@applift/core 0.11.0 → 0.12.1

package/dist/{artifact-DbTqPUbk.mjs → artifact-D3BSnmqY.mjs}

@@ -1160,13 +1160,111 @@ function assertBetaVersionSupported(ctx) {
 * 产物版本读取（只读不写——版本号变更属开发提交，发版工具只负责读版本防回退）。
 * .hap/.app：pack.info 是纯 JSON，零依赖直接读；
 * .apk：aapt2/aapt dump badging（ANDROID_HOME/SDK 探测，同 oppo 渠道逻辑）；
-* .ipa：二进制 plist 解析成本高，不支持自动读（返回 undefined，doctor 提示用 --version/配置）。
+* .hap/.app 的 pushy 构建时间戳在包内 resources/rawfile/meta.json（pushy hvigor 插件写入），
+* 由 readArtifactBuildTime 读取——基线 buildTime 必须与设备上报精确一致（不匹配服务端封锁 6h）。
 */
 function readArtifactVersion(artifactPath) {
 	const ext = path.extname(artifactPath).toLowerCase();
 	if (ext === ".hap" || ext === ".app") return fromPackInfo(artifactPath);
 	if (ext === ".apk") return fromAapt(artifactPath);
 }
+/** 产物 pushy 构建时间戳读取（buildTime 与设备上报必须精确一致，读不出返回 undefined，
+*  由调用方决定拒绝上传而非猜测）。
+*  .hap/.app：包内（.app 可能嵌套 hap）resources/rawfile/meta.json 的 pushy_build_time；
+*  .apk：AndroidManifest meta-data pushy_build_time（aapt2/aapt xmltree）；
+*  .ipa：Payload/*.app/pushy_build_time.txt（官方 Xcode 构建 phase 产物）。 */
+function readArtifactBuildTime(artifactPath) {
+	const ext = path.extname(artifactPath).toLowerCase();
+	if (ext === ".hap" || ext === ".app") return harmonyBuildTime(artifactPath);
+	if (ext === ".apk") return apkBuildTime(artifactPath);
+	if (ext === ".ipa") return ipaBuildTime(artifactPath);
+}
+/** unzip 子进程 stdout（失败/超时返回 undefined，调用方按读不出处理） */
+function unzipStdout(args) {
+	const r = spawnSync("unzip", args, {
+		timeout: 2e4,
+		encoding: "utf8",
+		maxBuffer: 67108864
+	});
+	return !r.error && r.status === 0 ? r.stdout : void 0;
+}
+function metaJsonBuildTime(text) {
+	if (!text) return void 0;
+	let meta;
+	try {
+		meta = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (meta && typeof meta === "object" && "pushy_build_time" in meta) {
+		const v = meta.pushy_build_time;
+		if (typeof v === "string" || typeof v === "number") return String(v);
+	}
+}
+/** 鸿蒙：先按顶层 resources/rawfile/meta.json 读（hap 或直排 hap 内容的 .app）；
+*  .app 整包的 hap 嵌套在 zip 里，取出后再读（对照官方 CLI getAppInfo 的嵌套提取）。 */
+function harmonyBuildTime(artifactPath) {
+	const direct = metaJsonBuildTime(unzipStdout([
+		"-p",
+		artifactPath,
+		"resources/rawfile/meta.json"
+	]));
+	if (direct) return direct;
+	const hapEntry = unzipStdout(["-Z1", artifactPath])?.split("\n").map((s) => s.trim()).find((s) => s.endsWith(".hap"));
+	if (!hapEntry) return void 0;
+	const tmp = path.join(os.tmpdir(), `applift-meta-hap-${process.pid}-${Date.now()}`);
+	try {
+		const ex = spawnSync("unzip", [
+			"-p",
+			artifactPath,
+			hapEntry
+		], {
+			timeout: 6e4,
+			maxBuffer: 536870912
+		});
+		if (ex.error || ex.status !== 0 || !ex.stdout) return void 0;
+		fs.writeFileSync(tmp, ex.stdout);
+		return metaJsonBuildTime(unzipStdout([
+			"-p",
+			tmp,
+			"resources/rawfile/meta.json"
+		]));
+	} finally {
+		fs.rmSync(tmp, { force: true });
+	}
+}
+/** APK：AndroidManifest meta-data pushy_build_time（对照官方 CLI getApkInfo 的 meta 读取） */
+function apkBuildTime(artifactPath) {
+	for (const tool of aaptTools()) {
+		const args = path.basename(tool).startsWith("aapt2") ? [
+			"dump",
+			"xmltree",
+			"--file",
+			"AndroidManifest.xml",
+			artifactPath
+		] : [
+			"dump",
+			"xmltree",
+			artifactPath,
+			"AndroidManifest.xml"
+		];
+		const r = spawnSync(tool, args, {
+			timeout: 1e4,
+			encoding: "utf8"
+		});
+		if (r.error || r.status !== 0) continue;
+		const m = /pushy_build_time"[\s\S]{0,400}?="(\d+)"/.exec(r.stdout ?? "");
+		if (m?.[1]) return m[1];
+	}
+}
+/** iOS：Payload/*.app/pushy_build_time.txt（官方 Xcode 构建 phase 产物） */
+function ipaBuildTime(artifactPath) {
+	return unzipStdout([
+		"-p",
+		artifactPath,
+		"Payload/*.app/pushy_build_time.txt"
+	])?.trim() || void 0;
+}
 /** 鸿蒙包版本读取：优先包内 pack.info（zip 容器内的权威数据），回退同目录 pack.info（标注可能过期） */
 function fromPackInfo(artifactPath) {
 	const r = spawnSync("unzip", [
@@ -1202,8 +1300,8 @@ function parsePackInfo(text, source) {
 		};
 	} catch {}
 }
-/** APK：aapt2/aapt dump badging（versionCode/versionName） */
-function fromAapt(artifactPath) {
+/** aapt 工具探测（ANDROID_HOME/SDK build-tools 下新版优先，aapt2 先于 aapt） */
+function aaptTools() {
 	const tools = [];
 	const sdkDir = process.env.ANDROID_HOME ?? path.join(os.homedir(), "Library/Android/sdk");
 	const btDir = path.join(sdkDir, "build-tools");
@@ -1211,6 +1309,11 @@ function fromAapt(artifactPath) {
 		const p = path.join(btDir, bt, tool);
 		if (fs.existsSync(p)) tools.push(p);
 	}
+	return tools;
+}
+/** APK：aapt2/aapt dump badging（versionCode/versionName） */
+function fromAapt(artifactPath) {
+	const tools = aaptTools();
 	for (const tool of tools) {
 		const r = spawnSync(tool, [
 			"dump",
@@ -1231,4 +1334,4 @@ function fromAapt(artifactPath) {
 	}
 }
 //#endregion
-export { resolveFramework as A, statusShort as B, suggestFramework as C, detectBundleIds as D, deps as E, git as F, isGitRepo as I, latestSemverTag as L, collectReleaseDiff as M, routeDelivery as N, findArtifacts as O, commitsSince as P, latestVersionAnchor as R, rnFramework as S, tauriFramework as T, tagReleaseVersion as V, nativeHarmonyAdapter as _, betaVersionName as a, nativeIosFramework as b, writeProjectVersions as c, electronFramework as d, flutterAdapter as f, nativeAndroidFramework as g, nativeAndroidAdapter as h, assertBetaVersionSupported as i, subdirs as j, readJson as k, redactText as l, knownFrameworkAdapters as m, DEFAULT_BETA_VERSION_CONFIG as n, checkVersionNameShape as o, flutterFramework as p, PLATFORM_VERSION_CAPS as r, readProjectVersions as s, readArtifactVersion as t, electronAdapter as u, nativeHarmonyFramework as v, tauriAdapter as w, rnAdapter as x, nativeIosAdapter as y, looseSemver as z };
+export { readJson as A, looseSemver as B, rnFramework as C, deps as D, tauriFramework as E, commitsSince as F, tagReleaseVersion as H, git as I, isGitRepo as L, subdirs as M, collectReleaseDiff as N, detectBundleIds as O, routeDelivery as P, latestSemverTag as R, rnAdapter as S, tauriAdapter as T, statusShort as V, nativeAndroidFramework as _, assertBetaVersionSupported as a, nativeIosAdapter as b, readProjectVersions as c, electronAdapter as d, electronFramework as f, nativeAndroidAdapter as g, knownFrameworkAdapters as h, PLATFORM_VERSION_CAPS as i, resolveFramework as j, findArtifacts as k, writeProjectVersions as l, flutterFramework as m, readArtifactVersion as n, betaVersionName as o, flutterAdapter as p, DEFAULT_BETA_VERSION_CONFIG as r, checkVersionNameShape as s, readArtifactBuildTime as t, redactText as u, nativeHarmonyAdapter as v, suggestFramework as w, nativeIosFramework as x, nativeHarmonyFramework as y, latestVersionAnchor as z };

package/dist/{frameworks-D0dZKGUL.d.mts → frameworks-B-t5Ywma.d.mts}

@@ -184,6 +184,8 @@ declare const BetaConfigSchema: z.ZodObject<{
     submit: z.ZodDefault<z.ZodBoolean>;
     group: z.ZodOptional<z.ZodString>;
     testType: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<3>, z.ZodLiteral<4>]>>;
+    privacyPolicy: z.ZodOptional<z.ZodString>;
+    appDesc: z.ZodOptional<z.ZodString>;
     cleanup: z.ZodDefault<z.ZodBoolean>;
   }, z.core.$strip>>;
   testflight: z.ZodOptional<z.ZodObject<{
@@ -297,6 +299,8 @@ declare const ProjectConfigSchema: z.ZodObject<{
       submit: z.ZodDefault<z.ZodBoolean>;
       group: z.ZodOptional<z.ZodString>;
       testType: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<3>, z.ZodLiteral<4>]>>;
+      privacyPolicy: z.ZodOptional<z.ZodString>;
+      appDesc: z.ZodOptional<z.ZodString>;
       cleanup: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
     testflight: z.ZodOptional<z.ZodObject<{

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as ProjectConfigSchema, A as routeDelivery, B as appendEntry, C as resolvePlugins, Ct as readJson, D as PublishContext, E as FrameworkContext, F as runSubmit, G as BetaVersionConfigSchema, H as BetaConfig, I as HISTORY_PATH, J as CredentialsProfile, K as CredentialsFile, L as HistoryEntry, M as PipelineSummary, N as PipelineSummaryEntry, O as UpdateProvider, P as runStage, Q as ProjectConfig, R as HistoryEvent, S as defineConfig, St as findArtifacts, T as DeliveryRoute, Tt as subdirs, U as BetaConfigSchema, V as readEntries, W as BetaVersionConfig, X as GlobalConfig, Y as CredentialsProfileSchema, Z as GlobalConfigSchema, _ as AppliftPlugin, _t as BundleIds, a as knownFrameworkAdapters, at as VersionCodeConfigSchema, b as PluginHookName, bt as deps, c as nativeHarmonyAdapter, ct as Channel, d as nativeIosFramework, dt as ChannelEvent, et as StoreConfig, f as rnAdapter, ft as ChannelRegistry, g as tauriFramework, gt as SubmitResult, h as tauriAdapter, ht as StageResult, i as flutterFramework, it as VersionCodeConfig, j as PipelineInput, k as collectReleaseDiff, l as nativeHarmonyFramework, lt as ChannelCapabilities, m as suggestFramework, mt as ReviewStatus, n as electronFramework, nt as Stores, o as nativeAndroidAdapter, ot as VersionConfig, p as rnFramework, pt as ReleasePlanEntry, q as CredentialsFileSchema, r as flutterAdapter, rt as StoresSchema, s as nativeAndroidFramework, st as VersionConfigSchema, t as electronAdapter, tt as StoreConfigSchema, u as nativeIosAdapter, ut as ChannelContext, v as AppliftUserConfig, vt as FrameworkAdapter, w as DeliveryJudgement, wt as resolveFramework, x as PluginHost, xt as detectBundleIds, y as HookContext, yt as Platform, z as HistoryQuery } from "./frameworks-D0dZKGUL.mjs";
+import { $ as ProjectConfigSchema, A as routeDelivery, B as appendEntry, C as resolvePlugins, Ct as readJson, D as PublishContext, E as FrameworkContext, F as runSubmit, G as BetaVersionConfigSchema, H as BetaConfig, I as HISTORY_PATH, J as CredentialsProfile, K as CredentialsFile, L as HistoryEntry, M as PipelineSummary, N as PipelineSummaryEntry, O as UpdateProvider, P as runStage, Q as ProjectConfig, R as HistoryEvent, S as defineConfig, St as findArtifacts, T as DeliveryRoute, Tt as subdirs, U as BetaConfigSchema, V as readEntries, W as BetaVersionConfig, X as GlobalConfig, Y as CredentialsProfileSchema, Z as GlobalConfigSchema, _ as AppliftPlugin, _t as BundleIds, a as knownFrameworkAdapters, at as VersionCodeConfigSchema, b as PluginHookName, bt as deps, c as nativeHarmonyAdapter, ct as Channel, d as nativeIosFramework, dt as ChannelEvent, et as StoreConfig, f as rnAdapter, ft as ChannelRegistry, g as tauriFramework, gt as SubmitResult, h as tauriAdapter, ht as StageResult, i as flutterFramework, it as VersionCodeConfig, j as PipelineInput, k as collectReleaseDiff, l as nativeHarmonyFramework, lt as ChannelCapabilities, m as suggestFramework, mt as ReviewStatus, n as electronFramework, nt as Stores, o as nativeAndroidAdapter, ot as VersionConfig, p as rnFramework, pt as ReleasePlanEntry, q as CredentialsFileSchema, r as flutterAdapter, rt as StoresSchema, s as nativeAndroidFramework, st as VersionConfigSchema, t as electronAdapter, tt as StoreConfigSchema, u as nativeIosAdapter, ut as ChannelContext, v as AppliftUserConfig, vt as FrameworkAdapter, w as DeliveryJudgement, wt as resolveFramework, x as PluginHost, xt as detectBundleIds, y as HookContext, yt as Platform, z as HistoryQuery } from "./frameworks-B-t5Ywma.mjs";
 //#region src/registry.d.ts
 export declare class DefaultChannelRegistry implements ChannelRegistry {
   private readonly channels;
@@ -766,5 +766,11 @@ export interface ArtifactVersion {
   source: string;
 }
 export declare function readArtifactVersion(artifactPath: string): ArtifactVersion | undefined;
+/** 产物 pushy 构建时间戳读取（buildTime 与设备上报必须精确一致，读不出返回 undefined，
+ *  由调用方决定拒绝上传而非猜测）。
+ *  .hap/.app：包内（.app 可能嵌套 hap）resources/rawfile/meta.json 的 pushy_build_time；
+ *  .apk：AndroidManifest meta-data pushy_build_time（aapt2/aapt xmltree）；
+ *  .ipa：Payload/*.app/pushy_build_time.txt（官方 Xcode 构建 phase 产物）。 */
+export declare function readArtifactBuildTime(artifactPath: string): string | undefined;
 //#endregion
 export { AppliftPlugin, AppliftUserConfig, BetaConfig, BetaConfigSchema, BetaVersionConfig, BetaVersionConfigSchema, BundleIds, Channel, ChannelCapabilities, ChannelContext, ChannelEvent, ChannelRegistry, CredentialsFile, CredentialsFileSchema, CredentialsProfile, CredentialsProfileSchema, DeliveryJudgement, DeliveryRoute, FrameworkAdapter, FrameworkContext, GlobalConfig, GlobalConfigSchema, HISTORY_PATH, HistoryEntry, HistoryEvent, HistoryQuery, HookContext, PipelineInput, PipelineSummary, PipelineSummaryEntry, Platform, PluginHookName, PluginHost, ProjectConfig, ProjectConfigSchema, PublishContext, ReleasePlanEntry, ReviewStatus, StageResult, StoreConfig, StoreConfigSchema, Stores, StoresSchema, SubmitResult, UpdateProvider, VersionCodeConfig, VersionCodeConfigSchema, VersionConfig, VersionConfigSchema, appendEntry, collectReleaseDiff, defineConfig, deps, detectBundleIds, electronAdapter, electronFramework, findArtifacts, flutterAdapter, flutterFramework, knownFrameworkAdapters, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, readEntries, readJson, resolveFramework, resolvePlugins, rnAdapter, rnFramework, routeDelivery, runStage, runSubmit, subdirs, suggestFramework, tauriAdapter, tauriFramework };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as resolveFramework, B as statusShort, C as suggestFramework, D as detectBundleIds, E as deps, F as git, I as isGitRepo, L as latestSemverTag, M as collectReleaseDiff, N as routeDelivery, O as findArtifacts, P as commitsSince, R as latestVersionAnchor, S as rnFramework, T as tauriFramework, V as tagReleaseVersion, _ as nativeHarmonyAdapter, a as betaVersionName, b as nativeIosFramework, c as writeProjectVersions, d as electronFramework, f as flutterAdapter, g as nativeAndroidFramework, h as nativeAndroidAdapter, i as assertBetaVersionSupported, j as subdirs, k as readJson, l as redactText, m as knownFrameworkAdapters, n as DEFAULT_BETA_VERSION_CONFIG, o as checkVersionNameShape, p as flutterFramework, r as PLATFORM_VERSION_CAPS, s as readProjectVersions, t as readArtifactVersion, u as electronAdapter, v as nativeHarmonyFramework, w as tauriAdapter, x as rnAdapter, y as nativeIosAdapter, z as looseSemver } from "./artifact-DbTqPUbk.mjs";
+import { A as readJson, B as looseSemver, C as rnFramework, D as deps, E as tauriFramework, F as commitsSince, H as tagReleaseVersion, I as git, L as isGitRepo, M as subdirs, N as collectReleaseDiff, O as detectBundleIds, P as routeDelivery, R as latestSemverTag, S as rnAdapter, T as tauriAdapter, V as statusShort, _ as nativeAndroidFramework, a as assertBetaVersionSupported, b as nativeIosAdapter, c as readProjectVersions, d as electronAdapter, f as electronFramework, g as nativeAndroidAdapter, h as knownFrameworkAdapters, i as PLATFORM_VERSION_CAPS, j as resolveFramework, k as findArtifacts, l as writeProjectVersions, m as flutterFramework, n as readArtifactVersion, o as betaVersionName, p as flutterAdapter, r as DEFAULT_BETA_VERSION_CONFIG, s as checkVersionNameShape, t as readArtifactBuildTime, u as redactText, v as nativeHarmonyAdapter, w as suggestFramework, x as nativeIosFramework, y as nativeHarmonyFramework, z as latestVersionAnchor } from "./artifact-D3BSnmqY.mjs";
 import { z } from "zod";
 import fs from "node:fs";
 import path from "node:path";
@@ -92,6 +92,18 @@ const BetaConfigSchema = z.object({
 		/** 3=邀请测试（默认）4=公开测试 */
 		testType: z.union([z.literal(3), z.literal(4)]).default(3),
 		/**
+		* 隐私政策 URL（提审必填：AGC Testing API 校验 extInfo.privacyPolicy，
+		* 控制台对应版本创建时的「自定义协议」步骤；缺失提审报 204144692
+		* privacyPolicy is necessary——2026-10-25 qy-driver 实测）。透传 target.privacyPolicy。
+		*/
+		privacyPolicy: z.string().optional(),
+		/**
+		* 测试版本描述（languages[].appDesc）：AGC 校验 appDesc/newFeatures/线上 briefInfo
+		* 三者不得相同（2026-10-25 实测），appDesc 与 newFeatures（--note）来源必须互异。
+		* 未配置时用通用基线文案；透传 target.appDesc。
+		*/
+		appDesc: z.string().optional(),
+		/**
 		* 发布前自动清理旧测试版本（stop+delete，默认 true）：
 		* AGC 测试版本在审/在架数量有上限（在审超限提交报 204144692、在架邀请测试 3 个），
 		* 旧版本不清理会阻塞新版本提审。清理只移除 AGC 在架记录——已装设备与热更均不受影响，
@@ -2550,7 +2562,7 @@ var AgcHarmonyChannel = class {
 		"1003": "client_id/client_secret 无效（AGC → 项目设置 → 常规 → API Client 重新获取）",
 		"204144702": "签名/证书不匹配：检查签名证书指纹（SHA256）与 AGC 后台登记是否一致",
 		"204144677": "bundleName 与应用不匹配：确认 appId 对应的应用包名",
-		"204144692": "提审前置校验失败（按 msg 判断）：privacyPolicy → 控制台「更多服务→协议服务」登记隐私政策；count of harmony test in audit → 在审测试版本超限（beta.agc.cleanup 默认已自动清理，仍出现请到控制台核对是否有删不掉的旧测试版本）"
+		"204144692": "提审前置校验失败（按 msg 对症，2026-10-25 实测）：privacyPolicy → 配置 beta.agc.privacyPolicy（Testing API extInfo.privacyPolicy，控制台对应版本创建的「自定义协议」）；displayArea → 邀请测试必填测试专区（CLI 已默认携带，仍报则到控制台核对版本）；count of harmony test in audit → 在审测试版本超限（beta.agc.cleanup 默认已自动清理，仍出现请到控制台核对是否有删不掉的旧测试版本）"
 	};
 	async authHeaders(ctx) {
 		const clientId = required$1(ctx, "AGC_CLIENT_ID");
@@ -2934,6 +2946,10 @@ var AgcHarmonyChannel = class {
 		}, "添加测试软件包")).pkgVersion?.[0] ?? "";
 		if (!pkgId) throw new Error("AGC 添加测试软件包未返回 pkgVersion");
 		await this.awaitCompile(ctx, appId, pkgId, headers);
+		const privacyPolicy = ctx.target.privacyPolicy?.trim();
+		const note = ctx.updateDescription ?? "applift 测试发布";
+		const appDesc = (ctx.target.appDesc?.trim() || "内测验证版本（internal test build），更新内容以新特性说明为准。").slice(0, 100);
+		const newFeatures = note.slice(0, 100);
 		await agcJson(`${BASE}/publish/v2/test/app/version?appId=${encodeURIComponent(appId)}`, {
 			method: "PUT",
 			headers: {
@@ -2942,7 +2958,13 @@ var AgcHarmonyChannel = class {
 			},
 			body: JSON.stringify({
 				versionId,
-				pkgId
+				pkgId,
+				...privacyPolicy ? { extInfo: { privacyPolicy } } : {},
+				languages: [{
+					language: "zh-CN",
+					appDesc,
+					newFeatures
+				}]
 			})
 		}, "绑定测试软件包");
 		if (ctx.target.submitTest === "true") {
@@ -2962,10 +2984,13 @@ var AgcHarmonyChannel = class {
 						openTestInfo: {
 							startTime: now,
 							endTime: now + 2592e6,
-							testTaskInfo: { groupInfos: [{
-								groupId,
-								groupName
-							}] }
+							testTaskInfo: {
+								groupInfos: [{
+									groupId,
+									groupName
+								}],
+								displayArea: "1"
+							}
 						}
 					})
 				}, "绑定测试群组");
@@ -3069,9 +3094,11 @@ var AgcHarmonyChannel = class {
 					body: JSON.stringify({ versionId: vid })
 				}, "停止测试版本");
 			} catch (e) {
+				const msg = e.message;
+				const hint = msg.includes("state is 9998") ? "——该版本在审中，AGC 不允许停/删：到控制台撤回该审核或等审毕后下次发版自动清理" : "";
 				ctx.emit({
 					type: "warn",
-					message: `停止测试版本 ${label}失败（继续尝试删除）: ${e.message}`
+					message: `停止测试版本 ${label}失败（继续尝试删除）: ${msg}${hint}`
 				});
 			}
 			try {
@@ -4750,4 +4777,4 @@ function applyBump(cwd, plan, framework, opts) {
 	}
 }
 //#endregion
-export { APPLIFT_HOME, AgcHarmonyChannel, AscChannel, BetaConfigSchema, BetaVersionConfigSchema, CREDENTIALS_PATH, CredentialsFileSchema, CredentialsProfileSchema, DEFAULT_BETA_VERSION_CONFIG, DefaultChannelRegistry, GLOBAL_CONFIG_PATH, GlobalConfigSchema, GooglePlayChannel, HISTORY_PATH, HonorChannel, HuaweiAndroidChannel, OppoChannel, PLATFORM_VERSION_CAPS, PROJECTS_MAP_PATH, PgyerChannel, PluginHost, ProjectConfigSchema, StoreConfigSchema, StoresSchema, VersionCodeConfigSchema, VersionConfigSchema, VivoChannel, WAIT_BEFORE_SUBMIT_MS, XiaomiChannel, YybChannel, appendEntry, applyBump, assertBetaVersionSupported, assertListingFiles, betaVersionName, checkVersionNameShape, collectReleaseDiff, commitsSince, compareDeclared, decideNextVersion, defineConfig, deps, detectBundleIds, electronAdapter, electronFramework, evalVersionCodeFormula, findArtifacts, findUp, flutterAdapter, flutterFramework, formPost, getAgcToken, getHarmonyAppId, git, hmacSign, humanizeError, inferBumpLevel, isGitRepo, knownFrameworkAdapters, latestSemverTag, latestVersionAnchor, loadCredentials, loadCredentialsLayered, loadGlobalConfig, loadListingFile, loadProjectConfig, loadProjectProfileMap, looseSemver, md5File, md5String, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, nextVersionCode, planBump, projectCredentialsPath, readArtifactVersion, readEntries, readJson, readProjectVersions, redactText, registry, renderChangelogSection, resolveFramework, resolveListing, resolvePlugins, resolveProfile, resolveProfileFor, resolveProfileSource, rnAdapter, rnFramework, routeDelivery, runStage, runSubmit, saveCredentials, saveProjectProfileMap, setProjectProfile, sha256File, sortedQueryString, statusShort, storeVersionName, subdirs, suggestFramework, tagReleaseVersion, tauriAdapter, tauriFramework, toChangelogEntries, tsMillis, tsSeconds, upsertChangelog, writeProjectVersions };
+export { APPLIFT_HOME, AgcHarmonyChannel, AscChannel, BetaConfigSchema, BetaVersionConfigSchema, CREDENTIALS_PATH, CredentialsFileSchema, CredentialsProfileSchema, DEFAULT_BETA_VERSION_CONFIG, DefaultChannelRegistry, GLOBAL_CONFIG_PATH, GlobalConfigSchema, GooglePlayChannel, HISTORY_PATH, HonorChannel, HuaweiAndroidChannel, OppoChannel, PLATFORM_VERSION_CAPS, PROJECTS_MAP_PATH, PgyerChannel, PluginHost, ProjectConfigSchema, StoreConfigSchema, StoresSchema, VersionCodeConfigSchema, VersionConfigSchema, VivoChannel, WAIT_BEFORE_SUBMIT_MS, XiaomiChannel, YybChannel, appendEntry, applyBump, assertBetaVersionSupported, assertListingFiles, betaVersionName, checkVersionNameShape, collectReleaseDiff, commitsSince, compareDeclared, decideNextVersion, defineConfig, deps, detectBundleIds, electronAdapter, electronFramework, evalVersionCodeFormula, findArtifacts, findUp, flutterAdapter, flutterFramework, formPost, getAgcToken, getHarmonyAppId, git, hmacSign, humanizeError, inferBumpLevel, isGitRepo, knownFrameworkAdapters, latestSemverTag, latestVersionAnchor, loadCredentials, loadCredentialsLayered, loadGlobalConfig, loadListingFile, loadProjectConfig, loadProjectProfileMap, looseSemver, md5File, md5String, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, nextVersionCode, planBump, projectCredentialsPath, readArtifactBuildTime, readArtifactVersion, readEntries, readJson, readProjectVersions, redactText, registry, renderChangelogSection, resolveFramework, resolveListing, resolvePlugins, resolveProfile, resolveProfileFor, resolveProfileSource, rnAdapter, rnFramework, routeDelivery, runStage, runSubmit, saveCredentials, saveProjectProfileMap, setProjectProfile, sha256File, sortedQueryString, statusShort, storeVersionName, subdirs, suggestFramework, tagReleaseVersion, tauriAdapter, tauriFramework, toChangelogEntries, tsMillis, tsSeconds, upsertChangelog, writeProjectVersions };

package/dist/plugins/index.d.mts

@@ -1,4 +1,4 @@
-import { E as FrameworkContext, O as UpdateProvider, W as BetaVersionConfig, _ as AppliftPlugin, a as knownFrameworkAdapters, c as nativeHarmonyAdapter, d as nativeIosFramework, f as rnAdapter, g as tauriFramework, h as tauriAdapter, i as flutterFramework, l as nativeHarmonyFramework, m as suggestFramework, n as electronFramework, o as nativeAndroidAdapter, p as rnFramework, r as flutterAdapter, s as nativeAndroidFramework, t as electronAdapter, u as nativeIosAdapter, w as DeliveryJudgement } from "../frameworks-D0dZKGUL.mjs";
+import { E as FrameworkContext, O as UpdateProvider, W as BetaVersionConfig, _ as AppliftPlugin, a as knownFrameworkAdapters, c as nativeHarmonyAdapter, d as nativeIosFramework, f as rnAdapter, g as tauriFramework, h as tauriAdapter, i as flutterFramework, l as nativeHarmonyFramework, m as suggestFramework, n as electronFramework, o as nativeAndroidAdapter, p as rnFramework, r as flutterAdapter, s as nativeAndroidFramework, t as electronAdapter, u as nativeIosAdapter, w as DeliveryJudgement } from "../frameworks-B-t5Ywma.mjs";
 //#region src/plugins/dingtalk-notify.d.ts
 interface DingtalkNotifyOptions {
   webhook: string;
@@ -32,8 +32,9 @@ interface PushyCli {
   }): Promise<{
     versionId: number;
   }>;
-  /** 上传原生基线（versionName 由调用方从产物读取后显式传入；deps 同 publish） */
-  uploadApp(appId: number, appFile: string, versionName: string, deps: Record<string, string>): Promise<{
+  /** 上传原生基线（versionName 与 buildTime 均由调用方从产物内读取后显式传入；
+   *  buildTime 必须与设备上报的编译时间戳精确一致，读不出时调用方应拒绝上传。deps 同 publish） */
+  uploadApp(appId: number, appFile: string, versionName: string, deps: Record<string, string>, buildTime: string): Promise<{
     packageId: number;
     version: string;
   }>;
@@ -44,12 +45,24 @@ interface PushyCli {
     packageVersion: string;
     rollout?: number;
   }): Promise<void>;
-  /** 版本列表（取号与状态展示用） */
+  /** 版本列表（取号与状态展示用）。packageVersion：该热更绑定的原生基线版本名
+   *  （基线自动替换的安全判据；服务端未回显时字段缺省，调用方按无法确认处理） */
   versions(appId: number): Promise<Array<{
     id: number;
     hash: string;
     name: string;
+    packageVersion?: string;
   }>>;
+  /** 基线包列表（GET /app/:id/package/list；409 自动替换的发现手段） */
+  packages(appId: number): Promise<Array<{
+    id: number;
+    hash: string;
+    name: string;
+    status: string;
+  }>>;
+  /** 删除基线包（DELETE /app/:id/package/:packageId，2026-10-25 实测端点存在）。
+   *  调用方必须先确认该基线无热更版本绑定（删除被绑定的基线会孤儿化热更）。 */
+  deletePackage(appId: number, packageId: number): Promise<void>;
 }
 /** credentials.json 中的 pushy token 键名 */
 export declare const PUSHY_TOKEN_KEY = "PUSHY_API_TOKEN";

package/dist/plugins/index.mjs

@@ -1,4 +1,4 @@
-import { C as suggestFramework, M as collectReleaseDiff, O as findArtifacts, S as rnFramework, T as tauriFramework, _ as nativeHarmonyAdapter, a as betaVersionName, b as nativeIosFramework, d as electronFramework, f as flutterAdapter, g as nativeAndroidFramework, h as nativeAndroidAdapter, i as assertBetaVersionSupported, l as redactText, m as knownFrameworkAdapters, n as DEFAULT_BETA_VERSION_CONFIG, p as flutterFramework, s as readProjectVersions, t as readArtifactVersion, u as electronAdapter, v as nativeHarmonyFramework, w as tauriAdapter, x as rnAdapter, y as nativeIosAdapter } from "../artifact-DbTqPUbk.mjs";
+import { C as rnFramework, E as tauriFramework, N as collectReleaseDiff, S as rnAdapter, T as tauriAdapter, _ as nativeAndroidFramework, a as assertBetaVersionSupported, b as nativeIosAdapter, c as readProjectVersions, d as electronAdapter, f as electronFramework, g as nativeAndroidAdapter, h as knownFrameworkAdapters, k as findArtifacts, m as flutterFramework, n as readArtifactVersion, o as betaVersionName, p as flutterAdapter, r as DEFAULT_BETA_VERSION_CONFIG, t as readArtifactBuildTime, u as redactText, v as nativeHarmonyAdapter, w as suggestFramework, x as nativeIosFramework, y as nativeHarmonyFramework } from "../artifact-D3BSnmqY.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import { createHmac } from "node:crypto";
@@ -62,9 +62,11 @@ function dingtalkNotify(options) {
 * cresc/自建服务差异仅在 baseUrl（同一套服务端代码），serverUrl 由 rnUpdate 配置注入。
 * uploadApp 相对官方 CLI 的有意降级（记录在案）：传原始产物而非 slim 包、不带 bundleHash/
 * bytecodeVersion/bundleLocation（服务端无法将该基线用作 hermes-base 或 package-origin diff）、
-* buildTime 为上传时刻而非包内提取、不校验包内 appId 与目标 app 一致（配错 appId 会传到别的 app——
-* 由配置审查保证）、不做 maxSize 预检（超限撞对象存储错误）。需要 hermes-base 能力时在此补齐。
-*/
+* 不校验包内 appId 与目标 app 一致（配错 appId 会传到别的 app——由配置审查保证）、
+* 不做 maxSize 预检（超限撞对象存储错误）。需要 hermes-base 能力时在此补齐。
+* buildTime 已对齐官方语义：由调用方从产物内提取真实构建时间戳传入（2026-10-26 qy-driver
+* 实证：服务端按 buildTime 精确匹配设备上报，写入上传时刻会让该基线下的设备全部
+* checkUpdate 吃「编译时间戳不匹配」+ 封锁 6h，热更永远发不下去）。 */
 /** credentials.json 中的 pushy token 键名 */
 const PUSHY_TOKEN_KEY = "PUSHY_API_TOKEN";
 /** pushy 官方 API 根（官方 CLI 默认端点簇的主端点） */
@@ -94,7 +96,9 @@ async function query(f, baseUrl, token, api, init) {
 	}
 	if (!res.ok) {
 		const msg = json?.message || res.statusText || `HTTP ${res.status}`;
-		throw new Error(res.status === 401 ? `pushy API 鉴权失败（token 无效或过期）：请更新 credentials.json 的 ${PUSHY_TOKEN_KEY}` : `pushy API ${api} 失败（HTTP ${res.status}）：${msg}`);
+		const err = /* @__PURE__ */ new Error(res.status === 401 ? `pushy API 鉴权失败（token 无效或过期）：请更新 credentials.json 的 ${PUSHY_TOKEN_KEY}` : `pushy API ${api} 失败（HTTP ${res.status}）：${msg}`);
+		err.status = res.status;
+		throw err;
 	}
 	return json ?? {};
 }
@@ -243,14 +247,14 @@ function createPushyApi(opts) {
 			await bind(q, input.appId, id, input.packageVersion, input.rollout);
 			return { versionId: id };
 		},
-		async uploadApp(appId, appFile, versionName, deps) {
+		async uploadApp(appId, appFile, versionName, deps, buildTime) {
 			const hash = await uploadFile(f, baseUrl, opts.token, appId, appFile, opts.httpUpload);
 			const { id } = await q(`/app/${appId}/package/create`, {
 				method: "POST",
 				body: JSON.stringify({
 					name: versionName,
 					hash,
-					buildTime: String(Date.now()),
+					buildTime,
 					deps
 				})
 			});
@@ -271,11 +275,31 @@ function createPushyApi(opts) {
 				for (const v of data) out.push({
 					id: v.id,
 					hash: v.hash ?? "",
-					name: v.name
+					name: v.name,
+					...v.packageVersion !== void 0 ? { packageVersion: v.packageVersion } : {}
+				});
+				if (data.length < limit) break;
+			}
+			return out;
+		},
+		async packages(appId) {
+			const out = [];
+			const limit = 100;
+			for (let offset = 0; offset < 1e4; offset += limit) {
+				const { data } = await q(`/app/${appId}/package/list?offset=${offset}&limit=${limit}`);
+				if (!data?.length) break;
+				for (const p of data) out.push({
+					id: p.id,
+					hash: p.hash ?? "",
+					name: p.name,
+					status: p.status ?? ""
 				});
 				if (data.length < limit) break;
 			}
 			return out;
+		},
+		async deletePackage(appId, packageId) {
+			await q(`/app/${appId}/package/${packageId}`, { method: "DELETE" });
 		}
 	};
 }
@@ -721,11 +745,27 @@ function rnUpdate(opts = {}, cli) {
 			try {
 				const versionName = readArtifactVersion(result.artifactPath)?.versionName;
 				if (!versionName) throw new Error(`未能从产物读出 versionName：${result.artifactPath}（readArtifactVersion 不支持该格式？）`);
+				const buildTime = readArtifactBuildTime(result.artifactPath);
+				if (!buildTime) throw new Error(`未能从产物读出 pushy 构建时间戳：${result.artifactPath}（包内缺 meta.json / pushy_build_time？请人工用 pushy CLI 补传基线）`);
 				const appId = platformAppId(opts, platform, result.target ?? baselineChannel(versionName, platform, hookCtx.cwd));
 				const key = `${platform}:${versionName}`;
 				if (uploadedBaselines.has(key)) return;
 				uploadedBaselines.add(key);
-				await resolvePushyClient(opts, cli, hookCtx.credentials).uploadApp(appId, result.artifactPath, versionName, readDepVersions(hookCtx.cwd));
+				const pushy = resolvePushyClient(opts, cli, hookCtx.credentials);
+				try {
+					await pushy.uploadApp(appId, result.artifactPath, versionName, readDepVersions(hookCtx.cwd), buildTime);
+				} catch (e) {
+					if (e.status !== 409) throw e;
+					const sameName = (await pushy.packages(appId)).filter((p) => p.name === versionName);
+					if (sameName.length === 0) throw new Error(`基线 409 但未发现同名基线（hash 重复？）：${versionName}——请人工核对 pushy 后台`);
+					const vers = await pushy.versions(appId);
+					const bound = vers.filter((v) => v.packageVersion === versionName || v.packageVersion === void 0 && sameName.some((p) => v.hash === p.hash && v.name === versionName));
+					if (vers.length > 0 && bound.length > 0) throw new Error(`基线 ${versionName} 已绑定 ${bound.length} 个热更版本，自动替换会使热更孤儿化——请人工处理（pushy 后台迁移热更或删除后重发）`);
+					if (vers.length > 0 && vers.every((v) => v.packageVersion === void 0)) throw new Error(`服务端未回显热更绑定关系，无法确认 ${versionName} 基线可安全替换——请人工核对后删除重传`);
+					for (const p of sameName) await pushy.deletePackage(appId, p.id);
+					process.stderr.write(`⚠ pushy 基线 ${versionName} 内容已变（同版本名重建），自动删除旧基线 ${sameName.map((p) => `#${p.id}(${p.hash})`).join(",")} 并重传\n`);
+					await pushy.uploadApp(appId, result.artifactPath, versionName, readDepVersions(hookCtx.cwd), buildTime);
+				}
 			} catch (e) {
 				uploadedBaselines.delete(`${platform}:${readArtifactVersion(result.artifactPath)?.versionName ?? ""}`);
 				process.stderr.write(`⚠ pushy 基线上传失败（请人工补传）：${e.message}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applift/core",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/hcg1023/applift.git",