feat(W1): 皮肤包完整管理-外部主题目录+热注册,zip上传/派生/编辑/删除,ThemePackageValidator收敛,Thymeleaf文件解析器,list增source/inUseCount/editable/usedBySiteNames,T-W1-01..20 全绿299/299

src/main/java/com/yunhai/cms/config/ThemeTemplateResolverConfig.java

@@ -0,0 +1,84 @@
+package com.yunhai.cms.config;
+
+import com.yunhai.cms.theme.ThemeRegistry;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.templateresolver.FileTemplateResolver;
+import org.thymeleaf.templateresolver.ITemplateResolver;
+import org.thymeleaf.templateresource.FileTemplateResource;
+import org.thymeleaf.templateresource.ITemplateResource;
+
+import java.nio.file.Paths;
+
+/**
+ * W1（G7 关键，方案 §5.4 步骤 3）：为 Thymeleaf 追加外部主题目录的文件解析器——
+ * 视图名 {@code themes/{外部包}/home} 改写为文件路径 {cms.theme.dir}/{外部包}/home.html；
+ * 内置包名不改写（返回不存在资源，checkExistence=true 时本解析器跳过，由 classpath 解析器处理）。
+ *
+ * <p>Spring 的 orderedStream 只认 {@code @Order}/{@code Ordered}（Thymeleaf 的 getOrder() 不参与
+ * Spring 排序）：必须排最前，否则 Boot 默认 SpringResourceTemplateResolver（checkExistence=false）
+ * 会抢先 claim 导致外部包模板解析不到。cacheable=true，registry.reload() 时经
+ * TemplateEngine.clearTemplateCache() 清缓存；目录经 registry.getThemeDir() 动态读取
+ * （测试可指向临时目录）。外部包门户 SSR 的前提（T-W1-19）。
+ *
+ * <p>Thymeleaf 3.0.15 的 {@code computeTemplateResource} 后两个参数是
+ * （resourceName=template+suffix, characterEncoding），非 suffix/markuper——路径由 template 自行拼接。
+ */
+@Slf4j
+@Configuration
+public class ThemeTemplateResolverConfig {
+
+    @Bean
+    @org.springframework.core.annotation.Order(Ordered.HIGHEST_PRECEDENCE)
+    public ITemplateResolver externalThemeTemplateResolver(final ThemeRegistry registry,
+            final org.springframework.beans.factory.ObjectProvider<org.thymeleaf.TemplateEngine> engineProvider) {
+        FileTemplateResolver resolver = new FileTemplateResolver() {
+            @Override
+            protected ITemplateResource computeTemplateResource(IEngineConfiguration configuration,
+                                                                String ownerTemplate, String template,
+                                                                String resourceName, String characterEncoding,
+                                                                java.util.Map<String, Object> templateResolutionAttributes) {
+                String t = template.replace('\\', '/');
+                if (t.startsWith("themes/") && !t.equals("themes/")) {
+                    String rest = t.substring("themes/".length());
+                    int slash = rest.indexOf('/');
+                    String pkg = slash > 0 ? rest.substring(0, slash) : rest;
+                    if (ThemeRegistry.SOURCE_EXTERNAL.equals(registry.sourceOf(pkg))) {
+                        String rel = (rest.endsWith(".html") ? rest : rest + ".html")
+                                .replace('/', java.io.File.separatorChar);
+                        String path = Paths.get(normalize(registry.getThemeDir()), rel).toString();
+                        return new FileTemplateResource(path, characterEncoding);
+                    }
+                }
+                // 内置包名等：返回不存在资源（checkExistence=true → 本解析器跳过，回落 classpath 解析器）
+                return new FileTemplateResource("__nonexistent_external__/themes/" + t, characterEncoding);
+            }
+        };
+        resolver.setCharacterEncoding("UTF-8");
+        resolver.setCheckExistence(true);
+        resolver.setCacheable(true);
+        registry.addReloadListener(() -> {
+            try {
+                org.thymeleaf.TemplateEngine engine = engineProvider.getIfAvailable();
+                if (engine != null) {
+                    engine.clearTemplateCache();
+                }
+            } catch (Exception e) {
+                log.warn("[cms] reload 清模板缓存失败：{}", e.getMessage());
+            }
+        });
+        log.info("[cms] 外部主题模板解析器已注册（仅外部包命中，@Order 最优先，内置包跳过回落 classpath）");
+        return resolver;
+    }
+
+    private static String normalize(String dir) {
+        String d = dir == null ? "" : dir.trim().replace('\\', '/');
+        while (d.endsWith("/")) {
+            d = d.substring(0, d.length() - 1);
+        }
+        return d;
+    }
+}

src/main/java/com/yunhai/cms/controller/api/ThemeController.java

@@ -1,9 +1,10 @@
 package com.yunhai.cms.controller.api;
 
 import com.yunhai.cms.service.impl.ThemeService;
+import com.yunhai.cms.theme.ThemeInfo;
+import com.yunhai.cms.theme.ThemePackageService;
 import com.yunhai.cms.theme.ThemeRegistry;
 import lombok.RequiredArgsConstructor;
-import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
 import org.springframework.http.CacheControl;
 import org.springframework.http.MediaType;
@@ -12,7 +13,14 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+import com.yunhai.platform.utils.model.BoaUser;
 
 import javax.servlet.http.HttpServletRequest;
 import java.time.Duration;
@@ -33,12 +41,53 @@ public class ThemeController {
 
     private final ThemeService themeService;
     private final ThemeRegistry themeRegistry;
+    private final ThemePackageService themePackageService;
 
     @GetMapping("/list")
     public List<com.yunhai.cms.model.vo.ThemeVo> list() {
         return themeService.list();
     }
 
+    /** W1（G2）：上传合规 zip——立即注册（免重启）；不合规返回逐条校验报告，不落盘不注册 */
+    @PostMapping("/upload")
+    public com.yunhai.cms.model.vo.ThemeVo upload(BoaUser authUserWithDept, @RequestParam("file") MultipartFile file) {
+        ThemeInfo info = themePackageService.upload(authUserWithDept, file);
+        return themeService.voOf(info);
+    }
+
+    /** W1（G3）：从现有包派生新皮肤（复制包体+改名，外部包可编辑可删除） */
+    @PostMapping("/derive")
+    public com.yunhai.cms.model.vo.ThemeVo derive(BoaUser authUserWithDept,
+            @RequestBody com.yunhai.cms.model.dto.ThemeDeriveRequest req) {
+        ThemeInfo info = themePackageService.derive(authUserWithDept, req.getSource(), req.getName());
+        return themeService.voOf(info);
+    }
+
+    /** W1（G4）：编辑外部包 theme.json 的 title 与参数 schema（保存后引用站点立即生效） */
+    @PutMapping("/{name}/meta")
+    public com.yunhai.cms.model.vo.ThemeVo updateMeta(BoaUser authUserWithDept,
+            @PathVariable("name") String name,
+            @RequestBody com.yunhai.cms.model.dto.ThemeMetaRequest req) {
+        ThemeInfo info = themePackageService.updateMeta(authUserWithDept, name, req.getTitle(), req.getParams());
+        return themeService.voOf(info);
+    }
+
+    /** W1（G5）：删除外部包（被用站点拒绝；内置不可删） */
+    @DeleteMapping("/{name}")
+    public java.util.Map<String, Object> remove(BoaUser authUserWithDept, @PathVariable("name") String name) {
+        themePackageService.remove(authUserWithDept, name);
+        java.util.Map<String, Object> result = new java.util.HashMap<>();
+        result.put("ok", true);
+        return result;
+    }
+
+    /** W1（G2/B4）：热重载（运维直放目录后生效；default 缺失报错且旧集合不丢） */
+    @PostMapping("/reload")
+    public List<com.yunhai.cms.model.vo.ThemeVo> reload(BoaUser authUserWithDept) {
+        themePackageService.reload(authUserWithDept);
+        return themeService.list();
+    }
+
     @GetMapping("/{name}/asset/**")
     public ResponseEntity<Resource> asset(@PathVariable("name") String name,
                                           HttpServletRequest request) {
@@ -49,7 +98,7 @@ public class ThemeController {
         if (path == null || path.isEmpty() || path.contains("..")) {
             return ResponseEntity.badRequest().build();
         }
-        Resource resource = new ClassPathResource("templates/themes/" + name + "/assets/" + path);
+        Resource resource = themeRegistry.resource(name, "assets/" + path);
         if (!resource.exists()) {
             return ResponseEntity.notFound().build();
         }

src/main/java/com/yunhai/cms/controller/portal/PortalAssetController.java

@@ -12,7 +12,6 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
 
 import javax.servlet.http.HttpServletRequest;
@@ -65,8 +64,8 @@ public class PortalAssetController {
         if (path == null || path.isEmpty() || path.contains("..")) {
             return ResponseEntity.badRequest().build();
         }
-        Resource resource = new ClassPathResource(
-                "templates/themes/" + theme + "/assets/" + path);
+        // W1（T-W1-20）：内置→ClassPathResource、外部→FileSystemResource，统一走 Registry 定位
+        Resource resource = themeRegistry.resource(theme, "assets/" + path);
         if (!resource.exists()) {
             return ResponseEntity.notFound().build();
         }

src/main/java/com/yunhai/cms/model/dto/ThemeDeriveRequest.java

@@ -0,0 +1,17 @@
+package com.yunhai.cms.model.dto;
+
+import com.yunhai.cms.theme.ThemeParam;
+import lombok.Data;
+
+import java.util.List;
+
+/** W1 皮肤包派生请求（POST /api/theme/derive） */
+@Data
+public class ThemeDeriveRequest {
+
+    /** 派生源包名（内置或外部） */
+    private String source;
+
+    /** 新包名（外部包目录名，theme.json name 同步改写） */
+    private String name;
+}

src/main/java/com/yunhai/cms/model/dto/ThemeMetaRequest.java

@@ -0,0 +1,16 @@
+package com.yunhai.cms.model.dto;
+
+import com.yunhai.cms.theme.ThemeParam;
+import lombok.Data;
+
+import java.util.List;
+
+/** W1 皮肤包元数据编辑请求（PUT /api/theme/{name}/meta）：title/参数 schema，保留其余 theme.json 字段 */
+@Data
+public class ThemeMetaRequest {
+
+    private String title;
+
+    /** 参数 schema 整体替换（key/label/type/默认值/色值合法性服务端强校验）；null=不改 */
+    private List<ThemeParam> params;
+}

src/main/java/com/yunhai/cms/model/vo/ThemeVo.java

@@ -30,6 +30,18 @@ public class ThemeVo {
     /** 可调参数 schema（管理端表单按此动态生成，方案 §6.3） */
     private List<ThemeParamVo> params;
 
+    /** 包来源（W1，G1）：builtin=内置只读 / external=外部可管 */
+    private String source;
+
+    /** 被用站点数（W1，G1：删除保护口径一致） */
+    private long inUseCount;
+
+    /** 是否可编辑/删除（W1：仅外部包 true） */
+    private boolean editable;
+
+    /** 引用站点名列表（W1：删除保护提示/前端 tooltip，与 inUseCount 同源） */
+    private List<String> usedBySiteNames;
+
     @Data
     public static class ThemeParamVo {
 

src/main/java/com/yunhai/cms/repository/CmsSiteRepository.java

@@ -21,6 +21,9 @@ public interface CmsSiteRepository extends JpaRepository<CmsSite, Integer> {
     /** 皮肤包被用站点数（W1 删除保护共用） */
     long countByTheme(String theme);
 
+    /** 使用指定皮肤包的站点（W1 删除保护：拒绝消息提示站点名） */
+    List<CmsSite> findByTheme(String theme);
+
     /** 启用站点（B-5：显式按 id 升序，/portal 默认入口跳转目标确定） */
     List<CmsSite> findByStatusOrderByIdAsc(Integer status);
 

src/main/java/com/yunhai/cms/service/impl/ThemeService.java

@@ -18,16 +18,35 @@ import java.util.List;
 public class ThemeService {
 
     private final ThemeRegistry themeRegistry;
+    private final com.yunhai.cms.repository.CmsSiteRepository siteRepository;
 
-    /** 可用主题（default 优先，其余按名称排序），管理端建站向导与站点编辑共用 */
+    /** 可用主题（default 优先，其余按名称排序），管理端建站向导与站点编辑共用。
+     *  W1（G1/T-W1-14）：增 source/inUseCount/editable——来源与删除保护口径同源（findByTheme）。 */
     public List<ThemeVo> list() {
         List<ThemeVo> result = new ArrayList<>();
         for (ThemeInfo info : themeRegistry.list()) {
-            result.add(ThemeVo.of(info));
+            result.add(voOf(info));
         }
         return result;
     }
 
+    /** 单个包 VO 装配（来源/被用数/可编辑随 Registry sourceOf 与站点仓储实时装配） */
+    public ThemeVo voOf(ThemeInfo info) {
+        ThemeVo vo = ThemeVo.of(info);
+        String source = themeRegistry.sourceOf(info.getName()) == null
+                ? ThemeRegistry.SOURCE_BUILTIN : themeRegistry.sourceOf(info.getName());
+        vo.setSource(source);
+        java.util.List<com.yunhai.cms.entity.CmsSite> usedBy = siteRepository.findByTheme(info.getName());
+        vo.setInUseCount(usedBy.size());
+        java.util.List<String> usedNames = new ArrayList<>();
+        for (com.yunhai.cms.entity.CmsSite s : usedBy) {
+            usedNames.add(s.getName());
+        }
+        vo.setUsedBySiteNames(usedNames);
+        vo.setEditable(ThemeRegistry.SOURCE_EXTERNAL.equals(source));
+        return vo;
+    }
+
     /** 未注册主题返回 null（白名单判断用） */
     public ThemeInfo get(String name) {
         return themeRegistry.get(name);

src/main/java/com/yunhai/cms/theme/ThemePackageService.java

@@ -0,0 +1,461 @@
+package com.yunhai.cms.theme;
+
+import com.yunhai.cms.entity.CmsSite;
+import com.yunhai.cms.event.SiteContentChangedEvent;
+import com.yunhai.cms.repository.CmsSiteRepository;
+import com.yunhai.platform.apistd.BizException;
+import com.yunhai.platform.utils.exception.ErrorCode;
+import com.yunhai.platform.utils.model.BoaUser;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.support.PathMatchingResourcePatternResolver;
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+
+/**
+ * 皮肤包完整管理（W1，方案 §5.4 步骤 2，D1：内置只读、外部可管）：
+ * 上传（zip 防御：条目数≤2000/单文件≤10MB/总≤20MB/zip-slip/扩展名白名单）→
+ * 解包临时目录 → 复用 Registry 校验语义（ThemePackageValidator）产出报告式错误 →
+ * 原子 move 到 {cms.theme.dir}/{name} → registry.reload()；
+ * 派生（复制包体+改名）、编辑（仅重写 theme.json 的 title/params，保留 specVersion 等）、
+ * 删除（被用站点拒绝且提示站点名；内置不可删）；写操作后发布 SiteContentChangedEvent（缓存失效）。
+ */
+@Slf4j
+@Service
+public class ThemePackageService {
+
+    private static final long MAX_TOTAL_BYTES = 20L * 1024 * 1024;
+    private static final long MAX_ENTRY_BYTES = 10L * 1024 * 1024;
+    private static final int MAX_ENTRIES = 2000;
+    private static final Pattern SAFE_ENTRY = Pattern.compile("^[A-Za-z0-9_\\-./]{1,200}$");
+    private static final Set<String> ALLOWED_EXTENSIONS = new HashSet<>(Arrays.asList(
+            ".html", ".css", ".js", ".json", ".txt", ".ico", ".svg", ".png", ".jpg", ".jpeg",
+            ".gif", ".webp", ".woff", ".woff2", ".ttf"));
+
+    private final ThemeRegistry themeRegistry;
+    private final CmsSiteRepository siteRepository;
+    private final ApplicationEventPublisher eventPublisher;
+
+    private String themeDir;
+
+    public ThemePackageService(ThemeRegistry themeRegistry, CmsSiteRepository siteRepository,
+                               ApplicationEventPublisher eventPublisher) {
+        this.themeRegistry = themeRegistry;
+        this.siteRepository = siteRepository;
+        this.eventPublisher = eventPublisher;
+        this.themeDir = System.getProperty("user.dir") + "/data/themes";
+    }
+
+    @Autowired
+    public void applyRegistryDir(ThemeRegistry registry) {
+        this.themeDir = registry.getThemeDir();
+    }
+
+    public void setThemeDir(String dir) {
+        this.themeDir = dir;
+    }
+
+    // ===== 上传（T-W1-05..12）=====
+
+    public ThemeInfo upload(BoaUser user, MultipartFile file) {
+        requireSuperAdmin(user);
+        if (file == null || file.isEmpty()) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "上传文件为空");
+        }
+        if (file.getSize() > MAX_TOTAL_BYTES) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包超过 20MB 上限（" + file.getSize() + " 字节）");
+        }
+        Path staging = null;
+        try {
+            staging = Files.createTempDirectory(Paths.get(themeDir), ".upload-");
+            List<String> report = new ArrayList<>();
+            String pkgName = extractZip(file, staging, report);
+            if (!report.isEmpty()) {
+                throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包校验未通过：" + String.join("；", report));
+            }
+            if (pkgName == null) {
+                throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包校验未通过：缺 theme.json");
+            }
+            String rootDir = singleRootDirName(staging);
+            if (rootDir != null && !rootDir.equals(pkgName)) {
+                throw new BizException(ErrorCode.PARAM_ERROR,
+                        "皮肤包校验未通过：name 与目录名不一致：" + rootDir + " != " + pkgName);
+            }
+            if (themeRegistry.contains(pkgName)
+                    && ThemeRegistry.SOURCE_BUILTIN.equals(themeRegistry.sourceOf(pkgName))) {
+                throw new BizException(ErrorCode.PARAM_ERROR,
+                        "皮肤包与内置包同名（" + pkgName + "），禁止覆盖内置包");
+            }
+            // 包内校验（复用 Registry 语义 → 报告式错误，T-W1-08/09/10）
+            validateStagedPackage(rootDir == null ? staging : staging.resolve(rootDir), report);
+            if (!report.isEmpty()) {
+                throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包校验未通过：" + String.join("；", report));
+            }
+            // 原子替换/落位（同名外部包=覆盖更新，T-W1-12）
+            Path target = Paths.get(themeDir, pkgName);
+            if (Files.exists(target)) {
+                Path old = Files.createTempDirectory(Paths.get(themeDir), ".old-");
+                moveDir(target, old.resolve("pkg"));
+            }
+            moveDir(rootDir == null ? staging : staging.resolve(rootDir), target);
+            themeRegistry.reload();
+            publishThemeChanged();
+            log.info("皮肤包 {} 上传注册成功（外部包）", pkgName);
+            return themeRegistry.get(pkgName);
+        } catch (BizException e) {
+            throw e;
+        } catch (Exception e) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包处理失败：" + e.getMessage());
+        } finally {
+            if (staging != null) {
+                deleteRecursively(staging);
+            }
+        }
+    }
+
+    /** zip 解包后：仅当 staging 下恰有一个目录且无散落文件时返回该目录名（包根目录），否则 null */
+    private static String singleRootDirName(Path staging) throws IOException {
+        List<Path> entries = new ArrayList<>();
+        try (java.util.stream.Stream<Path> children = Files.list(staging)) {
+            children.forEach(entries::add);
+        }
+        if (entries.size() == 1 && Files.isDirectory(entries.get(0))) {
+            return entries.get(0).getFileName().toString();
+        }
+        return null;
+    }
+
+    /** 解包到 staging；返回 theme.json 声明的 name（防御：zip-slip/条目数/体积/扩展名白名单） */
+    private String extractZip(MultipartFile file, Path staging, List<String> report) throws IOException {
+        String declaredName = null;
+        int entries = 0;
+        long total = 0;
+        try (ZipInputStream zip = new ZipInputStream(file.getInputStream())) {
+            ZipEntry entry;
+            byte[] buffer = new byte[8192];
+            while ((entry = zip.getNextEntry()) != null) {
+                if (++entries > MAX_ENTRIES) {
+                    report.add("zip 条目数超过 " + MAX_ENTRIES);
+                    return null;
+                }
+                String name = entry.getName().replace('\\', '/');
+                if (name.contains("..") || !SAFE_ENTRY.matcher(name).matches()) {
+                    report.add("zip 条目含非法路径：" + name);
+                    return null;
+                }
+                if (entry.isDirectory()) {
+                    continue;
+                }
+                String ext = name.lastIndexOf('.') >= 0
+                        ? name.substring(name.lastIndexOf('.')).toLowerCase() : "";
+                if (!ALLOWED_EXTENSIONS.contains(ext)) {
+                    report.add("zip 条目扩展名不允许：" + name);
+                    return null;
+                }
+                Path out = staging.resolve(name).normalize();
+                if (!out.startsWith(staging)) {
+                    report.add("zip 条目含非法路径（越界）：" + name);
+                    return null;
+                }
+                Files.createDirectories(out.getParent());
+                long written = 0;
+                try (java.io.OutputStream os = Files.newOutputStream(out)) {
+                    int n;
+                    while ((n = zip.read(buffer)) > 0) {
+                        written += n;
+                        total += n;
+                        if (written > MAX_ENTRY_BYTES) {
+                            report.add("单文件超过 10MB：" + name);
+                            return null;
+                        }
+                        if (total > MAX_TOTAL_BYTES) {
+                            report.add("皮肤包超过 20MB 上限");
+                            return null;
+                        }
+                        os.write(buffer, 0, n);
+                    }
+                }
+                if ("theme.json".equals(name) || name.endsWith("/theme.json") && name.indexOf('/') == name.length() - 11) {
+                    String json = new String(Files.readAllBytes(out), java.nio.charset.StandardCharsets.UTF_8);
+                    try {
+                        declaredName = new com.fasterxml.jackson.databind.ObjectMapper()
+                                .readTree(json).path("name").asText(null);
+                    } catch (Exception e) {
+                        declaredName = null;
+                    }
+                }
+            }
+        }
+        return declaredName;
+    }
+
+    /** 包内校验（与 Registry 同一 ThemePackageValidator 语义 → 逐条报告） */
+    private void validateStagedPackage(Path pkgDir, List<String> report) {
+        Path json = pkgDir.resolve("theme.json");
+        if (!Files.isRegularFile(json)) {
+            report.add("缺 theme.json");
+            return;
+        }
+        try {
+            com.fasterxml.jackson.databind.ObjectMapper mapper = new com.fasterxml.jackson.databind.ObjectMapper()
+                    .configure(com.fasterxml.jackson.databind.DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES,
+                            false);
+            ThemeInfo info = mapper.readValue(json.toFile(), ThemeInfo.class);
+            if (info.getName() == null) {
+                report.add("缺 theme.json（name 为空）");
+                return;
+            }
+            if (!ThemeRegistry.isValidName(info.getName())) {
+                report.add("name 不符合命名规范：" + info.getName());
+                return;
+            }
+            if (!info.getName().equals(pkgDir.getFileName().toString())) {
+                report.add("name 与目录名不一致：" + pkgDir.getFileName() + " != " + info.getName());
+                return;
+            }
+            for (String template : ThemeRegistry.requiredTemplates()) {
+                if (!Files.exists(pkgDir.resolve(template))) {
+                    report.add("缺必备模板 " + template);
+                }
+            }
+            if (!Files.exists(pkgDir.resolve("fragments").resolve("head.html"))) {
+                report.add("缺 fragments/head.html 公共片段");
+            }
+            try {
+                ThemePackageValidator.validateParams(info);
+            } catch (IllegalArgumentException e) {
+                report.add(e.getMessage());
+            }
+            if (!Files.exists(pkgDir.resolve(info.screenshotPath()))) {
+                report.add("声明的 screenshot 不存在：" + info.screenshotPath());
+            }
+        } catch (IOException e) {
+            report.add("theme.json 不是合法 JSON");
+        }
+    }
+
+    // ===== 派生（T-W1-17）=====
+
+    public ThemeInfo derive(BoaUser user, String sourceName, String newName) {
+        requireSuperAdmin(user);
+        if (!themeRegistry.contains(sourceName)) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包未注册：" + sourceName);
+        }
+        if (!ThemeRegistry.isValidName(newName)) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "新皮肤包名不符合命名规范：" + newName);
+        }
+        if (themeRegistry.contains(newName)) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包已存在：" + newName);
+        }
+        Path target = Paths.get(themeDir, newName);
+        try {
+            Files.createDirectories(target);
+            if (ThemeRegistry.SOURCE_EXTERNAL.equals(themeRegistry.sourceOf(sourceName))) {
+                copyDir(Paths.get(themeDir, sourceName), target);
+            } else {
+                copyClasspathPackage(sourceName, target);
+            }
+            // 改写 theme.json：name=newName（title 追加副名，其余保留）
+            Path json = target.resolve("theme.json");
+            String content = new String(Files.readAllBytes(json), java.nio.charset.StandardCharsets.UTF_8);
+            content = content.replaceAll("(\"name\"\\s*:\\s*\")" + sourceName + "(\")",
+                    "$1" + newName + "$2");
+            Files.write(json, content.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+            themeRegistry.reload();
+            publishThemeChanged();
+            log.info("皮肤包 {} 派生为 {}（外部包）", sourceName, newName);
+            return themeRegistry.get(newName);
+        } catch (BizException e) {
+            throw e;
+        } catch (Exception e) {
+            deleteRecursively(target);
+            throw new BizException(ErrorCode.PARAM_ERROR, "派生皮肤包失败：" + e.getMessage());
+        }
+    }
+
+    /** 内置包（可能在 jar 内）复制：PathMatchingResourcePatternResolver 遍历其全部资源 */
+    private void copyClasspathPackage(String sourceName, Path target) throws IOException {
+        PathMatchingResourcePatternResolver resolver = new PathMatchingResourcePatternResolver();
+        org.springframework.core.io.Resource[] resources =
+                resolver.getResources("classpath*:templates/themes/" + sourceName + "/**");
+        for (org.springframework.core.io.Resource r : resources) {
+            String url = r.getURL().toString().replace('\\', '/');
+            int root = url.indexOf("templates/themes/" + sourceName + "/");
+            if (root < 0) {
+                continue;
+            }
+            String rel = url.substring(root + ("templates/themes/" + sourceName + "/").length());
+            if (rel.isEmpty() || url.endsWith("/")) {
+                continue;
+            }
+            Path out = target.resolve(rel);
+            Files.createDirectories(out.getParent());
+            try (java.io.InputStream in = r.getInputStream()) {
+                Files.copy(in, out, java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+            }
+        }
+        // 兜底：theme.json 未被 ** 命中时显式拷贝
+        if (!Files.exists(target.resolve("theme.json"))) {
+            try (java.io.InputStream in = new ClassPathResource(
+                    "templates/themes/" + sourceName + "/theme.json").getInputStream()) {
+                Files.copy(in, target.resolve("theme.json"),
+                        java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+            }
+        }
+    }
+
+    // ===== 编辑（T-W1-17：title/参数 schema；保留 specVersion/模板清单字段）=====
+
+    public ThemeInfo updateMeta(BoaUser user, String name, String title, List<ThemeParam> params) {
+        requireSuperAdmin(user);
+        if (!themeRegistry.contains(name)) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包未注册：" + name);
+        }
+        if (!ThemeRegistry.SOURCE_EXTERNAL.equals(themeRegistry.sourceOf(name))) {
+            throw new BizException(ErrorCode.FORBIDDEN, "内置包不可编辑（D1：内置只读）");
+        }
+        Path json = Paths.get(themeDir, name, "theme.json");
+        try {
+            com.fasterxml.jackson.databind.ObjectMapper mapper = new com.fasterxml.jackson.databind.ObjectMapper();
+            com.fasterxml.jackson.databind.node.ObjectNode root =
+                    (com.fasterxml.jackson.databind.node.ObjectNode) mapper.readTree(json.toFile());
+            if (StringUtils.hasText(title)) {
+                root.put("title", title);
+            }
+            if (params != null) {
+                ThemeInfo probe = new ThemeInfo();
+                probe.setParams(params);
+                try {
+                    ThemePackageValidator.validateParams(probe);
+                } catch (IllegalArgumentException e) {
+                    throw new BizException(ErrorCode.PARAM_ERROR, "参数 schema 非法：" + e.getMessage());
+                }
+                root.set("params", mapper.valueToTree(params));
+            }
+            Files.write(json, mapper.writerWithDefaultPrettyPrinter()
+                    .writeValueAsBytes(root));
+            themeRegistry.reload();
+            publishThemeChanged();
+            return themeRegistry.get(name);
+        } catch (BizException e) {
+            throw e;
+        } catch (IOException e) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "theme.json 写入失败：" + e.getMessage());
+        }
+    }
+
+    // ===== 删除（T-W1-15/16）=====
+
+    public void remove(BoaUser user, String name) {
+        requireSuperAdmin(user);
+        if (!themeRegistry.contains(name)) {
+            throw new BizException(ErrorCode.PARAM_ERROR, "皮肤包未注册：" + name);
+        }
+        if (!ThemeRegistry.SOURCE_EXTERNAL.equals(themeRegistry.sourceOf(name))) {
+            throw new BizException(ErrorCode.FORBIDDEN, "内置包不可删除（D1：内置只读）");
+        }
+        List<CmsSite> inUse = siteRepository.findByTheme(name);
+        if (!inUse.isEmpty()) {
+            List<String> names = new ArrayList<>();
+            for (CmsSite s : inUse) {
+                names.add(s.getName());
+            }
+            throw new BizException(ErrorCode.PARAM_ERROR,
+                    "皮肤包正被站点使用，无法删除：" + String.join("、", names));
+        }
+        deleteRecursively(Paths.get(themeDir, name));
+        themeRegistry.reload();
+        publishThemeChanged();
+        log.info("皮肤包 {} 已删除并热注销", name);
+    }
+
+    // ===== 热重载（T-W1-02/18）=====
+
+    public void reload(BoaUser user) {
+        requireSuperAdmin(user);
+        themeRegistry.reload();
+    }
+
+    // ===== 内部 =====
+
+    private void requireSuperAdmin(BoaUser user) {
+        if (user == null || user.getType() == null || user.getType() != 1) {
+            throw new BizException(ErrorCode.FORBIDDEN, "仅平台超管可执行该操作");
+        }
+    }
+
+    /** 引用站点缓存失效（SiteService.java:159 同款事件，PortalCacheEvictListener 整缓存 clear） */
+    private void publishThemeChanged() {
+        eventPublisher.publishEvent(new SiteContentChangedEvent(null, "theme"));
+    }
+
+    private static void moveDir(Path from, Path to) throws IOException {
+        Files.createDirectories(to.getParent());
+        try (java.util.stream.Stream<Path> walk = Files.walk(from)) {
+            walk.sorted(Comparator.naturalOrder()).forEach(p -> {
+                try {
+                    Path dst = to.resolve(from.relativize(p).toString());
+                    if (Files.isDirectory(p)) {
+                        Files.createDirectories(dst);
+                    } else {
+                        Files.createDirectories(dst.getParent());
+                        Files.move(p, dst);
+                    }
+                } catch (IOException e) {
+                    throw new IllegalStateException(e);
+                }
+            });
+        }
+        deleteRecursively(from);
+    }
+
+    private static void copyDir(Path from, Path to) throws IOException {
+        try (java.util.stream.Stream<Path> walk = Files.walk(from)) {
+            walk.forEach(p -> {
+                try {
+                    Path dst = to.resolve(from.relativize(p).toString());
+                    if (Files.isDirectory(p)) {
+                        Files.createDirectories(dst);
+                    } else {
+                        Files.createDirectories(dst.getParent());
+                        Files.copy(p, dst, java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+                    }
+                } catch (IOException e) {
+                    throw new IllegalStateException(e);
+                }
+            });
+        }
+    }
+
+    private static void deleteRecursively(Path path) {
+        if (path == null || !Files.exists(path)) {
+            return;
+        }
+        try (java.util.stream.Stream<Path> walk = Files.walk(path)) {
+            walk.sorted(Comparator.reverseOrder()).forEach(p -> {
+                try {
+                    Files.delete(p);
+                } catch (IOException ignored) {
+                }
+            });
+        } catch (IOException ignored) {
+        }
+    }
+}

src/main/java/com/yunhai/cms/theme/ThemePackageValidator.java

@@ -0,0 +1,75 @@
+package com.yunhai.cms.theme;
+
+import java.util.List;
+import java.util.function.Predicate;
+
+/**
+ * 主题包规范校验（W1 重构点，方案 §5.5：校验语义收敛于本类，Registry 与 PackageService 共用，
+ * 杜绝两套校验漂移）。原 ThemeRegistry.validate 的规则原文平移：
+ * specVersion=1、name 规范、name=目录名、必备模板（home/list/detail/single）、
+ * fragments/head.html、param 规范、screenshot 存在。
+ * existsFn 判定资源存在：classpath 包用 ClassPathResource、外部包用 Files.exists（§5.4 步骤 1）。
+ */
+public final class ThemePackageValidator {
+
+    private ThemePackageValidator() {
+    }
+
+    /** 校验不通过抛 IllegalArgumentException（bad package 语义，Registry 剔除 + log.warn） */
+    public static void validate(ThemeInfo info, String dirName, Predicate<String> existsFn) {
+        if (info == null) {
+            throw new IllegalArgumentException("清单为空");
+        }
+        if (info.getSpecVersion() == null || info.getSpecVersion() != 1) {
+            throw new IllegalArgumentException("specVersion 必须为 1");
+        }
+        if (!ThemeRegistry.isValidName(info.getName())) {
+            throw new IllegalArgumentException("name 缺失或不符合命名规范：" + info.getName());
+        }
+        if (!info.getName().equals(dirName)) {
+            throw new IllegalArgumentException("name 与目录名不一致：" + dirName + " != " + info.getName());
+        }
+        for (String template : ThemeRegistry.requiredTemplates()) {
+            if (!existsFn.test(template)) {
+                throw new IllegalArgumentException("缺必备模板 " + template);
+            }
+        }
+        // fragments/ 目录存在性以 head.html 片段代替（jar 内目录项不可靠）
+        if (!existsFn.test("fragments/head.html")) {
+            throw new IllegalArgumentException("缺 fragments/head.html 公共片段");
+        }
+        validateParams(info);
+        String shot = info.screenshotPath();
+        if (!existsFn.test(shot)) {
+            throw new IllegalArgumentException("声明的 screenshot 不存在：" + shot);
+        }
+    }
+
+    /** param 规范（key/类型/重复/cssVar 仅 color/select 必带 options）；不合法抛 IllegalArgumentException */
+    public static void validateParams(ThemeInfo info) {
+        List<ThemeParam> params = info.getParams();
+        List<String> seen = new java.util.ArrayList<>();
+        for (ThemeParam p : params) {
+            if (p.getKey() == null || !ThemeParam.KEY_PATTERN.matcher(p.getKey()).matches()) {
+                throw new IllegalArgumentException("param key 非法：" + p.getKey());
+            }
+            if (seen.contains(p.getKey())) {
+                throw new IllegalArgumentException("param key 重复：" + p.getKey());
+            }
+            seen.add(p.getKey());
+            String type = p.getType();
+            boolean knownType = ThemeParam.TYPE_COLOR.equals(type) || ThemeParam.TYPE_IMAGE.equals(type)
+                    || ThemeParam.TYPE_SELECT.equals(type) || ThemeParam.TYPE_TEXT.equals(type);
+            if (!knownType) {
+                throw new IllegalArgumentException("param " + p.getKey() + " 类型非法：" + type);
+            }
+            if (p.getCssVar() != null && !p.getCssVar().isEmpty() && !ThemeParam.TYPE_COLOR.equals(type)) {
+                throw new IllegalArgumentException("cssVar 仅允许 color 类型参数：" + p.getKey());
+            }
+            if (ThemeParam.TYPE_SELECT.equals(type)
+                    && (p.getOptions() == null || p.getOptions().isEmpty())) {
+                throw new IllegalArgumentException("select 参数缺 options：" + p.getKey());
+            }
+        }
+    }
+}

src/main/java/com/yunhai/cms/theme/ThemeRegistry.java

@@ -3,31 +3,43 @@ package com.yunhai.cms.theme;
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
 import org.springframework.core.io.support.PathMatchingResourcePatternResolver;
 import org.springframework.stereotype.Component;
 
 import javax.annotation.PostConstruct;
 import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Predicate;
 import java.util.regex.Pattern;
 
 /**
- * 主题注册表（方案 §5.1）：启动时按 SCAN_PATTERN 扫描各主题包的 theme.json，
+ * 主题注册表（方案 §5.1；W1 扩展：外部主题目录 + 热注册，方案 §5.4 步骤 1）：
+ * 启动时扫描 classpath 内置包与 {@code cms.theme.dir} 外部包（默认 ${user.dir}/data/themes），
  * 按包规范（§4.1）校验，坏包剔除 + log.warn；default 缺失或非法 → 启动失败（fail-fast）。
- * 运行时不支持热加载，皮肤包随版本发布（zip 上传是 P3 项）。
+ *
+ * <p>W1 语义（D1）：内置只读、外部可管；内置优先于同名外部（冲突留 warn）；{@link #reload()}
+ * 运行期热重扫（default 缺失时抛异常且不回滚旧集合，T-W1-04）；校验语义收敛于
+ * {@link ThemePackageValidator}（Registry 与 PackageService 共用，杜绝两套校验漂移）。
  */
 @Slf4j
 @Component
 public class ThemeRegistry {
 
     public static final String DEFAULT_THEME = "default";
+    public static final String SOURCE_BUILTIN = "builtin";
+    public static final String SOURCE_EXTERNAL = "external";
 
     /** 包名与目录名约束（方案 §4.1） */
     private static final Pattern NAME_PATTERN = Pattern.compile("^[a-z][a-z0-9-]{1,30}[a-z0-9]$");
@@ -43,30 +55,117 @@ public class ThemeRegistry {
             .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
 
     private final Map<String, ThemeInfo> themes = new LinkedHashMap<>();
+    private final Map<String, String> sources = new LinkedHashMap<>();
+    private final List<Runnable> reloadListeners = new ArrayList<>();
+
+    /** 外部主题目录（W1；测试经 setter 指向临时目录） */
+    private String themeDir;
+
+    @Value("${cms.theme.dir:}")
+    public void applyConfiguredThemeDir(String dir) {
+        if (dir != null && !dir.trim().isEmpty()) {
+            this.themeDir = dir.trim();
+        }
+    }
+
+    public ThemeRegistry() {
+        if (themeDir == null || themeDir.isEmpty()) {
+            themeDir = System.getProperty("user.dir") + "/data/themes";
+        }
+    }
+
+    public void setThemeDir(String dir) {
+        this.themeDir = dir;
+    }
+
+    public String getThemeDir() {
+        return themeDir;
+    }
+
+    /** reload 后清外部模板缓存（ThemeTemplateResolverConfig 注册回调） */
+    public void addReloadListener(Runnable listener) {
+        reloadListeners.add(listener);
+    }
 
     @PostConstruct
     public void load() {
-        themes.clear();
+        reloadInternal(true);
+    }
+
+    /**
+     * W1 热重扫（T-W1-02/04）：重扫 classpath + 外部目录；
+     * default 缺失或非法时抛 IllegalStateException 且旧集合保持不变。
+     */
+    public synchronized void reload() {
+        reloadInternal(false);
+    }
+
+    private void reloadInternal(boolean startup) {
         Map<String, ThemeInfo> loaded = new LinkedHashMap<>();
+        Map<String, String> loadedSources = new LinkedHashMap<>();
         int rejected = 0;
-        for (Resource resource : scanResources()) {
+
+        // ① 内置 classpath 包（先注册，优先级高）
+        for (Resource resource : scanClasspathResources()) {
             String dirName = dirNameOf(resource);
             try {
                 ThemeInfo info = MAPPER.readValue(resource.getInputStream(), ThemeInfo.class);
-                validate(info, dirName);
+                ThemePackageValidator.validate(info, dirName, rel ->
+                        new ClassPathResource("templates/themes/" + dirName + "/" + rel).exists());
                 loaded.put(info.getName(), info);
+                loadedSources.put(info.getName(), SOURCE_BUILTIN);
             } catch (Exception e) {
                 rejected++;
                 log.warn("主题包 {} 注册失败被剔除：{}", dirName, e.getMessage());
             }
         }
+
+        // ② 外部目录包（同名让位内置，warn 留痕；T-W1-03）
+        for (Path pkg : scanExternalPackages()) {
+            String dirName = pkg.getFileName().toString();
+            Path json = pkg.resolve("theme.json");
+            try {
+                ThemeInfo info = MAPPER.readValue(json.toFile(), ThemeInfo.class);
+                ThemePackageValidator.validate(info, dirName, rel -> Files.exists(pkg.resolve(rel)));
+                if (loaded.containsKey(info.getName())) {
+                    log.warn("外部主题包 {} 与内置包同名，忽略外部包（内置只读、优先，D1）", dirName);
+                    continue;
+                }
+                loaded.put(info.getName(), info);
+                loadedSources.put(info.getName(), SOURCE_EXTERNAL);
+            } catch (Exception e) {
+                rejected++;
+                log.warn("外部主题包 {} 注册失败被剔除：{}", dirName, e.getMessage());
+            }
+        }
+
         List<ThemeInfo> sorted = new ArrayList<>(loaded.values());
         sorted.sort(Comparator.comparing(info -> DEFAULT_THEME.equals(info.getName())
                 ? "" : info.getName()));
+        Map<String, ThemeInfo> newThemes = new LinkedHashMap<>();
+        Map<String, String> newSources = new LinkedHashMap<>();
         for (ThemeInfo info : sorted) {
-            themes.put(info.getName(), info);
+            newThemes.put(info.getName(), info);
+            newSources.put(info.getName(), loadedSources.get(info.getName()));
+        }
+
+        if (!newThemes.containsKey(DEFAULT_THEME)) {
+            if (startup) {
+                throw new IllegalStateException("默认主题包 default 缺失或非法，拒绝启动（方案 §5.1）");
+            }
+            throw new IllegalStateException("默认主题包 default 缺失或非法，reload 已中止（旧集合保持不变，T-W1-04）");
+        }
+        themes.clear();
+        themes.putAll(newThemes);
+        sources.clear();
+        sources.putAll(newSources);
+        for (Runnable listener : reloadListeners) {
+            try {
+                listener.run();
+            } catch (Exception e) {
+                log.warn("主题注册表 reload 回调失败：{}", e.getMessage());
+            }
         }
-        verifyDefaultPresent();
         log.info("主题注册表加载完成：可用 {} {}，剔除 {} 个坏包", themes.size(), themes.keySet(), rejected);
     }
 
@@ -90,66 +189,38 @@ public class ThemeRegistry {
         return name == null ? null : themes.get(name);
     }
 
-    // ===== 包规范校验（方案 §4.1）=====
-
-    private void validate(ThemeInfo info, String dirName) {
-        if (info == null) {
-            throw new IllegalArgumentException("清单为空");
-        }
-        if (info.getSpecVersion() == null || info.getSpecVersion() != 1) {
-            throw new IllegalArgumentException("specVersion 必须为 1");
-        }
-        if (info.getName() == null || !NAME_PATTERN.matcher(info.getName()).matches()) {
-            throw new IllegalArgumentException("name 缺失或不符合命名规范：" + info.getName());
-        }
-        if (!info.getName().equals(dirName)) {
-            throw new IllegalArgumentException("name 与目录名不一致：" + dirName + " != " + info.getName());
-        }
-        for (String template : REQUIRED_TEMPLATES) {
-            if (!new ClassPathResource("templates/themes/" + dirName + "/" + template).exists()) {
-                throw new IllegalArgumentException("缺必备模板 " + template);
-            }
-        }
-        // fragments/ 目录存在性以 head.html 片段代替（jar 内目录项不可靠）
-        if (!new ClassPathResource("templates/themes/" + dirName + "/fragments/head.html").exists()) {
-            throw new IllegalArgumentException("缺 fragments/head.html 公共片段");
-        }
-        validateParams(info);
-        String shot = "templates/themes/" + dirName + "/" + info.screenshotPath();
-        if (!new ClassPathResource(shot).exists()) {
-            throw new IllegalArgumentException("声明的 screenshot 不存在：" + info.screenshotPath());
-        }
+    /** W1：包来源（builtin/external）；未注册返回 null */
+    public String sourceOf(String name) {
+        return name == null ? null : sources.get(name);
     }
 
-    private void validateParams(ThemeInfo info) {
-        List<String> seen = new ArrayList<>();
-        for (ThemeParam p : info.getParams()) {
-            if (p.getKey() == null || !ThemeParam.KEY_PATTERN.matcher(p.getKey()).matches()) {
-                throw new IllegalArgumentException("param key 非法：" + p.getKey());
-            }
-            if (seen.contains(p.getKey())) {
-                throw new IllegalArgumentException("param key 重复：" + p.getKey());
-            }
-            seen.add(p.getKey());
-            String type = p.getType();
-            boolean knownType = ThemeParam.TYPE_COLOR.equals(type) || ThemeParam.TYPE_IMAGE.equals(type)
-                    || ThemeParam.TYPE_SELECT.equals(type) || ThemeParam.TYPE_TEXT.equals(type);
-            if (!knownType) {
-                throw new IllegalArgumentException("param " + p.getKey() + " 类型非法：" + type);
-            }
-            if (p.getCssVar() != null && !p.getCssVar().isEmpty() && !ThemeParam.TYPE_COLOR.equals(type)) {
-                throw new IllegalArgumentException("cssVar 仅允许 color 类型参数：" + p.getKey());
-            }
-            if (ThemeParam.TYPE_SELECT.equals(type)
-                    && (p.getOptions() == null || p.getOptions().isEmpty())) {
-                throw new IllegalArgumentException("select 参数缺 options：" + p.getKey());
-            }
+    /** W1：包内相对资源定位（内置→ClassPathResource；外部→FileSystemResource，exists 即时判定） */
+    public Resource resource(String name, String relativePath) {
+        String rel = relativePath == null ? "" : relativePath;
+        while (rel.startsWith("/")) {
+            rel = rel.substring(1);
         }
+        if (SOURCE_EXTERNAL.equals(sources.get(name))) {
+            return new FileSystemResource(Paths.get(themeDir, name, rel).toFile());
+        }
+        return new ClassPathResource("templates/themes/" + name + "/" + rel);
+    }
+
+    // ===== 包规范校验（§4.1，语义收敛于 ThemePackageValidator）=====
+
+    /** 包名规范（PackageService 上传/派生共用） */
+    public static boolean isValidName(String name) {
+        return name != null && NAME_PATTERN.matcher(name).matches();
+    }
+
+    public static List<String> requiredTemplates() {
+        return REQUIRED_TEMPLATES;
     }
 
     // ===== 资源定位 =====
 
-    private List<Resource> scanResources() {
+    /** classpath 内置包扫描（protected：测试可屏蔽以构造外部-only 场景，T-W1-04） */
+    protected List<Resource> scanClasspathResources() {
         try {
             Resource[] resources = new PathMatchingResourcePatternResolver().getResources(SCAN_PATTERN);
             return Arrays.asList(resources);
@@ -158,6 +229,27 @@ public class ThemeRegistry {
         }
     }
 
+    /** W1：外部目录包扫描（themeDir 下各包的 theme.json；目录不存在视为空） */
+    protected List<Path> scanExternalPackages() {
+        List<Path> packages = new ArrayList<>();
+        if (themeDir == null || themeDir.isEmpty()) {
+            return packages;
+        }
+        Path root = Paths.get(themeDir);
+        if (!Files.isDirectory(root)) {
+            return packages;
+        }
+        try (java.util.stream.Stream<Path> children = Files.list(root)) {
+            children.filter(Files::isDirectory)
+                    .filter(p -> Files.isRegularFile(p.resolve("theme.json")))
+                    .sorted(Comparator.comparing(p -> p.getFileName().toString()))
+                    .forEach(packages::add);
+        } catch (IOException e) {
+            log.warn("外部主题目录扫描失败：{}（{}）", themeDir, e.getMessage());
+        }
+        return packages;
+    }
+
     /** 从 theme.json 资源 URL 截取所属包目录名 */
     private String dirNameOf(Resource resource) {
         try {