@applift/core 0.5.0 → 0.6.0

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as electronAdapter, A as ReleaseConfigSchema, B as ChannelCapabilities, C as CredentialsProfile, D as ProjectConfig, E as GlobalConfigSchema, F as VersionCodeConfig, G as ReviewStatus, H as ChannelEvent, I as VersionCodeConfigSchema, J as BundleIds, K as StageResult, L as VersionConfig, M as StoreConfigSchema, N as Stores, O as ProjectConfigSchema, P as StoresSchema, Q as detectFramework, R as VersionConfigSchema, S as CredentialsFileSchema, T as GlobalConfig, U as ChannelRegistry, V as ChannelContext, W as ReleasePlanEntry, X as Platform, Y as FrameworkAdapter, Z as detectBundleIds, _ as appendEntry, a as QypubUserConfig, at as rnAdapter, b as BetaConfigSchema, c as PipelineInput, d as runStage, et as findArtifacts, f as runSubmit, g as HistoryQuery, h as HistoryEvent, i as QypubPlugin, it as nativeIosAdapter, j as StoreConfig, k as ReleaseConfig, l as PipelineSummary, m as HistoryEntry, n as PluginHookName, nt as nativeAndroidAdapter, o as defineConfig, ot as tauriAdapter, p as HISTORY_PATH, q as SubmitResult, r as PluginHost, rt as nativeHarmonyAdapter, s as resolvePlugins, t as HookContext, tt as flutterAdapter, u as PipelineSummaryEntry, v as readEntries, w as CredentialsProfileSchema, x as CredentialsFile, y as BetaConfig, z as Channel } from "./plugin-CTt0LO8c.mjs";
+import { $ as electronAdapter, A as ReleaseConfigSchema, B as ChannelCapabilities, C as CredentialsProfile, D as ProjectConfig, E as GlobalConfigSchema, F as VersionCodeConfig, G as ReviewStatus, H as ChannelEvent, I as VersionCodeConfigSchema, J as BundleIds, K as StageResult, L as VersionConfig, M as StoreConfigSchema, N as Stores, O as ProjectConfigSchema, P as StoresSchema, Q as detectFramework, R as VersionConfigSchema, S as CredentialsFileSchema, T as GlobalConfig, U as ChannelRegistry, V as ChannelContext, W as ReleasePlanEntry, X as Platform, Y as FrameworkAdapter, Z as detectBundleIds, _ as appendEntry, a as PluginHost, at as rnAdapter, b as BetaConfigSchema, c as PipelineInput, d as runStage, et as findArtifacts, f as runSubmit, g as HistoryQuery, h as HistoryEvent, i as PluginHookName, it as nativeIosAdapter, j as StoreConfig, k as ReleaseConfig, l as PipelineSummary, m as HistoryEntry, n as AppliftUserConfig, nt as nativeAndroidAdapter, o as defineConfig, ot as tauriAdapter, p as HISTORY_PATH, q as SubmitResult, r as HookContext, rt as nativeHarmonyAdapter, s as resolvePlugins, t as AppliftPlugin, tt as flutterAdapter, u as PipelineSummaryEntry, v as readEntries, w as CredentialsProfileSchema, x as CredentialsFile, y as BetaConfig, z as Channel } from "./plugin-B2GGlI_2.mjs";
 //#region src/registry.d.ts
 export declare class DefaultChannelRegistry implements ChannelRegistry {
   private readonly channels;
@@ -30,8 +30,13 @@ export declare function loadCredentials(filePath?: string): CredentialsFile;
  * knownKeys 提供时其裸键名（如 PGYER_API_KEY）也认（向后兼容），未提供的裸大写键不捡（避免误吸无关变量）。
  */
 export declare function resolveProfile(creds: CredentialsFile, profile: string, knownKeys?: string[]): Record<string, string>;
-/** 全局配置装载（缺失/损坏降级默认值并警告，不阻断） */
-export declare function loadGlobalConfig(filePath?: string): GlobalConfig;
+export interface GlobalConfigLoadResult {
+  config: GlobalConfig;
+  /** 配置文件损坏降级默认值时的警告（调用方决定呈现方式；core 保持 headless 不写 stderr） */
+  warning?: string;
+}
+/** 全局配置装载（缺失/损坏降级默认值；警告经返回值交给调用方，不阻断） */
+export declare function loadGlobalConfig(filePath?: string): GlobalConfigLoadResult;
 /** 写凭据（目录自动创建，文件强制 0600） */
 export declare function saveCredentials(data: CredentialsFile, filePath?: string): void;
 //#endregion
@@ -42,7 +47,7 @@ export interface LoadedProjectConfig {
    * c12 原始配置（保留 plugins 等 schema 外键）——插件发现（resolvePlugins）用；
    * 业务字段一律以 config（zod 解析后）为准。
    */
-  raw: QypubUserConfig;
+  raw: AppliftUserConfig;
   /** 配置文件所在目录（解析相对路径用），无配置文件时为 cwd */
   cwd: string;
 }
@@ -80,6 +85,10 @@ export declare class PgyerChannel implements Channel {
   readonly id = "pgyer";
   readonly label = "蒲公英";
   readonly capabilities: ChannelCapabilities;
+  /** 平台错误码 → 人话（1247：源码注释已证 = buildKey 尚未就绪/COS 仍在入库） */
+  readonly errorHints: {
+    "1247": string;
+  };
   plan(ctx: ChannelContext): Promise<ReleasePlanEntry>;
   stage(ctx: ChannelContext): Promise<StageResult>;
   submit(): Promise<SubmitResult>;
@@ -172,6 +181,11 @@ export declare class XiaomiChannel implements Channel {
   readonly id = "xiaomi";
   readonly label = "小米应用商店";
   readonly capabilities: ChannelCapabilities;
+  /** 平台错误码 → 人话（result 码：依据为本仓测试已固化的真实失败路径文案） */
+  readonly errorHints: {
+    "401": string;
+    "1005": string;
+  };
   plan(_ctx: ChannelContext): Promise<ReleasePlanEntry>;
   /** 小米不支持只传包：push 接口上传即提审 */
   stage(_ctx: ChannelContext): Promise<StageResult>;
@@ -286,6 +300,10 @@ export declare class YybChannel implements Channel {
   readonly id = "yyb";
   readonly label = "腾讯应用宝";
   readonly capabilities: ChannelCapabilities;
+  /** 平台错误码 → 人话（ret 码：依据为本仓测试已固化的真实失败路径） */
+  readonly errorHints: {
+    "10010": string;
+  };
   /** stage 产物暂存（serial_number + md5），submit 按 appId 取回 */
   private readonly staged;
   private required;
@@ -384,11 +402,24 @@ export declare class GooglePlayChannel implements Channel {
   readonly id = "googleplay";
   readonly label = "Google Play";
   readonly capabilities: ChannelCapabilities;
+  /** 平台错误码 → 人话（HTTP 状态：依据为本仓测试已固化的失败路径） */
+  readonly errorHints: {
+    "403": string;
+  };
   plan(_ctx: ChannelContext): Promise<ReleasePlanEntry>;
   stage(ctx: ChannelContext): Promise<StageResult>;
-  submit(ctx: ChannelContext): Promise<SubmitResult>;
+  submit(ctx: ChannelContext, stagedRef?: string): Promise<SubmitResult>;
+  /** 复用 stage 已上传的 versionCode：开新 edit（仍需 auth）→ 部署 production → commit，跳过上传 */
+  private assignExisting;
   /** 上传 + 部署到指定轨道 + commit，返回 `editId:versionCode` */
   private uploadAndAssign;
+  /**
+   * 部署 versionCode 到指定轨道并 commit：
+   * 先 GET 轨道现有 releases 再合并 PUT——目标 release（同 status=completed 配置）追加新 versionCode，
+   * 其余 releases 原样保留（status/userFraction 不变），避免整轨覆盖把旧版本从轨道剔除；
+   * :commit 冒号语法（对拍 apkgo googleplay.go 权威；对 production 含提交审核语义，internal 即生效）
+   */
+  private deployAndCommit;
   status(ctx: Pick<ChannelContext, "credentials" | "target">): Promise<ReviewStatus>;
   private requirePkgName;
 }
@@ -400,9 +431,19 @@ export declare function sha256File(filePath: string): string;
 //#region src/channels/shared/error-codes.d.ts
 /**
  * 错误码人话化：消费各渠道自带 errorHints（平台内聚——表与渠道实现同文件）。
+ * 网络类故障（AbortSignal 超时/断连/DNS）渠道层不转译，统一在此兜底提示。
  */
 export declare function humanizeError(hints: Record<string, string> | undefined, message: string): string;
 //#endregion
+//#region src/channels/shared/redact.d.ts
+/**
+ * 文本脱敏（三层层叠，逐层尝试）：
+ *   1) http(s) URL 带 query/userinfo → query 按名脱敏 + 剥 userinfo
+ *   2) { / [ 开头且整串为合法 JSON → 递归按键名脱敏
+ *   3) 其余 → name=value 正则扫（错误消息等无结构文本）
+ */
+export declare function redactText(v: string): string;
+//#endregion
 //#region src/version/project.d.ts
 export type VersionFileKind = "gradle" | "pbxproj" | "app-json5" | "pubspec" | "package-json" | "tauri" | "expo-app-json";
 export interface PlatformVersionInfo {
@@ -589,4 +630,4 @@ export interface ArtifactVersion {
 }
 export declare function readArtifactVersion(artifactPath: string): ArtifactVersion | undefined;
 //#endregion
-export { BetaConfig, BetaConfigSchema, BundleIds, Channel, ChannelCapabilities, ChannelContext, ChannelEvent, ChannelRegistry, CredentialsFile, CredentialsFileSchema, CredentialsProfile, CredentialsProfileSchema, FrameworkAdapter, GlobalConfig, GlobalConfigSchema, HISTORY_PATH, HistoryEntry, HistoryEvent, HistoryQuery, HookContext, PipelineInput, PipelineSummary, PipelineSummaryEntry, Platform, PluginHookName, PluginHost, ProjectConfig, ProjectConfigSchema, QypubPlugin, QypubUserConfig, ReleaseConfig, ReleaseConfigSchema, ReleasePlanEntry, ReviewStatus, StageResult, StoreConfig, StoreConfigSchema, Stores, StoresSchema, SubmitResult, VersionCodeConfig, VersionCodeConfigSchema, VersionConfig, VersionConfigSchema, appendEntry, defineConfig, detectBundleIds, detectFramework, electronAdapter, findArtifacts, flutterAdapter, nativeAndroidAdapter, nativeHarmonyAdapter, nativeIosAdapter, readEntries, resolvePlugins, rnAdapter, runStage, runSubmit, tauriAdapter };
+export { AppliftPlugin, AppliftUserConfig, BetaConfig, BetaConfigSchema, BundleIds, Channel, ChannelCapabilities, ChannelContext, ChannelEvent, ChannelRegistry, CredentialsFile, CredentialsFileSchema, CredentialsProfile, CredentialsProfileSchema, FrameworkAdapter, GlobalConfig, GlobalConfigSchema, HISTORY_PATH, HistoryEntry, HistoryEvent, HistoryQuery, HookContext, PipelineInput, PipelineSummary, PipelineSummaryEntry, Platform, PluginHookName, PluginHost, ProjectConfig, ProjectConfigSchema, ReleaseConfig, ReleaseConfigSchema, ReleasePlanEntry, ReviewStatus, StageResult, StoreConfig, StoreConfigSchema, Stores, StoresSchema, SubmitResult, VersionCodeConfig, VersionCodeConfigSchema, VersionConfig, VersionConfigSchema, appendEntry, defineConfig, detectBundleIds, detectFramework, electronAdapter, findArtifacts, flutterAdapter, nativeAndroidAdapter, nativeHarmonyAdapter, nativeIosAdapter, readEntries, resolvePlugins, rnAdapter, runStage, runSubmit, tauriAdapter };

package/dist/index.mjs

@@ -41,15 +41,23 @@ profiles: z.record(z.string(), CredentialsProfileSchema) });
 /** 单渠道配置（appId、pkgName 等渠道侧键） */
 const StoreConfigSchema = z.record(z.string(), z.string());
 /**
-* stores 三种等价写法，统一规范化为 record：
+* stores 等价写法，统一规范化为 record：
 * ① 对象：{ huawei: { appId: 'x' } }（原有写法，原样保留）
 * ② 数组：['oppo', 'vivo'] → { oppo: {}, vivo: {} }（无配置渠道）
 * ③ 字符串值：{ huawei: '10xxx' } → { huawei: { appId: '10xxx' } }（appId 简写）
+* ④ 混排数组（README 首例）：['huawei', { yyb: 'appId值' }] → 元素对象须单键 { 渠道: 值 }，
+*    值走 ③ 同款 appId 简写归一
 */
-const StoresSchema = z.union([z.record(z.string(), z.union([StoreConfigSchema, z.string()])), z.array(z.string())]).transform((stores) => {
-	if (Array.isArray(stores)) return Object.fromEntries(stores.map((id) => [id, {}]));
+const storesNormalize = (stores) => {
+	if (Array.isArray(stores)) return Object.fromEntries(stores.map((el) => typeof el === "string" ? [el, {}] : (() => {
+		const entries = Object.entries(el);
+		if (entries.length !== 1) throw new Error(`stores 数组内的对象元素必须形如 { 渠道id: appId简写 }（单键），收到: ${JSON.stringify(el)}`);
+		const [id, cfg] = entries[0];
+		return [id, typeof cfg === "string" ? { appId: cfg } : cfg];
+	})()));
 	return Object.fromEntries(Object.entries(stores).map(([id, cfg]) => [id, typeof cfg === "string" ? { appId: cfg } : cfg]));
-}).default({});
+};
+const StoresSchema = z.union([z.record(z.string(), z.union([StoreConfigSchema, z.string()])), z.array(z.union([z.string(), StoreConfigSchema]))]).transform(storesNormalize).default({});
 /** 项目级配置（applift.config.ts 的形状）；beta 段见上方 BetaConfigSchema */
 /**
 * 内测分发配置（applift beta 无平台参数时并行发布的渠道开关）：
@@ -94,16 +102,19 @@ const ProjectConfigSchema = z.object({
 	/** 团队默认凭据 profile（个人用 applift use / --profile 覆盖），缺省 default */
 	profile: z.string().default("default"),
 	android: z.object({
-		pkgName: z.string(),
+		/** 缺省经 detectBundleIds 从工程文件自动推导（README 首例即只有 stores 的最小配置） */
+		pkgName: z.string().optional(),
 		/** 渠道 → 渠道侧配置（appId 等）；stores 里列出的渠道才发 */
 		stores: StoresSchema
 	}).optional(),
 	harmony: z.object({
-		bundleName: z.string(),
+		/** 缺省自动推导（AppScope/app.json5） */
+		bundleName: z.string().optional(),
 		appId: z.string().optional()
 	}).optional(),
 	ios: z.object({
-		scheme: z.string(),
+		/** 缺省自动推导（工程 scheme 探测） */
+		scheme: z.string().optional(),
 		workspace: z.string().optional(),
 		/** App Store Connect 按 bundleId 定位 App（asc 渠道 submit 用） */
 		bundleId: z.string().optional()
@@ -208,14 +219,16 @@ function resolveProfile(creds, profile, knownKeys) {
 	for (const [envName, value] of Object.entries(process.env)) if (envName.startsWith("APPLIFT_") && value) merged[envName.slice(8)] = value;
 	return merged;
 }
-/** 全局配置装载（缺失/损坏降级默认值并警告，不阻断） */
+/** 全局配置装载（缺失/损坏降级默认值；警告经返回值交给调用方，不阻断） */
 function loadGlobalConfig(filePath = GLOBAL_CONFIG_PATH) {
-	if (!fs.existsSync(filePath)) return GlobalConfigSchema.parse({});
+	if (!fs.existsSync(filePath)) return { config: GlobalConfigSchema.parse({}) };
 	try {
-		return GlobalConfigSchema.parse(parse(fs.readFileSync(filePath, "utf8")));
+		return { config: GlobalConfigSchema.parse(parse(fs.readFileSync(filePath, "utf8"))) };
 	} catch (e) {
-		process.stderr.write?.(`[applift] 全局配置解析失败，使用默认值: ${e.message}\n`);
-		return GlobalConfigSchema.parse({});
+		return {
+			config: GlobalConfigSchema.parse({}),
+			warning: `全局配置解析失败，使用默认值: ${e.message}`
+		};
 	}
 }
 /** 写凭据（目录自动创建，文件强制 0600） */
@@ -266,8 +279,13 @@ async function loadProjectConfig(cwd) {
 		packageJson: false,
 		defaults: ProjectConfigSchema.parse({})
 	});
+	const parsed = ProjectConfigSchema.safeParse(result.config ?? {});
+	if (!parsed.success) {
+		const details = parsed.error.issues.map((i) => `${i.path.join(".") || "(根)"}: ${i.message}`).join("；");
+		throw new Error(`applift.config.ts 字段校验失败 → ${details}`);
+	}
 	return {
-		config: ProjectConfigSchema.parse(result.config ?? {}),
+		config: parsed.data,
 		raw: result.config ?? {},
 		cwd: result.cwd ?? cwd
 	};
@@ -370,8 +388,19 @@ async function formPost(url, params, { timeout = 6e4 } = {}) {
 	}
 }
 //#endregion
+//#region src/channels/shared/file-blob.ts
+/**
+* 惰性文件 Blob：FormData multipart 上传的文件部件。
+* 优先 fs.openAsBlob（Node ≥19.8，按需分片读，零整读内存）；
+* 能力检测不存在时回退整读（旧运行时兜底）。
+*/
+async function fileBlob(p) {
+	if (typeof fs.openAsBlob === "function") return fs.openAsBlob(p);
+	return new Blob([await fs.promises.readFile(p)]);
+}
+//#endregion
 //#region src/util.ts
-/** core 内部共用小工具（不进公共 API） */
+/** core 内部共用小工具（sleep/formatSize 仅内部使用；sha256File 经 index 导出，CLI 历史指纹用） */
 const sleep = (ms) => new Promise((res) => setTimeout(res, ms));
 /** 分块计算文件 SHA256（产物可达上百 MB，8MB 分块避免整读内存，同 sign.ts md5File 先例） */
 function sha256File(filePath) {
@@ -413,7 +442,8 @@ async function pgyerPost(host, apiPath, form) {
 	const res = await fetch(`https://${host}${apiPath}`, {
 		method: "POST",
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body
+		body,
+		signal: AbortSignal.timeout(3e4)
 	});
 	const text = await res.text();
 	try {
@@ -431,6 +461,8 @@ var PgyerChannel = class {
 		scheduled: false,
 		status: false
 	};
+	/** 平台错误码 → 人话（1247：源码注释已证 = buildKey 尚未就绪/COS 仍在入库） */
+	errorHints = { "1247": "buildKey 尚未就绪（COS 上传仍在入库），属处理中状态，稍候即可" };
 	async plan(ctx) {
 		return {
 			channel: this.id,
@@ -487,7 +519,7 @@ var PgyerChannel = class {
 		form.append("x-cos-security-token", params["x-cos-security-token"]);
 		form.append("key", params.key);
 		form.append("x-cos-meta-file-name", path.basename(ctx.artifactPath));
-		form.append("file", new Blob([fs.readFileSync(ctx.artifactPath)]), path.basename(ctx.artifactPath));
+		form.append("file", await fileBlob(ctx.artifactPath), path.basename(ctx.artifactPath));
 		const upRes = await fetch(endpoint, {
 			method: "POST",
 			body: form,
@@ -970,6 +1002,11 @@ var XiaomiChannel = class {
 		scheduled: false,
 		status: true
 	};
+	/** 平台错误码 → 人话（result 码：依据为本仓测试已固化的真实失败路径文案） */
+	errorHints = {
+		"401": "签名无效或账号无该包名权限（检查 MI_CLIENT_SECRET 与 /dev/query 权限）",
+		"1005": "push SIG 校验失败（检查证书公钥与密码是否匹配）"
+	};
 	async plan(_ctx) {
 		return {
 			channel: this.id,
@@ -1051,8 +1088,8 @@ var XiaomiChannel = class {
 		const form = new FormData();
 		form.append("RequestData", requestJson);
 		form.append("SIG", sig);
-		form.append("apk", new Blob([fs.readFileSync(ctx.artifactPath)]), fileName);
-		form.append("icon", new Blob([fs.readFileSync(iconPath)]), path.basename(iconPath));
+		form.append("apk", await fileBlob(ctx.artifactPath), fileName);
+		form.append("icon", await fileBlob(iconPath), path.basename(iconPath));
 		const res = await fetch(`${MI_API_BASE}/dev/push`, {
 			method: "POST",
 			body: form,
@@ -1375,7 +1412,7 @@ var OppoChannel = class {
 		const form = new FormData();
 		form.append("type", "apk");
 		form.append("sign", sign);
-		form.append("file", new Blob([fs.readFileSync(ctx.artifactPath)]), fileName);
+		form.append("file", await fileBlob(ctx.artifactPath), fileName);
 		const upRes = await fetch(uploadUrl, {
 			method: "POST",
 			body: form,
@@ -1670,7 +1707,7 @@ var VivoChannel = class {
 		params.sign = hmacSign(accessSecret, params);
 		const form = new FormData();
 		for (const [k, v] of Object.entries(params)) form.append(k, v);
-		form.append("file", new Blob([fs.readFileSync(ctx.artifactPath)]), fileName);
+		form.append("file", await fileBlob(ctx.artifactPath), fileName);
 		const upRes = await fetch(API_BASE$2, {
 			method: "POST",
 			body: form,
@@ -1925,7 +1962,7 @@ var HonorChannel = class {
 			message: `上传 ${fileName}（${formatSize(fileSize)}）`
 		});
 		const form = new FormData();
-		form.append("file", new Blob([fs.readFileSync(ctx.artifactPath)]), fileName);
+		form.append("file", await fileBlob(ctx.artifactPath), fileName);
 		const upRes = await fetch(uploadUrl, {
 			method: "POST",
 			headers: { Authorization: `Bearer ${token}` },
@@ -2117,6 +2154,8 @@ var YybChannel = class {
 		scheduled: true,
 		status: true
 	};
+	/** 平台错误码 → 人话（ret 码：依据为本仓测试已固化的真实失败路径） */
+	errorHints = { "10010": "应用不存在（检查 YYB_APP_ID 与 user_id 是否匹配该应用）" };
 	/** stage 产物暂存（serial_number + md5），submit 按 appId 取回 */
 	staged = /* @__PURE__ */ new Map();
 	required(ctx, key, where) {
@@ -2319,7 +2358,10 @@ const COMPILE_POLL_MS = 15e3;
 const APP_TEST_BASE = "https://connect-api.cloud.huawei.com/api/app-test/v1";
 /** AGC JSON API 封装：判 ret.code !== 0 抛错 —— v1 agc.mjs agcJson 原样 */
 async function agcJson(url, init, context) {
-	const res = await fetch(url, init);
+	const res = await fetch(url, {
+		...init,
+		signal: init.signal ?? AbortSignal.timeout(6e4)
+	});
 	let json;
 	try {
 		json = await res.json();
@@ -2779,10 +2821,13 @@ var AgcHarmonyChannel = class {
 				current: String(current),
 				pageSize: "50"
 			});
-			const res = await fetch(`${APP_TEST_BASE}/test-group/list?${qs}`, { headers: {
-				...headers,
-				appId
-			} });
+			const res = await fetch(`${APP_TEST_BASE}/test-group/list?${qs}`, {
+				headers: {
+					...headers,
+					appId
+				},
+				signal: AbortSignal.timeout(6e4)
+			});
 			if (!res.ok) throw new Error(`AGC 查询测试群组失败 HTTP ${res.status}`);
 			const json = await res.json();
 			if (Number(json.rtnCode) !== 0) throw new Error(`AGC 查询测试群组失败: rtnCode=${json.rtnCode ?? "?"}${json.rtnDesc ? ` ${json.rtnDesc}` : ""}`);
@@ -3247,6 +3292,8 @@ var GooglePlayChannel = class {
 		scheduled: false,
 		status: true
 	};
+	/** 平台错误码 → 人话（HTTP 状态：依据为本仓测试已固化的失败路径） */
+	errorHints = { "403": "权限不足（检查 Service Account 是否已关联 Play Console 且有发布权限）" };
 	async plan(_ctx) {
 		return {
 			channel: this.id,
@@ -3263,12 +3310,40 @@ var GooglePlayChannel = class {
 			ref: await this.uploadAndAssign(ctx, "internal", void 0)
 		};
 	}
-	async submit(ctx) {
+	async submit(ctx, stagedRef) {
+		const reusedVc = stagedRef?.split(":")[1];
+		if (reusedVc !== void 0 && reusedVc !== "") return {
+			ok: true,
+			ref: await this.assignExisting(ctx, "production", Number(reusedVc))
+		};
 		return {
 			ok: true,
 			ref: await this.uploadAndAssign(ctx, "production", ctx.updateDescription)
 		};
 	}
+	/** 复用 stage 已上传的 versionCode：开新 edit（仍需 auth）→ 部署 production → commit，跳过上传 */
+	async assignExisting(ctx, track, versionCode) {
+		const pkgName = this.requirePkgName(ctx);
+		const token = await getAccessToken(ctx.credentials);
+		ctx.emit({
+			type: "phase",
+			phase: "auth",
+			message: "OAuth2 token 获取成功"
+		});
+		const edit = await apiFetch(`${API_BASE}/${pkgName}/edits`, token, {
+			method: "POST",
+			body: "{}"
+		}, "创建 edit");
+		if (!edit.id) throw new Error(`Google Play 创建 edit 响应缺少 id: ${JSON.stringify(edit).slice(0, 300)}`);
+		const editId = edit.id;
+		ctx.emit({
+			type: "phase",
+			phase: "upload",
+			message: `复用 stage 上传的 versionCode ${versionCode}（跳过重复上传）`
+		});
+		await this.deployAndCommit(ctx, pkgName, token, editId, track, versionCode, ctx.updateDescription);
+		return `${editId}:${versionCode}`;
+	}
 	/** 上传 + 部署到指定轨道 + commit，返回 `editId:versionCode` */
 	async uploadAndAssign(ctx, track, releaseNotes) {
 		const pkgName = this.requirePkgName(ctx);
@@ -3307,6 +3382,15 @@ var GooglePlayChannel = class {
 			type: "progress",
 			detail: `上传成功（versionCode: ${versionCode}）`
 		});
+		return this.deployAndCommit(ctx, pkgName, token, editId, track, versionCode, releaseNotes);
+	}
+	/**
+	* 部署 versionCode 到指定轨道并 commit：
+	* 先 GET 轨道现有 releases 再合并 PUT——目标 release（同 status=completed 配置）追加新 versionCode，
+	* 其余 releases 原样保留（status/userFraction 不变），避免整轨覆盖把旧版本从轨道剔除；
+	* :commit 冒号语法（对拍 apkgo googleplay.go 权威；对 production 含提交审核语义，internal 即生效）
+	*/
+	async deployAndCommit(ctx, pkgName, token, editId, track, versionCode, releaseNotes) {
 		const releases = [...(await apiFetch(`${API_BASE}/${pkgName}/edits/${editId}/tracks/${track}`, token, { method: "GET" }, `读取 ${track} 轨道现有 releases`)).releases ?? []];
 		const release = {
 			versionCodes: [versionCode],
@@ -3374,6 +3458,11 @@ var GooglePlayChannel = class {
 };
 //#endregion
 //#region src/pipeline.ts
+/**
+* 发布编排引擎：构建计划 → 确认协议 → 并发执行 → 汇总。
+* headless：确认通过注入的 confirm 回调完成（CLI 用 clack/弹窗），core 不碰终端。
+* 插件：可选 PluginHost，在 plan/stage/submit 生命周期触发钩子（可拦截可修改）。
+*/
 async function runLimited(items, limit, fn) {
 	const queue = [...items];
 	const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
@@ -3497,12 +3586,13 @@ async function runSubmit(input, options) {
 						label: channel.label,
 						ok: false,
 						submitError: "被插件跳过",
-						plan: planFor(plans, basePlans, channel.id)
+						plan: planFor(plans, basePlans, channel.id, ctx.artifactPath)
 					});
 					return;
 				}
 				effectiveCtx = r.value;
 			}
+			let stagedRef;
 			if (!options.skipStage && channel.capabilities.stage) {
 				const stageResult = await channel.stage(effectiveCtx);
 				if (!stageResult.ok) {
@@ -3511,7 +3601,7 @@ async function runSubmit(input, options) {
 						label: channel.label,
 						ok: false,
 						stageError: stageResult.error,
-						plan: planFor(plans, basePlans, channel.id)
+						plan: planFor(plans, basePlans, channel.id, ctx.artifactPath)
 					});
 					input.historySink?.({
 						channel: channel.id,
@@ -3521,6 +3611,7 @@ async function runSubmit(input, options) {
 					});
 					return;
 				}
+				stagedRef = stageResult.ref;
 				input.historySink?.({
 					channel: channel.id,
 					action: "stage",
@@ -3529,13 +3620,13 @@ async function runSubmit(input, options) {
 					artifactVersion: plans.find((p) => p.channel === channel.id)?.artifactVersion || void 0
 				});
 			}
-			const r = await channel.submit(effectiveCtx);
+			const r = await channel.submit(effectiveCtx, stagedRef);
 			summary.push({
 				channel: channel.id,
 				label: channel.label,
 				ok: r.ok,
 				submitError: r.error,
-				plan: planFor(plans, basePlans, channel.id)
+				plan: planFor(plans, basePlans, channel.id, ctx.artifactPath)
 			});
 			input.historySink?.({
 				channel: channel.id,
@@ -3550,7 +3641,7 @@ async function runSubmit(input, options) {
 				label: channel.label,
 				ok: false,
 				submitError: e.message,
-				plan: planFor(plans, basePlans, channel.id)
+				plan: planFor(plans, basePlans, channel.id, ctx.artifactPath)
 			});
 			input.historySink?.({
 				channel: channel.id,
@@ -3573,22 +3664,29 @@ async function safePlan(channel, ctx) {
 	try {
 		return await channel.plan(ctx);
 	} catch {
-		return fallbackPlan(channel.id);
+		return fallbackPlan(channel.id, ctx.artifactPath);
 	}
 }
-/** plan 失败/被插件删除时的兜底条目（保 summary.plan 非可选契约） */
-function fallbackPlan(channelId) {
+/** 按产物扩展名推断平台（兜底条目用）：.ipa→ios，.hap→harmony，.apk/.aab 及其余→android */
+function platformOfArtifact(artifactPath) {
+	const ext = path.extname(artifactPath).toLowerCase();
+	if (ext === ".ipa") return "ios";
+	if (ext === ".hap") return "harmony";
+	return "android";
+}
+/** plan 失败/被插件删除时的兜底条目（保 summary.plan 非可选契约；平台按产物推断不再硬编码 android） */
+function fallbackPlan(channelId, artifactPath) {
 	return {
 		channel: channelId,
-		platform: "android",
+		platform: platformOfArtifact(artifactPath),
 		artifactVersion: "",
 		action: "stage+submit",
 		afterApproval: "auto-publish"
 	};
 }
 /** 汇总条目取计划：plan:before 改写后的 plans 优先，被插件删除时回退改写前快照，永不返回 undefined */
-function planFor(plans, base, id) {
-	return plans.find((p) => p.channel === id) ?? base.get(id) ?? fallbackPlan(id);
+function planFor(plans, base, id, artifactPath) {
+	return plans.find((p) => p.channel === id) ?? base.get(id) ?? fallbackPlan(id, artifactPath);
 }
 //#endregion
 //#region src/plugin.ts
@@ -3599,6 +3697,8 @@ var PluginHost = class {
 	}
 	/**
 	* 顺序执行某钩子；支持「链式替换」（返回对象则替换后继续传给下一插件）与「拦截」（返回 false 立即中止）。
+	* 信任边界：返回值按 T 强转、不做形状校验（vite 同款取舍）——插件作者自负其责，
+	* 坏形状会在后续消费点显式抛错，宿主不代为静默兜底。
 	* @returns {[被拦截?, 最终值]} false 表示被某插件拦截
 	*/
 	async apply(hook, value, ctx) {
@@ -4073,13 +4173,116 @@ function readEntries(query = {}, filePath = HISTORY_PATH) {
 //#region src/channels/shared/error-codes.ts
 /**
 * 错误码人话化：消费各渠道自带 errorHints（平台内聚——表与渠道实现同文件）。
+* 网络类故障（AbortSignal 超时/断连/DNS）渠道层不转译，统一在此兜底提示。
 */
+/** 网络故障特征 → 人话提示（命中即返回，优先于渠道码表） */
+const NETWORK_HINTS = [[/aborted due to timeout|TimeoutError/i, "请求超时（服务端无响应或网络不稳）：可重跑；大包上传建议在稳定网络环境执行"], [/\b(?:ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|EPIPE)\b|socket hang up|fetch failed/i, "网络故障（连接被重置/DNS 解析失败等）：检查网络或代理后重跑"]];
+/** 码匹配：纯数字码加数字边界（防 1003 误中 11003/10031）；其余按包含匹配 */
+function matchesCode(message, code) {
+	if (/^\d+$/.test(code)) return new RegExp(`(?<!\\d)${code}(?!\\d)`).test(message);
+	return message.includes(code);
+}
 function humanizeError(hints, message) {
+	for (const [re, hint] of NETWORK_HINTS) if (re.test(message)) return `${message}\n  提示: ${hint}`;
 	if (!hints) return message;
-	for (const [code, hint] of Object.entries(hints)) if (message.includes(code)) return `${message}\n  提示: ${hint}`;
+	for (const [code, hint] of Object.entries(hints)) if (matchesCode(message, code)) return `${message}\n  提示: ${hint}`;
 	return message;
 }
 //#endregion
+//#region src/channels/shared/redact.ts
+/**
+* 凭据脱敏（对拍 apkgo pkg/httptrace/redact.go 权威）。
+* 判定依据是“名字”：JSON 键 / 表单字段 / query 参数 / header 名携带凭据语义即整值掩码为
+* [REDACTED <len>]（保留长度线索），空串保持空串——“签名为空”本身就是排查线索。
+* 非敏感名下的值仍递归扫内容（signed URL / 内嵌 JSON / name=value 自由文本）。
+* 故意分歧：掩码不做 percent-encode（日志可读性优先）；JSON 再序列化保持原键序（Go map 序随机）。
+* 挂接点：CLI / 错误消息层接入（core 先提供能力）。
+*/
+/** 归一化后「包含即敏感」的词（对拍 redact.go sensitiveWords） */
+const SENSITIVE_WORDS = [
+	"secret",
+	"token",
+	"password",
+	"passwd",
+	"authorization",
+	"credential",
+	"cookie",
+	"privatekey",
+	"apikey",
+	"assertion",
+	"jwt",
+	"signature"
+];
+/** 归一化后全等即敏感的名字（对拍 redact.go sensitiveNames） */
+const SENSITIVE_NAMES = {
+	sig: true,
+	sign: true,
+	pwd: true,
+	auth: true
+};
+/** 名字是否携带凭据语义（JSON 键 / 表单字段 / query 参数 / header 名通用；归一化 = 小写去非字母数字） */
+function isSensitiveName(name) {
+	const n = name.toLowerCase().replace(/[^a-z0-9]/g, "");
+	if (n in SENSITIVE_NAMES) return true;
+	if (n === "tokentype" || n.startsWith("accesscontrol")) return false;
+	if (n.endsWith("sign") && n !== "design") return true;
+	return SENSITIVE_WORDS.some((w) => n.includes(w));
+}
+/** 整值掩码：保留长度；空串保持（“签名为空”是有效诊断信息）。3 处调用点需锁步一致 */
+function mask(v) {
+	return v === "" ? "" : `[REDACTED ${v.length}]`;
+}
+/**
+* 按名字脱敏单个值：敏感名 → 整值掩码；Authorization 保留 scheme（"Bearer [REDACTED 812]"，
+* 对拍 redact.go redactHeaders）；非敏感名 → 递归 redactText 扫值内凭据。
+*/
+function redactValue(name, v) {
+	if (/^authorization$/i.test(name) && v.includes(" ")) {
+		const schemeEnd = v.indexOf(" ");
+		return `${v.slice(0, schemeEnd)} ${mask(v.slice(schemeEnd + 1))}`;
+	}
+	return isSensitiveName(name) ? mask(v) : redactText(v);
+}
+/** redactURL：剥离 userinfo + query 参数按名脱敏，路径/fragment 原样保留 */
+function redactUrlString(v) {
+	let out = v.replace(/^(https?:\/\/)[^/?#]*@/, "$1");
+	const hashIdx = out.indexOf("#");
+	const hash = hashIdx >= 0 ? out.slice(hashIdx) : "";
+	if (hashIdx >= 0) out = out.slice(0, hashIdx);
+	const qIdx = out.indexOf("?");
+	if (qIdx < 0) return out + hash;
+	const query = new URLSearchParams(out.slice(qIdx + 1));
+	const pairs = [];
+	for (const [k, val] of query) pairs.push(`${k}=${isSensitiveName(k) ? mask(val) : val}`);
+	return `${out.slice(0, qIdx)}?${pairs.join("&")}${hash}`;
+}
+/** free 文本中的 name=value / "name":"value" 凭据对（对拍 redact.go scrubRe；掩码无长度） */
+const SCRUB_RE = /([\w.-]*(?:secret|token|password|passwd|signature|credential|authorization|api_?key|assertion)[\w.-]*"?\s*[=:]\s*"?)([^"&\s,;<}]+)/gi;
+/** JSON 树递归：敏感名下字符串掩码、数字/布尔置 [REDACTED]，数组元素继承外层键名 */
+function redactTree(name, v) {
+	if (v === null || typeof v !== "object") {
+		if (typeof v === "string") return redactValue(name, v);
+		return isSensitiveName(name) ? "[REDACTED]" : v;
+	}
+	if (Array.isArray(v)) return v.map((x) => redactTree(name, x));
+	const out = {};
+	for (const [k, val] of Object.entries(v)) out[k] = redactTree(k, val);
+	return out;
+}
+/**
+* 文本脱敏（三层层叠，逐层尝试）：
+*   1) http(s) URL 带 query/userinfo → query 按名脱敏 + 剥 userinfo
+*   2) { / [ 开头且整串为合法 JSON → 递归按键名脱敏
+*   3) 其余 → name=value 正则扫（错误消息等无结构文本）
+*/
+function redactText(v) {
+	if (/^https?:\/\//i.test(v) && (v.includes("?") || /^https?:\/\/[^/?#]*@/i.test(v))) return redactUrlString(v);
+	if (v.length > 1 && (v.startsWith("{") || v.startsWith("["))) try {
+		return JSON.stringify(redactTree("", JSON.parse(v)));
+	} catch {}
+	return v.replace(SCRUB_RE, "$1[REDACTED]");
+}
+//#endregion
 //#region src/version/project.ts
 /**
 * 工程文件版本读写（可接管模式：版本事实源永远是工程文件，applift 只代读代写）。
@@ -5039,4 +5242,4 @@ function fromAapt(artifactPath) {
 	}
 }
 //#endregion
-export { APPLIFT_HOME, AgcHarmonyChannel, AscChannel, BetaConfigSchema, CREDENTIALS_PATH, CredentialsFileSchema, CredentialsProfileSchema, DefaultChannelRegistry, GLOBAL_CONFIG_PATH, GlobalConfigSchema, GooglePlayChannel, HISTORY_PATH, HonorChannel, HuaweiAndroidChannel, OppoChannel, PROJECTS_MAP_PATH, PgyerChannel, PluginHost, ProjectConfigSchema, ReleaseConfigSchema, StoreConfigSchema, StoresSchema, VersionCodeConfigSchema, VersionConfigSchema, VivoChannel, WAIT_BEFORE_SUBMIT_MS, XiaomiChannel, YybChannel, appendEntry, applyBump, assertListingFiles, commitsSince, decideNextVersion, defineConfig, detectBundleIds, detectFramework, electronAdapter, evalVersionCodeFormula, findArtifacts, findUp, flutterAdapter, formPost, getAgcToken, getHarmonyAppId, git, hmacSign, humanizeError, inferBumpLevel, isGitRepo, latestSemverTag, loadCredentials, loadCredentialsLayered, loadGlobalConfig, loadListingFile, loadProjectConfig, loadProjectProfileMap, looseSemver, md5File, md5String, nativeAndroidAdapter, nativeHarmonyAdapter, nativeIosAdapter, nextVersionCode, planBump, projectCredentialsPath, readArtifactVersion, readEntries, readProjectVersions, registry, renderChangelogSection, resolveListing, resolvePlugins, resolveProfile, resolveProfileFor, rnAdapter, runStage, runSubmit, saveCredentials, saveProjectProfileMap, setProjectProfile, sha256File, sortedQueryString, statusShort, storeVersionName, tauriAdapter, toChangelogEntries, tsMillis, tsSeconds, upsertChangelog, writeProjectVersions };
+export { APPLIFT_HOME, AgcHarmonyChannel, AscChannel, BetaConfigSchema, CREDENTIALS_PATH, CredentialsFileSchema, CredentialsProfileSchema, DefaultChannelRegistry, GLOBAL_CONFIG_PATH, GlobalConfigSchema, GooglePlayChannel, HISTORY_PATH, HonorChannel, HuaweiAndroidChannel, OppoChannel, PROJECTS_MAP_PATH, PgyerChannel, PluginHost, ProjectConfigSchema, ReleaseConfigSchema, StoreConfigSchema, StoresSchema, VersionCodeConfigSchema, VersionConfigSchema, VivoChannel, WAIT_BEFORE_SUBMIT_MS, XiaomiChannel, YybChannel, appendEntry, applyBump, assertListingFiles, commitsSince, decideNextVersion, defineConfig, detectBundleIds, detectFramework, electronAdapter, evalVersionCodeFormula, findArtifacts, findUp, flutterAdapter, formPost, getAgcToken, getHarmonyAppId, git, hmacSign, humanizeError, inferBumpLevel, isGitRepo, latestSemverTag, loadCredentials, loadCredentialsLayered, loadGlobalConfig, loadListingFile, loadProjectConfig, loadProjectProfileMap, looseSemver, md5File, md5String, nativeAndroidAdapter, nativeHarmonyAdapter, nativeIosAdapter, nextVersionCode, planBump, projectCredentialsPath, readArtifactVersion, readEntries, readProjectVersions, redactText, registry, renderChangelogSection, resolveListing, resolvePlugins, resolveProfile, resolveProfileFor, rnAdapter, runStage, runSubmit, saveCredentials, saveProjectProfileMap, setProjectProfile, sha256File, sortedQueryString, statusShort, storeVersionName, tauriAdapter, toChangelogEntries, tsMillis, tsSeconds, upsertChangelog, writeProjectVersions };

package/dist/{plugin-CTt0LO8c.d.mts → plugin-B2GGlI_2.d.mts}

@@ -46,16 +46,6 @@ interface BundleIds {
 declare function detectBundleIds(cwd: string): BundleIds;
 //#endregion
 //#region src/channel.d.ts
-/**
- * 渠道适配器统一接口 —— applift 可扩展性的核心。
- *
- * 每个渠道（六商店/AGC/ASC/蒲公英…）实现本接口并注册到 registry；
- * 编排引擎（pipeline）只面对本接口，不感知任何渠道细节。
- *
- * 两段式安全模型：
- *   stage  = 只把包送到渠道草稿区，不动线上（iOS 上传构建≈只进 TestFlight）
- *   submit = 提审；除 iOS（默认 manual 发布）外，审核通过即自动上架 —— 不可逆，需计划确认
- */
 /** 渠道能力声明（编排与确认界面据此渲染/拦截） */
 interface ChannelCapabilities {
   /** 支持只传包不提审（小米 push 一体 → false，submit 即上传） */
@@ -145,8 +135,12 @@ interface Channel {
   plan(ctx: ChannelContext): Promise<ReleasePlanEntry>;
   /** 传包到草稿（capabilities.stage=false 的渠道返回明确错误） */
   stage(ctx: ChannelContext): Promise<StageResult>;
-  /** 提审（=审核通过自动上架，L3 不可逆操作） */
-  submit(ctx: ChannelContext): Promise<SubmitResult>;
+  /**
+   * 提审（=审核通过自动上架，L3 不可逆操作）。
+   * stagedRef = 同渠道 stage 成功返回的 ref（如 googleplay 的 `editId:versionCode`），
+   * 供实现复用 stage 已上传的草稿、避免重复上传；实现方可忽略。
+   */
+  submit(ctx: ChannelContext, stagedRef?: string): Promise<SubmitResult>;
   /** 查询审核状态（capabilities.status=false 时抛 NotSupported） */
   status(ctx: Pick<ChannelContext, "credentials" | "target">): Promise<ReviewStatus>;
 }
@@ -167,13 +161,7 @@ type CredentialsFile = z.infer<typeof CredentialsFileSchema>;
 /** 单渠道配置（appId、pkgName 等渠道侧键） */
 declare const StoreConfigSchema: z.ZodRecord<z.ZodString, z.ZodString>;
 type StoreConfig = z.infer<typeof StoreConfigSchema>;
-/**
- * stores 三种等价写法，统一规范化为 record：
- * ① 对象：{ huawei: { appId: 'x' } }（原有写法，原样保留）
- * ② 数组：['oppo', 'vivo'] → { oppo: {}, vivo: {} }（无配置渠道）
- * ③ 字符串值：{ huawei: '10xxx' } → { huawei: { appId: '10xxx' } }（appId 简写）
- */
-declare const StoresSchema: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodString>, z.ZodString]>>, z.ZodArray<z.ZodString>]>, z.ZodTransform<Record<string, Record<string, string>>, string[] | Record<string, string | Record<string, string>>>>>;
+declare const StoresSchema: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodString>, z.ZodString]>>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>]>, z.ZodTransform<Record<string, Record<string, string>>, (string | Record<string, string>)[] | Record<string, string | Record<string, string>>>>>;
 type Stores = z.infer<typeof StoresSchema>;
 /** 项目级配置（applift.config.ts 的形状）；beta 段见上方 BetaConfigSchema */
 /**
@@ -223,15 +211,15 @@ declare const ProjectConfigSchema: z.ZodObject<{
   name: z.ZodOptional<z.ZodString>;
   profile: z.ZodDefault<z.ZodString>;
   android: z.ZodOptional<z.ZodObject<{
-    pkgName: z.ZodString;
-    stores: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodString>, z.ZodString]>>, z.ZodArray<z.ZodString>]>, z.ZodTransform<Record<string, Record<string, string>>, string[] | Record<string, string | Record<string, string>>>>>;
+    pkgName: z.ZodOptional<z.ZodString>;
+    stores: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodString>, z.ZodString]>>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>]>, z.ZodTransform<Record<string, Record<string, string>>, (string | Record<string, string>)[] | Record<string, string | Record<string, string>>>>>;
   }, z.core.$strip>>;
   harmony: z.ZodOptional<z.ZodObject<{
-    bundleName: z.ZodString;
+    bundleName: z.ZodOptional<z.ZodString>;
     appId: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>>;
   ios: z.ZodOptional<z.ZodObject<{
-    scheme: z.ZodString;
+    scheme: z.ZodOptional<z.ZodString>;
     workspace: z.ZodOptional<z.ZodString>;
     bundleId: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>>;
@@ -359,7 +347,7 @@ interface HookContext {
   /** 项目根目录 */
   cwd: string;
 }
-interface QypubPlugin {
+interface AppliftPlugin {
   name: string;
   "config:resolved"?(config: ProjectConfig, ctx: HookContext): Promise<ProjectConfig | void> | ProjectConfig | void;
   "channel:register"?(registry: ChannelRegistry, ctx: HookContext): Promise<void> | void;
@@ -377,12 +365,14 @@ interface QypubPlugin {
   "submit:after"?(summary: PipelineSummary, ctx: HookContext): Promise<void> | void;
   notify?(summary: PipelineSummary, ctx: HookContext): Promise<void> | void;
 }
-type PluginHookName = Exclude<keyof QypubPlugin, "name">;
+type PluginHookName = Exclude<keyof AppliftPlugin, "name">;
 declare class PluginHost {
   private readonly plugins;
-  constructor(plugins: QypubPlugin[]);
+  constructor(plugins: AppliftPlugin[]);
   /**
    * 顺序执行某钩子；支持「链式替换」（返回对象则替换后继续传给下一插件）与「拦截」（返回 false 立即中止）。
+   * 信任边界：返回值按 T 强转、不做形状校验（vite 同款取舍）——插件作者自负其责，
+   * 坏形状会在后续消费点显式抛错，宿主不代为静默兜底。
    * @returns {[被拦截?, 最终值]} false 表示被某插件拦截
    */
   apply<T>(hook: PluginHookName, value: T, ctx: HookContext): Promise<{
@@ -396,11 +386,11 @@ declare class PluginHost {
  * defineConfig —— vite 同款体验：applift.config.ts 导出时提供类型提示。
  * plugins 中允许嵌套工厂函数（如 dingtalkNotify({...}) 直接返回插件对象）。
  */
-interface QypubUserConfig extends Partial<ProjectConfig> {
-  plugins?: Array<QypubPlugin | (() => QypubPlugin)>;
+interface AppliftUserConfig extends Partial<ProjectConfig> {
+  plugins?: Array<AppliftPlugin | (() => AppliftPlugin)>;
 }
-declare function defineConfig(config: QypubUserConfig): QypubUserConfig;
+declare function defineConfig(config: AppliftUserConfig): AppliftUserConfig;
 /** 解析用户配置中的插件（工厂惰性求值），供 PluginHost 构造 */
-declare function resolvePlugins(userConfig: QypubUserConfig): QypubPlugin[];
+declare function resolvePlugins(userConfig: AppliftUserConfig): AppliftPlugin[];
 //#endregion
-export { electronAdapter as $, ReleaseConfigSchema as A, ChannelCapabilities as B, CredentialsProfile as C, ProjectConfig as D, GlobalConfigSchema as E, VersionCodeConfig as F, ReviewStatus as G, ChannelEvent as H, VersionCodeConfigSchema as I, BundleIds as J, StageResult as K, VersionConfig as L, StoreConfigSchema as M, Stores as N, ProjectConfigSchema as O, StoresSchema as P, detectFramework as Q, VersionConfigSchema as R, CredentialsFileSchema as S, GlobalConfig as T, ChannelRegistry as U, ChannelContext as V, ReleasePlanEntry as W, Platform as X, FrameworkAdapter as Y, detectBundleIds as Z, appendEntry as _, QypubUserConfig as a, rnAdapter as at, BetaConfigSchema as b, PipelineInput as c, runStage as d, findArtifacts as et, runSubmit as f, HistoryQuery as g, HistoryEvent as h, QypubPlugin as i, nativeIosAdapter as it, StoreConfig as j, ReleaseConfig as k, PipelineSummary as l, HistoryEntry as m, PluginHookName as n, nativeAndroidAdapter as nt, defineConfig as o, tauriAdapter as ot, HISTORY_PATH as p, SubmitResult as q, PluginHost as r, nativeHarmonyAdapter as rt, resolvePlugins as s, HookContext as t, flutterAdapter as tt, PipelineSummaryEntry as u, readEntries as v, CredentialsProfileSchema as w, CredentialsFile as x, BetaConfig as y, Channel as z };
+export { electronAdapter as $, ReleaseConfigSchema as A, ChannelCapabilities as B, CredentialsProfile as C, ProjectConfig as D, GlobalConfigSchema as E, VersionCodeConfig as F, ReviewStatus as G, ChannelEvent as H, VersionCodeConfigSchema as I, BundleIds as J, StageResult as K, VersionConfig as L, StoreConfigSchema as M, Stores as N, ProjectConfigSchema as O, StoresSchema as P, detectFramework as Q, VersionConfigSchema as R, CredentialsFileSchema as S, GlobalConfig as T, ChannelRegistry as U, ChannelContext as V, ReleasePlanEntry as W, Platform as X, FrameworkAdapter as Y, detectBundleIds as Z, appendEntry as _, PluginHost as a, rnAdapter as at, BetaConfigSchema as b, PipelineInput as c, runStage as d, findArtifacts as et, runSubmit as f, HistoryQuery as g, HistoryEvent as h, PluginHookName as i, nativeIosAdapter as it, StoreConfig as j, ReleaseConfig as k, PipelineSummary as l, HistoryEntry as m, AppliftUserConfig as n, nativeAndroidAdapter as nt, defineConfig as o, tauriAdapter as ot, HISTORY_PATH as p, SubmitResult as q, HookContext as r, nativeHarmonyAdapter as rt, resolvePlugins as s, AppliftPlugin as t, flutterAdapter as tt, PipelineSummaryEntry as u, readEntries as v, CredentialsProfileSchema as w, CredentialsFile as x, BetaConfig as y, Channel as z };

package/dist/plugins/index.d.mts

@@ -1,4 +1,4 @@
-import { i as QypubPlugin } from "../plugin-CTt0LO8c.mjs";
+import { t as AppliftPlugin } from "../plugin-B2GGlI_2.mjs";
 //#region src/plugins/dingtalk-notify.d.ts
 interface DingtalkNotifyOptions {
   webhook: string;
@@ -6,6 +6,6 @@ interface DingtalkNotifyOptions {
   secret?: string;
   atMobiles?: string[];
 }
-export declare function dingtalkNotify(options: DingtalkNotifyOptions): QypubPlugin;
+export declare function dingtalkNotify(options: DingtalkNotifyOptions): AppliftPlugin;
 //#endregion
 export type { DingtalkNotifyOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applift/core",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/hcg1023/applift.git",