@freelog-cli/cli2 0.5.3 → 0.5.4

package/dist/bin/index.js

@@ -9168,11 +9168,11 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path19) {
-      if (!path19 || typeof path19 !== "string") {
+    function lookup(path20) {
+      if (!path20 || typeof path20 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path19).toLowerCase().substr(1);
+      var extension2 = extname("x." + path20).toLowerCase().substr(1);
       if (!extension2) {
         return false;
       }
@@ -10287,7 +10287,7 @@ var require_form_data = __commonJS({
     "use strict";
     var CombinedStream = require_combined_stream();
     var util4 = __require("util");
-    var path19 = __require("path");
+    var path20 = __require("path");
     var http3 = __require("http");
     var https2 = __require("https");
     var parseUrl2 = __require("url").parse;
@@ -10418,11 +10418,11 @@ var require_form_data = __commonJS({
     FormData3.prototype._getContentDisposition = function(value, options) {
       var filename;
       if (typeof options.filepath === "string") {
-        filename = path19.normalize(options.filepath).replace(/\\/g, "/");
+        filename = path20.normalize(options.filepath).replace(/\\/g, "/");
       } else if (options.filename || value && (value.name || value.path)) {
-        filename = path19.basename(options.filename || value && (value.name || value.path));
+        filename = path20.basename(options.filename || value && (value.name || value.path));
       } else if (value && value.readable && hasOwn(value, "httpVersion")) {
-        filename = path19.basename(value.client._httpMessage.path || "");
+        filename = path20.basename(value.client._httpMessage.path || "");
       }
       if (filename) {
         return 'filename="' + escapeHeaderParam(filename) + '"';
@@ -13339,9 +13339,9 @@ function isVisitable(thing) {
 function removeBrackets(key) {
   return utils_default.endsWith(key, "[]") ? key.slice(0, -2) : key;
 }
-function renderKey(path19, key, dots) {
-  if (!path19) return key;
-  return path19.concat(key).map(function each(token, i) {
+function renderKey(path20, key, dots) {
+  if (!path20) return key;
+  return path20.concat(key).map(function each(token, i) {
     token = removeBrackets(token);
     return !dots && i ? "[" + token + "]" : token;
   }).join(dots ? "." : "");
@@ -13427,13 +13427,13 @@ function toFormData(obj, formData, options) {
       return currentValue;
     });
   }
-  function defaultVisitor(value, key, path19) {
+  function defaultVisitor(value, key, path20) {
     let arr = value;
     if (utils_default.isReactNative(formData) && utils_default.isReactNativeBlob(value)) {
-      formData.append(renderKey(path19, key, dots), convertValue(value));
+      formData.append(renderKey(path20, key, dots), convertValue(value));
       return false;
     }
-    if (value && !path19 && typeof value === "object") {
+    if (value && !path20 && typeof value === "object") {
       if (utils_default.endsWith(key, "{}")) {
         key = metaTokens ? key : key.slice(0, -2);
         value = stringifyWithDepthLimit(value, 1);
@@ -13452,7 +13452,7 @@ function toFormData(obj, formData, options) {
     if (isVisitable(value)) {
       return true;
     }
-    formData.append(renderKey(path19, key, dots), convertValue(value));
+    formData.append(renderKey(path20, key, dots), convertValue(value));
     return false;
   }
   const exposedHelpers = Object.assign(predicates, {
@@ -13460,17 +13460,17 @@ function toFormData(obj, formData, options) {
     convertValue,
     isVisitable
   });
-  function build(value, path19, depth = 0) {
+  function build(value, path20, depth = 0) {
     if (utils_default.isUndefined(value)) return;
     throwIfMaxDepthExceeded(depth);
     if (stack.indexOf(value) !== -1) {
-      throw new Error("Circular reference detected in " + path19.join("."));
+      throw new Error("Circular reference detected in " + path20.join("."));
     }
     stack.push(value);
     utils_default.forEach(value, function each(el, key) {
-      const result = !(utils_default.isUndefined(el) || el === null) && visitor.call(formData, el, utils_default.isString(key) ? key.trim() : key, path19, exposedHelpers);
+      const result = !(utils_default.isUndefined(el) || el === null) && visitor.call(formData, el, utils_default.isString(key) ? key.trim() : key, path20, exposedHelpers);
       if (result === true) {
-        build(el, path19 ? path19.concat(key) : [key], depth + 1);
+        build(el, path20 ? path20.concat(key) : [key], depth + 1);
       }
     });
     stack.pop();
@@ -13682,7 +13682,7 @@ var platform_default = {
 // ../../node_modules/.pnpm/axios@1.19.0/node_modules/axios/lib/helpers/toURLEncodedForm.js
 function toURLEncodedForm(data, options) {
   return toFormData_default(data, new platform_default.classes.URLSearchParams(), {
-    visitor: function(value, key, path19, helpers) {
+    visitor: function(value, key, path20, helpers) {
       if (platform_default.isNode && utils_default.isBuffer(value)) {
         this.append(key, value.toString("base64"));
         return false;
@@ -13704,14 +13704,14 @@ function throwIfDepthExceeded(index) {
   }
 }
 function parsePropPath(name) {
-  const path19 = [];
+  const path20 = [];
   const pattern = /[^.[\]]+|\[([^.[\]]*)]/g;
   let match;
   while ((match = pattern.exec(name)) !== null) {
-    throwIfDepthExceeded(path19.length);
-    path19.push(match[0] === "[]" ? "" : match[1] || match[0]);
+    throwIfDepthExceeded(path20.length);
+    path20.push(match[0] === "[]" ? "" : match[1] || match[0]);
   }
-  return path19;
+  return path20;
 }
 function arrayToObject(arr) {
   const obj = {};
@@ -13726,12 +13726,12 @@ function arrayToObject(arr) {
   return obj;
 }
 function formDataToJSON(formData) {
-  function buildPath(path19, value, target, index) {
+  function buildPath(path20, value, target, index) {
     throwIfDepthExceeded(index);
-    let name = path19[index++];
+    let name = path20[index++];
     if (name === "__proto__") return true;
     const isNumericKey = Number.isFinite(+name);
-    const isLast = index >= path19.length;
+    const isLast = index >= path20.length;
     name = !name && utils_default.isArray(target) ? target.length : name;
     if (isLast) {
       if (utils_default.hasOwnProp(target, name)) {
@@ -13744,7 +13744,7 @@ function formDataToJSON(formData) {
     if (!utils_default.hasOwnProp(target, name) || !utils_default.isObject(target[name])) {
       target[name] = [];
     }
-    const result = buildPath(path19, value, target[name], index);
+    const result = buildPath(path20, value, target[name], index);
     if (result && utils_default.isArray(target[name])) {
       target[name] = arrayToObject(target[name]);
     }
@@ -15462,9 +15462,9 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config) {
       auth = urlUsername + ":" + urlPassword;
     }
     auth && headers.delete("authorization");
-    let path19;
+    let path20;
     try {
-      path19 = buildURL(
+      path20 = buildURL(
         parsed.pathname + parsed.search,
         own2("params"),
         own2("paramsSerializer")
@@ -15483,7 +15483,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config) {
       false
     );
     const options = Object.assign(/* @__PURE__ */ Object.create(null), {
-      path: path19,
+      path: path20,
       method,
       headers: toByteStringHeaderObject(headers),
       agents: { http: httpAgent, https: httpsAgent },
@@ -15885,14 +15885,14 @@ var isURLSameOrigin_default = platform_default.hasStandardBrowserEnv ? /* @__PUR
 var cookies_default = platform_default.hasStandardBrowserEnv ? (
   // Standard browser envs support document.cookie
   {
-    write(name, value, expires, path19, domain, secure, sameSite) {
+    write(name, value, expires, path20, domain, secure, sameSite) {
       if (typeof document === "undefined") return;
       const cookie = [`${name}=${encodeURIComponent(value)}`];
       if (utils_default.isNumber(expires)) {
         cookie.push(`expires=${new Date(expires).toUTCString()}`);
       }
-      if (utils_default.isString(path19)) {
-        cookie.push(`path=${path19}`);
+      if (utils_default.isString(path20)) {
+        cookie.push(`path=${path20}`);
       }
       if (utils_default.isString(domain)) {
         cookie.push(`domain=${domain}`);
@@ -17786,14 +17786,14 @@ function copy(a, s, t2) {
     if (s[m]) t2[m] = s[m];
   });
 }
-function getLastOfPath(object, path19, Empty) {
+function getLastOfPath(object, path20, Empty) {
   function cleanKey(key2) {
     return key2 && key2.indexOf("###") > -1 ? key2.replace(/###/g, ".") : key2;
   }
   function canNotTraverseDeeper() {
     return !object || typeof object === "string";
   }
-  var stack = typeof path19 !== "string" ? [].concat(path19) : path19.split(".");
+  var stack = typeof path20 !== "string" ? [].concat(path20) : path20.split(".");
   while (stack.length > 1) {
     if (canNotTraverseDeeper()) return {};
     var key = cleanKey(stack.shift());
@@ -17810,18 +17810,18 @@ function getLastOfPath(object, path19, Empty) {
     k: cleanKey(stack.shift())
   };
 }
-function setPath(object, path19, newValue) {
-  var _getLastOfPath = getLastOfPath(object, path19, Object), obj = _getLastOfPath.obj, k = _getLastOfPath.k;
+function setPath(object, path20, newValue) {
+  var _getLastOfPath = getLastOfPath(object, path20, Object), obj = _getLastOfPath.obj, k = _getLastOfPath.k;
   obj[k] = newValue;
 }
-function pushPath(object, path19, newValue, concat) {
-  var _getLastOfPath2 = getLastOfPath(object, path19, Object), obj = _getLastOfPath2.obj, k = _getLastOfPath2.k;
+function pushPath(object, path20, newValue, concat) {
+  var _getLastOfPath2 = getLastOfPath(object, path20, Object), obj = _getLastOfPath2.obj, k = _getLastOfPath2.k;
   obj[k] = obj[k] || [];
   if (concat) obj[k] = obj[k].concat(newValue);
   if (!concat) obj[k].push(newValue);
 }
-function getPath(object, path19) {
-  var _getLastOfPath3 = getLastOfPath(object, path19), obj = _getLastOfPath3.obj, k = _getLastOfPath3.k;
+function getPath(object, path20) {
+  var _getLastOfPath3 = getLastOfPath(object, path20), obj = _getLastOfPath3.obj, k = _getLastOfPath3.k;
   if (!obj) return void 0;
   return obj[k];
 }
@@ -17943,11 +17943,11 @@ function _isNativeReflectConstruct() {
     return false;
   }
 }
-function deepFind(obj, path19) {
+function deepFind(obj, path20) {
   var keySeparator = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : ".";
   if (!obj) return void 0;
-  if (obj[path19]) return obj[path19];
-  var paths = path19.split(keySeparator);
+  if (obj[path20]) return obj[path20];
+  var paths = path20.split(keySeparator);
   var current = obj;
   for (var i = 0; i < paths.length; ++i) {
     if (!current) return void 0;
@@ -17965,7 +17965,7 @@ function deepFind(obj, path19) {
       }
       if (mix === void 0) return void 0;
       if (mix === null) return null;
-      if (path19.endsWith(p)) {
+      if (path20.endsWith(p)) {
         if (typeof mix === "string") return mix;
         if (p && typeof mix[p] === "string") return mix[p];
       }
@@ -18022,13 +18022,13 @@ var ResourceStore = (function(_EventEmitter) {
       var options = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : {};
       var keySeparator = options.keySeparator !== void 0 ? options.keySeparator : this.options.keySeparator;
       var ignoreJSONStructure = options.ignoreJSONStructure !== void 0 ? options.ignoreJSONStructure : this.options.ignoreJSONStructure;
-      var path19 = [lng, ns];
-      if (key && typeof key !== "string") path19 = path19.concat(key);
-      if (key && typeof key === "string") path19 = path19.concat(keySeparator ? key.split(keySeparator) : key);
+      var path20 = [lng, ns];
+      if (key && typeof key !== "string") path20 = path20.concat(key);
+      if (key && typeof key === "string") path20 = path20.concat(keySeparator ? key.split(keySeparator) : key);
       if (lng.indexOf(".") > -1) {
-        path19 = lng.split(".");
+        path20 = lng.split(".");
       }
-      var result = getPath(this.data, path19);
+      var result = getPath(this.data, path20);
       if (result || !ignoreJSONStructure || typeof key !== "string") return result;
       return deepFind(this.data && this.data[lng] && this.data[lng][ns], key, keySeparator);
     }
@@ -18040,15 +18040,15 @@ var ResourceStore = (function(_EventEmitter) {
       };
       var keySeparator = this.options.keySeparator;
       if (keySeparator === void 0) keySeparator = ".";
-      var path19 = [lng, ns];
-      if (key) path19 = path19.concat(keySeparator ? key.split(keySeparator) : key);
+      var path20 = [lng, ns];
+      if (key) path20 = path20.concat(keySeparator ? key.split(keySeparator) : key);
       if (lng.indexOf(".") > -1) {
-        path19 = lng.split(".");
+        path20 = lng.split(".");
         value = ns;
-        ns = path19[1];
+        ns = path20[1];
       }
       this.addNamespaces(ns);
-      setPath(this.data, path19, value);
+      setPath(this.data, path20, value);
       if (!options.silent) this.emit("added", lng, ns, key, value);
     }
   }, {
@@ -18070,21 +18070,21 @@ var ResourceStore = (function(_EventEmitter) {
       var options = arguments.length > 5 && arguments[5] !== void 0 ? arguments[5] : {
         silent: false
       };
-      var path19 = [lng, ns];
+      var path20 = [lng, ns];
       if (lng.indexOf(".") > -1) {
-        path19 = lng.split(".");
+        path20 = lng.split(".");
         deep = resources;
         resources = ns;
-        ns = path19[1];
+        ns = path20[1];
       }
       this.addNamespaces(ns);
-      var pack = getPath(this.data, path19) || {};
+      var pack = getPath(this.data, path20) || {};
       if (deep) {
         deepExtend(pack, resources, overwrite);
       } else {
         pack = _objectSpread$1(_objectSpread$1({}, pack), resources);
       }
-      setPath(this.data, path19, pack);
+      setPath(this.data, path20, pack);
       if (!options.silent) this.emit("added", lng, ns, resources);
     }
   }, {
@@ -19078,10 +19078,10 @@ var Interpolator = (function() {
       }
       var handleFormat = function handleFormat2(key) {
         if (key.indexOf(_this.formatSeparator) < 0) {
-          var path19 = getPathWithDefaults(data, defaultData, key);
-          return _this.alwaysFormat ? _this.format(path19, void 0, lng, _objectSpread$3(_objectSpread$3(_objectSpread$3({}, options), data), {}, {
+          var path20 = getPathWithDefaults(data, defaultData, key);
+          return _this.alwaysFormat ? _this.format(path20, void 0, lng, _objectSpread$3(_objectSpread$3(_objectSpread$3({}, options), data), {}, {
             interpolationkey: key
-          })) : path19;
+          })) : path20;
         }
         var p = key.split(_this.formatSeparator);
         var k = p.shift().trim();
@@ -23985,7 +23985,7 @@ function addSharedOptions(command) {
     "--json",
     // i18n: cli.flag.json
     "\u4EE5 JSON \u8F93\u51FA"
-  ).option("--resource <selector>", "\u9009\u62E9\u672C\u5730\u8D44\u6E90\uFF08id:\u3001name:\u3001title:\u3001artifact: \u6216 file:N.json\uFF09");
+  ).option("--resource <selector>", "\u9009\u62E9\u672C\u5730\u8D44\u6E90\uFF08id:\u3001name:\u3001artifact: \u6216 file:N.json\uFF09");
 }
 function readSharedOptions(command) {
   const raw = command.optsWithGlobals();
@@ -24273,28 +24273,47 @@ function sha256(content) {
 function readText(filePath) {
   return existsSync3(filePath) ? readFileSync2(filePath, "utf8") : null;
 }
-function validateTransaction(raw) {
+function resolveTransactionTarget(cwd, entryPath, allowLegacyIndex = false) {
+  const root = path4.resolve(freelogDir(cwd));
+  const allowed = allowLegacyIndex && entryPath === "index.json" || entryPath === ".sequence" || entryPath === ".pending-operation.json" || /^[1-9]\d*(?:\.version)?\.json$/.test(entryPath);
+  if (!allowed || path4.isAbsolute(entryPath) || entryPath.includes("/") || entryPath.includes("\\")) {
+    throw new CliError("\u672C\u5730\u4E8B\u52A1\u65E5\u5FD7\u5305\u542B\u4E0D\u5141\u8BB8\u7684\u76EE\u6807", "LOCAL_TXN_INVALID");
+  }
+  const target = path4.resolve(root, entryPath);
+  if (path4.dirname(target) !== root) {
+    throw new CliError("\u672C\u5730\u4E8B\u52A1\u65E5\u5FD7\u5305\u542B\u8D8A\u754C\u76EE\u6807", "LOCAL_TXN_INVALID");
+  }
+  return target;
+}
+function validateTransaction(cwd, raw) {
   const value = raw;
   if (value?.schemaVersion !== 1 || !Array.isArray(value.entries) || value.entries.length === 0) {
     throw new CliError("\u672C\u5730\u4E8B\u52A1\u65E5\u5FD7\u65E0\u6548\uFF0C\u8BF7\u5148\u5907\u4EFD .freelog \u540E\u5904\u7406", "LOCAL_TXN_INVALID");
   }
+  const targets = /* @__PURE__ */ new Set();
   for (const entry2 of value.entries) {
     if (!entry2 || typeof entry2.path !== "string" || entry2.before !== null && typeof entry2.before !== "string" || entry2.after !== null && typeof entry2.after !== "string" || entry2.beforeSha256 !== sha256(entry2.before) || entry2.afterSha256 !== sha256(entry2.after)) {
       throw new CliError("\u672C\u5730\u4E8B\u52A1\u65E5\u5FD7\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u5148\u5907\u4EFD .freelog \u540E\u5904\u7406", "LOCAL_TXN_INVALID");
     }
+    const target = resolveTransactionTarget(cwd, entry2.path, true);
+    if (targets.has(target)) {
+      throw new CliError("\u672C\u5730\u4E8B\u52A1\u65E5\u5FD7\u5305\u542B\u91CD\u590D\u76EE\u6807", "LOCAL_TXN_INVALID");
+    }
+    targets.add(target);
   }
   return value;
 }
-function applyEntry(entry2) {
-  const current = readText(entry2.path);
+function applyEntry(cwd, entry2) {
+  const target = resolveTransactionTarget(cwd, entry2.path, true);
+  const current = readText(target);
   if (current === entry2.after) return;
   if (current !== entry2.before) {
-    throw new CliError(`\u672C\u5730\u4E8B\u52A1\u4E0E ${path4.basename(entry2.path)} \u51B2\u7A81\uFF0C\u62D2\u7EDD\u731C\u6D4B\u8986\u76D6`, "LOCAL_TXN_CONFLICT");
+    throw new CliError(`\u672C\u5730\u4E8B\u52A1\u4E0E ${entry2.path} \u51B2\u7A81\uFF0C\u62D2\u7EDD\u731C\u6D4B\u8986\u76D6`, "LOCAL_TXN_CONFLICT");
   }
   if (entry2.after === null) {
-    if (existsSync3(entry2.path)) unlinkSync2(entry2.path);
+    if (existsSync3(target)) unlinkSync2(target);
   } else {
-    atomicWriteFile(entry2.path, entry2.after);
+    atomicWriteFile(target, entry2.after);
   }
 }
 function recoverPendingTransaction(cwd) {
@@ -24306,23 +24325,25 @@ function recoverPendingTransaction(cwd) {
   } catch {
     throw new CliError("\u672C\u5730\u4E8B\u52A1\u65E5\u5FD7\u65E0\u6CD5\u89E3\u6790\uFF0C\u8BF7\u5148\u5907\u4EFD .freelog \u540E\u5904\u7406", "LOCAL_TXN_INVALID");
   }
-  const transaction2 = validateTransaction(raw);
-  for (const entry2 of transaction2.entries) applyEntry(entry2);
+  const transaction2 = validateTransaction(cwd, raw);
+  for (const entry2 of transaction2.entries) applyEntry(cwd, entry2);
   unlinkSync2(txnPath);
 }
 function commitLocalTransaction(cwd, changes) {
   if (changes.length === 0) return;
-  const root = `${path4.resolve(freelogDir(cwd))}${path4.sep}`;
+  const root = path4.resolve(freelogDir(cwd));
   const paths = /* @__PURE__ */ new Set();
   const entries = changes.map((change) => {
     const target = path4.resolve(change.path);
-    if (!target.startsWith(root) || paths.has(target)) {
+    if (path4.dirname(target) !== root || paths.has(target)) {
       throw new CliError("\u672C\u5730\u4E8B\u52A1\u76EE\u6807\u65E0\u6548", "LOCAL_TXN_INVALID");
     }
+    const relativePath = path4.basename(target);
+    resolveTransactionTarget(cwd, relativePath);
     paths.add(target);
     const before = readText(target);
     return {
-      path: target,
+      path: relativePath,
       before,
       beforeSha256: sha256(before),
       after: change.content,
@@ -24332,7 +24353,7 @@ function commitLocalTransaction(cwd, changes) {
   if (entries.length === 0) return;
   atomicWriteFile(transactionFilePath(cwd), `${JSON.stringify({ schemaVersion: 1, entries }, null, 2)}
 `);
-  for (const entry2 of entries) applyEntry(entry2);
+  for (const entry2 of entries) applyEntry(cwd, entry2);
   unlinkSync2(transactionFilePath(cwd));
 }
 
@@ -24456,6 +24477,7 @@ var IDENTITY_FILE_RE = /^([1-9]\d*)\.json$/;
 var inputFields = {
   subject: z2.literal("resource"),
   resourceId: z2.string().min(1).optional(),
+  resourceName: z2.string().min(1).optional(),
   name: z2.string().min(1).optional(),
   title: z2.string().min(1).optional(),
   typeCode: z2.string().min(1),
@@ -24469,9 +24491,10 @@ var storedSchema = z2.object({
   ...inputFields
 }).strict().superRefine((identity, ctx) => {
   const hasResourceId = identity.resourceId !== void 0;
+  const hasResourceName = identity.resourceName !== void 0;
   const hasName = identity.name !== void 0;
   const hasTitle = identity.title !== void 0;
-  const bound = hasResourceId || hasName || hasTitle;
+  const bound = hasResourceId || hasResourceName || hasName || hasTitle;
   if (hasResourceId !== hasName) {
     ctx.addIssue({
       code: ZodIssueCode.custom,
@@ -24479,8 +24502,11 @@ var storedSchema = z2.object({
       message: "\u7ED1\u5B9A\u8EAB\u4EFD\u5FC5\u987B\u540C\u65F6\u5305\u542B resourceId \u548C name"
     });
   }
-  if (!hasResourceId && !hasName && hasTitle) {
-    ctx.addIssue({ code: ZodIssueCode.custom, path: ["title"], message: "\u672A\u7ED1\u5B9A\u8EAB\u4EFD\u4E0D\u80FD\u5199\u5165 title" });
+  if (hasResourceName && (!hasResourceId || !hasName)) {
+    ctx.addIssue({ code: ZodIssueCode.custom, path: ["resourceName"], message: "\u5B8C\u6574\u8D44\u6E90\u6807\u8BC6\u53EA\u80FD\u5C5E\u4E8E\u5DF2\u7ED1\u5B9A\u8EAB\u4EFD" });
+  }
+  if (!hasResourceId && !hasName && (hasTitle || hasResourceName)) {
+    ctx.addIssue({ code: ZodIssueCode.custom, path: [hasTitle ? "title" : "resourceName"], message: "\u672A\u7ED1\u5B9A\u8EAB\u4EFD\u4E0D\u80FD\u5199\u5165\u7ED1\u5B9A\u7F13\u5B58" });
   }
   if (!bound && identity.env !== void 0) {
     ctx.addIssue({
@@ -24496,6 +24522,9 @@ function freelogDir(cwd) {
 function identityFilePath(cwd, n) {
   return path6.join(freelogDir(cwd), `${n}.json`);
 }
+function identitySequenceFilePath(cwd) {
+  return path6.join(freelogDir(cwd), ".sequence");
+}
 function assertIdentityNumber(n) {
   if (!Number.isInteger(n) || n < 1) {
     throw new CliError("\u8EAB\u4EFD\u7F16\u53F7\u65E0\u6548", "IDENTITY_INVALID");
@@ -24516,7 +24545,7 @@ function throwZodAsCliError(error2) {
   if (field === "subject") {
     throw new CliError("\u672C\u671F\u53EA\u652F\u6301\u5355\u8D44\u6E90", "IDENTITY_SUBJECT_UNSUPPORTED");
   }
-  if (field === "name" || field === "resourceId" || field === "title") {
+  if (field === "name" || field === "resourceName" || field === "resourceId" || field === "title") {
     throw new CliError("\u7ED1\u5B9A\u8EAB\u4EFD\u5B57\u6BB5\u4E0D\u5B8C\u6574", "IDENTITY_BINDING_INVALID");
   }
   if (field === "filePath") {
@@ -24529,6 +24558,7 @@ function toStored(data) {
     schemaVersion: 1,
     subject: data.subject,
     ...data.resourceId ? { resourceId: data.resourceId } : {},
+    ...data.resourceName ? { resourceName: data.resourceName } : {},
     ...data.name ? { name: data.name } : {},
     ...data.title ? { title: data.title } : {},
     typeCode: data.typeCode,
@@ -24548,6 +24578,7 @@ function toDiskObject(identity) {
     schemaVersion: 1,
     subject: identity.subject,
     ...identity.resourceId ? { resourceId: identity.resourceId } : {},
+    ...identity.resourceName ? { resourceName: identity.resourceName } : {},
     ...identity.name ? { name: identity.name } : {},
     ...identity.title ? { title: identity.title } : {},
     typeCode: identity.typeCode,
@@ -24575,6 +24606,7 @@ function prepareIdentityUpdate(cwd, n, patch) {
   const identity = normalize({
     subject: parsed.subject ?? current.subject,
     resourceId: parsed.resourceId ?? current.resourceId,
+    resourceName: parsed.resourceName ?? current.resourceName,
     name: parsed.name ?? current.name,
     title: parsed.title ?? current.title,
     typeCode: parsed.typeCode ?? current.typeCode,
@@ -24585,7 +24617,23 @@ function prepareIdentityUpdate(cwd, n, patch) {
 }
 function prepareIdentityCreate(cwd, input2) {
   const numbers = listIdentityNumbers(cwd);
-  return { n: numbers.length === 0 ? 1 : Math.max(...numbers) + 1, ...parseCreateInput(input2) };
+  const highestOnDisk = numbers.length === 0 ? 0 : Math.max(...numbers);
+  const sequencePath = identitySequenceFilePath(cwd);
+  let highestAllocated = 0;
+  if (existsSync5(sequencePath)) {
+    const raw = readFileSync4(sequencePath, "utf8").trim();
+    const parsed = Number(raw);
+    if (!/^[1-9]\d*$/.test(raw) || !Number.isSafeInteger(parsed)) {
+      throw new CliError(".freelog/.sequence \u65E0\u6548\uFF0C\u8BF7\u5148\u5907\u4EFD\u540E\u6062\u590D", "IDENTITY_SEQUENCE_INVALID");
+    }
+    highestAllocated = parsed;
+  }
+  return { n: Math.max(highestOnDisk, highestAllocated) + 1, ...parseCreateInput(input2) };
+}
+function serializeIdentitySequence(n) {
+  assertIdentityNumber(n);
+  return `${n}
+`;
 }
 function parsePatchInput(input2) {
   const parsed = patchSchema.safeParse(input2);
@@ -24631,7 +24679,10 @@ function listIdentities(cwd) {
 function createIdentity(cwd, input2) {
   return withProjectLock(cwd, () => {
     const identity = prepareIdentityCreate(cwd, input2);
-    writeIdentityFile(cwd, identity.n, identity);
+    commitLocalTransaction(cwd, [
+      { path: identityFilePath(cwd, identity.n), content: serializeIdentity(identity) },
+      { path: identitySequenceFilePath(cwd), content: serializeIdentitySequence(identity.n) }
+    ]);
     return identity;
   }, "create-identity");
 }
@@ -24644,7 +24695,7 @@ function updateIdentity(cwd, n, patch) {
 }
 
 // src/local/resolve.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync2 } from "fs";
 
 // src/local/draft.ts
 import { existsSync as existsSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync4 } from "fs";
@@ -24765,6 +24816,7 @@ function draftSummary(draft) {
 
 // src/local/projectPath.ts
 import path8 from "path";
+import { existsSync as existsSync7, realpathSync } from "fs";
 var defaultError = {
   code: "FILE_PATH_OUTSIDE_PROJECT",
   message: "\u8DEF\u5F84\u5FC5\u987B\u843D\u5728\u5F53\u524D\u5DE5\u7A0B\u91CC"
@@ -24776,10 +24828,29 @@ function normalizeProjectPath(cwd, rawPath, error2 = defaultError) {
   const root = path8.resolve(cwd);
   const resolved = path8.resolve(root, rawPath);
   const relative = path8.relative(root, resolved);
-  if (!relative || relative.startsWith("..") || path8.isAbsolute(relative)) {
+  const normalized = relative.replaceAll("\\", "/");
+  if (!relative || relative.startsWith("..") || path8.isAbsolute(relative) || normalized === ".freelog" || normalized.startsWith(".freelog/")) {
+    throw new CliError(error2.message, error2.code);
+  }
+  return normalized;
+}
+function isInside(root, target) {
+  const relative = path8.relative(root, target);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path8.sep}`) && !path8.isAbsolute(relative);
+}
+function resolveExistingProjectPath(cwd, filePath, error2 = defaultError) {
+  const root = path8.resolve(cwd);
+  const absolute = path8.resolve(root, filePath);
+  if (!existsSync7(absolute)) {
+    if (!isInside(root, absolute)) throw new CliError(error2.message, error2.code);
+    return absolute;
+  }
+  const realRoot = realpathSync(root);
+  const realTarget = realpathSync(absolute);
+  if (!isInside(realRoot, realTarget)) {
     throw new CliError(error2.message, error2.code);
   }
-  return relative.replaceAll("\\", "/");
+  return realTarget;
 }
 
 // src/local/resolve.ts
@@ -24799,25 +24870,24 @@ function assertNoDuplicate(cwd, identities, key) {
 function matches(cwd, identity, selector) {
   if (selector.startsWith("file:")) return `${identity.n}.json` === selector.slice(5);
   if (selector.startsWith("id:")) return identity.resourceId === selector.slice(3);
-  if (selector.startsWith("name:")) return identity.name === selector.slice(5) || identity.name === selector.slice(5).split("/").pop();
-  if (selector.startsWith("title:")) return identity.title === selector.slice(6);
+  if (selector.startsWith("name:")) return identity.resourceName === selector.slice(5);
   if (selector.startsWith("artifact:")) {
     return normalizeProjectPath(cwd, identity.filePath) === normalizeProjectPath(
       cwd,
       selector.slice("artifact:".length)
     );
   }
-  return `${identity.n}.json` === selector || identity.resourceId === selector || identity.name === selector || identity.title === selector;
+  return `${identity.n}.json` === selector || identity.resourceId === selector || identity.resourceName === selector;
 }
 var DRAFT_FILE_RE = /^([1-9]\d*)\.version\.json$/;
 function validateLocalState(cwd) {
   const identities = listIdentities(cwd);
   assertNoDuplicate(cwd, identities, "resourceId");
-  assertNoDuplicate(cwd, identities, "name");
+  assertNoDuplicate(cwd, identities, "resourceName");
   assertNoDuplicate(cwd, identities, "filePath");
   const numbers = new Set(identities.map((identity) => identity.n));
   const dir = freelogDir(cwd);
-  if (!existsSync7(dir)) return identities;
+  if (!existsSync8(dir)) return identities;
   for (const fileName of readdirSync2(dir)) {
     const match = DRAFT_FILE_RE.exec(fileName);
     if (!match) continue;
@@ -24914,6 +24984,15 @@ function unwrapOne(result) {
   const data = envelope.data ?? result;
   return data && typeof data === "object" && !Array.isArray(data) ? data : void 0;
 }
+function normalizeTypeInfo(node) {
+  const support = node.resourceConfig?.supportOptionalConfig ?? node.supportOptionalConfig;
+  if (support === void 0 || support === null || support === "") return node;
+  const numeric = Number(support);
+  return Number.isFinite(numeric) ? { ...node, supportOptionalConfig: numeric } : node;
+}
+function supportsOptionalConfig(node) {
+  return Number(node.resourceConfig?.supportOptionalConfig ?? node.supportOptionalConfig) === 2;
+}
 function isEnabledResourceLeaf(node) {
   return node.isTerminate === true && node.status === 1 && supportsResourceSubject(node.subjectType);
 }
@@ -24943,6 +25022,28 @@ async function resourceTypeTree(apis) {
   const request2 = apis.resourceTypes ?? ((params) => service_API_default.Resource.resourceTypes(params));
   return unwrapList(await request2({ category: 1, status: 1, subjectType: 1 }));
 }
+function findTypePath(nodes2, code, ancestors = []) {
+  for (const node of nodes2) {
+    const path20 = [...ancestors, node];
+    if (node.code === code) return path20;
+    if (hasChildren(node)) {
+      const found = findTypePath(node.children, code, path20);
+      if (found) return found;
+    }
+  }
+  return void 0;
+}
+async function getTypeHierarchy(code, apis = {}) {
+  const normalized = code.trim();
+  if (!normalized) throw new CliError("\u8BF7\u63D0\u4F9B\u8D44\u6E90\u7C7B\u578B\u7F16\u53F7", "TYPE_CODE_REQUIRED");
+  const path20 = findTypePath(await resourceTypeTree(apis), normalized);
+  if (!path20) throw new CliError(`\u5E73\u53F0\u7C7B\u578B\u6811\u4E0D\u5305\u542B\u5F53\u524D\u7C7B\u578B ${normalized}`, "TYPE_HIERARCHY_NOT_FOUND");
+  const names = path20.map((node) => node.name.trim());
+  if (names.some((name) => !name)) {
+    throw new CliError("\u5E73\u53F0\u7C7B\u578B\u94FE\u5B58\u5728\u7F3A\u5931\u540D\u79F0\uFF0C\u65E0\u6CD5\u5C55\u793A\u5B8C\u6574\u5C42\u7EA7", "TYPE_HIERARCHY_INVALID");
+  }
+  return names;
+}
 async function listLeafTypes(apis = {}) {
   return flattenLeaves(await resourceTypeTree(apis));
 }
@@ -24963,7 +25064,8 @@ async function getTypeInfo(code, apis = {}) {
   }
   assertPlatformAllowed();
   const request2 = apis.getByCode ?? ((params) => service_API_default.Resource.getResourceTypeInfoByCode(params));
-  const info2 = unwrapOne(await request2({ code: normalized }));
+  const rawInfo = unwrapOne(await request2({ code: normalized }));
+  const info2 = rawInfo ? normalizeTypeInfo(rawInfo) : void 0;
   if (!info2?.code) {
     throw new CliError(`\u627E\u4E0D\u5230\u7C7B\u578B ${normalized}`, "TYPE_NOT_FOUND");
   }
@@ -25030,10 +25132,15 @@ async function chooseLeafType(apis = {}) {
 function formatTypeList(items) {
   return items.map((item) => `${item.code}	${item.nameChain ?? item.name}`).join("\n");
 }
+function formatTypeInfo(item) {
+  const optionalConfig = supportsOptionalConfig(item) ? "\u652F\u6301" : "\u4E0D\u652F\u6301";
+  return `${item.code}	${item.nameChain ?? item.name}	\u53EF\u9009\u914D\u7F6E\uFF1A${optionalConfig}`;
+}
 
 // src/domain/version/zip.ts
-import { createWriteStream, existsSync as existsSync8, readdirSync as readdirSync3, statSync, unlinkSync as unlinkSync5 } from "fs";
+import { createWriteStream, existsSync as existsSync9, lstatSync, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync, unlinkSync as unlinkSync5 } from "fs";
 import { tmpdir } from "os";
+import { randomUUID } from "crypto";
 import path9 from "path";
 import { finished } from "stream/promises";
 import archiver from "archiver";
@@ -25041,56 +25148,83 @@ function isThemeOrWidget(typeCode) {
   return typeCode === "RT001" || typeCode === "RT002";
 }
 function assertArtifactPath(typeCode, filePath) {
-  const stats = existsSync8(filePath) ? statSync(filePath) : void 0;
+  const stats = existsSync9(filePath) ? statSync(filePath) : void 0;
   const themeOrWidget = isThemeOrWidget(typeCode);
   if (stats?.isDirectory() && !themeOrWidget) {
     throw new CliError("\u4E0D\u652F\u6301\u6587\u4EF6\u5939\uFF0C\u8BF7\u6307\u5B9A\u4E00\u4E2A\u6587\u4EF6\u3002", "FILE_DIRECTORY_UNSUPPORTED");
   }
 }
-function assertArtifactAnchor(typeCode, filePath) {
-  if (!existsSync8(filePath)) {
+function assertArtifactAnchor(typeCode, filePath, cwd) {
+  if (!existsSync9(filePath)) {
     throw new CliError(`\u672C\u5730\u4EA7\u7269\u4E0D\u5B58\u5728\uFF1A${filePath}`, "ARTIFACT_ANCHOR_MISSING");
   }
+  if (cwd) resolveExistingProjectPath(cwd, filePath);
   const stats = statSync(filePath);
   assertArtifactPath(typeCode, filePath);
   if (!isThemeOrWidget(typeCode) && !stats.isFile()) {
     throw new CliError("\u4E0D\u652F\u6301\u6587\u4EF6\u5939\uFF0C\u8BF7\u6307\u5B9A\u4E00\u4E2A\u6587\u4EF6\u3002", "FILE_DIRECTORY_UNSUPPORTED");
   }
 }
-async function zipDirectoryContents(dir) {
-  if (!existsSync8(dir) || !statSync(dir).isDirectory()) {
+function assertUploadArtifactReady(typeCode, filePath, cwd) {
+  if (cwd) resolveExistingProjectPath(cwd, filePath);
+  assertArtifactPath(typeCode, filePath);
+  const stats = existsSync9(filePath) ? statSync(filePath) : void 0;
+  if (!stats) {
+    throw new CliError(`\u672C\u5730\u4EA7\u7269\u4E0D\u5B58\u5728\uFF1A${filePath}`, "ARTIFACT_ANCHOR_MISSING");
+  }
+  if (stats.isDirectory() && isThemeOrWidget(typeCode)) {
+    assertZipDirectoryReady(filePath);
+    return;
+  }
+  if (!stats.isFile()) {
+    throw new CliError("\u4EA7\u7269\u5FC5\u987B\u662F\u6587\u4EF6\uFF0C\u6216\u4E3B\u9898/\u63D2\u4EF6\u7684\u975E\u7A7A\u6784\u5EFA\u76EE\u5F55\u3002", "FILE_ARTIFACT_UNSUPPORTED");
+  }
+}
+function assertZipDirectoryReady(dir) {
+  if (!existsSync9(dir) || !statSync(dir).isDirectory()) {
     throw new CliError(`\u6CA1\u6709\u6784\u5EFA\u4EA7\u7269 ${dir}\uFF0C\u8BF7\u5148\u6784\u5EFA`, "ZIP_MISSING");
   }
-  if (existsSync8(path9.join(dir, ".freelog"))) {
+  if (existsSync9(path9.join(dir, ".freelog"))) {
     throw new CliError("\u4E0D\u8981\u628A\u5DE5\u7A0B\u6839\u5F53\u4EA7\u7269\u76EE\u5F55\uFF0C\u8BF7\u6307\u5B9A dist \u6216 build\u3002", "ZIP_PROJECT_ROOT");
   }
-  const entries = readdirSync3(dir);
-  if (entries.length === 0) {
+  if (readdirSync3(dir).length === 0) {
     throw new CliError("\u6784\u5EFA\u4EA7\u7269\u662F\u7A7A\u7684\uFF0C\u8BF7\u5148\u6784\u5EFA", "ZIP_EMPTY");
   }
+}
+async function zipDirectoryContents(dir) {
+  assertZipDirectoryReady(dir);
   const outPath = path9.join(
     tmpdir(),
-    `freelog-zip-${process.pid}-${Date.now()}.zip`
+    `freelog-zip-${process.pid}-${randomUUID()}.zip`
   );
   const output2 = createWriteStream(outPath);
   const archive = archiver("zip", { zlib: { level: 9 } });
   try {
     archive.on("error", (error2) => output2.destroy(error2));
     archive.pipe(output2);
-    for (const entry2 of entries) {
-      const full = path9.join(dir, entry2);
-      const stats = statSync(full);
-      if (stats.isDirectory()) {
-        archive.directory(full, entry2);
-      } else {
-        archive.file(full, { name: entry2 });
+    const appendEntries = (currentDir, prefix = "") => {
+      for (const entry2 of readdirSync3(currentDir).sort((left, right) => left < right ? -1 : left > right ? 1 : 0)) {
+        const full = path9.join(currentDir, entry2);
+        const stats = lstatSync(full);
+        const entryName = prefix ? `${prefix}/${entry2}` : entry2;
+        if (stats.isSymbolicLink()) {
+          throw new CliError(`\u6784\u5EFA\u76EE\u5F55\u4E0D\u80FD\u5305\u542B\u8F6F\u94FE\u63A5\uFF1A${entryName}`, "ZIP_SYMLINK_UNSUPPORTED");
+        }
+        if (stats.isDirectory()) {
+          appendEntries(full, entryName);
+        } else if (stats.isFile()) {
+          archive.append(readFileSync6(full), { name: entryName });
+        } else {
+          throw new CliError(`\u6784\u5EFA\u76EE\u5F55\u5305\u542B\u4E0D\u652F\u6301\u7684\u6761\u76EE\uFF1A${entryName}`, "ZIP_ENTRY_UNSUPPORTED");
+        }
       }
-    }
+    };
+    appendEntries(dir);
     await archive.finalize();
     await finished(output2);
     return outPath;
   } catch (error2) {
-    if (existsSync8(outPath)) {
+    if (existsSync9(outPath)) {
       try {
         unlinkSync5(outPath);
       } catch {
@@ -25099,9 +25233,9 @@ async function zipDirectoryContents(dir) {
     throw error2;
   }
 }
-async function prepareUploadPath(typeCode, filePath) {
-  assertArtifactPath(typeCode, filePath);
-  if (isThemeOrWidget(typeCode) && existsSync8(filePath) && statSync(filePath).isDirectory()) {
+async function prepareUploadPath(typeCode, filePath, cwd) {
+  assertUploadArtifactReady(typeCode, filePath, cwd);
+  if (isThemeOrWidget(typeCode) && existsSync9(filePath) && statSync(filePath).isDirectory()) {
     return zipDirectoryContents(filePath);
   }
   return filePath;
@@ -25164,6 +25298,9 @@ function validateCreateFlags(input2) {
 function resolveTargetIdentity(input2) {
   if (input2.selector) return resolveIdentity(input2.cwd, input2.selector);
   const unbound = input2.identities.filter((identity) => !identity.resourceId);
+  if (input2.artifact !== void 0) {
+    return unbound.find((identity) => identity.filePath === input2.artifact);
+  }
   if (unbound.length === 1) return unbound[0];
   if (unbound.length > 1) throw new CliError("\u5F53\u524D\u5DE5\u7A0B\u6709\u591A\u4EFD\u672A\u7ED1\u5B9A\u8D44\u6E90\u72B6\u6001\uFF1B\u8BF7\u4F7F\u7528 --resource \u6307\u5B9A\u8D44\u6E90", "IDENTITY_RESOURCE_REQUIRED");
   return void 0;
@@ -25177,7 +25314,8 @@ async function assertOwnShellAvailable(input2) {
   if (!existing.resourceId) {
     return;
   }
-  if (existing.userId !== input2.authUserId) {
+  const ownerId = existing.userId ?? existing.ownerId ?? existing.creatorId;
+  if (ownerId !== input2.authUserId) {
     throw new CliError(
       `\u8D44\u6E90\u6388\u6743\u6807\u8BC6 ${input2.name} \u5DF2\u88AB\u4F7F\u7528\uFF0C\u8BF7\u91CD\u65B0\u8F93\u5165\u3002`,
       "CREATE_NAME_TAKEN"
@@ -25193,6 +25331,7 @@ function writeCreatedIdentity(input2) {
   if (!filePath) throw new CliError("\u65B0\u8D44\u6E90\u5FC5\u987B\u901A\u8FC7 --artifact \u5173\u8054\u672C\u5730\u4EA7\u7269", "CREATE_ARTIFACT_REQUIRED");
   const patch = {
     resourceId: input2.resourceId,
+    resourceName: input2.resourceName,
     name: input2.name,
     title: input2.title,
     typeCode: input2.typeCode,
@@ -25202,6 +25341,7 @@ function writeCreatedIdentity(input2) {
   return input2.target ? updateIdentity(input2.cwd, input2.target.n, patch) : createIdentity(input2.cwd, {
     subject: "resource",
     resourceId: input2.resourceId,
+    resourceName: input2.resourceName,
     name: input2.name,
     title: input2.title,
     typeCode: input2.typeCode,
@@ -25212,7 +25352,6 @@ function writeCreatedIdentity(input2) {
 async function createResource(input2) {
   assertPlatformAllowed();
   const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
-  validateLocalState(input2.cwd);
   const { title, name } = validateCreateFlags(input2);
   const file = input2.file !== void 0 ? normalizeProjectPath(input2.cwd, input2.file, {
     code: "CREATE_FILE_OUTSIDE",
@@ -25223,6 +25362,7 @@ async function createResource(input2) {
     const target = resolveTargetIdentity({
       cwd: input2.cwd,
       selector: input2.selector,
+      artifact: file,
       identities
     });
     const occupant = file ? identities.find((identity) => identity.filePath === file && identity.n !== target?.n) : void 0;
@@ -25248,7 +25388,7 @@ async function createResource(input2) {
     }
     const typeCode = resolveTypeCode(input2.type, target);
     await getTypeInfo(typeCode, input2.apis);
-    assertArtifactAnchor(typeCode, path10.resolve(input2.cwd, artifact));
+    assertArtifactAnchor(typeCode, path10.resolve(input2.cwd, artifact), input2.cwd);
     await assertOwnShellAvailable({
       authLoginName: auth.loginName,
       authUserId: auth.userId,
@@ -25271,6 +25411,7 @@ async function createResource(input2) {
       cwd: input2.cwd,
       env: getEnv2(),
       name,
+      resourceName: typeof created.resourceName === "string" && created.resourceName ? created.resourceName : `${auth.loginName}/${name}`,
       typeCode,
       resourceId,
       title,
@@ -25318,6 +25459,10 @@ function createCreateCommand() {
 // src/commands/listing/update.ts
 import { Command as Command5 } from "commander";
 
+// src/domain/listing/update.ts
+import { existsSync as existsSync10, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import path11 from "path";
+
 // src/domain/version/gates.ts
 function evaluateGates(input2, intent) {
   const latest = input2.latestVersion;
@@ -25359,19 +25504,170 @@ function resolveBoundIdentity(cwd, file) {
   if (!identity.resourceId) {
     throw new CliError("\u8BF7\u5148 create \u6216 bind", "GATE_NO_RESOURCE");
   }
+  const identityEnv = identity.env ?? "prod";
+  const activeEnv2 = getEnv2();
+  if (identityEnv !== activeEnv2) {
+    throw new CliError(
+      `\u8D44\u6E90 ${identity.n}.json \u5C5E\u4E8E ${identityEnv} \u73AF\u5883\uFF0C\u672C\u6B21\u662F ${activeEnv2}\uFF1B\u8BF7\u5207\u6362 --env \u6216\u9009\u62E9\u8BE5\u73AF\u5883\u7684\u8D44\u6E90\u72B6\u6001`,
+      "RESOURCE_ENV_MISMATCH"
+    );
+  }
   return identity;
 }
+function assertRemoteResourceWritable(input2) {
+  const codes = {
+    invalid: input2.codes?.invalid ?? "RESOURCE_WRITE_INFO_INVALID",
+    notOwner: input2.codes?.notOwner ?? "RESOURCE_NOT_OWNER",
+    frozen: input2.codes?.frozen ?? "RESOURCE_FROZEN"
+  };
+  assertRemoteResourceOwned({
+    info: input2.info,
+    resourceId: input2.resourceId,
+    authUserId: input2.authUserId,
+    codes
+  });
+  if (input2.info.status === 2 || input2.info.isFrozen === true) {
+    throw new CliError("\u8D44\u6E90\u5DF2\u88AB\u51BB\u7ED3\uFF0C\u4E0D\u80FD\u4FEE\u6539", codes.frozen);
+  }
+}
+function assertRemoteResourceOwned(input2) {
+  const codes = {
+    invalid: input2.codes?.invalid ?? "RESOURCE_WRITE_INFO_INVALID",
+    notOwner: input2.codes?.notOwner ?? "RESOURCE_NOT_OWNER"
+  };
+  if (input2.info.resourceId !== input2.resourceId) {
+    throw new CliError("\u5E73\u53F0\u8BE6\u60C5\u7F3A\u5C11\u6216\u4E0D\u5339\u914D resourceId\uFF0C\u62D2\u7EDD\u5199\u5165", codes.invalid);
+  }
+  const ownerId = input2.info.userId ?? input2.info.ownerId ?? input2.info.creatorId;
+  if (typeof ownerId !== "number" || !Number.isSafeInteger(ownerId)) {
+    throw new CliError("\u5E73\u53F0\u8BE6\u60C5\u7F3A\u5C11\u8D44\u6E90 owner\uFF0C\u62D2\u7EDD\u5199\u5165", codes.invalid);
+  }
+  if (ownerId !== input2.authUserId) {
+    throw new CliError("\u53EA\u80FD\u4FEE\u6539\u81EA\u5DF1\u7684\u8D44\u6E90", codes.notOwner);
+  }
+}
+
+// src/platform/unwrap.ts
+function unwrapData2(result) {
+  const envelope = result;
+  const data = envelope.data ?? result;
+  return data ?? {};
+}
+function unwrapFirst(result) {
+  const envelope = result;
+  const data = envelope.data ?? result;
+  if (Array.isArray(data)) {
+    return data[0] ?? {};
+  }
+  return data ?? {};
+}
+function unwrapList2(result, fields = ["dataList", "list"]) {
+  const envelope = result;
+  const data = envelope.data ?? result;
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (data && typeof data === "object") {
+    for (const field of fields) {
+      const list2 = data[field];
+      if (Array.isArray(list2)) {
+        return list2;
+      }
+    }
+  }
+  return [];
+}
 
 // src/domain/listing/update.ts
 var MAX_TITLE = 100;
 var MAX_INTRO = 200;
 var MAX_TAGS = 20;
 var MAX_TAG_LENGTH = 20;
+var MAX_COVER_BYTES = 5 * 1024 * 1024;
+var COVER_EXTENSIONS = /* @__PURE__ */ new Set([".jpg", ".jpeg", ".png", ".gif"]);
 function assertTitle(title) {
+  if (!title) {
+    throw new CliError("\u8BF7\u8F93\u5165\u8D44\u6E90\u6807\u9898", "UPDATE_TITLE_REQUIRED");
+  }
   if (title.length > MAX_TITLE) {
     throw new CliError("\u6807\u9898\u4E0D\u80FD\u8D85\u8FC7100\u4E2A\u5B57\u7B26", "UPDATE_TITLE_LONG");
   }
 }
+function isAnimatedGif(content) {
+  if (content.subarray(0, 6).toString("ascii") !== "GIF87a" && content.subarray(0, 6).toString("ascii") !== "GIF89a" || content.length < 13) {
+    return true;
+  }
+  let offset = 13;
+  if ((content[10] & 128) !== 0) {
+    offset += 3 * 2 ** ((content[10] & 7) + 1);
+  }
+  let frames = 0;
+  while (offset < content.length) {
+    const marker = content[offset++];
+    if (marker === 59) return frames > 1;
+    if (marker === 44) {
+      frames += 1;
+      if (frames > 1) return true;
+      if (offset + 9 > content.length) return true;
+      const packed = content[offset + 8];
+      offset += 9;
+      if ((packed & 128) !== 0) offset += 3 * 2 ** ((packed & 7) + 1);
+      offset += 1;
+    } else if (marker === 33) {
+      offset += 1;
+    } else {
+      return true;
+    }
+    while (offset < content.length) {
+      const size = content[offset++];
+      if (size === 0) break;
+      offset += size;
+    }
+  }
+  return true;
+}
+function assertCoverContent(extension, content) {
+  const isJpeg = content.length >= 3 && content[0] === 255 && content[1] === 216 && content[2] === 255;
+  const isPng = content.length >= 8 && content.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+  const isGif = content.subarray(0, 6).toString("ascii") === "GIF87a" || content.subarray(0, 6).toString("ascii") === "GIF89a";
+  if ((extension === ".jpg" || extension === ".jpeg") && isJpeg) return;
+  if (extension === ".png" && isPng) return;
+  if (extension === ".gif" && isGif && !isAnimatedGif(content)) return;
+  throw new CliError("\u5C01\u9762\u5FC5\u987B\u662F JPG\u3001PNG \u6216\u9759\u6001 GIF \u56FE\u7247", "UPDATE_COVER_INVALID");
+}
+async function uploadCover(cwd, cover, apis) {
+  const normalized = normalizeProjectPath(cwd, cover, {
+    code: "UPDATE_COVER_OUTSIDE",
+    message: "\u5C01\u9762\u5FC5\u987B\u4F4D\u4E8E\u5F53\u524D\u5DE5\u7A0B\u5185"
+  });
+  const localPath = resolveExistingProjectPath(cwd, path11.resolve(cwd, normalized), {
+    code: "UPDATE_COVER_OUTSIDE",
+    message: "\u5C01\u9762\u5FC5\u987B\u4F4D\u4E8E\u5F53\u524D\u5DE5\u7A0B\u5185"
+  });
+  if (!existsSync10(localPath)) {
+    throw new CliError(`\u5C01\u9762\u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${normalized}`, "UPDATE_COVER_MISSING");
+  }
+  const stats = statSync2(localPath);
+  if (!stats.isFile()) {
+    throw new CliError("\u5C01\u9762\u5FC5\u987B\u662F\u4E00\u4E2A\u56FE\u7247\u6587\u4EF6", "UPDATE_COVER_INVALID");
+  }
+  if (stats.size > MAX_COVER_BYTES) {
+    throw new CliError("\u5C01\u9762\u4E0D\u80FD\u8D85\u8FC7 5MB", "UPDATE_COVER_TOO_LARGE");
+  }
+  const extension = path11.extname(normalized).toLowerCase();
+  if (!COVER_EXTENSIONS.has(extension)) {
+    throw new CliError("\u5C01\u9762\u53EA\u652F\u6301 JPG\u3001PNG \u6216\u9759\u6001 GIF", "UPDATE_COVER_INVALID");
+  }
+  const content = readFileSync7(localPath);
+  assertCoverContent(extension, content);
+  const upload = apis?.uploadImage ?? ((params) => service_API_default.Storage.uploadImage(params));
+  const result = unwrapData2(await upload({ file: content }));
+  const url2 = result.url ?? result.fileUrl ?? result.fileURL;
+  if (typeof url2 !== "string" || !url2.trim()) {
+    throw new CliError("\u5C01\u9762\u4E0A\u4F20\u6210\u529F\u4F46\u5E73\u53F0\u672A\u8FD4\u56DE\u56FE\u7247 URL", "UPDATE_COVER_UPLOAD_INVALID");
+  }
+  return url2;
+}
 function assertIntro(intro) {
   if (intro.length > MAX_INTRO) {
     throw new CliError("\u7B80\u4ECB\u4E0D\u80FD\u8D85\u8FC7200\u4E2A\u5B57\u7B26", "UPDATE_INTRO_LONG");
@@ -25385,9 +25681,6 @@ function assertTags(tags) {
     if (tag.length > MAX_TAG_LENGTH) {
       throw new CliError("\u5355\u4E2A\u6807\u7B7E\u957F\u5EA6\u4E0D\u80FD\u8D85\u8FC720\u4E2A\u5B57\u7B26", "UPDATE_TAG_LONG");
     }
-    if (tag.includes("#")) {
-      throw new CliError(`\u6807\u7B7E\u4E0D\u80FD\u5305\u542B #\uFF1A${tag}`, "UPDATE_TAG_INVALID");
-    }
   }
   if (tags.some((tag, i) => tags.indexOf(tag) !== i)) {
     throw new CliError("\u8BE5\u6807\u7B7E\u5DF2\u6DFB\u52A0", "UPDATE_TAG_DUPLICATE");
@@ -25395,34 +25688,47 @@ function assertTags(tags) {
 }
 async function updateListing(input2) {
   assertPlatformAllowed();
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
-  if (input2.yes && !input2.title && !input2.intro && !input2.cover && !input2.tags) {
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  if (input2.yes && input2.title === void 0 && input2.intro === void 0 && input2.cover === void 0 && input2.tags === void 0) {
     throw new CliError("--yes \u4E14\u65E0\u4FEE\u6539\u9879\uFF0C\u62D2\u7EDD\u7A7A\u66F4\u65B0", "UPDATE_NO_FLAGS");
   }
   const identity = resolveBoundIdentity(input2.cwd, input2.file);
+  const info2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
+  const remote = unwrapData2(await info2({ resourceIdOrName: identity.resourceId }));
+  assertRemoteResourceWritable({ info: remote, resourceId: identity.resourceId, authUserId: auth.userId });
   const payload = {
     resourceId: identity.resourceId
   };
-  if (input2.title) {
-    assertTitle(input2.title);
-    payload.resourceTitle = input2.title;
+  const title = input2.title?.trim();
+  if (input2.title !== void 0) {
+    assertTitle(title ?? "");
+    payload.resourceTitle = title;
   }
-  if (input2.intro) {
-    assertIntro(input2.intro);
-    payload.intro = input2.intro;
+  if (input2.intro !== void 0) {
+    const intro = input2.intro.trim();
+    assertIntro(intro);
+    payload.intro = intro;
   }
-  if (input2.cover) payload.coverImages = [input2.cover];
-  if (input2.tags) {
-    const tags = input2.tags.split(",").map((item) => item.trim().replaceAll("#", "")).filter(Boolean);
-    assertTags(tags);
-    payload.tags = tags;
+  if (input2.cover !== void 0) {
+    if (!input2.cover.trim()) {
+      throw new CliError("\u8BF7\u63D0\u4F9B\u5C01\u9762\u56FE\u7247\u8DEF\u5F84\uFF1B\u672C\u671F\u4E0D\u652F\u6301\u6E05\u7A7A\u5C01\u9762", "UPDATE_COVER_REQUIRED");
+    }
+    payload.coverImages = [await uploadCover(input2.cwd, input2.cover, input2.apis)];
+  }
+  if (input2.tags !== void 0) {
+    const rawTags = input2.tags === "" ? [] : input2.tags.split(",").map((item) => item.trim().replaceAll("#", ""));
+    if (rawTags.some((tag) => !tag)) {
+      throw new CliError("\u6807\u7B7E\u4E0D\u80FD\u5305\u542B\u7A7A\u9879", "UPDATE_TAG_EMPTY");
+    }
+    assertTags(rawTags);
+    payload.tags = rawTags;
   }
   if ("status" in payload) {
     delete payload.status;
   }
   const update2 = input2.apis?.update ?? ((params) => service_API_default.Resource.update(params));
   await update2(payload);
-  if (input2.title) updateIdentity(input2.cwd, identity.n, { title: input2.title });
+  if (title !== void 0) updateIdentity(input2.cwd, identity.n, { title });
   return payload;
 }
 
@@ -25448,27 +25754,13 @@ function createUpdateCommand() {
 }
 
 // src/commands/policy/apply.ts
-import { readFileSync as readFileSync6 } from "fs";
-import path11 from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import path12 from "path";
 import { confirm, input } from "@inquirer/prompts";
 import { Command as Command6 } from "commander";
 
-// src/platform/unwrap.ts
-function unwrapData2(result) {
-  const envelope = result;
-  const data = envelope.data ?? result;
-  return data ?? {};
-}
-function unwrapFirst(result) {
-  const envelope = result;
-  const data = envelope.data ?? result;
-  if (Array.isArray(data)) {
-    return data[0] ?? {};
-  }
-  return data ?? {};
-}
-
 // src/domain/policy/list.ts
+var POLICY_LIST_PAGE_SIZE = 50;
 function infoApi(apis) {
   return apis?.info ?? ((params) => service_API_default.Resource.info(params));
 }
@@ -25497,14 +25789,17 @@ function decoded(value) {
     return value;
   }
 }
-function assertEditable(info2, authUserId) {
-  if (info2.status === 2 || info2.isFrozen === true) {
-    throw new CliError("\u8D44\u6E90\u5DF2\u88AB\u51BB\u7ED3\uFF0C\u4E0D\u80FD\u4FEE\u6539\u6388\u6743\u7B56\u7565", "POLICY_RESOURCE_FROZEN");
-  }
-  const ownerId = info2.userId ?? info2.ownerId ?? info2.creatorId;
-  if (typeof ownerId === "number" && ownerId !== authUserId) {
-    throw new CliError("\u53EA\u80FD\u4FEE\u6539\u81EA\u5DF1\u7684\u8D44\u6E90\u6388\u6743\u7B56\u7565", "POLICY_NOT_OWNER");
-  }
+function assertEditable(info2, authUserId, resourceId) {
+  assertRemoteResourceWritable({
+    info: info2,
+    resourceId,
+    authUserId,
+    codes: {
+      invalid: "POLICY_INFO_INVALID",
+      notOwner: "POLICY_NOT_OWNER",
+      frozen: "POLICY_RESOURCE_FROZEN"
+    }
+  });
 }
 async function loadPolicyContext(input2) {
   assertPlatformAllowed();
@@ -25523,7 +25818,7 @@ async function loadPolicyContext(input2) {
     isLoadPolicyInfo: 1,
     isTranslate: 1
   }));
-  if (input2.editable) assertEditable(info2, auth.userId);
+  if (input2.editable) assertEditable(info2, auth.userId, resourceId);
   return {
     resourceId,
     typeCode,
@@ -25534,30 +25829,56 @@ async function loadPolicyContext(input2) {
 function templateFrom(value) {
   if (!value || typeof value !== "object") return void 0;
   const raw = value;
-  const id = raw.id ?? raw.templateId ?? raw.policyTemplateId;
-  const name = raw.name ?? raw.templateName ?? raw.policyName;
-  const defaultValue = raw.defaultValue ?? raw.policyText ?? raw.value;
+  const id = raw.id ?? raw.templateId ?? raw.policyTemplateId ?? raw._id;
+  const name = raw.name ?? raw.templateName ?? raw.policyName ?? raw.title;
+  const defaultValue = raw.defaultValue ?? raw.policyText ?? raw.value ?? raw.template;
   if (typeof id !== "string" || !id || typeof name !== "string" || !name || typeof defaultValue !== "string" || !defaultValue.trim()) {
     return void 0;
   }
   const summaryValue = raw.summary ?? raw.description ?? raw.eventSummary;
+  const fillArgs = Array.isArray(raw.reportUiTemplate) ? raw.reportUiTemplate.flatMap((item) => {
+    if (!item || typeof item !== "object") return [];
+    const field = item;
+    const name2 = field.id;
+    const value2 = field.uiSectionDefaultValue;
+    return typeof name2 === "string" && name2 && (typeof value2 === "string" || typeof value2 === "number") ? [{ name: name2, value: value2 }] : [];
+  }) : [];
   return {
     id,
     name,
     defaultValue,
+    fillArgs,
     ...typeof summaryValue === "string" && summaryValue.trim() ? { summary: summaryValue.trim() } : {}
   };
 }
+function normalizeCompiledTemplateDsl(contract2) {
+  return contract2.replace(/\bfor\s+public\b/gi, "FOR PUBLIC").replace(/\binitial\b/gi, "Initial");
+}
+function compiledContract(result) {
+  const envelope = result;
+  const data = envelope.data ?? result;
+  const contract2 = data && typeof data === "object" ? data.contractNew ?? data.contract : data;
+  if (typeof contract2 !== "string" || !contract2.trim()) {
+    throw new CliError("\u7B56\u7565\u6A21\u677F\u7F16\u8BD1\u7ED3\u679C\u7F3A\u5C11 contractNew", "POLICY_TEMPLATE_COMPILE_INVALID");
+  }
+  return normalizeCompiledTemplateDsl(contract2).trim();
+}
 async function getPolicyTemplates(input2) {
-  const context = await loadPolicyContext(input2);
+  await loadPolicyContext(input2);
   const request2 = input2.apis?.policyTemplates ?? ((params) => service_API_default.Policy.policyTemplates(params));
-  const result = unwrapData2(await request2({ resourceTypeCodes4Resource: [context.typeCode] }));
-  const rawList = Array.isArray(result.list) ? result.list : Array.isArray(result.dataList) ? result.dataList : Array.isArray(result.templates) ? result.templates : [];
+  const rawList = unwrapList2(await request2({}), ["list", "dataList", "templates"]);
   return rawList.flatMap((item) => {
     const template = templateFrom(item);
     return template ? [template] : [];
   });
 }
+async function applyPolicyTemplate(input2) {
+  const template = (await getPolicyTemplates(input2)).find((item) => item.id === input2.templateId);
+  if (!template) throw new CliError("\u6307\u5B9A\u6A21\u677F\u4E0D\u5728\u5F53\u524D\u6A21\u677F\u5217\u8868\u4E2D", "POLICY_TEMPLATE_INVALID");
+  const request2 = input2.apis?.policyReCompile ?? ((params) => service_API_default.Policy.policyReCompile(params));
+  const policyText = compiledContract(await request2({ _id: template.id, fillArgs: template.fillArgs }));
+  await applyPolicy({ ...input2, policyText });
+}
 function positiveInteger(value, fallback, name, max) {
   const actual = value ?? fallback;
   if (!Number.isInteger(actual) || actual < 1 || actual > max) {
@@ -25565,10 +25886,39 @@ function positiveInteger(value, fallback, name, max) {
   }
   return actual;
 }
-async function listPolicies(input2) {
+async function getPolicyList(input2) {
   const context = await loadPolicyContext(input2);
-  if (!context.policies.length) return "\u8FD8\u6CA1\u6709\u6388\u6743\u7B56\u7565";
-  return [...context.policies].sort((a, b) => b.status - a.status || a.policyName.localeCompare(b.policyName)).map((item) => `${item.policyId}	${item.policyName}	${item.status === 1 ? "on" : "off"}`).join("\n");
+  const typeHierarchy = await getTypeHierarchy(context.typeCode, input2.apis);
+  return {
+    typeHierarchy,
+    policies: [...context.policies].sort((a, b) => b.status - a.status || a.policyName.localeCompare(b.policyName))
+  };
+}
+function policyListPage(list2, page) {
+  const pageCount = Math.max(1, Math.ceil(list2.policies.length / POLICY_LIST_PAGE_SIZE));
+  if (!Number.isInteger(page) || page < 1 || page > pageCount) {
+    throw new CliError(`\u7B56\u7565\u9875\u7801\u8D85\u51FA\u8303\u56F4\uFF0C\u5F53\u524D\u5171 ${pageCount} \u9875`, "POLICY_LIST_PAGE");
+  }
+  return {
+    ...list2,
+    page,
+    pageCount,
+    total: list2.policies.length,
+    hasPrevious: page > 1,
+    hasNext: page < pageCount,
+    items: list2.policies.slice((page - 1) * POLICY_LIST_PAGE_SIZE, page * POLICY_LIST_PAGE_SIZE)
+  };
+}
+function formatPolicyListPage(page) {
+  const header = [
+    `\u8D44\u6E90\u7C7B\u578B\uFF1A${page.typeHierarchy.join(" / ")}`,
+    `\u7B2C ${page.page}/${page.pageCount} \u9875\uFF0C\u5171 ${page.total} \u6761`
+  ];
+  if (page.items.length === 0) return [...header, "\u8FD8\u6CA1\u6709\u6388\u6743\u7B56\u7565"].join("\n");
+  return [
+    ...header,
+    ...page.items.map((item) => `${item.policyId}	${item.policyName}	${item.status === 1 ? "on" : "off"}`)
+  ].join("\n");
 }
 async function listPolicyTemplates(input2) {
   const page = positiveInteger(input2.page, 1, "--page", Number.MAX_SAFE_INTEGER);
@@ -25627,8 +25977,8 @@ async function setPolicy(input2) {
 
 // src/commands/policy/apply.ts
 function parsePolicy(file) {
-  const text = readFileSync6(file, "utf8");
-  if (path11.extname(file).toLowerCase() !== ".json") return { policyText: text };
+  const text = readFileSync8(file, "utf8");
+  if (path12.extname(file).toLowerCase() !== ".json") return { policyText: text };
   let parsed;
   try {
     parsed = JSON.parse(text);
@@ -25663,17 +26013,39 @@ function createPolicyApplyCommand() {
 
 // src/commands/policy/list.ts
 import { Command as Command7 } from "commander";
+async function showPolicyPages(pageFor) {
+  let page = 1;
+  while (true) {
+    const current = pageFor(page);
+    console.log(formatPolicyListPage(current));
+    if (!current.hasPrevious && !current.hasNext) return;
+    if (!isInteractive()) {
+      if (current.hasNext) {
+        console.log(`\u8FD8\u6709 ${current.total - current.page * POLICY_LIST_PAGE_SIZE} \u6761\u7B56\u7565\uFF1B\u8BF7\u5728\u4EA4\u4E92\u7EC8\u7AEF\u8FD0\u884C policy list \u67E5\u770B\u540E\u7EED\u9875`);
+      }
+      return;
+    }
+    const action = await selectQuestion("\u6388\u6743\u7B56\u7565\u5217\u8868", [
+      ...current.hasPrevious ? [{ name: "\u4E0A\u4E00\u9875", value: "__previous__" }] : [],
+      ...current.hasNext ? [{ name: "\u4E0B\u4E00\u9875", value: "__next__" }] : [],
+      { name: "\u9000\u51FA", value: "__exit__" }
+    ]);
+    if (action === "__exit__") return;
+    page += action === "__next__" ? 1 : -1;
+  }
+}
 function createPolicyListCommand() {
   const command = addSharedOptions(new Command7("list"));
   command.description(
     // i18n: cli.command.policy.list.description
-    "\u770B\u5DF2\u6709\u7B56\u7565"
+    "\u770B\u5DF2\u6709\u7B56\u7565\u53CA\u8D44\u6E90\u7C7B\u578B\u5C42\u7EA7"
   ).action(async function() {
     const shared = readSharedOptions(this);
-    console.log(await listPolicies({
+    const list2 = await getPolicyList({
       cwd: resolveCwd(shared.cwd),
       file: shared.file
-    }));
+    });
+    await showPolicyPages((page) => policyListPage(list2, page));
   });
   return command;
 }
@@ -25725,7 +26097,7 @@ async function chooseTemplate(templates) {
 }
 function createPolicyTemplateCommand() {
   const template = addSharedOptions(new Command9("template")).description("\u6388\u6743\u7B56\u7565\u6A21\u677F");
-  addSharedOptions(template.command("list")).description("\u6309\u5F53\u524D\u8D44\u6E90\u7C7B\u578B\u5217\u5168\u90E8\u6A21\u677F").option("--page <n>", "\u9875\u7801\uFF0C\u4ECE 1 \u5F00\u59CB", Number).option("--page-size <n>", "\u6BCF\u9875 1\u2013100 \u6761\uFF0C\u9ED8\u8BA4 20", Number).action(async function(options) {
+  addSharedOptions(template.command("list")).description("\u5217\u5F53\u524D\u6A21\u677F\u5217\u8868").option("--page <n>", "\u9875\u7801\uFF0C\u4ECE 1 \u5F00\u59CB", Number).option("--page-size <n>", "\u6BCF\u9875 1\u2013100 \u6761\uFF0C\u9ED8\u8BA4 20", Number).action(async function(options) {
     const shared = readSharedOptions(this);
     console.log(await listPolicyTemplates({ cwd: resolveCwd(shared.cwd), file: shared.file, page: options.page, pageSize: options.pageSize }));
   });
@@ -25735,7 +26107,7 @@ function createPolicyTemplateCommand() {
     const yes = shared.yes === true;
     const templates = await getPolicyTemplates({ cwd, file: shared.file });
     let item = templateId ? templates.find((candidate) => candidate.id === templateId) : void 0;
-    if (!item && templateId) throw new CliError("\u6307\u5B9A\u6A21\u677F\u4E0D\u5C5E\u4E8E\u5F53\u524D\u8D44\u6E90\u7C7B\u578B", "POLICY_TEMPLATE_INVALID");
+    if (!item && templateId) throw new CliError("\u6307\u5B9A\u6A21\u677F\u4E0D\u5728\u5F53\u524D\u6A21\u677F\u5217\u8868\u4E2D", "POLICY_TEMPLATE_INVALID");
     if (!item) {
       if (yes || !process.stdin.isTTY) throw new CliError("--yes \u6216\u975E\u4EA4\u4E92\u6A21\u5F0F\u5FC5\u987B\u63D0\u4F9B templateId", "POLICY_TEMPLATE_ID");
       item = await chooseTemplate(templates);
@@ -25743,7 +26115,7 @@ function createPolicyTemplateCommand() {
     }
     const policyName = options.name ?? item.name;
     if (!yes && !await confirm3({ message: `\u6DFB\u52A0\u5E76\u542F\u7528\u7B56\u7565\u300C${policyName}\u300D\uFF1F`, default: true })) return;
-    await applyPolicy({ cwd, file: shared.file, policyName, policyText: item.defaultValue });
+    await applyPolicyTemplate({ cwd, file: shared.file, templateId: item.id, policyName });
     console.log("\u5DF2\u6DFB\u52A0\u5E76\u542F\u7528\u6388\u6743\u7B56\u7565");
   });
   return template;
@@ -25753,28 +26125,18 @@ function createPolicyTemplateCommand() {
 import { Command as Command10 } from "commander";
 
 // src/domain/bind/bind.ts
-import { existsSync as existsSync10 } from "fs";
-
-// src/local/indexFile.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import path12 from "path";
-function normalizeFileKey(filePath) {
-  return path12.posix.normalize(filePath.replaceAll("\\", "/")).replace(/^\.\//, "");
-}
-
-// src/domain/bind/bind.ts
+import { existsSync as existsSync11 } from "fs";
 import path13 from "path";
 async function bindResource(input2) {
   assertPlatformAllowed();
   const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
-  validateLocalState(input2.cwd);
   const filePath = input2.file !== void 0 ? normalizeProjectPath(input2.cwd, input2.file, {
     code: "BIND_FILE_OUTSIDE",
     message: "--artifact \u5FC5\u987B\u843D\u5728\u5F53\u524D\u5DE5\u7A0B\u91CC"
   }) : void 0;
   if (filePath) {
     const absolute = path13.resolve(input2.cwd, filePath);
-    if (!existsSync10(absolute)) {
+    if (!existsSync11(absolute)) {
       throw new CliError(`\u672C\u5730\u4EA7\u7269\u4E0D\u5B58\u5728\uFF1A${absolute}`, "ARTIFACT_ANCHOR_MISSING");
     }
   }
@@ -25791,23 +26153,34 @@ async function bindResource(input2) {
   if (!isResourceSubject(info2.subjectType)) {
     throw new CliError("\u53EA\u80FD bind \u5355\u8D44\u6E90", "BIND_SUBJECT_INVALID");
   }
-  if (info2.userId !== auth.userId) {
-    throw new CliError("\u53EA\u80FD bind \u81EA\u5DF1\u7684\u8D44\u6E90", "BIND_NOT_OWNER");
-  }
   const resourceId = String(info2.resourceId ?? "");
-  const name = String(info2.resourceName ?? info2.name ?? "").split("/").pop() ?? "";
+  if (!resourceId) {
+    throw new CliError("\u5E73\u53F0\u8BE6\u60C5\u7F3A\u5C11\u8EAB\u4EFD\u5B57\u6BB5", "BIND_INFO_INVALID");
+  }
+  assertRemoteResourceOwned({
+    info: info2,
+    resourceId,
+    authUserId: auth.userId,
+    codes: {
+      invalid: "BIND_INFO_INVALID",
+      notOwner: "BIND_NOT_OWNER"
+    }
+  });
+  const resourceName = String(info2.resourceName ?? "");
+  const name = (resourceName || String(info2.name ?? "")).split("/").pop() ?? "";
   const title = String(info2.resourceTitle ?? info2.title ?? name);
   const resourceType = info2.resourceType;
   const typeFromArray = Array.isArray(resourceType) ? String(resourceType[0] ?? "") : "";
   const typeCode = String(info2.resourceTypeCode ?? typeFromArray);
-  if (!resourceId || !name || !typeCode || !title) {
+  if (!name || !typeCode || !title) {
     throw new CliError("\u5E73\u53F0\u8BE6\u60C5\u7F3A\u5C11\u8EAB\u4EFD\u5B57\u6BB5", "BIND_INFO_INVALID");
   }
+  const stableResourceName = resourceName || `${auth.loginName}/${name}`;
   return withProjectLock(input2.cwd, () => {
     const identities = validateLocalState(input2.cwd);
     const byId = identities.find((item) => item.resourceId === resourceId);
     const byFile = filePath ? identities.find(
-      (item) => item.filePath !== void 0 && normalizeFileKey(item.filePath) === filePath
+      (item) => normalizeProjectPath(input2.cwd, item.filePath) === filePath
     ) : void 0;
     const unbound = identities.filter((item) => !item.resourceId);
     if (byFile && byId && byFile.n !== byId.n) {
@@ -25817,7 +26190,10 @@ async function bindResource(input2) {
     if (input2.selector && byId && target && target.n !== byId.n) {
       throw new CliError(`\u8D44\u6E90\u5DF2\u7ED1\u5B9A\u5230 ${byId.n}.json`, "BIND_ID_TAKEN");
     }
-    if (!target && unbound.length === 1) {
+    if (!target && filePath) {
+      target = unbound.find((item) => item.filePath === filePath);
+    }
+    if (!target && filePath === void 0 && unbound.length === 1) {
       target = unbound[0];
     }
     if (!target && unbound.length > 1) throw new CliError("\u5F53\u524D\u5DE5\u7A0B\u6709\u591A\u4EFD\u672A\u7ED1\u5B9A\u8D44\u6E90\u72B6\u6001\uFF1B\u8BF7\u4F7F\u7528 --resource \u6307\u5B9A\u8D44\u6E90", "IDENTITY_RESOURCE_REQUIRED");
@@ -25828,9 +26204,15 @@ async function bindResource(input2) {
     if (!resolvedFilePath) {
       throw new CliError("\u65B0\u589E\u672C\u5730\u72B6\u6001\u65F6\u5FC5\u987B\u901A\u8FC7 --artifact \u5173\u8054\u672C\u5730\u4EA7\u7269", "BIND_ARTIFACT_REQUIRED");
     }
-    assertArtifactAnchor(typeCode, path13.resolve(input2.cwd, resolvedFilePath));
+    assertArtifactAnchor(typeCode, path13.resolve(input2.cwd, resolvedFilePath), input2.cwd);
     const env = getEnv2();
     if (target) {
+      if (target.resourceId && (target.env ?? "prod") !== env) {
+        throw new CliError(
+          `\u4E0D\u80FD\u628A ${target.n}.json\uFF08${target.env ?? "prod"}\uFF09\u6539\u7ED1\u5230 ${env} \u73AF\u5883\uFF1B\u8BF7\u65B0\u5EFA\u6216\u9009\u62E9\u8BE5\u73AF\u5883\u7684\u672C\u5730\u8D44\u6E90\u72B6\u6001`,
+          "BIND_ENV_MISMATCH"
+        );
+      }
       const resourceChanged = target.resourceId !== resourceId;
       const typeChanged = target.typeCode !== typeCode;
       if (target.resourceId && resourceChanged) {
@@ -25841,6 +26223,7 @@ async function bindResource(input2) {
       const discardDraft = target.resourceId && resourceChanged || typeChanged;
       const updated = prepareIdentityUpdate(input2.cwd, target.n, {
         resourceId,
+        resourceName: stableResourceName,
         name,
         title,
         typeCode,
@@ -25856,6 +26239,7 @@ async function bindResource(input2) {
     const created = prepareIdentityCreate(input2.cwd, {
       subject: "resource",
       resourceId,
+      resourceName: stableResourceName,
       name,
       title,
       typeCode,
@@ -25863,7 +26247,8 @@ async function bindResource(input2) {
       env
     });
     commitLocalTransaction(input2.cwd, [
-      { path: identityFilePath(input2.cwd, created.n), content: serializeIdentity(created) }
+      { path: identityFilePath(input2.cwd, created.n), content: serializeIdentity(created) },
+      { path: identitySequenceFilePath(input2.cwd), content: serializeIdentitySequence(created.n) }
     ]);
     return created;
   });
@@ -25911,7 +26296,7 @@ import { Command as Command11 } from "commander";
 
 // src/domain/init/scaffold.ts
 import { execFile as execFileCallback } from "child_process";
-import { cpSync, existsSync as existsSync11, lstatSync, mkdirSync as mkdirSync2, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync8, renameSync, rmSync } from "fs";
+import { cpSync, existsSync as existsSync12, lstatSync as lstatSync2, mkdirSync as mkdirSync2, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync9, renameSync, rmSync } from "fs";
 import os4 from "os";
 import path14 from "path";
 import { promisify } from "util";
@@ -25943,7 +26328,7 @@ function resolveTargetDir(input2) {
   return input2.dir ? path14.isAbsolute(input2.dir) ? input2.dir : path14.resolve(input2.cwd, input2.dir) : path14.resolve(input2.cwd);
 }
 function targetHasOnlyAuthSelector(targetDir) {
-  if (!existsSync11(targetDir)) return false;
+  if (!existsSync12(targetDir)) return false;
   let entries;
   try {
     entries = readdirSync4(targetDir);
@@ -25956,20 +26341,20 @@ function targetHasOnlyAuthSelector(targetDir) {
   return stateDirHasOnlyAuthSelector(stateDir);
 }
 function stateDirHasOnlyAuthSelector(stateDir) {
-  if (!existsSync11(stateDir) || !lstatSync(stateDir).isDirectory() || lstatSync(stateDir).isSymbolicLink()) return false;
+  if (!existsSync12(stateDir) || !lstatSync2(stateDir).isDirectory() || lstatSync2(stateDir).isSymbolicLink()) return false;
   const stateEntries = readdirSync4(stateDir);
   if (stateEntries.length !== 1 || stateEntries[0] !== "auth") return false;
-  const auth = lstatSync(path14.join(stateDir, "auth"));
+  const auth = lstatSync2(path14.join(stateDir, "auth"));
   return auth.isFile() && !auth.isSymbolicLink();
 }
 function assertInitialTarget(targetDir, adoptExistingProject) {
-  if (!existsSync11(targetDir)) return { targetExisted: false, preserveAuth: false, adoptExistingProject };
+  if (!existsSync12(targetDir)) return { targetExisted: false, preserveAuth: false, adoptExistingProject };
   const entries = readdirSync4(targetDir);
   if (entries.length === 0) return { targetExisted: true, preserveAuth: false, adoptExistingProject };
   if (targetHasOnlyAuthSelector(targetDir)) return { targetExisted: true, preserveAuth: true, adoptExistingProject };
   if (adoptExistingProject) {
     const stateDir = path14.join(targetDir, ".freelog");
-    if (!existsSync11(stateDir)) return { targetExisted: true, preserveAuth: false, adoptExistingProject: true };
+    if (!existsSync12(stateDir)) return { targetExisted: true, preserveAuth: false, adoptExistingProject: true };
     if (stateDirHasOnlyAuthSelector(stateDir)) return { targetExisted: true, preserveAuth: true, adoptExistingProject: true };
   }
   throw new CliError("\u76EE\u6807\u76EE\u5F55\u4E0D\u662F\u7A7A\u76EE\u5F55\uFF0C\u62D2\u7EDD\u8986\u76D6", "INIT_TARGET_NOT_EMPTY");
@@ -25997,12 +26382,12 @@ function validateRemoteTemplate(packageDir, template) {
   const templateDir = path14.join(packageDir, "template");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync8(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
   } catch {
     throw new CliError("\u6A21\u677F\u6821\u9A8C\u5931\u8D25\uFF1A\u7F3A\u5C11\u6216\u65E0\u6CD5\u8BFB\u53D6 template.manifest.json", "TEMPLATE_INVALID");
   }
   const tags = Array.isArray(manifest.tags) ? manifest.tags : [];
-  if (manifest.id !== template.id || manifest.npmName !== template.npmName || manifest.version !== template.version || !tags.includes("runtime") || !template.targets.every((target) => tags.includes(target)) || !existsSync11(templateDir)) {
+  if (manifest.id !== template.id || manifest.npmName !== template.npmName || manifest.version !== template.version || !tags.includes("runtime") || !template.targets.every((target) => tags.includes(target)) || !existsSync12(templateDir)) {
     throw new CliError("\u6A21\u677F\u6821\u9A8C\u5931\u8D25\uFF1A\u7EBF\u4E0A\u6A21\u677F\u4E0E\u53D7\u63A7\u6E05\u5355\u4E0D\u4E00\u81F4", "TEMPLATE_INVALID");
   }
   return templateDir;
@@ -26040,7 +26425,7 @@ function commitStaging(stagingDir, targetDir, targetExisted, preserveAuth, adopt
   if (preserveAuth) {
     assertOnlyAuthSelectorStillThere(targetDir);
   } else if (adoptExistingProject) {
-    if (existsSync11(path14.join(targetDir, ".freelog"))) {
+    if (existsSync12(path14.join(targetDir, ".freelog"))) {
       throw new CliError("\u76EE\u6807\u76EE\u5F55\u5728\u521D\u59CB\u5316\u671F\u95F4\u88AB\u4FEE\u6539\uFF0C\u672A\u8986\u76D6\u672A\u77E5\u6587\u4EF6", "INIT_TARGET_CHANGED");
     }
     renameSync(path14.join(stagingDir, ".freelog"), path14.join(targetDir, ".freelog"));
@@ -26054,7 +26439,7 @@ function commitStaging(stagingDir, targetDir, targetExisted, preserveAuth, adopt
     if (preserveAuth && entry2 === ".freelog") {
       for (const stateEntry of readdirSync4(path14.join(stagingDir, entry2))) {
         const stateDestination = path14.join(destination, stateEntry);
-        if (existsSync11(stateDestination)) {
+        if (existsSync12(stateDestination)) {
           throw new CliError("\u76EE\u6807\u76EE\u5F55\u5728\u521D\u59CB\u5316\u671F\u95F4\u88AB\u4FEE\u6539\uFF0C\u672A\u8986\u76D6\u672A\u77E5\u6587\u4EF6", "INIT_TARGET_CHANGED");
         }
         renameSync(path14.join(stagingDir, entry2, stateEntry), stateDestination);
@@ -26062,7 +26447,7 @@ function commitStaging(stagingDir, targetDir, targetExisted, preserveAuth, adopt
       rmSync(path14.join(stagingDir, entry2), { recursive: true, force: true });
       continue;
     }
-    if (existsSync11(destination)) {
+    if (existsSync12(destination)) {
       throw new CliError("\u76EE\u6807\u76EE\u5F55\u5728\u521D\u59CB\u5316\u671F\u95F4\u88AB\u4FEE\u6539\uFF0C\u672A\u8986\u76D6\u672A\u77E5\u6587\u4EF6", "INIT_TARGET_CHANGED");
     }
     renameSync(path14.join(stagingDir, entry2), destination);
@@ -26086,7 +26471,7 @@ async function initProject(input2) {
     }
     const typeCode = shortcut === "theme" ? "RT001" : shortcut === "widget" ? "RT002" : (await (input2.typeValidator ?? ((code) => getTypeInfo(code, input2.typeApis)))(input2.typeCode)).code;
     const artifact = shortcut ? "dist" : normalizeProjectPath(targetDir, input2.artifact);
-    if (!shortcut) assertArtifactAnchor(typeCode, path14.resolve(targetDir, artifact));
+    if (!shortcut) assertArtifactAnchor(typeCode, path14.resolve(targetDir, artifact), targetDir);
     const template = shortcut && input2.template ? getTemplate(input2.template, shortcut) : void 0;
     if (shortcut && !template) throw new CliError("\u8BF7\u9009\u62E9\u6A21\u677F", "INIT_TEMPLATE_REQUIRED");
     const parent = path14.dirname(targetDir);
@@ -26188,6 +26573,7 @@ async function statusProject(input2) {
   if (local?.resourceId) {
     assertPlatformAllowed();
     requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+    resolveBoundIdentity(input2.cwd, input2.file);
     const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
     const result = await infoApi2({
       resourceIdOrName: local.resourceId,
@@ -26298,7 +26684,7 @@ function createTypeCommand() {
       return;
     }
     const info2 = await getTypeInfo(options.type);
-    console.log(`${info2.code}	${info2.nameChain ?? info2.name}`);
+    console.log(formatTypeInfo(info2));
   });
   addSharedOptions(type.command("info")).description(
     // i18n: cli.command.type.info.description
@@ -26313,7 +26699,7 @@ function createTypeCommand() {
       throw new CliError("\u8BF7\u63D0\u4F9B\u7C7B\u578B\u7F16\u53F7", "TYPE_CODE_REQUIRED");
     }
     const info2 = await getTypeInfo(code);
-    console.log(`${info2.code}	${info2.nameChain ?? info2.name}`);
+    console.log(formatTypeInfo(info2));
   });
   return type;
 }
@@ -26340,6 +26726,9 @@ async function syncResourceTitles(input2) {
       if (!identity.resourceId) return { identity, error: "\u8D44\u6E90\u5C1A\u672A\u7ED1\u5B9A" };
       try {
         const data = unwrapData2(await info2({ resourceIdOrName: identity.resourceId, isLoadLatestVersionInfo: 1 }));
+        if (data.resourceId !== identity.resourceId) {
+          return { identity, error: "\u5E73\u53F0\u8BE6\u60C5\u7F3A\u5C11\u6216\u4E0D\u5339\u914D resourceId" };
+        }
         const title = String(data.resourceTitle ?? data.title ?? "");
         if (!title) return { identity, error: "\u5E73\u53F0\u8BE6\u60C5\u7F3A\u5C11\u6807\u9898" };
         return { identity, title };
@@ -26363,76 +26752,367 @@ async function syncResourceTitles(input2) {
   }, "sync-resource-titles");
 }
 
-// src/commands/project/resource.ts
-function createResourceCommand() {
-  const resource = addSharedOptions(new Command15("resource")).description("\u8D44\u6E90\u672C\u5730\u72B6\u6001\u7EF4\u62A4");
-  resource.command("sync").description("\u4ECE\u5E73\u53F0\u540C\u6B65\u672C\u5730\u8D44\u6E90\u6807\u9898").action(async function() {
-    const shared = readSharedOptions(this);
-    console.log(await syncResourceTitles({ cwd: resolveCwd(shared.cwd), selector: shared.file }));
-  });
-  return resource;
+// src/local/pendingOperation.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync13, readFileSync as readFileSync10, unlinkSync as unlinkSync6 } from "fs";
+import path15 from "path";
+import { z as z4 } from "zod";
+var pendingVersionSubmitV1Schema = z4.object({
+  schemaVersion: z4.literal(1),
+  operationId: z4.string().uuid(),
+  kind: z4.literal("version-submit"),
+  resourceN: z4.number().int().positive(),
+  resourceId: z4.string().min(1),
+  env: z4.enum(["prod", "test", "dev"]),
+  version: z4.string().min(1),
+  fileSha1: z4.string().min(1),
+  createdAt: z4.string().min(1)
+}).strict();
+var pendingVersionSubmitV2Schema = pendingVersionSubmitV1Schema.omit({ schemaVersion: true }).extend({
+  schemaVersion: z4.literal(2),
+  state: z4.enum(["prepared", "sending"])
+}).strict();
+function pendingOperationFilePath(cwd) {
+  return path15.join(freelogDir(cwd), ".pending-operation.json");
 }
-
-// src/commands/shelf/offline.ts
-import { Command as Command16 } from "commander";
-
-// src/domain/online/online.ts
-async function loadInfo(resourceId, apis) {
-  const infoApi2 = apis?.info ?? ((params) => service_API_default.Resource.info(params));
-  return unwrapData2(
-    await infoApi2({
-      resourceIdOrName: resourceId,
-      isLoadLatestVersionInfo: 1,
-      isLoadPolicyInfo: 1
-    })
-  );
+function invalidPending() {
+  throw new CliError("\u672A\u51B3\u8FDC\u7AEF\u64CD\u4F5C\u8BB0\u5F55\u65E0\u6548\uFF0C\u8BF7\u5148\u5907\u4EFD .freelog \u540E\u5904\u7406", "PENDING_OPERATION_INVALID");
 }
-function validateForOnline(info2) {
-  if (!info2.latestVersion) {
-    throw new CliError("\u4E0A\u67B6\u987B\u5DF2\u6709\u7248\u672C", "ONLINE_NO_VERSION");
+function readPendingOperation(cwd) {
+  const filePath = pendingOperationFilePath(cwd);
+  if (!existsSync13(filePath)) return void 0;
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync10(filePath, "utf8"));
+  } catch {
+    return invalidPending();
   }
-  const policies2 = info2.policies ?? [];
-  if (!policies2.some((item) => item.status === 1)) {
-    throw new CliError("\u4E0A\u67B6\u987B\u81F3\u5C11\u4E00\u6761\u542F\u7528\u7B56\u7565", "ONLINE_NO_POLICY");
+  const v2 = pendingVersionSubmitV2Schema.safeParse(raw);
+  if (v2.success) return v2.data;
+  const v1 = pendingVersionSubmitV1Schema.safeParse(raw);
+  if (v1.success) {
+    return { ...v1.data, state: "sending" };
   }
+  return invalidPending();
 }
-async function onlineResource(input2) {
-  assertPlatformAllowed();
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
-  const identity = resolveBoundIdentity(input2.cwd, input2.file);
-  const info2 = await loadInfo(identity.resourceId, input2.apis);
-  validateForOnline(info2);
-  const update2 = input2.apis?.update ?? ((params) => service_API_default.Resource.update(params));
-  await update2({
-    resourceId: identity.resourceId,
-    status: 1
-  });
+function createPendingVersionSubmit(input2) {
+  if (readPendingOperation(input2.cwd)) {
+    throw new CliError("\u5B58\u5728\u7ED3\u679C\u672A\u77E5\u7684\u8FDC\u7AEF\u64CD\u4F5C\uFF1B\u8BF7\u5148 resource recover", "PENDING_OPERATION_EXISTS");
+  }
+  const pending = {
+    schemaVersion: 2,
+    operationId: randomUUID2(),
+    kind: "version-submit",
+    resourceN: input2.resourceN,
+    resourceId: input2.resourceId,
+    env: input2.env,
+    version: input2.version,
+    fileSha1: input2.fileSha1,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    state: "prepared"
+  };
+  atomicWriteFile(pendingOperationFilePath(input2.cwd), `${JSON.stringify(pending, null, 2)}
+`);
+  return pending;
 }
-async function offlineResource(input2) {
-  assertPlatformAllowed();
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
-  const identity = resolveBoundIdentity(input2.cwd, input2.file);
-  const update2 = input2.apis?.update ?? ((params) => service_API_default.Resource.update(params));
-  await update2({
-    resourceId: identity.resourceId,
-    status: 4
-  });
+function markPendingVersionSubmitSending(cwd) {
+  const pending = readPendingOperation(cwd);
+  if (!pending || pending.state !== "prepared") {
+    throw new CliError("\u672A\u51B3\u7248\u672C\u63D0\u4EA4\u4E0D\u5904\u4E8E\u53EF\u53D1\u9001\u72B6\u6001\uFF0C\u62D2\u7EDD\u8C03\u7528\u5E73\u53F0", "PENDING_OPERATION_STATE_INVALID");
+  }
+  const sending = {
+    ...pending,
+    schemaVersion: 2,
+    state: "sending"
+  };
+  atomicWriteFile(pendingOperationFilePath(cwd), `${JSON.stringify(sending, null, 2)}
+`);
+  return sending;
 }
-
-// src/commands/shelf/offline.ts
-function createOfflineCommand() {
-  const command = addSharedOptions(new Command16("offline"));
-  command.description(
-    // i18n: cli.command.offline.description
-    "\u4E0B\u67B6"
-  ).action(async function() {
-    const shared = readSharedOptions(this);
-    await offlineResource({
-      cwd: resolveCwd(shared.cwd),
-      file: shared.file
-    });
-  });
-  return command;
+function clearPendingOperation(cwd) {
+  const filePath = pendingOperationFilePath(cwd);
+  if (!existsSync13(filePath)) return false;
+  unlinkSync6(filePath);
+  return true;
+}
+function assertNoPendingOperation(cwd) {
+  const pending = readPendingOperation(cwd);
+  if (pending) {
+    throw new CliError(
+      `\u5B58\u5728\u672A\u5B8C\u6210\u6536\u5C3E\u7684\u7248\u672C\u63D0\u4EA4\uFF08${pending.resourceId} ${pending.version}\uFF0C${pending.state}\uFF09\uFF1B\u8BF7\u5148 resource recover`,
+      "PENDING_OPERATION_EXISTS"
+    );
+  }
+}
+
+// src/domain/resource/recover.ts
+async function recoverPendingOperation(input2) {
+  return withProjectLock(input2.cwd, () => recoverPendingOperationLocked(input2), "resource-recover");
+}
+async function recoverPendingOperationLocked(input2) {
+  assertPlatformAllowed();
+  const pending = readPendingOperation(input2.cwd);
+  if (!pending) return "\u6CA1\u6709\u7ED3\u679C\u672A\u77E5\u7684\u8FDC\u7AEF\u64CD\u4F5C";
+  const activeEnv2 = getEnv2();
+  if (pending.env !== activeEnv2) {
+    throw new CliError(
+      `\u672A\u51B3\u64CD\u4F5C\u5C5E\u4E8E ${pending.env} \u73AF\u5883\uFF0C\u672C\u6B21\u662F ${activeEnv2}\uFF1B\u8BF7\u5207\u6362 --env \u540E\u6062\u590D`,
+      "PENDING_OPERATION_ENV_MISMATCH"
+    );
+  }
+  const identity = readIdentity(input2.cwd, pending.resourceN);
+  if (identity.resourceId !== pending.resourceId || (identity.env ?? "prod") !== pending.env) {
+    throw new CliError("\u672A\u51B3\u64CD\u4F5C\u4E0E\u5F53\u524D N.json \u8EAB\u4EFD\u6216\u73AF\u5883\u4E0D\u4E00\u81F4\uFF0C\u62D2\u7EDD\u731C\u6D4B\u6E05\u7406", "PENDING_OPERATION_LOCAL_MISMATCH");
+  }
+  const draft = readDraft(input2.cwd, identity.n);
+  if (draft?.resourceId && draft.resourceId !== pending.resourceId) {
+    throw new CliError("\u672A\u51B3\u64CD\u4F5C\u4E0E\u5F53\u524D\u5DE5\u4F5C\u7A3F\u4E0D\u4E00\u81F4\uFF0C\u62D2\u7EDD\u731C\u6D4B\u6E05\u7406", "PENDING_OPERATION_LOCAL_MISMATCH");
+  }
+  if (pending.state === "prepared") {
+    if (!input2.apply) {
+      return `\u5C1A\u672A\u53D1\u9001\uFF1A${pending.resourceId} ${pending.version} \u7684\u63D0\u4EA4\u8BF7\u6C42\u5C1A\u672A\u5141\u8BB8\u53D1\u51FA\uFF1B\u5DE5\u4F5C\u7A3F\u5DF2\u4FDD\u7559\u3002\u8FD0\u884C resource recover --apply --yes \u4EC5\u6E05\u7406\u672A\u51B3\u8BB0\u5F55\u540E\u53EF\u91CD\u65B0\u63D0\u4EA4`;
+    }
+    if (!input2.yes) {
+      throw new CliError("\u5E94\u7528\u6062\u590D\u4F1A\u6E05\u7406\u672A\u51B3\u8BB0\u5F55\uFF1B\u8BF7\u4F7F\u7528 resource recover --apply --yes", "RECOVER_APPLY_NEED_YES");
+    }
+    commitLocalTransaction(input2.cwd, [
+      { path: pendingOperationFilePath(input2.cwd), content: null }
+    ]);
+    return `\u5DF2\u5B8C\u6210\u6062\u590D\uFF1A${pending.resourceId} ${pending.version} \u7684\u672A\u51B3\u8BB0\u5F55\u5DF2\u6E05\u7406\uFF0C\u5DE5\u4F5C\u7A3F\u5DF2\u4FDD\u7559`;
+  }
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
+  const info2 = unwrapData2(await infoApi2({ resourceIdOrName: pending.resourceId }));
+  assertRemoteResourceOwned({
+    info: info2,
+    resourceId: pending.resourceId,
+    authUserId: auth.userId,
+    codes: {
+      invalid: "RECOVER_RESOURCE_INFO_INVALID",
+      notOwner: "RECOVER_NOT_OWNER"
+    }
+  });
+  const versionInfoApi = input2.apis?.resourceVersionInfo1 ?? ((params) => service_API_default.Resource.resourceVersionInfo1(params));
+  const versionInfo = unwrapData2(await versionInfoApi({
+    resourceId: pending.resourceId,
+    version: pending.version
+  }));
+  const remoteSha = typeof versionInfo.fileSha1 === "string" ? versionInfo.fileSha1 : "";
+  if (!remoteSha) {
+    if (input2.apply) {
+      throw new CliError("\u7EBF\u4E0A\u5C1A\u672A\u8BC1\u660E\u76EE\u6807\u7248\u672C\u5B58\u5728\uFF0C\u4E0D\u80FD\u5E94\u7528\u6062\u590D", "RECOVER_NOT_CONFIRMED");
+    }
+    return `\u672A\u786E\u8BA4\uFF1A\u7EBF\u4E0A\u4E0D\u5B58\u5728 ${pending.resourceId} \u7684\u7248\u672C ${pending.version}\uFF1B\u5DF2\u4FDD\u7559\u5DE5\u4F5C\u7A3F\u548C\u672A\u51B3\u8BB0\u5F55\uFF0C\u5207\u52FF\u91CD\u590D\u63D0\u4EA4`;
+  }
+  if (remoteSha !== pending.fileSha1) {
+    if (input2.apply) {
+      throw new CliError("\u7EBF\u4E0A\u76EE\u6807\u7248\u672C\u7684\u6587\u4EF6 SHA \u4E0D\u5339\u914D\uFF0C\u4E0D\u80FD\u5E94\u7528\u6062\u590D", "RECOVER_NOT_CONFIRMED");
+    }
+    return `\u51B2\u7A81\uFF1A\u7EBF\u4E0A ${pending.version} \u7684\u6587\u4EF6 SHA \u4E0E\u672A\u51B3\u8BB0\u5F55\u4E0D\u540C\uFF1B\u5DF2\u4FDD\u7559\u5DE5\u4F5C\u7A3F\u548C\u672A\u51B3\u8BB0\u5F55\uFF0C\u5207\u52FF\u91CD\u590D\u63D0\u4EA4`;
+  }
+  if (!input2.apply) {
+    return `\u5DF2\u786E\u8BA4\uFF1A${pending.resourceId} ${pending.version} \u5DF2\u4EE5\u76F8\u540C SHA \u63D0\u4EA4\u3002\u8FD0\u884C resource recover --apply --yes \u6E05\u7406\u672C\u5730\u5DE5\u4F5C\u7A3F\u548C\u672A\u51B3\u8BB0\u5F55`;
+  }
+  if (!input2.yes) {
+    throw new CliError("\u5E94\u7528\u6062\u590D\u4F1A\u5220\u9664\u672C\u5730\u5DE5\u4F5C\u7A3F\uFF1B\u8BF7\u4F7F\u7528 resource recover --apply --yes", "RECOVER_APPLY_NEED_YES");
+  }
+  commitLocalTransaction(input2.cwd, [
+    { path: pendingOperationFilePath(input2.cwd), content: null },
+    { path: draftFilePath(input2.cwd, identity.n), content: null }
+  ]);
+  return `\u5DF2\u5B8C\u6210\u6062\u590D\uFF1A${pending.resourceId} ${pending.version} \u7684\u672C\u5730\u5DE5\u4F5C\u7A3F\u548C\u672A\u51B3\u8BB0\u5F55\u5DF2\u6E05\u7406`;
+}
+
+// src/local/diagnostics.ts
+import { existsSync as existsSync14, readdirSync as readdirSync5 } from "fs";
+var IDENTITY_FILE_RE2 = /^([1-9]\d*)\.json$/;
+var DRAFT_FILE_RE2 = /^([1-9]\d*)\.version\.json$/;
+function errorMessage(error2) {
+  return error2 instanceof Error ? error2.message : "\u672A\u77E5\u9519\u8BEF";
+}
+function duplicateDiagnostics(cwd, identities) {
+  const result = [];
+  for (const key of ["resourceId", "resourceName", "filePath"]) {
+    const seen = /* @__PURE__ */ new Map();
+    for (const identity of identities) {
+      const raw = identity[key];
+      if (!raw) continue;
+      let value;
+      try {
+        value = key === "filePath" ? normalizeProjectPath(cwd, raw) : raw;
+      } catch (error2) {
+        result.push({ file: `${identity.n}.json`, code: "IDENTITY_PATH_INVALID", message: errorMessage(error2) });
+        continue;
+      }
+      const previous = seen.get(value);
+      if (previous !== void 0) {
+        result.push({
+          file: `${identity.n}.json`,
+          code: "IDENTITY_CONFLICT",
+          message: `\u4E0E ${previous}.json \u4F7F\u7528\u76F8\u540C ${key}`
+        });
+      } else {
+        seen.set(value, identity.n);
+      }
+    }
+  }
+  return result;
+}
+function diagnoseLocalState(cwd) {
+  const dir = freelogDir(cwd);
+  if (!existsSync14(dir)) return "\u6CA1\u6709 .freelog \u672C\u5730\u72B6\u6001";
+  let entries;
+  try {
+    entries = readdirSync5(dir).sort((left, right) => left.localeCompare(right, "en"));
+  } catch (error2) {
+    return `\u65E0\u6CD5\u8BFB\u53D6 .freelog\uFF1A${errorMessage(error2)}`;
+  }
+  const lines = [];
+  const diagnostics = [];
+  const identityNumbers = /* @__PURE__ */ new Set();
+  const validIdentities = [];
+  for (const file of entries) {
+    const match = IDENTITY_FILE_RE2.exec(file);
+    if (!match) continue;
+    const n = Number(match[1]);
+    identityNumbers.add(n);
+    try {
+      const identity = readIdentity(cwd, n);
+      validIdentities.push(identity);
+      lines.push(`${file}\uFF1A\u6709\u6548\uFF08${identity.resourceId ?? "\u672A\u7ED1\u5B9A"}\uFF0C${identity.typeCode}\uFF0C${identity.filePath}\uFF09`);
+    } catch (error2) {
+      diagnostics.push({ file, code: "IDENTITY_INVALID", message: errorMessage(error2) });
+    }
+  }
+  for (const file of entries) {
+    const match = DRAFT_FILE_RE2.exec(file);
+    if (!match) continue;
+    const n = Number(match[1]);
+    if (!identityNumbers.has(n)) {
+      diagnostics.push({ file, code: "DRAFT_ORPHAN", message: `\u6CA1\u6709\u540C\u53F7 ${n}.json` });
+      continue;
+    }
+    if (!validIdentities.some((identity) => identity.n === n)) {
+      diagnostics.push({ file, code: "DRAFT_IDENTITY_INVALID", message: `\u540C\u53F7 ${n}.json \u5DF2\u635F\u574F\uFF0C\u65E0\u6CD5\u6838\u9A8C\u5DE5\u4F5C\u7A3F` });
+      continue;
+    }
+    try {
+      const draft = readDraft(cwd, n);
+      lines.push(`${file}\uFF1A\u6709\u6548\uFF08${draft?.draftKind ?? "\u65E0"} \u5DE5\u4F5C\u7A3F\uFF09`);
+    } catch (error2) {
+      diagnostics.push({ file, code: "DRAFT_INVALID", message: errorMessage(error2) });
+    }
+  }
+  diagnostics.push(...duplicateDiagnostics(cwd, validIdentities));
+  if (entries.includes("index.json")) {
+    lines.push("index.json\uFF1A\u5386\u53F2\u9057\u7559\u6587\u4EF6\uFF0C\u5F53\u524D CLI \u4E0D\u8BFB\u53D6\u3001\u4E0D\u91CD\u5EFA\u4E5F\u4E0D\u81EA\u52A8\u5220\u9664");
+  }
+  try {
+    const pending = readPendingOperation(cwd);
+    if (pending) lines.push(`.pending-operation.json\uFF1A\u672A\u51B3 ${pending.kind}\uFF08${pending.resourceId} ${pending.version}\uFF09`);
+  } catch (error2) {
+    diagnostics.push({ file: ".pending-operation.json", code: "PENDING_OPERATION_INVALID", message: errorMessage(error2) });
+  }
+  if (entries.includes(".txn.json")) {
+    lines.push(".txn.json\uFF1A\u5B58\u5728\uFF1B\u4E0B\u4E00\u6B21\u6301\u9501\u4E1A\u52A1\u547D\u4EE4\u4F1A\u5C1D\u8BD5\u6062\u590D\uFF0C\u8BCA\u65AD\u547D\u4EE4\u4E0D\u4F1A\u56DE\u653E");
+  }
+  if (lines.length === 0) lines.push("\u6CA1\u6709\u53EF\u8BC6\u522B\u7684\u8D44\u6E90\u8EAB\u4EFD\u6216\u5DE5\u4F5C\u7A3F");
+  if (diagnostics.length === 0) return `\u672C\u5730\u72B6\u6001\u6B63\u5E38\uFF1A
+${lines.map((line) => `- ${line}`).join("\n")}`;
+  return [
+    "\u672C\u5730\u72B6\u6001\u5B58\u5728\u95EE\u9898\uFF08\u672A\u4FEE\u6539\u4EFB\u4F55\u6587\u4EF6\uFF09\uFF1A",
+    ...lines.map((line) => `- ${line}`),
+    ...diagnostics.map((item) => `- ${item.file} [${item.code}]\uFF1A${item.message}`),
+    "\u8BF7\u5148\u5907\u4EFD .freelog\uFF1B\u4FEE\u590D\u6216\u5220\u9664\u660E\u786E\u65E0\u7528\u7684\u5B8C\u6574\u72B6\u6001\u5355\u5143\u540E\u518D\u6267\u884C\u4E1A\u52A1\u547D\u4EE4\u3002"
+  ].join("\n");
+}
+
+// src/commands/project/resource.ts
+function createResourceCommand() {
+  const resource = addSharedOptions(new Command15("resource")).description("\u8D44\u6E90\u672C\u5730\u72B6\u6001\u7EF4\u62A4");
+  resource.command("list").description("\u53EA\u8BFB\u8BCA\u65AD\u672C\u5730\u8D44\u6E90\u72B6\u6001\uFF08\u635F\u574F\u65F6\u4E5F\u53EF\u8FD0\u884C\uFF09").action(function() {
+    const shared = readSharedOptions(this);
+    console.log(diagnoseLocalState(resolveCwd(shared.cwd)));
+  });
+  resource.command("sync").description("\u4ECE\u5E73\u53F0\u540C\u6B65\u672C\u5730\u8D44\u6E90\u6807\u9898").action(async function() {
+    const shared = readSharedOptions(this);
+    console.log(await syncResourceTitles({ cwd: resolveCwd(shared.cwd), selector: shared.file }));
+  });
+  resource.command("recover").description("\u5904\u7406\u672A\u51B3\u7248\u672C\u63D0\u4EA4\uFF0C\u7EDD\u4E0D\u91CD\u53D1").option("--apply", "prepared \u4EC5\u6E05 marker\uFF1Bsending \u987B\u8FDC\u7AEF\u7248\u672C\u548C SHA \u5DF2\u8BC1\u660E\u6210\u529F\u624D\u6E05\u7406\u7A3F").action(async function() {
+    const shared = readSharedOptions(this);
+    const options = this.opts();
+    console.log(await recoverPendingOperation({
+      cwd: resolveCwd(shared.cwd),
+      apply: options.apply === true,
+      yes: shared.yes
+    }));
+  });
+  return resource;
+}
+
+// src/commands/shelf/offline.ts
+import { Command as Command16 } from "commander";
+
+// src/domain/online/online.ts
+async function loadInfo(resourceId, apis) {
+  const infoApi2 = apis?.info ?? ((params) => service_API_default.Resource.info(params));
+  return unwrapData2(
+    await infoApi2({
+      resourceIdOrName: resourceId,
+      isLoadLatestVersionInfo: 1,
+      isLoadPolicyInfo: 1
+    })
+  );
+}
+function validateForOnline(info2) {
+  if (!info2.latestVersion) {
+    throw new CliError("\u4E0A\u67B6\u987B\u5DF2\u6709\u7248\u672C", "ONLINE_NO_VERSION");
+  }
+  const policies2 = info2.policies ?? [];
+  if (!policies2.some((item) => item.status === 1)) {
+    throw new CliError("\u4E0A\u67B6\u987B\u81F3\u5C11\u4E00\u6761\u542F\u7528\u7B56\u7565", "ONLINE_NO_POLICY");
+  }
+}
+async function onlineResource(input2) {
+  assertPlatformAllowed();
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const identity = resolveBoundIdentity(input2.cwd, input2.file);
+  const info2 = await loadInfo(identity.resourceId, input2.apis);
+  assertRemoteResourceWritable({ info: info2, resourceId: identity.resourceId, authUserId: auth.userId });
+  validateForOnline(info2);
+  const update2 = input2.apis?.update ?? ((params) => service_API_default.Resource.update(params));
+  await update2({
+    resourceId: identity.resourceId,
+    status: 1
+  });
+}
+async function offlineResource(input2) {
+  assertPlatformAllowed();
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const identity = resolveBoundIdentity(input2.cwd, input2.file);
+  const info2 = await loadInfo(identity.resourceId, input2.apis);
+  assertRemoteResourceWritable({ info: info2, resourceId: identity.resourceId, authUserId: auth.userId });
+  const update2 = input2.apis?.update ?? ((params) => service_API_default.Resource.update(params));
+  await update2({
+    resourceId: identity.resourceId,
+    status: 4
+  });
+}
+
+// src/commands/shelf/offline.ts
+function createOfflineCommand() {
+  const command = addSharedOptions(new Command16("offline"));
+  command.description(
+    // i18n: cli.command.offline.description
+    "\u4E0B\u67B6"
+  ).action(async function() {
+    const shared = readSharedOptions(this);
+    await offlineResource({
+      cwd: resolveCwd(shared.cwd),
+      file: shared.file
+    });
+  });
+  return command;
 }
 
 // src/commands/shelf/online.ts
@@ -26461,7 +27141,7 @@ async function validateOnline(input2) {
     throw new CliError("\u76EE\u524D\u53EA\u652F\u6301 --for online", "VALIDATE_FOR");
   }
   assertPlatformAllowed();
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
   const identity = resolveBoundIdentity(input2.cwd, input2.file);
   const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
   const result = await infoApi2({
@@ -26470,6 +27150,11 @@ async function validateOnline(input2) {
     isLoadPolicyInfo: 1
   });
   const data = result.data ?? result;
+  assertRemoteResourceWritable({
+    info: data,
+    resourceId: identity.resourceId,
+    authUserId: auth.userId
+  });
   validateForOnline(data);
   return "\u53EF\u4EE5\u4E0A\u67B6";
 }
@@ -26753,6 +27438,42 @@ function attrList(cwd, file) {
   );
   return list2.map((item) => `${item.key}=${item.defaultValue ?? ""} ${item.name ?? ""}`).join("\n");
 }
+function attrReview(cwd, file) {
+  const identity = resolveIdentity(cwd, file);
+  const draft = readDraft(cwd, identity.n);
+  if (!draft) {
+    throw new CliError("\u6CA1\u6709\u5DE5\u4F5C\u7A3F\uFF0C\u8BF7\u5148 version draft pull", "DRAFT_MISSING");
+  }
+  const items = draft.orphanedInputAttrs ?? [];
+  if (items.length === 0) return "\u6CA1\u6709\u5F85\u590D\u6838\u7684\u9644\u52A0\u5C5E\u6027";
+  return [
+    "\u4EE5\u4E0B\u9644\u52A0\u5C5E\u6027\u5DF2\u4E0D\u5728\u5F53\u524D\u6587\u4EF6\u5206\u6790\u7ED3\u679C\u4E2D\uFF0C\u4E0D\u80FD\u63D0\u4EA4\uFF1A",
+    ...items.map((item) => `  ${String(item.key ?? "\uFF08\u65E0\u952E\uFF09")}=${String(item.value ?? "")}`),
+    "\u91CD\u65B0\u4E0A\u4F20\u5305\u542B\u8BE5 key \u7684\u6587\u4EF6\u4F1A\u81EA\u52A8\u6062\u590D\uFF1B\u786E\u8BA4\u4E0D\u518D\u9700\u8981\u53EF\u6267\u884C version attr review discard <key>\u3002"
+  ].join("\n");
+}
+async function attrReviewDiscard(cwd, input2) {
+  return withProjectLock(cwd, () => attrReviewDiscardLocked(cwd, input2), "version-attr-review-discard");
+}
+async function attrReviewDiscardLocked(cwd, input2) {
+  const identity = resolveIdentity(cwd, input2.file);
+  const draft = readDraft(cwd, identity.n);
+  if (!draft) {
+    throw new CliError("\u6CA1\u6709\u5DE5\u4F5C\u7A3F\uFF0C\u8BF7\u5148 version draft pull", "DRAFT_MISSING");
+  }
+  const key = input2.key.trim();
+  const items = draft.orphanedInputAttrs ?? [];
+  if (!key || !items.some((item) => item.key === key)) {
+    throw new CliError("\u627E\u4E0D\u5230\u5F85\u590D\u6838\u9644\u52A0\u5C5E\u6027", "ATTR_REVIEW_NOT_FOUND");
+  }
+  const preview = `\u5373\u5C06\u4E22\u5F03\u5F85\u590D\u6838\u9644\u52A0\u5C5E\u6027\uFF1A${key}`;
+  if (!await confirmDestructive(preview, "\u4E22\u5F03\u5F85\u590D\u6838\u9644\u52A0\u5C5E\u6027", input2.yes)) {
+    return "\u5DF2\u53D6\u6D88";
+  }
+  draft.orphanedInputAttrs = items.filter((item) => item.key !== key);
+  writeDraft(cwd, identity.n, draft);
+  return preview;
+}
 
 // src/commands/version/attr.ts
 function createVersionAttrCommand() {
@@ -26774,12 +27495,232 @@ function createVersionAttrCommand() {
     const shared = readSharedOptions(this);
     console.log(attrList(resolveCwd(shared.cwd), shared.file));
   });
+  const review = addSharedOptions(attr.command("review")).description("\u67E5\u770B\u6216\u5904\u7406\u6587\u4EF6\u5206\u6790\u53D8\u5316\u540E\u7684\u9644\u52A0\u5C5E\u6027");
+  review.action(function() {
+    const shared = readSharedOptions(this);
+    console.log(attrReview(resolveCwd(shared.cwd), shared.file));
+  });
+  addSharedOptions(review.command("discard")).description("\u786E\u8BA4\u4E22\u5F03\u4E00\u9879\u5F85\u590D\u6838\u9644\u52A0\u5C5E\u6027").argument("<key>", "\u9644\u52A0\u5C5E\u6027\u952E").action(async function(key) {
+    const shared = readSharedOptions(this);
+    console.log(await attrReviewDiscard(resolveCwd(shared.cwd), {
+      key,
+      file: shared.file,
+      yes: shared.yes
+    }));
+  });
   return attr;
 }
 
 // src/commands/version/create-version.ts
 import { Command as Command20 } from "commander";
 
+// src/domain/version/form/option.ts
+var MAX_OPTION = 30;
+var MAX_OPTION_ITEM = 30;
+var MAX_TEXT_DEFAULT = 140;
+var MAX_NAME2 = 50;
+var MAX_REMARK2 = 50;
+function assertValidName2(name) {
+  if (name.length > MAX_NAME2) {
+    throw new CliError("\u540D\u79F0\u4E0D\u80FD\u8D85\u8FC750\u4E2A\u5B57\u7B26", "OPTION_NAME_LONG");
+  }
+}
+function assertValidRemark2(remark) {
+  if (remark.length > MAX_REMARK2) {
+    throw new CliError("\u4E0D\u80FD\u8D85\u8FC750\u4E2A\u5B57\u7B26\u3002", "OPTION_REMARK_LONG");
+  }
+}
+function assertOptionValueLength(value) {
+  if (value.length > MAX_TEXT_DEFAULT) {
+    throw new CliError("\u4E0D\u8D85\u8FC7140\u4E2A\u5B57\u7B26", "OPTION_VALUE_LONG");
+  }
+}
+function isOption(item) {
+  return item.type === "editableText" || item.type === "select";
+}
+async function assertTypeAllowsOption(input2) {
+  if (input2.supportOptionalConfig === true) return;
+  if (input2.supportOptionalConfig === false) {
+    throw new CliError("\u5F53\u524D\u7C7B\u578B\u4E0D\u652F\u6301\u53EF\u9009\u914D\u7F6E", "OPTION_UNSUPPORTED");
+  }
+  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const type = await getTypeInfo(input2.typeCode, input2.apis);
+  if (type.supportOptionalConfig !== 2) {
+    throw new CliError("\u5F53\u524D\u7C7B\u578B\u4E0D\u652F\u6301\u53EF\u9009\u914D\u7F6E", "OPTION_UNSUPPORTED");
+  }
+}
+async function assertDraftOptionsAllowed(input2) {
+  if (!(input2.customPropertyDescriptors ?? []).some((item) => isOption(item))) return;
+  await assertTypeAllowsOption(input2);
+}
+function optionListFromDraft(draft) {
+  return (draft.customPropertyDescriptors ?? []).filter((item) => isOption(item));
+}
+function normalizeMode(mode) {
+  if (mode === void 0) return void 0;
+  if (mode === "\u4E0B\u62C9" || mode === "\u4E0B\u62C9\u5217\u8868" || mode === "select") return "select";
+  if (mode === "\u6587\u672C" || mode === "\u6587\u672C\u8F93\u5165\u6846" || mode === "input") return "editableText";
+  throw new CliError("\u65B9\u5F0F\u53EA\u80FD\u662F\u6587\u672C\u6216\u4E0B\u62C9", "OPTION_MODE");
+}
+function parseCandidates(raw) {
+  const items = (raw ?? "").split("|").map((item) => item.trim()).filter(Boolean);
+  if (items.length === 0) throw new CliError("\u4E0B\u62C9\u81F3\u5C11\u9700\u8981 1 \u4E2A\u9009\u9879", "OPTION_OPTIONS");
+  if (items.length > MAX_OPTION_ITEM) throw new CliError("\u9009\u9879\u4E2A\u6570\u4E0D\u80FD\u8D85\u8FC730\u9879", "OPTION_OPTIONS");
+  for (const item of items) assertOptionValueLength(item);
+  if (items.some((item, index) => items.indexOf(item) !== index)) {
+    throw new CliError("\u8BE5\u9009\u9879\u5DF2\u5B58\u5728", "OPTION_DUPLICATE_OPTION");
+  }
+  return items;
+}
+async function optionAdd(cwd, input2) {
+  return withProjectLock(cwd, () => optionAddLocked(cwd, input2), "version-option-add");
+}
+async function optionAddLocked(cwd, input2) {
+  const identity = resolveIdentity(cwd, input2.file);
+  await assertTypeAllowsOption({ cwd, typeCode: identity.typeCode, ...input2 });
+  const draft = readDraft(cwd, identity.n) ?? {
+    baseUpcastResources: [],
+    authExcludedItems: []
+  };
+  const parsed = parseLine(input2.line ?? "");
+  if (!parsed.name || !parsed.key) {
+    throw new CliError("\u53EF\u9009\u914D\u7F6E\u9700\u8981\u540D\u79F0\u548C\u952E", "OPTION_FIELDS");
+  }
+  assertValidKey(parsed.key);
+  const list2 = draft.customPropertyDescriptors ?? [];
+  if (optionListFromDraft(draft).length >= MAX_OPTION) {
+    throw new CliError("\u6700\u591A\u53EF\u6DFB\u52A030\u4E2A\u53EF\u9009\u914D\u7F6E", "OPTION_FULL");
+  }
+  if (list2.some((item) => item.key === parsed.key)) {
+    throw new CliError(`\u952E ${parsed.key} \u5DF2\u5B58\u5728`, "OPTION_DUPLICATE");
+  }
+  if (list2.some((item) => item.name === parsed.name)) {
+    throw new CliError("\u540D\u79F0\u5DF2\u5B58\u5728", "OPTION_NAME_DUPLICATE");
+  }
+  const normalizedMode = normalizeMode(parsed.mode);
+  if (!normalizedMode) {
+    throw new CliError("\u65B9\u5F0F\u53EA\u80FD\u662F\u6587\u672C\u6216\u4E0B\u62C9", "OPTION_MODE");
+  }
+  const isSelect = normalizedMode === "select";
+  const isText = normalizedMode === "editableText";
+  if (isSelect && parsed.defaultValue) {
+    throw new CliError("\u4E0B\u62C9\u9ED8\u8BA4\u503C\u56FA\u5B9A\u4E3A\u7B2C\u4E00\u9879\uFF0C\u8BF7\u628A\u8981\u9ED8\u8BA4\u7684\u9009\u9879\u653E\u5728\u7B2C\u4E00\u4F4D", "OPTION_SELECT_DEFAULT");
+  }
+  if (isText && parsed.options) {
+    throw new CliError("\u6587\u672C\u65B9\u5F0F\u4E0D\u8981\u5199\u9009\u9879", "OPTION_TEXT_OPTIONS");
+  }
+  if (!isSelect && !isText) {
+    throw new CliError("\u65B9\u5F0F\u53EA\u80FD\u662F\u6587\u672C\u6216\u4E0B\u62C9", "OPTION_MODE");
+  }
+  let type = "editableText";
+  let defaultValue = parsed.defaultValue ?? parsed.value ?? "";
+  let candidateItems;
+  assertValidName2(parsed.name);
+  assertValidRemark2(parsed.remark ?? "");
+  if (isSelect) {
+    const options = parseCandidates(parsed.options);
+    type = "select";
+    defaultValue = options[0] ?? "";
+    candidateItems = options;
+  } else {
+    assertOptionValueLength(defaultValue);
+  }
+  const preview = await confirmWrite(previewLine(parsed), input2.yes);
+  list2.push({
+    name: parsed.name,
+    key: parsed.key,
+    remark: parsed.remark ?? "",
+    defaultValue,
+    type,
+    ...candidateItems ? { candidateItems } : {}
+  });
+  draft.customPropertyDescriptors = list2;
+  writeDraft(cwd, identity.n, draft);
+  return preview;
+}
+async function optionSet(cwd, input2) {
+  return withProjectLock(cwd, () => optionSetLocked(cwd, input2), "version-option-set");
+}
+async function optionSetLocked(cwd, input2) {
+  const identity = resolveIdentity(cwd, input2.file);
+  const draft = readDraft(cwd, identity.n);
+  if (!draft) {
+    throw new CliError("\u6CA1\u6709\u5DE5\u4F5C\u7A3F\uFF0C\u8BF7\u5148 version draft pull", "DRAFT_MISSING");
+  }
+  const parsed = parseLine(input2.line ?? "");
+  const found = (draft.customPropertyDescriptors ?? []).find(
+    (item) => isOption(item) && (item.key === parsed.key || item.name === parsed.name)
+  );
+  if (!found) {
+    throw new CliError("\u627E\u4E0D\u5230\u8FD9\u6761\u53EF\u9009\u914D\u7F6E", "OPTION_NOT_FOUND");
+  }
+  await assertTypeAllowsOption({ cwd, typeCode: identity.typeCode, ...input2 });
+  assertKeyUnchanged(String(found.key), parsed.key);
+  assertValidName2(parsed.name ?? String(found.name ?? ""));
+  assertValidRemark2(parsed.remark ?? String(found.remark ?? ""));
+  const nextType = normalizeMode(parsed.mode) ?? (String(found.type) === "select" ? "select" : "editableText");
+  const nextDefault = parsed.defaultValue ?? parsed.value;
+  if (nextType === "select" && nextDefault !== void 0) {
+    throw new CliError("\u4E0B\u62C9\u9ED8\u8BA4\u503C\u56FA\u5B9A\u4E3A\u7B2C\u4E00\u9879\uFF0C\u8BF7\u628A\u8981\u9ED8\u8BA4\u7684\u9009\u9879\u653E\u5728\u7B2C\u4E00\u4F4D", "OPTION_SELECT_DEFAULT");
+  }
+  if (nextType === "editableText") {
+    if (parsed.options !== void 0) {
+      throw new CliError("\u6587\u672C\u65B9\u5F0F\u4E0D\u8981\u5199\u9009\u9879", "OPTION_TEXT_OPTIONS");
+    }
+    if (nextDefault !== void 0) assertOptionValueLength(nextDefault);
+  }
+  if (parsed.name && (draft.customPropertyDescriptors ?? []).some((item) => item.name === parsed.name && item.key !== found.key)) {
+    throw new CliError("\u540D\u79F0\u5DF2\u5B58\u5728", "OPTION_NAME_DUPLICATE");
+  }
+  if (parsed.name) {
+    found.name = parsed.name;
+  }
+  if (parsed.remark !== void 0) {
+    found.remark = parsed.remark;
+  }
+  if (nextType === "select") {
+    const candidates = parsed.options !== void 0 ? parseCandidates(parsed.options) : Array.isArray(found.candidateItems) ? found.candidateItems.map(String) : [];
+    if (candidates.length === 0) {
+      throw new CliError("\u4E0B\u62C9\u81F3\u5C11\u9700\u8981 1 \u4E2A\u9009\u9879", "OPTION_OPTIONS");
+    }
+    found.type = "select";
+    found.candidateItems = candidates;
+    found.defaultValue = candidates[0];
+  } else {
+    found.type = "editableText";
+    delete found.candidateItems;
+    if (nextDefault !== void 0) {
+      found.defaultValue = nextDefault;
+    }
+  }
+  const preview = await confirmWrite(previewLine(parsed), input2.yes);
+  writeDraft(cwd, identity.n, draft);
+  return preview;
+}
+function optionRm(cwd, key, file) {
+  return withProjectLock(cwd, () => optionRmLocked(cwd, key, file), "version-option-rm");
+}
+function optionRmLocked(cwd, key, file) {
+  const identity = resolveIdentity(cwd, file);
+  const draft = readDraft(cwd, identity.n);
+  if (!draft) {
+    throw new CliError("\u6CA1\u6709\u5DE5\u4F5C\u7A3F\uFF0C\u8BF7\u5148 version draft pull", "DRAFT_MISSING");
+  }
+  const list2 = draft.customPropertyDescriptors ?? [];
+  const next = list2.filter((item) => !(isOption(item) && item.key === key));
+  if (next.length === list2.length) {
+    throw new CliError("\u627E\u4E0D\u5230\u8FD9\u6761\u53EF\u9009\u914D\u7F6E", "OPTION_NOT_FOUND");
+  }
+  draft.customPropertyDescriptors = next;
+  writeDraft(cwd, identity.n, draft);
+  return key;
+}
+function optionList(cwd, file) {
+  const identity = resolveIdentity(cwd, file);
+  const draft = readDraft(cwd, identity.n);
+  return optionListFromDraft(draft ?? {}).map((item) => `${item.key}=${item.defaultValue ?? ""} ${item.name ?? ""}`).join("\n");
+}
+
 // src/domain/version/submit.ts
 function fieldName(error2) {
   const rec = error2;
@@ -26804,6 +27745,9 @@ function buildVersionPayload(input2) {
   };
 }
 async function submitVersion(input2) {
+  return withProjectLock(input2.cwd, () => submitVersionLocked(input2), "submit-version");
+}
+async function submitVersionLocked(input2) {
   assertPlatformAllowed();
   if (!input2.identity.resourceId) {
     throw new CliError("\u8BF7\u5148 create \u6216 bind", "SUBMIT_NO_RESOURCE");
@@ -26818,15 +27762,39 @@ async function submitVersion(input2) {
   if ((draft.orphanedInputAttrs ?? []).length > 0) {
     throw new CliError("\u6587\u4EF6\u5206\u6790\u53D8\u5316\u5F85\u5904\u7406\uFF0C\u8BF7\u5148\u4EBA\u5DE5\u590D\u6838\u9644\u52A0\u5C5E\u6027", "SUBMIT_ORPHANED_INPUT_ATTRS");
   }
+  await assertDraftOptionsAllowed({
+    cwd: input2.cwd,
+    typeCode: input2.identity.typeCode,
+    customPropertyDescriptors: draft.customPropertyDescriptors,
+    homeDir: input2.homeDir,
+    apis: input2.apis
+  });
   const payload = buildVersionPayload({
     resourceId: input2.identity.resourceId,
     version: input2.version,
     draft
   });
   const createVersion2 = input2.apis?.createVersion ?? ((params) => service_API_default.Resource.createVersion(params));
+  assertNoPendingOperation(input2.cwd);
+  createPendingVersionSubmit({
+    cwd: input2.cwd,
+    resourceN: input2.identity.n,
+    resourceId: input2.identity.resourceId,
+    env: getEnv2(),
+    version: input2.version,
+    fileSha1: draft.fileSha1
+  });
+  markPendingVersionSubmitSending(input2.cwd);
   try {
     await createVersion2(payload);
   } catch (error2) {
+    if (!isDefinitivePlatformRejection(error2)) {
+      throw new CliError(
+        "\u7248\u672C\u63D0\u4EA4\u8BF7\u6C42\u7ED3\u679C\u672A\u77E5\uFF1B\u8BF7\u8FD0\u884C resource recover \u6838\u9A8C\uFF0C\u5207\u52FF\u91CD\u590D\u63D0\u4EA4\u6216\u91CD\u65B0 bump",
+        "SUBMIT_RESULT_UNKNOWN"
+      );
+    }
+    clearPendingOperation(input2.cwd);
     const field = fieldName(error2);
     const detail = errorDetail(error2);
     throw new CliError(
@@ -26834,21 +27802,30 @@ async function submitVersion(input2) {
       "SUBMIT_FAILED"
     );
   }
-  deleteDraft(input2.cwd, input2.identity.n);
+  commitLocalTransaction(input2.cwd, [
+    { path: draftFilePath(input2.cwd, input2.identity.n), content: null },
+    { path: pendingOperationFilePath(input2.cwd), content: null }
+  ]);
+}
+function isDefinitivePlatformRejection(error2) {
+  if (error2 instanceof CliError) return true;
+  const rec = error2;
+  if (typeof rec.field === "string" || typeof rec.msg === "string" || typeof rec.result?.msg === "string") {
+    return true;
+  }
+  const status = rec.status ?? rec.statusCode ?? rec.response?.status;
+  return typeof status === "number" && status >= 400 && status < 500;
 }
 
 // src/domain/version/file.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync12, readFileSync as readFileSync9, statSync as statSync2, unlinkSync as unlinkSync6 } from "fs";
-import path15 from "path";
+import { createReadStream, existsSync as existsSync15, openAsBlob, statSync as statSync3, unlinkSync as unlinkSync7 } from "fs";
+import path16 from "path";
 var ANALYZE_TIMEOUT_MS = 12e4;
 var ANALYZE_POLL_INTERVAL_MS = 200;
 function resolveExistingPath(cwd, raw) {
-  if (existsSync12(raw)) {
-    return path15.resolve(raw);
-  }
-  const joined = path15.resolve(cwd, raw);
-  if (existsSync12(joined)) {
+  const joined = path16.resolve(cwd, raw);
+  if (existsSync15(joined)) {
     return joined;
   }
   return void 0;
@@ -26860,11 +27837,13 @@ function confirmLocalPath(identity, file, yes, cwd) {
     if (!resolved) {
       throw new CliError(`\u672C\u5730\u6587\u4EF6\u4E0D\u5728\uFF1A${normalizedFile}\u3002\u4E0D\u51C6\u7EED\u7528 sha1`, "FILE_MISSING");
     }
+    resolveExistingProjectPath(cwd, resolved);
     return resolved;
   }
   const recorded = identity.filePath ? normalizeProjectPath(cwd, identity.filePath) : void 0;
   const recordedExists = recorded ? resolveExistingPath(cwd, recorded) : void 0;
   if (recordedExists) {
+    resolveExistingProjectPath(cwd, recordedExists);
     return recordedExists;
   }
   if (yes) {
@@ -26894,24 +27873,55 @@ async function waitAnalyze(sha1, typeCode, apis, now = Date.now, sleep = (ms) =>
   }
   throw new CliError("\u5C5E\u6027\u89E3\u6790\u8D85\u65F6", "FILE_ANALYZE_TIMEOUT");
 }
-function sha1OfFile(uploadPath) {
-  return createHash3("sha1").update(readFileSync9(uploadPath)).digest("hex");
+function fingerprintFile(uploadPath) {
+  const stats = statSync3(uploadPath);
+  if (!stats.isFile()) {
+    throw new CliError("\u4EA7\u7269\u5FC5\u987B\u662F\u53EF\u8BFB\u53D6\u7684\u6587\u4EF6", "FILE_ARTIFACT_UNSUPPORTED");
+  }
+  return { size: stats.size, mtimeMs: stats.mtimeMs, ctimeMs: stats.ctimeMs };
 }
-async function uploadIfNew(uploadPath, sha1, typeCode, apis) {
+function assertFileUnchanged(uploadPath, expected) {
+  const actual = fingerprintFile(uploadPath);
+  if (actual.size !== expected.size || actual.mtimeMs !== expected.mtimeMs || actual.ctimeMs !== expected.ctimeMs) {
+    throw new CliError(
+      "\u53D1\u5E03\u671F\u95F4\u672C\u5730\u4EA7\u7269\u53D1\u751F\u53D8\u5316\uFF1B\u8BF7\u4FDD\u6301\u4EA7\u7269\u7A33\u5B9A\u540E\u91CD\u8BD5",
+      "FILE_CHANGED_DURING_PUBLISH"
+    );
+  }
+}
+async function sha1OfFile(uploadPath) {
+  const fingerprint = fingerprintFile(uploadPath);
+  const hash = createHash3("sha1");
+  await new Promise((resolve, reject) => {
+    const stream4 = createReadStream(uploadPath);
+    stream4.on("data", (chunk) => {
+      hash.update(chunk);
+    });
+    stream4.once("error", reject);
+    stream4.once("end", resolve);
+  });
+  assertFileUnchanged(uploadPath, fingerprint);
+  return { sha1: hash.digest("hex"), fingerprint };
+}
+async function uploadIfNew(uploadPath, sha1, fingerprint, typeCode, apis) {
   const fileIsExist2 = apis.fileIsExist ?? ((params) => service_API_default.Storage.fileIsExist(params));
   const exists2 = unwrapFirst(await fileIsExist2({ sha1 }));
   if (exists2.isExisting || exists2.exist || exists2.data === true) {
+    assertFileUnchanged(uploadPath, fingerprint);
     return;
   }
   const upload = apis.uploadFile ?? ((params) => service_API_default.Storage.uploadFile(params));
-  await upload({ file: readFileSync9(uploadPath), resourceType: typeCode });
+  assertFileUnchanged(uploadPath, fingerprint);
+  const file = await openAsBlob(uploadPath);
+  await upload({ file, resourceType: typeCode });
+  assertFileUnchanged(uploadPath, fingerprint);
 }
 function removeTempZip(uploadPath, localPath) {
-  if (uploadPath === localPath || !existsSync12(uploadPath)) {
+  if (uploadPath === localPath || !existsSync15(uploadPath)) {
     return;
   }
   try {
-    unlinkSync6(uploadPath);
+    unlinkSync7(uploadPath);
   } catch {
   }
 }
@@ -26926,16 +27936,22 @@ function writeSha1ToDraft(input2, uploaded, analysis) {
     metadata.filter((item) => Boolean(item) && typeof item === "object").filter((item) => Number(item.insertMode) === 2).map((item) => String(item.key ?? "")).filter(Boolean)
   );
   const previousAttrs = draft.inputAttrs ?? [];
+  const previousOrphans = draft.orphanedInputAttrs ?? [];
   const reuseCurrentAnalysis = !hasMetadata && draft.fileSha1 === uploaded.fileSha1 && draft.analyzedSha1 === uploaded.fileSha1;
-  const retainedAttrs = reuseCurrentAnalysis ? previousAttrs : previousAttrs.filter((item) => additionalKeys.has(String(item.key ?? "")));
+  const retainedAttrs = reuseCurrentAnalysis ? previousAttrs : [
+    ...previousAttrs.filter((item) => additionalKeys.has(String(item.key ?? ""))),
+    // 新分析重新出现同 key 时，恢复用户上次保留的值；它不应永远卡在待复核队列。
+    ...previousOrphans.filter((item) => additionalKeys.has(String(item.key ?? "")) && !previousAttrs.some((current) => additionalKeys.has(String(current.key ?? "")) && current.key === item.key))
+  ];
   const newlyOrphaned = reuseCurrentAnalysis ? [] : previousAttrs.filter((item) => !additionalKeys.has(String(item.key ?? "")));
+  const unresolvedOrphans = reuseCurrentAnalysis ? previousOrphans : previousOrphans.filter((item) => !additionalKeys.has(String(item.key ?? "")));
   draft.fileSha1 = uploaded.fileSha1;
   draft.filename = uploaded.filename;
   draft.analyzedSha1 = uploaded.fileSha1;
   draft.inputAttrs = retainedAttrs;
   draft.orphanedInputAttrs = [
-    ...draft.orphanedInputAttrs ?? [],
-    ...newlyOrphaned.filter((item) => !(draft.orphanedInputAttrs ?? []).some((old) => old.key === item.key))
+    ...unresolvedOrphans,
+    ...newlyOrphaned.filter((item) => !unresolvedOrphans.some((old) => old.key === item.key))
   ];
   const nextDraft = prepareDraft(input2.cwd, input2.identity.n, draft);
   const changes = [{
@@ -26959,10 +27975,11 @@ async function uploadAndAnalyzeLocked(input2) {
   const recordedFile = normalizeProjectPath(input2.cwd, input2.identity.filePath);
   const identity = recordedFile === input2.identity.filePath ? input2.identity : { ...input2.identity, filePath: recordedFile };
   const localPath = confirmLocalPath(identity, file, input2.yes, input2.cwd);
-  const uploadPath = await prepareUploadPath(identity.typeCode, localPath);
+  const uploadPath = await prepareUploadPath(identity.typeCode, localPath, input2.cwd);
   try {
-    const uploaded = { fileSha1: sha1OfFile(uploadPath), filename: path15.basename(uploadPath) };
-    await uploadIfNew(uploadPath, uploaded.fileSha1, identity.typeCode, input2.apis ?? {});
+    const hashed = await sha1OfFile(uploadPath);
+    const uploaded = { fileSha1: hashed.sha1, filename: path16.basename(uploadPath) };
+    await uploadIfNew(uploadPath, uploaded.fileSha1, hashed.fingerprint, identity.typeCode, input2.apis ?? {});
     const analysis = await waitAnalyze(
       uploaded.fileSha1,
       identity.typeCode,
@@ -26970,6 +27987,7 @@ async function uploadAndAnalyzeLocked(input2) {
       input2.now,
       input2.sleep
     );
+    assertFileUnchanged(uploadPath, hashed.fingerprint);
     writeSha1ToDraft(
       {
         ...input2,
@@ -27004,7 +28022,7 @@ async function runCreateVersion(input2) {
 }
 async function runCreateVersionLocked(input2) {
   assertPlatformAllowed();
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
   const identity = resolveBoundIdentity(input2.cwd, input2.file);
   const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
   const info2 = unwrapData2(
@@ -27021,8 +28039,10 @@ async function runCreateVersionLocked(input2) {
     throw new CliError("\u63D0\u4EA4\u8BF7\u52A0 --yes", "CREATE_VERSION_NEED_YES");
   }
   if (input2.reset) {
-    confirmLocalPath(identity, artifact, input2.yes, input2.cwd);
+    const localPath = confirmLocalPath(identity, artifact, input2.yes, input2.cwd);
+    assertUploadArtifactReady(identity.typeCode, localPath, input2.cwd);
   }
+  assertRemoteResourceWritable({ info: info2, resourceId: identity.resourceId, authUserId: auth.userId });
   let draft = existingDraft;
   if (input2.reset && existingDraft) {
     if (!input2.confirmReset) {
@@ -27060,6 +28080,7 @@ async function runCreateVersionLocked(input2) {
       isLoadLatestVersionInfo: 1
     })
   );
+  assertRemoteResourceWritable({ info: again, resourceId: identity.resourceId, authUserId: auth.userId });
   if (again.latestVersion) {
     throw new CliError(
       `\u8FD9\u4E2A\u8D44\u6E90\u5DF2\u7ECF\u6709\u53D1\u884C\u7248\u672C\u3002\u7EBF\u4E0A latest \u662F ${again.latestVersion}\uFF0C\u8BF7\u7528 update-version\u3002`,
@@ -27070,6 +28091,7 @@ async function runCreateVersionLocked(input2) {
     cwd: input2.cwd,
     identity,
     version: "1.0.0",
+    homeDir: input2.homeDir,
     apis: input2.apis
   });
   return "1.0.0";
@@ -27120,6 +28142,26 @@ import { Command as Command21 } from "commander";
 
 // src/domain/version/form/dep.ts
 import semver from "semver";
+async function assertCurrentResourceWritable(input2) {
+  const auth = requireAuth({ cwd: input2.cwd });
+  const resourceId = input2.identity.resourceId;
+  if (!resourceId) {
+    throw new CliError("\u8BF7\u5148 create \u6216 bind", "DEP_NEED_SHELL");
+  }
+  const infoApi2 = input2.apis?.ownInfo ?? ((params) => service_API_default.Resource.info(params));
+  const info2 = unwrapData3(await infoApi2({ resourceIdOrName: resourceId }));
+  assertRemoteResourceWritable({
+    info: info2,
+    resourceId,
+    authUserId: auth.userId,
+    codes: {
+      invalid: "DEP_CURRENT_INFO_INVALID",
+      notOwner: "DEP_CURRENT_NOT_OWNER",
+      frozen: "DEP_CURRENT_RESOURCE_FROZEN"
+    }
+  });
+  return resourceId;
+}
 function unwrapData3(result) {
   const envelope = result;
   const data = envelope.data ?? result;
@@ -27157,6 +28199,64 @@ function statusLabel(status) {
   }
   return void 0;
 }
+async function loadDependencyTarget(input2) {
+  const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
+  const info2 = unwrapData3(
+    await infoApi2({
+      resourceIdOrName: input2.resourceIdOrName,
+      isLoadLatestVersionInfo: 1,
+      isLoadPolicyInfo: 1
+    })
+  );
+  const resourceId = typeof info2.resourceId === "string" ? info2.resourceId.trim() : "";
+  if (!resourceId || input2.expectedResourceId && resourceId !== input2.expectedResourceId) {
+    throw new CliError("\u5BF9\u65B9\u8D44\u6E90\u4FE1\u606F\u4E0D\u5B8C\u6574\u6216\u4E0E\u8981\u4FEE\u6539\u7684\u4F9D\u8D56\u4E0D\u4E00\u81F4", "DEP_TARGET_INVALID");
+  }
+  const resourceName = typeof info2.resourceName === "string" ? info2.resourceName : typeof info2.name === "string" ? info2.name : "";
+  if (input2.identity.resourceId === resourceId || input2.identity.name && resourceName === input2.identity.name) {
+    throw new CliError("\u4E0D\u80FD\u4F9D\u8D56\u81EA\u5DF1", "DEP_SELF");
+  }
+  if (Number(info2.subjectType) !== 1) {
+    throw new CliError("\u5BF9\u65B9\u4E0D\u662F\u666E\u901A\u5355\u8D44\u6E90\uFF0C\u4E0D\u52A0", "DEP_NOT_RESOURCE");
+  }
+  const latestVersion = typeof info2.latestVersion === "string" ? info2.latestVersion.trim() : "";
+  if (!latestVersion || !semver.valid(latestVersion)) {
+    throw new CliError("\u5BF9\u65B9\u8FD8\u6CA1\u6709\u53D1\u884C\u7248\u672C", "DEP_NO_VERSION");
+  }
+  if (info2.status === void 0 || !Number.isFinite(Number(info2.status))) {
+    throw new CliError("\u5BF9\u65B9\u8D44\u6E90\u4FE1\u606F\u4E0D\u5B8C\u6574\u6216\u72B6\u6001\u4E0D\u53EF\u7528", "DEP_TARGET_INVALID");
+  }
+  const blocked = statusLabel(Number(info2.status));
+  if (blocked) {
+    throw new CliError(blocked, "DEP_TARGET_STATUS");
+  }
+  if (Array.isArray(info2.baseUpcastResources) && info2.baseUpcastResources.length > 0) {
+    throw new CliError("\u5BF9\u65B9\u5B58\u5728\u57FA\u7840\u4E0A\u629B\uFF0C\u672C\u671F\u4E0D\u652F\u6301\u3002", "DEP_UPCAST");
+  }
+  return { info: info2, resourceId, latestVersion };
+}
+async function assertDependencyVersionRange(input2) {
+  const listApi = input2.apis?.getVersionListByResourceID ?? ((params) => service_API_default.Resource.getVersionListByResourceID(params));
+  const list2 = unwrapData3(await listApi({ resourceId: input2.resourceId }));
+  const rawVersions = list2.dataList ?? list2.list;
+  if (!Array.isArray(rawVersions) || rawVersions.length === 0) {
+    throw new CliError("\u5BF9\u65B9\u7248\u672C\u5217\u8868\u4E0D\u53EF\u7528\uFF0C\u4E0D\u80FD\u786E\u8BA4\u4F9D\u8D56\u8303\u56F4", "DEP_VERSION_LIST_INVALID");
+  }
+  const versions = [];
+  for (const item of rawVersions) {
+    const version = typeof item === "object" && item !== null && typeof item.version === "string" ? item.version : "";
+    if (!version || !semver.valid(version)) {
+      throw new CliError("\u5BF9\u65B9\u7248\u672C\u5217\u8868\u4E0D\u53EF\u7528\uFF0C\u4E0D\u80FD\u786E\u8BA4\u4F9D\u8D56\u8303\u56F4", "DEP_VERSION_LIST_INVALID");
+    }
+    versions.push(version);
+  }
+  if (!versions.some((version) => semver.eq(version, input2.latestVersion))) {
+    throw new CliError("\u5BF9\u65B9\u7248\u672C\u5217\u8868\u4E0D\u53EF\u7528\uFF0C\u4E0D\u80FD\u786E\u8BA4\u4F9D\u8D56\u8303\u56F4", "DEP_VERSION_LIST_INVALID");
+  }
+  if (!semver.validRange(input2.versionRange) || !semver.maxSatisfying(versions, input2.versionRange)) {
+    throw new CliError("\u8FD9\u4E2A\u8303\u56F4\u5BF9\u4E0D\u4E0A\u5BF9\u65B9\u5DF2\u53D1\u884C\u7684\u7248\u672C", "DEP_RANGE");
+  }
+}
 function signablePolicies(info2) {
   const policies2 = info2.policies ?? [];
   return policies2.filter((item) => item.status === 1 && item.policyId).map((item) => ({ policyId: item.policyId, policyName: item.policyName }));
@@ -27197,49 +28297,26 @@ async function depAdd(input2) {
 }
 async function depAddLocked(input2) {
   assertPlatformAllowed();
-  const identity = resolveIdentity(input2.cwd, input2.file);
+  const identity = resolveBoundIdentity(input2.cwd, input2.file);
   const draft = readDraft(input2.cwd, identity.n) ?? {
     baseUpcastResources: [],
     authExcludedItems: []
   };
-  const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
-  const info2 = unwrapData3(
-    await infoApi2({
-      resourceIdOrName: input2.resourceId,
-      isLoadLatestVersionInfo: 1,
-      isLoadPolicyInfo: 1
-    })
-  );
-  const targetId = String(info2.resourceId ?? input2.resourceId);
-  const targetName = String(info2.resourceName ?? info2.name ?? "");
-  if (identity.resourceId && (targetId === identity.resourceId || targetName === `${identity.name}`)) {
-    throw new CliError("\u4E0D\u80FD\u4F9D\u8D56\u81EA\u5DF1", "DEP_SELF");
-  }
-  if (info2.subjectType !== void 0 && Number(info2.subjectType) !== 1) {
-    throw new CliError("\u5BF9\u65B9\u4E0D\u662F\u666E\u901A\u5355\u8D44\u6E90\uFF0C\u4E0D\u52A0", "DEP_NOT_RESOURCE");
-  }
-  const latestVersion = info2.latestVersion ? String(info2.latestVersion) : void 0;
-  if (!latestVersion) {
-    throw new CliError("\u5BF9\u65B9\u8FD8\u6CA1\u6709\u53D1\u884C\u7248\u672C", "DEP_NO_VERSION");
-  }
-  const status = Number(info2.status ?? 1);
-  const blocked = statusLabel(status);
-  if (blocked) {
-    throw new CliError(blocked, "DEP_TARGET_STATUS");
-  }
-  const upcast = info2.baseUpcastResources;
-  if (Array.isArray(upcast) && upcast.length > 0) {
-    throw new CliError("\u5BF9\u65B9\u5B58\u5728\u57FA\u7840\u4E0A\u629B\uFF0C\u672C\u671F\u4E0D\u652F\u6301\u3002", "DEP_UPCAST");
-  }
-  let versionRange = input2.versionRange ?? `^${latestVersion}`;
-  const listApi = input2.apis?.getVersionListByResourceID ?? ((params) => service_API_default.Resource.getVersionListByResourceID(params));
-  const list2 = unwrapData3(await listApi({ resourceId: targetId }));
-  const versions = (list2.dataList ?? list2.list ?? []).map((item) => item.version).filter((item) => Boolean(item));
-  if (versions.length > 0) {
-    if (!semver.validRange(versionRange) || !semver.maxSatisfying(versions, versionRange)) {
-      throw new CliError("\u8FD9\u4E2A\u8303\u56F4\u5BF9\u4E0D\u4E0A\u5BF9\u65B9\u5DF2\u53D1\u884C\u7684\u7248\u672C", "DEP_RANGE");
-    }
-  }
+  const licenseeId = await assertCurrentResourceWritable({ cwd: input2.cwd, identity, apis: input2.apis });
+  const target = await loadDependencyTarget({
+    resourceIdOrName: input2.resourceId,
+    identity,
+    apis: input2.apis
+  });
+  const targetId = target.resourceId;
+  const info2 = target.info;
+  const versionRange = input2.versionRange ?? `^${target.latestVersion}`;
+  await assertDependencyVersionRange({
+    resourceId: targetId,
+    latestVersion: target.latestVersion,
+    versionRange,
+    apis: input2.apis
+  });
   if (identity.resourceId) {
     const cycleApi = input2.apis?.cycleDependencyCheck ?? ((params) => service_API_default.Resource.cycleDependencyCheck(params));
     const existing2 = (draft.dependencies ?? []).filter((item) => item.resourceId !== targetId).map((item) => ({ resourceId: String(item.resourceId), versionRange: String(item.versionRange ?? "*") }));
@@ -27262,16 +28339,13 @@ async function depAddLocked(input2) {
   );
   if (!extractIsAuth(firstAuth, targetId)) {
     const policies2 = signablePolicies(info2);
-    if (!identity.resourceId) {
-      throw new CliError("\u8BF7\u5148 create \u6216 bind", "DEP_NEED_SHELL");
-    }
     const sign = input2.apis?.sign ?? ((params) => service_API_default.Contract.batchCreateContracts(params));
     await signWithSelectedPolicy({
       policies: policies2,
       policyId: input2.policyId,
       yes: input2.yes,
       targetId,
-      licenseeId: identity.resourceId,
+      licenseeId,
       sign
     });
   }
@@ -27317,7 +28391,8 @@ async function depRange(cwd, resourceId, versionRange, file, apis, options) {
   return withProjectLock(cwd, () => depRangeLocked(cwd, resourceId, versionRange, file, apis, options), "version-dep-range");
 }
 async function depRangeLocked(cwd, resourceId, versionRange, file, apis, options) {
-  const identity = resolveIdentity(cwd, file);
+  assertPlatformAllowed();
+  const identity = resolveBoundIdentity(cwd, file);
   const draft = readDraft(cwd, identity.n);
   if (!draft) {
     throw new CliError("\u6CA1\u6709\u5DE5\u4F5C\u7A3F\uFF0C\u8BF7\u5148 version draft pull", "DRAFT_MISSING");
@@ -27326,39 +28401,27 @@ async function depRangeLocked(cwd, resourceId, versionRange, file, apis, options
   if (!found) {
     throw new CliError(`\u7A3F\u4E0A\u6CA1\u6709\u4F9D\u8D56 ${resourceId}`, "DEP_NOT_FOUND");
   }
-  const infoApi2 = apis?.info ?? ((params) => service_API_default.Resource.info(params));
-  const info2 = unwrapData3(
-    await infoApi2({
-      resourceIdOrName: resourceId,
-      isLoadLatestVersionInfo: 1,
-      isLoadPolicyInfo: 1
-    })
-  );
-  const latestVersion = info2.latestVersion ? String(info2.latestVersion) : void 0;
-  const status = Number(info2.status ?? 1);
-  const blocked = statusLabel(status);
-  if (blocked) {
-    throw new CliError(blocked, "DEP_TARGET_STATUS");
-  }
-  const upcast = info2.baseUpcastResources;
-  if (Array.isArray(upcast) && upcast.length > 0) {
-    throw new CliError("\u5BF9\u65B9\u5B58\u5728\u57FA\u7840\u4E0A\u629B\uFF0C\u672C\u671F\u4E0D\u652F\u6301\u3002", "DEP_UPCAST");
-  }
-  const listApi = apis?.getVersionListByResourceID ?? ((params) => service_API_default.Resource.getVersionListByResourceID(params));
-  const list2 = unwrapData3(await listApi({ resourceId }));
-  const versions = (list2.dataList ?? list2.list ?? []).map((item) => item.version).filter((item) => Boolean(item));
-  if (versions.length > 0 && latestVersion) {
-    if (!semver.validRange(versionRange) || !semver.maxSatisfying(versions, versionRange)) {
-      throw new CliError("\u8FD9\u4E2A\u8303\u56F4\u5BF9\u4E0D\u4E0A\u5BF9\u65B9\u5DF2\u53D1\u884C\u7684\u7248\u672C", "DEP_RANGE");
-    }
-  }
+  const licenseeId = await assertCurrentResourceWritable({ cwd, identity, apis });
+  const target = await loadDependencyTarget({
+    resourceIdOrName: resourceId,
+    expectedResourceId: resourceId,
+    identity,
+    apis
+  });
+  await assertDependencyVersionRange({
+    resourceId: target.resourceId,
+    latestVersion: target.latestVersion,
+    versionRange,
+    apis
+  });
+  const info2 = target.info;
   if (identity.resourceId) {
     const cycleApi = apis?.cycleDependencyCheck ?? ((params) => service_API_default.Resource.cycleDependencyCheck(params));
     const existing = (draft.dependencies ?? []).filter((item) => item.resourceId !== resourceId).map((item) => ({ resourceId: String(item.resourceId), versionRange: String(item.versionRange ?? "*") }));
     const cycle = unwrapData3(
       await cycleApi({
         resourceId: identity.resourceId,
-        dependencies: [...existing, { resourceId, versionRange }]
+        dependencies: [...existing, { resourceId: target.resourceId, versionRange }]
       })
     );
     if (cycle.ok === false || cycle.data === false) {
@@ -27366,22 +28429,22 @@ async function depRangeLocked(cwd, resourceId, versionRange, file, apis, options
     }
   }
   const batchAuth3 = apis?.batchAuth ?? ((params) => service_API_default.Resource.batchAuth(params));
-  const firstAuth = unwrapData3(await batchAuth3({ resourceIds: resourceId, versionRanges: versionRange }));
-  if (!extractIsAuth(firstAuth, resourceId) && identity.resourceId) {
+  const firstAuth = unwrapData3(await batchAuth3({ resourceIds: target.resourceId, versionRanges: versionRange }));
+  if (!extractIsAuth(firstAuth, target.resourceId) && identity.resourceId) {
     const policies2 = signablePolicies(info2);
     const sign = apis?.sign ?? ((params) => service_API_default.Contract.batchCreateContracts(params));
     await signWithSelectedPolicy({
       policies: policies2,
       policyId: options?.policyId,
       yes: options?.yes,
-      targetId: resourceId,
-      licenseeId: identity.resourceId,
+      targetId: target.resourceId,
+      licenseeId,
       sign
     });
   }
   found.versionRange = versionRange;
   writeDraft(cwd, identity.n, draft);
-  return `${resourceId}@${versionRange}`;
+  return `${target.resourceId}@${versionRange}`;
 }
 
 // src/commands/version/dep.ts
@@ -27424,7 +28487,7 @@ import { Command as Command22 } from "commander";
 // src/domain/version/description.ts
 async function updateOnlineDescription(input2) {
   assertPlatformAllowed();
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
   const identity = resolveBoundIdentity(input2.cwd, input2.file);
   const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
   const info2 = unwrapData2(
@@ -27433,6 +28496,7 @@ async function updateOnlineDescription(input2) {
       isLoadLatestVersionInfo: 1
     })
   );
+  assertRemoteResourceWritable({ info: info2, resourceId: identity.resourceId, authUserId: auth.userId });
   if (!info2.latestVersion) {
     throw new CliError(
       "\u8FD8\u6CA1\u6709\u53D1\u884C\u7248\u672C\u3002\u8BF7\u5148\u6309\u53D1\u884C\u7248\u672C create-version \u63D0\u4EA4\u8D44\u6E90\u6587\u4EF6\u3002",
@@ -27655,210 +28719,6 @@ function createVersionDraftCommand() {
 
 // src/commands/version/option.ts
 import { Command as Command24 } from "commander";
-
-// src/domain/version/form/option.ts
-var MAX_OPTION = 30;
-var MAX_OPTION_ITEM = 30;
-var MAX_TEXT_DEFAULT = 140;
-var MAX_NAME2 = 50;
-var MAX_REMARK2 = 50;
-function assertValidName2(name) {
-  if (name.length > MAX_NAME2) {
-    throw new CliError("\u540D\u79F0\u4E0D\u80FD\u8D85\u8FC750\u4E2A\u5B57\u7B26", "OPTION_NAME_LONG");
-  }
-}
-function assertValidRemark2(remark) {
-  if (remark.length > MAX_REMARK2) {
-    throw new CliError("\u4E0D\u80FD\u8D85\u8FC750\u4E2A\u5B57\u7B26\u3002", "OPTION_REMARK_LONG");
-  }
-}
-function assertOptionValueLength(value) {
-  if (value.length > MAX_TEXT_DEFAULT) {
-    throw new CliError("\u4E0D\u8D85\u8FC7140\u4E2A\u5B57\u7B26", "OPTION_VALUE_LONG");
-  }
-}
-function isOption(item) {
-  return item.type === "editableText" || item.type === "select";
-}
-async function assertTypeAllowsOption(input2) {
-  if (input2.supportOptionalConfig === true) return;
-  if (input2.supportOptionalConfig === false) {
-    throw new CliError("\u5F53\u524D\u7C7B\u578B\u4E0D\u652F\u6301\u53EF\u9009\u914D\u7F6E", "OPTION_UNSUPPORTED");
-  }
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
-  const type = await getTypeInfo(input2.typeCode, input2.apis);
-  if (type.supportOptionalConfig !== 2) {
-    throw new CliError("\u5F53\u524D\u7C7B\u578B\u4E0D\u652F\u6301\u53EF\u9009\u914D\u7F6E", "OPTION_UNSUPPORTED");
-  }
-}
-function optionListFromDraft(draft) {
-  return (draft.customPropertyDescriptors ?? []).filter((item) => isOption(item));
-}
-function normalizeMode(mode) {
-  if (mode === void 0) return void 0;
-  if (mode === "\u4E0B\u62C9" || mode === "\u4E0B\u62C9\u5217\u8868" || mode === "select") return "select";
-  if (mode === "\u6587\u672C" || mode === "\u6587\u672C\u8F93\u5165\u6846" || mode === "input") return "editableText";
-  throw new CliError("\u65B9\u5F0F\u53EA\u80FD\u662F\u6587\u672C\u6216\u4E0B\u62C9", "OPTION_MODE");
-}
-function parseCandidates(raw) {
-  const items = (raw ?? "").split("|").map((item) => item.trim()).filter(Boolean);
-  if (items.length === 0) throw new CliError("\u4E0B\u62C9\u81F3\u5C11\u9700\u8981 1 \u4E2A\u9009\u9879", "OPTION_OPTIONS");
-  if (items.length > MAX_OPTION_ITEM) throw new CliError("\u9009\u9879\u4E2A\u6570\u4E0D\u80FD\u8D85\u8FC730\u9879", "OPTION_OPTIONS");
-  for (const item of items) assertOptionValueLength(item);
-  if (items.some((item, index) => items.indexOf(item) !== index)) {
-    throw new CliError("\u8BE5\u9009\u9879\u5DF2\u5B58\u5728", "OPTION_DUPLICATE_OPTION");
-  }
-  return items;
-}
-async function optionAdd(cwd, input2) {
-  return withProjectLock(cwd, () => optionAddLocked(cwd, input2), "version-option-add");
-}
-async function optionAddLocked(cwd, input2) {
-  const identity = resolveIdentity(cwd, input2.file);
-  await assertTypeAllowsOption({ cwd, typeCode: identity.typeCode, ...input2 });
-  const draft = readDraft(cwd, identity.n) ?? {
-    baseUpcastResources: [],
-    authExcludedItems: []
-  };
-  const parsed = parseLine(input2.line ?? "");
-  if (!parsed.name || !parsed.key) {
-    throw new CliError("\u53EF\u9009\u914D\u7F6E\u9700\u8981\u540D\u79F0\u548C\u952E", "OPTION_FIELDS");
-  }
-  assertValidKey(parsed.key);
-  const list2 = draft.customPropertyDescriptors ?? [];
-  if (optionListFromDraft(draft).length >= MAX_OPTION) {
-    throw new CliError("\u6700\u591A\u53EF\u6DFB\u52A030\u4E2A\u53EF\u9009\u914D\u7F6E", "OPTION_FULL");
-  }
-  if (list2.some((item) => item.key === parsed.key)) {
-    throw new CliError(`\u952E ${parsed.key} \u5DF2\u5B58\u5728`, "OPTION_DUPLICATE");
-  }
-  if (list2.some((item) => item.name === parsed.name)) {
-    throw new CliError("\u540D\u79F0\u5DF2\u5B58\u5728", "OPTION_NAME_DUPLICATE");
-  }
-  const normalizedMode = normalizeMode(parsed.mode);
-  if (!normalizedMode) {
-    throw new CliError("\u65B9\u5F0F\u53EA\u80FD\u662F\u6587\u672C\u6216\u4E0B\u62C9", "OPTION_MODE");
-  }
-  const isSelect = normalizedMode === "select";
-  const isText = normalizedMode === "editableText";
-  if (isSelect && parsed.defaultValue) {
-    throw new CliError("\u4E0B\u62C9\u9ED8\u8BA4\u503C\u56FA\u5B9A\u4E3A\u7B2C\u4E00\u9879\uFF0C\u8BF7\u628A\u8981\u9ED8\u8BA4\u7684\u9009\u9879\u653E\u5728\u7B2C\u4E00\u4F4D", "OPTION_SELECT_DEFAULT");
-  }
-  if (isText && parsed.options) {
-    throw new CliError("\u6587\u672C\u65B9\u5F0F\u4E0D\u8981\u5199\u9009\u9879", "OPTION_TEXT_OPTIONS");
-  }
-  if (!isSelect && !isText) {
-    throw new CliError("\u65B9\u5F0F\u53EA\u80FD\u662F\u6587\u672C\u6216\u4E0B\u62C9", "OPTION_MODE");
-  }
-  let type = "editableText";
-  let defaultValue = parsed.defaultValue ?? parsed.value ?? "";
-  let candidateItems;
-  assertValidName2(parsed.name);
-  assertValidRemark2(parsed.remark ?? "");
-  if (isSelect) {
-    const options = parseCandidates(parsed.options);
-    type = "select";
-    defaultValue = options[0] ?? "";
-    candidateItems = options;
-  } else {
-    assertOptionValueLength(defaultValue);
-  }
-  const preview = await confirmWrite(previewLine(parsed), input2.yes);
-  list2.push({
-    name: parsed.name,
-    key: parsed.key,
-    remark: parsed.remark ?? "",
-    defaultValue,
-    type,
-    ...candidateItems ? { candidateItems } : {}
-  });
-  draft.customPropertyDescriptors = list2;
-  writeDraft(cwd, identity.n, draft);
-  return preview;
-}
-async function optionSet(cwd, input2) {
-  return withProjectLock(cwd, () => optionSetLocked(cwd, input2), "version-option-set");
-}
-async function optionSetLocked(cwd, input2) {
-  const identity = resolveIdentity(cwd, input2.file);
-  const draft = readDraft(cwd, identity.n);
-  if (!draft) {
-    throw new CliError("\u6CA1\u6709\u5DE5\u4F5C\u7A3F\uFF0C\u8BF7\u5148 version draft pull", "DRAFT_MISSING");
-  }
-  const parsed = parseLine(input2.line ?? "");
-  const found = (draft.customPropertyDescriptors ?? []).find(
-    (item) => isOption(item) && (item.key === parsed.key || item.name === parsed.name)
-  );
-  if (!found) {
-    throw new CliError("\u627E\u4E0D\u5230\u8FD9\u6761\u53EF\u9009\u914D\u7F6E", "OPTION_NOT_FOUND");
-  }
-  assertKeyUnchanged(String(found.key), parsed.key);
-  assertValidName2(parsed.name ?? String(found.name ?? ""));
-  assertValidRemark2(parsed.remark ?? String(found.remark ?? ""));
-  const nextType = normalizeMode(parsed.mode) ?? (String(found.type) === "select" ? "select" : "editableText");
-  const nextDefault = parsed.defaultValue ?? parsed.value;
-  if (nextType === "select" && nextDefault !== void 0) {
-    throw new CliError("\u4E0B\u62C9\u9ED8\u8BA4\u503C\u56FA\u5B9A\u4E3A\u7B2C\u4E00\u9879\uFF0C\u8BF7\u628A\u8981\u9ED8\u8BA4\u7684\u9009\u9879\u653E\u5728\u7B2C\u4E00\u4F4D", "OPTION_SELECT_DEFAULT");
-  }
-  if (nextType === "editableText") {
-    if (parsed.options !== void 0) {
-      throw new CliError("\u6587\u672C\u65B9\u5F0F\u4E0D\u8981\u5199\u9009\u9879", "OPTION_TEXT_OPTIONS");
-    }
-    if (nextDefault !== void 0) assertOptionValueLength(nextDefault);
-  }
-  if (parsed.name && (draft.customPropertyDescriptors ?? []).some((item) => item.name === parsed.name && item.key !== found.key)) {
-    throw new CliError("\u540D\u79F0\u5DF2\u5B58\u5728", "OPTION_NAME_DUPLICATE");
-  }
-  if (parsed.name) {
-    found.name = parsed.name;
-  }
-  if (parsed.remark !== void 0) {
-    found.remark = parsed.remark;
-  }
-  if (nextType === "select") {
-    const candidates = parsed.options !== void 0 ? parseCandidates(parsed.options) : Array.isArray(found.candidateItems) ? found.candidateItems.map(String) : [];
-    if (candidates.length === 0) {
-      throw new CliError("\u4E0B\u62C9\u81F3\u5C11\u9700\u8981 1 \u4E2A\u9009\u9879", "OPTION_OPTIONS");
-    }
-    found.type = "select";
-    found.candidateItems = candidates;
-    found.defaultValue = candidates[0];
-  } else {
-    found.type = "editableText";
-    delete found.candidateItems;
-    if (nextDefault !== void 0) {
-      found.defaultValue = nextDefault;
-    }
-  }
-  const preview = await confirmWrite(previewLine(parsed), input2.yes);
-  writeDraft(cwd, identity.n, draft);
-  return preview;
-}
-function optionRm(cwd, key, file) {
-  return withProjectLock(cwd, () => optionRmLocked(cwd, key, file), "version-option-rm");
-}
-function optionRmLocked(cwd, key, file) {
-  const identity = resolveIdentity(cwd, file);
-  const draft = readDraft(cwd, identity.n);
-  if (!draft) {
-    throw new CliError("\u6CA1\u6709\u5DE5\u4F5C\u7A3F\uFF0C\u8BF7\u5148 version draft pull", "DRAFT_MISSING");
-  }
-  const list2 = draft.customPropertyDescriptors ?? [];
-  const next = list2.filter((item) => !(isOption(item) && item.key === key));
-  if (next.length === list2.length) {
-    throw new CliError("\u627E\u4E0D\u5230\u8FD9\u6761\u53EF\u9009\u914D\u7F6E", "OPTION_NOT_FOUND");
-  }
-  draft.customPropertyDescriptors = next;
-  writeDraft(cwd, identity.n, draft);
-  return key;
-}
-function optionList(cwd, file) {
-  const identity = resolveIdentity(cwd, file);
-  const draft = readDraft(cwd, identity.n);
-  return optionListFromDraft(draft ?? {}).map((item) => `${item.key}=${item.defaultValue ?? ""} ${item.name ?? ""}`).join("\n");
-}
-
-// src/commands/version/option.ts
 function createVersionOptionCommand() {
   const option = addSharedOptions(new Command24("option"));
   option.description("\u6539\u7A3F\u4E0A\u7684\u53EF\u9009\u914D\u7F6E");
@@ -27893,7 +28753,16 @@ function createVersionOptionCommand() {
 import { Command as Command25 } from "commander";
 
 // src/domain/version/setPath.ts
-import path16 from "path";
+import { existsSync as existsSync16, statSync as statSync4 } from "fs";
+import path17 from "path";
+function sameOrNestedPath(parent, candidate) {
+  const relative = path17.relative(parent, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path17.sep}`) && !path17.isAbsolute(relative);
+}
+function artifactsOverlap(first, second) {
+  if (first.path === second.path) return true;
+  return (first.isDirectory || second.isDirectory) && (sameOrNestedPath(first.path, second.path) || sameOrNestedPath(second.path, first.path));
+}
 function setIdentityFilePath(cwd, input2) {
   return withProjectLock(cwd, () => {
     const artifact = input2.artifact !== void 0 ? normalizeProjectPath(cwd, input2.artifact) : void 0;
@@ -27901,7 +28770,24 @@ function setIdentityFilePath(cwd, input2) {
       throw new CliError("\u8BF7\u63D0\u4F9B --artifact", "SET_ARTIFACT_REQUIRED");
     }
     const identity = resolveIdentity(cwd, input2.file);
-    assertArtifactAnchor(identity.typeCode, path16.resolve(cwd, artifact));
+    const absoluteArtifact = path17.resolve(cwd, artifact);
+    assertArtifactAnchor(identity.typeCode, absoluteArtifact, cwd);
+    const nextArtifact = {
+      path: resolveExistingProjectPath(cwd, absoluteArtifact),
+      isDirectory: statSync4(absoluteArtifact).isDirectory()
+    };
+    const occupant = validateLocalState(cwd).find((candidate) => {
+      if (candidate.n === identity.n) return false;
+      const candidatePath = path17.resolve(cwd, normalizeProjectPath(cwd, candidate.filePath));
+      if (!existsSync16(candidatePath)) return false;
+      return artifactsOverlap(nextArtifact, {
+        path: resolveExistingProjectPath(cwd, candidatePath),
+        isDirectory: statSync4(candidatePath).isDirectory()
+      });
+    });
+    if (occupant) {
+      throw new CliError(`\u4EA7\u7269\u8DEF\u5F84 ${artifact} \u5DF2\u88AB ${occupant.n}.json \u5360\u7528`, "SET_ARTIFACT_OCCUPIED");
+    }
     const updated = prepareIdentityUpdate(cwd, identity.n, { filePath: artifact });
     commitLocalTransaction(cwd, [
       { path: identityFilePath(cwd, updated.n), content: serializeIdentity(updated) }
@@ -27950,10 +28836,11 @@ function showLocal(cwd, file) {
 async function showOnline(input2) {
   assertPlatformAllowed();
   requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
-  const identity = resolveIdentity(input2.cwd, input2.file);
-  if (!identity.resourceId) {
+  const local = resolveIdentity(input2.cwd, input2.file);
+  if (!local.resourceId) {
     return "\u672C\u5730\u8FD8\u6CA1\u6709 resourceId";
   }
+  const identity = resolveBoundIdentity(input2.cwd, input2.file);
   const draft = readDraft(input2.cwd, identity.n);
   const hint = draft ? "\u672C\u5730\u6709\u672A\u63D0\u4EA4\u7684\u7248\u672C\u5DE5\u4F5C\u7A3F\uFF0C\u67E5\u770B\u8BF7 version show --local\n" : "";
   const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
@@ -28026,7 +28913,7 @@ async function runUpdateVersion(input2) {
 }
 async function runUpdateVersionLocked(input2) {
   assertPlatformAllowed();
-  requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
+  const auth = requireAuth({ cwd: input2.cwd, homeDir: input2.homeDir });
   const identity = resolveBoundIdentity(input2.cwd, input2.file);
   const infoApi2 = input2.apis?.info ?? ((params) => service_API_default.Resource.info(params));
   const info2 = unwrapData2(
@@ -28057,8 +28944,10 @@ async function runUpdateVersionLocked(input2) {
     throw new CliError("\u63D0\u4EA4\u8BF7\u52A0 --yes", "UPDATE_VERSION_NEED_YES");
   }
   if (input2.reset) {
-    confirmLocalPath(identity, artifact, input2.yes, input2.cwd);
+    const localPath = confirmLocalPath(identity, artifact, input2.yes, input2.cwd);
+    assertUploadArtifactReady(identity.typeCode, localPath, input2.cwd);
   }
+  assertRemoteResourceWritable({ info: info2, resourceId: identity.resourceId, authUserId: auth.userId });
   let draft = existingDraft;
   if (input2.reset && existingDraft) {
     if (!input2.confirmReset) {
@@ -28103,6 +28992,7 @@ async function runUpdateVersionLocked(input2) {
       isLoadLatestVersionInfo: 1
     })
   );
+  assertRemoteResourceWritable({ info: again, resourceId: identity.resourceId, authUserId: auth.userId });
   const currentLatest = String(again.latestVersion ?? latestVersion);
   if (!semver2.gt(next, currentLatest)) {
     throw new CliError(
@@ -28114,6 +29004,7 @@ async function runUpdateVersionLocked(input2) {
     cwd: input2.cwd,
     identity,
     version: next,
+    homeDir: input2.homeDir,
     apis: input2.apis
   });
   return next;
@@ -28235,26 +29126,26 @@ function createSubCommands() {
 }
 
 // src/core/usageDocs.ts
-import { existsSync as existsSync13 } from "fs";
-import path17 from "path";
+import { existsSync as existsSync17 } from "fs";
+import path18 from "path";
 import { fileURLToPath } from "url";
 function usageDocsPath() {
-  const moduleDir = path17.dirname(fileURLToPath(import.meta.url));
-  const bundledPath = path17.resolve(moduleDir, "../docs/README.md");
-  if (existsSync13(bundledPath)) {
+  const moduleDir = path18.dirname(fileURLToPath(import.meta.url));
+  const bundledPath = path18.resolve(moduleDir, "../docs/README.md");
+  if (existsSync17(bundledPath)) {
     return bundledPath;
   }
-  return path17.resolve(moduleDir, "../../../../docs/\u4E00\u671F/\u4EA7\u54C1\u65B9\u6848/\u4F7F\u7528/README.md");
+  return path18.resolve(moduleDir, "../../../../docs/\u4E00\u671F/\u4EA7\u54C1\u65B9\u6848/\u4F7F\u7528/README.md");
 }
 
 // src/core/packageVersion.ts
-import { readFileSync as readFileSync10 } from "fs";
-import path18 from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import path19 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function packageVersion() {
-  const moduleDir = path18.dirname(fileURLToPath2(import.meta.url));
-  const packageJson = path18.resolve(moduleDir, "../..", "package.json");
-  const value = JSON.parse(readFileSync10(packageJson, "utf8"));
+  const moduleDir = path19.dirname(fileURLToPath2(import.meta.url));
+  const packageJson = path19.resolve(moduleDir, "../..", "package.json");
+  const value = JSON.parse(readFileSync11(packageJson, "utf8"));
   return typeof value.version === "string" ? value.version : "unknown";
 }
 
@@ -28279,7 +29170,14 @@ function createProgram() {
     const cwdFlag = findOptionValue(actionCommand ?? thisCommand, "cwd");
     const cwd = resolveCwd(typeof cwdFlag === "string" ? cwdFlag : void 0);
     setAuthSearchCwd(cwd);
-    await chooseResourceWhenNeeded(actionCommand ?? thisCommand, cwd);
+    const command = actionCommand ?? thisCommand;
+    if (!isResourceFreeCommand(command)) {
+      withProjectLock(cwd, () => void 0, "preselect-resource");
+    }
+    if (!isPendingOperationReadAllowed(command)) {
+      withProjectLock(cwd, () => assertNoPendingOperation(cwd), "pending-operation-gate");
+    }
+    await chooseResourceWhenNeeded(command, cwd);
   });
   for (const command of Object.values(createSubCommands())) {
     program.addCommand(command);
@@ -28287,6 +29185,10 @@ function createProgram() {
   return program;
 }
 var RESOURCE_FREE_COMMANDS = /* @__PURE__ */ new Set(["login", "logout", "init", "template", "type", "resource", "create", "bind"]);
+var PENDING_OPERATION_READ_COMMANDS = /* @__PURE__ */ new Set(["login", "logout", "template", "type", "status", "show", "validate", "list", "recover"]);
+function isPendingOperationReadAllowed(command) {
+  return PENDING_OPERATION_READ_COMMANDS.has(command.name());
+}
 async function chooseResourceWhenNeeded(command, cwd) {
   if (isResourceFreeCommand(command)) return;
   const selector = findOptionValue(command, "resource");
@@ -28317,7 +29219,7 @@ function resourceChoiceLabel(cwd, identity) {
   return [
     `${identity.n}.json`,
     `\u6807\u9898=${identity.title ?? "\uFF08\u672A\u540C\u6B65\u6807\u9898\uFF09"}`,
-    `\u6807\u8BC6=${identity.name ?? "\u672A\u7ED1\u5B9A"}`,
+    `\u6807\u8BC6=${identity.resourceName ?? identity.name ?? "\u672A\u7ED1\u5B9A"}`,
     `ID=${identity.resourceId ?? "\u672A\u7ED1\u5B9A"}`,
     `\u7C7B\u578B=${identity.typeCode}`,
     `\u4EA7\u7269=${identity.filePath ?? "\u672A\u8BBE\u7F6E"}`,
@@ -28325,15 +29227,10 @@ function resourceChoiceLabel(cwd, identity) {
   ].join("  ");
 }
 function resourceSelectorExamples(identities) {
-  const titleCounts = /* @__PURE__ */ new Map();
-  for (const identity of identities) {
-    if (identity.title) titleCounts.set(identity.title, (titleCounts.get(identity.title) ?? 0) + 1);
-  }
   return identities.map((identity) => {
     const selectors = [
       ...identity.resourceId ? [`id:${identity.resourceId}`] : [],
-      ...identity.name ? [`name:${identity.name}`] : [],
-      ...identity.title && titleCounts.get(identity.title) === 1 ? [`title:${identity.title}`] : [],
+      ...identity.resourceName ? [`name:${identity.resourceName}`] : [],
       `artifact:${identity.filePath}`,
       `file:${identity.n}.json`
     ];