@pactor-app/module-pack 1.55.0 → 1.56.0

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/build.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, renameSync, rmSync as rmSync2 } from "fs";
-import { dirname as dirname3, join as join9, resolve as resolve4 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync2, renameSync, rmSync as rmSync2 } from "fs";
+import { dirname as dirname3, join as join10, resolve as resolve5 } from "path";
 
 // src/bundle-client.ts
 import { existsSync, mkdirSync, readFileSync } from "fs";
@@ -117,9 +117,60 @@ function parseJsonc(text) {
   return JSON.parse(out.replace(/,(\s*[}\]])/g, "$1"));
 }
 
+// src/bundle-server.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join2, resolve as resolve2, sep } from "path";
+import { buildSync as buildSync2 } from "esbuild";
+var SERVER_EXTERNALS = [
+  "react",
+  "react-dom",
+  "react-dom/*",
+  "next",
+  "next/*",
+  "pactor-app",
+  "pactor-app/*",
+  "@pactor-app/*"
+];
+var SERVER_BUNDLE_FILE = "index.mjs";
+var ServerBundleError = class extends Error {
+};
+function bundleServer(options) {
+  const projectRoot = resolve2(options.projectDir);
+  const entry = resolve2(projectRoot, options.serverEntry);
+  if (!entry.startsWith(`${projectRoot}${sep}`)) {
+    throw new ServerBundleError(
+      `server \u5165\u53E3\u5FC5\u987B\u4F4D\u4E8E\u5DE5\u7A0B\u6839\u5185: ${options.serverEntry}`
+    );
+  }
+  if (!existsSync2(entry)) {
+    throw new ServerBundleError(`server \u5165\u53E3\u4E0D\u5B58\u5728: ${options.serverEntry}`);
+  }
+  mkdirSync2(options.outDir, { recursive: true });
+  buildSync2({
+    entryPoints: [entry],
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node20",
+    outdir: options.outDir,
+    entryNames: "index",
+    outExtension: { ".js": ".mjs" },
+    sourcemap: true,
+    alias: tsconfigAliases(projectRoot),
+    external: [...SERVER_EXTERNALS],
+    logLevel: "silent"
+  });
+  if (!existsSync2(join2(options.outDir, SERVER_BUNDLE_FILE))) {
+    throw new ServerBundleError(
+      `server \u6253\u5305\u672A\u4EA7\u51FA ${SERVER_BUNDLE_FILE}\uFF08\u8BF7\u68C0\u67E5 serverEntry \u4E0E esbuild \u914D\u7F6E\uFF09`
+    );
+  }
+  return { bundled: true, entry: SERVER_BUNDLE_FILE };
+}
+
 // src/collect.ts
 import { readdirSync } from "fs";
-import { join as join2, relative } from "path";
+import { join as join3, relative } from "path";
 function collectModuleSource(yamlRoot) {
   const pages = /* @__PURE__ */ new Map();
   const layouts = [];
@@ -127,7 +178,7 @@ function collectModuleSource(yamlRoot) {
   const warnings = [];
   const walk = (dir) => {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const full = join2(dir, entry.name);
+      const full = join3(dir, entry.name);
       if (entry.isDirectory()) {
         walk(full);
         continue;
@@ -164,26 +215,26 @@ function collectModuleSource(yamlRoot) {
 import { execFileSync } from "child_process";
 import {
   appendFileSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
   mkdtempSync,
   readFileSync as readFileSync2,
   rmSync,
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 function compileTailwind(options) {
   const warnings = [];
   if (!options.tailwind.enabled) {
     return { compiled: false, warnings };
   }
-  const work = mkdtempSync(join3(tmpdir(), "pactor-tailwind-"));
+  const work = mkdtempSync(join4(tmpdir(), "pactor-tailwind-"));
   try {
     let input;
     if (options.tailwind.input !== void 0) {
-      input = join3(options.projectDir, options.tailwind.input);
-      if (!existsSync2(input)) {
+      input = join4(options.projectDir, options.tailwind.input);
+      if (!existsSync3(input)) {
         warnings.push(`tailwind.input \u4E0D\u5B58\u5728: ${options.tailwind.input}\uFF0C\u8DF3\u8FC7\u9884\u7F16\u8BD1`);
         return { compiled: false, warnings };
       }
@@ -191,21 +242,21 @@ function compileTailwind(options) {
       const scan = (options.tailwind.scan ?? options.scanDirs).map(
         (dir) => `@source "${dir.replace(/\\/g, "/")}";`
       );
-      input = join3(work, "input.css");
+      input = join4(work, "input.css");
       writeFileSync(input, `@import "tailwindcss";
 ${scan.join("\n")}
 `, "utf8");
     }
-    const out = join3(work, "tailwind.css");
+    const out = join4(work, "tailwind.css");
     execFileSync(
       "npx",
       ["--no-install", "tailwindcss", "--input", input, "--output", out],
       { cwd: options.projectDir, stdio: "pipe" }
     );
-    if (existsSync2(out)) {
+    if (existsSync3(out)) {
       const css = readFileSync2(out, "utf8");
       if (css.trim().length > 0) {
-        mkdirSync2(dirname2(options.cssFile), { recursive: true });
+        mkdirSync3(dirname2(options.cssFile), { recursive: true });
         appendFileSync(
           options.cssFile,
           `
@@ -228,8 +279,8 @@ ${css}`,
 }
 
 // src/config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join4, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { join as join5, resolve as resolve3 } from "path";
 
 // src/profiles/innospots-web-shell.ts
 var base = {
@@ -238,7 +289,8 @@ var base = {
   stripMenuPaths: true,
   rewriteNavigation: { basePath: true, excludeApiUrls: true },
   rewriteAssetUrls: (id, version) => `/modules/${id}/${version}/`,
-  forbidRootBasePath: true
+  forbidRootBasePath: true,
+  moduleServerApi: false
 };
 var innospotsWebShellV1 = {
   ...base,
@@ -250,15 +302,22 @@ var innospotsWebShellV2 = {
   version: 2,
   forceInlinePages: false
 };
+var innospotsWebShellV3 = {
+  ...base,
+  version: 3,
+  forceInlinePages: false,
+  moduleServerApi: true
+};
 
 // src/profiles/index.ts
 var ProfileError = class extends Error {
 };
 var registry = /* @__PURE__ */ new Map([
   [`${innospotsWebShellV1.name}@${innospotsWebShellV1.version}`, innospotsWebShellV1],
-  [`${innospotsWebShellV2.name}@${innospotsWebShellV2.version}`, innospotsWebShellV2]
+  [`${innospotsWebShellV2.name}@${innospotsWebShellV2.version}`, innospotsWebShellV2],
+  [`${innospotsWebShellV3.name}@${innospotsWebShellV3.version}`, innospotsWebShellV3]
 ]);
-var DEFAULT_TARGET = `${innospotsWebShellV2.name}@${innospotsWebShellV2.version}`;
+var DEFAULT_TARGET = `${innospotsWebShellV3.name}@${innospotsWebShellV3.version}`;
 function listProfiles() {
   return [...registry.keys()];
 }
@@ -282,8 +341,8 @@ var CONFIG_DEFAULTS = {
   outDir: "dist-module"
 };
 function loadModuleConfig(projectDir, configPath) {
-  const file = configPath ? resolve2(projectDir, configPath) : join4(projectDir, CONFIG_FILE);
-  if (!existsSync3(file)) {
+  const file = configPath ? resolve3(projectDir, configPath) : join5(projectDir, CONFIG_FILE);
+  if (!existsSync4(file)) {
     throw new ConfigError(`\u7F3A\u5C11\u914D\u7F6E\u6587\u4EF6: ${file}\uFF08\u53EF\u5148\u6267\u884C pactor module init \u751F\u6210\uFF09`);
   }
   let raw;
@@ -304,19 +363,32 @@ function loadModuleConfig(projectDir, configPath) {
   if (!basePath.startsWith("/")) basePath = `/${basePath}`;
   if (basePath.length > 1 && basePath.endsWith("/")) basePath = basePath.slice(0, -1);
   const actions = raw.actions === void 0 ? [] : readStringArray(raw.actions, "actions", file);
-  const demo = isRecord(raw.demo) ? raw.demo : {};
+  if (raw.demo !== void 0) {
+    throw new ConfigError(
+      `${file}: demo.public \u5DF2\u79FB\u9664\uFF0C\u8BF7\u6539\u7528 "access": { "default": "public" }\uFF08\u7F3A\u7701\u586B\u5145\u8BED\u4E49\uFF0C\u4E0D\u8986\u76D6\u663E\u5F0F permission\uFF09`
+    );
+  }
+  const access = isRecord(raw.access) ? raw.access : {};
+  const accessDefault = readString(access, "default", file, "access") ?? "authenticated";
+  if (accessDefault !== "public" && accessDefault !== "authenticated") {
+    throw new ConfigError(`${file}: access.default \u53EA\u652F\u6301 "public" | "authenticated"`);
+  }
   const tailwind = isRecord(raw.tailwind) ? raw.tailwind : {};
   const rewrite = isRecord(raw.rewrite) ? raw.rewrite : {};
+  const serverEntry = readString(raw, "serverEntry", file);
+  const apiPrefixes = raw.apiPrefixes === void 0 ? void 0 : readStringArray(raw.apiPrefixes, "apiPrefixes", file);
+  validateServerConfig({ id, serverEntry, apiPrefixes, file });
   return {
     id,
     name,
     basePath,
     yamlRoot: readString(raw, "yamlRoot", file) ?? CONFIG_DEFAULTS.yamlRoot,
     clientEntry: readString(raw, "clientEntry", file) ?? CONFIG_DEFAULTS.clientEntry,
+    ...serverEntry !== void 0 ? { serverEntry, apiPrefixes } : {},
     actions,
     publicDir: readString(raw, "publicDir", file) ?? CONFIG_DEFAULTS.publicDir,
     target: readString(raw, "target", file) ?? CONFIG_DEFAULTS.target,
-    demo: { public: readBoolean(demo, "public", file, "demo") ?? false },
+    access: { default: accessDefault },
     tailwind: {
       enabled: readBoolean(tailwind, "enabled", file, "tailwind") ?? false,
       input: readString(tailwind, "input", file, "tailwind"),
@@ -354,20 +426,67 @@ function readStringArray(value, label, file) {
   }
   return value;
 }
+var URL_SAFE_MODULE_ID_RE = /^[A-Za-z0-9._~-]+$/;
+var API_PREFIX_RE = /^\/api\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/;
+var RESERVED_API_PREFIXES = ["/api/modules", "/api/runtime"];
+function validateServerConfig(input) {
+  const { id, serverEntry, apiPrefixes, file } = input;
+  if (serverEntry === void 0 && apiPrefixes === void 0) return;
+  if (serverEntry === void 0 || apiPrefixes === void 0) {
+    throw new ConfigError(`${file}: serverEntry \u4E0E apiPrefixes \u5FC5\u987B\u540C\u65F6\u914D\u7F6E\uFF08\u7F3A\u4E00\u4E0D\u53EF\uFF09`);
+  }
+  if (apiPrefixes.length === 0) {
+    throw new ConfigError(`${file}: \u914D\u7F6E serverEntry \u65F6 apiPrefixes \u5FC5\u987B\u662F\u975E\u7A7A\u6570\u7EC4`);
+  }
+  if (!URL_SAFE_MODULE_ID_RE.test(id)) {
+    throw new ConfigError(
+      `${file}: \u542F\u7528 serverEntry \u65F6 id \u53EA\u80FD\u5305\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001. _ ~ -\uFF08\u5F53\u524D: ${JSON.stringify(id)}\uFF09`
+    );
+  }
+  for (const prefix of apiPrefixes) {
+    if (!API_PREFIX_RE.test(prefix)) {
+      throw new ConfigError(
+        `${file}: apiPrefixes \u542B\u975E\u6CD5\u524D\u7F00 ${JSON.stringify(prefix)}\uFF08\u8981\u6C42\u5F62\u5982 /api/risk-analysis\uFF0C\u4E0D\u80FD\u542B query / hash / \u5C3E\u659C\u6760 / \u901A\u914D / :param\uFF09`
+      );
+    }
+    const reserved = RESERVED_API_PREFIXES.find(
+      (item) => prefix === item || prefix.startsWith(`${item}/`)
+    );
+    if (reserved) {
+      throw new ConfigError(
+        `${file}: apiPrefixes \u4E0D\u80FD\u4F7F\u7528\u4FDD\u7559\u524D\u7F00 ${reserved}\uFF08Shell \u81EA\u5E26\u8DEF\u7531\uFF09: ${prefix}`
+      );
+    }
+  }
+  for (let i = 0; i < apiPrefixes.length; i += 1) {
+    for (let j = i + 1; j < apiPrefixes.length; j += 1) {
+      const a = apiPrefixes[i];
+      const b = apiPrefixes[j];
+      if (a === b) {
+        throw new ConfigError(`${file}: apiPrefixes \u5B58\u5728\u91CD\u590D\u524D\u7F00: ${a}`);
+      }
+      if (a.startsWith(`${b}/`) || b.startsWith(`${a}/`)) {
+        throw new ConfigError(
+          `${file}: apiPrefixes \u524D\u7F00\u4E92\u76F8\u5305\u542B\uFF08\u540C\u4E00\u6A21\u5757\u5185\u65E0\u6CD5\u786E\u5B9A\u5F52\u5C5E\uFF09: ${a} / ${b}`
+        );
+      }
+    }
+  }
+}
 
 // src/emit-manifest.ts
 import { createHash } from "crypto";
 import {
   cpSync,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
   readFileSync as readFileSync4,
   statSync,
   writeFileSync as writeFileSync2
 } from "fs";
 import { createRequire } from "module";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { stringify } from "yaml";
 function emitModule(input) {
   const dslResult = emitDsl(input);
@@ -376,22 +495,22 @@ function emitModule(input) {
 }
 function emitDsl(input) {
   const { config, projectDir, outDir, site, pages } = input;
-  const dslDir = join5(outDir, "dsl");
-  mkdirSync3(dslDir, { recursive: true });
-  writeFileSync2(join5(dslDir, "sitemap.yaml"), stringify(site, { lineWidth: 0 }), "utf8");
+  const dslDir = join6(outDir, "dsl");
+  mkdirSync4(dslDir, { recursive: true });
+  writeFileSync2(join6(dslDir, "sitemap.yaml"), stringify(site, { lineWidth: 0 }), "utf8");
   for (const [id, dsl] of pages) {
-    writeFileSync2(join5(dslDir, `${id}.yaml`), stringify(dsl, { lineWidth: 0 }), "utf8");
+    writeFileSync2(join6(dslDir, `${id}.yaml`), stringify(dsl, { lineWidth: 0 }), "utf8");
   }
-  const publicDir = join5(projectDir, config.publicDir);
-  const assetsDir = join5(outDir, "assets");
-  if (existsSync4(publicDir)) {
+  const publicDir = join6(projectDir, config.publicDir);
+  const assetsDir = join6(outDir, "assets");
+  if (existsSync5(publicDir)) {
     cpSync(publicDir, assetsDir, { recursive: true });
   } else {
-    mkdirSync3(assetsDir, { recursive: true });
+    mkdirSync4(assetsDir, { recursive: true });
   }
   const assets = hashAssets(assetsDir, assetsDir);
   writeFileSync2(
-    join5(outDir, "module-assets.json"),
+    join6(outDir, "module-assets.json"),
     `${JSON.stringify({ module: config.id, assets }, null, 2)}
 `,
     "utf8"
@@ -412,10 +531,12 @@ function writeManifest(input) {
     dslRoot: "dsl",
     assetsRoot: "assets",
     ...input.clientEntry ? { clientEntry: input.clientEntry } : {},
-    ...input.styles ? { styles: input.styles } : {}
+    ...input.styles ? { styles: input.styles } : {},
+    ...input.serverEntry ? { serverEntry: input.serverEntry } : {},
+    ...input.apiPrefixes && input.apiPrefixes.length > 0 ? { apiPrefixes: input.apiPrefixes } : {}
   };
   writeFileSync2(
-    join5(outDir, "manifest.json"),
+    join6(outDir, "manifest.json"),
     `${JSON.stringify(manifest, null, 2)}
 `,
     "utf8"
@@ -423,8 +544,8 @@ function writeManifest(input) {
   return manifest;
 }
 function readProjectVersion(projectDir) {
-  const pkgFile = join5(projectDir, "package.json");
-  if (!existsSync4(pkgFile)) return "0.0.0";
+  const pkgFile = join6(projectDir, "package.json");
+  if (!existsSync5(pkgFile)) return "0.0.0";
   try {
     const pkg = JSON.parse(readFileSync4(pkgFile, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : "0.0.0";
@@ -434,7 +555,7 @@ function readProjectVersion(projectDir) {
 }
 function resolvePactorVersionRange(projectDir, warnings) {
   try {
-    const require2 = createRequire(join5(projectDir, "package.json"));
+    const require2 = createRequire(join6(projectDir, "package.json"));
     for (const name of ["pactor-app/package.json", "@pactor-app/app/package.json"]) {
       try {
         const pkgFile = require2.resolve(name);
@@ -445,7 +566,7 @@ function resolvePactorVersionRange(projectDir, warnings) {
       } catch {
       }
     }
-    const pkg = JSON.parse(readFileSync4(join5(projectDir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(join6(projectDir, "package.json"), "utf8"));
     for (const section of ["dependencies", "peerDependencies", "devDependencies"]) {
       const range = pkg[section]?.["pactor-app"];
       if (typeof range === "string" && range.length > 0) {
@@ -459,11 +580,11 @@ function resolvePactorVersionRange(projectDir, warnings) {
 }
 function hashAssets(dir, root) {
   const entries = [];
-  if (!existsSync4(dir)) return entries;
+  if (!existsSync5(dir)) return entries;
   for (const entry of readdirSync2(dir, { withFileTypes: true }).sort(
     (a, b) => a.name.localeCompare(b.name)
   )) {
-    const full = join5(dir, entry.name);
+    const full = join6(dir, entry.name);
     if (entry.isDirectory()) {
       entries.push(...hashAssets(full, root));
       continue;
@@ -481,7 +602,7 @@ function hashAssets(dir, root) {
 
 // src/expand-include.ts
 import { readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { parseDocument } from "yaml";
 var INCLUDE_KEY = "$include";
 var IncludeError = class extends Error {
@@ -499,7 +620,7 @@ function loadYamlExpanded(yamlRoot, relPath, stack = []) {
   if (stack.includes(relPath)) {
     throw new IncludeError(`\u5FAA\u73AF\u5F15\u7528: ${[...stack, relPath].join(" -> ")}`);
   }
-  const value = parseYamlFile(join6(yamlRoot, relPath));
+  const value = parseYamlFile(join7(yamlRoot, relPath));
   return expandIncludes(value, { yamlRoot, current: relPath, stack: [...stack, relPath] });
 }
 function expandIncludes(value, ctx) {
@@ -526,8 +647,8 @@ function expandIncludes(value, ctx) {
 }
 
 // src/rewrite-urls.ts
-import { existsSync as existsSync5, statSync as statSync2 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, statSync as statSync2 } from "fs";
+import { join as join8 } from "path";
 var NAVIGATION_ACTIONS = /* @__PURE__ */ new Set(["navigate", "app.reload"]);
 var ABSOLUTE_API_RE = /^https?:\/\/[^/]+(\/api\/.+)$/;
 function rewriteDslUrls(value, ctx) {
@@ -582,11 +703,14 @@ function matchPathPattern(pattern, value) {
 function rewriteString(value, ctx, warnings) {
   const absoluteApi = ABSOLUTE_API_RE.exec(value);
   if (absoluteApi) {
-    warnings.push(
-      `\u7EDD\u5BF9 API \u5730\u5740: ${value}${ctx.absoluteApiToRelative ? "\uFF08\u5DF2\u91CD\u5199\u4E3A\u76F8\u5BF9\u8DEF\u5F84\uFF0C\u9700\u5E95\u5EA7 BFF/\u4EE3\u7406\u627F\u63A5\uFF09" : ""}`
-    );
-    return ctx.absoluteApiToRelative ? absoluteApi[1] : value;
+    const relative3 = absoluteApi[1];
+    const namespaced2 = ctx.absoluteApiToRelative ? namespaceModuleApi(relative3, ctx) : void 0;
+    const action = ctx.absoluteApiToRelative ? namespaced2 !== void 0 ? "\uFF08\u5DF2\u91CD\u5199\u4E3A\u6A21\u5757 API \u76F8\u5BF9\u8DEF\u5F84\uFF09" : "\uFF08\u5DF2\u91CD\u5199\u4E3A\u76F8\u5BF9\u8DEF\u5F84\uFF0C\u9700\u5E95\u5EA7 BFF/\u4EE3\u7406\u627F\u63A5\uFF09" : "\uFF08absoluteApiToRelative=false\uFF0C\u4FDD\u6301\u7EDD\u5BF9\u5730\u5740\uFF0C\u4E0D\u4F1A\u8D70\u6A21\u5757 API \u8DEF\u7531\uFF09";
+    warnings.push(`\u7EDD\u5BF9 API \u5730\u5740: ${value}${action}`);
+    return ctx.absoluteApiToRelative ? namespaced2 ?? relative3 : value;
   }
+  const namespaced = namespaceModuleApi(value, ctx);
+  if (namespaced !== void 0) return namespaced;
   if (!ctx.rewriteAssets) return value;
   if (!value.startsWith("/") || value.startsWith("//")) return value;
   if (value.startsWith("/api/")) return value;
@@ -598,10 +722,18 @@ function rewriteString(value, ctx, warnings) {
   if (!isPublicFile(ctx.publicDir, value)) return value;
   return `${ctx.assetPrefix}${value}`;
 }
+function namespaceModuleApi(value, ctx) {
+  const { moduleId, apiPrefixes } = ctx;
+  if (!moduleId || !apiPrefixes || apiPrefixes.length === 0) return void 0;
+  const pathOnly = value.split(/[?#]/, 1)[0];
+  const hit = [...apiPrefixes].sort((a, b) => b.length - a.length).some((prefix) => pathOnly === prefix || pathOnly.startsWith(`${prefix}/`));
+  if (!hit) return void 0;
+  return `/api/modules/${encodeURIComponent(moduleId)}${value.slice("/api".length)}`;
+}
 function isPublicFile(publicDir, urlPath) {
-  const file = join7(publicDir, urlPath);
+  const file = join8(publicDir, urlPath);
   try {
-    return existsSync5(file) && statSync2(file).isFile();
+    return existsSync6(file) && statSync2(file).isFile();
   } catch {
     return false;
   }
@@ -612,7 +744,8 @@ function isRecord2(value) {
 
 // src/transform-sitemap.ts
 function transformSitemap(site, options) {
-  const { profile, demoPublic, loadLayout } = options;
+  const { profile, accessDefault, loadLayout } = options;
+  const fillPublic = accessDefault === "public";
   const next = { ...site };
   const rawLayouts = isRecord3(site.layouts) ? site.layouts : {};
   const layouts = {};
@@ -626,7 +759,7 @@ function transformSitemap(site, options) {
     if (profile.forceInlinePages) {
       delete nextPage.lazy;
     }
-    if (demoPublic) {
+    if (fillPublic && isAccessUndeclared(nextPage)) {
       nextPage.public = true;
     }
     return nextPage;
@@ -637,7 +770,7 @@ function transformSitemap(site, options) {
     if (profile.stripMenuPaths) {
       delete nextMenu.path;
     }
-    if (demoPublic) {
+    if (fillPublic && isAccessUndeclared(nextMenu)) {
       nextMenu.public = true;
     }
     if (Array.isArray(nextMenu.children)) {
@@ -658,10 +791,13 @@ function transformSitemap(site, options) {
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function isAccessUndeclared(entry) {
+  return entry.public === void 0 && entry.permission === void 0;
+}
 
 // src/validate.ts
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
-import { join as join8, relative as relative2, resolve as resolve3 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+import { join as join9, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
 import { parseDocument as parseDocument2 } from "yaml";
 var REQUIRED_MANIFEST_FIELDS = [
   "schemaVersion",
@@ -675,7 +811,7 @@ var REQUIRED_MANIFEST_FIELDS = [
   "assetsRoot"
 ];
 function validateModule(options = {}) {
-  const projectDir = resolve3(options.dir ?? process.cwd());
+  const projectDir = resolve4(options.dir ?? process.cwd());
   const errors = [];
   const warnings = [];
   let config;
@@ -693,9 +829,9 @@ function validateModule(options = {}) {
       config = void 0;
     }
   }
-  const moduleDir = options.moduleDir ?? join8(projectDir, config?.outDir ?? CONFIG_DEFAULTS.outDir);
-  const manifestFile = join8(moduleDir, "manifest.json");
-  if (!existsSync6(manifestFile)) {
+  const moduleDir = options.moduleDir ?? join9(projectDir, config?.outDir ?? CONFIG_DEFAULTS.outDir);
+  const manifestFile = join9(moduleDir, "manifest.json");
+  if (!existsSync7(manifestFile)) {
     errors.push(`\u4EA7\u7269\u4E0D\u5B58\u5728: ${manifestFile}\uFF08\u5148\u6267\u884C pactor module build\uFF09`);
     return { ok: false, errors, warnings };
   }
@@ -716,8 +852,8 @@ function validateModule(options = {}) {
   }
   const dslRoot = typeof manifest.dslRoot === "string" ? manifest.dslRoot : "dsl";
   const sitemapRel = typeof manifest.sitemap === "string" ? manifest.sitemap : "dsl/sitemap.yaml";
-  const sitemapFile = join8(moduleDir, sitemapRel);
-  if (!existsSync6(sitemapFile)) {
+  const sitemapFile = join9(moduleDir, sitemapRel);
+  if (!existsSync7(sitemapFile)) {
     errors.push(`sitemap \u4E0D\u5B58\u5728: ${sitemapRel}`);
   } else {
     const doc = parseDocument2(readFileSync6(sitemapFile, "utf8"));
@@ -732,7 +868,7 @@ function validateModule(options = {}) {
           errors.push("sitemap.pages \u5B58\u5728\u7F3A\u5C11 id \u7684\u9875\u9762\u9879");
           continue;
         }
-        if (findPageDslFile(join8(moduleDir, dslRoot), id) === null) {
+        if (findPageDslFile(join9(moduleDir, dslRoot), id) === null) {
           errors.push(`\u9875\u9762 ${id} \u7F3A\u5C11 DSL \u6587\u4EF6\uFF08${dslRoot}/ \u4E0B\u672A\u627E\u5230 ${id}.yaml\uFF09`);
         }
       }
@@ -746,15 +882,15 @@ function validateModule(options = {}) {
       }
     }
   }
-  const dslDir = join8(moduleDir, dslRoot);
+  const dslDir = join9(moduleDir, dslRoot);
   for (const file of listFiles(dslDir)) {
     if (readFileSync6(file, "utf8").includes(INCLUDE_KEY)) {
       errors.push(`$include \u6B8B\u7559: ${relative2(moduleDir, file)}`);
     }
   }
   if (typeof manifest.clientEntry === "string") {
-    const clientFile = join8(moduleDir, manifest.clientEntry);
-    if (!existsSync6(clientFile)) {
+    const clientFile = join9(moduleDir, manifest.clientEntry);
+    if (!existsSync7(clientFile)) {
       errors.push(`client bundle \u4E0D\u5B58\u5728: ${manifest.clientEntry}`);
     } else {
       const text = readFileSync6(clientFile, "utf8");
@@ -770,8 +906,34 @@ function validateModule(options = {}) {
       }
     }
   }
-  const pkgFile = join8(projectDir, "package.json");
-  if (existsSync6(pkgFile)) {
+  const hasServerEntry = typeof manifest.serverEntry === "string";
+  const hasApiPrefixes = Array.isArray(manifest.apiPrefixes);
+  if (hasServerEntry !== hasApiPrefixes) {
+    errors.push("manifest.serverEntry \u4E0E apiPrefixes \u5FC5\u987B\u6210\u5BF9\u51FA\u73B0");
+  }
+  if (hasServerEntry) {
+    const serverRel = manifest.serverEntry;
+    const serverFile = resolve4(moduleDir, serverRel);
+    if (!isInsideDir(moduleDir, serverFile)) {
+      errors.push(`server bundle \u8DEF\u5F84\u8D8A\u754C: ${serverRel}`);
+    } else if (!existsSync7(serverFile)) {
+      errors.push(`server bundle \u4E0D\u5B58\u5728: ${serverRel}`);
+    } else {
+      const text = readFileSync6(serverFile, "utf8");
+      if (/node_modules\/(?:next|react|react-dom|@pactor-app|pactor-app)\//.test(text)) {
+        warnings.push(
+          "server bundle \u7591\u4F3C\u5185\u5D4C next / react / pactor\uFF08\u5E94\u4FDD\u6301 external\uFF0C\u7531\u5BBF\u4E3B\u63D0\u4F9B\uFF09"
+        );
+      }
+    }
+    if (!Array.isArray(manifest.apiPrefixes) || manifest.apiPrefixes.length === 0) {
+      errors.push("manifest.apiPrefixes \u5FC5\u987B\u662F\u975E\u7A7A\u6570\u7EC4");
+    } else if (manifest.apiPrefixes.some((prefix) => typeof prefix !== "string")) {
+      errors.push("manifest.apiPrefixes \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u6570\u7EC4");
+    }
+  }
+  const pkgFile = join9(projectDir, "package.json");
+  if (existsSync7(pkgFile)) {
     try {
       const pkg = JSON.parse(readFileSync6(pkgFile, "utf8"));
       const exportsMap = pkg.exports ?? {};
@@ -781,6 +943,9 @@ function validateModule(options = {}) {
       if (typeof manifest.clientEntry === "string" && exportsMap["./client"] === void 0) {
         errors.push('package.json exports \u7F3A\u5C11 "./client"\uFF08client-registry \u9759\u6001 import "<pkg>/client"\uFF09');
       }
+      if (typeof manifest.serverEntry === "string" && exportsMap["./server"] === void 0) {
+        errors.push('package.json exports \u7F3A\u5C11 "./server"\uFF08Shell \u88C5\u914D\u5668\u7ECF require.resolve("<pkg>/server") \u5B9A\u4F4D\uFF09');
+      }
       if (typeof pkg.version === "string" && typeof manifest.version === "string" && pkg.version !== manifest.version) {
         warnings.push(
           `manifest.version (${manifest.version}) \u4E0E package.json version (${pkg.version}) \u4E0D\u4E00\u81F4\uFF0C\u8BF7\u91CD\u65B0 build`
@@ -794,13 +959,17 @@ function validateModule(options = {}) {
   }
   return { ok: errors.length === 0, errors, warnings };
 }
+function isInsideDir(dir, file) {
+  const root = resolve4(dir);
+  return file.startsWith(`${root}${sep2}`);
+}
 function findPageDslFile(dslRootDir, pageId) {
-  if (!existsSync6(dslRootDir)) return null;
+  if (!existsSync7(dslRootDir)) return null;
   const queue = [dslRootDir];
   while (queue.length > 0) {
     const dir = queue.pop();
     for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-      const full = join8(dir, entry.name);
+      const full = join9(dir, entry.name);
       if (entry.isDirectory()) {
         queue.push(full);
         continue;
@@ -811,11 +980,11 @@ function findPageDslFile(dslRootDir, pageId) {
   return null;
 }
 function listFiles(dir) {
-  if (!existsSync6(dir)) return [];
+  if (!existsSync7(dir)) return [];
   const files = [];
   const walk = (target) => {
     for (const entry of readdirSync3(target, { withFileTypes: true })) {
-      const full = join8(target, entry.name);
+      const full = join9(target, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.isFile()) {
@@ -835,7 +1004,7 @@ var ModuleBuildError = class extends Error {
   }
 };
 function buildModule(options = {}) {
-  const projectDir = resolve4(options.dir ?? process.cwd());
+  const projectDir = resolve5(options.dir ?? process.cwd());
   const config = loadModuleConfig(projectDir, options.config);
   const profile = getProfile(config.target);
   if (profile.forbidRootBasePath && config.basePath === "/") {
@@ -844,8 +1013,17 @@ function buildModule(options = {}) {
       [`basePath: "/" \u4E0E profile ${config.target} \u7684 forbidRootBasePath \u51B2\u7A81\uFF0C\u8BF7\u6539\u7528\u5982 /${config.id} \u7684\u524D\u7F00`]
     );
   }
-  const yamlRoot = join9(projectDir, config.yamlRoot);
-  if (!existsSync7(yamlRoot)) {
+  if (config.serverEntry !== void 0 && !profile.moduleServerApi) {
+    throw new ModuleBuildError(
+      `target ${config.target} \u4E0D\u652F\u6301\u6A21\u5757 server entry\uFF08\u9700\u8981 innospots-web-shell@3\uFF09`,
+      [
+        `\u914D\u7F6E\u4E86 serverEntry / apiPrefixes\uFF0C\u4F46 profile ${config.target} \u7684 moduleServerApi=false`,
+        '\u8BF7\u628A pactor.module.json \u7684 target \u5347\u5230 "innospots-web-shell@3" \u540E\u91CD\u65B0\u6784\u5EFA'
+      ]
+    );
+  }
+  const yamlRoot = join10(projectDir, config.yamlRoot);
+  if (!existsSync8(yamlRoot)) {
     throw new ModuleBuildError(`yamlRoot \u4E0D\u5B58\u5728: ${config.yamlRoot}`, [
       `yamlRoot \u4E0D\u5B58\u5728: ${yamlRoot}`
     ]);
@@ -885,7 +1063,7 @@ function buildModule(options = {}) {
   }
   const transformed = transformSitemap(site, {
     profile,
-    demoPublic: config.demo.public,
+    accessDefault: config.access.default,
     loadLayout: (rel) => loadYamlExpanded(yamlRoot, rel)
   });
   const version = readProjectVersion(projectDir);
@@ -894,11 +1072,13 @@ function buildModule(options = {}) {
     basePath: config.basePath,
     pagePaths: sitePages.map((page) => page.path).filter((path) => typeof path === "string"),
     loginPath: typeof siteAuth.loginPath === "string" ? siteAuth.loginPath : "/login",
-    publicDir: join9(projectDir, config.publicDir),
+    publicDir: join10(projectDir, config.publicDir),
     rewriteNavigation: profile.rewriteNavigation.basePath,
     rewriteAssets: true,
     assetPrefix: profile.rewriteAssetUrls(config.id, version).replace(/\/+$/, ""),
-    absoluteApiToRelative: config.rewrite.absoluteApiToRelative
+    absoluteApiToRelative: config.rewrite.absoluteApiToRelative,
+    moduleId: config.id,
+    apiPrefixes: config.apiPrefixes
   };
   const sitemapRewrite = rewriteDslUrls(transformed.site, rewriteCtx);
   warnings.push(...sitemapRewrite.warnings);
@@ -908,17 +1088,22 @@ function buildModule(options = {}) {
     warnings.push(...result.warnings.map((warning) => `${id}: ${warning}`));
     rewrittenPages.set(id, result.value);
   }
-  const outDir = join9(projectDir, config.outDir);
-  const temp = mkdtempSync2(join9(projectDir, ".module-pack-"));
+  const outDir = join10(projectDir, config.outDir);
+  const temp = mkdtempSync2(join10(projectDir, ".module-pack-"));
   try {
     const bundle = bundleClient({
       projectDir,
       clientEntry: config.clientEntry,
-      outDir: join9(temp, "client")
+      outDir: join10(temp, "client")
     });
     if (bundle.message !== void 0) {
       warnings.push(bundle.message);
     }
+    const server = config.serverEntry ? bundleServer({
+      projectDir,
+      serverEntry: config.serverEntry,
+      outDir: join10(temp, "server")
+    }) : void 0;
     const emitted = emitDsl({
       config,
       projectDir,
@@ -930,18 +1115,20 @@ function buildModule(options = {}) {
       const tailwind = compileTailwind({
         projectDir,
         tailwind: config.tailwind,
-        scanDirs: [join9(temp, "dsl"), dirname3(join9(projectDir, config.clientEntry))],
-        cssFile: join9(temp, "client", "index.css")
+        scanDirs: [join10(temp, "dsl"), dirname3(join10(projectDir, config.clientEntry))],
+        cssFile: join10(temp, "client", "index.css")
       });
       warnings.push(...tailwind.warnings);
     }
-    const hasCss = existsSync7(join9(temp, "client", "index.css"));
+    const hasCss = existsSync8(join10(temp, "client", "index.css"));
     writeManifest({
       config,
       projectDir,
       outDir: temp,
       clientEntry: bundle.bundled ? "client/index.js" : void 0,
       styles: bundle.bundled && hasCss ? ["client/index.css"] : void 0,
+      serverEntry: server ? "server/index.mjs" : void 0,
+      apiPrefixes: server ? config.apiPrefixes : void 0,
       warnings
     });
     const validation = validateModule({ dir: projectDir, config: options.config, moduleDir: temp });
@@ -953,7 +1140,7 @@ function buildModule(options = {}) {
       );
     }
     rmSync2(outDir, { recursive: true, force: true });
-    mkdirSync4(dirname3(outDir), { recursive: true });
+    mkdirSync5(dirname3(outDir), { recursive: true });
     renameSync(temp, outDir);
     return {
       outDir,
@@ -964,6 +1151,7 @@ function buildModule(options = {}) {
         assets: emitted.assetCount
       },
       clientBundled: bundle.bundled,
+      serverBundled: server !== void 0,
       warnings
     };
   } catch (error) {
@@ -973,67 +1161,131 @@ function buildModule(options = {}) {
 }
 
 // src/init.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join10, resolve as resolve5 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4, join as join11, resolve as resolve6 } from "path";
+var CLIENT_STYLES_ENTRY = "module/module.css";
+var SERVER_ENTRY = "module/server.ts";
 function initModule(options = {}) {
-  const projectDir = resolve5(options.dir ?? process.cwd());
-  const result = { created: [], skipped: [], warnings: [] };
-  const pkgFile = join10(projectDir, "package.json");
-  if (!existsSync8(pkgFile)) {
+  const projectDir = resolve6(options.dir ?? process.cwd());
+  const overwrite = options.overwrite ?? false;
+  const server = options.server ?? false;
+  const result = { created: [], overwritten: [], skipped: [], warnings: [] };
+  const pkgFile = join11(projectDir, "package.json");
+  if (!existsSync9(pkgFile)) {
     throw new Error(`\u672A\u627E\u5230 package.json: ${projectDir}\uFF08\u8BF7\u5728\u76EE\u6807\u5DE5\u7A0B\u6839\u6267\u884C\uFF09`);
   }
   const pkg = JSON.parse(readFileSync7(pkgFile, "utf8"));
   const id = deriveModuleId(pkg.name);
   const actions = discoverActions(projectDir);
   const hasComponents = discoverComponents(projectDir);
-  const configFile = join10(projectDir, CONFIG_FILE);
-  if (existsSync8(configFile)) {
+  const configFile = join11(projectDir, CONFIG_FILE);
+  const renderConfig = () => ({
+    id,
+    name: typeof pkg.name === "string" ? pkg.name : id,
+    basePath: `/${id}`,
+    yamlRoot: CONFIG_DEFAULTS.yamlRoot,
+    clientEntry: CONFIG_DEFAULTS.clientEntry,
+    // 只有显式 --server 才写入，避免纯 DSL 模块被迫启用 server entry
+    ...server ? { serverEntry: SERVER_ENTRY, apiPrefixes: [deriveApiPrefix(id)] } : {},
+    actions: actions.map((action) => action.specifier.replace(/^\.\.\//, "")),
+    publicDir: CONFIG_DEFAULTS.publicDir,
+    target: DEFAULT_TARGET
+  });
+  const configExisted = existsSync9(configFile);
+  if (configExisted && !overwrite) {
     result.skipped.push(`${CONFIG_FILE}\uFF08\u5DF2\u5B58\u5728\uFF09`);
   } else {
-    const config = {
-      id,
-      name: typeof pkg.name === "string" ? pkg.name : id,
-      basePath: `/${id}`,
-      yamlRoot: CONFIG_DEFAULTS.yamlRoot,
-      clientEntry: CONFIG_DEFAULTS.clientEntry,
-      actions: actions.map((action) => action.specifier.replace(/^\.\.\//, "")),
-      publicDir: CONFIG_DEFAULTS.publicDir,
-      target: DEFAULT_TARGET,
-      demo: { public: false }
-    };
-    writeFileSync3(configFile, `${JSON.stringify(config, null, 2)}
+    writeFileSync3(configFile, `${JSON.stringify(renderConfig(), null, 2)}
 `, "utf8");
-    result.created.push(CONFIG_FILE);
+    if (configExisted) {
+      result.overwritten.push(CONFIG_FILE);
+    } else {
+      result.created.push(CONFIG_FILE);
+    }
   }
-  const clientFile = join10(projectDir, CONFIG_DEFAULTS.clientEntry);
-  if (existsSync8(clientFile)) {
+  const clientFile = join11(projectDir, CONFIG_DEFAULTS.clientEntry);
+  if (existsSync9(clientFile) && !overwrite) {
     result.skipped.push(`${CONFIG_DEFAULTS.clientEntry}\uFF08\u5DF2\u5B58\u5728\uFF09`);
   } else {
-    mkdirSync5(join10(projectDir, "module"), { recursive: true });
+    const clientExisted = existsSync9(clientFile);
+    mkdirSync6(dirname4(clientFile), { recursive: true });
     writeFileSync3(clientFile, renderClientEntry(hasComponents, actions), "utf8");
-    result.created.push(CONFIG_DEFAULTS.clientEntry);
+    if (clientExisted) {
+      result.overwritten.push(CONFIG_DEFAULTS.clientEntry);
+    } else {
+      result.created.push(CONFIG_DEFAULTS.clientEntry);
+    }
+  }
+  const stylesFile = join11(projectDir, CLIENT_STYLES_ENTRY);
+  if (existsSync9(stylesFile) && !overwrite) {
+    result.skipped.push(`${CLIENT_STYLES_ENTRY}\uFF08\u5DF2\u5B58\u5728\uFF09`);
+  } else {
+    const stylesExisted = existsSync9(stylesFile);
+    mkdirSync6(dirname4(stylesFile), { recursive: true });
+    writeFileSync3(stylesFile, renderModuleStyles(), "utf8");
+    if (stylesExisted) {
+      result.overwritten.push(CLIENT_STYLES_ENTRY);
+    } else {
+      result.created.push(CLIENT_STYLES_ENTRY);
+    }
+  }
+  if (server) {
+    const serverFile = join11(projectDir, SERVER_ENTRY);
+    if (existsSync9(serverFile) && !overwrite) {
+      result.skipped.push(`${SERVER_ENTRY}\uFF08\u5DF2\u5B58\u5728\uFF09`);
+    } else {
+      const serverExisted = existsSync9(serverFile);
+      mkdirSync6(dirname4(serverFile), { recursive: true });
+      writeFileSync3(serverFile, renderServerEntry(id), "utf8");
+      if (serverExisted) {
+        result.overwritten.push(SERVER_ENTRY);
+      } else {
+        result.created.push(SERVER_ENTRY);
+      }
+    }
+  }
+  const hasServerEntry = existsSync9(join11(projectDir, SERVER_ENTRY));
+  injectPackageJson(pkg, result, hasServerEntry);
+  if (hasServerEntry && !configDeclaresServerEntry(configFile)) {
+    result.warnings.push(
+      '\u68C0\u6D4B\u5230 module/server.ts\uFF1A\u5DF2\u6CE8\u5165 "./server" export\uFF1B\u8BF7\u5728 pactor.module.json \u4E2D\u540C\u65F6\u914D\u7F6E serverEntry \u4E0E apiPrefixes \u540E\u518D\u6784\u5EFA\uFF08\u7F3A\u4E00\u6784\u5EFA\u4F1A\u5931\u8D25\uFF09'
+    );
   }
-  injectPackageJson(pkg, result);
   writeFileSync3(pkgFile, `${JSON.stringify(pkg, null, 2)}
 `, "utf8");
   result.created.push("package.json\uFF08\u6CE8\u5165 files / exports / scripts / peerDependencies\uFF09");
   return result;
 }
+function configDeclaresServerEntry(configFile) {
+  if (!existsSync9(configFile)) return false;
+  try {
+    const raw = JSON.parse(readFileSync7(configFile, "utf8"));
+    return raw.serverEntry === SERVER_ENTRY;
+  } catch {
+    return false;
+  }
+}
+var MODULE_ID_PREFIX = "pactor-app-";
 function deriveModuleId(name) {
   const base2 = typeof name === "string" && name.length > 0 ? name : "module";
   const withoutScope = base2.startsWith("@") ? base2.slice(base2.indexOf("/") + 1) : base2;
   const kebab = withoutScope.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return kebab.length > 0 ? kebab : "module";
+  const id = kebab.length > 0 ? kebab : "module";
+  return id.startsWith(MODULE_ID_PREFIX) ? id : `${MODULE_ID_PREFIX}${id}`;
+}
+function deriveApiPrefix(moduleId) {
+  const slug = moduleId.startsWith(MODULE_ID_PREFIX) ? moduleId.slice(MODULE_ID_PREFIX.length) : moduleId;
+  return `/api/${slug.length > 0 ? slug : "module"}`;
 }
 function discoverActions(projectDir) {
-  const dir = join10(projectDir, "src/pactor");
-  if (!existsSync8(dir)) return [];
+  const dir = join11(projectDir, "src/pactor");
+  if (!existsSync9(dir)) return [];
   const sources = [];
   for (const entry of readdirSync4(dir, { withFileTypes: true }).sort(
     (a, b) => a.name.localeCompare(b.name)
   )) {
     if (!entry.isFile() || !entry.name.endsWith("-actions.ts")) continue;
-    const file = join10(dir, entry.name);
+    const file = join11(dir, entry.name);
     const content = readFileSync7(file, "utf8");
     const exports = [...content.matchAll(/export\s+const\s+([A-Za-z_$][\w$]*)/g)].map(
       (match) => match[1]
@@ -1047,8 +1299,8 @@ function discoverActions(projectDir) {
   return sources;
 }
 function discoverComponents(projectDir) {
-  const file = join10(projectDir, "src/pactor/components/index.ts");
-  if (!existsSync8(file)) return false;
+  const file = join11(projectDir, "src/pactor/components/index.ts");
+  if (!existsSync9(file)) return false;
   return /export\s+(const|\{[^}]*)\s*pactorComponents/.test(readFileSync7(file, "utf8"));
 }
 function renderClientEntry(hasComponents, actions) {
@@ -1065,18 +1317,48 @@ function renderClientEntry(hasComponents, actions) {
   }
   const components = hasComponents ? "pactorComponents" : "{}";
   const actionsExpr = spreads.length > 0 ? `{ ${spreads.join(", ")} }` : "{}";
+  const importsBlock = imports.length > 0 ? `${imports.join("\n")}
+` : "";
   return `// \u7531 \`pactor module init\` \u751F\u6210\uFF1A\u6A21\u5757 client \u5165\u53E3\u3002
 // Shell \u88C5\u914D\u5668\u751F\u6210 client-registry.ts \u65F6\u9759\u6001 import "<pkg>/client"\uFF0C
 // \u8981\u6C42\u6B64\u5904\u5177\u540D\u5BFC\u51FA extensions\uFF08components / actions \u6CE8\u518C\u8868\uFF09\u3002
-${imports.join("\n")}
-
+// module.css \u7531 esbuild \u62BD\u6210 client/index.css\uFF0CShell \u6309 manifest.styles \u52A0\u8F7D\u3002
+import './module.css';
+${importsBlock}
 export const extensions = {
   components: ${components},
   actions: ${actionsExpr},
 };
 `;
 }
-function injectPackageJson(pkg, result) {
+function renderModuleStyles() {
+  return `/**
+ * \u6A21\u5757\u81EA\u5E26\u6837\u5F0F\uFF08\u7531 \`pactor module init\` \u751F\u6210\uFF09\u3002
+ *
+ * \u672C\u6587\u4EF6\u7531 module/client.ts import\uFF1Aesbuild \u6253\u5305\u65F6\u4F1A\u62BD\u53D6\u4E3A
+ * dist-module/client/index.css \u5E76\u5199\u5165 manifest.styles\uFF0CShell \u636E\u6B64\u81EA\u52A8\u52A0\u8F7D\u3002
+ * Tailwind \u57FA\u7840\u6837\u5F0F\u3001pactor-app \u805A\u5408\u6837\u5F0F\u4E0E\u4E3B\u9898\u53D8\u91CF\u7531 Shell \u7EDF\u4E00\u63D0\u4F9B\uFF0C
+ * \u6A21\u5757\u5185\u4E0D\u8981\u91CD\u590D\u5F15\u5165\uFF0C\u907F\u514D\u4EA7\u751F\u7B2C\u4E8C\u4EFD reset / \u4EE4\u724C\u3002
+ */
+
+/* \u6A21\u5757\u7EA7\u6837\u5F0F\u5199\u5728\u8FD9\u91CC\uFF1A\u5EFA\u8BAE\u4F7F\u7528\u5E26\u6A21\u5757\u524D\u7F00\u7684\u7C7B\u540D\uFF0C\u907F\u514D\u4E0E Shell \u5168\u5C40\u6837\u5F0F\u51B2\u7A81\u3002 */
+`;
+}
+function renderServerEntry(moduleId) {
+  const prefix = deriveApiPrefix(moduleId);
+  return `// \u7531 \`pactor module init --server\` \u751F\u6210\uFF1A\u6A21\u5757\u670D\u52A1\u7AEF\u5165\u53E3\u3002
+// \u5BFC\u51FA\u300C\u903B\u8F91\u8DEF\u5F84 \u2192 \u65B9\u6CD5\u5904\u7406\u51FD\u6570\u300D\u6620\u5C04\uFF1A\u8DEF\u5F84\u952E\u4F7F\u7528\u539F\u59CB /api/... \u903B\u8F91\u8DEF\u5F84\uFF0C
+// Shell \u901A\u8FC7 /api/modules/<moduleId>/* \u7EDF\u4E00\u5206\u53D1\uFF08\u89C1 pactor.module.json \u7684 apiPrefixes\uFF09\u3002
+// handler \u53EA\u4F9D\u8D56 Web \u6807\u51C6 Request / Response\uFF0Ccontext.url \u4E3A\u903B\u8F91 URL\uFF08\u542B query\uFF09\u3002
+
+export const handlers = {
+  // '${prefix}/hello': {
+  //   GET: () => Response.json({ code: 0, data: { ok: true }, message: 'ok' }),
+  // },
+};
+`;
+}
+function injectPackageJson(pkg, result, hasServerEntry) {
   const outDir = CONFIG_DEFAULTS.outDir;
   const files = Array.isArray(pkg.files) ? pkg.files : [];
   if (!files.includes(outDir)) {
@@ -1086,7 +1368,8 @@ function injectPackageJson(pkg, result) {
   const wantedExports = {
     "./manifest": `./${outDir}/manifest.json`,
     "./client": `./${outDir}/client/index.js`,
-    "./styles.css": `./${outDir}/client/index.css`
+    "./styles.css": `./${outDir}/client/index.css`,
+    ...hasServerEntry ? { "./server": `./${outDir}/server/index.mjs` } : {}
   };
   for (const [key, value] of Object.entries(wantedExports)) {
     if (exportsMap[key] === void 0) {
@@ -1099,7 +1382,8 @@ function injectPackageJson(pkg, result) {
   const scripts = isRecord4(pkg.scripts) ? { ...pkg.scripts } : {};
   const wantedScripts = {
     "build:module": "pactor module build",
-    "pack:module": "pactor module pack"
+    "pack:module": "pactor module pack",
+    "publish:module": "pactor module publish"
   };
   for (const [key, value] of Object.entries(wantedScripts)) {
     if (scripts[key] === void 0) {
@@ -1127,20 +1411,71 @@ function injectPackageJson(pkg, result) {
 function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+
+// src/version.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve7 } from "path";
+var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?$/;
+function bumpVersion(current, release) {
+  if (release === "major" || release === "minor" || release === "patch") {
+    const match = SEMVER_RE.exec(current);
+    if (!match) {
+      throw new ConfigError(`package.json \u7248\u672C\u53F7\u975E\u6CD5: ${current}\uFF08\u671F\u671B x.y.z\uFF09`);
+    }
+    const [, major, minor, patch] = match;
+    if (release === "major") return `${Number(major) + 1}.0.0`;
+    if (release === "minor") return `${major}.${Number(minor) + 1}.0`;
+    return `${major}.${minor}.${Number(patch) + 1}`;
+  }
+  if (!SEMVER_RE.test(release)) {
+    throw new ConfigError(
+      `--bump \u53D6\u503C\u975E\u6CD5: ${release}\uFF08\u652F\u6301 patch | minor | major | \u663E\u5F0F\u7248\u672C\u53F7 x.y.z\uFF09`
+    );
+  }
+  return release;
+}
+function bumpPackageVersion(options) {
+  const dir = resolve7(options.dir ?? process.cwd());
+  const pkgFile = resolve7(dir, "package.json");
+  if (!existsSync10(pkgFile)) {
+    throw new ConfigError(`\u672A\u627E\u5230 package.json: ${dir}\uFF08\u8BF7\u5728\u76EE\u6807\u5DE5\u7A0B\u6839\u6267\u884C\uFF09`);
+  }
+  const pkg = JSON.parse(readFileSync8(pkgFile, "utf8"));
+  const name = typeof pkg.name === "string" ? pkg.name : "(\u672A\u547D\u540D)";
+  if (typeof pkg.version !== "string" || pkg.version === "") {
+    throw new ConfigError(`package.json \u7F3A\u5C11 version \u5B57\u6BB5: ${pkgFile}`);
+  }
+  const from = pkg.version;
+  const to = bumpVersion(from, options.release);
+  pkg.version = to;
+  writeFileSync4(pkgFile, `${JSON.stringify(pkg, null, 2)}
+`, "utf8");
+  return { name, from, to };
+}
 export {
   CLIENT_EXTERNALS,
+  CLIENT_STYLES_ENTRY,
   CONFIG_DEFAULTS,
   CONFIG_FILE,
   ConfigError,
   DEFAULT_TARGET,
   INCLUDE_KEY,
   IncludeError,
+  MODULE_ID_PREFIX,
   ModuleBuildError,
   ProfileError,
+  SERVER_BUNDLE_FILE,
+  SERVER_ENTRY,
+  SERVER_EXTERNALS,
+  ServerBundleError,
   buildModule,
+  bumpPackageVersion,
+  bumpVersion,
   bundleClient,
+  bundleServer,
   collectModuleSource,
   compileTailwind,
+  deriveApiPrefix,
   deriveModuleId,
   discoverActions,
   discoverComponents,
@@ -1151,6 +1486,7 @@ export {
   initModule,
   innospotsWebShellV1,
   innospotsWebShellV2,
+  innospotsWebShellV3,
   listProfiles,
   loadModuleConfig,
   loadYamlExpanded,
@@ -1159,6 +1495,8 @@ export {
   parseYamlFile,
   readProjectVersion,
   renderClientEntry,
+  renderModuleStyles,
+  renderServerEntry,
   resolvePactorVersionRange,
   rewriteDslUrls,
   rewriteNavigationTo,