@adep/runtime 0.1.0 → 0.1.2

package/dist/database/builder/ulid.d.ts

@@ -1,3 +1,19 @@
+/**
+ * ULID 生成器（DB-006 owned 表主键）。
+ *
+ * 128 位 = 48 位毫秒时间戳 + 80 位随机，Crockford Base32 编码，26 字符。
+ * 性质（Gherkin Scenario：owned 表行主键为 ULID 且本地可生成）：
+ * - **时间有序**：高位是毫秒时间戳，新生成的 ULID 字典序严格 ≥ 旧值；
+ * - **单调**：同一毫秒内对随机段 +1 递增，保证同毫秒生成不冲突；
+ * - **离线可生成**：纯本地随机，无中心协调（对比 UUID v4 需中心分配）。
+ *
+ * 纯函数模块，无运行时依赖；离线/本地节点可用相同逻辑复现（M8 同步客户端）。
+ *
+ * FN-023 起随机源走 `crypto.getRandomValues`（浏览器 / Node19+ / Bun 全 realm 同形），
+ * 不再 import `node:crypto`——`@adep/runtime` 的 builder 模块要进浏览器 bundle
+ * （离线模拟运行时复用 `createDbCapability`），node-only import 会让打包直接失败。
+ * 退化分支（非安全上下文无 crypto）仅覆盖模拟/开发场景，主键唯一性由单调段兜底。
+ */
 /** ULID 合法字符集（用于校验：`^[0-9A-HJKMNP-TV-Z]{26}$`）。 */
 export declare const ULID_PATTERN: RegExp;
 /**

package/dist/index.d.ts

@@ -32,4 +32,9 @@ export type { StorageDriver, StoredFileMeta, FileVisibility } from './storage/dr
 export { StorageError, STORAGE_CODES } from './storage/driver';
 export { signDownloadUrl, verifyDownloadSignature } from './storage/signature';
 export type { DownloadSignerConfig } from './storage/signature';
+export { hmacSha256, hmacSha256Hex, sha256, constantTimeEqual } from './storage/hmac-sha256';
+export { SimSqlEngine, SimDbError } from './sim/sql-engine';
+export type { SimTable, EngineStorage } from './sim/sql-engine';
+export { SimRealtime, createSimRealtimeCapability, REALTIME_CODES } from './sim/realtime';
+export type { SimRealtimeSubscription } from './sim/realtime';
 export { resolveFunctionSource, parseSnapshot } from './shared/function-source';

package/dist/index.js

@@ -35,6 +35,20 @@ var DB_RPC = {
   /** 执行一条链：`chain, args=[ChainRequest]`。 */
   chain: "chain"
 };
+var REALTIME_CAPABILITY_CODES = {
+  invalidMethod: "REALTIME_INVALID_METHOD",
+  unsupportedArg: "REALTIME_UNSUPPORTED_ARG",
+  subscriptionNotFound: "REALTIME_SUBSCRIPTION_NOT_FOUND",
+  tooManySubscriptions: "REALTIME_TOO_MANY_SUBSCRIPTIONS",
+  /** 线上独有：订阅授权策略（RT-002 `SubscriptionPolicy`）拒绝该 channel。 */
+  channelDenied: "REALTIME_CHANNEL_DENIED"
+};
+var REALTIME_CAPABILITY_METHODS = [
+  "publish",
+  "subscribe",
+  "receive",
+  "unsubscribe"
+];
 
 // packages/runtime/src/functions/runtime/worker-executor.ts
 import { readFileSync } from "node:fs";
@@ -301,9 +315,6 @@ var WorkerFunctionExecutor = class {
   }
 };
 
-// packages/runtime/src/database/sdk/cloud.ts
-import { randomUUID } from "node:crypto";
-
 // packages/runtime/src/database/builder/dialect.ts
 var sqliteDialect = {
   name: "sqlite",
@@ -485,7 +496,6 @@ async function readChanges(driver, table, query = {}) {
 }
 
 // packages/runtime/src/database/builder/ulid.ts
-import { randomFillSync } from "node:crypto";
 var ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var TIME_LEN = 10;
 var RANDOM_LEN = 16;
@@ -526,6 +536,16 @@ function incrBase32(prev) {
   }
   return chars.join("");
 }
+function randomFill(bytes) {
+  const source = globalThis.crypto;
+  if (source !== void 0 && typeof source.getRandomValues === "function") {
+    return source.getRandomValues(bytes);
+  }
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Math.floor(Math.random() * 256);
+  }
+  return bytes;
+}
 function ulid(now = Date.now()) {
   const time = encodeTime(now);
   let random;
@@ -534,7 +554,7 @@ function ulid(now = Date.now()) {
   } else {
     lastTime = now;
     const bytes = new Uint8Array(10);
-    randomFillSync(bytes);
+    randomFill(bytes);
     random = encodeRandom(bytes);
   }
   lastRandom = random;
@@ -982,7 +1002,7 @@ function createDbCapability(driver, options = {}) {
         case DB_RPC.begin: {
           if (activeTxs.size > 0) throw unsafeOperation("\u4E0D\u5141\u8BB8\u5D4C\u5957\u4E8B\u52A1");
           await driver.run("BEGIN");
-          const txId = randomUUID();
+          const txId = crypto.randomUUID();
           activeTxs.set(txId, true);
           return txId;
         }
@@ -1059,14 +1079,182 @@ function assertSafeStoragePath(path) {
   return path;
 }
 
+// packages/runtime/src/storage/hmac-sha256.ts
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function compress(h, block, w) {
+  for (let i = 0; i < 16; i += 1) {
+    const j = i * 4;
+    w[i] = (block[j] ?? 0) << 24 | (block[j + 1] ?? 0) << 16 | (block[j + 2] ?? 0) << 8 | (block[j + 3] ?? 0);
+  }
+  for (let i = 16; i < 64; i += 1) {
+    const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+    const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+    w[i] = w[i - 16] + s0 + w[i - 7] + s1 | 0;
+  }
+  let [a, b, c, d, e, f, g, hh] = [h[0], h[1], h[2], h[3], h[4], h[5], h[6], h[7]];
+  for (let i = 0; i < 64; i += 1) {
+    const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+    const ch = e & f ^ ~e & g;
+    const t1 = hh + S1 + ch + K[i] + w[i] | 0;
+    const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+    const maj = a & b ^ a & c ^ b & c;
+    const t2 = S0 + maj | 0;
+    hh = g;
+    g = f;
+    f = e;
+    e = d + t1 | 0;
+    d = c;
+    c = b;
+    b = a;
+    a = t1 + t2 | 0;
+  }
+  h[0] = h[0] + a | 0;
+  h[1] = h[1] + b | 0;
+  h[2] = h[2] + c | 0;
+  h[3] = h[3] + d | 0;
+  h[4] = h[4] + e | 0;
+  h[5] = h[5] + f | 0;
+  h[6] = h[6] + g | 0;
+  h[7] = h[7] + hh | 0;
+}
+function sha256(data) {
+  const h = new Uint32Array([
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ]);
+  const bitLength = data.length * 8;
+  const paddedLength = Math.ceil((data.length + 9) / 64) * 64;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(data);
+  padded[data.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 4294967296), false);
+  const w = new Uint32Array(64);
+  for (let offset = 0; offset < paddedLength; offset += 64) {
+    compress(h, padded.subarray(offset, offset + 64), w);
+  }
+  const out = new Uint8Array(32);
+  const outView = new DataView(out.buffer);
+  for (let i = 0; i < 8; i += 1) outView.setUint32(i * 4, h[i], false);
+  return out;
+}
+function toBytes(input) {
+  if (typeof input !== "string") return input;
+  return new TextEncoder().encode(input);
+}
+function hmacSha256(key, message) {
+  const blockSize = 64;
+  let keyBytes = toBytes(key);
+  if (keyBytes.length > blockSize) keyBytes = sha256(keyBytes);
+  const padded = new Uint8Array(blockSize);
+  padded.set(keyBytes);
+  const inner = new Uint8Array(blockSize);
+  const outer = new Uint8Array(blockSize);
+  for (let i = 0; i < blockSize; i += 1) {
+    inner[i] = padded[i] ^ 54;
+    outer[i] = padded[i] ^ 92;
+  }
+  const innerInput = new Uint8Array(blockSize + toBytes(message).length);
+  innerInput.set(inner);
+  innerInput.set(toBytes(message), blockSize);
+  const innerHash = sha256(innerInput);
+  const outerInput = new Uint8Array(blockSize + 32);
+  outerInput.set(outer);
+  outerInput.set(innerHash, blockSize);
+  return sha256(outerInput);
+}
+function hmacSha256Hex(key, message) {
+  return [...hmacSha256(key, message)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
 // packages/runtime/src/storage/signature.ts
-import { createHmac, timingSafeEqual } from "node:crypto";
 var DEFAULT_SIGN_TTL_SECONDS = 15 * 60;
 var SIGN_EXPIRES_KEY = "x-expires";
 var SIGN_SIGNATURE_KEY = "x-signature";
 function sign(secret, projectId, path, expires) {
   const payload = `${projectId}|${path}|${expires}`;
-  return createHmac("sha256", secret).update(payload).digest("hex");
+  return hmacSha256Hex(secret, payload);
 }
 function signDownloadUrl(config, projectId, path, ttlSeconds = DEFAULT_SIGN_TTL_SECONDS) {
   const expires = Math.floor(Date.now() / 1e3) + ttlSeconds;
@@ -1085,9 +1273,7 @@ function verifyDownloadSignature(config, projectId, path, query, nowSeconds = Ma
   if (!Number.isFinite(expires)) return { ok: false, reason: "malformed" };
   if (nowSeconds > expires) return { ok: false, reason: "expired" };
   const expected = sign(config.secret, projectId, path, expires);
-  const actual = Buffer.from(signatureRaw, "utf8");
-  const candidate = Buffer.from(expected, "utf8");
-  if (actual.length !== candidate.length || !timingSafeEqual(actual, candidate)) {
+  if (!constantTimeEqual(signatureRaw, expected)) {
     return { ok: false, reason: "invalid" };
   }
   return { ok: true };
@@ -1359,6 +1545,546 @@ function createLocalStorageDriver(options) {
   };
 }
 
+// packages/runtime/src/sim/sql-engine.ts
+var SimDbError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SimDbError";
+  }
+};
+var ParamCursor = class {
+  constructor(params) {
+    this.params = params;
+  }
+  index = 0;
+  take() {
+    const v = this.params[this.index];
+    this.index += 1;
+    return v ?? null;
+  }
+};
+function ident(raw) {
+  return raw.trim().replace(/^"|"$/g, "").trim();
+}
+function toNumber(raw) {
+  const t = raw.trim();
+  if (t === "?") return null;
+  const n = Number(t);
+  return Number.isNaN(n) ? null : n;
+}
+function stripQuotes(raw) {
+  const t = raw.trim();
+  if (/^'.*'$/.test(t)) return t.slice(1, -1);
+  if (/^".*"$/.test(t)) return t.slice(1, -1);
+  return t;
+}
+function parseCreateTable(ddl) {
+  const m = /^CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s*\(([\s\S]*)\)$/i.exec(
+    ddl.trim()
+  );
+  if (m === null) return null;
+  const name = ident(m[1]);
+  const body = m[3];
+  const columns = [];
+  for (const part of body.split(",")) {
+    const tokens = part.trim().split(/\s+/);
+    const colName = ident(tokens[0] ?? "");
+    const type = (tokens[1] ?? "TEXT").toUpperCase();
+    const primaryKey = tokens.includes("PRIMARY") && tokens.includes("KEY");
+    const autoincrement = primaryKey && tokens.includes("AUTOINCREMENT");
+    columns.push({ name: colName, type, primaryKey, autoincrement });
+  }
+  return { name, columns };
+}
+function parseWhereClauses(whereRaw, cursor) {
+  const clauses = [];
+  for (const part of whereRaw.split(/\s+AND\s+/i)) {
+    const t = part.trim();
+    if (t.length === 0) continue;
+    if (/\bIS\s+NULL\b/i.test(t)) {
+      const col2 = ident(t.split(/\s+IS\s+NULL\b/i)[0] ?? "");
+      clauses.push({ column: col2, operator: "IS NULL", value: null, list: false });
+      continue;
+    }
+    if (/\bIS\s+NOT\s+NULL\b/i.test(t)) {
+      const col2 = ident(t.split(/\s+IS\s+NOT\s+NULL\b/i)[0] ?? "");
+      clauses.push({ column: col2, operator: "IS NOT NULL", value: null, list: false });
+      continue;
+    }
+    const opMatch = /^\s*((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s*(=|!=|>=|<=|>|<|like|in|not\s+in)\s*(.+)$/i.exec(
+      t
+    );
+    if (opMatch === null) continue;
+    const col = ident(opMatch[1] ?? "");
+    const op = (opMatch[3] ?? opMatch[2] ?? "").toLowerCase();
+    const rhs = (opMatch[4] ?? "").trim();
+    if (op === "in" || op === "not in") {
+      const inner = rhs.replace(/^\(|\)$/g, "");
+      const items = splitListItems(inner);
+      const list = items.map((item) => {
+        if (item.trim() === "?") return cursor.take();
+        return stripQuotes(item);
+      });
+      clauses.push({ column: col, operator: op, value: list, list: true });
+      continue;
+    }
+    let value;
+    if (rhs === "?") {
+      value = cursor.take();
+    } else {
+      value = stripQuotes(rhs);
+    }
+    clauses.push({ column: col, operator: op, value, list: false });
+  }
+  return clauses;
+}
+function matchWhere(clauses, row) {
+  return clauses.every((c) => matchValue(row[c.column], c));
+}
+function splitListItems(inner) {
+  const items = [];
+  let depth = 0;
+  let buffer = "";
+  for (let i = 0; i < inner.length; i += 1) {
+    const ch = inner[i];
+    if (ch === "(") depth += 1;
+    else if (ch === ")") depth -= 1;
+    if (ch === "," && depth === 0) {
+      items.push(buffer);
+      buffer = "";
+    } else {
+      buffer += ch;
+    }
+  }
+  items.push(buffer);
+  return items;
+}
+function matchValue(value, clause) {
+  const op = clause.operator;
+  if (op === "IS NULL") return value === null || value === void 0;
+  if (op === "IS NOT NULL") return value !== null && value !== void 0;
+  if (op === "in") return clause.value.some((item) => value === item);
+  if (op === "not in") return !clause.value.some((item) => value === item);
+  if (op === "like") {
+    if (typeof value !== "string") return false;
+    const pattern = String(clause.value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/%/g, ".*").replace(/_/g, ".");
+    return new RegExp(`^${pattern}$`, "s").test(value);
+  }
+  const left = value;
+  const right = clause.value;
+  switch (op) {
+    case "=":
+      return left !== null && right !== null && left === right;
+    case "!=":
+      return left !== null && right !== null && left !== right;
+    case ">":
+      return left !== null && right !== null && left > right;
+    case ">=":
+      return left !== null && right !== null && left >= right;
+    case "<":
+      return left !== null && right !== null && left < right;
+    case "<=":
+      return left !== null && right !== null && left <= right;
+    default:
+      return false;
+  }
+}
+function assertReadOnly(sql) {
+  const stripped = sql.replace(/'[^']*(?:''[^']*)*'/g, "").replace(/"[^"]*(?:""[^"]*)*"/g, "").replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+  if (stripped.includes(";")) throw new SimDbError("DB_UNSAFE_OP", "\u4EC5\u5141\u8BB8\u5355\u6761\u8BED\u53E5\uFF0C\u7981\u6B62\u591A\u8BED\u53E5\u5806\u53E0");
+  const head = stripped.trim().replace(/^\(+/, "").trim().toUpperCase();
+  if (!head.startsWith("SELECT") && !head.startsWith("WITH")) {
+    throw new SimDbError("DB_UNSAFE_OP", "cloud.db.query \u4EC5\u5141\u8BB8\u53EA\u8BFB\u67E5\u8BE2\uFF08SELECT / WITH\uFF09");
+  }
+  if (/ATTACH|DETACH/.test(stripped.toUpperCase())) {
+    throw new SimDbError("DB_UNSAFE_OP", "\u7981\u6B62\u8DE8\u5E93\u64CD\u4F5C\uFF08ATTACH / DETACH\uFF09");
+  }
+  if (/SQLITE_\w+/i.test(stripped) && !/SQLITE_MASTER\b/i.test(stripped)) {
+    throw new SimDbError("DB_UNSAFE_OP", "\u7981\u6B62\u8BBF\u95EE\u7CFB\u7EDF\u8868\uFF08sqlite_*\uFF09");
+  }
+}
+var SimSqlEngine = class {
+  tables = {};
+  storage;
+  memoryOnly;
+  savepointDepth = 0;
+  txSnapshot = null;
+  constructor(options = {}) {
+    this.storage = options.storage ?? { load: async () => null, save: async () => void 0 };
+    this.memoryOnly = options.memoryOnly ?? false;
+  }
+  async load() {
+    if (this.memoryOnly) return;
+    const persisted = await this.storage.load();
+    if (persisted !== null) this.tables = persisted;
+  }
+  async persist() {
+    if (this.memoryOnly) return;
+    await this.storage.save(this.tables);
+  }
+  ensureTable(name) {
+    let table = this.tables[name];
+    if (table === void 0) {
+      table = { columns: [], rows: [], nextAutoincrement: 1 };
+      this.tables[name] = table;
+    }
+    return table;
+  }
+  applyAutoincrement(table, row) {
+    const pk = table.columns.find((c) => c.primaryKey && c.autoincrement);
+    if (pk === void 0) return;
+    const val = row[pk.name];
+    if (val !== null && val !== void 0) {
+      const n = Number(val);
+      if (Number.isInteger(n) && n >= table.nextAutoincrement) table.nextAutoincrement = n + 1;
+      return;
+    }
+    row[pk.name] = table.nextAutoincrement;
+    table.nextAutoincrement += 1;
+  }
+  catalog() {
+    const out = [];
+    for (const [name] of Object.entries(this.tables)) {
+      out.push({ type: "table", name, tbl_name: name });
+    }
+    return out;
+  }
+  async run(sql, params = []) {
+    const stmt = sql.trim();
+    if (/^BEGIN\s*$/i.test(stmt)) {
+      this.txSnapshot = structuredClone(this.tables);
+      return { changes: 0 };
+    }
+    if (/^COMMIT\s*$/i.test(stmt)) {
+      this.txSnapshot = null;
+      await this.persist();
+      return { changes: 0 };
+    }
+    if (/^ROLLBACK\s*$/i.test(stmt)) {
+      if (this.txSnapshot !== null) {
+        this.tables = this.txSnapshot;
+        this.txSnapshot = null;
+      }
+      await this.persist();
+      return { changes: 0 };
+    }
+    if (/^SAVEPOINT\s+/i.test(stmt)) {
+      this.savepointDepth += 1;
+      return { changes: 0 };
+    }
+    if (/^RELEASE\s+SAVEPOINT\s+/i.test(stmt)) {
+      this.savepointDepth = Math.max(0, this.savepointDepth - 1);
+      return { changes: 0 };
+    }
+    if (/^ROLLBACK\s+TO\s+SAVEPOINT\s+/i.test(stmt)) return { changes: 0 };
+    if (/^CREATE\s+TABLE/i.test(stmt)) {
+      const parsed = parseCreateTable(stmt);
+      if (parsed === null) throw new SimDbError("DB_UNSAFE_OP", `\u65E0\u6CD5\u89E3\u6790\u5EFA\u8868\u8BED\u53E5`);
+      if (this.tables[parsed.name] === void 0) {
+        this.tables[parsed.name] = { columns: parsed.columns, rows: [], nextAutoincrement: 1 };
+        await this.persist();
+      }
+      return { changes: 0 };
+    }
+    if (/^INSERT\s+INTO/i.test(stmt)) return this.execInsert(stmt, params);
+    if (/^UPDATE\s+/i.test(stmt)) return this.execUpdate(stmt, params);
+    if (/^DELETE\s+FROM/i.test(stmt)) return this.execDelete(stmt, params);
+    throw new SimDbError("DB_UNSAFE_OP", `sim SQL \u5F15\u64CE\u4E0D\u652F\u6301\u8BE5\u8BED\u53E5`);
+  }
+  execInsert(sql, params) {
+    const match = /^INSERT\s+INTO\s+((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s*\(([^)]*)\)\s*VALUES\s*([\s\S]+)$/i.exec(
+      sql
+    );
+    if (match === null) throw new SimDbError("DB_UNSAFE_OP", "\u65E0\u6CD5\u89E3\u6790 INSERT");
+    const tableName = ident(match[1]);
+    const cols = match[3].split(",").map(ident);
+    const valueBody = match[4].trim();
+    const cursor = new ParamCursor(params);
+    const table = this.ensureTable(tableName);
+    let inserted = 0;
+    for (const group of splitListItems(valueBody)) {
+      const inner = group.trim().replace(/^\(|\)$/g, "");
+      const values = splitListItems(inner).map(
+        (item) => item.trim() === "?" ? cursor.take() : stripQuotes(item)
+      );
+      const row = {};
+      cols.forEach((col, i) => {
+        row[col] = values[i] ?? null;
+      });
+      this.applyAutoincrement(table, row);
+      table.rows.push(row);
+      inserted += 1;
+    }
+    void this.persist();
+    return { changes: inserted };
+  }
+  execUpdate(sql, params) {
+    const match = /^UPDATE\s+((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s+SET\s+([\s\S]+?)\s+WHERE\s+([\s\S]+)$/i.exec(
+      sql
+    );
+    if (match === null) throw new SimDbError("DB_UNSAFE_OP", "UPDATE \u5FC5\u987B\u5E26 WHERE");
+    const tableName = ident(match[1]);
+    const setRaw = match[3];
+    const whereRaw = match[4];
+    const cursor = new ParamCursor(params);
+    const sets = splitListItems(setRaw).map((part) => {
+      const [col, , mark] = part.trim().split(/\s+/);
+      return { col: ident(col ?? ""), mark: mark ?? "?" };
+    });
+    const table = this.ensureTable(tableName);
+    const boundSets = sets.map((set) => ({
+      col: set.col,
+      value: set.mark === "?" ? cursor.take() : stripQuotes(set.mark)
+    }));
+    const whereClauses = parseWhereClauses(whereRaw, cursor);
+    let changes = 0;
+    for (const row of table.rows) {
+      if (!matchWhere(whereClauses, row)) continue;
+      for (const set of boundSets) {
+        row[set.col] = set.value;
+      }
+      changes += 1;
+    }
+    void this.persist();
+    return { changes };
+  }
+  execDelete(sql, params) {
+    const match = /^DELETE\s+FROM\s+((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s+WHERE\s+([\s\S]+)$/i.exec(sql);
+    if (match === null) throw new SimDbError("DB_UNSAFE_OP", "DELETE \u5FC5\u987B\u5E26 WHERE");
+    const tableName = ident(match[1]);
+    const whereRaw = match[3];
+    const cursor = new ParamCursor(params);
+    const table = this.ensureTable(tableName);
+    const whereClauses = parseWhereClauses(whereRaw, cursor);
+    const keep = [];
+    let changes = 0;
+    for (const row of table.rows) {
+      if (!matchWhere(whereClauses, row)) keep.push(row);
+      else changes += 1;
+    }
+    table.rows = keep;
+    void this.persist();
+    return { changes };
+  }
+  select(sql, params) {
+    const m = /^SELECT\s+([\s\S]+?)\s+FROM\s+((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))([\s\S]*)$/i.exec(
+      sql.trim()
+    );
+    if (m === null) throw new SimDbError("DB_UNSAFE_OP", "\u65E0\u6CD5\u89E3\u6790 SELECT");
+    const selectRaw = m[1].trim();
+    const tableName = ident(m[2]);
+    const tail = m[4] ?? "";
+    const cursor = new ParamCursor(params);
+    if (tableName.toLowerCase() === "sqlite_master") {
+      return project(this.catalog(), selectRaw);
+    }
+    const table = this.ensureTable(tableName);
+    const whereMatch = /\bWHERE\b/i.exec(tail);
+    const orderMatch = /\bORDER\s+BY\b/i.exec(tail);
+    const limitMatch = /\bLIMIT\b/i.exec(tail);
+    const offsetMatch = /\bOFFSET\b/i.exec(tail);
+    const whereRaw = whereMatch === null ? "" : tail.slice(
+      whereMatch.index + whereMatch[0].length,
+      indexAfter(whereMatch.index, [orderMatch, limitMatch, offsetMatch], tail)
+    );
+    let rows = table.rows;
+    if (whereRaw.trim().length > 0) {
+      const clauses = parseWhereClauses(whereRaw, cursor);
+      rows = rows.filter((row) => matchWhere(clauses, row));
+    }
+    if (orderMatch !== null) {
+      const orderRaw = tail.slice(
+        orderMatch.index + orderMatch[0].length,
+        indexAfter(orderMatch.index, [limitMatch, offsetMatch], tail)
+      );
+      const oc = /^\s*((?:"[^"]+")|([A-Za-z_][A-Za-z0-9_]*))\s+(asc|desc)/i.exec(orderRaw);
+      if (oc !== null) {
+        const col = ident(oc[1]);
+        const dir = oc[3].toLowerCase();
+        rows = [...rows].toSorted((a, b) => {
+          const av = a[col];
+          const bv = b[col];
+          const cmp = av === bv ? 0 : av === null ? -1 : bv === null ? 1 : av > bv ? 1 : -1;
+          return dir === "desc" ? -cmp : cmp;
+        });
+      }
+    }
+    if (limitMatch !== null) {
+      const limRaw = tail.slice(
+        limitMatch.index + limitMatch[0].length,
+        indexAfter(limitMatch.index, [offsetMatch], tail)
+      );
+      const lim = limRaw.trim() === "?" ? cursor.take() : toNumber(limRaw);
+      if (typeof lim === "number") rows = rows.slice(0, lim);
+    }
+    if (offsetMatch !== null) {
+      const offRaw = tail.slice(
+        offsetMatch.index + offsetMatch[0].length,
+        indexAfter(offsetMatch.index, [limitMatch], tail)
+      );
+      const off = offRaw.trim() === "?" ? cursor.take() : toNumber(offRaw);
+      if (typeof off === "number") rows = rows.slice(off);
+    }
+    return project(rows, selectRaw);
+  }
+  async all(sql, params = []) {
+    assertReadOnly(sql);
+    return this.select(sql, params);
+  }
+  async get(sql, params = []) {
+    assertReadOnly(sql);
+    return this.select(sql, params)[0] ?? null;
+  }
+  async close() {
+    void this.savepointDepth;
+  }
+};
+function indexAfter(start, matches, tail) {
+  const candidates = matches.filter((x) => x !== null && x.index > start).map((x) => x.index);
+  const end = candidates.length === 0 ? -1 : Math.min(...candidates);
+  return end === -1 ? tail.length : end;
+}
+function project(rows, selectRaw) {
+  if (/^count\s*\(\s*\*/i.test(selectRaw) || /^count\s*\(\s*1\)/i.test(selectRaw)) {
+    const alias = selectRaw.match(/\bAS\s+([A-Za-z_][A-Za-z0-9_]*)/i)?.[1] ?? "n";
+    return [{ [alias]: rows.length }];
+  }
+  const constMatch = /^(\d+)\s+AS\s+([A-Za-z_][A-Za-z0-9_]*)/i.exec(selectRaw);
+  if (constMatch !== null) {
+    return [{ [constMatch[2]]: Number(constMatch[1]) }];
+  }
+  if (selectRaw.trim() === "*") return rows;
+  const cols = selectRaw.split(",").map((s) => ident(s.trim()));
+  return rows.map((row) => {
+    const out = {};
+    for (const col of cols) out[col] = row[col];
+    return out;
+  });
+}
+
+// packages/runtime/src/sim/realtime.ts
+var SimRealtime = class {
+  seq = 0;
+  subscribers = /* @__PURE__ */ new Map();
+  /** 向某 channel 广播一条消息；返回被投递的连接数（单进程内）。 */
+  publish(channel, data, publisher) {
+    this.seq += 1;
+    const message = {
+      channel,
+      seq: this.seq,
+      data,
+      publishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...publisher === void 0 ? {} : { publisher }
+    };
+    const set = this.subscribers.get(channel);
+    if (set === void 0) return { delivered: 0 };
+    let delivered = 0;
+    for (const listener of set) {
+      listener(message);
+      delivered += 1;
+    }
+    return { delivered };
+  }
+  /** 订阅某 channel；返回退订函数。 */
+  subscribe(channel, listener) {
+    let set = this.subscribers.get(channel);
+    if (set === void 0) {
+      set = /* @__PURE__ */ new Set();
+      this.subscribers.set(channel, set);
+    }
+    set.add(listener);
+    return () => {
+      set?.delete(listener);
+    };
+  }
+  /** 当前有订阅者的 channel 数（调试用）。 */
+  channelCount() {
+    return this.subscribers.size;
+  }
+};
+var MAX_BUFFERED_MESSAGES = 64;
+var MAX_SUBSCRIPTIONS = 64;
+var REALTIME_CODES = REALTIME_CAPABILITY_CODES;
+function realtimeError(code, message) {
+  return new Error(`[${code}] ${message}`);
+}
+function createSimRealtimeCapability() {
+  const sim = new SimRealtime();
+  const buffers = /* @__PURE__ */ new Map();
+  const disposers = /* @__PURE__ */ new Map();
+  let seq = 0;
+  const handler = async (method, args) => {
+    switch (method) {
+      case "publish": {
+        if (args.length > 2) {
+          throw realtimeError(
+            REALTIME_CODES.unsupportedArg,
+            "\u672C\u5730\u5355\u8FDB\u7A0B\u5185\u5B58\u5E7F\u64AD\u65E0\u8FDE\u63A5\u8EAB\u4EFD\uFF0C\u4E0D\u652F\u6301 publish \u7684 except \u5B9E\u53C2"
+          );
+        }
+        const [channel, data] = args;
+        return sim.publish(channel, data);
+      }
+      case "subscribe": {
+        if (buffers.size >= MAX_SUBSCRIPTIONS) {
+          throw realtimeError(
+            REALTIME_CODES.tooManySubscriptions,
+            `\u672C\u5730\u8BA2\u9605\u6570\u5DF2\u8FBE\u4E0A\u9650 ${String(MAX_SUBSCRIPTIONS)}\uFF0C\u8BF7\u5148 unsubscribe`
+          );
+        }
+        const [channel] = args;
+        seq += 1;
+        const id = `sub-${String(seq)}`;
+        const buffer = [];
+        const off = sim.subscribe(channel, (msg) => {
+          buffer.push(msg);
+          if (buffer.length > MAX_BUFFERED_MESSAGES) buffer.shift();
+        });
+        buffers.set(id, buffer);
+        disposers.set(id, off);
+        return { subscription: id, channel };
+      }
+      case "receive": {
+        const buffer = buffers.get(args[0]);
+        if (buffer === void 0) {
+          throw realtimeError(
+            REALTIME_CODES.subscriptionNotFound,
+            `\u672C\u5730\u8BA2\u9605 "${String(args[0])}" \u4E0D\u5B58\u5728\u6216\u5DF2\u9000\u8BA2`
+          );
+        }
+        return buffer.splice(0, buffer.length);
+      }
+      case "unsubscribe": {
+        const id = args[0];
+        const off = disposers.get(id);
+        if (off === void 0) {
+          throw realtimeError(
+            REALTIME_CODES.subscriptionNotFound,
+            `\u672C\u5730\u8BA2\u9605 "${id}" \u4E0D\u5B58\u5728\u6216\u5DF2\u9000\u8BA2`
+          );
+        }
+        off();
+        disposers.delete(id);
+        buffers.delete(id);
+        return { removed: true };
+      }
+      default:
+        throw realtimeError(
+          REALTIME_CODES.invalidMethod,
+          `\u672A\u77E5\u7684 cloud.realtime \u65B9\u6CD5 "${method}"\uFF08\u53EF\u7528\uFF1A${REALTIME_CAPABILITY_METHODS.join(" / ")}\uFF09`
+        );
+    }
+  };
+  return {
+    bundle: {
+      capabilities: [{ name: "realtime", value: { [RPC_CAPABILITY_KEY]: true } }],
+      rpcHandlers: { realtime: handler }
+    },
+    realtime: sim
+  };
+}
+
 // packages/runtime/src/shared/function-source.ts
 async function resolveFunctionSource(db, fn) {
   const readDraft = async () => {
@@ -1381,17 +2107,26 @@ export {
   DEFAULT_TIMEOUT_MS,
   ExecutorError,
   OOM_CODE,
+  REALTIME_CODES,
   RPC_CAPABILITY_KEY,
   STORAGE_CODES,
+  SimDbError,
+  SimRealtime,
+  SimSqlEngine,
   StorageError,
   TIMEOUT_CODE,
   WorkerFunctionExecutor,
+  constantTimeEqual,
   createCloudDb,
   createDbCapability,
   createLocalStorageDriver,
+  createSimRealtimeCapability,
   createStorageCapability,
+  hmacSha256,
+  hmacSha256Hex,
   parseSnapshot,
   resolveFunctionSource,
+  sha256,
   signDownloadUrl,
   verifyDownloadSignature
 };

package/dist/shared/capability-keys.d.ts

@@ -25,3 +25,19 @@ export declare const DB_RPC: {
     /** 执行一条链：`chain, args=[ChainRequest]`。 */
     readonly chain: "chain";
 };
+/**
+ * `cloud.realtime` 的跨 realm 错误码（FN-020）：与 `STORAGE_*` / `DB_*` 同族，装在 message 前缀里
+ * （worker 只回传 `error.message`）。本地 sim（CLI-007）与线上提供方**共用这一份**——
+ * 两侧各写一份时，函数里 `catch` 的错误码分支会在上线后静默走空。
+ */
+export declare const REALTIME_CAPABILITY_CODES: {
+    readonly invalidMethod: "REALTIME_INVALID_METHOD";
+    readonly unsupportedArg: "REALTIME_UNSUPPORTED_ARG";
+    readonly subscriptionNotFound: "REALTIME_SUBSCRIPTION_NOT_FOUND";
+    readonly tooManySubscriptions: "REALTIME_TOO_MANY_SUBSCRIPTIONS";
+    /** 线上独有：订阅授权策略（RT-002 `SubscriptionPolicy`）拒绝该 channel。 */
+    readonly channelDenied: "REALTIME_CHANNEL_DENIED";
+};
+/** 命令通道可派发的 realtime 方法名（未知方法一律 fail loud）。 */
+export declare const REALTIME_CAPABILITY_METHODS: readonly ["publish", "subscribe", "receive", "unsubscribe"];
+export type RealtimeCapabilityMethod = (typeof REALTIME_CAPABILITY_METHODS)[number];

package/dist/sim/realtime.d.ts

@@ -0,0 +1,64 @@
+/**
+ * SimRealtime（CLI-004）+ `cloud.realtime` 能力装配（CLI-007）：单进程内存广播。
+ *
+ * 以 `RealtimeChannelMessage`（`@adep/types`）为对外形状；单实例语义与 PRD §3.2.9
+ * 硬约束 5 一致：**不支持跨进程 / 跨实例广播**。这是模拟运行时的**能力边界**之一。
+ *
+ * `createSimRealtimeCapability` 把本类装成 `CapabilityBundle`（与 sim db / storage 同款形状：
+ * 能力值以 `RPC_CAPABILITY_KEY` 占位、实现在宿主侧 `rpcHandlers.realtime`），因此函数里
+ * `await ctx.cloud.realtime.publish(...)` 在 `adep dev` 下可达。本地不建 WS 握手（无连接身份），
+ * 函数侧订阅采用**拉取式缓冲**：`subscribe` 注册一条进程内监听并把命中消息留在宿主缓冲里，
+ * 函数用 `receive` 取回，`unsubscribe` 退订。测试 / CLI 也可直接调用类上的 `publish` / `subscribe`。
+ *
+ * **FN-023 移植说明**：本文件自 `packages/cli/src/sim/realtime.ts` 复制进 runtime（CLI 域不在
+ * 该单 touches，CLI 侧暂留自有副本）。两份副本的语义一致性由 `shared/sim-contract.ts` 的
+ * realtime 期望表双向钉死（CLI 测试 + 浏览器驱动测试各跑一遍）；CLI 换口消费本模块留给
+ * CLI 域后续单。浏览器侧（`@adep/web-container`）在本装配之上叠加「回网切真实 WS」的
+ * 传输切换，语义层（广播 / 缓冲 / 错误码）不动。
+ */
+import type { CapabilityBundle, RealtimeChannelMessage } from '@adep/types';
+export declare class SimRealtime {
+    private seq;
+    private readonly subscribers;
+    /** 向某 channel 广播一条消息；返回被投递的连接数（单进程内）。 */
+    publish(channel: string, data: unknown, publisher?: string): {
+        delivered: number;
+    };
+    /** 订阅某 channel；返回退订函数。 */
+    subscribe(channel: string, listener: (msg: RealtimeChannelMessage) => void): () => void;
+    /** 当前有订阅者的 channel 数（调试用）。 */
+    channelCount(): number;
+}
+/**
+ * 错误码自 FN-020 起取自 `@adep/runtime/shared/capability-keys`（本地与线上共用同一份）。
+ * 保留 `REALTIME_CODES` 这个名字与导出，既有 sim 测试与调用点无需改动。
+ */
+export declare const REALTIME_CODES: {
+    readonly invalidMethod: "REALTIME_INVALID_METHOD";
+    readonly unsupportedArg: "REALTIME_UNSUPPORTED_ARG";
+    readonly subscriptionNotFound: "REALTIME_SUBSCRIPTION_NOT_FOUND";
+    readonly tooManySubscriptions: "REALTIME_TOO_MANY_SUBSCRIPTIONS";
+    readonly channelDenied: "REALTIME_CHANNEL_DENIED";
+};
+/** `subscribe` 的回执（函数侧只拿到订阅号，拿不到监听器 / 总线内部对象）。 */
+export interface SimRealtimeSubscription {
+    subscription: string;
+    channel: string;
+}
+/**
+ * 装配 `cloud.realtime` 能力 bundle（`capabilities[].name = 'realtime'` + `rpcHandlers.realtime`），
+ * 并暴露其背后的进程内广播实例（宿主可直接 `subscribe` 观察函数广播）。
+ *
+ * 方法面（全部经命令通道转发回宿主，返回 Promise）：
+ * - `publish(channel, data)` → `{ delivered }`：向 channel 内存广播，返回命中订阅者数；
+ * - `subscribe(channel)` → `{ subscription, channel }`：注册进程内监听，命中消息留在宿主缓冲；
+ * - `receive(subscription)` → `RealtimeChannelMessage[]`：取回并清空缓冲（非阻塞）；
+ * - `unsubscribe(subscription)` → `{ removed: true }`：退订并丢弃缓冲。
+ *
+ * 本地**没有**线上的连接身份，故 PRD §2.12.3 的 `except`（不回给发送者）无从实现——
+ * 传第三个实参即 fail loud 报错，不静默改变语义。
+ */
+export declare function createSimRealtimeCapability(): {
+    bundle: CapabilityBundle;
+    realtime: SimRealtime;
+};

package/dist/sim/sql-engine.d.ts

@@ -0,0 +1,82 @@
+/**
+ * 本地模拟 SQL 引擎（CLI-004）：进程内、零外部依赖的 MINI-SQL。
+ *
+ * 设计动因：`adep dev` 要把 `cloud.db` 能力装进函数执行环境，而 `createDbCapability`
+ * （线上 Provider，只读复用）消费一个 `ProjectDriver`（run/all/get/close + engine）。
+ * 本引擎实现该驱动所需的「有界 SQL 子集」，恰好覆盖线上 `createCloudDb` 编译器产出的语句形态。
+ *
+ * **参数化一致性核心**：线上 `compileUpdate`/`compileDelete`/`compileInsert` 的 params 数组顺序
+ * 与 SQL 文本里 `?` 占位符的**出现顺序**严格一致（编译器边拼文本边 push 参数）。本引擎统一采用
+ * 「从左到右扫描文本、按顺序消费 params」的方式，因此无论 WHERE / SET / VALUES 谁先谁后，
+ * 解析顺序都与 params 数组天然对齐——删掉了按子句手工记账的出错面。
+ *
+ * 覆盖语句：
+ * - DDL：`CREATE TABLE [IF NOT EXISTS] name (col TYPE [PRIMARY KEY] [AUTOINCREMENT] [, ...])`；
+ * - SELECT：`SELECT cols|count(*)|常量 FROM t [WHERE ...] [ORDER BY col asc|desc] [LIMIT ?] [OFFSET ?]`；
+ *   `sqlite_master` 探测（owned 变更流表存在性）由特殊分支返回目录；
+ * - INSERT：`INSERT INTO t (cols) VALUES (?,...) [, (?,...)]`；
+ * - UPDATE：`UPDATE t SET col = ? [...] WHERE ...`；
+ * - DELETE：`DELETE FROM t WHERE ...`；
+ * - 事务：`BEGIN` / `COMMIT` / `ROLLBACK` / `SAVEPOINT x` / `RELEASE SAVEPOINT x` / `ROLLBACK TO SAVEPOINT x`；
+ * - WHERE：`col op ?`（op ∈ = != > >= < <= like in not in）；`= ?(null)` → IS NULL、`!= ?(null)` → IS NOT NULL。
+ *
+ * 一致性承诺：本引擎只在「持久化落点」与线上 sqlite 不同，SQL 语义（CRUD、where 操作符、
+ * orderBy/limit、owned 变更流、事务回滚）逐条对齐线上 builder 编译产物——契约表由
+ * `shared/sim-contract.ts` 钉死，sim 与线上 Provider 跑同一张表。
+ *
+ * **FN-023 移植说明**：本文件自 `packages/cli/src/sim/sql-engine.ts` 复制进 runtime
+ * （CLI 域不在该单 touches，CLI 侧暂留自有副本）。两份副本的语义一致性由契约表双向钉死
+ * （CLI 测试 + 浏览器驱动测试各跑一遍）；CLI 换口消费本模块留给 CLI 域后续单。
+ * 移植至此的原因：浏览器侧模拟运行时（`@adep/web-container`）复用 `createDbCapability`
+ * 时需要同一份「进程内 SQL 引擎」，而 CLI 包不能进浏览器 bundle（`adep` 命令族 / node 依赖）。
+ */
+/** 表列定义（从 CREATE TABLE 语句解析）。 */
+interface SimColumn {
+    name: string;
+    type: string;
+    primaryKey: boolean;
+    autoincrement: boolean;
+}
+/** 单表状态：列 + 行。 */
+export interface SimTable {
+    columns: SimColumn[];
+    rows: Array<Record<string, unknown>>;
+    nextAutoincrement: number;
+}
+/** 持久层宿主接口（JSON 文件 / 内存）。 */
+export interface EngineStorage {
+    load(): Promise<Record<string, SimTable> | null>;
+    save(tables: Record<string, SimTable>): Promise<void>;
+}
+/** 本地模拟 DB 统一错误（code 用平台码，供错误信封一致）。 */
+export declare class SimDbError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare class SimSqlEngine {
+    private tables;
+    private storage;
+    private memoryOnly;
+    private savepointDepth;
+    private txSnapshot;
+    constructor(options?: {
+        storage?: EngineStorage;
+        memoryOnly?: boolean;
+    });
+    load(): Promise<void>;
+    private persist;
+    private ensureTable;
+    private applyAutoincrement;
+    private catalog;
+    run(sql: string, params?: readonly unknown[]): Promise<{
+        changes: number;
+    }>;
+    private execInsert;
+    private execUpdate;
+    private execDelete;
+    private select;
+    all(sql: string, params?: readonly unknown[]): Promise<Array<Record<string, unknown>>>;
+    get(sql: string, params?: readonly unknown[]): Promise<Record<string, unknown> | null>;
+    close(): Promise<void>;
+}
+export {};

package/dist/storage/hmac-sha256.d.ts

@@ -0,0 +1,23 @@
+/**
+ * 纯 TS HMAC-SHA256（FN-023）：跨 realm（浏览器 / Node / Bun）同形，零 node 依赖。
+ *
+ * 动因：`storage/signature.ts` 的签名 URL 算法原走 `node:crypto.createHmac`，浏览器侧
+ * 模拟运行时（`@adep/web-container` 的 sim storage）复用 `createStorageCapability` 时
+ * 打包直接失败。与其在浏览器再造一份「形状一致但算法不同」的签名，不如把 HMAC 本体
+ * 收敛为单一实现——所有 realm 跑同一份代码，签名逐字节可比（对拍测试钉住与
+ * `node:crypto` 的一致性，见 `__tests__/signature.test.ts`）。
+ *
+ * 实现是教科书式 FIPS 180-4 / RFC 2104：无 SIMD 优化、无流式 API——本模块的调用面只有
+ * 「一次签一个短 payload（项目 + 路径 + 过期时间）」，常数级正确性优先于大数据吞吐。
+ */
+/** SHA-256 摘要（32 字节）。输入一次性给全（本模块的调用面没有流式需求）。 */
+export declare function sha256(data: Uint8Array): Uint8Array;
+/** HMAC-SHA256（RFC 2104）：key 超过块长先哈希，短 key 左侧补零。 */
+export declare function hmacSha256(key: string | Uint8Array, message: string | Uint8Array): Uint8Array;
+/** HMAC-SHA256 的小写 hex 摘要（签名 URL 的 `x-signature` 取此形态）。 */
+export declare function hmacSha256Hex(key: string | Uint8Array, message: string | Uint8Array): string;
+/**
+ * 恒时字符串比较（替代 `node:crypto.timingSafeEqual`）：先比长度、再逐字符累加差值。
+ * 签名校验的侧信道面是「签名串本身」，该形态恒时性足够（比较对象是 hex 串，无密钥直接暴露）。
+ */
+export declare function constantTimeEqual(a: string, b: string): boolean;

package/package.json

@@ -1,44 +1,30 @@
 {
   "name": "@adep/runtime",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "private": false,
   "type": "module",
   "sideEffects": false,
   "description": "AgentDeploy 运行时内核：云函数执行器 + 本地模拟运行时 + cloud.db/cloud.storage 能力装配，零平台重栈依赖（无 elysia/drizzle/better-auth/nuxt/bun:sqlite/postgres/ioredis），供 server / CLI(adep dev) / 浏览器离线工作区三方复用。",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     },
     "./*": {
-      "types": "./src/*.ts",
-      "default": "./src/*.ts"
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
     }
   },
   "files": [
     "dist"
   ],
+  "dependencies": {
+    "@adep/types": "0.1.2"
+  },
   "scripts": {
     "test": "vitest run",
     "build": "bun run ../../scripts/build-package.ts runtime"
-  },
-  "dependencies": {
-    "@adep/types": "workspace:*"
-  },
-  "publishConfig": {
-    "main": "./dist/index.js",
-    "types": "./dist/index.d.ts",
-    "exports": {
-      ".": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "./*": {
-        "types": "./dist/*.d.ts",
-        "default": "./dist/*.js"
-      }
-    }
   }
-}
+}