@tbox.cn/app-cli 0.1.0 → 0.1.3

package/dist/index.js

@@ -2,6 +2,7 @@
 
 // src/index.ts
 import { Command } from "commander";
+import { createRequire as createRequire3 } from "module";
 import { fileURLToPath } from "url";
 import { realpathSync as realpathSync3 } from "fs";
 
@@ -383,8 +384,8 @@ async function createApp(opts) {
 }
 
 // src/commands/add.ts
-import { existsSync as existsSync19, readFileSync as readFileSync8, readdirSync as readdirSync2 } from "fs";
-import path23 from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync9, readdirSync as readdirSync2 } from "fs";
+import path24 from "path";
 
 // src/expand.ts
 import { mkdir as mkdir2, rm, writeFile as writeFile3 } from "fs/promises";
@@ -405,15 +406,32 @@ function rewritePlatformRefs(deps) {
     if (isWorkspacePkg(name)) deps[name] = "catalog:";
   }
 }
+function deriveModuleId(pkgName) {
+  return pkgName.replace(/^@tbox\.cn\/app-/, "").replace(/^@[^/]+\//, "");
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function rewriteLoadModuleSkillsCall(content, fromName, toName) {
+  return content.replaceAll(
+    new RegExp(`loadModuleSkills\\(\\s*['"]${escapeRegExp(fromName)}['"]`, "g"),
+    `loadModuleSkills('${toName}'`
+  );
+}
 function rewriteExportsToSrc(pkg) {
   const exports = pkg.exports;
   if (!exports || typeof exports !== "object") return;
   const next = {};
   for (const [sub, val] of Object.entries(exports)) {
+    if (sub === "./package.json") {
+      next[sub] = val;
+      continue;
+    }
     if (typeof val !== "object" || val === null) continue;
     const base = sub === "." ? "./src/index.ts" : `./src/${sub.replace(/^\.\//, "")}/index.ts`;
     next[sub] = { types: base, import: base };
   }
+  if (next["./package.json"] === void 0) next["./package.json"] = "./package.json";
   pkg.exports = next;
 }
 async function expandCodegen(appDir, sourceDir, entry) {
@@ -421,16 +439,21 @@ async function expandCodegen(appDir, sourceDir, entry) {
   const targetDir = path5.join(appDir, "packages", entry.id);
   await rm(targetDir, { recursive: true, force: true });
   await mkdir2(targetDir, { recursive: true });
+  const rawPkg = JSON.parse(await src.readFile("package.json"));
+  const fromName = rawPkg.name ?? "";
+  const toName = `@app/${entry.id}`;
   for (const rel of await src.listFiles()) {
     if (rel === "package.json") continue;
-    const content = await src.readFile(rel);
+    let content = await src.readFile(rel);
+    if (fromName && fromName !== toName && rel.endsWith(".ts")) {
+      content = rewriteLoadModuleSkillsCall(content, fromName, toName);
+    }
     const out = path5.join(targetDir, rel);
     await mkdir2(path5.dirname(out), { recursive: true });
     await writeFile3(out, content);
   }
-  const rawPkg = await src.readFile("package.json");
-  const pkg = JSON.parse(rawPkg);
-  pkg.name = `@app/${entry.id}`;
+  const pkg = rawPkg;
+  pkg.name = toName;
   pkg.private = true;
   if (pkg.dependencies && typeof pkg.dependencies === "object") {
     rewritePlatformRefs(pkg.dependencies);
@@ -522,7 +545,9 @@ async function createLocalSkeleton(appDir, shortName) {
     exports: {
       ".": { types: "./src/index.ts", import: "./src/index.ts" },
       "./server": { types: "./src/server/index.ts", import: "./src/server/index.ts" },
-      "./client": { types: "./src/client/index.ts", import: "./src/client/index.ts" }
+      "./client": { types: "./src/client/index.ts", import: "./src/client/index.ts" },
+      // 009 模块文件化前置：loadModuleSkills 包名解析需 exports 放行元数据子路径
+      "./package.json": "./package.json"
     },
     // 本地模块自带工具链：typecheck/test 可在生成应用内直接跑（pnpm verify 全 @app/* 范围）
     scripts: { typecheck: "tsc --noEmit", test: "vitest run --passWithNoTests" },
@@ -932,6 +957,19 @@ function probeModuleObjectExport(dir, sub, symbol) {
     return false;
   }
 }
+function readServerSource(dir) {
+  const file = path7.join(dir, "src", "server", "index.ts");
+  if (!existsSync5(file)) return "";
+  try {
+    return readFileSync4(file, "utf8");
+  } catch {
+    return "";
+  }
+}
+function extractComponentId(source) {
+  const match = source.match(/declaration\s*:\s*\{[\s\S]*?componentId\s*:\s*['"]([^'"]+)['"]/);
+  return match?.[1];
+}
 async function listLocalModules(appDir) {
   const packagesDir = path7.join(appDir, "packages");
   const result = [];
@@ -968,25 +1006,31 @@ async function collectDeclared(appDir) {
     const descriptor = readComponentFile(local) ?? readDescriptorFromNodeModules(appDir, entry.package);
     const probeDir = existsSync5(path7.join(local, "src")) ? local : path7.join(appDir, "node_modules", ...entry.package.split("/"));
     const c = descriptor?.contributes;
+    const hasServerEntry = descriptor !== null && probeModuleObjectExport(probeDir, "server", "serverModule");
     declared.push({
       id: entry.id,
       pkg: entry.mode === "sdk" ? entry.package : `@app/${entry.id}`,
       mode: entry.mode,
-      hasServerEntry: descriptor !== null && probeModuleObjectExport(probeDir, "server", "serverModule"),
+      hasServerEntry,
       hasClientEntry: descriptor !== null && probeModuleObjectExport(probeDir, "client", "clientModule"),
-      hasCards: (c?.cards?.length ?? 0) > 0
+      hasCards: (c?.cards?.length ?? 0) > 0,
+      // 011 评审 M3：declaration.componentId（deployment 对账真源；老模块无 declaration → undefined）
+      ...hasServerEntry ? { componentId: extractComponentId(readServerSource(probeDir)) } : {}
     });
   }
   for (const mod of await listLocalModules(appDir)) {
     if (seen.has(mod.id)) continue;
     const c = mod.descriptor.contributes;
+    const hasServerEntry = probeModuleObjectExport(mod.dir, "server", "serverModule");
     declared.push({
       id: mod.id,
       pkg: `@app/${mod.id}`,
       mode: "local",
-      hasServerEntry: probeModuleObjectExport(mod.dir, "server", "serverModule"),
+      hasServerEntry,
       hasClientEntry: probeModuleObjectExport(mod.dir, "client", "clientModule"),
-      hasCards: (c.cards?.length ?? 0) > 0
+      hasCards: (c.cards?.length ?? 0) > 0,
+      // 011 评审 M3：declaration.componentId（同 npmModules 路径）
+      ...hasServerEntry ? { componentId: extractComponentId(readServerSource(mod.dir)) } : {}
     });
   }
   return declared;
@@ -2093,6 +2137,181 @@ function legacyPlatformFilesRule(ctx) {
   return issues;
 }
 
+// src/doctor/rules/mall-deployment.ts
+import { existsSync as existsSync19, readFileSync as readFileSync8 } from "fs";
+import { readdir as readdir11 } from "fs/promises";
+import { createRequire as createRequire2 } from "module";
+import path23 from "path";
+function resolveModuleRoot(ctx, pkg) {
+  try {
+    const req = createRequire2(path23.join(ctx.appDir, "package.json"));
+    const resolved = req.resolve(`${pkg}/package.json`);
+    return path23.dirname(resolved);
+  } catch {
+    return void 0;
+  }
+}
+function readServerSource2(moduleRoot) {
+  const candidates = [
+    path23.join(moduleRoot, "src/server/index.ts"),
+    path23.join(moduleRoot, "src/server/index.tsx")
+  ];
+  for (const c of candidates) {
+    if (existsSync19(c)) return readFileSync8(c, "utf8");
+  }
+  return "";
+}
+function extractFeatures(source) {
+  const match = source.match(/features\s*:\s*\[([^\]]*)\]/);
+  if (!match) return [];
+  return [...match[1].matchAll(/['"]([^'"]+)['"]/g)].map((m) => m[1]);
+}
+function extractIntentPatterns(source) {
+  const patterns = [];
+  for (const block of source.matchAll(/patterns\s*:\s*\[([^\]]*)\]/g)) {
+    for (const m of block[1].matchAll(/['"]([^'"]+)['"]/g)) {
+      patterns.push(m[1]);
+    }
+  }
+  return patterns;
+}
+function extractFeatureRefs(source) {
+  return [...source.matchAll(/isFeatureEnabled\s*\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => m[1]);
+}
+async function deploymentConsistencyRule(ctx) {
+  const issues = [];
+  const deploymentDir = path23.join(ctx.appDir, "config/deployments");
+  if (!existsSync19(deploymentDir)) return issues;
+  const entries = await readdir11(deploymentDir);
+  const jsonFiles = entries.filter((e) => e.endsWith(".json"));
+  if (jsonFiles.length === 0) return issues;
+  for (const file of jsonFiles) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync8(path23.join(deploymentDir, file), "utf8"));
+    } catch {
+      issues.push({ rule: "deployment-consistency", level: "error", message: `deployment \u914D\u7F6E\u975E\u6CD5 JSON\uFF1Aconfig/deployments/${file}` });
+      continue;
+    }
+    const components = parsed.deployment?.components ?? [];
+    const declaredPkgs = new Map(ctx.declared.map((d) => [d.componentId ?? d.id, d]));
+    for (const component of components) {
+      const componentId = component.componentId;
+      if (!componentId) {
+        issues.push({
+          rule: "deployment-consistency",
+          level: "error",
+          message: `config/deployments/${file}\uFF1Acomponents \u9879\u7F3A componentId`
+        });
+        continue;
+      }
+      const declared = declaredPkgs.get(componentId);
+      if (!declared) {
+        issues.push({
+          rule: "deployment-consistency",
+          level: component.optional ? "warning" : "error",
+          message: `config/deployments/${file}\uFF1AcomponentId "${componentId}" \u672A\u5B89\u88C5\u5BF9\u5E94\u6A21\u5757` + (component.optional ? "\uFF08optional \u7EC4\u4EF6\uFF0C\u964D\u7EA7 warning\uFF09" : "\uFF08\u5B89\u88C5\u5BF9\u5E94\u6A21\u5757\u6216\u6807\u8BB0 optional\uFF09")
+        });
+        continue;
+      }
+      const moduleRoot = resolveModuleRoot(ctx, declared.pkg);
+      if (moduleRoot && component.enabledFeatures?.length) {
+        const source = readServerSource2(moduleRoot);
+        const declaredFeatures = extractFeatures(source);
+        if (declaredFeatures.length > 0) {
+          for (const feature of component.enabledFeatures) {
+            if (!declaredFeatures.includes(feature)) {
+              issues.push({
+                rule: "deployment-consistency",
+                level: "error",
+                message: `config/deployments/${file}\uFF1Afeature "${feature}" \u4E0D\u5728 ${componentId} \u7684 declaration.features \u5185\uFF08\u5DF2\u58F0\u660E\uFF1A${declaredFeatures.join(", ") || "(\u65E0)"}\uFF09`
+              });
+            }
+          }
+        }
+      }
+    }
+  }
+  return issues;
+}
+async function intentOverlapRule(ctx) {
+  const issues = [];
+  const byPattern = /* @__PURE__ */ new Map();
+  for (const declared of ctx.declared) {
+    if (!declared.hasServerEntry) continue;
+    const root = resolveModuleRoot(ctx, declared.pkg);
+    if (!root) continue;
+    const patterns = extractIntentPatterns(readServerSource2(root));
+    for (const p of patterns) {
+      const list = byPattern.get(p) ?? [];
+      list.push(declared.id);
+      byPattern.set(p, list);
+    }
+  }
+  for (const [pattern, modules] of byPattern) {
+    if (modules.length > 1) {
+      issues.push({
+        rule: "intent-overlap",
+        level: "warning",
+        message: `\u610F\u56FE\u8BCD "${pattern}" \u5728\u591A\u4E2A\u6A21\u5757\u58F0\u660E\uFF08${modules.join(", ")}\uFF09\u2014\u2014\u5148\u6CE8\u518C\u5148\u547D\u4E2D`
+      });
+    }
+  }
+  return issues;
+}
+async function skillNameConflictRule(ctx) {
+  const issues = [];
+  const byName = /* @__PURE__ */ new Map();
+  for (const declared of ctx.declared) {
+    if (!declared.hasServerEntry) continue;
+    const root = resolveModuleRoot(ctx, declared.pkg);
+    if (!root) continue;
+    const skillsDir = path23.join(root, "skills");
+    if (!existsSync19(skillsDir)) continue;
+    try {
+      const names = (await readdir11(skillsDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+      for (const name of names) {
+        const list = byName.get(name) ?? [];
+        list.push(declared.id);
+        byName.set(name, list);
+      }
+    } catch {
+    }
+  }
+  for (const [name, modules] of byName) {
+    if (modules.length > 1) {
+      issues.push({
+        rule: "skill-name-conflict",
+        level: "warning",
+        message: `skill "${name}" \u5728\u591A\u4E2A\u6A21\u5757\u58F0\u660E\uFF08${modules.join(", ")}\uFF09\u2014\u2014\u540E\u6CE8\u518C\u8986\u76D6`
+      });
+    }
+  }
+  return issues;
+}
+async function featureDeclarationRule(ctx) {
+  const issues = [];
+  for (const declared of ctx.declared) {
+    if (!declared.hasServerEntry) continue;
+    const root = resolveModuleRoot(ctx, declared.pkg);
+    if (!root) continue;
+    const source = readServerSource2(root);
+    if (!source) continue;
+    const declaredFeatures = extractFeatures(source);
+    const refs = extractFeatureRefs(source);
+    for (const ref of refs) {
+      if (declaredFeatures.length > 0 && !declaredFeatures.includes(ref)) {
+        issues.push({
+          rule: "feature-declaration",
+          level: "error",
+          message: `\u6A21\u5757 ${declared.id}\uFF1AisFeatureEnabled("${ref}") \u4E0D\u5728 declaration.features \u5185\uFF08\u5DF2\u58F0\u660E\uFF1A${declaredFeatures.join(", ") || "(\u65E0)"}\uFF09`
+        });
+      }
+    }
+  }
+  return issues;
+}
+
 // src/doctor/index.ts
 var DOCTOR_RULES = [
   { name: "workspace-dag", run: workspaceDagRule },
@@ -2108,7 +2327,11 @@ var DOCTOR_RULES = [
   { name: "naked-write-route", run: nakedWriteRouteRule },
   { name: "descriptor-schema", run: descriptorSchemaRule },
   { name: "workspace-ref-resolved", run: workspaceRefResolvedRule },
-  { name: "legacy-platform-files", run: legacyPlatformFilesRule }
+  { name: "legacy-platform-files", run: legacyPlatformFilesRule },
+  { name: "deployment-consistency", run: deploymentConsistencyRule },
+  { name: "intent-overlap", run: intentOverlapRule },
+  { name: "skill-name-conflict", run: skillNameConflictRule },
+  { name: "feature-declaration", run: featureDeclarationRule }
 ];
 async function runDoctor(ctx, opts) {
   const issues = [];
@@ -2244,10 +2467,10 @@ async function resolveDependencies(appDir, rootIds, declared, extraRoots = []) {
 
 // src/commands/add.ts
 function readSourceDescriptor(sourceDir) {
-  const file = path23.join(sourceDir, "tbox.component.json");
-  if (!existsSync19(file)) return null;
+  const file = path24.join(sourceDir, "tbox.component.json");
+  if (!existsSync20(file)) return null;
   try {
-    const parsed = parseComponentDescriptor(JSON.parse(readFileSync8(file, "utf8")));
+    const parsed = parseComponentDescriptor(JSON.parse(readFileSync9(file, "utf8")));
     return parsed.ok ? parsed.value : null;
   } catch {
     return null;
@@ -2255,20 +2478,20 @@ function readSourceDescriptor(sourceDir) {
 }
 function resolveDepSource(sourcePath, depId) {
   if (!sourcePath) return null;
-  const dir = path23.dirname(sourcePath);
-  const siblingDir = path23.join(dir, depId);
-  if (existsSync19(path23.join(siblingDir, "package.json"))) return siblingDir;
+  const dir = path24.dirname(sourcePath);
+  const siblingDir = path24.join(dir, depId);
+  if (existsSync20(path24.join(siblingDir, "package.json"))) return siblingDir;
   try {
     const tgz = readdirSync2(dir).find(
       (f) => f.endsWith(".tgz") && f.includes(`-${depId}-`)
     );
-    if (tgz) return path23.join(dir, tgz);
+    if (tgz) return path24.join(dir, tgz);
   } catch {
   }
   return null;
 }
 function isInstalled(appDir, id) {
-  if (existsSync19(path23.join(appDir, "packages", id))) return true;
+  if (existsSync20(path24.join(appDir, "packages", id))) return true;
   const manifest = readAppManifest(appDir);
   return manifest?.npmModules.some((m) => m.id === id && m.mode === "sdk") ?? false;
 }
@@ -2296,7 +2519,7 @@ async function addModuleWithDepsCore(opts, visited, asDependency, tarballs) {
     assertValidModuleId(id, `--mode local ${opts.pkg}`);
   } else {
     if (!opts.source) throw new Error(`--mode ${opts.mode} \u9700\u8981 --source <\u76EE\u5F55\u6216 tgz \u6216 registry \u5305>`);
-    const isRegSource = isReg && !existsSync19(path23.resolve(opts.source));
+    const isRegSource = isReg && !existsSync20(path24.resolve(opts.source));
     if (!isRegSource && !opts.source.endsWith(".tgz") && !LocalDirSource.isUsable(opts.source)) {
       throw new Error(`\u6A21\u5757\u6E90\u65E0\u6548\uFF08\u7F3A package.json\uFF09: ${opts.source}`);
     }
@@ -2305,7 +2528,7 @@ async function addModuleWithDepsCore(opts, visited, asDependency, tarballs) {
       tarballs.push(opened.source);
     }
     const pkgOnly = opts.pkg.replace(/@[^/]+$/, "");
-    id = pkgOnly.replace(/^@tbox\.cn\/app-/, "").replace(/^@[^/]+\//, "");
+    id = deriveModuleId(pkgOnly);
     assertValidModuleId(id, `--mode ${opts.mode} ${opts.pkg}`);
     sourceDescriptor = readSourceDescriptor(opened.sourceDir);
   }
@@ -2314,7 +2537,7 @@ async function addModuleWithDepsCore(opts, visited, asDependency, tarballs) {
     return;
   }
   if (!asDependency && isInstalled(appDir, id)) {
-    const where = existsSync19(path23.join(appDir, "packages", id)) ? `packages/${id}` : "manifest \u5DF2\u767B\u8BB0\uFF08sdk \u5305\uFF0C\u65E0\u672C\u5730\u76EE\u5F55\uFF09";
+    const where = existsSync20(path24.join(appDir, "packages", id)) ? `packages/${id}` : "manifest \u5DF2\u767B\u8BB0\uFF08sdk \u5305\uFF0C\u65E0\u672C\u5730\u76EE\u5F55\uFF09";
     throw new Error(`\u6A21\u5757 ${id} \u5DF2\u5B58\u5728\uFF08${where}\uFF09\u3002\u82E5\u8981\u91CD\u65B0\u5C55\u5F00\u8BF7\u5148 remove \u6216\u624B\u52A8\u5904\u7406\uFF1B\u88C5\u914D\u552F\u4E00\u8986\u76D6\u5165\u53E3\u4E3A sync --force`);
   }
   if (visited.has(id)) return;
@@ -2345,7 +2568,7 @@ async function addModuleWithDepsCore(opts, visited, asDependency, tarballs) {
       if (depOpened.source instanceof TarballSource || depOpened.source instanceof RegistrySource) {
         tarballs.push(depOpened.source);
       }
-      const depIsBusiness = existsSync19(path23.join(depOpened.sourceDir, "tbox.component.json"));
+      const depIsBusiness = existsSync20(path24.join(depOpened.sourceDir, "tbox.component.json"));
       await addModuleWithDeps(
         { pkg: depPkg, mode: depIsBusiness ? "codegen" : "sdk", source: depSource, registry: opts.registry },
         visited,
@@ -2558,9 +2781,9 @@ async function doctorCommand(opts = {}) {
 }
 
 // src/commands/update.ts
-import { existsSync as existsSync20 } from "fs";
-import { readdir as readdir11, readFile as readFile6, unlink, writeFile as writeFile7 } from "fs/promises";
-import path24 from "path";
+import { existsSync as existsSync21 } from "fs";
+import { readdir as readdir12, readFile as readFile6, unlink, writeFile as writeFile7 } from "fs/promises";
+import path25 from "path";
 
 // src/merge3.ts
 import { diffArrays } from "diff";
@@ -2643,21 +2866,21 @@ function merge3(base, ours, theirs) {
 // src/commands/update.ts
 var EXCLUDED = /* @__PURE__ */ new Set(["node_modules", "dist", ".git", ".tbox"]);
 function openSourceDir(source) {
-  if (source.endsWith(".tgz") && existsSync20(source)) {
+  if (source.endsWith(".tgz") && existsSync21(source)) {
     const tarball = new TarballSource(source);
     return { dir: tarball.getDir(), tarball };
   }
-  return { dir: path24.resolve(source), tarball: null };
+  return { dir: path25.resolve(source), tarball: null };
 }
 async function readPackageFiles(dir) {
   const map = /* @__PURE__ */ new Map();
   async function walk(rel) {
-    const full = path24.join(dir, rel);
-    const entries = await readdir11(full, { withFileTypes: true });
+    const full = path25.join(dir, rel);
+    const entries = await readdir12(full, { withFileTypes: true });
     for (const entry of entries) {
       if (EXCLUDED.has(entry.name)) continue;
       const child = rel ? `${rel}/${entry.name}` : entry.name;
-      const childFull = path24.join(full, entry.name);
+      const childFull = path25.join(full, entry.name);
       if (entry.isDirectory()) {
         await walk(child);
       } else {
@@ -2687,8 +2910,8 @@ async function updateModule(opts) {
     console.log(`\u2705 \u5DF2\u5347\u7EA7 ${entry.package}\uFF08sdk \u6A21\u5F0F\uFF09`);
     return;
   }
-  const pkgDir = path24.join(appDir, "packages", opts.module);
-  if (!existsSync20(pkgDir)) throw new Error(`\u7F3A\u5C11 packages/${opts.module}`);
+  const pkgDir = path25.join(appDir, "packages", opts.module);
+  if (!existsSync21(pkgDir)) throw new Error(`\u7F3A\u5C11 packages/${opts.module}`);
   const ours = await readPackageFiles(pkgDir);
   const tarballs = [];
   try {
@@ -2735,8 +2958,8 @@ async function updateModule(opts) {
       return;
     }
     for (const [key, content] of mergedFiles) {
-      const out = path24.join(pkgDir, key);
-      if (content === "" && existsSync20(out)) {
+      const out = path25.join(pkgDir, key);
+      if (content === "" && existsSync21(out)) {
         await unlink(out);
         console.log(`   \u{1F5D1} \u5DF2\u5220\u9664 ${key}\uFF08\u5347\u7EA7\u6E90\u5220\u9664\u8BE5\u6587\u4EF6\uFF09`);
         continue;
@@ -2765,27 +2988,27 @@ async function updateModule(opts) {
 }
 
 // src/commands/publish.ts
-import { existsSync as existsSync22, readFileSync as readFileSync10, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync11, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import path26 from "path";
+import path27 from "path";
 
 // src/commands/pack.ts
-import { existsSync as existsSync21, readFileSync as readFileSync9, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync10, readdirSync as readdirSync3 } from "fs";
 import { execFileSync as execFileSync3 } from "child_process";
-import path25 from "path";
+import path26 from "path";
 function tarballFileName(name, version) {
   const plain = name.replace(/^@/, "").replace("/", "-");
   return `${plain}-${version}.tgz`;
 }
 function validatePublishableModule(moduleDir) {
-  if (!existsSync21(moduleDir) || !existsSync21(path25.join(moduleDir, "package.json"))) {
+  if (!existsSync22(moduleDir) || !existsSync22(path26.join(moduleDir, "package.json"))) {
     throw new Error(`\u6A21\u5757\u76EE\u5F55\u65E0\u6548\uFF08\u7F3A package.json\uFF09: ${moduleDir}`);
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync9(path25.join(moduleDir, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync10(path26.join(moduleDir, "package.json"), "utf8"));
   } catch {
-    throw new Error(`package.json \u89E3\u6790\u5931\u8D25: ${path25.join(moduleDir, "package.json")}`);
+    throw new Error(`package.json \u89E3\u6790\u5931\u8D25: ${path26.join(moduleDir, "package.json")}`);
   }
   const name = typeof pkg.name === "string" ? pkg.name : "";
   if (!/^@tbox\.cn\//.test(name)) {
@@ -2799,20 +3022,20 @@ function validatePublishableModule(moduleDir) {
 }
 function packModule(moduleDir, outDir) {
   const { name, version } = validatePublishableModule(moduleDir);
-  const absOut = path25.resolve(outDir);
+  const absOut = path26.resolve(outDir);
   execFileSync3("pnpm", ["pack", "--pack-destination", absOut], { stdio: "inherit", cwd: moduleDir });
-  return path25.join(absOut, tarballFileName(name, version));
+  return path26.join(absOut, tarballFileName(name, version));
 }
 function detectKind(pkgDir, name) {
-  if (existsSync21(path25.join(pkgDir, "pnpm-workspace.template.yaml"))) return "template";
-  if (existsSync21(path25.join(pkgDir, "tbox.component.json"))) return "module";
+  if (existsSync22(path26.join(pkgDir, "pnpm-workspace.template.yaml"))) return "template";
+  if (existsSync22(path26.join(pkgDir, "tbox.component.json"))) return "module";
   if (/^@[^/]+\/app-contracts/.test(name)) return "contract";
   return "generic";
 }
 function listAllFiles(dir) {
   const out = [];
   function walk(rel) {
-    const full = path25.join(dir, rel);
+    const full = path26.join(dir, rel);
     for (const entry of readdirSync3(full, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git") continue;
       const child = rel ? `${rel}/${entry.name}` : entry.name;
@@ -2841,10 +3064,10 @@ function collectExportTargets(exports) {
 }
 function verifyPkgDir(pkgDir, kind) {
   const issues = [];
-  const pkgFile = path25.join(pkgDir, "package.json");
+  const pkgFile = path26.join(pkgDir, "package.json");
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync9(pkgFile, "utf8"));
+    pkg = JSON.parse(readFileSync10(pkgFile, "utf8"));
   } catch {
     issues.push({ rule: "pack-manifest", level: "error", message: "\u4EA7\u7269\u7F3A\u5C11\u53EF\u89E3\u6790\u7684 package.json" });
     return issues;
@@ -2872,7 +3095,7 @@ function verifyPkgDir(pkgDir, kind) {
           level: "error",
           message: `exports \u6307\u5411\u5F00\u53D1\u6001\u6E90\u7801 "${t}"\uFF08\u53D1\u5E03\u6001\u5E94\u6307\u5411 dist/\uFF09`
         });
-      } else if (t.startsWith("./") && !existsSync21(path25.join(pkgDir, t))) {
+      } else if (t.startsWith("./") && !existsSync22(path26.join(pkgDir, t))) {
         issues.push({
           rule: "pack-exports",
           level: "error",
@@ -2905,7 +3128,7 @@ function verifyPkgDir(pkgDir, kind) {
   }
   if (kindOf === "module") {
     for (const required of ["src", "dist", "tbox.component.json"]) {
-      if (!files.includes(required) && !existsSync21(path25.join(pkgDir, required))) {
+      if (!files.includes(required) && !existsSync22(path26.join(pkgDir, required))) {
         issues.push({ rule: "pack-files", level: "error", message: `\u4E1A\u52A1\u6A21\u5757\u4EA7\u7269\u7F3A\u5C11 ${required}` });
       }
     }
@@ -2919,12 +3142,12 @@ function verifyPkgDir(pkgDir, kind) {
       "tsconfig.base.json",
       "scripts/verify-generated.mjs"
     ]) {
-      if (!existsSync21(path25.join(pkgDir, required))) {
+      if (!existsSync22(path26.join(pkgDir, required))) {
         issues.push({ rule: "pack-files", level: "error", message: `\u6A21\u677F\u4EA7\u7269\u7F3A\u5C11 ${required}` });
       }
     }
     for (const leaked2 of ["pnpm-workspace.yaml", "pnpm-lock.yaml"]) {
-      if (existsSync21(path25.join(pkgDir, leaked2))) {
+      if (existsSync22(path26.join(pkgDir, leaked2))) {
         issues.push({
           rule: "pack-files",
           level: "error",
@@ -2967,11 +3190,11 @@ async function verifyTarball(tgzPath) {
     const issues = verifyPkgDir(pkgDir, kind);
     if (pkg.name && pkg.version) {
       const expect = tarballFileName(pkg.name, pkg.version);
-      if (path25.basename(tgzPath) !== expect) {
+      if (path26.basename(tgzPath) !== expect) {
         issues.push({
           rule: "pack-filename",
           level: "error",
-          message: `tgz \u6587\u4EF6\u540D ${path25.basename(tgzPath)} \u4E0E\u5305 ${pkg.name}@${pkg.version} \u671F\u671B ${expect} \u4E0D\u4E00\u81F4`
+          message: `tgz \u6587\u4EF6\u540D ${path26.basename(tgzPath)} \u4E0E\u5305 ${pkg.name}@${pkg.version} \u671F\u671B ${expect} \u4E0D\u4E00\u81F4`
         });
       }
     }
@@ -2986,9 +3209,9 @@ function printIssues(issues) {
   }
 }
 async function packCommand(opts) {
-  const moduleDir = path25.resolve(process.cwd(), opts.module);
+  const moduleDir = path26.resolve(process.cwd(), opts.module);
   const tgzPath = packModule(moduleDir, opts.out);
-  console.log(`\u2705 \u5DF2\u6253\u5305 ${path25.basename(tgzPath)} \u2192 ${path25.resolve(opts.out)}`);
+  console.log(`\u2705 \u5DF2\u6253\u5305 ${path26.basename(tgzPath)} \u2192 ${path26.resolve(opts.out)}`);
   if (opts.check) {
     const issues = await verifyTarball(tgzPath);
     printIssues(issues);
@@ -2999,19 +3222,19 @@ async function packCommand(opts) {
 // src/commands/publish.ts
 async function publishModule(opts) {
   const cwd = process.cwd();
-  const moduleDir = path26.resolve(cwd, opts.module);
-  if (!existsSync22(moduleDir) || !existsSync22(path26.join(moduleDir, "package.json"))) {
+  const moduleDir = path27.resolve(cwd, opts.module);
+  if (!existsSync23(moduleDir) || !existsSync23(path27.join(moduleDir, "package.json"))) {
     throw new Error(`\u6A21\u5757\u76EE\u5F55\u65E0\u6548\uFF08\u7F3A package.json\uFF09: ${opts.module}`);
   }
   let tgzPath;
   let workDir = null;
   if (opts.tgz) {
-    tgzPath = path26.resolve(opts.tgz);
-    if (!existsSync22(tgzPath)) throw new Error(`tgz \u4EA7\u7269\u4E0D\u5B58\u5728: ${opts.tgz}`);
+    tgzPath = path27.resolve(opts.tgz);
+    if (!existsSync23(tgzPath)) throw new Error(`tgz \u4EA7\u7269\u4E0D\u5B58\u5728: ${opts.tgz}`);
     const tarball = new TarballSource(tgzPath);
     try {
       const tgzPkg = JSON.parse(await tarball.readFile("package.json"));
-      const modulePkg = JSON.parse(readFileSync10(path26.join(moduleDir, "package.json"), "utf8"));
+      const modulePkg = JSON.parse(readFileSync11(path27.join(moduleDir, "package.json"), "utf8"));
       if (tgzPkg.name !== modulePkg.name) {
         throw new Error(
           `--tgz \u5305\u540D ${tgzPkg.name ?? "(\u672A\u77E5)"} \u4E0E\u6A21\u5757 ${modulePkg.name ?? "(\u672A\u77E5)"} \u4E0D\u4E00\u81F4\uFF08\u8BF7\u786E\u8BA4 --tgz \u4E0E\u6A21\u5757\u5339\u914D\uFF09`
@@ -3021,7 +3244,7 @@ async function publishModule(opts) {
       tarball.dispose();
     }
   } else {
-    workDir = mkdtempSync2(path26.join(tmpdir2(), "tbox-publish-"));
+    workDir = mkdtempSync2(path27.join(tmpdir2(), "tbox-publish-"));
     tgzPath = packModule(moduleDir, workDir);
   }
   try {
@@ -3029,9 +3252,9 @@ async function publishModule(opts) {
     if (issues.length > 0) printIssues(issues);
     const errors = issues.filter((i) => i.level === "error");
     if (errors.length > 0) {
-      throw new Error(`\u4EA7\u7269\u95E8\u7981\u5931\u8D25\uFF08${errors.length} \u5904 error\uFF09\uFF0C\u5DF2\u4E2D\u6B62\u53D1\u5E03: ${path26.basename(tgzPath)}`);
+      throw new Error(`\u4EA7\u7269\u95E8\u7981\u5931\u8D25\uFF08${errors.length} \u5904 error\uFF09\uFF0C\u5DF2\u4E2D\u6B62\u53D1\u5E03: ${path27.basename(tgzPath)}`);
     }
-    if (!workDir) workDir = mkdtempSync2(path26.join(tmpdir2(), "tbox-publish-"));
+    if (!workDir) workDir = mkdtempSync2(path27.join(tmpdir2(), "tbox-publish-"));
     const { execFileSync: execFileSync4 } = await import("child_process");
     const registryArgs = opts.registry ? ["--registry", opts.registry] : [];
     execFileSync4(
@@ -3040,7 +3263,7 @@ async function publishModule(opts) {
       { stdio: "inherit", cwd: workDir }
     );
     console.log(
-      `\u2705 \u5DF2\u53D1\u5E03 ${path26.basename(tgzPath)}${opts.registry ? ` \u2192 ${opts.registry}` : ""}${opts.dryRun ? "\uFF08dry-run\uFF09" : ""}`
+      `\u2705 \u5DF2\u53D1\u5E03 ${path27.basename(tgzPath)}${opts.registry ? ` \u2192 ${opts.registry}` : ""}${opts.dryRun ? "\uFF08dry-run\uFF09" : ""}`
     );
   } finally {
     if (workDir) {
@@ -3055,7 +3278,8 @@ async function publishModule(opts) {
 // src/index.ts
 function createProgram() {
   const program = new Command();
-  program.name("tbox-app").description("tbox \u7EC4\u4EF6\u5316\u5E94\u7528 CLI\uFF1Acreate / module add|remove|list|sync|diff|doctor").version("0.1.0");
+  const pkgJson = createRequire3(import.meta.url)("../package.json");
+  program.name("tbox-app").description("tbox \u7EC4\u4EF6\u5316\u5E94\u7528 CLI\uFF1Acreate / module add|remove|list|sync|diff|doctor").version(pkgJson.version);
   program.command("create <name>").description("\u4ECE\u6A21\u677F\u751F\u6210\u591A\u5305 workspace \u5E94\u7528\u9AA8\u67B6").option("--source <\u8DEF\u5F84>", "\u6A21\u677F\u6E90\uFF08\u672C\u5730\u76EE\u5F55 / \u6A21\u677F pack tgz / registry \u5305 @scope/pkg[@version]\uFF09").option("--local-deps <tgz\u76EE\u5F55>", "\u6CE8\u5165\u5E73\u53F0 overrides\uFF08file: \u672C\u5730\u53D1\u5E03\u6001 tgz\uFF0Cinstall \u79BB\u7EBF\u9A8C\u8BC1\u6001\uFF1B\u751F\u4EA7 B \u6863\u4E0D\u4F20\uFF09").option("--registry <url>", "\u62C9\u53D6 registry\uFF08registry \u6E90\u65F6\u751F\u6548\uFF1B\u7F3A\u7701\u81EA\u52A8\u89E3\u6790\u73AF\u5883\u955C\u50CF\uFF09").option("--force", "\u8986\u76D6\u5DF2\u5B58\u5728\u76EE\u5F55").action(async (name, opts) => {
     try {
       await createApp({ name, source: opts.source ?? "", force: opts.force, localDeps: opts.localDeps, registry: opts.registry });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tbox.cn/app-cli",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "type": "module",
   "description": "tbox-app CLI：create / module add|remove|list|sync|diff|doctor|update|publish（纯函数核心 + commander 薄壳）。",
   "bin": {