@dp-bohrium/widget-cli 0.1.0 → 0.3.0

package/dist/{dsh-DgkNH7L-.mjs → dsh-DbOeoKFJ.mjs}

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { lstat, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -95,52 +95,78 @@ function collectReferencedFileIds(request) {
 	return referenced;
 }
 //#endregion
-//#region ../widget-project/src/manifest.mjs
-const require$2 = createRequire(import.meta.url);
+//#region ../widget-sdk/dist/runtime-DVFTv55x.js
+/** 从当前安装的 SDK package.json 读取版本，插件作者不需要重复填写。 */
+const WIDGET_SDK_VERSION = "0.5.0";
+//#endregion
+//#region ../widget-sdk/dist/index.js
+function compiledContribution(contribution) {
+	switch (contribution.type) {
+		case "panel": return {
+			type: "panel",
+			id: contribution.id,
+			...contribution.placement === void 0 ? {} : { placement: contribution.placement }
+		};
+		case "file-preview": return {
+			type: "file-preview",
+			extensions: [...contribution.extensions]
+		};
+	}
+}
 /**
-* Convert the author-facing VS Code-style plugin manifest to the Host
-* manifest consumed by Host Runtime Config. This is deliberately a tooling
-* boundary: source code and editor tooling use `contributes`, while only the
-* upload/preview pipeline knows about `widgetConfig.contribution` and protocol fields.
+* 将开发者维护的插件清单编译为宿主可加载的宿主清单。
+*
+* 这是构建工具的边界函数，不是类型提示入口：作者直接编辑带 `$schema` 的 JSON，
+* SDK 版本从当前安装包读取，宿主入口默认落到 dist/widget.js，内部 contribution 标识只在这里生成。
 */
-function compileAuthorManifest(manifest, options = {}) {
-	if (!isAuthorManifest(manifest)) return manifest;
-	const sdkVersion = options.sdkVersion ?? installedSdkVersion();
+function compileWidgetPluginManifest(manifest, options = {}) {
+	const samples = options.samples ?? manifest.samples;
+	if (!samples || samples.length === 0) throw new Error("Widget Plugin Manifest must provide at least one sample before packaging");
 	const contribution = manifest.contributes.widget;
-	if (!contribution || typeof contribution !== "object" || !["panel", "file-preview"].includes(contribution.type) || contribution.type === "file-preview" && !Array.isArray(contribution.extensions)) return manifest;
-	const compiledContribution = contribution.type === "panel" ? {
-		type: "panel",
-		id: contribution.id
-	} : {
-		type: "file-preview",
-		extensions: [...contribution.extensions]
-	};
+	if (contribution.type === "panel" && contribution.placement?.kind === "region" && (manifest.capabilities?.region?.mode !== contribution.placement.mode || !manifest.capabilities.region.regions.includes(contribution.placement.region))) throw new Error("A region Widget contribution must declare a matching region capability");
+	const activationEvents = manifest.activationEvents ? [...manifest.activationEvents] : void 0;
 	return {
 		name: manifest.name,
 		...manifest.description === void 0 ? {} : { description: manifest.description },
 		widgetConfig: {
 			schemaVersion: 1,
 			hostApiVersion: 1,
-			widgetSdkVersion: sdkVersion,
+			widgetSdkVersion: WIDGET_SDK_VERSION,
 			entry: options.hostEntry ?? "dist/widget.js",
-			contribution: compiledContribution,
-			...manifest.activationEvents === void 0 ? {} : { activationEvents: manifest.activationEvents },
+			contribution: compiledContribution(manifest.contributes.widget),
+			...activationEvents === void 0 ? {} : { activationEvents },
 			...manifest.capabilities === void 0 ? {} : { requestedCapabilities: manifest.capabilities },
 			...manifest.runtime === void 0 ? {} : { runtime: manifest.runtime },
-			samples: options.samples ?? manifest.samples ?? []
+			samples
 		}
 	};
 }
+//#endregion
+//#region ../widget-project/src/manifest.mjs
+/**
+* Convert the author-facing VS Code-style plugin manifest to the Host
+* manifest consumed by Host Runtime Config. This is deliberately a tooling
+* boundary: source code and editor tooling use `contributes`, while only the
+* upload/preview pipeline knows about `widgetConfig.contribution` and protocol fields.
+*/
+function compileAuthorManifest(manifest, options = {}) {
+	if (!isAuthorManifest(manifest)) return manifest;
+	const contribution = manifest.contributes?.widget;
+	if (!contribution || typeof contribution !== "object" || !["panel", "file-preview"].includes(contribution.type) || contribution.type === "file-preview" && !Array.isArray(contribution.extensions)) return manifest;
+	const compiled = (options.compiler ?? compileWidgetPluginManifest)(manifest, {
+		hostEntry: options.hostEntry,
+		samples: options.samples
+	});
+	if (options.sdkVersion !== void 0 && compiled.widgetConfig.widgetSdkVersion !== options.sdkVersion) {
+		const error = /* @__PURE__ */ new Error(`Manifest compiler SDK version ${compiled.widgetConfig.widgetSdkVersion} does not match requested SDK version ${options.sdkVersion}`);
+		error.code = "WIDGET_CLI_PROJECT_SDK_MISMATCH";
+		throw error;
+	}
+	return compiled;
+}
 function isAuthorManifest(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value) && "contributes" in value && "version" in value);
 }
-function installedSdkVersion() {
-	try {
-		return require$2("@dp-bohrium/widget-sdk/package.json").version;
-	} catch {
-		return "0.0.0-dev";
-	}
-}
 //#endregion
 //#region ../../node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -6798,7 +6824,7 @@ var require_json_schema_2020_12 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.default = addMetaSchema2020;
 }));
 //#endregion
-//#region ../contract-testing/dist/manifest-validator-BWdmIEES.js
+//#region ../contract-testing/dist/manifest-validator-DUzSsw8D.js
 var import__2020 = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.MissingRefError = exports.ValidationError = exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = exports.Ajv2020 = void 0;
@@ -6978,7 +7004,7 @@ const widgetManifestSchema = {
 			}
 		},
 		"FilesCapabilityRequest": {
-			"description": "只读文件能力的申请开关；对应 files.list / files.metadata / files.read / files.download。",
+			"description": "文件能力的独立申请开关；保存已有文件必须单独申请 files.write 并获得 Host 授权，可写范围由 Host grant 决定。",
 			"title": "FilesCapabilityRequest",
 			"type": "object",
 			"additionalProperties": false,
@@ -6986,7 +7012,8 @@ const widgetManifestSchema = {
 				"list": { "type": "boolean" },
 				"metadata": { "type": "boolean" },
 				"read": { "type": "boolean" },
-				"download": { "type": "boolean" }
+				"download": { "type": "boolean" },
+				"write": { "type": "boolean" }
 			}
 		},
 		"EventsCapabilityRequest": {
@@ -7009,12 +7036,15 @@ const widgetManifestSchema = {
 			} }
 		},
 		"TasksCapabilityRequest": {
-			"description": "任务观察能力的申请；watch 固定为 true。",
+			"description": "任务发现与观察能力的申请；list / watch 至少显式申请一项，已申请项固定为 true。",
 			"title": "TasksCapabilityRequest",
 			"type": "object",
 			"additionalProperties": false,
-			"required": ["watch"],
-			"properties": { "watch": { "const": true } }
+			"minProperties": 1,
+			"properties": {
+				"list": { "const": true },
+				"watch": { "const": true }
+			}
 		},
 		"StateCapabilityRequest": {
 			"description": "受限 UI 状态读写能力的申请；read / write 分别声明。",
@@ -7439,9 +7469,14 @@ const widgetRuntimeContractsSchema = {
 		"presentationCapabilityResult": { "$ref": "#/$defs/PresentationCapabilityResult" },
 		"regionCapabilityResult": { "$ref": "#/$defs/RegionCapabilityResult" },
 		"fileDownloadResult": { "$ref": "#/$defs/FileDownloadResult" },
+		"fileReadResult": { "$ref": "#/$defs/FileReadResult" },
+		"fileWriteResult": { "$ref": "#/$defs/FileWriteResult" },
 		"taskObservationSnapshot": { "$ref": "#/$defs/TaskObservationSnapshot" },
 		"taskObservationEvent": { "$ref": "#/$defs/TaskObservationEvent" },
 		"taskObservationBatch": { "$ref": "#/$defs/TaskObservationBatch" },
+		"taskListField": { "$ref": "#/$defs/TaskListField" },
+		"taskListItem": { "$ref": "#/$defs/TaskListItem" },
+		"taskListPage": { "$ref": "#/$defs/TaskListPage" },
 		"toolResultEnvelope": { "$ref": "#/$defs/ToolResultEnvelope" },
 		"uiStateResult": { "$ref": "#/$defs/UiStateResult" },
 		"uiStateWriteResult": { "$ref": "#/$defs/UiStateWriteResult" },
@@ -7671,7 +7706,7 @@ const widgetRuntimeContractsSchema = {
 			}
 		},
 		"FileReference": {
-			"description": "只读文件引用；仅含不透明 id 与展示元数据，不含路径或 URL。",
+			"description": "Host 签发的文件引用；仅含不透明 id、可选内容版本和展示元数据。引用本身不授予写权限，不含路径或 URL。",
 			"title": "FileReference",
 			"type": "object",
 			"additionalProperties": false,
@@ -7703,7 +7738,121 @@ const widgetRuntimeContractsSchema = {
 				"size": {
 					"type": "integer",
 					"minimum": 0
-				}
+				},
+				"revision": { "$ref": "#/$defs/FileRevision" }
+			}
+		},
+		"FileRevision": {
+			"description": "由存储执行端签发的文件内容版本，用于条件读取和保存；不是 RenderRequest.revision。",
+			"title": "FileRevision",
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 256
+		},
+		"FileMutationId": {
+			"description": "一次逻辑保存的稳定标识；重试或确认结果时必须复用，相同标识不得提交不同内容。",
+			"title": "FileMutationId",
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 128,
+			"pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$"
+		},
+		"FileReadInput": {
+			"description": "分块读取已授权文件；后续分块应携带首块返回的 expectedRevision，防止拼接不同版本。",
+			"title": "FileReadInput",
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"file",
+				"offset",
+				"length",
+				"encoding"
+			],
+			"properties": {
+				"file": { "$ref": "#/$defs/FileReference" },
+				"offset": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 9007199254740991
+				},
+				"length": {
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 9007199254740991
+				},
+				"encoding": { "enum": ["utf8", "base64"] },
+				"expectedRevision": { "$ref": "#/$defs/FileRevision" }
+			}
+		},
+		"FileReadResult": {
+			"description": "文件读取结果；普通读取只要求内容与编码，原有游标和截断信息按 Host 能力返回。revision 可选且必须与本次读取的内容属于同一快照；请求 expectedRevision 时必须返回匹配版本。缺少 revision 的结果仅用于只读展示，不能据此条件保存。提供字节游标时 nextOffset 等于请求 offset + bytesRead，不按字符串长度计数。",
+			"title": "FileReadResult",
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["content", "encoding"],
+			"properties": {
+				"content": { "type": "string" },
+				"encoding": { "enum": ["utf8", "base64"] },
+				"offset": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 9007199254740991
+				},
+				"bytesRead": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 9007199254740991
+				},
+				"nextOffset": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 9007199254740991
+				},
+				"eof": { "type": "boolean" },
+				"truncated": { "type": "boolean" },
+				"revision": { "$ref": "#/$defs/FileRevision" }
+			}
+		},
+		"FileWriteInput": {
+			"description": "按 Host 授权范围对已有文件作整文件条件替换；Host 校验引用、作用域、权限和实际字节预算。超时不表示未写入，使用同一 mutationId 核对结果。",
+			"title": "FileWriteInput",
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"file",
+				"content",
+				"encoding",
+				"expectedRevision",
+				"mutationId"
+			],
+			"properties": {
+				"file": { "$ref": "#/$defs/FileReference" },
+				"content": { "type": "string" },
+				"encoding": { "enum": ["utf8", "base64"] },
+				"expectedRevision": { "$ref": "#/$defs/FileRevision" },
+				"mutationId": { "$ref": "#/$defs/FileMutationId" }
+			}
+		},
+		"FileWriteResult": {
+			"description": "执行端已确认持久化的保存回执；file.id 保持原文件引用身份，revision 是新内容版本。",
+			"title": "FileWriteResult",
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"file",
+				"revision",
+				"bytesWritten",
+				"mutationId"
+			],
+			"properties": {
+				"file": { "$ref": "#/$defs/FileReference" },
+				"revision": { "$ref": "#/$defs/FileRevision" },
+				"bytesWritten": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 9007199254740991
+				},
+				"mutationId": { "$ref": "#/$defs/FileMutationId" }
 			}
 		},
 		"FileDownloadResult": {
@@ -7718,6 +7867,18 @@ const widgetRuntimeContractsSchema = {
 				"cancelled"
 			] } }
 		},
+		"TaskStatus": {
+			"description": "Host 投影给 Widget 的统一任务状态。",
+			"title": "TaskStatus",
+			"enum": [
+				"queued",
+				"running",
+				"succeeded",
+				"failed",
+				"cancelled",
+				"expired"
+			]
+		},
 		"TaskObservationSnapshot": {
 			"description": "任务观察的当前快照：taskId、status 与 updatedAt；progress、message 可选。",
 			"title": "TaskObservationSnapshot",
@@ -7734,14 +7895,7 @@ const widgetRuntimeContractsSchema = {
 					"minLength": 1,
 					"maxLength": 256
 				},
-				"status": { "enum": [
-					"queued",
-					"running",
-					"succeeded",
-					"failed",
-					"cancelled",
-					"expired"
-				] },
+				"status": { "$ref": "#/$defs/TaskStatus" },
 				"progress": {
 					"type": "number",
 					"minimum": 0,
@@ -7825,6 +7979,110 @@ const widgetRuntimeContractsSchema = {
 				}
 			}
 		},
+		"TaskListField": {
+			"description": "任务列表中的受限展示字段；key 是稳定机器键，value 是 Host 裁剪后的展示文本。",
+			"title": "TaskListField",
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["key", "value"],
+			"properties": {
+				"key": {
+					"description": "展示字段的稳定机器键，例如 machine 或 command。",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 64,
+					"pattern": "^[A-Za-z][A-Za-z0-9_.:-]*$"
+				},
+				"value": {
+					"description": "Host 完成授权与裁剪后的展示文本。",
+					"type": "string",
+					"maxLength": 16384
+				}
+			}
+		},
+		"TaskListItem": {
+			"description": "Host 已授权发现的任务摘要；taskId 是可继续传给 tasks.watch 的不透明引用。",
+			"title": "TaskListItem",
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"taskId",
+				"kind",
+				"name",
+				"status",
+				"updatedAt",
+				"fields"
+			],
+			"properties": {
+				"taskId": {
+					"description": "可继续传给 tasks.watch 的 Host 不透明任务引用。",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 256
+				},
+				"kind": {
+					"description": "任务来源类型的稳定机器键。",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 64,
+					"pattern": "^[A-Za-z][A-Za-z0-9_.:-]*$"
+				},
+				"name": {
+					"description": "任务的安全展示名称。",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 256
+				},
+				"status": { "$ref": "#/$defs/TaskStatus" },
+				"progress": {
+					"description": "可选执行进度，取值范围为 0 到 1。",
+					"type": "number",
+					"minimum": 0,
+					"maximum": 1
+				},
+				"message": {
+					"description": "Host 裁剪后的可选状态说明。",
+					"type": "string",
+					"maxLength": 1024
+				},
+				"updatedAt": {
+					"description": "任务摘要最后更新时间，使用 UTC ISO 8601 字符串。",
+					"type": "string",
+					"pattern": "^\\d{4}-\\d{2}-\\d{2}T[^ ]+Z$"
+				},
+				"fields": {
+					"description": "任务面板可展示的受限附加字段。",
+					"type": "array",
+					"maxItems": 32,
+					"items": { "$ref": "#/$defs/TaskListField" }
+				}
+			}
+		},
+		"TaskListPage": {
+			"description": "Host 已授权任务摘要的一页结果；nextCursor 缺失表示当前页已到末尾。",
+			"title": "TaskListPage",
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["schemaVersion", "tasks"],
+			"properties": {
+				"schemaVersion": {
+					"description": "任务列表页结构版本，当前固定为 1。",
+					"const": 1
+				},
+				"tasks": {
+					"description": "当前页中 Host 已授权的任务摘要。",
+					"type": "array",
+					"maxItems": 100,
+					"items": { "$ref": "#/$defs/TaskListItem" }
+				},
+				"nextCursor": {
+					"description": "下一页的不透明游标；缺失表示当前列表已到末尾。",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512
+				}
+			}
+		},
 		"ToolResultMetric": {
 			"description": "工具结果中的单个指标。",
 			"title": "ToolResultMetric",
@@ -8119,6 +8377,40 @@ const widgetRuntimeContractsSchema = {
 						}
 					}
 				},
+				{
+					"type": "object",
+					"additionalProperties": false,
+					"required": ["name", "limits"],
+					"properties": {
+						"name": { "const": "files.write" },
+						"limits": {
+							"type": "object",
+							"additionalProperties": false,
+							"required": [
+								"bytesPerRequest",
+								"bytesPerRun",
+								"callsPerMinute"
+							],
+							"properties": {
+								"bytesPerRequest": {
+									"type": "integer",
+									"minimum": 1,
+									"maximum": 9007199254740991
+								},
+								"bytesPerRun": {
+									"type": "integer",
+									"minimum": 1,
+									"maximum": 9007199254740991
+								},
+								"callsPerMinute": {
+									"type": "integer",
+									"minimum": 1,
+									"maximum": 9007199254740991
+								}
+							}
+						}
+					}
+				},
 				{
 					"type": "object",
 					"additionalProperties": false,
@@ -8169,6 +8461,40 @@ const widgetRuntimeContractsSchema = {
 						}
 					}
 				},
+				{
+					"type": "object",
+					"additionalProperties": false,
+					"required": ["name", "limits"],
+					"properties": {
+						"name": { "const": "tasks.list" },
+						"limits": {
+							"type": "object",
+							"additionalProperties": false,
+							"required": [
+								"callsPerMinute",
+								"pageSize",
+								"minPollMs"
+							],
+							"properties": {
+								"callsPerMinute": {
+									"type": "integer",
+									"minimum": 1,
+									"maximum": 9007199254740991
+								},
+								"pageSize": {
+									"type": "integer",
+									"minimum": 1,
+									"maximum": 100
+								},
+								"minPollMs": {
+									"type": "integer",
+									"minimum": 1e3,
+									"maximum": 6e4
+								}
+							}
+						}
+					}
+				},
 				{
 					"type": "object",
 					"additionalProperties": false,
@@ -8620,26 +8946,36 @@ const widgetRuntimeContractsSchema = {
 					"required": ["operation", "input"],
 					"properties": {
 						"operation": { "const": "files.read" },
+						"input": { "$ref": "#/$defs/FileReadInput" }
+					}
+				},
+				{
+					"type": "object",
+					"additionalProperties": false,
+					"required": ["operation", "input"],
+					"properties": {
+						"operation": { "const": "files.write" },
+						"input": { "$ref": "#/$defs/FileWriteInput" }
+					}
+				},
+				{
+					"type": "object",
+					"additionalProperties": false,
+					"required": ["operation", "input"],
+					"properties": {
+						"operation": { "const": "files.download" },
 						"input": {
 							"type": "object",
 							"additionalProperties": false,
-							"required": [
-								"file",
-								"offset",
-								"length",
-								"encoding"
-							],
+							"required": ["file", "suggestedName"],
 							"properties": {
 								"file": { "$ref": "#/$defs/FileReference" },
-								"offset": {
-									"type": "integer",
-									"minimum": 0
-								},
-								"length": {
-									"type": "integer",
-									"minimum": 1
-								},
-								"encoding": { "enum": ["utf8", "base64"] }
+								"suggestedName": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 255,
+									"pattern": "^[^\\\\/\\u0000-\\u001f]+$"
+								}
 							}
 						}
 					}
@@ -8649,18 +8985,20 @@ const widgetRuntimeContractsSchema = {
 					"additionalProperties": false,
 					"required": ["operation", "input"],
 					"properties": {
-						"operation": { "const": "files.download" },
+						"operation": { "const": "tasks.list" },
 						"input": {
 							"type": "object",
 							"additionalProperties": false,
-							"required": ["file", "suggestedName"],
 							"properties": {
-								"file": { "$ref": "#/$defs/FileReference" },
-								"suggestedName": {
+								"cursor": {
 									"type": "string",
 									"minLength": 1,
-									"maxLength": 255,
-									"pattern": "^[^\\\\/\\u0000-\\u001f]+$"
+									"maxLength": 512
+								},
+								"limit": {
+									"type": "integer",
+									"minimum": 1,
+									"maximum": 100
 								}
 							}
 						}
@@ -9201,7 +9539,10 @@ const widgetRuntimeContractsSchema = {
 						"network-credential-unavailable",
 						"network-scope-invalid",
 						"network-dns-denied",
-						"network-error"
+						"network-error",
+						"revision-conflict",
+						"mutation-conflict",
+						"write-outcome-unknown"
 					] },
 					"message": {
 						"type": "string",
@@ -9360,6 +9701,18 @@ const widgetRuntimeContractsSchema = {
 						"listPageSize": {
 							"type": "integer",
 							"minimum": 1
+						},
+						"writeBytesPerRequest": {
+							"description": "写入单次原始字节上限；未签发时不得授权 files.write。",
+							"type": "integer",
+							"minimum": 1,
+							"maximum": 9007199254740991
+						},
+						"writeBytesPerRun": {
+							"description": "当前运行的累计写入原始字节上限；未签发时不得授权 files.write。",
+							"type": "integer",
+							"minimum": 1,
+							"maximum": 9007199254740991
 						}
 					}
 				},
@@ -10735,14 +11088,51 @@ async function checkWidgetProject(projectRoot, options = {}) {
 			projectRoot: root
 		};
 	}
-	const { validateWidgetManifest, validateRenderRequest, validateCapabilityResult } = await loadContractValidators();
+	const toolchain = options.toolchain ?? {};
+	const { validateWidgetManifest, validateRenderRequest, validateCapabilityResult } = options.validators ?? toolchain.validators ?? await loadContractValidators();
 	const sourceManifest = manifest;
-	manifest = compileAuthorManifest(manifest, { hostEntry: options.hostEntry });
+	const sdkVersion = options.sdkVersion ?? toolchain.sdkVersion;
+	try {
+		manifest = compileAuthorManifest(manifest, {
+			hostEntry: options.hostEntry,
+			samples: options.samples,
+			sdkVersion,
+			compiler: options.compiler ?? toolchain.compiler
+		});
+	} catch (error) {
+		checks.push({
+			name: "manifest 编译",
+			ok: false
+		});
+		errors.push(`manifest compilation failed: ${error instanceof Error ? error.message : String(error)}`);
+		return {
+			ok: false,
+			label,
+			checks,
+			errors,
+			manifest: sourceManifest,
+			sourceManifest,
+			manifestKind: isAuthorManifest(sourceManifest) ? "author" : "host",
+			sampleRequest: null,
+			sampleRequests: [],
+			fixtures: null,
+			fixturesPath: null,
+			entryPath: null,
+			projectRoot: root
+		};
+	}
 	const manifestResult = validateWidgetManifest(manifest);
 	checks.push({
 		name: "manifest 契约校验 (AJV)",
 		ok: manifestResult.ok
 	});
+	if (manifestResult.ok && sdkVersion !== void 0 && manifest.widgetConfig.widgetSdkVersion !== sdkVersion) {
+		checks.push({
+			name: "manifest 工具链 SDK 版本",
+			ok: false
+		});
+		errors.push(`manifest SDK version ${manifest.widgetConfig.widgetSdkVersion} does not match toolchain SDK version ${sdkVersion}`);
+	}
 	if (!manifestResult.ok) {
 		errors.push(...formatContractErrors(manifestResult));
 		return {
@@ -10883,8 +11273,29 @@ function resolveWidgetProjects(input, root = repoRoot) {
 	throw new Error("请传入 Widget 工程目录、manifest.json 或 all");
 }
 //#endregion
-//#region ../widget-project/src/export.mjs
+//#region ../widget-project/src/zip.mjs
+/** 固定归档顺序与时间戳，统一路径安全与重复条目处理。 */
+function assertArchivePath(path) {
+	if (typeof path !== "string" || path.length === 0 || path.startsWith("/") || path.includes("..") || path.includes("\\") || path.includes("://") || /^[A-Za-z]:/u.test(path) || [...path].some((character) => {
+		const code = character.charCodeAt(0);
+		return code < 32 || code === 127;
+	})) throw new Error(`Invalid archive path: ${path}`);
+}
+function normalizeArchivePath(path) {
+	assertArchivePath(path);
+	const normalized = path.split("/").filter((part) => part !== "" && part !== ".").join("/");
+	assertArchivePath(normalized);
+	return normalized;
+}
 function storedZip(files) {
+	const uniqueFiles = /* @__PURE__ */ new Map();
+	for (const [declaredPath, value] of files) {
+		const path = normalizeArchivePath(declaredPath);
+		const bytes = Buffer.from(value);
+		const previous = uniqueFiles.get(path);
+		if (previous && !previous.equals(bytes)) throw new Error(`Conflicting duplicate archive path: ${path}`);
+		uniqueFiles.set(path, bytes);
+	}
 	const table = Array.from({ length: 256 }, (_, index) => {
 		let value = index;
 		for (let bit = 0; bit < 8; bit++) value = value & 1 ? 3988292384 ^ value >>> 1 : value >>> 1;
@@ -10893,10 +11304,8 @@ function storedZip(files) {
 	const locals = [];
 	const central = [];
 	let offset = 0;
-	for (const [path, value] of [...files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
-		if (!/^[a-zA-Z0-9._/-]+$/.test(path) || path.startsWith("/") || path.split("/").includes("..")) throw new Error("Invalid archive path");
+	for (const [path, bytes] of [...uniqueFiles].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
 		const name = Buffer.from(path);
-		const bytes = Buffer.from(value);
 		let crc = 4294967295;
 		for (const byte of bytes) crc = table[(crc ^ byte) & 255] ^ crc >>> 8;
 		crc = (crc ^ 4294967295) >>> 0;
@@ -10927,8 +11336,8 @@ function storedZip(files) {
 	const centralBytes = Buffer.concat(central);
 	const end = Buffer.alloc(22);
 	end.writeUInt32LE(101010256);
-	end.writeUInt16LE(files.length, 8);
-	end.writeUInt16LE(files.length, 10);
+	end.writeUInt16LE(uniqueFiles.size, 8);
+	end.writeUInt16LE(uniqueFiles.size, 10);
 	end.writeUInt32LE(centralBytes.length, 12);
 	end.writeUInt32LE(offset, 16);
 	return Buffer.concat([
@@ -10937,24 +11346,81 @@ function storedZip(files) {
 		end
 	]);
 }
-function safeBundlePath(value) {
-	return value.replace(/^\/+/u, "");
+//#endregion
+//#region ../widget-project/src/export.mjs
+const EXCLUDED_BUILD_NAMES = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	".widget-build",
+	".widget-dev",
+	"widget-toolchain.json",
+	".widget-build-receipt.json"
+]);
+function bundleFileMetadata(root, path) {
+	const normalized = normalizeArchivePath(path);
+	let file = root;
+	let metadata;
+	for (const part of normalized.split("/")) {
+		file = join(file, part);
+		metadata = lstatSync(file);
+		if (metadata.isSymbolicLink()) throw new Error(`ZIP 不允许 symbolic link（符号链接）：${path}`);
+	}
+	return {
+		file,
+		metadata
+	};
+}
+function readBundleFile(root, path) {
+	const { file, metadata } = bundleFileMetadata(root, path);
+	if (!metadata.isFile()) throw new Error(`ZIP 资源不是普通文件：${path}`);
+	return readFileSync(file);
+}
+function collectBuildAssets(root, entry) {
+	entry = normalizeArchivePath(entry);
+	if (!entry.includes("/")) return [[entry, readBundleFile(root, entry)]];
+	const files = [];
+	const rootName = entry.split("/")[0];
+	if (EXCLUDED_BUILD_NAMES.has(rootName)) throw new Error(`构建资源目录不能是工程内部目录：${rootName}`);
+	const visit = (path) => {
+		const { file, metadata } = bundleFileMetadata(root, path);
+		if (metadata.isDirectory()) for (const name of readdirSync(file)) {
+			if (EXCLUDED_BUILD_NAMES.has(name) || /\.zip$/iu.test(name)) continue;
+			visit(`${path}/${name}`);
+		}
+		else files.push([path, readBundleFile(root, path)]);
+	};
+	visit(rootName);
+	return files;
 }
 function buildWidgetPackage(project, options = {}) {
-	const manifest = project.manifest ?? compileAuthorManifest(JSON.parse(readFileSync(join(project.projectRoot, "manifest.json"), "utf8")), { hostEntry: options.hostEntry });
+	return storedZip(collectWidgetPackageFiles(project, options));
+}
+/** 返回将写入 ZIP 的 `[路径, 字节]` 列表；同一路径可能重复出现，由 `storedZip` 去重。 */
+function collectWidgetPackageFiles(project, options = {}) {
+	const root = resolve(project.projectRoot);
+	const sourceManifest = project.manifest ?? compileAuthorManifest(JSON.parse(readBundleFile(root, "manifest.json").toString("utf8")), { hostEntry: options.hostEntry });
+	const manifest = {
+		...sourceManifest,
+		widgetConfig: {
+			...sourceManifest.widgetConfig,
+			entry: normalizeArchivePath(sourceManifest.widgetConfig.entry),
+			samples: sourceManifest.widgetConfig.samples?.map((sample) => ({
+				...sample,
+				request: normalizeArchivePath(sample.request)
+			}))
+		}
+	};
 	const files = [["manifest.json", Buffer.from(`${JSON.stringify(manifest)}\n`)]];
-	const entryPath = join(project.projectRoot, manifest.widgetConfig.entry);
+	const entryPath = join(root, manifest.widgetConfig.entry);
 	if (!existsSync(entryPath)) throw new Error("Widget entry is missing; build the project first");
-	files.push([safeBundlePath(manifest.widgetConfig.entry), readFileSync(entryPath)]);
-	for (const sample of manifest.widgetConfig.samples ?? []) {
-		const samplePath = join(project.projectRoot, sample.request);
-		if (existsSync(samplePath)) files.push([safeBundlePath(sample.request), readFileSync(samplePath)]);
-	}
+	files.push(...collectBuildAssets(root, manifest.widgetConfig.entry));
+	files.push([manifest.widgetConfig.entry, readBundleFile(root, manifest.widgetConfig.entry)]);
+	for (const sample of manifest.widgetConfig.samples ?? []) files.push([sample.request, readBundleFile(root, sample.request)]);
 	if (options.includePreviewFixtures) {
-		const fixturesPath = join(project.projectRoot, "preview", "fixtures.json");
-		if (existsSync(fixturesPath)) files.push(["preview/fixtures.json", readFileSync(fixturesPath)]);
+		const fixturesPath = join(root, "preview", "fixtures.json");
+		if (existsSync(fixturesPath)) files.push(["preview/fixtures.json", readBundleFile(root, "preview/fixtures.json")]);
 	}
-	return storedZip(files);
+	return files;
 }
 //#endregion
 //#region src/migration/recipes.mjs
@@ -11392,4 +11858,4 @@ async function scaffoldDshWidget(input, output, options) {
 	};
 }
 //#endregion
-export { resolveWidgetProjects as a, checkWidgetProject as i, scaffoldDshWidget as n, compileAuthorManifest as o, buildWidgetPackage as r, auditDshPlugin as t };
+export { normalizeArchivePath as a, resolveWidgetProjects as c, collectWidgetPackageFiles as i, compileAuthorManifest as l, scaffoldDshWidget as n, storedZip as o, buildWidgetPackage as r, checkWidgetProject as s, auditDshPlugin as t };