packages/cli/src/sim/env.ts"() {
-    "use strict";
+async function createClient(paths) {
+  const credentials = await loadCredentials(paths);
+  if (credentials === null) {
+    throw new CliError("NOT_LOGGED_IN", "\u672A\u767B\u5F55\uFF1A\u8BF7\u5148\u6267\u884C adep login");
   }
-});
-
-// packages/cli/src/sim/invoke.ts
-function resolveFunctionEntry(files, fnName) {
-  const flat = `${fnName}.ts`;
-  if (files[flat] !== void 0) return flat;
-  const directory = `${fnName}/index.ts`;
-  if (files[directory] !== void 0) return directory;
-  return void 0;
-}
-function listFunctionNames(files) {
-  const names = /* @__PURE__ */ new Set();
-  for (const key of Object.keys(files)) {
-    const parts = key.split("/");
-    if (parts.length === 1 && parts[0] !== void 0 && parts[0].endsWith(".ts")) {
-      names.add(parts[0].slice(0, -3));
-    } else if (parts.length === 2 && parts[1] === "index.ts" && parts[0] !== void 0) {
-      names.add(parts[0]);
+  const server = credentials.server;
+  const cookie = sessionCookieHeader(credentials);
+  const request = async (path, init = {}, fallbackCode = "API_REQUEST_FAILED") => {
+    const method = init.method ?? (init.body === void 0 ? "GET" : "POST");
+    let response;
+    try {
+      response = await fetch(`${server}${path}`, {
+        method,
+        headers: { "content-type": "application/json", cookie },
+        ...init.body === void 0 ? {} : { body: JSON.stringify(init.body) }
+      });
+    } catch (error) {
+      throw new CliError(
+        "SERVER_UNREACHABLE",
+        `\u65E0\u6CD5\u8FDE\u63A5\u5E73\u53F0 ${server}\uFF1A${error instanceof Error ? error.message : String(error)}`
+      );
     }
-  }
-  return [...names];
-}
-function createSimInvokeHandler(options) {
-  return async (method, args) => {
-    if (method !== "invoke") {
-      throw new Error(`\u672A\u77E5\u7684 cloud.invoke \u65B9\u6CD5 "${method}"`);
+    const parsed = await parseBody(response);
+    if (response.status < 200 || response.status >= 300) {
+      throw await envelopeError(response, fallbackCode, parsed);
     }
-    const input = args[0];
-    if (typeof input?.name !== "string" || input.name.length === 0) {
-      throw new Error("cloud.invoke \u9700\u8981\u76EE\u6807\u51FD\u6570\u540D\uFF08InvokeInput.name\uFF09");
+    return parsed;
+  };
+  const upload = async (path, form, fallbackCode = "UPLOAD_FAILED") => {
+    let response;
+    try {
+      response = await fetch(`${server}${path}`, {
+        method: "POST",
+        headers: { cookie },
+        body: form
+      });
+    } catch (error) {
+      throw new CliError(
+        "SERVER_UNREACHABLE",
+        `\u65E0\u6CD5\u8FDE\u63A5\u5E73\u53F0 ${server}\uFF1A${error instanceof Error ? error.message : String(error)}`
+      );
     }
-    const targetEntry = resolveFunctionEntry(options.files, input.name);
-    if (targetEntry === void 0) {
-      throw new Error(`\u76EE\u6807\u51FD\u6570 "${input.name}" \u4E0D\u5B58\u5728`);
+    if (response.status < 200 || response.status >= 300) {
+      throw await envelopeError(response, fallbackCode, await parseBody(response));
     }
-    const executeInput = {
-      project: { id: "local", slug: "local" },
-      fn: { id: input.name, name: input.name },
-      files: options.files,
-      entry: targetEntry,
-      request: {
-        method: "POST",
-        path: `/${input.name}`,
-        query: input.query ?? {},
-        headers: {},
-        ...input.body === void 0 ? {} : { body: input.body }
-      },
-      timeoutMs: 1e4,
-      ...options.env === void 0 ? {} : { env: options.env }
-    };
-    const result = await options.executor.execute(executeInput);
-    return result.body;
+    return response;
+  };
+  const download = async (url, fallbackCode = "DOWNLOAD_FAILED") => {
+    const target = url.startsWith("http") ? url : `${server}${url}`;
+    let response;
+    try {
+      response = await fetch(target, { headers: { cookie } });
+    } catch (error) {
+      throw new CliError(
+        "SERVER_UNREACHABLE",
+        `\u65E0\u6CD5\u8FDE\u63A5\u5E73\u53F0 ${server}\uFF1A${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw await envelopeError(response, fallbackCode, await parseBody(response));
+    }
+    return response;
   };
+  return { server, cookie, request, upload, download };
 }
-var init_invoke = __esm({
-  "packages/cli/src/sim/invoke.ts"() {
-    "use strict";
-  }
-});
-
-// shared/builtin-deps.ts
-var CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER, BUILTIN_DEPS, BUILTIN_DEPS_CSV;
-var init_builtin_deps = __esm({
-  "shared/builtin-deps.ts"() {
-    "use strict";
-    CF_COMPAT_SPECIFIER = "@adep/cf-compat";
-    STATE_OBJECTS_SPECIFIER = "@adep/runtime/state-objects";
-    BUILTIN_DEPS = [
-      CF_COMPAT_SPECIFIER,
-      STATE_OBJECTS_SPECIFIER,
-      "axios",
-      "lodash",
-      "dayjs",
-      "zod"
-    ];
-    BUILTIN_DEPS_CSV = BUILTIN_DEPS.join(",");
-  }
-});
-
-// packages/cli/src/builtin-deps.ts
-var LOCAL_BUILTIN_DEPS;
-var init_builtin_deps2 = __esm({
-  "packages/cli/src/builtin-deps.ts"() {
+async function resolveSlug(cwd, slug) {
+  if (slug !== void 0 && slug.length > 0) return slug;
+  const config = await loadConfig(cwd);
+  return config.name;
+}
+var init_client = __esm({
+  "packages/cli/src/client.ts"() {
     "use strict";
-    init_builtin_deps();
-    LOCAL_BUILTIN_DEPS = [CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER];
+    init_auth();
+    init_credentials();
+    init_dev();
   }
 });
 
-// packages/cli/src/sim/boundary.ts
-var SIM_BOUNDARIES;
-var init_boundary = __esm({
-  "packages/cli/src/sim/boundary.ts"() {
-    "use strict";
-    SIM_BOUNDARIES = [
-      {
-        kind: "capability",
-        title: "\u89E6\u53D1\u5668\u4E0D\u81EA\u52A8\u6267\u884C",
-        detail: "\u5B9A\u65F6 / \u4E8B\u4EF6\u89E6\u53D1\u5668\u53EA\u767B\u8BB0\uFF0C\u4E0D\u7531\u6A21\u62DF\u5668\u81EA\u52A8\u89E6\u53D1\uFF08\u672C\u5730\u4EE5\u624B\u5DE5 HTTP \u8C03\u7528\u66FF\u4EE3\uFF09\u3002"
-      },
-      {
-        kind: "diff",
-        title: "\u65E0\u8DE8\u5B9E\u4F8B\u5E7F\u64AD",
-        detail: "cloud.realtime \u5DF2\u6CE8\u5165\uFF0C\u4F46\u4E3A\u5355\u8FDB\u7A0B\u5185\u5B58\u5E7F\u64AD\uFF1A\u4E0D\u652F\u6301\u8DE8\u8FDB\u7A0B / \u8DE8\u5B9E\u4F8B\uFF0C\u7EBF\u4E0A\u591A\u5B9E\u4F8B\u8BED\u4E49\u4E0D\u540C\u3002"
-      },
-      {
-        kind: "capability",
-        title: "publish \u4E0D\u652F\u6301 except",
-        detail: "\u672C\u5730\u4E0D\u5EFA WS \u63E1\u624B\u3001\u65E0\u8FDE\u63A5\u8EAB\u4EFD\uFF0C\u6545 cloud.realtime.publish \u7684 except\uFF08\u4E0D\u53D1\u56DE\u53D1\u9001\u8005\uFF09\u65E0\u4ECE\u5B9E\u73B0\uFF0C\u4F20\u5165\u5373\u62A5\u9519\u3002"
-      },
-      {
-        kind: "capability",
-        title: "\u65E0\u9650\u989D\u7B49\u4EF7",
-        detail: "\u672C\u5730\u4E0D\u6267\u884C\u8BA1\u91CF / \u914D\u989D\u95E8\u7981\uFF08\u4E0D\u6309\u51FD\u6570\u8C03\u7528\u3001\u6D41\u91CF\u3001\u63A8\u9001\u8BA1\u6570\uFF09\uFF0C\u9650\u989D\u8BED\u4E49\u4EC5\u7EBF\u4E0A\u751F\u6548\u3002"
-      },
-      {
-        kind: "diff",
-        title: "\u4E0D\u8BA1\u91CF",
-        detail: "\u672C\u6A21\u62DF\u8FD0\u884C\u65F6\u4E0D\u4EA7\u51FA\u8BA1\u91CF\u4E8B\u4EF6\uFF0C\u4E5F\u4E0D\u5199 billing\uFF1B\u79BB\u7EBF\u5F00\u53D1\u4E0D\u8BA1\u8D39\u3002"
-      }
-    ];
-  }
+// packages/cli/src/db.ts
+var db_exports = {};
+__export(db_exports, {
+  dbExec: () => dbExec,
+  dbMigrate: () => dbMigrate,
+  dbRollback: () => dbRollback,
+  dbSnapshotCreate: () => dbSnapshotCreate,
+  dbSnapshotList: () => dbSnapshotList,
+  dbSnapshotRestore: () => dbSnapshotRestore,
+  dbStart: () => dbStart,
+  dbStatus: () => dbStatus,
+  dbStop: () => dbStop,
+  splitSqlStatements: () => splitSqlStatements
 });
-
-// packages/cli/src/ts-config.ts
-import { stat as stat6, readFile as readFile7 } from "node:fs/promises";
-import { join as join10 } from "node:path";
-async function loadAdepConfigModule(cwd) {
-  const configPath = join10(cwd, "adep.config.ts");
-  try {
-    await stat6(configPath);
-  } catch {
-    return null;
-  }
-  let rawDefault;
-  try {
-    const bun = globalThis.Bun;
+import { readFile as readFile6 } from "node:fs/promises";
+import { resolve as resolve4 } from "node:path";
+async function open2(paths, options) {
+  const client = await createClient(paths);
+  const project2 = await resolveSlug(resolve4(options.cwd), options.slug);
+  return { client, project: project2 };
+}
+async function dbStart(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(`/api/v1/projects/${project2}/database`, { method: "POST" });
+}
+async function dbStatus(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(`/api/v1/projects/${project2}/database`);
+}
+async function dbStop(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(`/api/v1/projects/${project2}/database`, {
+    method: "DELETE"
+  });
+}
+async function dbExec(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(
+    `/api/v1/projects/${project2}/database/console/sql`,
+    {
+      method: "POST",
+      body: {
+        sql: options.sql,
+        ...options.params === void 0 ? {} : { params: options.params },
+        ...options.confirmTable === void 0 ? {} : { confirmTable: options.confirmTable }
+      }
+    },
+    "SQL_EXEC_FAILED"
+  );
+}
+async function dbSnapshotList(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(
+    `/api/v1/projects/${project2}/database/snapshots`
+  );
+}
+async function dbSnapshotCreate(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(`/api/v1/projects/${project2}/database/snapshots`, {
+    method: "POST"
+  });
+}
+async function dbSnapshotRestore(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(
+    `/api/v1/projects/${project2}/database/snapshots/${options.snapshotId}/restore`,
+    { method: "POST" }
+  );
+}
+async function dbRollback(paths, options) {
+  const { client, project: project2 } = await open2(paths, options);
+  return client.request(
+    `/api/v1/projects/${project2}/database/rollback`,
+    { method: "POST", body: { to: options.to } }
+  );
+}
+function splitSqlStatements(source) {
+  const statements = [];
+  let buffer = "";
+  let inQuote = false;
+  const lines = source.split("\n");
+  for (const rawLine of lines) {
+    const trimmed = rawLine.trim();
+    if (!inQuote && (trimmed.length === 0 || trimmed.startsWith("--"))) continue;
+    for (let i = 0; i < rawLine.length; i++) {
+      const ch = rawLine[i];
+      if (inQuote) {
+        if (ch === "'") {
+          if (rawLine[i + 1] === "'") {
+            buffer += ch + rawLine[i + 1];
+            i++;
+            continue;
+          }
+          inQuote = false;
+        }
+        buffer += ch;
+        continue;
+      }
+      if (ch === "'") {
+        inQuote = true;
+        buffer += ch;
+        continue;
+      }
+      if (ch === "-" && rawLine[i + 1] === "-") break;
+      if (ch === ";") {
+        const statement = buffer.trim();
+        if (statement.length > 0) statements.push(statement);
+        buffer = "";
+        continue;
+      }
+      buffer += ch;
+    }
+    buffer += inQuote ? "\n" : " ";
+  }
+  if (inQuote) {
+    throw new Error(`SQL \u8FC1\u79FB\u6587\u4EF6\u5F15\u53F7\u672A\u95ED\u5408\uFF1A${buffer.trim().slice(0, 80)}\u2026`);
+  }
+  const tail = buffer.trim();
+  if (tail.length > 0) statements.push(tail);
+  return statements;
+}
+async function dbMigrate(paths, options) {
+  const source = await readFile6(resolve4(options.file), "utf8");
+  const statements = splitSqlStatements(source);
+  if (statements.length === 0) {
+    throw new Error(`\u8FC1\u79FB\u6587\u4EF6\u6CA1\u6709\u53EF\u6267\u884C\u8BED\u53E5\uFF1A${options.file}`);
+  }
+  const { project: project2 } = await open2(paths, options);
+  const applied = [];
+  const changes = [];
+  for (const statement of statements) {
+    try {
+      const result = await dbExec(paths, {
+        cwd: options.cwd,
+        ...options.slug === void 0 ? {} : { slug: options.slug },
+        sql: statement
+      });
+      applied.push(statement);
+      changes.push(result.changes);
+    } catch (error) {
+      const code = error instanceof CliError ? error.code : "MIGRATE_FAILED";
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        projectId: project2,
+        applied,
+        changes,
+        failed: { statement, code, message }
+      };
+    }
+  }
+  return { projectId: project2, applied, changes };
+}
+var init_db2 = __esm({
+  "packages/cli/src/db.ts"() {
+    "use strict";
+    init_auth();
+    init_client();
+  }
+});
+
+// packages/cli/src/serve/sqlite-driver.ts
+import { mkdir as mkdir7 } from "node:fs/promises";
+import { dirname as dirname8, resolve as resolve5 } from "node:path";
+function isBun(versions) {
+  return versions["bun"] !== void 0 && versions["bun"] !== "";
+}
+function detectSqliteRuntime(versions = process.versions) {
+  if (isBun(versions)) return "bun";
+  const raw = versions["node"];
+  if (raw === void 0) return null;
+  const [majorText, minorText] = raw.split(".");
+  const major = Number(majorText);
+  const minor = Number(minorText ?? "0");
+  if (!Number.isInteger(major) || !Number.isInteger(minor)) return null;
+  if (major > NODE_SQLITE_MIN.major) return "node";
+  if (major === NODE_SQLITE_MIN.major && minor >= NODE_SQLITE_MIN.minor) return "node";
+  return null;
+}
+function sqliteModuleName(runtime) {
+  return runtime === "bun" ? "bun:sqlite" : "node:sqlite";
+}
+function sqliteUnavailableReason(versions = process.versions) {
+  const current = isBun(versions) ? `Bun ${versions["bun"] ?? ""}`.trim() : `Node ${versions["node"] ?? "\u672A\u77E5"}`;
+  return `\u5F53\u524D\u8FD0\u884C\u65F6 ${current} \u4E0D\u63D0\u4F9B SQLite \u5185\u5EFA\u6A21\u5757\uFF08\u9700\u8981 Bun \u6216 Node \u2265 ${NODE_SQLITE_MIN.major}.${NODE_SQLITE_MIN.minor}\uFF09`;
+}
+function sqliteRuntimeRequirementMessage(versions = process.versions) {
+  return `--db sqlite \u9700\u8981 Bun\uFF08\u5185\u7F6E bun:sqlite\uFF09\u6216 Node \u2265 ${NODE_SQLITE_MIN.major}.${NODE_SQLITE_MIN.minor}\uFF08\u5185\u7F6E node:sqlite\uFF09\uFF1B${sqliteUnavailableReason(versions)}\u3002\u8BF7\u6539\u7528 \`--db sim\`\uFF08\u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\uFF0C\u65E0\u9700\u989D\u5916\u8FD0\u884C\u65F6\uFF09\uFF0C\u6216\u5347\u7EA7 Node / \u7528 Bun \u8FD0\u884C\u3002`;
+}
+async function openSqliteProjectDriver(file, options = {}) {
+  const runtime = options.runtime ?? detectSqliteRuntime();
+  if (runtime === null) throw new Error(sqliteRuntimeRequirementMessage());
+  const moduleName = sqliteModuleName(runtime);
+  const ctorName = runtime === "bun" ? "Database" : "DatabaseSync";
+  let mod;
+  try {
+    const specifier = moduleName;
+    mod = await import(
+      /* @vite-ignore */
+      specifier
+    );
+  } catch (error) {
+    throw new Error(
+      `${sqliteRuntimeRequirementMessage()}
+\uFF08\u8F7D\u5165 ${moduleName} \u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}\uFF09`,
+      { cause: error }
+    );
+  }
+  const Ctor = mod[ctorName];
+  if (Ctor === void 0) {
+    throw new Error(`${moduleName} \u672A\u5BFC\u51FA ${ctorName}\uFF1A\u5F53\u524D\u8FD0\u884C\u65F6\u7684 SQLite \u5185\u5EFA\u6A21\u5757\u4E0D\u53EF\u7528`);
+  }
+  const target = file === ":memory:" ? file : resolve5(file);
+  if (target !== ":memory:") await mkdir7(dirname8(target), { recursive: true });
+  const database = new Ctor(target);
+  database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;");
+  return {
+    engine: "sqlite",
+    async run(sql, params = []) {
+      if (params.length === 0) {
+        database.exec(sql);
+        return { changes: 0 };
+      }
+      const result = database.prepare(sql).run(...params);
+      return { changes: Number(result.changes) };
+    },
+    async all(sql, params = []) {
+      const statement = database.prepare(sql);
+      statement.setReturnArrays?.(false);
+      return statement.all(...params);
+    },
+    async get(sql, params = []) {
+      const statement = database.prepare(sql);
+      statement.setReturnArrays?.(false);
+      const row = statement.get(...params);
+      return row ?? null;
+    },
+    async close() {
+      database.close();
+    }
+  };
+}
+var NODE_SQLITE_MIN;
+var init_sqlite_driver = __esm({
+  "packages/cli/src/serve/sqlite-driver.ts"() {
+    "use strict";
+    NODE_SQLITE_MIN = { major: 22, minor: 5 };
+  }
+});
+
+// packages/cli/src/serve/db-mode.ts
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join9, relative as relative2, resolve as resolve6 } from "node:path";
+function isServeDbMode(value) {
+  return SERVE_DB_MODES.includes(value.trim().toLowerCase());
+}
+function parseServeDbMode(raw, source) {
+  const value = raw.trim().toLowerCase();
+  if (!isServeDbMode(value)) {
+    throw new Error(
+      `${source} \u7684\u6570\u636E\u5E93\u6A21\u5F0F "${raw}" \u65E0\u6548\uFF1A\u53EA\u652F\u6301 ${SERVE_DB_MODES.join(" | ")}\uFF08sim = \u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\u4E0E .adep/sim/db.json\uFF1Bsqlite = \u771F\u5B9E SQLite \u5E93\u6587\u4EF6\uFF09`
+    );
+  }
+  return value;
+}
+function resolveServeDbMode(explicit) {
+  if (explicit !== void 0) return parseServeDbMode(explicit, "--db");
+  const fromEnv = process.env["ADEP_SERVE_DB"];
+  if (fromEnv !== void 0 && fromEnv.trim() !== "") {
+    return parseServeDbMode(fromEnv, "ADEP_SERVE_DB");
+  }
+  return DEFAULT_SERVE_DB_MODE;
+}
+function resolveServeDbFile(cwd, explicit) {
+  const raw = explicit ?? envDbFile() ?? DEFAULT_SQLITE_DB_FILE;
+  return raw === ":memory:" ? raw : resolve6(cwd, raw);
+}
+function envDbFile() {
+  const raw = process.env["ADEP_SERVE_DB_FILE"];
+  return raw === void 0 || raw.trim() === "" ? void 0 : raw.trim();
+}
+function displayPath(cwd, target) {
+  if (target === ":memory:") return target;
+  const rel = relative2(cwd, target);
+  return rel.startsWith("..") ? target : rel;
+}
+function simDbTarget(cwd) {
+  return displayPath(cwd, join9(simDir(cwd), "db.json"));
+}
+function resolveLocalDbTarget(cwd, options) {
+  const mode = resolveServeDbMode(options.db);
+  return {
+    mode,
+    file: mode === "sqlite" ? resolveServeDbFile(cwd, options.dbFile) : null
+  };
+}
+async function openLocalDbDriver(target, options) {
+  if (target.mode === "sim" || target.file === null) {
+    return { mode: "sim", file: null, module: null, driver: null };
+  }
+  const simTarget = simDbTarget(options.cwd);
+  const runtimeName = detectSqliteRuntime();
+  if (runtimeName === null) {
+    options.log(
+      `[${options.tag}] \u8B66\u544A\uFF1A${sqliteUnavailableReason()}\uFF0C\u5DF2\u81EA\u52A8\u964D\u7EA7\u4E3A sim \u6A21\u5F0F\uFF08\u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\uFF0C\u5E93 ${simTarget}\uFF09\u3002\u5982\u9700\u771F\u5B9E SQLite\uFF0C\u8BF7\u7528 Bun \u6216\u5347\u7EA7 Node \u540E\u91CD\u8BD5\u3002`
+    );
+    return { mode: "sim", file: null, module: null, driver: null };
+  }
+  try {
+    const driver = await openSqliteProjectDriver(target.file, { runtime: runtimeName });
+    return {
+      mode: "sqlite",
+      file: target.file,
+      module: sqliteModuleName(runtimeName),
+      driver
+    };
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    options.log(
+      `[${options.tag}] \u8B66\u544A\uFF1A\u6253\u5F00 SQLite \u5E93\u5931\u8D25\uFF08${detail}\uFF09\uFF0C\u5DF2\u81EA\u52A8\u964D\u7EA7\u4E3A sim \u6A21\u5F0F\uFF08\u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\uFF0C\u5E93 ${simTarget}\uFF09\u3002`
+    );
+    return { mode: "sim", file: null, module: null, driver: null };
+  }
+}
+async function applyLocalSchema(driver, options) {
+  const { schemaFile, mode, tag, cwd, log } = options;
+  const schemaPath = resolve6(cwd, schemaFile);
+  const schemaSource = await readFile7(schemaPath, "utf8").catch((error) => {
+    if (error.code === "ENOENT") {
+      throw new Error(`schema \u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${schemaPath}`);
+    }
+    throw error;
+  });
+  const statements = splitSqlStatements(schemaSource);
+  let applied = 0;
+  let skipped = 0;
+  for (const [index, statement] of statements.entries()) {
+    try {
+      await driver.run(statement);
+      applied += 1;
+    } catch (error) {
+      const isUnsupported = error instanceof Error && "code" in error && error.code === "DB_UNSAFE_OP";
+      if (mode === "sim" && isUnsupported) {
+        skipped += 1;
+        log(`[${tag}] \u8DF3\u8FC7 schema \u8BED\u53E5\uFF08sim \u5F15\u64CE\u4E0D\u652F\u6301\uFF09\uFF1A${statement.slice(0, 60)}\u2026`);
+        continue;
+      }
+      const detail = error instanceof Error ? error.message : String(error);
+      throw new Error(
+        `schema \u8BED\u53E5\u6267\u884C\u5931\u8D25\uFF08--schema ${schemaFile}\uFF0C\u7B2C ${index + 1} \u6761\uFF0Cdb \u6A21\u5F0F ${mode}\uFF09\uFF1A${detail}
+\u8BED\u53E5\uFF1A${statement.slice(0, 200)}` + (mode === "sqlite" ? "\n\uFF08sqlite \u6A21\u5F0F\u4E0D\u505A\u8BED\u53E5\u8DF3\u8FC7\uFF1B\u5982\u9700\u8DF3\u8FC7\u8BED\u4E49\u8BF7\u6539\u7528 --db sim\uFF09" : ""),
+        { cause: error }
+      );
+    }
+  }
+  const skipNote = skipped > 0 ? `\uFF0C\u8DF3\u8FC7 ${skipped} \u6761` : "";
+  log(`[${tag}] \u5DF2\u5E94\u7528\u6570\u636E\u5E93\u7ED3\u6784\uFF08--schema ${schemaFile}\uFF09\uFF1A${applied} \u6761\u8BED\u53E5${skipNote}`);
+}
+var SERVE_DB_MODES, DEFAULT_SERVE_DB_MODE, DEFAULT_SQLITE_DB_FILE;
+var init_db_mode = __esm({
+  "packages/cli/src/serve/db-mode.ts"() {
+    "use strict";
+    init_db2();
+    init_runtime();
+    init_sqlite_driver();
+    SERVE_DB_MODES = ["sim", "sqlite"];
+    DEFAULT_SERVE_DB_MODE = "sqlite";
+    DEFAULT_SQLITE_DB_FILE = ".adep/data/project.sqlite";
+  }
+});
+
+// packages/cli/src/sim/env.ts
+import { readFile as readFile8 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+function parseEnv(content) {
+  const env = {};
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    const key = line.slice(0, eq).trim();
+    if (key.length === 0) continue;
+    env[key] = line.slice(eq + 1).trim();
+  }
+  return env;
+}
+async function loadSimEnv(cwd, config = {}) {
+  const envRoot = await readFile8(join10(cwd, ".env"), "utf8").catch(() => "");
+  const envLocal = await readFile8(join10(cwd, ".env.local"), "utf8").catch(() => "");
+  const merged = { ...parseEnv(envRoot), ...parseEnv(envLocal) };
+  for (const secret of config.secrets ?? []) {
+    if (merged[secret] !== void 0) continue;
+    if (process.env[secret] !== void 0) {
+      merged[secret] = process.env[secret];
+      continue;
+    }
+    throw new Error(
+      `secret "${secret}" \u672A\u914D\u7F6E\uFF1A\u8BF7\u5728 .env.local \u6DFB\u52A0 ${secret}=<value>\uFF0C\u6216\u7528\u73AF\u5883\u53D8\u91CF\u5BFC\u51FA\u540E\u91CD\u8BD5 adep dev\uFF08\u6A21\u62DF\u73AF\u5883\u6C38\u4E0D\u843D\u76D8\u8BE5\u503C\uFF09`
+    );
+  }
+  return merged;
+}
+var init_env = __esm({
+  "packages/cli/src/sim/env.ts"() {
+    "use strict";
+  }
+});
+
+// packages/cli/src/sim/invoke.ts
+function resolveFunctionEntry(files, fnName) {
+  const flat = `${fnName}.ts`;
+  if (files[flat] !== void 0) return flat;
+  const directory = `${fnName}/index.ts`;
+  if (files[directory] !== void 0) return directory;
+  return void 0;
+}
+function listFunctionNames(files) {
+  const names = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(files)) {
+    const parts = key.split("/");
+    if (parts.length === 1 && parts[0] !== void 0 && parts[0].endsWith(".ts")) {
+      names.add(parts[0].slice(0, -3));
+    } else if (parts.length === 2 && parts[1] === "index.ts" && parts[0] !== void 0) {
+      names.add(parts[0]);
+    }
+  }
+  return [...names];
+}
+function createSimInvokeHandler(options) {
+  return async (method, args) => {
+    if (method !== "invoke") {
+      throw new Error(`\u672A\u77E5\u7684 cloud.invoke \u65B9\u6CD5 "${method}"`);
+    }
+    const input = args[0];
+    if (typeof input?.name !== "string" || input.name.length === 0) {
+      throw new Error("cloud.invoke \u9700\u8981\u76EE\u6807\u51FD\u6570\u540D\uFF08InvokeInput.name\uFF09");
+    }
+    const targetEntry = resolveFunctionEntry(options.files, input.name);
+    if (targetEntry === void 0) {
+      throw new Error(`\u76EE\u6807\u51FD\u6570 "${input.name}" \u4E0D\u5B58\u5728`);
+    }
+    const executeInput = {
+      project: { id: "local", slug: "local" },
+      fn: { id: input.name, name: input.name },
+      files: options.files,
+      entry: targetEntry,
+      request: {
+        method: "POST",
+        path: `/${input.name}`,
+        query: input.query ?? {},
+        headers: {},
+        ...input.body === void 0 ? {} : { body: input.body }
+      },
+      timeoutMs: 1e4,
+      ...options.env === void 0 ? {} : { env: options.env }
+    };
+    const result = await options.executor.execute(executeInput);
+    return result.body;
+  };
+}
+var init_invoke = __esm({
+  "packages/cli/src/sim/invoke.ts"() {
+    "use strict";
+  }
+});
+
+// shared/builtin-deps.ts
+var CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER, CRYPTO_SPECIFIER, ROUTE_SPECIFIER, BUILTIN_DEPS, BUILTIN_DEPS_CSV;
+var init_builtin_deps = __esm({
+  "shared/builtin-deps.ts"() {
+    "use strict";
+    CF_COMPAT_SPECIFIER = "@adep/cf-compat";
+    STATE_OBJECTS_SPECIFIER = "@adep/runtime/state-objects";
+    CRYPTO_SPECIFIER = "@adep/crypto";
+    ROUTE_SPECIFIER = "@adep/runtime/route";
+    BUILTIN_DEPS = [
+      CF_COMPAT_SPECIFIER,
+      STATE_OBJECTS_SPECIFIER,
+      CRYPTO_SPECIFIER,
+      ROUTE_SPECIFIER,
+      "axios",
+      "lodash",
+      "dayjs",
+      "zod"
+    ];
+    BUILTIN_DEPS_CSV = BUILTIN_DEPS.join(",");
+  }
+});
+
+// packages/cli/src/builtin-deps.ts
+var LOCAL_BUILTIN_DEPS;
+var init_builtin_deps2 = __esm({
+  "packages/cli/src/builtin-deps.ts"() {
+    "use strict";
+    init_builtin_deps();
+    LOCAL_BUILTIN_DEPS = [
+      CF_COMPAT_SPECIFIER,
+      STATE_OBJECTS_SPECIFIER,
+      CRYPTO_SPECIFIER,
+      ROUTE_SPECIFIER
+    ];
+  }
+});
+
+// packages/cli/src/sim/boundary.ts
+var SIM_BOUNDARIES;
+var init_boundary = __esm({
+  "packages/cli/src/sim/boundary.ts"() {
+    "use strict";
+    SIM_BOUNDARIES = [
+      {
+        kind: "capability",
+        title: "\u89E6\u53D1\u5668\u4E0D\u81EA\u52A8\u6267\u884C",
+        detail: "\u5B9A\u65F6 / \u4E8B\u4EF6\u89E6\u53D1\u5668\u53EA\u767B\u8BB0\uFF0C\u4E0D\u7531\u6A21\u62DF\u5668\u81EA\u52A8\u89E6\u53D1\uFF08\u672C\u5730\u4EE5\u624B\u5DE5 HTTP \u8C03\u7528\u66FF\u4EE3\uFF09\u3002"
+      },
+      {
+        kind: "diff",
+        title: "\u65E0\u8DE8\u5B9E\u4F8B\u5E7F\u64AD",
+        detail: "cloud.realtime \u5DF2\u6CE8\u5165\uFF0C\u4F46\u4E3A\u5355\u8FDB\u7A0B\u5185\u5B58\u5E7F\u64AD\uFF1A\u4E0D\u652F\u6301\u8DE8\u8FDB\u7A0B / \u8DE8\u5B9E\u4F8B\uFF0C\u7EBF\u4E0A\u591A\u5B9E\u4F8B\u8BED\u4E49\u4E0D\u540C\u3002"
+      },
+      {
+        kind: "capability",
+        title: "publish \u4E0D\u652F\u6301 except",
+        detail: "\u672C\u5730\u4E0D\u5EFA WS \u63E1\u624B\u3001\u65E0\u8FDE\u63A5\u8EAB\u4EFD\uFF0C\u6545 cloud.realtime.publish \u7684 except\uFF08\u4E0D\u53D1\u56DE\u53D1\u9001\u8005\uFF09\u65E0\u4ECE\u5B9E\u73B0\uFF0C\u4F20\u5165\u5373\u62A5\u9519\u3002"
+      },
+      {
+        kind: "capability",
+        title: "\u65E0\u9650\u989D\u7B49\u4EF7",
+        detail: "\u672C\u5730\u4E0D\u6267\u884C\u8BA1\u91CF / \u914D\u989D\u95E8\u7981\uFF08\u4E0D\u6309\u51FD\u6570\u8C03\u7528\u3001\u6D41\u91CF\u3001\u63A8\u9001\u8BA1\u6570\uFF09\uFF0C\u9650\u989D\u8BED\u4E49\u4EC5\u7EBF\u4E0A\u751F\u6548\u3002"
+      },
+      {
+        kind: "diff",
+        title: "\u4E0D\u8BA1\u91CF",
+        detail: "\u672C\u6A21\u62DF\u8FD0\u884C\u65F6\u4E0D\u4EA7\u51FA\u8BA1\u91CF\u4E8B\u4EF6\uFF0C\u4E5F\u4E0D\u5199 billing\uFF1B\u79BB\u7EBF\u5F00\u53D1\u4E0D\u8BA1\u8D39\u3002"
+      }
+    ];
+  }
+});
+
+// packages/cli/src/ts-config.ts
+import { stat as stat6, readFile as readFile9 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+async function loadAdepConfigModule(cwd) {
+  const configPath = join11(cwd, "adep.config.ts");
+  try {
+    await stat6(configPath);
+  } catch {
+    return null;
+  }
+  let rawDefault;
+  try {
+    const bun = globalThis.Bun;
     if (bun !== void 0) {
       const mod = await import(configPath);
       rawDefault = mod.default;
     } else {
       const { transform } = await import("esbuild");
-      const source = await readFile7(configPath, "utf8");
+      const source = await readFile9(configPath, "utf8");
       const { code } = await transform(source, {
         loader: "ts",
         format: "esm",
@@ -4424,7 +4932,7 @@ var init_chain = __esm({
 // packages/runtime/src/functions/runtime/worker-entry.ts
 import { parentPort, workerData } from "node:worker_threads";
 import { createRequire } from "node:module";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 function isRpcCapability(value) {
   return typeof value === "object" && value !== null && value[RPC_CAPABILITY_KEY] === true;
 }
@@ -4473,7 +4981,7 @@ function errorMessageWithLocation(error, files) {
 }
 function createBareResolver(deps) {
   const platformRequire = createRequire(import.meta.url);
-  const depsRequire = deps.dir === null ? null : createRequire(join11(deps.dir, "__deps__.js"));
+  const depsRequire = deps.dir === null ? null : createRequire(join12(deps.dir, "__deps__.js"));
   return (request) => {
     if (deps.builtin.includes(request)) return platformRequire(request);
     const root = splitBareSpecifier(request);
@@ -4664,8 +5172,8 @@ var init_shared_source = __esm({
 });
 
 // packages/cli/src/dev-shared.ts
-import { readdir as readdir4, readFile as readFile8 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readdir as readdir4, readFile as readFile10 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 function bearerUserResolverFromEnv() {
   const raw = process.env.ADEP_AUTH_ISSUER;
   if (raw === void 0 || raw.trim() === "") return void 0;
@@ -4706,11 +5214,11 @@ async function collectFunctions(dir) {
     }
     for (const entry of entries) {
       const rel = prefix.length === 0 ? entry.name : `${prefix}/${entry.name}`;
-      const full = join12(sub, entry.name);
+      const full = join13(sub, entry.name);
       if (entry.isDirectory()) {
         await walk(full, rel);
       } else if (entry.isFile() && isRuntimeSource(entry.name)) {
-        files[rel] = await readFile8(full, "utf8");
+        files[rel] = await readFile10(full, "utf8");
       }
     }
   };
@@ -4798,10 +5306,10 @@ __export(dev_exports, {
 });
 import { createServer } from "node:http";
 import { watch } from "node:fs";
-import { mkdir as mkdir7, readFile as readFile9, writeFile as writeFile6 } from "node:fs/promises";
-import { basename as basename2, join as join13, resolve as resolve4 } from "node:path";
+import { mkdir as mkdir8, readFile as readFile11, writeFile as writeFile6 } from "node:fs/promises";
+import { basename as basename2, join as join14, resolve as resolve7 } from "node:path";
 async function loadConfig(cwd) {
-  const name = basename2(resolve4(cwd));
+  const name = basename2(resolve7(cwd));
   const config = await loadAdepConfigModule(cwd);
   return {
     name: config?.name ?? name,
@@ -4843,34 +5351,49 @@ function printBoundaries(log) {
   }
 }
 async function ensureGitignore(cwd) {
-  const gitignorePath = join13(cwd, ".gitignore");
-  const existing = await readFile9(gitignorePath, "utf8").catch(() => "");
+  const gitignorePath = join14(cwd, ".gitignore");
+  const existing = await readFile11(gitignorePath, "utf8").catch(() => "");
   if (existing.split(/\r?\n/).includes(".adep/")) return;
   await writeFile6(gitignorePath, `${existing.replace(/\n+$/, "")}
 .adep/
 `, "utf8");
 }
 async function startDevServer(options) {
-  const cwd = resolve4(options.cwd);
+  const cwd = resolve7(options.cwd);
   const log = options.log ?? ((line) => process.stdout.write(`${line}
 `));
   const config = await loadConfig(cwd);
   if (options.prefix !== void 0) {
     config.functionsPrefix = options.prefix.replace(/^\/+|\/+$/g, "");
   }
-  const functionsDir = join13(cwd, config.functionsDir);
+  const functionsDir = join14(cwd, config.functionsDir);
   const coldStartAt = Date.now();
+  const dbTarget = resolveLocalDbTarget(cwd, {
+    ...options.db === void 0 ? {} : { db: options.db },
+    ...options.dbFile === void 0 ? {} : { dbFile: options.dbFile }
+  });
   const bearerUser = bearerUserResolverFromEnv();
   const executor = new WorkerFunctionExecutor({
     deps: { rootDir: cwd, builtin: LOCAL_BUILTIN_DEPS }
   });
-  await mkdir7(functionsDir, { recursive: true });
+  await mkdir8(functionsDir, { recursive: true });
+  const db = await openLocalDbDriver(dbTarget, { cwd, tag: "adep", log });
   const runtime = await createSimRuntime({
     cwd,
     projectId: "local",
     baseUrl: `http://127.0.0.1:${options.port ?? 8787}`,
-    log
+    log,
+    ...db.driver === null ? {} : { driver: db.driver }
   });
+  if (options.schemaFile !== void 0) {
+    await applyLocalSchema(runtime.db.driver, {
+      cwd,
+      schemaFile: options.schemaFile,
+      mode: db.mode,
+      tag: "adep",
+      log
+    });
+  }
   await ensureGitignore(cwd);
   let files = mergeSharedIntoFunctions(await collectFunctions(functionsDir));
   let env = {
@@ -4951,12 +5474,12 @@ async function startDevServer(options) {
   const reload = async () => {
     const [nextFiles, envText2] = await Promise.all([
       collectFunctions(functionsDir).then(mergeSharedIntoFunctions),
-      readFile9(join13(cwd, ".env.local"), "utf8").catch(() => "")
+      readFile11(join14(cwd, ".env.local"), "utf8").catch(() => "")
     ]);
     files = nextFiles;
     env = { ...config.environment, ...parseEnvFile(envText2) };
   };
-  const envText = await readFile9(join13(cwd, ".env.local"), "utf8").catch(() => "");
+  const envText = await readFile11(join14(cwd, ".env.local"), "utf8").catch(() => "");
   env = { ...config.environment, ...parseEnvFile(envText) };
   let debounceTimer;
   let watcher;
@@ -5113,13 +5636,17 @@ async function startDevServer(options) {
   const baseUrl = `http://127.0.0.1:${actualPort}`;
   const coldStartMs = Date.now() - coldStartAt;
   const curlPath = config.functionsPrefix.length === 0 ? "/hello" : `/${config.functionsPrefix}/hello`;
-  log(`[adep] dev server listening on ${baseUrl}\uFF08\u6A21\u62DF\u8FD0\u884C\u65F6\uFF0C\u51B7\u542F\u52A8 ${coldStartMs}ms\uFF09`);
+  const dbLabel = db.mode === "sqlite" ? `SQLite \u771F\u5B9E\u5E93${db.module === null ? "" : `\uFF08${db.module}\uFF09`}` : "sim \u5F15\u64CE\uFF08\u5185\u7F6E\u6A21\u62DF\uFF09";
+  const dbTargetText = db.file === null ? simDbTarget(cwd) : displayPath(cwd, db.file);
+  log(
+    `[adep] dev server listening on ${baseUrl}\uFF08\u672C\u5730\u8FD0\u884C\u65F6 / ${dbLabel}\uFF0C\u51B7\u542F\u52A8 ${coldStartMs}ms\uFF09`
+  );
   log(`[adep] curl \u793A\u4F8B\uFF1Acurl ${baseUrl}${curlPath}`);
   printBoundaries(log);
   if (bearerUser !== void 0) {
     log(`[adep] \u767B\u5F55\u5373\u670D\u52A1\uFF1AADEP_AUTH_ISSUER \u5DF2\u914D\u7F6E\uFF0CBearer token \u5C06\u89E3\u6790\u4E3A\u7528\u6237\u8EAB\u4EFD\uFF08userinfo \u7AEF\u70B9\uFF09`);
   }
-  log(`[adep] \u6A21\u62DF\u6570\u636E\u76EE\u5F55\uFF1A${simDir(cwd)}`);
+  log(`[adep] \u6570\u636E\u5E93\uFF1A${dbLabel} \u2192 ${dbTargetText}`);
   startStateAlarmScheduler();
   return {
     port: actualPort,
@@ -5142,6 +5669,7 @@ var init_dev = __esm({
     init_http_envelope();
     init_worker_executor();
     init_runtime();
+    init_db_mode();
     init_env();
     init_invoke();
     init_builtin_deps2();
@@ -5154,267 +5682,6 @@ var init_dev = __esm({
   }
 });
 
-// packages/cli/src/client.ts
-var client_exports = {};
-__export(client_exports, {
-  createClient: () => createClient,
-  resolveSlug: () => resolveSlug
-});
-async function envelopeError(response, fallbackCode, parsed) {
-  const payload = parsed ?? null;
-  return new CliError(
-    payload?.error?.code ?? fallbackCode,
-    payload?.error?.message ?? `\u5E73\u53F0\u8FD4\u56DE HTTP ${response.status}`
-  );
-}
-async function parseBody(response) {
-  const text = await response.text();
-  if (text.length === 0) return null;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return null;
-  }
-}
-async function createClient(paths) {
-  const credentials = await loadCredentials(paths);
-  if (credentials === null) {
-    throw new CliError("NOT_LOGGED_IN", "\u672A\u767B\u5F55\uFF1A\u8BF7\u5148\u6267\u884C adep login");
-  }
-  const server = credentials.server;
-  const cookie = sessionCookieHeader(credentials);
-  const request = async (path, init = {}, fallbackCode = "API_REQUEST_FAILED") => {
-    const method = init.method ?? (init.body === void 0 ? "GET" : "POST");
-    let response;
-    try {
-      response = await fetch(`${server}${path}`, {
-        method,
-        headers: { "content-type": "application/json", cookie },
-        ...init.body === void 0 ? {} : { body: JSON.stringify(init.body) }
-      });
-    } catch (error) {
-      throw new CliError(
-        "SERVER_UNREACHABLE",
-        `\u65E0\u6CD5\u8FDE\u63A5\u5E73\u53F0 ${server}\uFF1A${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    const parsed = await parseBody(response);
-    if (response.status < 200 || response.status >= 300) {
-      throw await envelopeError(response, fallbackCode, parsed);
-    }
-    return parsed;
-  };
-  const upload = async (path, form, fallbackCode = "UPLOAD_FAILED") => {
-    let response;
-    try {
-      response = await fetch(`${server}${path}`, {
-        method: "POST",
-        headers: { cookie },
-        body: form
-      });
-    } catch (error) {
-      throw new CliError(
-        "SERVER_UNREACHABLE",
-        `\u65E0\u6CD5\u8FDE\u63A5\u5E73\u53F0 ${server}\uFF1A${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    if (response.status < 200 || response.status >= 300) {
-      throw await envelopeError(response, fallbackCode, await parseBody(response));
-    }
-    return response;
-  };
-  const download = async (url, fallbackCode = "DOWNLOAD_FAILED") => {
-    const target = url.startsWith("http") ? url : `${server}${url}`;
-    let response;
-    try {
-      response = await fetch(target, { headers: { cookie } });
-    } catch (error) {
-      throw new CliError(
-        "SERVER_UNREACHABLE",
-        `\u65E0\u6CD5\u8FDE\u63A5\u5E73\u53F0 ${server}\uFF1A${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    if (response.status < 200 || response.status >= 300) {
-      throw await envelopeError(response, fallbackCode, await parseBody(response));
-    }
-    return response;
-  };
-  return { server, cookie, request, upload, download };
-}
-async function resolveSlug(cwd, slug) {
-  if (slug !== void 0 && slug.length > 0) return slug;
-  const config = await loadConfig(cwd);
-  return config.name;
-}
-var init_client = __esm({
-  "packages/cli/src/client.ts"() {
-    "use strict";
-    init_auth();
-    init_credentials();
-    init_dev();
-  }
-});
-
-// packages/cli/src/db.ts
-var db_exports = {};
-__export(db_exports, {
-  dbExec: () => dbExec,
-  dbMigrate: () => dbMigrate,
-  dbRollback: () => dbRollback,
-  dbSnapshotCreate: () => dbSnapshotCreate,
-  dbSnapshotList: () => dbSnapshotList,
-  dbSnapshotRestore: () => dbSnapshotRestore,
-  dbStart: () => dbStart,
-  dbStatus: () => dbStatus,
-  dbStop: () => dbStop,
-  splitSqlStatements: () => splitSqlStatements
-});
-import { readFile as readFile10 } from "node:fs/promises";
-import { resolve as resolve5 } from "node:path";
-async function open2(paths, options) {
-  const client = await createClient(paths);
-  const project2 = await resolveSlug(resolve5(options.cwd), options.slug);
-  return { client, project: project2 };
-}
-async function dbStart(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(`/api/v1/projects/${project2}/database`, { method: "POST" });
-}
-async function dbStatus(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(`/api/v1/projects/${project2}/database`);
-}
-async function dbStop(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(`/api/v1/projects/${project2}/database`, {
-    method: "DELETE"
-  });
-}
-async function dbExec(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(
-    `/api/v1/projects/${project2}/database/console/sql`,
-    {
-      method: "POST",
-      body: {
-        sql: options.sql,
-        ...options.params === void 0 ? {} : { params: options.params },
-        ...options.confirmTable === void 0 ? {} : { confirmTable: options.confirmTable }
-      }
-    },
-    "SQL_EXEC_FAILED"
-  );
-}
-async function dbSnapshotList(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(
-    `/api/v1/projects/${project2}/database/snapshots`
-  );
-}
-async function dbSnapshotCreate(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(`/api/v1/projects/${project2}/database/snapshots`, {
-    method: "POST"
-  });
-}
-async function dbSnapshotRestore(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(
-    `/api/v1/projects/${project2}/database/snapshots/${options.snapshotId}/restore`,
-    { method: "POST" }
-  );
-}
-async function dbRollback(paths, options) {
-  const { client, project: project2 } = await open2(paths, options);
-  return client.request(
-    `/api/v1/projects/${project2}/database/rollback`,
-    { method: "POST", body: { to: options.to } }
-  );
-}
-function splitSqlStatements(source) {
-  const statements = [];
-  let buffer = "";
-  let inQuote = false;
-  const lines = source.split("\n");
-  for (const rawLine of lines) {
-    const trimmed = rawLine.trim();
-    if (trimmed.length === 0 || trimmed.startsWith("--")) continue;
-    for (let i = 0; i < rawLine.length; i++) {
-      const ch = rawLine[i];
-      if (inQuote) {
-        if (ch === "'") {
-          if (rawLine[i + 1] === "'") {
-            buffer += ch + rawLine[i + 1];
-            i++;
-            continue;
-          }
-          inQuote = false;
-        }
-        buffer += ch;
-        continue;
-      }
-      if (ch === "'") {
-        inQuote = true;
-        buffer += ch;
-        continue;
-      }
-      if (ch === "-" && rawLine[i + 1] === "-") break;
-      if (ch === ";") {
-        const statement = buffer.trim();
-        if (statement.length > 0) statements.push(statement);
-        buffer = "";
-        continue;
-      }
-      buffer += ch;
-    }
-    buffer += " ";
-  }
-  if (inQuote) {
-    throw new Error(`SQL \u8FC1\u79FB\u6587\u4EF6\u5F15\u53F7\u672A\u95ED\u5408\uFF1A${buffer.trim().slice(0, 80)}\u2026`);
-  }
-  const tail = buffer.trim();
-  if (tail.length > 0) statements.push(tail);
-  return statements;
-}
-async function dbMigrate(paths, options) {
-  const source = await readFile10(resolve5(options.file), "utf8");
-  const statements = splitSqlStatements(source);
-  if (statements.length === 0) {
-    throw new Error(`\u8FC1\u79FB\u6587\u4EF6\u6CA1\u6709\u53EF\u6267\u884C\u8BED\u53E5\uFF1A${options.file}`);
-  }
-  const { project: project2 } = await open2(paths, options);
-  const applied = [];
-  const changes = [];
-  for (const statement of statements) {
-    try {
-      const result = await dbExec(paths, {
-        cwd: options.cwd,
-        ...options.slug === void 0 ? {} : { slug: options.slug },
-        sql: statement
-      });
-      applied.push(statement);
-      changes.push(result.changes);
-    } catch (error) {
-      const code = error instanceof CliError ? error.code : "MIGRATE_FAILED";
-      const message = error instanceof Error ? error.message : String(error);
-      return {
-        projectId: project2,
-        applied,
-        changes,
-        failed: { statement, code, message }
-      };
-    }
-  }
-  return { projectId: project2, applied, changes };
-}
-var init_db2 = __esm({
-  "packages/cli/src/db.ts"() {
-    "use strict";
-    init_auth();
-    init_client();
-  }
-});
-
 // packages/cli/src/serve/banner.ts
 function isLoopback(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
@@ -5483,135 +5750,6 @@ var init_banner = __esm({
   }
 });
 
-// packages/cli/src/serve/db-mode.ts
-import { resolve as resolve6 } from "node:path";
-function isServeDbMode(value) {
-  return SERVE_DB_MODES.includes(value.trim().toLowerCase());
-}
-function parseServeDbMode(raw, source) {
-  const value = raw.trim().toLowerCase();
-  if (!isServeDbMode(value)) {
-    throw new Error(
-      `${source} \u7684\u6570\u636E\u5E93\u6A21\u5F0F "${raw}" \u65E0\u6548\uFF1A\u53EA\u652F\u6301 ${SERVE_DB_MODES.join(" | ")}\uFF08sim = \u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\u4E0E .adep/sim/db.json\uFF1Bsqlite = \u771F\u5B9E SQLite \u5E93\u6587\u4EF6\uFF09`
-    );
-  }
-  return value;
-}
-function resolveServeDbMode(explicit) {
-  if (explicit !== void 0) return parseServeDbMode(explicit, "--db");
-  const fromEnv = process.env["ADEP_SERVE_DB"];
-  if (fromEnv !== void 0 && fromEnv.trim() !== "") {
-    return parseServeDbMode(fromEnv, "ADEP_SERVE_DB");
-  }
-  return DEFAULT_SERVE_DB_MODE;
-}
-function resolveServeDbFile(cwd, explicit) {
-  const raw = explicit ?? envDbFile() ?? DEFAULT_SQLITE_DB_FILE;
-  return raw === ":memory:" ? raw : resolve6(cwd, raw);
-}
-function envDbFile() {
-  const raw = process.env["ADEP_SERVE_DB_FILE"];
-  return raw === void 0 || raw.trim() === "" ? void 0 : raw.trim();
-}
-var SERVE_DB_MODES, DEFAULT_SERVE_DB_MODE, DEFAULT_SQLITE_DB_FILE;
-var init_db_mode = __esm({
-  "packages/cli/src/serve/db-mode.ts"() {
-    "use strict";
-    SERVE_DB_MODES = ["sim", "sqlite"];
-    DEFAULT_SERVE_DB_MODE = "sqlite";
-    DEFAULT_SQLITE_DB_FILE = ".adep/data/project.sqlite";
-  }
-});
-
-// packages/cli/src/serve/sqlite-driver.ts
-import { mkdir as mkdir8 } from "node:fs/promises";
-import { dirname as dirname8, resolve as resolve7 } from "node:path";
-function isBun(versions) {
-  return versions["bun"] !== void 0 && versions["bun"] !== "";
-}
-function detectSqliteRuntime(versions = process.versions) {
-  if (isBun(versions)) return "bun";
-  const raw = versions["node"];
-  if (raw === void 0) return null;
-  const [majorText, minorText] = raw.split(".");
-  const major = Number(majorText);
-  const minor = Number(minorText ?? "0");
-  if (!Number.isInteger(major) || !Number.isInteger(minor)) return null;
-  if (major > NODE_SQLITE_MIN.major) return "node";
-  if (major === NODE_SQLITE_MIN.major && minor >= NODE_SQLITE_MIN.minor) return "node";
-  return null;
-}
-function sqliteModuleName(runtime) {
-  return runtime === "bun" ? "bun:sqlite" : "node:sqlite";
-}
-function sqliteUnavailableReason(versions = process.versions) {
-  const current = isBun(versions) ? `Bun ${versions["bun"] ?? ""}`.trim() : `Node ${versions["node"] ?? "\u672A\u77E5"}`;
-  return `\u5F53\u524D\u8FD0\u884C\u65F6 ${current} \u4E0D\u63D0\u4F9B SQLite \u5185\u5EFA\u6A21\u5757\uFF08\u9700\u8981 Bun \u6216 Node \u2265 ${NODE_SQLITE_MIN.major}.${NODE_SQLITE_MIN.minor}\uFF09`;
-}
-function sqliteRuntimeRequirementMessage(versions = process.versions) {
-  return `--db sqlite \u9700\u8981 Bun\uFF08\u5185\u7F6E bun:sqlite\uFF09\u6216 Node \u2265 ${NODE_SQLITE_MIN.major}.${NODE_SQLITE_MIN.minor}\uFF08\u5185\u7F6E node:sqlite\uFF09\uFF1B${sqliteUnavailableReason(versions)}\u3002\u8BF7\u6539\u7528 \`--db sim\`\uFF08\u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\uFF0C\u65E0\u9700\u989D\u5916\u8FD0\u884C\u65F6\uFF09\uFF0C\u6216\u5347\u7EA7 Node / \u7528 Bun \u8FD0\u884C\u3002`;
-}
-async function openSqliteProjectDriver(file, options = {}) {
-  const runtime = options.runtime ?? detectSqliteRuntime();
-  if (runtime === null) throw new Error(sqliteRuntimeRequirementMessage());
-  const moduleName = sqliteModuleName(runtime);
-  const ctorName = runtime === "bun" ? "Database" : "DatabaseSync";
-  let mod;
-  try {
-    const specifier = moduleName;
-    mod = await import(
-      /* @vite-ignore */
-      specifier
-    );
-  } catch (error) {
-    throw new Error(
-      `${sqliteRuntimeRequirementMessage()}
-\uFF08\u8F7D\u5165 ${moduleName} \u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}\uFF09`,
-      { cause: error }
-    );
-  }
-  const Ctor = mod[ctorName];
-  if (Ctor === void 0) {
-    throw new Error(`${moduleName} \u672A\u5BFC\u51FA ${ctorName}\uFF1A\u5F53\u524D\u8FD0\u884C\u65F6\u7684 SQLite \u5185\u5EFA\u6A21\u5757\u4E0D\u53EF\u7528`);
-  }
-  const target = file === ":memory:" ? file : resolve7(file);
-  if (target !== ":memory:") await mkdir8(dirname8(target), { recursive: true });
-  const database = new Ctor(target);
-  database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;");
-  return {
-    engine: "sqlite",
-    async run(sql, params = []) {
-      if (params.length === 0) {
-        database.exec(sql);
-        return { changes: 0 };
-      }
-      const result = database.prepare(sql).run(...params);
-      return { changes: Number(result.changes) };
-    },
-    async all(sql, params = []) {
-      const statement = database.prepare(sql);
-      statement.setReturnArrays?.(false);
-      return statement.all(...params);
-    },
-    async get(sql, params = []) {
-      const statement = database.prepare(sql);
-      statement.setReturnArrays?.(false);
-      const row = statement.get(...params);
-      return row ?? null;
-    },
-    async close() {
-      database.close();
-    }
-  };
-}
-var NODE_SQLITE_MIN;
-var init_sqlite_driver = __esm({
-  "packages/cli/src/serve/sqlite-driver.ts"() {
-    "use strict";
-    NODE_SQLITE_MIN = { major: 22, minor: 5 };
-  }
-});
-
 // packages/cli/src/serve/server.ts
 var server_exports = {};
 __export(server_exports, {
@@ -5621,8 +5759,8 @@ __export(server_exports, {
 });
 import { createServer as createServer2 } from "node:http";
 import { watch as watch2 } from "node:fs";
-import { mkdir as mkdir9, readFile as readFile11, stat as stat7 } from "node:fs/promises";
-import { extname, join as join14, relative as relative2, resolve as resolve8 } from "node:path";
+import { mkdir as mkdir9, readFile as readFile12, stat as stat7 } from "node:fs/promises";
+import { extname, join as join15, relative as relative3, resolve as resolve8 } from "node:path";
 function envNumber(name) {
   const raw = process.env[name];
   if (raw === void 0 || raw.trim() === "") return void 0;
@@ -5640,11 +5778,6 @@ function contentTypeFor(path) {
   const ext = path.slice(path.lastIndexOf(".")).toLowerCase();
   return MIME_TYPES[ext] ?? "application/octet-stream";
 }
-function displayPath(cwd, target) {
-  if (target === ":memory:") return target;
-  const rel = relative2(cwd, target);
-  return rel.startsWith("..") ? target : rel;
-}
 async function startServeServer(options) {
   const cwd = resolve8(options.cwd);
   const log = options.log ?? ((line) => process.stdout.write(`${line}
@@ -5655,10 +5788,12 @@ async function startServeServer(options) {
     cwd,
     options.staticDir ?? envString("ADEP_SERVE_STATIC_DIR") ?? "public"
   );
-  let dbMode = resolveServeDbMode(options.db);
-  let sqliteFile = dbMode === "sqlite" ? resolveServeDbFile(cwd, options.dbFile) : null;
+  const dbTarget = resolveLocalDbTarget(cwd, {
+    ...options.db === void 0 ? {} : { db: options.db },
+    ...options.dbFile === void 0 ? {} : { dbFile: options.dbFile }
+  });
   const config = await loadConfig(cwd);
-  const functionsDir = join14(cwd, config.functionsDir);
+  const functionsDir = join15(cwd, config.functionsDir);
   const bearerUser = bearerUserResolverFromEnv();
   let hasStatic = false;
   try {
@@ -5670,76 +5805,28 @@ async function startServeServer(options) {
   const loadFunctionFiles = async () => mergeSharedIntoFunctions(await collectFunctions(functionsDir));
   let files = await loadFunctionFiles();
   let functionNames = listFunctionNames(files);
-  const envText = await readFile11(join14(cwd, ".env.local"), "utf8").catch(() => "");
+  const envText = await readFile12(join15(cwd, ".env.local"), "utf8").catch(() => "");
   let env = parseEnvFile(envText);
   let simEnv = await loadSimEnv(cwd).catch(() => ({}));
-  let sqliteModule = null;
-  let sqliteDriver = null;
-  if (sqliteFile !== null) {
-    const runtimeName = detectSqliteRuntime();
-    if (runtimeName === null) {
-      log(
-        `[serve] \u8B66\u544A\uFF1A${sqliteUnavailableReason()}\uFF0C\u5DF2\u81EA\u52A8\u964D\u7EA7\u4E3A sim \u6A21\u5F0F\uFF08\u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\uFF0C\u5E93 ${displayPath(cwd, join14(simDir(cwd), "db.json"))}\uFF09\u3002\u5982\u9700\u771F\u5B9E SQLite\uFF0C\u8BF7\u7528 Bun \u6216\u5347\u7EA7 Node \u540E\u91CD\u8BD5\u3002`
-      );
-      dbMode = "sim";
-      sqliteFile = null;
-    } else {
-      sqliteModule = sqliteModuleName(runtimeName);
-      try {
-        sqliteDriver = await openSqliteProjectDriver(sqliteFile, { runtime: runtimeName });
-      } catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        log(
-          `[serve] \u8B66\u544A\uFF1A\u6253\u5F00 SQLite \u5E93\u5931\u8D25\uFF08${detail}\uFF09\uFF0C\u5DF2\u81EA\u52A8\u964D\u7EA7\u4E3A sim \u6A21\u5F0F\uFF08\u5185\u7F6E\u6A21\u62DF\u5F15\u64CE\uFF0C\u5E93 ${displayPath(cwd, join14(simDir(cwd), "db.json"))}\uFF09\u3002`
-        );
-        sqliteModule = null;
-        sqliteDriver = null;
-        sqliteFile = null;
-        dbMode = "sim";
-      }
-    }
-  }
+  const db = await openLocalDbDriver(dbTarget, { cwd, tag: "serve", log });
+  const dbMode = db.mode;
+  const sqliteFile = db.file;
+  const sqliteModule = db.module;
   const runtime = await createSimRuntime({
     cwd,
     projectId: "local",
     baseUrl: `http://${host}:${port}`,
     log,
-    ...sqliteDriver === null ? {} : { driver: sqliteDriver }
+    ...db.driver === null ? {} : { driver: db.driver }
   });
   if (options.schemaFile !== void 0) {
-    const schemaPath = resolve8(cwd, options.schemaFile);
-    const schemaSource = await readFile11(schemaPath, "utf8").catch(
-      (error) => {
-        if (error.code === "ENOENT") {
-          throw new Error(`schema \u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${schemaPath}`);
-        }
-        throw error;
-      }
-    );
-    const statements = splitSqlStatements(schemaSource);
-    let applied = 0;
-    let skipped = 0;
-    for (const [index, statement] of statements.entries()) {
-      try {
-        await runtime.db.driver.run(statement);
-        applied += 1;
-      } catch (error) {
-        const isUnsupported = error instanceof Error && "code" in error && error.code === "DB_UNSAFE_OP";
-        if (dbMode === "sim" && isUnsupported) {
-          skipped += 1;
-          log(`[serve] \u8DF3\u8FC7 schema \u8BED\u53E5\uFF08sim \u5F15\u64CE\u4E0D\u652F\u6301\uFF09\uFF1A${statement.slice(0, 60)}\u2026`);
-          continue;
-        }
-        const detail = error instanceof Error ? error.message : String(error);
-        throw new Error(
-          `schema \u8BED\u53E5\u6267\u884C\u5931\u8D25\uFF08--schema ${options.schemaFile}\uFF0C\u7B2C ${index + 1} \u6761\uFF0Cdb \u6A21\u5F0F ${dbMode}\uFF09\uFF1A${detail}
-\u8BED\u53E5\uFF1A${statement.slice(0, 200)}` + (dbMode === "sqlite" ? "\n\uFF08sqlite \u6A21\u5F0F\u4E0D\u505A\u8BED\u53E5\u8DF3\u8FC7\uFF1B\u5982\u9700\u8DF3\u8FC7\u8BED\u4E49\u8BF7\u6539\u7528 --db sim\uFF09" : ""),
-          { cause: error }
-        );
-      }
-    }
-    const skipNote = skipped > 0 ? `\uFF0C\u8DF3\u8FC7 ${skipped} \u6761` : "";
-    log(`[serve] \u5DF2\u5E94\u7528\u6570\u636E\u5E93\u7ED3\u6784\uFF08--schema ${options.schemaFile}\uFF09\uFF1A${applied} \u6761\u8BED\u53E5${skipNote}`);
+    await applyLocalSchema(runtime.db.driver, {
+      cwd,
+      schemaFile: options.schemaFile,
+      mode: dbMode,
+      tag: "serve",
+      log
+    });
   }
   const executor = new WorkerFunctionExecutor({
     deps: { rootDir: cwd, builtin: LOCAL_BUILTIN_DEPS }
@@ -5751,7 +5838,7 @@ async function startServeServer(options) {
     const reload = async () => {
       const [nextFiles, envLocalText] = await Promise.all([
         loadFunctionFiles(),
-        readFile11(join14(cwd, ".env.local"), "utf8").catch(() => "")
+        readFile12(join15(cwd, ".env.local"), "utf8").catch(() => "")
       ]);
       files = nextFiles;
       env = parseEnvFile(envLocalText);
@@ -5806,16 +5893,16 @@ async function startServeServer(options) {
   const serveStatic = async (pathname, res) => {
     if (!hasStatic) return false;
     const safePath = pathname.replace(/\.\.\//g, "").replace(/^\//, "");
-    const filePath = join14(staticDir, safePath);
-    const resolvedPath = safePath === "" || safePath === "/" ? join14(filePath, "index.html") : filePath;
+    const filePath = join15(staticDir, safePath);
+    const resolvedPath = safePath === "" || safePath === "/" ? join15(filePath, "index.html") : filePath;
     try {
       const fileStat = await stat7(resolvedPath);
       if (fileStat.isDirectory()) {
-        const indexPath = join14(resolvedPath, "index.html");
+        const indexPath = join15(resolvedPath, "index.html");
         try {
           const indexStat = await stat7(indexPath);
           if (indexStat.isFile()) {
-            const content2 = await readFile11(indexPath);
+            const content2 = await readFile12(indexPath);
             res.writeHead(200, { "content-type": contentTypeFor(indexPath) });
             res.end(content2);
             return true;
@@ -5824,7 +5911,7 @@ async function startServeServer(options) {
         }
         return false;
       }
-      const content = await readFile11(resolvedPath);
+      const content = await readFile12(resolvedPath);
       res.writeHead(200, { "content-type": contentTypeFor(resolvedPath) });
       res.end(content);
       return true;
@@ -5833,7 +5920,7 @@ async function startServeServer(options) {
         const ext = extname(pathname);
         if (ext === "" || ext === ".html") {
           try {
-            const indexContent = await readFile11(join14(staticDir, "index.html"));
+            const indexContent = await readFile12(join15(staticDir, "index.html"));
             res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
             res.end(indexContent);
             return true;
@@ -5844,9 +5931,66 @@ async function startServeServer(options) {
       return false;
     }
   };
+  const serveSignedFile = async (req, res, url, projectId, path) => {
+    const driver = runtime.storage.driver;
+    try {
+      const meta = await driver.getMeta(projectId, path);
+      if (meta.visibility === "private") {
+        const verification = verifyDownloadSignature(
+          { secret: SIM_SIGN_SECRET, baseUrl: "" },
+          projectId,
+          path,
+          {
+            expires: url.searchParams.get(SIGN_EXPIRES_KEY) ?? void 0,
+            signature: url.searchParams.get(SIGN_SIGNATURE_KEY) ?? void 0
+          }
+        );
+        if (!verification.ok) {
+          const message = verification.reason === "expired" ? "\u7B7E\u540D URL \u5DF2\u8FC7\u671F\uFF1A\u8BF7\u91CD\u65B0\u751F\u6210\uFF0815 \u5206\u949F\u6709\u6548\uFF09" : verification.reason === "missing" ? "\u79C1\u6709\u6587\u4EF6\u9700\u8981\u7B7E\u540D URL \u624D\u80FD\u8BBF\u95EE" : "\u7B7E\u540D\u65E0\u6548\uFF1AURL \u53EF\u80FD\u88AB\u7BE1\u6539";
+          writeJson(res, 403, { error: { code: "STORAGE_SIGNATURE_INVALID", message } });
+          log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> 403 (${verification.reason})`);
+          return true;
+        }
+      }
+      const { data } = await driver.get(projectId, path);
+      res.writeHead(200, {
+        "content-type": meta.contentType ?? "application/octet-stream",
+        "content-length": String(meta.size),
+        "cache-control": meta.visibility === "public" ? "public, max-age=3600" : "private, no-store"
+      });
+      res.end(data);
+      log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> 200\uFF08\u6587\u4EF6\u4E0B\u8F7D ${meta.size}B\uFF09`);
+    } catch (error) {
+      if (error instanceof StorageError) {
+        writeJson(res, error.status, { error: { code: error.code, message: error.message } });
+        log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> ${error.status} (${error.code})`);
+        return true;
+      }
+      writeJson(res, 500, {
+        error: {
+          code: "FILE_DOWNLOAD_ERROR",
+          message: error instanceof Error ? error.message : "\u6587\u4EF6\u4E0B\u8F7D\u5931\u8D25"
+        }
+      });
+      log(`[serve] ${req.method ?? "GET"} ${url.pathname} -> 500\uFF08\u6587\u4EF6\u4E0B\u8F7D\u5F02\u5E38\uFF09`);
+    }
+    return true;
+  };
+  const SIGNED_FILES_ROUTE = /^\/api\/v1\/projects\/([^/]+)\/files\/([^/]+)$/;
   const handle = async (req, res) => {
     const url = new URL(req.url ?? "/", `http://${host}:${port}`);
     const pathname = url.pathname;
+    const filesMatch = SIGNED_FILES_ROUTE.exec(pathname);
+    if (filesMatch !== null && (req.method === "GET" || req.method === "HEAD")) {
+      await serveSignedFile(
+        req,
+        res,
+        url,
+        decodeURIComponent(filesMatch[1]),
+        decodeURIComponent(filesMatch[2])
+      );
+      return;
+    }
     const normalizedPrefix = config.functionsPrefix.replace(/^\/+|\/+$/g, "");
     const fnRest = normalizedPrefix.length > 0 ? pathname === `/${normalizedPrefix}` || pathname.startsWith(`/${normalizedPrefix}/`) ? pathname.slice(normalizedPrefix.length + 1) : null : pathname === "/api" ? "" : pathname.startsWith("/api/") ? pathname.slice("/api/".length) : null;
     if (fnRest !== null) {
@@ -5921,7 +6065,7 @@ async function startServeServer(options) {
         functions: functionNames,
         static: hasStatic,
         // CLI-020：当前数据面（换模式即换库，这里让脚本/e2e 有可断言的读数）。
-        db: sqliteFile === null ? { mode: "sim", file: displayPath(cwd, join14(simDir(cwd), "db.json")) } : { mode: "sqlite", file: displayPath(cwd, sqliteFile), driver: sqliteModule },
+        db: sqliteFile === null ? { mode: "sim", file: simDbTarget(cwd) } : { mode: "sqlite", file: displayPath(cwd, sqliteFile), driver: sqliteModule },
         endpoints: {
           functions: "/api/{fn}",
           static: `/ \u2192 ${staticDir}`,
@@ -5960,9 +6104,9 @@ async function startServeServer(options) {
     functions: functionNames,
     functionsPrefix: config.functionsPrefix,
     hasStatic,
-    staticDir: relative2(cwd, staticDir).length > 0 ? relative2(cwd, staticDir) : staticDir,
+    staticDir: relative3(cwd, staticDir).length > 0 ? relative3(cwd, staticDir) : staticDir,
     dbMode,
-    dbTarget: sqliteFile === null ? displayPath(cwd, join14(simDir(cwd), "db.json")) : displayPath(cwd, sqliteFile),
+    dbTarget: sqliteFile === null ? simDbTarget(cwd) : displayPath(cwd, sqliteFile),
     ...sqliteModule === null ? {} : { dbDriver: sqliteModule }
   });
   log(banner);
@@ -5994,15 +6138,16 @@ var init_server = __esm({
     init_executor();
     init_http_envelope();
     init_worker_executor();
+    init_signature();
+    init_driver();
     init_builtin_deps2();
-    init_db2();
     init_runtime();
+    init_storage();
     init_env();
     init_invoke();
     init_dev();
     init_banner();
     init_db_mode();
-    init_sqlite_driver();
     init_dev_shared();
     MIME_TYPES = {
       ".html": "text/html; charset=utf-8",
@@ -6037,8 +6182,8 @@ __export(deploy_exports, {
   deploy: () => deploy
 });
 import { createHash as createHash2 } from "node:crypto";
-import { readdir as readdir5, readFile as readFile12 } from "node:fs/promises";
-import { join as join15, resolve as resolve9, basename as basename3, relative as relative3, sep } from "node:path";
+import { readdir as readdir5, readFile as readFile13 } from "node:fs/promises";
+import { join as join16, resolve as resolve9, basename as basename3, relative as relative4, sep } from "node:path";
 function functionUrlBase(prefix) {
   const raw = (prefix ?? "/api").trim();
   const normalized = raw === "/" ? "/" : raw.replace(/\/+$/, "");
@@ -6064,10 +6209,10 @@ async function collectFunctionFiles(functionsDir) {
   if (conflicting.length > 0) throw new AmbiguousFunctionError(functionsDir, conflicting);
   const out = {};
   for (const name of flatNames) {
-    out[name] = { [`${name}.ts`]: await readFile12(join15(functionsDir, `${name}.ts`), "utf8") };
+    out[name] = { [`${name}.ts`]: await readFile13(join16(functionsDir, `${name}.ts`), "utf8") };
   }
   for (const name of dirNames) {
-    const files = await collectFunctionDir(join15(functionsDir, name));
+    const files = await collectFunctionDir(join16(functionsDir, name));
     if (files["index.ts"] === void 0) continue;
     out[name] = files;
   }
@@ -6086,11 +6231,11 @@ async function collectFunctionDir(absDir) {
       const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
       if (entry.isDirectory()) {
         if (entry.name === "__tests__" || IGNORED_DIRS.has(entry.name)) continue;
-        await walk(join15(dir, entry.name), rel);
+        await walk(join16(dir, entry.name), rel);
         continue;
       }
       if (!isRuntimeSource2(entry.name)) continue;
-      files[rel] = await readFile12(join15(dir, entry.name), "utf8");
+      files[rel] = await readFile13(join16(dir, entry.name), "utf8");
     }
   };
   await walk(absDir, "");
@@ -6100,7 +6245,7 @@ function sha256Hex(content) {
   return createHash2("sha256").update(content).digest("hex");
 }
 async function collectShared(functionsDir) {
-  const sharedDir = join15(functionsDir, "_shared");
+  const sharedDir = join16(functionsDir, "_shared");
   const files = {};
   const walk = async (dir) => {
     let entries;
@@ -6112,13 +6257,13 @@ async function collectShared(functionsDir) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (entry.name === "__tests__" || entry.name === "node_modules") continue;
-        await walk(join15(dir, entry.name));
+        await walk(join16(dir, entry.name));
         continue;
       }
       if (!isRuntimeSource2(entry.name)) continue;
-      const full = join15(dir, entry.name);
-      const rel = relative3(sharedDir, full).split(sep).join("/");
-      files[`${SHARED_SOURCE_ROOT3}${rel}`] = await readFile12(full, "utf8");
+      const full = join16(dir, entry.name);
+      const rel = relative4(sharedDir, full).split(sep).join("/");
+      files[`${SHARED_SOURCE_ROOT3}${rel}`] = await readFile13(full, "utf8");
     }
   };
   await walk(sharedDir);
@@ -6132,7 +6277,7 @@ async function deploy(paths, options) {
   const cwd = resolve9(options.cwd);
   const config = await loadConfig(cwd);
   const slug = options.slug ?? config.name;
-  const functionsDir = options.functionsDir === void 0 ? join15(cwd, config.functionsDir) : resolve9(cwd, options.functionsDir);
+  const functionsDir = options.functionsDir === void 0 ? join16(cwd, config.functionsDir) : resolve9(cwd, options.functionsDir);
   const local = await collectFunctionFiles(functionsDir);
   if (Object.keys(local).length === 0) {
     throw new CliError("NO_FUNCTIONS", `${functionsDir} \u4E0B\u6CA1\u6709\u51FD\u6570\u6587\u4EF6`);
@@ -6204,7 +6349,12 @@ async function deploy(paths, options) {
     }
     const published = await client.request(
       `/api/v1/functions/${functionId}/publish`,
-      { method: "POST" }
+      {
+        method: "POST",
+        // FN-013：显式 body 而非省略——`force: false` 与 `undefined` 在服务端语义相同，
+        // 但显式传值让「这次发布是否放行过警告」在请求层面可审计。
+        body: { force: options.force === true }
+      }
     );
     deployed.push({
       name: item.name,
@@ -6263,8 +6413,8 @@ var frontend_exports = {};
 __export(frontend_exports, {
   frontendSync: () => frontendSync
 });
-import { readdir as readdir6, readFile as readFile13, stat as stat8 } from "node:fs/promises";
-import { join as join16, relative as relative4, sep as sep2 } from "node:path";
+import { readdir as readdir6, readFile as readFile14, stat as stat8 } from "node:fs/promises";
+import { join as join17, relative as relative5, sep as sep2 } from "node:path";
 async function resolveProjectId(client, cwd, slug) {
   const resolvedSlug = await resolveSlug(cwd, slug);
   const listed = await client.request("/api/v1/projects", {}, "PROJECT_LIST_FAILED");
@@ -6284,20 +6434,21 @@ async function collectFiles(root, dir) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS2.has(entry.name)) continue;
-      const nested = await collectFiles(root, join16(dir, entry.name));
+      const nested = await collectFiles(root, join17(dir, entry.name));
       for (const [path, content] of nested.files) files.set(path, content);
       skipped.push(...nested.skipped);
       continue;
     }
-    const full = join16(dir, entry.name);
-    const rel = relative4(root, full).split(sep2).join("/");
+    if (IGNORED_FILES.has(entry.name)) continue;
+    const full = join17(dir, entry.name);
+    const rel = relative5(root, full).split(sep2).join("/");
     const info = await stat8(full);
     if (info.size > 1024 * 1024) {
       skipped.push(rel);
       continue;
     }
     try {
-      const content = await readFile13(full, "utf8");
+      const content = await readFile14(full, "utf8");
       if (content.includes("\0")) {
         skipped.push(rel);
         continue;
@@ -6312,7 +6463,7 @@ async function collectFiles(root, dir) {
 async function frontendSync(paths, options) {
   const log = options.silent === true ? () => void 0 : options.log ?? ((line) => process.stdout.write(`${line}
 `));
-  const webDir = options.dir ?? join16(options.cwd, "web");
+  const webDir = options.dir ?? join17(options.cwd, "web");
   const rootStat = await stat8(webDir).catch(() => null);
   if (rootStat === null || !rootStat.isDirectory()) {
     throw new CliError(
@@ -6359,7 +6510,7 @@ async function frontendSync(paths, options) {
   }
   return { projectId: project2.id, uploaded: files.size, skipped, totalBytes };
 }
-var MAX_FILES, MAX_TOTAL_SOURCE_BYTES2, FILE_PATH_PATTERN, IGNORED_DIRS2;
+var MAX_FILES, MAX_TOTAL_SOURCE_BYTES2, FILE_PATH_PATTERN, IGNORED_DIRS2, IGNORED_FILES;
 var init_frontend = __esm({
   "packages/cli/src/frontend.ts"() {
     "use strict";
@@ -6370,6 +6521,14 @@ var init_frontend = __esm({
     MAX_TOTAL_SOURCE_BYTES2 = FRONTEND_DRAFT_MAX_TOTAL_SOURCE_BYTES;
     FILE_PATH_PATTERN = FRONTEND_DRAFT_FILE_PATH_PATTERN;
     IGNORED_DIRS2 = /* @__PURE__ */ new Set(["node_modules", "dist", ".git", ".adep", ".vite", "coverage"]);
+    IGNORED_FILES = /* @__PURE__ */ new Set([
+      "package-lock.json",
+      "npm-shrinkwrap.json",
+      "yarn.lock",
+      "pnpm-lock.yaml",
+      "bun.lockb",
+      "bun.lock"
+    ]);
   }
 });
 
@@ -6526,11 +6685,11 @@ var fs_exports = {};
 __export(fs_exports, {
   createExportFileSystem: () => createExportFileSystem
 });
-import { mkdir as mkdir10, readFile as readFile14, rm as rm3, stat as stat10, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname9, join as join18 } from "node:path";
+import { mkdir as mkdir10, readFile as readFile15, rm as rm3, stat as stat10, writeFile as writeFile8 } from "node:fs/promises";
+import { dirname as dirname9, join as join19 } from "node:path";
 function createExportFileSystem() {
   return {
-    readFile: (path) => readFile14(path),
+    readFile: (path) => readFile15(path),
     writeFile: (path, content) => writeFile8(path, content),
     // 同时用于清理解压临时目录（${zip}.tmp 是个目录）——递归强制删除，缺失不报错。
     deleteFile: async (path) => {
@@ -6548,9 +6707,9 @@ function createExportFileSystem() {
       await mkdir10(path, { recursive: true });
     },
     unzip: async (zipPath, targetDir) => {
-      const entries = zipRead(await readFile14(zipPath));
+      const entries = zipRead(await readFile15(zipPath));
       for (const [name, data] of entries) {
-        const dest = join18(targetDir, name);
+        const dest = join19(targetDir, name);
         await mkdir10(dirname9(dest), { recursive: true });
         await writeFile8(dest, data);
       }
@@ -7068,8 +7227,8 @@ __export(storage_exports, {
   storageRemove: () => storageRemove,
   storageUpload: () => storageUpload
 });
-import { mkdir as mkdir11, readFile as readFile15, stat as stat11, writeFile as writeFile9 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname10, extname as extname2, join as join19, resolve as resolve11 } from "node:path";
+import { mkdir as mkdir11, readFile as readFile16, stat as stat11, writeFile as writeFile9 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname10, extname as extname2, join as join20, resolve as resolve11 } from "node:path";
 async function open3(paths, options) {
   const client = await createClient(paths);
   const project2 = await resolveSlug(resolve11(options.cwd), options.slug);
@@ -7111,7 +7270,7 @@ async function storageUpload(paths, options) {
     throw new CliError("FILE_NOT_FOUND", `\u672C\u5730\u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${local}`);
   }
   const visibility = options.visibility ?? "private";
-  const bytes = await readFile15(local);
+  const bytes = await readFile16(local);
   const form = new FormData();
   form.set("path", options.path);
   form.set("visibility", visibility);
@@ -7152,7 +7311,7 @@ async function storageDownload(paths, options) {
   const url = await resolveDownloadUrl(client, project2, options.path);
   const response = await client.download(url, "STORAGE_DOWNLOAD_FAILED");
   const bytes = Buffer.from(await response.arrayBuffer());
-  const output = resolve11(options.output ?? join19(resolve11(options.cwd), basename4(options.path)));
+  const output = resolve11(options.output ?? join20(resolve11(options.cwd), basename4(options.path)));
   await mkdir11(dirname10(output), { recursive: true });
   await writeFile9(output, bytes);
   return { path: options.path, output, size: bytes.length };
@@ -7172,6 +7331,189 @@ var init_storage2 = __esm({
   }
 });
 
+// packages/cli/src/sandbox-scan.ts
+import { readdir as readdir7, readFile as readFile17 } from "node:fs/promises";
+import { join as join21, relative as relative6, sep as sep3 } from "node:path";
+function extractSpecifiers(line) {
+  const out = [];
+  const patterns = [
+    /\bfrom\s+['"]([^'"]+)['"]/g,
+    // import x from '<spec>' / export … from '<spec>'
+    /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+    /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+    /^\s*import\s+['"]([^'"]+)['"]/g
+    // 副作用导入 import '<spec>'
+  ];
+  for (const pattern of patterns) {
+    for (const match of line.matchAll(pattern)) {
+      const spec = match[1];
+      if (spec !== void 0) out.push(spec);
+    }
+  }
+  return out;
+}
+function classify(specifier) {
+  if (specifier.startsWith("node:")) {
+    const bare = specifier.slice("node:".length);
+    const root = bare.split("/")[0];
+    const suggestion = BUILTIN_SUGGESTIONS[specifier] ?? BUILTIN_SUGGESTIONS[`node:${root}`];
+    return {
+      code: "NODE_BUILTIN",
+      message: `\u6C99\u7BB1\u6CA1\u6709 node \u5185\u7F6E\u6A21\u5757\uFF0C'${specifier}' \u5728\u53D1\u5E03\u540E\u8FD0\u884C\u65F6\u4F1A\u629B ERR_MODULE_NOT_FOUND\uFF08\u672C\u5730 adep dev \u80FD\u8DD1\uFF0C\u56E0\u4E3A\u5BBF\u4E3B\u5C31\u662F Node\uFF09\u3002${suggestion ?? `\u8BF7\u79FB\u9664\u5BF9 ${root} \u7684\u4F9D\u8D56\u3002`}`
+    };
+  }
+  if (NODE_BUILTINS.has(specifier)) {
+    return {
+      code: "NODE_BUILTIN",
+      message: `\u6C99\u7BB1\u6CA1\u6709 node \u5185\u7F6E\u6A21\u5757\uFF0C'${specifier}' \u5728\u53D1\u5E03\u540E\u8FD0\u884C\u65F6\u4F1A\u629B ERR_MODULE_NOT_FOUND\u3002${BUILTIN_SUGGESTIONS[specifier] ?? `\u8BF7\u79FB\u9664\u5BF9 ${specifier} \u7684\u4F9D\u8D56\u3002`}`
+    };
+  }
+  if (NATIVE_ADDON_PACKAGES.has(specifier)) {
+    return {
+      code: "NATIVE_ADDON",
+      message: `'${specifier}' \u9700\u8981\u539F\u751F C++ \u6269\u5C55\uFF0C\u4E91\u51FD\u6570\u6C99\u7BB1\u65E0\u6CD5\u52A0\u8F7D\uFF08\u4E5F\u4E0D\u662F registry \u767D\u540D\u5355\u80FD\u89E3\u51B3\u7684\u95EE\u9898\uFF09\u3002\u8BF7\u6362\u7EAF JS \u5B9E\u73B0\uFF08\u5982 bcrypt\u2192@adep/crypto \u7684 hashPassword\u3001sharp\u2192\u6784\u5EFA\u671F\u9884\u5904\u7406\u56FE\u7247\uFF09\u3002`
+    };
+  }
+  return null;
+}
+async function scanFunctionSources(rootDir, functionsDir) {
+  const base = join21(rootDir, functionsDir);
+  const findings = [];
+  async function walk(current) {
+    let entries;
+    try {
+      entries = await readdir7(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = join21(current, entry.name);
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        await walk(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (!SOURCE_EXTENSIONS.some((ext) => entry.name.endsWith(ext))) continue;
+      if (entry.name.endsWith(".d.ts")) continue;
+      let content;
+      try {
+        content = await readFile17(abs, "utf8");
+      } catch {
+        continue;
+      }
+      if (content.length > MAX_SCAN_BYTES) continue;
+      const relPath = relative6(rootDir, abs).split(sep3).join("/");
+      const lines = content.split("\n");
+      for (const [index, line] of lines.entries()) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*")) continue;
+        for (const specifier of extractSpecifiers(line)) {
+          const hit = classify(specifier);
+          if (hit !== null) {
+            findings.push({
+              file: relPath,
+              line: index + 1,
+              code: hit.code,
+              specifier,
+              message: hit.message
+            });
+          }
+        }
+      }
+    }
+  }
+  await walk(base);
+  return findings;
+}
+var NODE_BUILTINS, NATIVE_ADDON_PACKAGES, BUILTIN_SUGGESTIONS, SOURCE_EXTENSIONS, SKIP_DIRS, MAX_SCAN_BYTES;
+var init_sandbox_scan = __esm({
+  "packages/cli/src/sandbox-scan.ts"() {
+    "use strict";
+    NODE_BUILTINS = /* @__PURE__ */ new Set([
+      "assert",
+      "async_hooks",
+      "buffer",
+      "child_process",
+      "cluster",
+      "console",
+      "constants",
+      "crypto",
+      "dgram",
+      "diagnostics_channel",
+      "dns",
+      "domain",
+      "events",
+      "fs",
+      "http",
+      "http2",
+      "https",
+      "inspector",
+      "module",
+      "net",
+      "os",
+      "path",
+      "perf_hooks",
+      "process",
+      "punycode",
+      "querystring",
+      "readline",
+      "repl",
+      "stream",
+      "string_decoder",
+      "sys",
+      "timers",
+      "tls",
+      "trace_events",
+      "tty",
+      "url",
+      "util",
+      "v8",
+      "vm",
+      "wasi",
+      "worker_threads",
+      "zlib"
+    ]);
+    NATIVE_ADDON_PACKAGES = /* @__PURE__ */ new Set([
+      "bcrypt",
+      "better-sqlite3",
+      "sqlite3",
+      "sharp",
+      "canvas",
+      "argon2",
+      "node-gyp",
+      "farmhash",
+      "xxhash-addon",
+      "zeromq",
+      "grpc",
+      "@grpc/grpc-js",
+      "leveldown",
+      "rocksdb",
+      "node-canvas",
+      "microtime",
+      "sodium-native",
+      "re2"
+    ]);
+    BUILTIN_SUGGESTIONS = {
+      "node:crypto": "\u7528 WebCrypto\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165 crypto\uFF09\u6216 @adep/crypto \u7684 signJwt / hashPassword / encryptSecret",
+      crypto: "\u7528 WebCrypto\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165 crypto\uFF09\u6216 @adep/crypto",
+      "node:fs": "\u6C99\u7BB1\u65E0\u6587\u4EF6\u7CFB\u7EDF\uFF1B\u9879\u76EE\u6570\u636E\u8D70 ctx.cloud.db\uFF0C\u6587\u4EF6\u8D70 ctx.cloud.storage",
+      fs: "\u6C99\u7BB1\u65E0\u6587\u4EF6\u7CFB\u7EDF\uFF1B\u9879\u76EE\u6570\u636E\u8D70 ctx.cloud.db\uFF0C\u6587\u4EF6\u8D70 ctx.cloud.storage",
+      "node:path": "\u624B\u5199\u5B57\u7B26\u4E32\u62FC\u63A5\uFF08\u6C99\u7BB1\u91CC\u7684\u8DEF\u5F84\u90FD\u662F POSIX \u5F62\u5F0F\uFF09",
+      path: "\u624B\u5199\u5B57\u7B26\u4E32\u62FC\u63A5\uFF08\u6C99\u7BB1\u91CC\u7684\u8DEF\u5F84\u90FD\u662F POSIX \u5F62\u5F0F\uFF09",
+      "node:buffer": "\u7528 Uint8Array + TextEncoder/TextDecoder\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165\uFF09",
+      buffer: "\u7528 Uint8Array + TextEncoder/TextDecoder\uFF08\u6C99\u7BB1\u5DF2\u6CE8\u5165\uFF09",
+      "node:process": "\u73AF\u5883\u53D8\u91CF\u8D70 ctx.env\uFF08adep.config.ts \u7684 environment\uFF09",
+      process: "\u73AF\u5883\u53D8\u91CF\u8D70 ctx.env\uFF08adep.config.ts \u7684 environment\uFF09",
+      "node:stream": "\u7528\u6C99\u7BB1\u6CE8\u5165\u7684 ReadableStream / WritableStream / TransformStream",
+      stream: "\u7528\u6C99\u7BB1\u6CE8\u5165\u7684 ReadableStream / WritableStream / TransformStream"
+    };
+    SOURCE_EXTENSIONS = [".ts", ".js", ".mjs", ".cjs", ".tsx", ".jsx"];
+    SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "__tests__", "dist", ".git", ".adep", "coverage"]);
+    MAX_SCAN_BYTES = 512 * 1024;
+  }
+});
+
 // packages/cli/src/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
@@ -7202,12 +7544,13 @@ async function credentialMode(file) {
     return void 0;
   }
 }
-async function runDoctor(paths) {
+async function runDoctor(paths, cwd = process.cwd()) {
   const credentials = await loadCredentials(paths);
   const server = credentials?.server ?? resolveServer();
   const mode = await credentialMode(paths.credentialsFile);
   const offline = await isOffline();
   const health = await probeServer(server);
+  const sandbox = await scanSandbox(cwd);
   const report = {
     server,
     credentials: {
@@ -7218,7 +7561,8 @@ async function runDoctor(paths) {
     network: { offline },
     serverHealth: health,
     offlineCommands: [...OFFLINE_COMMANDS],
-    boundaries: SIM_BOUNDARIES.map((b) => ({ kind: b.kind, title: b.title, detail: b.detail }))
+    boundaries: SIM_BOUNDARIES.map((b) => ({ kind: b.kind, title: b.title, detail: b.detail })),
+    sandbox
   };
   if (credentials !== null) report.credentials.email = credentials.email;
   if (mode !== void 0 && mode !== "600") {
@@ -7226,6 +7570,22 @@ async function runDoctor(paths) {
   }
   return report;
 }
+async function scanSandbox(cwd) {
+  let functionsDir = "functions";
+  try {
+    const config = await loadAdepConfigModule(cwd);
+    if (config?.functionsDir !== void 0 && config.functionsDir.length > 0) {
+      functionsDir = config.functionsDir;
+    }
+  } catch {
+  }
+  try {
+    const findings = await scanFunctionSources(cwd, functionsDir);
+    return { functionsDir, findings };
+  } catch {
+    return { functionsDir: null, findings: [] };
+  }
+}
 function formatDoctorReport(report) {
   const lines = ["adep doctor \xB7 \u73AF\u5883\u81EA\u68C0", ""];
   lines.push("\u51ED\u636E\u4E0E\u8EAB\u4EFD");
@@ -7253,6 +7613,28 @@ function formatDoctorReport(report) {
   }
   lines.push("", "\u79BB\u7EBF\u53EF\u7528\u8303\u56F4\uFF08\u65AD\u7F51\u65F6\u4ECD\u53EF\u6267\u884C\uFF09");
   for (const command of report.offlineCommands) lines.push(`  \xB7 ${command}`);
+  lines.push("", "\u4E91\u51FD\u6570\u6C99\u7BB1\u517C\u5BB9\u6027\uFF08\u53D1\u5E03\u524D\u5C31\u80FD\u6539\uFF0C\u522B\u7B49\u8FD0\u884C\u65F6\u70B8\uFF09");
+  if (report.sandbox.functionsDir === null) {
+    lines.push("  \xB7 \u672A\u627E\u5230\u51FD\u6570\u76EE\u5F55\uFF0C\u8DF3\u8FC7\u626B\u63CF");
+  } else if (report.sandbox.findings.length === 0) {
+    lines.push(`  \u2713 ${report.sandbox.functionsDir}/ \u5185\u672A\u53D1\u73B0 node \u5185\u7F6E\u6A21\u5757 / \u539F\u751F addon \u4F9D\u8D56`);
+  } else {
+    const byFile = /* @__PURE__ */ new Map();
+    for (const finding of report.sandbox.findings) {
+      const list = byFile.get(finding.file) ?? [];
+      list.push(finding);
+      byFile.set(finding.file, list);
+    }
+    lines.push(
+      `  \u2717 \u53D1\u73B0 ${report.sandbox.findings.length} \u5904\u6C99\u7BB1\u4E0D\u517C\u5BB9\uFF08\u672C\u5730 adep dev \u80FD\u8DD1\uFF0C\u53D1\u5E03\u540E\u4F1A\u5931\u8D25\uFF09\uFF1A`
+    );
+    for (const [file, findingList] of byFile) {
+      for (const finding of findingList) {
+        lines.push(`    ${file}:${finding.line}  [${finding.code}] ${finding.specifier}`);
+        lines.push(`      ${finding.message}`);
+      }
+    }
+  }
   lines.push("", "\u672C\u5730\u6A21\u62DF\u8FD0\u884C\u65F6\u7684\u80FD\u529B\u8FB9\u754C\uFF08\u4E0E adep dev \u542F\u52A8\u6A2A\u5E45\u540C\u6E90\uFF09");
   for (const boundary of report.boundaries) {
     lines.push(`  \xB7 [${boundary.kind}] ${boundary.title}\uFF1A${boundary.detail}`);
@@ -7267,6 +7649,8 @@ var init_doctor = __esm({
     init_config();
     init_boundary();
     init_net();
+    init_sandbox_scan();
+    init_ts_config();
     SERVER_PROBE_TIMEOUT_MS = 5e3;
     OFFLINE_COMMANDS = [
       "adep init",
@@ -7639,8 +8023,8 @@ __export(hosting_exports, {
   hostingInfo: () => hostingInfo,
   hostingPull: () => hostingPull
 });
-import { readdir as readdir7, readFile as readFile16, stat as stat13 } from "node:fs/promises";
-import { dirname as dirname11, join as join20, relative as relative5, resolve as resolve14, sep as sep3 } from "node:path";
+import { readdir as readdir8, readFile as readFile18, stat as stat13 } from "node:fs/promises";
+import { dirname as dirname11, join as join22, relative as relative7, resolve as resolve14, sep as sep4 } from "node:path";
 async function open4(paths, options) {
   const client = await createClient(paths);
   const project2 = await resolveSlug(resolve14(options.cwd), options.slug);
@@ -7661,16 +8045,16 @@ async function collectSiteFiles(dir) {
   const walk = async (sub) => {
     let entries;
     try {
-      entries = await readdir7(sub, { withFileTypes: true });
+      entries = await readdir8(sub, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = join20(sub, entry.name);
+      const full = join22(sub, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
       } else if (entry.isFile()) {
-        const rel = relative5(root, full).split(sep3).join("/");
+        const rel = relative7(root, full).split(sep4).join("/");
         files.set(rel, full);
       }
     }
@@ -7690,7 +8074,7 @@ async function hostingDeploy(paths, options) {
   for (const [rel, full] of files) {
     log(`[adep] \u4E0A\u4F20 site/${rel}`);
     const info2 = await stat13(full);
-    const bytes = await readFile16(full);
+    const bytes = await readFile18(full);
     const form = new FormData();
     form.set("path", `site/${rel}`);
     form.set("visibility", "public");
@@ -7728,7 +8112,7 @@ async function hostingPull(paths, options) {
     const response = await client.download(url, "HOSTING_DOWNLOAD_FAILED");
     const bytes = Buffer.from(await response.arrayBuffer());
     const rel = entry.path.replace(/^site\//, "");
-    const target = join20(outputDir, ...rel.split("/"));
+    const target = join22(outputDir, ...rel.split("/"));
     await mkdir12(dirname11(target), { recursive: true });
     await writeFile10(target, bytes);
     files.push({ path: entry.path, size: bytes.length });
@@ -12274,11 +12658,28 @@ function registerImport(program2, ctx) {
 
 // packages/cli/src/commands/dev.ts
 function registerDevServers(program2, ctx) {
-  program2.command("dev").description("\u672C\u5730\u8C03\u8BD5\uFF1A\u76D1\u542C functions/ \u70ED\u91CD\u8F7D\uFF0Chttp://localhost:<port>/<fnName>").option("-p, --port <port>", "\u76D1\u542C\u7AEF\u53E3\uFF08\u7F3A\u7701 8787\uFF09", "8787").action(async (flags) => {
+  program2.command("dev").description("\u672C\u5730\u8C03\u8BD5\uFF1A\u76D1\u542C functions/ \u70ED\u91CD\u8F7D\uFF0Chttp://localhost:<port>/<fnName>").option("-p, --port <port>", "\u76D1\u542C\u7AEF\u53E3\uFF08\u7F3A\u7701 8787\uFF09", "8787").option(
+    "--db <mode>",
+    "\u6570\u636E\u5E93\u6A21\u5F0F\uFF1Asqlite\uFF08\u7F3A\u7701\uFF0C\u771F\u5B9E SQLite \u5E93\u6587\u4EF6\uFF0C\u9700 Bun \u6216 Node \u2265 22.5\uFF1B\u8FD0\u884C\u65F6\u4E0D\u652F\u6301\u6216\u6253\u5F00\u5931\u8D25\u65F6\u81EA\u52A8\u964D\u7EA7 sim\uFF09| sim\uFF08\u5185\u7F6E\u6A21\u62DF\u5F15\u64CE + .adep/sim/db.json\uFF09"
+  ).option(
+    "--db-file <path>",
+    "sqlite \u6A21\u5F0F\u7684\u5E93\u6587\u4EF6\uFF08\u7F3A\u7701\u53D6 ADEP_SERVE_DB_FILE\uFF0C\u518D\u7F3A\u7701 .adep/data/project.sqlite\uFF09"
+  ).option(
+    "--schema <file>",
+    "\u6570\u636E\u5E93\u7ED3\u6784\u6587\u4EF6\uFF1A\u542F\u52A8\u65F6\u5BF9\u672C\u5730\u5E93\u9010\u6761\u5E94\u7528\uFF08\u5EFA\u8868\u8BED\u53E5\u5EFA\u8BAE IF NOT EXISTS\uFF0C\u5E42\u7B49\u53EF\u91CD\u590D\u542F\u52A8\uFF09"
+  ).action(async (flags) => {
     const command = ctx.io("dev");
     await command.run(async () => {
       const { startDevServer: startDevServer2 } = await Promise.resolve().then(() => (init_dev(), dev_exports));
-      const started = await startDevServer2({ cwd: ctx.cwd, port: Number(flags.port ?? "8787") });
+      const started = await startDevServer2({
+        cwd: ctx.cwd,
+        port: Number(flags.port ?? "8787"),
+        // 缺省值一律交给 startDevServer 定档（旗标 > ADEP_SERVE_DB > 内置缺省），
+        // 与 `adep serve` 同一条纪律：commander 的缺省值不该盖掉环境变量。
+        ...flags.db === void 0 ? {} : { db: flags.db },
+        ...flags.dbFile === void 0 ? {} : { dbFile: flags.dbFile },
+        ...flags.schema === void 0 ? {} : { schemaFile: flags.schema }
+      });
       command.raw(`[adep] dev server listening on ${started.baseUrl}\uFF08Ctrl-C \u9000\u51FA\uFF09`);
       await new Promise(() => void 0);
     });
@@ -12333,7 +12734,7 @@ init_auth();
 init_client();
 init_deploy();
 import { stat as stat9 } from "node:fs/promises";
-import { join as join17, resolve as resolve10 } from "node:path";
+import { join as join18, resolve as resolve10 } from "node:path";
 async function resolveProjectId2(client, cwd, slug) {
   const resolvedSlug = await resolveSlug(resolve10(cwd), slug);
   const listed = await client.request("/api/v1/projects", {}, "PROJECT_LIST_FAILED");
@@ -12376,7 +12777,8 @@ async function publishFunctions(paths, options) {
     cwd: options.cwd,
     ...options.slug === void 0 ? {} : { slug: options.slug },
     silent: options.silent ?? false,
-    ...options.log === void 0 ? {} : { log: options.log }
+    ...options.log === void 0 ? {} : { log: options.log },
+    ...options.force === void 0 ? {} : { force: options.force }
   });
   const elapsedSeconds = (Date.now() - startedAt) / 1e3;
   const deployedCount = result.functions.filter((fn) => fn.action !== "none").length;
@@ -12395,11 +12797,12 @@ async function runPublish(paths, io, cwd, flags) {
       cwd,
       ...flags.project === void 0 ? {} : { slug: flags.project },
       silent: io.json,
-      log: (line) => io.line(line)
+      log: (line) => io.line(line),
+      ...flags.force === void 0 ? {} : { force: flags.force }
     });
   }
   if (wantFrontend) {
-    const webDir = join17(cwd, "web");
+    const webDir = join18(cwd, "web");
     const webStat = await stat9(webDir).catch(() => null);
     if (webStat !== null && webStat.isDirectory()) {
       const { frontendSync: frontendSync2 } = await Promise.resolve().then(() => (init_frontend(), frontend_exports));
@@ -12447,7 +12850,10 @@ function registerPublish(program2, ctx) {
   program2.command("publish").description("\u5168\u6808\u53D1\u5E03\uFF1A\u51FD\u6570\u90E8\u7F72 + \u524D\u7AEF\u6784\u5EFA\u6258\u7BA1\uFF08--only functions|frontend \u53EF\u5355\u72EC\u53D1\u5E03\u4E00\u4FA7\uFF09").option(
     "--only <scope>",
     "\u4EC5\u53D1\u5E03\u4E00\u4FA7\uFF1Afunctions\uFF08\u53EA\u90E8\u7F72\u4E91\u51FD\u6570\uFF09| frontend\uFF08\u53EA\u6784\u5EFA\u6258\u7BA1\u524D\u7AEF\uFF09\uFF1B\u7F3A\u7701\u5168\u6808\u53D1\u5E03"
-  ).option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").action(async (flags) => {
+  ).option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").option(
+    "--force",
+    "\u653E\u884C warn \u7EA7\u5BC6\u94A5\u5F15\u7528\u547D\u4E2D\uFF08FN-013\uFF1B\u6E90\u7801\u5F15\u7528\u4E86\u5DF2\u914D\u7F6E\u7684 secret \u73AF\u5883\u53D8\u91CF\u540D\u65F6\u53D1\u5E03\u88AB\u963B\u65AD\uFF0C\u786E\u8BA4\u975E\u6CC4\u6F0F\u540E\u7528\u672C\u65D7\u6807\u653E\u884C\uFF0C\u670D\u52A1\u7AEF\u843D\u5BA1\u8BA1\uFF09"
+  ).action(async (flags) => {
     const command = ctx.io("publish");
     await command.run(async () => {
       const result = await runPublish(ctx.paths, command, ctx.cwd, flags);
@@ -12457,13 +12863,14 @@ function registerPublish(program2, ctx) {
 }
 
 // packages/cli/src/commands/deploy.ts
-async function runDeploy(paths, io, cwd, slug, dir) {
+async function runDeploy(paths, io, cwd, slug, dir, force) {
   const { deploy: deploy2 } = await Promise.resolve().then(() => (init_deploy(), deploy_exports));
   const startedAt = Date.now();
   const result = await deploy2(paths, {
     cwd,
     ...slug === void 0 ? {} : { slug },
     ...dir === void 0 ? {} : { functionsDir: dir },
+    ...force === void 0 ? {} : { force },
     // --json 下逐函数进度会破坏「stdout 恰好一个 JSON 对象」的信封约定（PRD §2.5.3）。
     silent: io.json,
     // 人读模式的进度也走注入的 io：deploy 内部缺省会直写 process.stdout，
@@ -12488,14 +12895,14 @@ async function runDeploy(paths, io, cwd, slug, dir) {
 function registerDeploy(program2, ctx) {
   program2.command("deploy").description(
     "[deprecated] \u63A8\u8350\u4F7F\u7528 adep publish\u3002\u589E\u91CF\u90E8\u7F72\u51FD\u6570\uFF1A\u5BF9\u6BD4\u8FDC\u7AEF\u54C8\u5E0C \u2192 \u4EC5\u4E0A\u4F20\u53D8\u66F4 \u2192 \u53D1\u5E03 \u2192 \u8F93\u51FA\u8BBF\u95EE\u57DF\u540D"
-  ).option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").action(async (flags) => {
+  ).option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").option("--force", "\u653E\u884C warn \u7EA7\u5BC6\u94A5\u5F15\u7528\u547D\u4E2D\uFF08FN-013\uFF1B\u786E\u8BA4\u975E\u6CC4\u6F0F\u540E\u7528\uFF0C\u670D\u52A1\u7AEF\u843D\u5BA1\u8BA1\uFF09").action(async (flags) => {
     const command = ctx.io("deploy");
     if (!command.json) {
       process.stderr.write(
         "\u63D0\u793A\uFF1Aadep deploy \u5DF2\u5E9F\u5F03\uFF0C\u63A8\u8350\u4F7F\u7528 adep publish\uFF08\u5168\u6808\u53D1\u5E03\uFF09\u6216 adep publish --only functions\uFF08\u4EC5\u51FD\u6570\uFF09\n"
       );
     }
-    await command.run(() => runDeploy(ctx.paths, command, ctx.cwd, flags.project));
+    await command.run(() => runDeploy(ctx.paths, command, ctx.cwd, flags.project, void 0, flags.force));
   });
 }
 
@@ -12539,7 +12946,7 @@ function registerExport(program2, ctx) {
 
 // packages/cli/src/commands/db.ts
 function registerDb(program2, ctx) {
-  const db = program2.command("db").description("\u9879\u76EE\u6570\u636E\u5E93\u7EF4\u62A4\uFF1A\u542F\u52A8 / \u72B6\u6001 / \u505C\u6B62 / SQL / \u5FEB\u7167 / \u56DE\u6EDA").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09");
+  const db = program2.command("db").description("\u9879\u76EE\u6570\u636E\u5E93\u7EF4\u62A4\uFF1A\u542F\u52A8 / \u72B6\u6001 / \u505C\u6B62 / SQL / \u5FEB\u7167 / \u56DE\u6EDA");
   db.command("start").description("\u542F\u52A8\u9879\u76EE\u6570\u636E\u5E93\uFF08\u5DF2\u5B58\u5728\u5219\u91CD\u65B0\u6FC0\u6D3B\uFF0C\u4E0D\u91CD\u5EFA\u6570\u636E\uFF09").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").action(async (flags) => {
     const command = ctx.io("db start");
     await command.run(async () => {
@@ -12690,7 +13097,7 @@ function registerDb(program2, ctx) {
 
 // packages/cli/src/commands/frontend.ts
 function registerFrontend(program2, ctx) {
-  const frontend = program2.command("frontend").description("\u524D\u7AEF\u8349\u7A3F\u7EF4\u62A4\uFF1Async\uFF08\u672C\u5730 web/ \u2192 \u5E73\u53F0\u8349\u7A3F\uFF09").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09");
+  const frontend = program2.command("frontend").description("\u524D\u7AEF\u8349\u7A3F\u7EF4\u62A4\uFF1Async\uFF08\u672C\u5730 web/ \u2192 \u5E73\u53F0\u8349\u7A3F\uFF09");
   frontend.command("sync").description("\u4E0A\u4F20\u672C\u5730 web/ \u6E90\u7801\u4E3A\u5E73\u53F0\u524D\u7AEF\u8349\u7A3F\uFF08\u6574\u7EC4\u66FF\u6362\uFF1Bpublish \u5168\u6808\u65F6\u81EA\u52A8\u6267\u884C\uFF09").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").option("-d, --dir <dir>", "\u672C\u5730\u524D\u7AEF\u6E90\u7801\u76EE\u5F55\uFF08\u7F3A\u7701 cwd/web\uFF09").action(async (flags) => {
     const command = ctx.io("frontend sync");
     await command.run(async () => {
@@ -12712,7 +13119,7 @@ function registerFrontend(program2, ctx) {
 
 // packages/cli/src/commands/storage.ts
 function registerStorage(program2, ctx) {
-  const storage = program2.command("storage").description("\u4E91\u5B58\u50A8 / \u6587\u4EF6\u5B58\u50A8\uFF1A\u4E0A\u4F20 / \u4E0B\u8F7D / \u5217\u8868 / \u5220\u9664").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09");
+  const storage = program2.command("storage").description("\u4E91\u5B58\u50A8 / \u6587\u4EF6\u5B58\u50A8\uFF1A\u4E0A\u4F20 / \u4E0B\u8F7D / \u5217\u8868 / \u5220\u9664");
   storage.command("upload").description("\u4E0A\u4F20\u5355\u4E2A\u6587\u4EF6\uFF08multipart\uFF1B\u5355\u6587\u4EF6 \u2264 50MB\uFF09").argument("<file>", "\u672C\u5730\u6587\u4EF6\u8DEF\u5F84").requiredOption("--path <remote-path>", "\u6876\u5185\u76EE\u6807\u8DEF\u5F84\uFF08\u5982 avatars/a.png\uFF09").option(
     "--visibility <public|private>",
     "public \u76F4\u8FDE / private \u7B7E\u540D\uFF08\u7F3A\u7701 private\uFF09",
@@ -12997,14 +13404,16 @@ function registerFunctions(program2, ctx) {
   const functions = program2.command("functions").description("\u4E91\u51FD\u6570\uFF1A\u90E8\u7F72\uFF08\u53EF\u6307\u5B9A\u76EE\u5F55\uFF09/ \u5217\u51FA / \u67E5\u65E5\u5FD7");
   functions.command("deploy").description(
     "[deprecated] \u63A8\u8350\u4F7F\u7528 adep publish --only functions\u3002\u90E8\u7F72\u51FD\u6570\u76EE\u5F55\uFF08dir \u8986\u76D6 adep.config.ts \u7684 functionsDir\uFF09"
-  ).argument("[dir]", "\u51FD\u6570\u76EE\u5F55\uFF08\u76F8\u5BF9\u9879\u76EE\u6839\u6216\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u7F3A\u7701\u53D6\u914D\u7F6E\u91CC\u7684 functionsDir\uFF09").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").action(async (dir, flags) => {
+  ).argument("[dir]", "\u51FD\u6570\u76EE\u5F55\uFF08\u76F8\u5BF9\u9879\u76EE\u6839\u6216\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u7F3A\u7701\u53D6\u914D\u7F6E\u91CC\u7684 functionsDir\uFF09").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").option("--force", "\u653E\u884C warn \u7EA7\u5BC6\u94A5\u5F15\u7528\u547D\u4E2D\uFF08FN-013\uFF1B\u786E\u8BA4\u975E\u6CC4\u6F0F\u540E\u7528\uFF0C\u670D\u52A1\u7AEF\u843D\u5BA1\u8BA1\uFF09").action(async (dir, flags) => {
     const command = ctx.io("functions deploy");
     if (!command.json) {
       process.stderr.write(
         "\u63D0\u793A\uFF1Aadep functions deploy \u5DF2\u5E9F\u5F03\uFF0C\u63A8\u8350\u4F7F\u7528 adep publish --only functions\n"
       );
     }
-    await command.run(() => runDeploy(ctx.paths, command, ctx.cwd, flags.project, dir));
+    await command.run(
+      () => runDeploy(ctx.paths, command, ctx.cwd, flags.project, dir, flags.force)
+    );
   });
   functions.command("list").description("\u5217\u51FA\u9879\u76EE\u4E0B\u7684\u4E91\u51FD\u6570\uFF08\u542B\u516C\u7F51\u8BBF\u95EE\u524D\u7F00\uFF09").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").action(async (flags) => {
     const command = ctx.io("functions list");
@@ -13055,7 +13464,7 @@ function parseBool(raw) {
   throw new CliError("INVALID_BOOLEAN", `\u5E03\u5C14\u53C2\u6570\u987B\u4E3A true \u6216 false\uFF0C\u6536\u5230 "${raw}"`);
 }
 function registerHosting(program2, ctx) {
-  const hosting = program2.command("hosting").description("\u9759\u6001\u6258\u7BA1\uFF1A\u67E5\u770B / \u90E8\u7F72 / \u62C9\u53D6 / \u914D\u7F6E").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09");
+  const hosting = program2.command("hosting").description("\u9759\u6001\u6258\u7BA1\uFF1A\u67E5\u770B / \u90E8\u7F72 / \u62C9\u53D6 / \u914D\u7F6E");
   hosting.command("info").description("\u67E5\u770B\u9759\u6001\u6258\u7BA1\u914D\u7F6E\u3001\u7AD9\u70B9\u5730\u5740\u4E0E\u6587\u4EF6\u6811").option("-p, --project <slug>", "\u76EE\u6807\u5E73\u53F0\u9879\u76EE slug\uFF08\u7F3A\u7701\u53D6 adep.config.ts \u7684 name\uFF09").action(async (flags) => {
     const command = ctx.io("hosting info");
     await command.run(async () => {