create-weapp-vite 2.8.17 → 2.9.1

package/README.md

@@ -8,7 +8,7 @@
 
 - 交互式创建或非交互式参数创建
 - 内置多种模板（默认、原生多平台 + Web、Vue SFC 多平台 + Web、Wevu、Wevu + TDesign、Tailwindcss、TDesign、Vant、插件、组件库）
-- 自动对齐 `weapp-vite` 与 `wevu` 版本
+- 默认不联网查询版本，使用随包依赖；可显式按用户 registry 查询兼容稳定版
 - 自动处理 `.gitignore` 写入
 - 可选安装推荐的 AI skills（`sonofmagic/skills`）
 - 生成带来源标记的项目级 `AGENTS.md`，并保留用户维护的 `AGENTS.local.md`
@@ -33,10 +33,10 @@ npx create-weapp-vite
 pnpm create weapp-vite
 ```
 
-交互流程会默认询问是否安装推荐的 AI skills，并提示将执行：
+交互流程询问是否安装推荐的 AI skills，默认选择“否”。显式安装时执行：
 
 ```bash
-npx skills add sonofmagic/skills
+npx --yes skills add sonofmagic/skills
 ```
 
 如果你暂时不想安装，也可以先跳过，后面再手动执行上面的命令。
@@ -57,6 +57,9 @@ pnpm create weapp-vite my-app wevu --install-skills
 
 # 显式跳过推荐 skills 安装
 pnpm create weapp-vite my-app wevu --no-install-skills
+
+# 默认使用随包版本；需要联网更新兼容版本时显式启用
+pnpm create weapp-vite my-app wevu --dependency-versions=compatible --registry=https://registry.npmmirror.com/
 ```
 
 在代码中使用：
@@ -66,8 +69,68 @@ import { createProject, TemplateName } from 'create-weapp-vite'
 
 await createProject('my-app', TemplateName.wevu)
 await createProject('my-app', TemplateName.wevu, { installSkills: true })
+await createProject('my-app', TemplateName.wevu, {
+  dependencyVersionStrategy: 'compatible',
+  registry: 'https://registry.npmmirror.com/',
+})
+```
+
+## 依赖版本策略
+
+CLI 的 `--dependency-versions=compatible|bundled` 对应 API 的 `dependencyVersionStrategy`，默认 `bundled`。
+
+- `bundled`：不发起任何依赖版本查询，使用随脚手架发布的框架版本和模板依赖。生成的 semver 范围仍可能接受更新，安装后的精确版本由 lockfile 固定。
+- `compatible`：按用户实际安装源查询模板使用的 `weapp-vite`、`wevu`、`@weapp-vite/dashboard`，选择每个包基线 caret 范围内共同存在的最高稳定版本，不跨大版本、不降级、不混用不同来源的版本列表。预发布基线保留随包组合。Tailwind 与核心查询并行，共享预算，只在模板原有兼容范围内更新；精确版本保持不变。
+- 主查询最多 4 秒，失败后最多再用 1 秒探测一个公共备用源，全部网络等待最多 5 秒。失败保留随包组合；备用源结果仅提供恢复提示，不能证明用户当前源可安装的新版不会写入项目。企业私有源不自动切换公共源。
+
+AI skills 是独立的可选联网步骤，需要 npm 和 GitHub 可达。交互默认跳过，也可用 `--no-install-skills` 明确禁用；显式安装最长等待 60 秒，超时清理进程，保留已经生成的项目并提示手动重试。
+
+## Registry 与代理
+
+新增 CLI 参数 `--registry=<url>` 和 API 选项 `registry?: string`。普通 registry 的优先级为：显式参数 → `CREATE_WEAPP_VITE_REGISTRY` → `npm_config_registry` / `NPM_CONFIG_REGISTRY` / `pnpm_config_registry` → 目标项目 `.npmrc` → 用户 `.npmrc` → npm 默认源。
+
+作用域配置（如 `@weapp-vite:registry`）继续遵循 npm 规则；普通 `--registry` 不覆盖作用域源。代理、`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`、npm 的 `proxy` / `https-proxy`、`cafile` 与认证配置交给 npm 的网络栈处理。保持证书校验，不通过关闭 TLS 校验解决网络问题。诊断不会打印 token 或代理凭据。携带认证或客户端证书的 registry 必须直接返回元数据；重定向会触发随包版本回退，避免凭据被转发。
+
+脚手架按生成项目的安装边界读取 `.npmrc`：处于已有 pnpm workspace 时使用最近 workspace 根目录的配置；独立项目使用目标目录配置，不继承普通父项目中无法被后续安装继承的配置。脚手架不改写项目或全局 `.npmrc`。通常创建后执行：
+
+```bash
+cd my-app
+pnpm install
+pnpm build
+pnpm dev
+```
+
+独立新项目会生成 `pnpm-workspace.yaml`，明确声明模板依赖的构建脚本审批策略，避免 pnpm 12 因未审批的依赖脚本中止安装；项目自身的 `wv prepare` 仍正常执行。已有项目或父级 `pnpm-workspace.yaml` 会保留，已有项目遇到 `ERR_PNPM_IGNORED_BUILDS` 时，可按团队策略执行 `pnpm approve-builds`。
+
+通过 `--registry` 或 registry 环境变量临时选源时，安装提示会显式保留该源，避免 pnpm 原生入口忽略临时环境配置。按创建完成后打印的命令安装，例如：
+
+```bash
+pnpm --config.registry=https://registry.npmmirror.com/ install
 ```
 
+`pnpm --config.registry=... create` 中的临时配置不一定传给脚手架子进程；启用 `compatible` 时，请同时传 `--registry=...`，或设置 `CREATE_WEAPP_VITE_REGISTRY`。仅设置脚手架参数不能改变 pnpm 下载脚手架本身使用的源。
+
+## 国内镜像、缓存与故障恢复
+
+首次 `pnpm create weapp-vite` 下载由 pnpm 负责；包尚未下载时，脚手架的容错逻辑无法执行。镜像中的框架包、脚手架包和 tarball 可能不同步。完全离线也只有在脚手架及其依赖已经缓存后，才可能进入本地模板生成。
+
+先向当前可达的源查询版本：
+
+```bash
+pnpm --config.registry=https://registry.npmmirror.com/ view create-weapp-vite version
+pnpm --config.registry=https://registry.npmjs.org/ view create-weapp-vite version
+```
+
+选择包含本次修复且该源已同步的精确版本，将下面的 `<version>` 替换为查询结果，再运行：
+
+```bash
+pnpm --config.registry=https://registry.npmmirror.com/ dlx create-weapp-vite@<version> my-app wevu
+```
+
+如果当前镜像尚未同步且官方源可达，可将命令中的 registry 改为官方源；官方源不可达时使用可用镜像或已配置的代理，不必强制直连。指定精确版本能避开旧 `latest` 执行缓存；旧脚手架本身不会获得新版代码中的修复。历史 `2.9.0` 及更早发布版本不包含本文的默认离线、代理与超时改造。
+
+安装时报 DNS、超时或连接错误时先检查 registry/代理；证书错误应配置正确 CA，401/403 应修正该源认证。包或版本 404 通常需要检查镜像同步、作用域源和 tarball 是否齐全。生成成功只说明模板完整，仍须以正常 `pnpm install`（包含 `wv prepare`）、`pnpm build` 和 `pnpm dev` 验证安装与构建。
+
 ## 配置
 
 `TemplateName` 支持以下模板：

package/dist/cli.js

@@ -1,7 +1,7 @@
-import { n as RECOMMENDED_SKILLS_INSTALL_COMMAND, t as createProject } from "./src-DOup_ePc.js";
+import { i as validateDependencyVersionStrategy, n as RECOMMENDED_SKILLS_INSTALL_COMMAND, t as createProject } from "./src-8XDUHEZA.js";
+import process from "node:process";
 import logger from "@weapp-core/logger";
 import { fs } from "@weapp-core/shared/fs";
-import process from "node:process";
 import path from "node:path";
 import { confirm, input, select } from "@inquirer/prompts";
 import { initConfig } from "@weapp-core/init";
@@ -56,7 +56,20 @@ const TEMPLATE_CHOICES = [
 function parseCliArgs(argv) {
 	const positionals = [];
 	let installSkills;
+	let dependencyVersionStrategy = "bundled";
+	let registry;
 	for (const arg of argv) {
+		if (arg.startsWith("--registry=")) {
+			registry = arg.slice(11);
+			if (!registry) throw new Error("请使用 --registry=<http(s) URL>");
+			continue;
+		}
+		if (arg === "--registry") throw new Error("请使用 --registry=<http(s) URL>");
+		if (arg.startsWith("--dependency-versions=")) {
+			dependencyVersionStrategy = arg.slice(22);
+			continue;
+		}
+		if (arg === "--dependency-versions") throw new Error("请使用 --dependency-versions=compatible 或 --dependency-versions=bundled");
 		if (arg === "--install-skills") {
 			installSkills = true;
 			continue;
@@ -67,11 +80,14 @@ function parseCliArgs(argv) {
 		}
 		positionals.push(arg);
 	}
+	validateDependencyVersionStrategy(dependencyVersionStrategy);
 	return {
 		command: positionals[0],
 		targetDir: positionals[0],
 		templateName: positionals[1],
-		installSkills
+		installSkills,
+		dependencyVersionStrategy,
+		registry
 	};
 }
 async function run() {
@@ -98,11 +114,15 @@ async function run() {
 		choices: TEMPLATE_CHOICES,
 		default: "default"
 	});
-	const installSkills = isArgMode ? argInstallSkills ?? false : await confirm({
+	const installSkills = argInstallSkills ?? (isArgMode ? false : await confirm({
 		message: `是否安装推荐的 AI skills？将执行 \`${RECOMMENDED_SKILLS_INSTALL_COMMAND}\`，也可稍后手动执行`,
-		default: true
+		default: false
+	}));
+	await createProject(targetDir, templateName, {
+		installSkills,
+		dependencyVersionStrategy: parsedArgs.dependencyVersionStrategy,
+		registry: parsedArgs.registry
 	});
-	await createProject(targetDir, templateName, { installSkills });
 }
 /**
 * @description CLI 主入口执行 Promise（便于测试或外部调用）
@@ -114,6 +134,7 @@ const runPromise = run().catch((err) => {
 		return;
 	}
 	logger.error("✗ 创建失败:", message);
+	process.exitCode = 1;
 });
 //#endregion
 export { run, runPromise };

package/dist/index.d.ts

@@ -1,4 +1,8 @@
+import "npm-registry-fetch";
 import "pkg-types";
+//#region src/dependencyVersions/index.d.ts
+type DependencyVersionStrategy = 'compatible' | 'bundled';
+//#endregion
 //#region src/enums.d.ts
 export declare enum TemplateName {
   default = "default",
@@ -17,10 +21,13 @@ export declare enum TemplateName {
 //#region src/createProject.d.ts
 interface CreateProjectOptions {
   installSkills?: boolean;
+  dependencyVersionStrategy?: DependencyVersionStrategy;
+  /** 本次依赖查询与建议安装命令使用的 registry，不写入用户配置。 */
+  registry?: string;
 }
 /**
  * @description 根据模板创建项目
  */
 export declare function createProject(targetDir?: string, templateName?: TemplateName, options?: CreateProjectOptions): Promise<void>;
 //#endregion
-export type { CreateProjectOptions };
+export type { CreateProjectOptions, DependencyVersionStrategy };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { r as TemplateName, t as createProject } from "./src-DOup_ePc.js";
+import { r as TemplateName, t as createProject } from "./src-8XDUHEZA.js";
 export { TemplateName, createProject };

package/dist/{src-DOup_ePc.js → src-8XDUHEZA.js}

@@ -1,25 +1,17 @@
+import process from "node:process";
 import { fileURLToPath } from "node:url";
 import logger from "@weapp-core/logger";
 import { fs } from "@weapp-core/shared/fs";
 import path from "pathe";
-import https from "node:https";
-import { spawn } from "node:child_process";
-import process from "node:process";
-//#region ../../packages-runtime/react/package.json
-var version$4 = "0.2.8";
-//#endregion
-//#region ../../packages-runtime/wevu/package.json
-var version$3 = "7.1.4";
-//#endregion
-//#region ../dashboard/package.json
-var version$2 = "7.1.4";
-//#endregion
-//#region ../eslint/package.json
-var version$1 = "0.2.6";
-//#endregion
-//#region ../weapp-vite/package.json
-var version = "7.1.4";
-//#endregion
+import { gte, minVersion, prerelease, rcompare, satisfies, valid } from "semver";
+import { access, writeFile } from "node:fs/promises";
+import path$1 from "node:path";
+import NpmConfig from "@npmcli/config";
+import configDefinitions from "@npmcli/config/lib/definitions/index.js";
+import makeFetch from "make-fetch-happen";
+import registryFetch from "npm-registry-fetch";
+import { isIP } from "node:net";
+import { execa } from "execa";
 //#region src/generated/agents.ts
 const generatedAgentGuidelines = {
 	"default": "# AGENTS Guidelines\n\n<!-- agents-generated: v1 -->\n<!-- source: template:default; manifest-version: 1; generator-version: 1 -->\n\n## Mini-program Runtime Host APIs\n\n- 小程序 AppService 不是浏览器或 Node.js。新增 `queueMicrotask`、Web API、DOM/Node 全局或现代内建前，必须先在目标平台的真实 IDE、目标基础库和 renderer 中探测存在性与最小调用语义；浏览器、Node、类型声明和 headless simulator 结果都不能替代真实 IDE 证据。\n- 微信运行时不得假定存在 `queueMicrotask`。即使某个 DevTools 版本探测为可用，也必须使用显式兼容层，或确认项目已经启用对应的 weapp-vite runtime global 注入。\n- 项目 ESLint 配置应接入 `@weapp-vite/eslint` 的 `miniProgramRuntimeRecommended` 或 `createMiniProgramRuntimeConfig()`，只检查会进入小程序运行时的 `src` 代码；config、构建脚本、测试、Web-only、WXS 和生成产物不纳入该规则。\n\n## Local Docs First\n\n- After dependencies are installed, prefer reading local package docs under `node_modules/weapp-vite/dist/docs/` first.\n- Start with `node_modules/weapp-vite/dist/docs/index.md`, then read `README.md` and `mcp.md` as needed.\n- Prefer local package docs over stale model memory or old web pages when command behavior is unclear.\n\n## CLI Entry\n\n- This project supports both `weapp-vite` and `wv` CLI commands.\n- Treat `weapp-vite dev` and `wv dev` as equivalent forms.\n- Prefer project scripts such as `pnpm dev`, `pnpm build`, `pnpm open`, and `pnpm g` before ad-hoc shell commands.\n- Use `weapp-vite prepare` or `wv prepare` when managed support files under `.weapp-vite/` need to be refreshed.\n- Prefer `weapp-vite screenshot` or `wv screenshot` for mini-program screenshot acceptance.\n- Prefer `weapp-vite compare` or `wv compare` for mini-program screenshot diff, baseline comparison, and visual regression checks.\n- Prefer `weapp-vite ide logs --open` or `wv ide logs --open` for DevTools terminal log bridging.\n- Do not default to generic browser screenshot tools when the target is the mini-program runtime in WeChat DevTools.\n\n## AI Intent Routing\n\n- When the request mentions screenshot, 截图, 页面快照, runtime screenshot, or capture the current mini-program page, default to `weapp-vite screenshot` / `wv screenshot`.\n- When the request mentions screenshot compare, 截图对比, diff, baseline, visual regression, 像素对比, or acceptance comparison, default to `weapp-vite compare` / `wv compare`.\n- Treat these commands as the primary screenshot contract for AI workflows in this project.\n- Only fall back to generic browser screenshot tools when the target is explicitly the web runtime instead of WeChat DevTools.\n\n## Weapp-vite Workflow\n\n- Keep `vite.config.ts` as the source of truth for `weapp` config, output behavior, and IDE/MCP automation.\n- Confirm `weapp.srcRoot`, routes, subpackages, and auto-import strategy before broad refactors.\n- Prefer minimal scoped verification: targeted `pnpm build`, targeted tests, then broader checks only when required.\n- If editing package source in a monorepo dependency, rebuild the touched package before validating downstream apps to avoid stale `dist`.\n- Keep CLI ownership explicit: native `weapp-vite` commands first, IDE passthrough second.\n- For Rust/native acceleration, treat JS ↔ Rust boundary crossings as a primary performance cost. Prefer batch analysis that sends source once, parses once, and returns structured results; only put fine-grained native APIs on hot paths when profiling proves a net win.\n- Keep native AST fast paths optional and explicitly enabled. They must fall back to Babel/Oxc/Vue compiler behavior on load, parse, or runtime failure, and new native coverage needs correctness tests plus real profiling.\n\n## WeChat DevTools\n\n- Before using screenshot, preview, upload, automator, or `--open`, ensure WeChat DevTools is logged in and the service port is enabled.\n- `wv open`, `wv dev -o`, and `wv build -o` use the official DevTools CLI first, then connect automator; if the IDE is open but automator is unavailable, run `wv ide doctor --json` before retrying.\n- Use `--ide-open-strategy automator` only for explicit compatibility debugging; do not treat it as the default startup path.\n- Prefer writing screenshots to workspace paths such as `.tmp/acceptance.png`.\n\n## AI Skills\n\n- Recommend installing shared skills with `npx skills add sonofmagic/skills`.\n- In Codex/Claude environments, prefer these skills first when available:\n  - `$weapp-vite-best-practices` for config, build, subpackage, route, DevTools CLI orchestration, and screenshot/compare command work.\n  - `$weapp-vite-vue-sfc-best-practices` for `.vue` SFC macros, JSON blocks, and template compatibility.\n  - `$release-and-changeset-best-practices` for issue delivery, pnpm change intents, repoctl release decisions, and PR workflow.\n  - `$docs-and-website-sync` when documentation or AI guidance must be refreshed together with code changes.\n  - Use `$weapp-vite-best-practices` for stateful HMR, pluginRoot/dist-plugin, Web runtime compatibility, and native AST profiling; use `$wevu-best-practices` for `wevu/router` navigation semantics.\n  - Use `$weapp-devtools-e2e-best-practices` for serialized DevTools runtime suites, shared automator sessions, and known host compatibility skips.\n  - `$native-to-weapp-vite-wevu-migration` when migrating native mini-program projects to `weapp-vite + native`, or further toward Vue SFC / wevu.\n\n## Native Mini-program Authoring\n\n- Keep native page/component structure consistent with the template unless there is a clear migration goal.\n- Prefer `weapp-vite generate` or `wv generate` for new app/page/component scaffolds.\n- If migrating this project, first decide whether the target is `weapp-vite + native` or a further Vue SFC / `wevu` migration, then keep each migration wave explicit.\n\n## Local Overlay\n\n- If `AGENTS.local.md` exists in this project or directory, read it after this file and apply its project-specific additions.\n- Keep generated `AGENTS.md` files managed by the repository tooling; put user-owned custom rules in `AGENTS.local.md`.\n",
@@ -45,6 +37,469 @@ function createAgentsGuidelines(templateName) {
 	return guidelines;
 }
 //#endregion
+//#region ../../packages-runtime/react/package.json
+var version$4 = "0.2.9";
+//#endregion
+//#region ../../packages-runtime/wevu/package.json
+var version$3 = "7.2.1";
+//#endregion
+//#region ../dashboard/package.json
+var version$2 = "7.2.1";
+//#endregion
+//#region ../eslint/package.json
+var version$1 = "0.2.7";
+//#endregion
+//#region ../weapp-vite/package.json
+var version = "7.2.1";
+//#endregion
+//#region src/pnpmBuildPolicy.ts
+const WORKSPACE_CONFIG = `packages: []
+
+# 仅允许模板依赖中需要的安装脚本，新增依赖仍需单独审批。
+allowBuilds:
+  '@swc/core': true
+  '@weapp-tailwindcss/merge': true
+  oxc-resolver: true
+  rolldown: true
+
+  # 使用 registry 内的预编译包，避免额外下载或本机源码编译。
+  '@parcel/watcher': false
+  esbuild: false
+  weapp-tailwindcss: false
+`;
+/** 从目标目录向上查找 pnpm 实际使用的最近工作区边界。 */
+async function findPnpmWorkspaceRoot(root) {
+	let current = path$1.resolve(root);
+	while (true) {
+		try {
+			await access(path$1.join(current, "pnpm-workspace.yaml"));
+			return current;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const parent = path$1.dirname(current);
+		if (parent === current) return;
+		current = parent;
+	}
+}
+/** 为独立新项目生成 pnpm 构建审批，原样保留已有团队配置。 */
+async function ensurePnpmBuildPolicy(root) {
+	if (await findPnpmWorkspaceRoot(root)) return;
+	try {
+		await writeFile(path$1.join(root, "pnpm-workspace.yaml"), WORKSPACE_CONFIG, { flag: "wx" });
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	}
+}
+//#endregion
+//#region src/npm/config.ts
+const NPM_REGISTRY = "https://registry.npmjs.org/";
+const transportKeys = [
+	"proxy",
+	"httpsProxy",
+	"noProxy",
+	"ca",
+	"strictSSL"
+];
+const networkKeys = /* @__PURE__ */ new Set([
+	...transportKeys,
+	"cert",
+	"key",
+	"localAddress"
+]);
+const npmNetworkKeys = /* @__PURE__ */ new Set([
+	"registry",
+	"proxy",
+	"https-proxy",
+	"noproxy",
+	"ca",
+	"cafile",
+	"strict-ssl",
+	"cert",
+	"key",
+	"local-address"
+]);
+function flattenNetworkConfig(data, flat) {
+	const selected = Object.fromEntries(Object.entries(data).filter(([key]) => npmNetworkKeys.has(key) || key.startsWith("//") || key.startsWith("@") && key.endsWith(":registry")));
+	configDefinitions.flatten(selected, flat);
+}
+function normalizeRegistry(value) {
+	try {
+		if (typeof value !== "string" || !value.trim()) throw new Error("invalid");
+		const url = new URL(value.trim());
+		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error("invalid");
+		url.pathname = `${url.pathname.replace(/\/+$/, "")}/`;
+		return url.href;
+	} catch {
+		throw new Error("registry 必须是有效的 HTTP(S) 地址，认证信息请放在 .npmrc 中，地址不能包含凭据、查询参数或片段。");
+	}
+}
+/** 只展示源的地址，避免在诊断中暴露凭据或查询参数。 */
+function displayRegistry(registry) {
+	try {
+		const url = new URL(registry);
+		url.username = "";
+		url.password = "";
+		url.search = "";
+		url.hash = "";
+		return url.href;
+	} catch {
+		return "配置的 registry";
+	}
+}
+async function findProjectConfigDir(cwd) {
+	let current = path$1.resolve(cwd);
+	while (true) try {
+		await Promise.any([
+			".npmrc",
+			"package.json",
+			"node_modules"
+		].map((name) => access(path$1.join(current, name))));
+		return current;
+	} catch {
+		const parent = path$1.dirname(current);
+		if (parent === current) return path$1.resolve(cwd);
+		current = parent;
+	}
+}
+var ScaffoldNpmConfig = class extends NpmConfig {
+	/** 创建目录可能尚不存在；使用调用者确定的安装边界。 */
+	async loadLocalPrefix() {
+		this.localPrefix = this.cwd;
+	}
+};
+/** 读取 npm 配置但不写文件，也不修改调用者环境或主动联网。 */
+async function resolveRegistryOptions(options = {}) {
+	const env = { ...process.env };
+	const override = options.registry ?? env.CREATE_WEAPP_VITE_REGISTRY ?? env.npm_config_registry ?? env.NPM_CONFIG_REGISTRY ?? env.pnpm_config_registry ?? env.PNPM_CONFIG_REGISTRY;
+	const registryOverride = override === void 0 ? void 0 : normalizeRegistry(override);
+	if (registryOverride) {
+		delete env.NPM_CONFIG_REGISTRY;
+		env.npm_config_registry = registryOverride;
+	}
+	const target = path$1.resolve(options.projectRoot ?? options.cwd ?? process.cwd());
+	const cwd = await findPnpmWorkspaceRoot(target) ?? (options.projectRoot ? target : await findProjectConfigDir(target));
+	const config = new ScaffoldNpmConfig({
+		...configDefinitions,
+		flatten: flattenNetworkConfig,
+		npmPath: path$1.dirname(fileURLToPath(import.meta.resolve("@npmcli/config/package.json"))),
+		cwd,
+		env,
+		argv: ["node", "create-weapp-vite"],
+		warn: false
+	});
+	config.types["https-proxy"] = config.types.proxy;
+	try {
+		await config.load();
+		const flat = config.flat;
+		const resolved = {
+			registry: registryOverride ?? normalizeRegistry(flat.registry ?? NPM_REGISTRY),
+			strictSSL: flat.strictSSL !== false
+		};
+		for (const [key, value] of Object.entries(flat)) if (key.startsWith("@") && key.endsWith(":registry")) resolved[key] = normalizeRegistry(value);
+		else if (networkKeys.has(key) || key.startsWith("//")) {
+			if (value !== null && value !== void 0) resolved[key] = value;
+		}
+		if (resolved.proxy === void 0 && resolved.httpsProxy === void 0) {
+			resolved.httpsProxy = env.https_proxy || env.HTTPS_PROXY || env.http_proxy || env.HTTP_PROXY;
+			resolved.proxy = env.http_proxy || env.HTTP_PROXY;
+		}
+		resolved.noProxy = resolved.noProxy || env.no_proxy || env.NO_PROXY;
+		for (const key of ["cafile", "userconfig"]) {
+			const value = config.get(key);
+			if (typeof value === "string" && value) resolved[key] = value;
+		}
+		return resolved;
+	} catch {
+		throw new Error("无法读取 npm 网络配置，请检查 .npmrc、registry、代理与 CA 文件配置。");
+	}
+}
+/** 按 npm 的作用域规则选择源，显式普通源不会覆盖作用域配置。 */
+function registryForPackage(packageName, options) {
+	const scope = packageName.startsWith("@") ? packageName.split("/")[0] : void 0;
+	return normalizeRegistry(scope && options[`${scope}:registry`] || options.registry);
+}
+/** 公共源诊断仅复用传输配置，不携带私有源 token、作用域或客户端证书。 */
+function publicRegistryOptions(options, registry) {
+	const result = {
+		registry: normalizeRegistry(registry),
+		strictSSL: true
+	};
+	for (const key of transportKeys) if (options[key] !== void 0) Object.assign(result, { [key]: options[key] });
+	return result;
+}
+/** 仅向可选安装子进程透传网络参数，认证仍交给 npm 自行读取用户配置。 */
+function registryEnvironment(options) {
+	const env = {
+		npm_config_registry: options.registry,
+		npm_config_strict_ssl: String(options.strictSSL)
+	};
+	for (const [key, name] of Object.entries({
+		proxy: "proxy",
+		httpsProxy: "https_proxy",
+		noProxy: "noproxy",
+		cafile: "cafile",
+		userconfig: "userconfig"
+	})) {
+		const value = options[key];
+		if (value !== void 0) env[`npm_config_${name}`] = String(value);
+	}
+	if (!options.cafile && options.ca) env.npm_config_ca = Array.isArray(options.ca) ? options.ca.join("\n") : String(options.ca);
+	return env;
+}
+//#endregion
+//#region src/npm/proxy.ts
+function bypassProxy(url, noProxy) {
+	const hostname = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+	const port = url.port || (url.protocol === "https:" ? "443" : "80");
+	return noProxy.toLowerCase().split(/[,\s]+/).filter(Boolean).some((entry) => {
+		if (entry === "*") return true;
+		const parsed = isIP(entry) === 6 ? [entry, entry] : /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(entry);
+		if (!parsed || parsed[2] && parsed[2] !== port) return false;
+		const host = parsed[1].replace(/^\[|\]$/g, "").replace(/^\*?\./, "");
+		return hostname === host || !isIP(hostname) && hostname.endsWith(`.${host}`);
+	});
+}
+/** 显式决定代理或直连，避免 npm transport 再从缓存的环境变量恢复已禁用代理。 */
+function proxyOptions(uri, options) {
+	const proxy = options.httpsProxy ?? options.proxy ?? process.env.https_proxy ?? process.env.HTTPS_PROXY ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
+	const noProxy = options.noProxy ?? process.env.no_proxy ?? process.env.NO_PROXY ?? "";
+	if (!proxy || bypassProxy(new URL(uri), noProxy)) return { agent: false };
+	return {
+		proxy,
+		noProxy: []
+	};
+}
+//#endregion
+//#region src/npm/transport.ts
+const { getAuth } = registryFetch;
+/** 复用 npm 的认证解析和网络传输，限制认证请求的重定向边界。 */
+async function requestMetadata(uri, options, signal, timeout) {
+	const auth = getAuth(uri, options);
+	const headers = { accept: "application/vnd.npm.install-v1+json" };
+	if (auth.token) headers.authorization = `Bearer ${auth.token}`;
+	else if (auth.auth) headers.authorization = `Basic ${auth.auth}`;
+	const cert = auth.cert || options.cert;
+	const key = auth.key || options.key;
+	const fetchOptions = {
+		ca: options.ca,
+		cert,
+		key,
+		headers,
+		localAddress: options.localAddress,
+		strictSSL: options.strictSSL,
+		redirect: "manual",
+		retry: {
+			retries: 1,
+			factor: 2,
+			minTimeout: 150,
+			maxTimeout: 300
+		},
+		timeout,
+		signal
+	};
+	let target = uri;
+	for (let redirects = 0;; redirects++) {
+		const response = await makeFetch(target, {
+			...fetchOptions,
+			...proxyOptions(target, options)
+		});
+		if (response.ok) return response.json();
+		response.body.destroy();
+		const location = response.headers.get("location");
+		if ([
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) && location && redirects < 5 && !headers.authorization && !cert && !key) {
+			const next = new URL(location, target);
+			if (!["https:", "http:"].includes(next.protocol) || next.username || next.password) throw new Error("registry redirect is invalid");
+			target = next.href;
+			continue;
+		}
+		throw Object.assign(/* @__PURE__ */ new Error("registry HTTP request failed"), { statusCode: response.status });
+	}
+}
+//#endregion
+//#region src/npm/index.ts
+const REQUEST_TIMEOUT_MS = 5e3;
+function requestError(error, registry) {
+	const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
+	const status = error && typeof error === "object" && "statusCode" in error ? Number(error.statusCode) : 0;
+	const reason = status >= 400 && status <= 599 ? `HTTP ${status}` : [
+		"ECONNRESET",
+		"ECONNREFUSED",
+		"ENOTFOUND",
+		"EAI_AGAIN",
+		"ETIMEDOUT",
+		"CERT_HAS_EXPIRED",
+		"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+		"DEPTH_ZERO_SELF_SIGNED_CERT"
+	].includes(code) ? code : "连接失败或响应无效";
+	return /* @__PURE__ */ new Error(`registry ${displayRegistry(registry)} 查询失败（${reason}）`);
+}
+async function requestJson(packageName, suffix = "", signal, options) {
+	if (signal?.aborted) throw new Error("registry 查询已取消");
+	const resolved = options ?? await resolveRegistryOptions();
+	const registry = registryForPackage(packageName, resolved);
+	const controller = new AbortController();
+	let rejectDeadline = () => {};
+	const deadline = new Promise((_resolve, reject) => {
+		rejectDeadline = reject;
+	});
+	function cancel(message) {
+		const error = new Error(message);
+		controller.abort(error);
+		rejectDeadline(error);
+	}
+	const abort = () => cancel("registry 查询已取消");
+	const timer = setTimeout(cancel, REQUEST_TIMEOUT_MS, `registry 查询超过 ${REQUEST_TIMEOUT_MS / 1e3} 秒`);
+	signal?.addEventListener("abort", abort, { once: true });
+	if (signal?.aborted) abort();
+	try {
+		const metadata = requestMetadata(`${registry}${encodeURIComponent(packageName)}${suffix}`, {
+			...resolved,
+			registry
+		}, controller.signal, REQUEST_TIMEOUT_MS);
+		return await Promise.race([metadata, deadline]);
+	} catch (error) {
+		if (controller.signal.aborted) throw controller.signal.reason;
+		throw requestError(error, registry);
+	} finally {
+		clearTimeout(timer);
+		signal?.removeEventListener("abort", abort);
+	}
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** 从配置的 npm registry 获取包的已发布版本列表。 */
+async function getPackageVersionsFromNpm(packageName, signal, options) {
+	const metadata = await requestJson(packageName, "", signal, options);
+	if (!isRecord(metadata) || !isRecord(metadata.versions)) throw new Error("registry 响应缺少有效的 versions 信息");
+	return Object.keys(metadata.versions);
+}
+//#endregion
+//#region src/dependencyVersions/compatible.ts
+/** 仅选择所有已使用核心包共同发布、且兼容各自基线的最高稳定版本。 */
+function findCompatibleVersion(packages) {
+	if (packages.length === 0 || packages.some((pkg) => !valid(pkg.version) || prerelease(pkg.version))) return;
+	return packages[0].versions.filter((version) => valid(version) && !prerelease(version)).filter((version) => packages.every((pkg) => pkg.versions.includes(version) && gte(version, pkg.version) && satisfies(version, `^${pkg.version}`))).sort(rcompare)[0];
+}
+//#endregion
+//#region src/dependencyVersions/deadline.ts
+/** 将整个查询批次约束在同一时间预算内，并清理未完成的请求。 */
+async function queryWithDeadline(query, timeoutMs) {
+	const controller = new AbortController();
+	let timer;
+	try {
+		const deadline = new Promise((_resolve, reject) => {
+			timer = setTimeout(() => {
+				const error = /* @__PURE__ */ new Error("registry 查询超时");
+				controller.abort(error);
+				reject(error);
+			}, timeoutMs);
+		});
+		return await Promise.race([query(controller.signal), deadline]);
+	} catch (error) {
+		controller.abort(error);
+		throw error;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+//#endregion
+//#region src/dependencyVersions/index.ts
+const BUNDLED_VERSIONS = {
+	"weapp-vite": version,
+	"wevu": version$3,
+	"@weapp-vite/dashboard": version$2,
+	"@weapp-vite/react": version$4,
+	"@weapp-vite/eslint": version$1
+};
+const CORE_PACKAGES = [
+	"weapp-vite",
+	"wevu",
+	"@weapp-vite/dashboard"
+];
+const DEPENDENCY_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+const PRIMARY_TIMEOUT_MS = 4e3;
+const FALLBACK_TIMEOUT_MS = 1e3;
+const PUBLIC_REGISTRIES = ["https://registry.npmjs.org/", "https://registry.npmmirror.com/"];
+/** 校验依赖版本策略，避免无效选项在创建文件后才报错。 */
+function validateDependencyVersionStrategy(value) {
+	if (value !== "compatible" && value !== "bundled") throw new Error(`无效的依赖版本策略：${String(value)}，仅支持 compatible 或 bundled`);
+}
+function hasDependency(pkg, name) {
+	return DEPENDENCY_FIELDS.some((field) => pkg[field]?.[name] !== void 0);
+}
+function setDependencyVersion(pkg, name, version) {
+	for (const field of DEPENDENCY_FIELDS) if (pkg[field]?.[name] !== void 0) pkg[field][name] = `^${version}`;
+}
+/** 备用源仅用于恢复提示，不能把备用源中的新版写进当前安装源的项目。 */
+async function suggestFallbackRegistry(names, options) {
+	if (!PUBLIC_REGISTRIES.includes(options.registry) || Object.keys(options).some((key) => key.startsWith("@") && key.endsWith(":registry"))) return;
+	const registry = PUBLIC_REGISTRIES.find((value) => value !== options.registry);
+	const fallback = publicRegistryOptions(options, registry);
+	try {
+		await queryWithDeadline(async (signal) => {
+			if (!findCompatibleVersion(await Promise.all(names.map(async (name) => ({
+				version: BUNDLED_VERSIONS[name],
+				versions: await getPackageVersionsFromNpm(name, signal, fallback)
+			}))))) throw new Error("备用源尚未同步");
+		}, FALLBACK_TIMEOUT_MS);
+		logger.warn(`备用源 ${displayRegistry(registry)} 的核心版本可查询；如当前源无法安装，可用 pnpm --config.registry=${registry} install 重试。项目仍保留随包版本。`);
+	} catch {}
+}
+/** 根据当前安装源解析兼容版本；默认离线，并始终保留完整的随包回退组合。 */
+async function resolveDependencyVersions(pkg, strategy = "bundled", network) {
+	validateDependencyVersionStrategy(strategy);
+	for (const [name, version] of Object.entries(BUNDLED_VERSIONS)) setDependencyVersion(pkg, name, version);
+	const names = CORE_PACKAGES.filter((name) => hasDependency(pkg, name));
+	const tailwindSpec = pkg.devDependencies?.["weapp-tailwindcss"];
+	if (strategy === "bundled" || names.length === 0 && !tailwindSpec) return { strategy: "bundled" };
+	const bundledDescription = names.map((name) => `${name}@${BUNDLED_VERSIONS[name]}`).join("、");
+	if (names.some((name) => !valid(BUNDLED_VERSIONS[name]) || prerelease(BUNDLED_VERSIONS[name]))) {
+		logger.warn(`预发布基线保持随包版本，不自动更新：${bundledDescription}`);
+		return { strategy: "bundled" };
+	}
+	const options = network ?? await resolveRegistryOptions();
+	try {
+		const { coreVersion, tailwindVersion } = await queryWithDeadline(async (signal) => {
+			const [candidates, tailwindVersions] = await Promise.all([Promise.all(names.map(async (name) => ({
+				version: BUNDLED_VERSIONS[name],
+				versions: await getPackageVersionsFromNpm(name, signal, options)
+			}))), tailwindSpec ? getPackageVersionsFromNpm("weapp-tailwindcss", signal, options) : void 0]);
+			const coreVersion = findCompatibleVersion(candidates);
+			if (names.length && !coreVersion) throw new Error("未找到核心依赖共同发布的兼容稳定版本");
+			const tailwindBaseline = tailwindSpec && minVersion(tailwindSpec)?.version;
+			const tailwindVersion = tailwindBaseline && tailwindVersions ? findCompatibleVersion([{
+				version: tailwindBaseline,
+				versions: tailwindVersions.filter((value) => valid(value) && satisfies(value, tailwindSpec))
+			}]) : void 0;
+			if (tailwindSpec && !tailwindVersion) throw new Error("当前源缺少模板兼容的 Tailwind 版本");
+			return {
+				coreVersion,
+				tailwindVersion
+			};
+		}, PRIMARY_TIMEOUT_MS);
+		if (coreVersion) for (const name of names) setDependencyVersion(pkg, name, coreVersion);
+		if (tailwindVersion && tailwindSpec?.startsWith("^") && valid(tailwindSpec.slice(1))) pkg.devDependencies["weapp-tailwindcss"] = `^${tailwindVersion}`;
+		return { strategy: "compatible" };
+	} catch {
+		logger.warn(`当前 registry 的兼容版本查询失败、超时或没有共同版本，已使用随包版本：${bundledDescription}。网络等待总上限为 5 秒。`);
+		if (names.length) await suggestFallbackRegistry(names, options);
+		return { strategy: "bundled" };
+	}
+}
+//#endregion
 //#region src/enums.ts
 let TemplateName = /* @__PURE__ */ function(TemplateName) {
 	TemplateName["default"] = "default";
@@ -61,6 +516,88 @@ let TemplateName = /* @__PURE__ */ function(TemplateName) {
 	return TemplateName;
 }({});
 //#endregion
+//#region src/installationCommand.ts
+const SAFE_REGISTRY_RE = /^https?:\/\/[\w.:/-]+$/;
+/** 生成可复制的安装命令；Windows 的特殊地址使用明确标注的 PowerShell 语法。 */
+function installationCommand(registry, platform = process.platform) {
+	if (!registry) return "pnpm install";
+	if (SAFE_REGISTRY_RE.test(registry)) return `pnpm --config.registry=${registry} install`;
+	const quoted = platform === "win32" ? `'${registry.replaceAll("'", "''")}'` : `'${registry.replaceAll("'", "'\\''")}'`;
+	return `${platform === "win32" ? "PowerShell: " : ""}pnpm --config.registry=${quoted} install`;
+}
+//#endregion
+//#region src/skills.ts
+const RECOMMENDED_SKILLS_SOURCE = "sonofmagic/skills";
+const RECOMMENDED_SKILLS_INSTALL_COMMAND = `npx --yes skills add ${RECOMMENDED_SKILLS_SOURCE}`;
+const SKILLS_INSTALL_TIMEOUT_MS = 6e4;
+async function terminateSkillsProcessTree(child) {
+	if (!child.pid) return;
+	if (process.platform === "win32") try {
+		await execa("taskkill", [
+			"/pid",
+			String(child.pid),
+			"/T",
+			"/F"
+		], {
+			stdio: "ignore",
+			windowsHide: true,
+			timeout: 5e3,
+			killSignal: "SIGKILL",
+			forceKillAfterDelay: 0
+		});
+		return;
+	} catch {
+		child.kill("SIGKILL");
+		return;
+	}
+	try {
+		process.kill(-child.pid, "SIGKILL");
+	} catch {
+		child.kill("SIGKILL");
+	}
+}
+/**
+* @description 安装推荐的 AI skills。
+*/
+async function installRecommendedSkills(cwd, options = {}) {
+	const child = execa("npx", [
+		"--yes",
+		"skills",
+		"add",
+		RECOMMENDED_SKILLS_SOURCE
+	], {
+		cwd,
+		env: {
+			...process.env,
+			...options.env
+		},
+		stdio: "inherit",
+		detached: process.platform !== "win32",
+		windowsHide: true
+	});
+	let timer;
+	let timeoutError;
+	let cleanup;
+	const deadline = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => {
+			timeoutError = /* @__PURE__ */ new Error("AI skills 安装超过 60 秒，已终止安装进程；可稍后手动安装");
+			cleanup = terminateSkillsProcessTree(child);
+			cleanup.then(() => reject(timeoutError), reject);
+		}, SKILLS_INSTALL_TIMEOUT_MS);
+	});
+	try {
+		await Promise.race([child, deadline]);
+	} catch (error) {
+		if (timeoutError) {
+			await cleanup;
+			throw timeoutError;
+		}
+		throw error;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+//#endregion
 //#region src/generated/catalog.ts
 const TEMPLATE_CATALOG = {
 	"@babel/core": "^8.0.6",
@@ -76,6 +613,7 @@ const TEMPLATE_CATALOG = {
 	"@iconify/tailwind4": "^1.2.3",
 	"@mini-types/alipay": "^3.0.14",
 	"@tailwindcss/vite": "^4.3.3",
+	"@types/d3": "^7.4.3",
 	"@types/node": "^26.6.2",
 	"@types/react": "19.3.0",
 	"@types/react-reconciler": "0.33.0",
@@ -98,7 +636,7 @@ const TEMPLATE_CATALOG = {
 	"lru-cache": "^11.5.3",
 	"magic-string": "^1.4.1",
 	"miniprogram-api-typings": "^5.2.3",
-	"oxc-parser": "^0.150.0",
+	"oxc-parser": "^0.151.0",
 	"oxc-walker": "^1.1.1",
 	"pkg-types": "^2.3.3",
 	"postcss-selector-parser": "^7.1.6",
@@ -112,11 +650,13 @@ const TEMPLATE_CATALOG = {
 	"uview-plus": "3.8.113",
 	"vite-plugin-inspect": "^12.0.2",
 	"vue-tsc": "^3.3.11",
-	"weapp-tailwindcss": "^5.5.6",
+	"weapp-tailwindcss": "^5.5.8",
 	autoprefixer: "^10.6.1",
 	axios: "^1.20.0",
 	clsx: "^2.1.1",
+	d3: "^7.9.0",
 	dayjs: "^1.11.23",
+	devframe: "1.0.0",
 	echarts: "^6.1.0",
 	esbuild: "^0.28.2",
 	eslint: "^10.11.0",
@@ -135,7 +675,7 @@ const TEMPLATE_CATALOG = {
 	stylelint: "^17.15.0",
 	tailwindcss: "^4.3.3",
 	tslib: "^2.8.1",
-	tsx: "^4.23.13",
+	tsx: "^4.23.15",
 	typescript: "^6.0.3",
 	vite: "8.3.0",
 	vue: "^3.5.43",
@@ -143,7 +683,7 @@ const TEMPLATE_CATALOG = {
 };
 const TEMPLATE_NAMED_CATALOG = {
 	"tdesign-miniprogram-fixed": { "tdesign-miniprogram": "1.16.1" },
-	"weapp-tailwindcss-fixed": { "weapp-tailwindcss": "5.5.6" },
+	"weapp-tailwindcss-fixed": { "weapp-tailwindcss": "5.5.8" },
 	latest: {
 		"miniprogram-api-typings": "^5.2.3",
 		typescript: "^6.0.3"
@@ -151,77 +691,50 @@ const TEMPLATE_NAMED_CATALOG = {
 	tailwind4: { tailwindcss: "^4.3.3" }
 };
 //#endregion
-//#region src/npm.ts
-/**
-* @description 从 npm registry 获取包的最新版本号
-*/
-function getLatestVersionFromNpm(packageName) {
-	return new Promise((resolve, reject) => {
-		const url = `https://registry.npmjs.org/${packageName}/latest`;
-		https.get(url, (res) => {
-			if (!res || res.statusCode && res.statusCode >= 400) {
-				res?.resume();
-				reject(/* @__PURE__ */ new Error(`Request to ${url} failed with status ${res?.statusCode ?? "unknown"}`));
-				return;
-			}
-			let data = "";
-			res.setEncoding("utf8");
-			res.on("data", (chunk) => data += chunk);
-			res.on("end", () => {
-				try {
-					const json = JSON.parse(data);
-					if (!json.version || typeof json.version !== "string") {
-						reject(/* @__PURE__ */ new Error(`Unexpected response when fetching ${packageName}: missing version`));
-						return;
-					}
-					resolve(json.version);
-				} catch (err) {
-					reject(err);
-				}
-			});
-			res.on("error", reject);
-		}).on("error", reject);
-	});
-}
-async function latestVersion(packageName, prefix = "^", fetch = getLatestVersionFromNpm) {
-	try {
-		const resolved = await fetch(packageName);
-		if (!resolved) return null;
-		return `${prefix}${resolved}`;
-	} catch {
-		return null;
+//#region src/templateDependencies/index.ts
+const DIGIT_RE = /\d/;
+const templateCatalogMap = { ...TEMPLATE_CATALOG };
+const templateNamedCatalogMap = Object.fromEntries(Object.entries(TEMPLATE_NAMED_CATALOG).map(([name, deps]) => [name, { ...deps }]));
+function resolveCatalogSpec(packageName, spec) {
+	if (!spec.startsWith("catalog:")) return spec;
+	const catalogName = spec.slice(8);
+	if (!catalogName) return templateCatalogMap[packageName] ?? spec;
+	const fromNamedCatalog = templateNamedCatalogMap[catalogName]?.[packageName];
+	if (fromNamedCatalog) {
+		if (fromNamedCatalog === "latest") return templateCatalogMap[packageName] ?? fromNamedCatalog;
+		return fromNamedCatalog;
 	}
+	return templateCatalogMap[packageName] ?? spec;
 }
-//#endregion
-//#region src/skills.ts
-const RECOMMENDED_SKILLS_SOURCE = "sonofmagic/skills";
-const RECOMMENDED_SKILLS_INSTALL_COMMAND = `npx skills add ${RECOMMENDED_SKILLS_SOURCE}`;
-function resolveNpxCommand() {
-	return process.platform === "win32" ? "npx.cmd" : "npx";
-}
-/**
-* @description 安装推荐的 AI skills。
-*/
-async function installRecommendedSkills(cwd) {
-	const command = resolveNpxCommand();
-	await new Promise((resolve, reject) => {
-		const child = spawn(command, [
-			"skills",
-			"add",
-			RECOMMENDED_SKILLS_SOURCE
-		], {
-			cwd,
-			stdio: "inherit"
-		});
-		child.on("error", reject);
-		child.on("exit", (code) => {
-			if (code === 0) {
-				resolve();
-				return;
+function normalizeTemplateDependencySpecs(pkgJson) {
+	for (const field of [
+		"dependencies",
+		"devDependencies",
+		"peerDependencies",
+		"optionalDependencies"
+	]) {
+		const deps = pkgJson[field];
+		if (!deps) continue;
+		for (const [name, rawSpec] of Object.entries(deps)) {
+			if (typeof rawSpec !== "string" || !rawSpec) continue;
+			const spec = rawSpec;
+			if (spec.startsWith("catalog:")) deps[name] = resolveCatalogSpec(name, spec);
+			else if (spec.startsWith("workspace:")) {
+				const workspaceSpec = spec.slice(10);
+				if (workspaceSpec && DIGIT_RE.test(workspaceSpec)) {
+					deps[name] = workspaceSpec;
+					continue;
+				}
+				const fromCatalog = templateCatalogMap[name];
+				if (fromCatalog) deps[name] = fromCatalog;
 			}
-			reject(/* @__PURE__ */ new Error(`skills install exited with code ${code ?? "unknown"}`));
-		});
-	});
+		}
+	}
+}
+function ensureManagedTypeScriptDevDependencies(pkgJson) {
+	pkgJson.devDependencies ??= {};
+	if (pkgJson.dependencies?.["@types/node"] || pkgJson.devDependencies["@types/node"] || pkgJson.peerDependencies?.["@types/node"] || pkgJson.optionalDependencies?.["@types/node"]) return;
+	pkgJson.devDependencies["@types/node"] = templateCatalogMap["@types/node"];
 }
 //#endregion
 //#region src/gitignore.ts
@@ -341,7 +854,7 @@ async function writeJsonFile(filepath, data, spaces = 2) {
 		throw new FsWriteError(filepath, error);
 	}
 }
-async function writeFile(filepath, contents) {
+async function writeFile$1(filepath, contents) {
 	try {
 		await fs.outputFile(filepath, contents, "utf8");
 	} catch (error) {
@@ -356,14 +869,13 @@ async function updateGitIgnore(options) {
 	const existing = await readFileIfExists(gitignorePath);
 	const merged = mergeGitignore(existing);
 	if (write && merged !== (existing ?? "")) {
-		await writeFile(gitignorePath, merged);
+		await writeFile$1(gitignorePath, merged);
 		logger.log(`✨ 更新 ${path.relative(root, gitignorePath)} 成功!`);
 	}
 	return merged;
 }
 //#endregion
 //#region src/createProject.ts
-const DIGIT_RE = /\d/;
 const CRLF_RE = /\r\n/g;
 const WINDOWS_VERBATIM_PATH_RE = /^\\\\\?\\/;
 const TOURIST_APP_ID = "touristappid";
@@ -381,8 +893,6 @@ const TEMPLATE_DIR_MAP = {
 	["tdesign"]: "weapp-vite-tailwindcss-tdesign-template",
 	["vant"]: "weapp-vite-tailwindcss-vant-template"
 };
-const templateCatalogMap = { ...TEMPLATE_CATALOG };
-const templateNamedCatalogMap = Object.fromEntries(Object.entries(TEMPLATE_NAMED_CATALOG).map(([name, deps]) => [name, { ...deps }]));
 function resolveWorkspaceTemplateDir(templateName) {
 	const templateDirName = TEMPLATE_DIR_MAP[templateName];
 	return templateDirName ? path.resolve(moduleDir, "../../../templates", templateDirName) : path.resolve(moduleDir, "../../../templates", templateName);
@@ -412,7 +922,7 @@ async function resolveTemplateDirs(templateName) {
 function shouldSkipTemplateFile(filePath, templateRoot) {
 	const relativePath = normalizeTemplateRelativePath(path.relative(normalizeTemplatePath(templateRoot), normalizeTemplatePath(filePath)));
 	if (!relativePath) return false;
-	return hasTemplatePathSegment(relativePath, (segment) => segment === "node_modules") || hasTemplatePathSegment(relativePath, (segment) => segment === ".weapp-vite") || hasTemplatePathSegment(relativePath, isGeneratedOutputSegment) || hasTemplatePathSegment(relativePath, (segment) => segment === ".turbo") || relativePath === "vite.config.ts.timestamp" || relativePath.endsWith("/vite.config.ts.timestamp") || relativePath === "CHANGELOG.md" || relativePath.endsWith("/CHANGELOG.md") || relativePath === ".DS_Store" || relativePath.endsWith("/.DS_Store");
+	return hasTemplatePathSegment(relativePath, (segment) => segment === "node_modules") || hasTemplatePathSegment(relativePath, (segment) => segment === ".weapp-vite") || hasTemplatePathSegment(relativePath, isGeneratedOutputSegment) || hasTemplatePathSegment(relativePath, (segment) => segment === ".turbo") || hasTemplatePathSegment(relativePath, (segment) => segment === ".npmrc") || relativePath === "vite.config.ts.timestamp" || relativePath.endsWith("/vite.config.ts.timestamp") || relativePath === "CHANGELOG.md" || relativePath.endsWith("/CHANGELOG.md") || relativePath === ".DS_Store" || relativePath.endsWith("/.DS_Store");
 }
 function normalizeLines(value) {
 	return value.replace(CRLF_RE, "\n").split("\n");
@@ -469,64 +979,16 @@ function createEmptyPackageJson() {
 		devDependencies: {}
 	};
 }
-async function upsertTailwindcssVersion(pkgJson) {
-	if (!pkgJson.devDependencies?.["weapp-tailwindcss"]) return;
-	const resolved = await latestVersion("weapp-tailwindcss");
-	if (resolved) pkgJson.devDependencies["weapp-tailwindcss"] = resolved;
-}
-function upsertExistingDependencyVersion(pkgJson, packageName, resolvedVersion) {
-	if (pkgJson.dependencies?.[packageName]) pkgJson.dependencies[packageName] = resolvedVersion;
-	if (pkgJson.devDependencies?.[packageName]) pkgJson.devDependencies[packageName] = resolvedVersion;
-	if (pkgJson.peerDependencies?.[packageName]) pkgJson.peerDependencies[packageName] = resolvedVersion;
-}
-function toCaretVersion(version) {
-	return version.startsWith("^") ? version : `^${version}`;
-}
-function resolveCatalogSpec(packageName, spec) {
-	if (!spec.startsWith("catalog:")) return spec;
-	const catalogName = spec.slice(8);
-	if (!catalogName) return templateCatalogMap[packageName] ?? spec;
-	const fromNamedCatalog = templateNamedCatalogMap[catalogName]?.[packageName];
-	if (fromNamedCatalog) {
-		if (fromNamedCatalog === "latest") return templateCatalogMap[packageName] ?? fromNamedCatalog;
-		return fromNamedCatalog;
-	}
-	return templateCatalogMap[packageName] ?? spec;
-}
-function normalizeTemplateDependencySpecs(pkgJson) {
-	for (const field of [
-		"dependencies",
-		"devDependencies",
-		"peerDependencies",
-		"optionalDependencies"
-	]) {
-		const deps = pkgJson[field];
-		if (!deps) continue;
-		for (const [name, rawSpec] of Object.entries(deps)) {
-			if (typeof rawSpec !== "string" || !rawSpec) continue;
-			const spec = rawSpec;
-			if (spec.startsWith("catalog:")) deps[name] = resolveCatalogSpec(name, spec);
-			else if (spec.startsWith("workspace:")) {
-				const workspaceSpec = spec.slice(10);
-				if (workspaceSpec && DIGIT_RE.test(workspaceSpec)) {
-					deps[name] = workspaceSpec;
-					continue;
-				}
-				const fromCatalog = templateCatalogMap[name];
-				if (fromCatalog) deps[name] = fromCatalog;
-			}
-		}
-	}
-}
-function ensureManagedTypeScriptDevDependencies(pkgJson) {
-	pkgJson.devDependencies ??= {};
-	if (pkgJson.dependencies?.["@types/node"] || pkgJson.devDependencies["@types/node"] || pkgJson.peerDependencies?.["@types/node"] || pkgJson.optionalDependencies?.["@types/node"]) return;
-	pkgJson.devDependencies["@types/node"] = templateCatalogMap["@types/node"];
-}
 /**
 * @description 根据模板创建项目
 */
 async function createProject(targetDir = "", templateName = "default", options = {}) {
+	const dependencyVersionStrategy = options.dependencyVersionStrategy ?? "bundled";
+	validateDependencyVersionStrategy(dependencyVersionStrategy);
+	const network = await resolveRegistryOptions({
+		registry: options.registry,
+		projectRoot: path.resolve(targetDir || ".")
+	});
 	const { preferredTemplateDir, workspaceTemplateDir } = await resolveTemplateDirs(templateName);
 	const dotGitignorePath = path.resolve(targetDir, ".gitignore");
 	const existingGitignore = await fs.pathExists(dotGitignorePath) ? await fs.readFile(dotGitignorePath, "utf8") : null;
@@ -546,14 +1008,9 @@ async function createProject(targetDir = "", templateName = "default", options =
 	const pkgJson = await fs.pathExists(templatePackagePath) ? await fs.readJSON(templatePackagePath) : createEmptyPackageJson();
 	normalizeTemplateDependencySpecs(pkgJson);
 	ensureManagedTypeScriptDevDependencies(pkgJson);
-	if (!pkgJson.devDependencies) pkgJson.devDependencies = {};
-	upsertExistingDependencyVersion(pkgJson, "weapp-vite", toCaretVersion(version));
-	upsertExistingDependencyVersion(pkgJson, "@weapp-vite/eslint", toCaretVersion(version$1));
-	upsertExistingDependencyVersion(pkgJson, "@weapp-vite/react", toCaretVersion(version$4));
-	upsertExistingDependencyVersion(pkgJson, "wevu", toCaretVersion(version$3));
-	upsertExistingDependencyVersion(pkgJson, "@weapp-vite/dashboard", toCaretVersion(version$2));
-	await upsertTailwindcssVersion(pkgJson);
+	const resolution = await resolveDependencyVersions(pkgJson, dependencyVersionStrategy, network);
 	await writeJsonFile(packageJsonPath, pkgJson);
+	await ensurePnpmBuildPolicy(targetDir);
 	await writeAgentsGuidelines(targetDir, templateName);
 	await updateGitIgnore({
 		root: targetDir,
@@ -563,15 +1020,18 @@ async function createProject(targetDir = "", templateName = "default", options =
 		logger.info(`🤖 即将安装 AI skills：${RECOMMENDED_SKILLS_INSTALL_COMMAND}`);
 		logger.info("如果你更想手动执行，也可以在项目创建后自行运行上面的命令。");
 		try {
-			await installRecommendedSkills(targetDir);
+			await installRecommendedSkills(targetDir, { env: registryEnvironment(network) });
 			logger.log("✨ 已安装推荐的 AI skills!");
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			logger.warn(`安装 AI skills 失败：${message}`);
+		} catch {
+			logger.warn("安装 AI skills 未完成（网络错误、取消或超时），项目已保留。");
 			logger.warn(`你可以稍后手动执行：${RECOMMENDED_SKILLS_INSTALL_COMMAND}`);
 		}
 	}
 	logger.log("✨ 创建模板成功!");
+	logger.info(`依赖版本策略：${resolution.strategy}；registry：${displayRegistry(network.registry)}`);
+	logger.info("进入项目目录后安装依赖：");
+	const temporaryRegistry = options.registry ?? process.env.CREATE_WEAPP_VITE_REGISTRY ?? process.env.npm_config_registry ?? process.env.NPM_CONFIG_REGISTRY ?? process.env.pnpm_config_registry ?? process.env.PNPM_CONFIG_REGISTRY;
+	logger.info(installationCommand(temporaryRegistry !== void 0 ? network.registry : void 0));
 }
 async function writeAgentsGuidelines(targetDir, templateName) {
 	const agentsPath = path.resolve(targetDir, "AGENTS.md");
@@ -584,4 +1044,4 @@ async function writeAgentsGuidelines(targetDir, templateName) {
 	await fs.writeFile(agentsPath, createAgentsGuidelines(templateName));
 }
 //#endregion
-export { RECOMMENDED_SKILLS_INSTALL_COMMAND as n, TemplateName as r, createProject as t };
+export { validateDependencyVersionStrategy as i, RECOMMENDED_SKILLS_INSTALL_COMMAND as n, TemplateName as r, createProject as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-weapp-vite",
   "type": "module",
-  "version": "2.8.17",
+  "version": "2.9.1",
   "description": "create-weapp-vite tools and runtime components for modern WeChat and multi-platform mini-program development.",
   "author": "ice breaker <1324318532@qq.com>",
   "license": "MIT",
@@ -59,11 +59,21 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.7.2",
-    "@weapp-core/init": "6.0.21",
-    "@weapp-core/logger": "3.1.5",
-    "@weapp-core/shared": "3.2.4",
+    "@npmcli/config": "^10.13.0",
+    "@weapp-core/init": "6.0.22",
+    "@weapp-core/logger": "3.1.6",
+    "@weapp-core/shared": "3.2.5",
+    "execa": "^9.6.1",
+    "make-fetch-happen": "^15.0.6",
+    "npm-registry-fetch": "^19.1.1",
     "pathe": "^2.0.3",
-    "pkg-types": "^2.3.3"
+    "pkg-types": "^2.3.3",
+    "semver": "^7.8.5"
+  },
+  "devDependencies": {
+    "@types/make-fetch-happen": "^10.0.4",
+    "@types/npm-registry-fetch": "^8.0.9",
+    "@types/npmcli__config": "^6.0.4"
   },
   "scripts": {
     "catalog:sync": "node --import tsx scripts/generate-template-catalog.ts",