fix(GOV-009): 封堵外部脚本边界绕过

tools/boundaries/verify-project-boundaries.mjs

@@ -2,6 +2,7 @@ import { readdir, readFile, stat } from 'node:fs/promises';
 import path from 'node:path';
 import process from 'node:process';
 import ts from 'typescript';
+import { parse } from '@vue/compiler-sfc';
 
 const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.mts', '.cts', '.vue']);
 const INTERNAL_MESSAGE_MARKERS = ['MessageEnvelope', 'message-contracts'];
@@ -20,16 +21,18 @@ async function collectSourceFiles(directory) {
 
 function extractTypeScriptSource(sourcePath, sourceText) {
   if (path.extname(sourcePath) !== '.vue') return sourceText;
-  const externalScript = sourceText.match(/<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>/i);
+  const { descriptor, errors } = parse(sourceText, { filename: sourcePath });
+  const externalScript = descriptor.script?.src ?? descriptor.scriptSetup?.src;
   if (externalScript) {
     throw new Error(
-      `Web Vue 组件禁止使用外部 script src：${path.basename(sourcePath)} -> ${externalScript[1]}`,
+      `Web Vue 组件禁止使用外部 script src：${path.basename(sourcePath)} -> ${externalScript}`,
     );
   }
-  // 边界门禁只需解析 SFC 的脚本块；模板和样式不会产生 TypeScript 模块依赖。
-  return [...sourceText.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script>/gi)]
-    .map((match) => match[1])
-    .join('\n');
+  if (errors.length > 0) {
+    throw new Error(`Vue 单文件组件解析失败：${path.basename(sourcePath)}`);
+  }
+  // 使用 Vue 官方解析器读取普通脚本和 setup 脚本，避免 HTML 属性写法绕过正则门禁。
+  return [descriptor.script?.content, descriptor.scriptSetup?.content].filter(Boolean).join('\n');
 }
 
 function collectModuleSpecifiers(sourceFile) {