@adep/cli 0.1.8 → 0.1.10

package/dist/vite.js

@@ -4,8 +4,8 @@ import { adepPlugin } from "@adep/vite-plugin";
 // packages/cli/src/dev.ts
 import { createServer } from "node:http";
 import { watch } from "node:fs";
-import { mkdir as mkdir3, readdir as readdir2, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
-import { basename, join as join8, resolve as resolve2 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile6, writeFile as writeFile3 } from "node:fs/promises";
+import { basename, join as join9, resolve as resolve2 } from "node:path";
 
 // packages/runtime/src/shared/capability-keys.ts
 var RPC_CAPABILITY_KEY = "__adepRpc";
@@ -1106,7 +1106,7 @@ function createDbCapability(driver, options = {}) {
   };
 }
 
-// packages/cli/src/sim/sql-engine.ts
+// packages/runtime/src/sim/sql-engine.ts
 var SimDbError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -1138,6 +1138,7 @@ function stripQuotes(raw) {
   const t = raw.trim();
   if (/^'.*'$/.test(t)) return t.slice(1, -1);
   if (/^".*"$/.test(t)) return t.slice(1, -1);
+  if (/^NULL$/i.test(t)) return null;
   return t;
 }
 function parseCreateTable(ddl) {
@@ -1146,7 +1147,7 @@ function parseCreateTable(ddl) {
   );
   if (m === null) return null;
   const name = ident(m[1]);
-  const body = m[2];
+  const body = m[3];
   const columns = [];
   for (const part of body.split(",")) {
     const tokens = part.trim().split(/\s+/);
@@ -1158,50 +1159,109 @@ function parseCreateTable(ddl) {
   }
   return { name, columns };
 }
-function parseWhereClauses(whereRaw, cursor) {
-  const clauses = [];
-  for (const part of whereRaw.split(/\s+AND\s+/i)) {
-    const t = part.trim();
-    if (t.length === 0) continue;
-    if (/\bIS\s+NULL\b/i.test(t)) {
-      const col2 = ident(t.split(/\s+IS\s+NULL\b/i)[0] ?? "");
-      clauses.push({ column: col2, operator: "IS NULL", value: null, list: false });
-      continue;
-    }
-    if (/\bIS\s+NOT\s+NULL\b/i.test(t)) {
-      const col2 = ident(t.split(/\s+IS\s+NOT\s+NULL\b/i)[0] ?? "");
-      clauses.push({ column: col2, operator: "IS NOT NULL", value: null, list: false });
-      continue;
-    }
-    const opMatch = /^\s*((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s*(=|!=|>=|<=|>|<|like|in|not\s+in)\s*(.+)$/i.exec(
-      t
-    );
-    if (opMatch === null) continue;
-    const col = ident(opMatch[1] ?? "");
-    const op = (opMatch[3] ?? opMatch[2] ?? "").toLowerCase();
-    const rhs = (opMatch[4] ?? "").trim();
-    if (op === "in" || op === "not in") {
-      const inner = rhs.replace(/^\(|\)$/g, "");
-      const items = splitListItems(inner);
-      const list = items.map((item) => {
-        if (item.trim() === "?") return cursor.take();
-        return stripQuotes(item);
-      });
-      clauses.push({ column: col, operator: op, value: list, list: true });
+function splitTopLevel(raw, token) {
+  const parts = [];
+  let depth = 0;
+  let inQuote = false;
+  let buffer = "";
+  const n = raw.length;
+  const isTokenAt = (i) => {
+    const word = raw.slice(i, i + token.length);
+    if (word.toUpperCase() !== token) return false;
+    const before = i === 0 ? "" : raw[i - 1] ?? "";
+    const after = raw[i + token.length] ?? "";
+    return !/[A-Za-z0-9_.]/.test(before) && !/[A-Za-z0-9_.]/.test(after);
+  };
+  for (let i = 0; i < n; i += 1) {
+    const ch = raw[i] ?? "";
+    if (ch === "'") {
+      if (inQuote && raw[i + 1] === "'") {
+        buffer += ch + (raw[i + 1] ?? "");
+        i += 1;
+        continue;
+      }
+      inQuote = !inQuote;
+      buffer += ch;
       continue;
     }
-    let value;
-    if (rhs === "?") {
-      value = cursor.take();
+    if (!inQuote && ch === "(") depth += 1;
+    else if (!inQuote && ch === ")") depth -= 1;
+    if (!inQuote && depth === 0 && isTokenAt(i)) {
+      parts.push(buffer);
+      buffer = "";
+      i += token.length - 1;
     } else {
-      value = stripQuotes(rhs);
+      buffer += ch;
     }
-    clauses.push({ column: col, operator: op, value, list: false });
   }
-  return clauses;
+  parts.push(buffer);
+  return parts;
+}
+function unqualifyColumn(raw) {
+  const t = raw.trim();
+  const dot = t.lastIndexOf(".");
+  if (dot > 0 && /^[A-Za-z_][A-Za-z0-9_]*\./.test(t)) return t.slice(dot + 1);
+  return t;
+}
+function parseLeftJoins(tail) {
+  const joins = [];
+  const re = /LEFT\s+JOIN\s+((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s+([A-Za-z_][A-Za-z0-9_]*)\s+ON\s+([A-Za-z_][A-Za-z0-9_.]*)\s*=\s*([A-Za-z_][A-Za-z0-9_.]*)/gi;
+  let m;
+  while ((m = re.exec(tail)) !== null) {
+    joins.push({
+      table: ident(m[1] ?? ""),
+      alias: m[3] ?? "",
+      leftCol: unqualifyColumn(m[4] ?? ""),
+      rightCol: unqualifyColumn(m[5] ?? "")
+    });
+  }
+  return joins;
+}
+function parseWhereClauses(whereRaw, cursor) {
+  const parseAndGroup = (andRaw) => {
+    const clauses = [];
+    for (const part of splitTopLevel(andRaw, "AND")) {
+      const t = part.trim();
+      if (t.length === 0) continue;
+      if (/\bIS\s+NULL\b/i.test(t)) {
+        clauses.push({ column: unqualifyColumn(ident(t.split(/\s+IS\s+NULL\b/i)[0] ?? "")), operator: "IS NULL", value: null, list: false });
+        continue;
+      }
+      if (/\bIS\s+NOT\s+NULL\b/i.test(t)) {
+        clauses.push({ column: unqualifyColumn(ident(t.split(/\s+IS\s+NOT\s+NULL\b/i)[0] ?? "")), operator: "IS NOT NULL", value: null, list: false });
+        continue;
+      }
+      const opMatch = /^\s*((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_.]*))\s*(=|!=|>=|<=|>|<|like|in|not\s+in)\s*(.+)$/i.exec(
+        t
+      );
+      if (opMatch === null) continue;
+      const col = unqualifyColumn(ident(opMatch[1] ?? ""));
+      const op = (opMatch[3] ?? opMatch[2] ?? "").toLowerCase();
+      const rhs = (opMatch[4] ?? "").trim();
+      if (op === "in" || op === "not in") {
+        const inner = rhs.replace(/^\(|\)$/g, "");
+        const items = splitListItems(inner);
+        const list = items.map((item) => {
+          if (item.trim() === "?") return cursor.take();
+          return stripQuotes(item);
+        });
+        clauses.push({ column: col, operator: op, value: list, list: true });
+        continue;
+      }
+      let value;
+      if (rhs === "?") {
+        value = cursor.take();
+      } else {
+        value = stripQuotes(rhs);
+      }
+      clauses.push({ column: col, operator: op, value, list: false });
+    }
+    return clauses;
+  };
+  return splitTopLevel(whereRaw, "OR").map((group) => group.trim()).filter((group) => group.length > 0).map(parseAndGroup);
 }
-function matchWhere(clauses, row) {
-  return clauses.every((c) => matchValue(row[c.column], c));
+function matchWhere(groups, row) {
+  return groups.some((clauses) => clauses.every((c) => matchValue(row[c.column], c)));
 }
 function splitListItems(inner) {
   const items = [];
@@ -1221,6 +1281,168 @@ function splitListItems(inner) {
   items.push(buffer);
   return items;
 }
+var ExcludedRef = class {
+  constructor(column) {
+    this.column = column;
+  }
+};
+var ColumnRef = class {
+  constructor(column) {
+    this.column = column;
+  }
+};
+var ExprRef = class {
+  constructor(source) {
+    this.source = source;
+  }
+};
+function resolveSetValue(value, existing, row) {
+  if (value instanceof ExcludedRef) return row[value.column];
+  if (value instanceof ColumnRef) return existing[value.column];
+  if (value instanceof ExprRef) return evalArithmetic(value.source, existing, row);
+  return value;
+}
+function evalArithmetic(src, existing, row) {
+  const num = (v) => {
+    const n2 = Number(v);
+    return Number.isFinite(n2) ? n2 : 0;
+  };
+  let i = 0;
+  const n = src.length;
+  const skip = () => {
+    while (i < n && /\s/.test(src[i] ?? "")) i += 1;
+  };
+  const peek = () => {
+    skip();
+    return i < n ? src[i] ?? "" : null;
+  };
+  const parseIdent = () => {
+    skip();
+    const m = /^([A-Za-z_][A-Za-z0-9_]*)/.exec(src.slice(i));
+    if (m === null) return null;
+    i += (m[1] ?? "").length;
+    skip();
+    let col = ident(m[1] ?? "");
+    let excluded = false;
+    if (src[i] === ".") {
+      const m2 = /^\.([A-Za-z_][A-Za-z0-9_]*)/.exec(src.slice(i));
+      if (m2 !== null) {
+        i += (m2[0] ?? "").length;
+        if (col.toLowerCase() === "excluded") excluded = true;
+        col = ident(m2[1] ?? "");
+      }
+    }
+    return { col, excluded };
+  };
+  const parseFactor = () => {
+    const ch = peek();
+    if (ch === "(") {
+      i += 1;
+      const v = parseExpr();
+      skip();
+      if (src[i] === ")") i += 1;
+      return v;
+    }
+    const numMatch = /^(\d+(?:\.\d+)?)/.exec(src.slice(i));
+    if (numMatch !== null) {
+      i += (numMatch[1] ?? "").length;
+      return Number(numMatch[1]);
+    }
+    const id = parseIdent();
+    if (id !== null) {
+      const v = id.excluded ? row[id.col] : existing[id.col];
+      return num(v);
+    }
+    return 0;
+  };
+  const parseTerm = () => {
+    let v = parseFactor();
+    for (; ; ) {
+      const ch = peek();
+      if (ch !== "*" && ch !== "/") return v;
+      i += 1;
+      const rhs = parseFactor();
+      v = ch === "*" ? v * rhs : rhs === 0 ? v : v / rhs;
+    }
+  };
+  const parseExpr = () => {
+    let v = parseTerm();
+    for (; ; ) {
+      const ch = peek();
+      if (ch !== "+" && ch !== "-") return v;
+      i += 1;
+      const rhs = parseTerm();
+      v = ch === "+" ? v + rhs : v - rhs;
+    }
+  };
+  return parseExpr();
+}
+function splitInsertTuples(body) {
+  const tuples = [];
+  let i = 0;
+  const n = body.length;
+  while (i < n) {
+    while (i < n && (body[i] === " " || body[i] === "	" || body[i] === "\n" || body[i] === "\r" || body[i] === ",")) {
+      i += 1;
+    }
+    if (i >= n) break;
+    if (body[i] !== "(") {
+      return { tuples, conflict: body.slice(i).trim() };
+    }
+    let depth = 0;
+    let j = i;
+    for (; j < n; j += 1) {
+      if (body[j] === "(") depth += 1;
+      else if (body[j] === ")") {
+        depth -= 1;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= n) return { tuples, conflict: null };
+    tuples.push(body.slice(i + 1, j));
+    i = j + 1;
+  }
+  return { tuples, conflict: null };
+}
+function parseConflictClause(clause, cursor, fallbackCols) {
+  const m = /^ON\s+CONFLICT(?:\s*\(([^)]*)\))?\s+DO\s+(UPDATE\s+SET\s+([\s\S]+)|NOTHING\s*)$/i.exec(
+    clause.trim()
+  );
+  if (m === null) {
+    throw new SimDbError("DB_UNSAFE_OP", `\u65E0\u6CD5\u89E3\u6790 ON CONFLICT \u5B50\u53E5\uFF1A${clause.trim().slice(0, 60)}\u2026`);
+  }
+  const colsRaw = m[1];
+  const cols = colsRaw === void 0 ? fallbackCols : colsRaw.split(",").map(ident);
+  if (cols.length === 0) throw new SimDbError("DB_UNSAFE_OP", "ON CONFLICT \u51B2\u7A81\u5217\u4E3A\u7A7A");
+  const action = m[2] ?? "";
+  if (/^NOTHING/i.test(action)) return { cols, sets: [] };
+  const setRaw = m[3] ?? "";
+  const sets = splitListItems(setRaw).map((part) => {
+    const eq = /^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*([\s\S]+)$/i.exec(part.trim());
+    if (eq === null) {
+      throw new SimDbError("DB_UNSAFE_OP", `\u65E0\u6CD5\u89E3\u6790 SET \u8D4B\u503C\uFF1A${part.trim().slice(0, 60)}\u2026`);
+    }
+    const col = ident(eq[1] ?? "");
+    const rhs = (eq[2] ?? "").trim();
+    let value;
+    if (rhs === "?") {
+      value = cursor.take();
+    } else {
+      const ex = /^excluded\.([A-Za-z_][A-Za-z0-9_]*)$/i.exec(rhs);
+      if (ex !== null) {
+        value = new ExcludedRef(ident(ex[1] ?? ""));
+      } else if (/^([A-Za-z_][A-Za-z0-9_]*)$/.test(rhs) && !/^NULL$/i.test(rhs)) {
+        value = new ColumnRef(ident(rhs));
+      } else if (/^'.*'$/.test(rhs) || /^".*"$/.test(rhs) || /^NULL$/i.test(rhs)) {
+        value = stripQuotes(rhs);
+      } else {
+        value = new ExprRef(rhs);
+      }
+    }
+    return { col, value };
+  });
+  return { cols, sets };
+}
 function matchValue(value, clause) {
   const op = clause.operator;
   if (op === "IS NULL") return value === null || value === void 0;
@@ -1236,9 +1458,9 @@ function matchValue(value, clause) {
   const right = clause.value;
   switch (op) {
     case "=":
-      return left === right;
+      return left !== null && right !== null && left === right;
     case "!=":
-      return left !== right;
+      return left !== null && right !== null && left !== right;
     case ">":
       return left !== null && right !== null && left > right;
     case ">=":
@@ -1374,16 +1596,36 @@ var SimSqlEngine = class {
     const valueBody = match[4].trim();
     const cursor = new ParamCursor(params);
     const table = this.ensureTable(tableName);
+    const { tuples, conflict } = splitInsertTuples(valueBody);
+    if (tuples.length === 0) throw new SimDbError("DB_UNSAFE_OP", "INSERT \u7F3A\u5C11 VALUES \u5143\u7EC4");
+    const conflictSpec = conflict === null ? null : parseConflictClause(
+      conflict,
+      cursor,
+      table.columns.filter((c) => c.primaryKey).map((c) => c.name)
+    );
     let inserted = 0;
-    for (const group of splitListItems(valueBody)) {
-      const inner = group.trim().replace(/^\(|\)$/g, "");
-      const values = splitListItems(inner).map(
+    for (const tuple of tuples) {
+      const values = splitListItems(tuple).map(
         (item) => item.trim() === "?" ? cursor.take() : stripQuotes(item)
       );
       const row = {};
       cols.forEach((col, i) => {
         row[col] = values[i] ?? null;
       });
+      if (conflictSpec !== null) {
+        const existing = table.rows.find(
+          (r) => conflictSpec.cols.every((c) => r[c] === row[c])
+        );
+        if (existing !== void 0) {
+          const oldRow = { ...existing };
+          for (const set of conflictSpec.sets) {
+            existing[set.col] = resolveSetValue(set.value, oldRow, row);
+          }
+          inserted += 1;
+          void this.persist();
+          continue;
+        }
+      }
       this.applyAutoincrement(table, row);
       table.rows.push(row);
       inserted += 1;
@@ -1452,6 +1694,20 @@ var SimSqlEngine = class {
       return project(this.catalog(), selectRaw);
     }
     const table = this.ensureTable(tableName);
+    let rows = table.rows;
+    const joins = parseLeftJoins(tail);
+    if (joins.length > 0) {
+      rows = table.rows.map((row) => {
+        const merged = { ...row };
+        for (const j of joins) {
+          const joined = this.tables[j.table]?.rows.find((jr) => jr[j.leftCol] === merged[j.rightCol]);
+          if (joined !== void 0) {
+            for (const [k, v] of Object.entries(joined)) merged[`${j.alias}.${k}`] = v;
+          }
+        }
+        return merged;
+      });
+    }
     const whereMatch = /\bWHERE\b/i.exec(tail);
     const orderMatch = /\bORDER\s+BY\b/i.exec(tail);
     const limitMatch = /\bLIMIT\b/i.exec(tail);
@@ -1460,7 +1716,6 @@ var SimSqlEngine = class {
       whereMatch.index + whereMatch[0].length,
       indexAfter(whereMatch.index, [orderMatch, limitMatch, offsetMatch], tail)
     );
-    let rows = table.rows;
     if (whereRaw.trim().length > 0) {
       const clauses = parseWhereClauses(whereRaw, cursor);
       rows = rows.filter((row) => matchWhere(clauses, row));
@@ -1470,9 +1725,9 @@ var SimSqlEngine = class {
         orderMatch.index + orderMatch[0].length,
         indexAfter(orderMatch.index, [limitMatch, offsetMatch], tail)
       );
-      const oc = /^\s*((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s+(asc|desc)/i.exec(orderRaw);
+      const oc = /^\s*((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_.]*))\s+(asc|desc)/i.exec(orderRaw);
       if (oc !== null) {
-        const col = ident(oc[1]);
+        const col = unqualifyColumn(ident(oc[1]));
         const dir = oc[3].toLowerCase();
         rows = [...rows].toSorted((a, b) => {
           const av = a[col];
@@ -1517,6 +1772,15 @@ function indexAfter(start, matches, tail) {
   const end = candidates.length === 0 ? -1 : Math.min(...candidates);
   return end === -1 ? tail.length : end;
 }
+function parseSelectItem(raw) {
+  const t = raw.trim();
+  const as = /\s+AS\s+([A-Za-z_][A-Za-z0-9_]*)$/i.exec(t);
+  let name = as === null ? t : t.slice(0, as.index).trim();
+  if (unqualifyColumn(name) === "*") return { name: "", qualified: "", alias: "", star: true };
+  const qualified = /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? ident(name) : "";
+  const plain = unqualifyColumn(ident(name));
+  return { name: plain, qualified, alias: as === null ? plain : ident(as[1] ?? ""), star: false };
+}
 function project(rows, selectRaw) {
   if (/^count\s*\(\s*\*/i.test(selectRaw) || /^count\s*\(\s*1\)/i.test(selectRaw)) {
     const alias = selectRaw.match(/\bAS\s+([A-Za-z_][A-Za-z0-9_]*)/i)?.[1] ?? "n";
@@ -1527,10 +1791,21 @@ function project(rows, selectRaw) {
     return [{ [constMatch[2]]: Number(constMatch[1]) }];
   }
   if (selectRaw.trim() === "*") return rows;
-  const cols = selectRaw.split(",").map((s) => ident(s.trim()));
+  const items = selectRaw.split(",").map(parseSelectItem);
+  const valueOf = (row, item) => item.qualified !== "" && row[item.qualified] !== void 0 ? row[item.qualified] : row[item.name];
+  if (items.some((item) => item.star)) {
+    return rows.map((row) => {
+      const out = { ...row };
+      for (const item of items) {
+        if (item.star) continue;
+        out[item.alias] = valueOf(row, item);
+      }
+      return out;
+    });
+  }
   return rows.map((row) => {
     const out = {};
-    for (const col of cols) out[col] = row[col];
+    for (const item of items) out[item.alias] = valueOf(row, item);
     return out;
   });
 }
@@ -1698,6 +1973,19 @@ function assertSafeStoragePath(path) {
   }
   return path;
 }
+function assertStoragePrefix(prefix) {
+  if (prefix !== void 0 && prefix !== "") {
+    const segments = prefix.split("/");
+    if (prefix.startsWith("/") || /[\\]/.test(prefix) || segments.some((segment) => segment === "..")) {
+      throw new StorageError(
+        400,
+        STORAGE_CODES.invalidPath,
+        `\u975E\u6CD5\u524D\u7F00 "${prefix}"\uFF08\u7981\u6B62 / \u5F00\u5934\u3001\u53CD\u659C\u6760\u6216 .. \u7A7F\u8D8A\uFF09`
+      );
+    }
+  }
+  return prefix ?? "";
+}
 
 // packages/runtime/src/storage/hmac-sha256.ts
 var K = new Uint32Array([
@@ -2081,16 +2369,7 @@ function createLocalStorageDriver(options) {
       await unlink(metaPath(projectId, path)).catch(() => void 0);
     },
     async list(projectId, prefix) {
-      if (prefix !== void 0 && prefix !== "") {
-        const segments = prefix.split("/");
-        if (prefix.startsWith("/") || /[\\]/.test(prefix) || segments.some((segment) => segment === "..")) {
-          throw new StorageError(
-            400,
-            STORAGE_CODES.invalidPath,
-            `\u975E\u6CD5\u524D\u7F00 "${prefix}"\uFF08\u7981\u6B62 / \u5F00\u5934\u3001\u53CD\u659C\u6760\u6216 .. \u7A7F\u8D8A\uFF09`
-          );
-        }
-      }
+      assertStoragePrefix(prefix);
       const root = bucketDir(projectId);
       const metas = [];
       const walk = async (dir, relative) => {
@@ -2156,7 +2435,7 @@ function createSimStorageCapability(options) {
   return { bundle, driver };
 }
 
-// packages/cli/src/sim/realtime.ts
+// packages/runtime/src/sim/realtime.ts
 var SimRealtime = class {
   seq = 0;
   subscribers = /* @__PURE__ */ new Map();
@@ -2278,10 +2557,7 @@ function createSimRealtimeCapability() {
   };
 }
 
-// packages/cli/src/sim/runtime.ts
-function simDir(cwd) {
-  return join4(cwd, ".adep", "sim");
-}
+// packages/runtime/src/sim/merge.ts
 function mergeBundles(bundles) {
   const capabilities = [];
   const byName = /* @__PURE__ */ new Map();
@@ -2301,6 +2577,11 @@ function mergeBundles(bundles) {
   }
   return { capabilities, rpcHandlers };
 }
+
+// packages/cli/src/sim/runtime.ts
+function simDir(cwd) {
+  return join4(cwd, ".adep", "sim");
+}
 function jsonStorage(cwd) {
   const file = join4(simDir(cwd), "db.json");
   return {
@@ -2416,12 +2697,21 @@ function createSimInvokeHandler(options) {
   };
 }
 
-// packages/cli/src/builtin-deps.ts
-var LOCAL_STATE_OBJECTS_SPECIFIER = "@adep/runtime/state-objects";
-var LOCAL_BUILTIN_DEPS = [
-  "@adep/cf-compat",
-  LOCAL_STATE_OBJECTS_SPECIFIER
+// shared/builtin-deps.ts
+var CF_COMPAT_SPECIFIER = "@adep/cf-compat";
+var STATE_OBJECTS_SPECIFIER = "@adep/runtime/state-objects";
+var BUILTIN_DEPS = [
+  CF_COMPAT_SPECIFIER,
+  STATE_OBJECTS_SPECIFIER,
+  "axios",
+  "lodash",
+  "dayjs",
+  "zod"
 ];
+var BUILTIN_DEPS_CSV = BUILTIN_DEPS.join(",");
+
+// packages/cli/src/builtin-deps.ts
+var LOCAL_BUILTIN_DEPS = [CF_COMPAT_SPECIFIER, STATE_OBJECTS_SPECIFIER];
 
 // packages/cli/src/sim/boundary.ts
 var SIM_BOUNDARIES = [
@@ -3057,9 +3347,9 @@ function loadFunctionModule(files, entry, sandboxGlobals, resolveBare) {
 
 // packages/runtime/src/state-objects/loader.ts
 var STATE_OBJECTS_ENTRY = "state-objects.ts";
-var STATE_OBJECTS_SPECIFIER = "@adep/runtime/state-objects";
+var STATE_OBJECTS_SPECIFIER2 = "@adep/runtime/state-objects";
 function resolveStateObjectSpecifier(request) {
-  if (request === STATE_OBJECTS_SPECIFIER) return { StateObject };
+  if (request === STATE_OBJECTS_SPECIFIER2) return { StateObject };
   return void 0;
 }
 function defaultStateSandboxGlobals() {
@@ -3381,6 +3671,19 @@ function createSandboxFetch(options) {
   };
 }
 
+// packages/runtime/src/functions/runtime/rpc-wire.ts
+function wireRpcResponses(port, pending) {
+  port.on?.((message) => {
+    const reply = message;
+    if (reply?.type !== "rpc-response" || typeof reply.id !== "number") return;
+    const entry = pending.get(reply.id);
+    if (entry === void 0) return;
+    pending.delete(reply.id);
+    if (reply.ok === true) entry.resolve(reply.result);
+    else entry.reject(new Error(reply.error ?? "RPC \u80FD\u529B\u8C03\u7528\u5931\u8D25"));
+  });
+}
+
 // packages/runtime/src/functions/runtime/chain.ts
 function isChainCapability(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -3452,6 +3755,11 @@ function createChainClient(capability, port, pending, nextId, spec) {
   return makeRoot(void 0);
 }
 
+// packages/runtime/src/shared/regexp.ts
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // packages/runtime/src/functions/runtime/worker-entry.ts
 function isRpcCapability(value) {
   return typeof value === "object" && value !== null && value[RPC_CAPABILITY_KEY] === true;
@@ -3481,9 +3789,6 @@ function errorMessageOf2(error) {
   }
   return String(error);
 }
-function escapeRegExp(text) {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function firstUserFrame(stack, files) {
   for (const key of Object.keys(files)) {
     const match = new RegExp(
@@ -3542,15 +3847,7 @@ function runWorker(input, port) {
   const container = createCloudContainer();
   const pending = /* @__PURE__ */ new Map();
   let rpcId = 0;
-  port.on?.((message) => {
-    const reply = message;
-    if (reply?.type !== "rpc-response" || typeof reply.id !== "number") return;
-    const entry = pending.get(reply.id);
-    if (entry === void 0) return;
-    pending.delete(reply.id);
-    if (reply.ok === true) entry.resolve(reply.result);
-    else entry.reject(new Error(reply.error ?? "RPC \u80FD\u529B\u8C03\u7528\u5931\u8D25"));
-  });
+  wireRpcResponses(port, pending);
   for (const capability of input.capabilities ?? []) {
     container.register(
       capability.name,
@@ -3656,32 +3953,39 @@ if (workerPort !== null && workerData !== void 0) {
   runWorker(workerData, port);
 }
 
-// packages/cli/src/dev.ts
-async function loadConfig(cwd) {
-  const name = basename(resolve2(cwd));
-  const config = await loadAdepConfigModule(cwd);
-  return {
-    name: config?.name ?? name,
-    functionsDir: config?.functionsDir ?? "functions",
-    functionsPrefix: config?.functions_prefix ?? "",
-    ...config?.environment === void 0 ? {} : { environment: config.environment }
+// packages/cli/src/dev-shared.ts
+import { readdir as readdir2, readFile as readFile5 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+var BEARER_TOKEN_RE = /^Bearer\s+(.+)$/i;
+function bearerUserResolverFromEnv() {
+  const raw = process.env.ADEP_AUTH_ISSUER;
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  return createBearerUserResolver(raw.trim());
+}
+function createBearerUserResolver(issuer) {
+  const userinfoUrl = `${issuer.replace(/\/+$/, "")}/oauth/userinfo`;
+  return async (headers) => {
+    const match = BEARER_TOKEN_RE.exec((headers["authorization"] ?? "").trim());
+    const token = match?.[1]?.trim();
+    if (token === void 0 || token === "") return null;
+    try {
+      const res = await fetch(userinfoUrl, { headers: { authorization: `Bearer ${token}` } });
+      if (!res.ok) return null;
+      const claims = await res.json();
+      if (typeof claims.sub !== "string" || claims.sub.length === 0) return null;
+      return {
+        id: claims.sub,
+        ...typeof claims.name === "string" ? { name: claims.name } : {},
+        ...typeof claims.email === "string" ? { email: claims.email } : {}
+      };
+    } catch {
+      return null;
+    }
   };
 }
-function parseEnvFile(content) {
-  const env = {};
-  for (const raw of content.split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line.length === 0 || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq === -1) continue;
-    const key = line.slice(0, eq).trim();
-    if (key.length === 0) continue;
-    env[key] = line.slice(eq + 1).trim();
-  }
-  return env;
-}
 async function collectFunctions(dir) {
   const files = {};
+  const isRuntimeSource = (name) => (name.endsWith(".ts") || name.endsWith(".js")) && !name.endsWith(".d.ts") && !name.endsWith(".test.ts");
   const walk = async (sub, prefix) => {
     let entries;
     try {
@@ -3694,7 +3998,7 @@ async function collectFunctions(dir) {
       const full = join8(sub, entry.name);
       if (entry.isDirectory()) {
         await walk(full, rel);
-      } else if (entry.isFile() && entry.name.endsWith(".ts")) {
+      } else if (entry.isFile() && isRuntimeSource(entry.name)) {
         files[rel] = await readFile5(full, "utf8");
       }
     }
@@ -3721,6 +4025,42 @@ function bodyOf(req) {
     req.on("error", rejectBody);
   });
 }
+function writeJson(res, status, payload) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(payload));
+}
+async function requestInput(url, req, readBody) {
+  const query = {};
+  for (const key of new Set(url.searchParams.keys())) {
+    const values = url.searchParams.getAll(key);
+    query[key] = values.length > 1 ? values.join(",") : values[0] ?? "";
+  }
+  const headers = {};
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (typeof value === "string") headers[key] = value;
+  }
+  const body = req.method === "GET" || req.method === "HEAD" ? void 0 : await readBody(req);
+  return {
+    method: req.method ?? "GET",
+    path: url.pathname,
+    query,
+    headers,
+    ...body === void 0 ? {} : { body }
+  };
+}
+
+// packages/cli/src/dev.ts
+async function loadConfig(cwd) {
+  const name = basename(resolve2(cwd));
+  const config = await loadAdepConfigModule(cwd);
+  return {
+    name: config?.name ?? name,
+    functionsDir: config?.functionsDir ?? "functions",
+    functionsPrefix: config?.functions_prefix ?? "",
+    ...config?.environment === void 0 ? {} : { environment: config.environment }
+  };
+}
+var parseEnvFile = parseEnv;
 function resolveRouteFnName(pathname, prefix) {
   const segments = pathname.split("/").filter((segment) => segment.length > 0);
   const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
@@ -3747,10 +4087,6 @@ function resolveRouteFnName(pathname, prefix) {
   }
   return { fnName: second };
 }
-function writeJson(res, status, payload) {
-  res.writeHead(status, { "content-type": "application/json" });
-  res.end(JSON.stringify(payload));
-}
 function printBoundaries(log) {
   log("[adep] \u80FD\u529B\u8FB9\u754C\uFF08\u6A21\u62DF\u8FD0\u884C\u65F6\u53EA\u66FF\u6362\u4F20\u8F93/\u6301\u4E45\u5316\uFF0C\u4E0D\u6539\u5199\u8BED\u4E49\uFF09\uFF1A");
   for (const b of SIM_BOUNDARIES) {
@@ -3758,8 +4094,8 @@ function printBoundaries(log) {
   }
 }
 async function ensureGitignore(cwd) {
-  const gitignorePath = join8(cwd, ".gitignore");
-  const existing = await readFile5(gitignorePath, "utf8").catch(() => "");
+  const gitignorePath = join9(cwd, ".gitignore");
+  const existing = await readFile6(gitignorePath, "utf8").catch(() => "");
   if (existing.split(/\r?\n/).includes(".adep/")) return;
   await writeFile3(gitignorePath, `${existing.replace(/\n+$/, "")}
 .adep/
@@ -3773,8 +4109,9 @@ async function startDevServer(options) {
   if (options.prefix !== void 0) {
     config.functionsPrefix = options.prefix.replace(/^\/+|\/+$/g, "");
   }
-  const functionsDir = join8(cwd, config.functionsDir);
+  const functionsDir = join9(cwd, config.functionsDir);
   const coldStartAt = Date.now();
+  const bearerUser = bearerUserResolverFromEnv();
   const executor = new WorkerFunctionExecutor({
     deps: { rootDir: cwd, builtin: LOCAL_BUILTIN_DEPS }
   });
@@ -3865,12 +4202,12 @@ async function startDevServer(options) {
   const reload = async () => {
     const [nextFiles, envText2] = await Promise.all([
       collectFunctions(functionsDir),
-      readFile5(join8(cwd, ".env.local"), "utf8").catch(() => "")
+      readFile6(join9(cwd, ".env.local"), "utf8").catch(() => "")
     ]);
     files = nextFiles;
     env = { ...config.environment, ...parseEnvFile(envText2) };
   };
-  const envText = await readFile5(join8(cwd, ".env.local"), "utf8").catch(() => "");
+  const envText = await readFile6(join9(cwd, ".env.local"), "utf8").catch(() => "");
   env = { ...config.environment, ...parseEnvFile(envText) };
   let debounceTimer;
   let watcher;
@@ -3885,29 +4222,15 @@ async function startDevServer(options) {
     watcher = void 0;
   }
   const buildInput = async (fnName, entry, url, req) => {
-    const query = {};
-    for (const key of new Set(url.searchParams.keys())) {
-      const values = url.searchParams.getAll(key);
-      query[key] = values.length > 1 ? values.join(",") : values[0] ?? "";
-    }
-    const headers = {};
-    for (const [key, value] of Object.entries(req.headers)) {
-      if (typeof value === "string") headers[key] = value;
-    }
-    const body = req.method === "GET" || req.method === "HEAD" ? void 0 : await bodyOf(req);
     const hasEnv = Object.keys(env).length > 0;
+    const request = await requestInput(url, req, bodyOf);
+    if (bearerUser !== void 0) request.user = await bearerUser(request.headers);
     return {
       project: { id: "local", slug: config.name },
       fn: { id: fnName, name: fnName },
       files,
       entry,
-      request: {
-        method: req.method ?? "GET",
-        path: url.pathname,
-        query,
-        headers,
-        ...body === void 0 ? {} : { body }
-      },
+      request,
       // 模拟运行时能力：db / storage / realtime 各自只读复用线上装配，语义一致。
       capabilities: dbBundle.capabilities,
       rpcHandlers: {
@@ -4044,6 +4367,9 @@ async function startDevServer(options) {
   log(`[adep] dev server listening on ${baseUrl}\uFF08\u6A21\u62DF\u8FD0\u884C\u65F6\uFF0C\u51B7\u542F\u52A8 ${coldStartMs}ms\uFF09`);
   log(`[adep] curl \u793A\u4F8B\uFF1Acurl ${baseUrl}${curlPath}`);
   printBoundaries(log);
+  if (bearerUser !== void 0) {
+    log(`[adep] \u767B\u5F55\u5373\u670D\u52A1\uFF1AADEP_AUTH_ISSUER \u5DF2\u914D\u7F6E\uFF0CBearer token \u5C06\u89E3\u6790\u4E3A\u7528\u6237\u8EAB\u4EFD\uFF08userinfo \u7AEF\u70B9\uFF09`);
+  }
   log(`[adep] \u6A21\u62DF\u6570\u636E\u76EE\u5F55\uFF1A${simDir(cwd)}`);
   startStateAlarmScheduler();
   return {