@heybox/hb-sdk 0.2.0-alpha.1 → 0.2.0-alpha.2

package/skill/references/safety-boundaries.md

@@ -16,6 +16,7 @@
 - `network.request()` 的 `validateStatus` 只在 SDK 本地执行，不会被序列化给父容器。
 - `on()` 返回取消监听函数；组件卸载或页面销毁时应主动取消监听。
 - 使用 `createMiniProgramSDK()` 创建独立实例后，不再需要时应调用 `destroy()`。
+- 构建产物可以包含 `dist/manifest.json`，业务代码不应自行 fetch 已部署的 manifest；这个文件由发布流水线读取并上送后台。
 
 ## Agent rules
 
@@ -25,4 +26,5 @@
 - Do not use storage delete, clear, info listing, V2, or global Heybox client storage access.
 - Do not pass host-only protocol fields through `network.request`.
 - Do not build raw `postMessage` bridge flows in iframe business code.
+- Do not fetch deployed `dist/manifest.json` from business code; it is a build artifact for the release pipeline, not a CDN runtime asset.
 - Do not import from internal hb-sdk implementation paths; only use documented package entrypoints.

package/skill/scripts/sync-references.mjs

@@ -173,6 +173,7 @@ function createCurrentSkillManifest(generatedReferences) {
 const packageJson = JSON.parse(read('packages/hb-sdk/package.json'));
 const rootEntry = read('packages/hb-sdk/src/index.ts');
 const protocolEntry = read('packages/hb-sdk/src/protocol.ts');
+const viteEntry = read('packages/hb-sdk/src/vite/index.ts');
 const cliEntry = read('packages/hb-sdk/src/cli/index.ts');
 const cliTemplateReadme = read('packages/hb-sdk/src/cli/templates/vue3-vite-ts/README.md.ejs');
 const readme = read('packages/hb-sdk/README.md');
@@ -193,6 +194,7 @@ const lifecycleEvents = extractSection(readme, '## 生命周期事件');
 const standardErrors = extractSection(readme, '## 错误处理');
 const sdkRuntimeRelation = extractSection(readme, '## SDK 与 Runtime');
 const capabilityBoundaries = extractSection(readme, '## 能力边界');
+const manifestSection = extractSection(readme, '## Manifest');
 const cliSummarySection = extractSection(readme, '## CLI');
 const repositoryDevelopment = extractSection(readme, '## 本仓库开发');
 const cliCreateSection = extractSection(cliGuide, '## 创建外部小程序模板');
@@ -209,10 +211,12 @@ const files = new Map();
 files.set('api-root.md', `${header('Root API reference', [
   'packages/hb-sdk/package.json',
   'packages/hb-sdk/src/index.ts',
+  'packages/hb-sdk/src/vite/index.ts',
   'packages/hb-sdk/README.md',
 ])}${contents([
   ['Package metadata', 'package-metadata'],
   ['Public root entrypoint', 'public-root-entrypoint'],
+  ['Vite plugin export', 'vite-plugin-export'],
   ['App-facing concepts', 'app-facing-concepts'],
   ['Public modules', 'public-modules'],
 ])}## Package metadata
@@ -221,11 +225,20 @@ files.set('api-root.md', `${header('Root API reference', [
 - Version at generation time: \`${packageJson.version}\`
 - Public root export: \`@heybox/hb-sdk\`
 - Protocol export: \`@heybox/hb-sdk/protocol\`
+- Vite plugin export: \`@heybox/hb-sdk/vite\`
 
 ## Public root entrypoint
 
 ${fenced('ts', rootEntry)}
 
+## Vite plugin export
+
+Use \`@heybox/hb-sdk/vite\` only in \`vite.config.ts\`. Do not import it from iframe mini-program business code.
+
+${fenced('ts', viteEntry)}
+
+${manifestSection}
+
 ## App-facing concepts
 
 ${quickStartSection}
@@ -404,6 +417,7 @@ ${capabilityBoundaries}
 - Do not use storage delete, clear, info listing, V2, or global Heybox client storage access.
 - Do not pass host-only protocol fields through \`network.request\`.
 - Do not build raw \`postMessage\` bridge flows in iframe business code.
+- Do not fetch deployed \`dist/manifest.json\` from business code; it is a build artifact for the release pipeline, not a CDN runtime asset.
 - Do not import from internal hb-sdk implementation paths; only use documented package entrypoints.
 `);
 
@@ -498,6 +512,15 @@ ${fenced('bash', `hb-sdk login
 hb-sdk login status
 hb-sdk login clear`)}
 
+### Vite manifest plugin
+
+${fenced('ts', `import { miniappManifest } from '@heybox/hb-sdk/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+  plugins: [miniappManifest()],
+});`)}
+
 ## Negative examples
 
 - Do not import from internal hb-sdk implementation paths.
@@ -507,6 +530,7 @@ hb-sdk login clear`)}
 - Do not pass raw internal share/network protocol fields from mini-program code.
 - Do not treat \`hb-sdk login\` as iframe SDK authentication state.
 - Do not create a second mock runtime package when \`hb-sdk dev\` is the supported local mock workflow.
+- Do not import \`@heybox/hb-sdk/vite\` from iframe business code or fetch a deployed \`manifest.json\` directly.
 `);
 
 const skillManifest = normalizeSkillManifest(createCurrentSkillManifest(files));

package/skill/scripts/validate-skill.mjs

@@ -184,8 +184,10 @@ for (const file of textFiles) {
     fail(`Removed API guidance found in ${relative}: use auth.login() instead of user.login().`);
   }
 
-  if (new RegExp(`${HB_SDK_PACKAGE_NAME.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\/(?!protocol\\b)[A-Za-z0-9_./-]+`).test(content)) {
-    fail(`Deep/internal hb-sdk import guidance found in ${relative}. Only @heybox/hb-sdk and @heybox/hb-sdk/protocol are allowed.`);
+  if (new RegExp(`${HB_SDK_PACKAGE_NAME.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\/(?!(?:protocol|vite|miniapp-publish)\\b)[A-Za-z0-9_./-]+`).test(content)) {
+    fail(
+      `Deep/internal hb-sdk import guidance found in ${relative}. Only @heybox/hb-sdk, @heybox/hb-sdk/protocol, @heybox/hb-sdk/vite, and @heybox/hb-sdk/miniapp-publish are allowed.`,
+    );
   }
 
   const lines = content.split('\n');

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.2.0-alpha.1+skill.66c7559e5e13",
+  "skillVersion": "0.2.0-alpha.2+skill.57e0cec11058",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.2.0-alpha.1",
-    "compatibility": "0.2.0-alpha.1"
+    "version": "0.2.0-alpha.2",
+    "compatibility": "0.2.0-alpha.2"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-66c7559e5e13eaaefc9718b0f643dffd5853c864913e57e5a65ab0c663553797"
+  "integrity": "sha256-57e0cec1105894712e82600045659d9f08fedc9e0e4c3159445168eaec6675e7"
 }

package/types/miniapp-publish/index.d.ts

@@ -0,0 +1,23 @@
+export declare const MINIAPP_UPLOAD_SCOPE = "activity";
+export declare const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
+export declare const PUBLISH_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_miniprogram/publish";
+export declare function isValidVersion(version: string): boolean;
+export declare function normalizeRelativePath(relativePath: string): string;
+export declare function relativePathContainsNodeModulesSegment(relativePath: string): boolean;
+export declare function getMiniProgramUploadAlias(miniProgramId: string): string;
+export interface MiniappUploadKeyInput {
+    miniProgramId: string;
+    version: string;
+    relativePath: string;
+}
+export declare function getMiniappUploadKey(input: MiniappUploadKeyInput): string;
+export interface UploadPathItem {
+    relativePath: string;
+}
+export interface ValidateUploadPathsOptions {
+    miniProgramId: string;
+    version: string;
+    maxLength?: number;
+}
+export declare function validateUploadPaths(items: UploadPathItem[], options: ValidateUploadPathsOptions): string | undefined;
+export declare function shouldUploadDistFile(relativePath: string): boolean;

package/types/vite/index.d.ts

@@ -0,0 +1,17 @@
+type MiniappManifestPlugin = {
+    name: string;
+    apply: 'build';
+    configResolved: (resolved: MiniappManifestResolvedConfig) => void;
+    writeBundle: (this: MiniappManifestPluginContext) => void;
+};
+interface MiniappManifestPluginContext {
+    warn: (message: string) => void;
+}
+interface MiniappManifestResolvedConfig {
+    root: string;
+    build: {
+        outDir: string;
+    };
+}
+export declare function miniappManifest(): MiniappManifestPlugin;
+export {};