@heybox/hb-sdk 0.4.5 → 0.4.6

package/dist/cli-chunks/{remote-DjaOc1VS.cjs → remote-zX17hOT4.cjs}

@@ -1,13 +1,12 @@
 'use strict';
 
 var promises = require('node:readline/promises');
+var session = require('./session-D7lF9mpd.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var session = require('./session-BAgaqpNL.cjs');
-var index = require('./index-BYMTp2I6.cjs');
-var node_crypto = require('node:crypto');
+var index = require('./index-DuwxUSkq.cjs');
 
 var re = {exports: {}};
 
@@ -2860,6 +2859,8 @@ function formatReason(error) {
 const MINIAPP_UPLOAD_SCOPE = 'activity';
 const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = '/mall/developer/user_miniprogram/access_status';
+const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
+const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
 const LIST_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/list';
 const CREATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/create';
 const UPDATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/update';
@@ -2932,281 +2933,6 @@ function shouldUploadDistFile(relativePath) {
     return true;
 }
 
-const globalHeyboxCliRequestConfig = {};
-function readHeyboxCliRequestConfig() {
-    return normalizeHeyboxRylaiServiceTagConfig(globalHeyboxCliRequestConfig);
-}
-function resolveHeyboxRylaiServiceTag(pathWithQuery, config = readHeyboxCliRequestConfig()) {
-    const normalized = normalizeHeyboxRylaiServiceTagConfig(config);
-    const pathname = pathWithQuery ? getPathname(pathWithQuery) : '';
-    const specialTag = normalized.special_tag;
-    if (pathname && specialTag?.path_prefix_list.some((prefix) => pathname.startsWith(prefix))) {
-        return specialTag.tag_name;
-    }
-    return normalized.default_tag;
-}
-function normalizeHeyboxRylaiServiceTagConfig(config) {
-    const defaultTag = normalizeHeyboxRylaiServiceTag(config.default_tag);
-    const specialTagName = normalizeHeyboxRylaiServiceTag(config.special_tag?.tag_name);
-    const pathPrefixList = config.special_tag?.path_prefix_list?.filter(isValidPathPrefix) || [];
-    return {
-        ...(defaultTag ? { default_tag: defaultTag } : {}),
-        ...(specialTagName && pathPrefixList.length
-            ? {
-                special_tag: {
-                    tag_name: specialTagName,
-                    path_prefix_list: pathPrefixList,
-                },
-            }
-            : {}),
-    };
-}
-function normalizeHeyboxRylaiServiceTag(value) {
-    const tag = String(value ?? '').trim();
-    if (!tag) {
-        return undefined;
-    }
-    if (/[\r\n]/.test(tag)) {
-        throw new Error('x-rylai-service-tag 不允许包含换行符');
-    }
-    return tag;
-}
-function isValidPathPrefix(value) {
-    return typeof value === 'string' && value.startsWith('/') && !/[\r\n]/.test(value);
-}
-function getPathname(pathWithQuery) {
-    try {
-        return new URL(pathWithQuery, 'https://api.xiaoheihe.cn').pathname;
-    }
-    catch {
-        return '';
-    }
-}
-
-const SIGN_VERSION = '999.0.4';
-const SIGN_CHARSET = 'AB45STUVWZEFGJ6CH01D237IXYPQRKLMN89';
-function createHeyboxOpenPlatformSignParams(pathname, options = {}) {
-    const now = options.now ?? new Date();
-    const time = Math.trunc(now.getTime() / 1000);
-    const nonce = options.nonce ?? md5(`${time}${Date.now()}${node_crypto.randomBytes(16).toString('hex')}`).toUpperCase();
-    return {
-        version: SIGN_VERSION,
-        hkey: generateSignature(pathname, time + 1, nonce),
-        _time: time,
-        nonce,
-    };
-}
-function generateSignature(path, time, nonce) {
-    const normalizedPath = `/${path
-        .split('/')
-        .filter(Boolean)
-        .join('/')}/`;
-    const transformedTime = transformWithOffset(String(time), SIGN_CHARSET, -2);
-    const transformedPath = transform(normalizedPath, SIGN_CHARSET);
-    const transformedNonce = transform(nonce, SIGN_CHARSET);
-    const combined = interleave([transformedTime, transformedPath, transformedNonce]).slice(0, 20);
-    const hash = md5(combined);
-    let sign = `${mixColumns(hash.slice(-6).split('').map((char) => char.charCodeAt(0))).reduce((sum, value) => sum + value, 0) % 100}`;
-    sign = sign.length < 2 ? `0${sign}` : sign;
-    return `${transformWithOffset(hash.substring(0, 5), SIGN_CHARSET, -4)}${sign}`;
-}
-function transformWithOffset(str, charset, offset) {
-    return transform(str, charset.slice(0, offset));
-}
-function transform(str, charset) {
-    let output = '';
-    for (let index = 0; index < str.length; index += 1) {
-        output += charset[str.charCodeAt(index) % charset.length];
-    }
-    return output;
-}
-function interleave(strings) {
-    let output = '';
-    const maxLength = Math.max(...strings.map((str) => str.length));
-    for (let index = 0; index < maxLength; index += 1) {
-        for (const str of strings) {
-            if (index < str.length) {
-                output += str[index];
-            }
-        }
-    }
-    return output;
-}
-function mixColumns(column) {
-    const output = [...column];
-    output[0] = multiplyE(column[0]) ^ multiply4(column[1]) ^ multiply3(column[2]) ^ multiply2(column[3]);
-    output[1] = multiply2(column[0]) ^ multiplyE(column[1]) ^ multiply4(column[2]) ^ multiply3(column[3]);
-    output[2] = multiply3(column[0]) ^ multiply2(column[1]) ^ multiplyE(column[2]) ^ multiply4(column[3]);
-    output[3] = multiply4(column[0]) ^ multiply3(column[1]) ^ multiply2(column[2]) ^ multiplyE(column[3]);
-    return output;
-}
-function multiply1(value) {
-    if (value & 0x80) {
-        return ((value << 1) ^ 0x1b) & 0xff;
-    }
-    return value << 1;
-}
-function multiply2(value) {
-    return multiply1(value) ^ value;
-}
-function multiply3(value) {
-    return multiply2(multiply1(value));
-}
-function multiply4(value) {
-    return multiply3(multiply2(multiply1(value)));
-}
-function multiplyE(value) {
-    return multiply4(value) ^ multiply3(value) ^ multiply2(value);
-}
-function md5(input) {
-    return node_crypto.createHash('md5').update(input).digest('hex');
-}
-
-const DEFAULT_PLATFORM_PARAMS = {
-    os_type: 'web',
-    app: 'heybox',
-    x_client_type: 'web',
-    x_os_type: 'Mac',
-    x_app: 'heybox',
-    x_client_version: '999.999.999',
-};
-const HEYBOX_WEB_REFERER = 'https://www.xiaoheihe.cn/';
-function resolveHeyboxId(session) {
-    if (session.heyboxId.trim()) {
-        return session.heyboxId.trim();
-    }
-    return session.cookieHeader
-        .split(';')
-        .map((part) => part.trim())
-        .find((part) => part.startsWith('heybox_id='))
-        ?.slice('heybox_id='.length);
-}
-function createHeyboxAuthHeaders(session, options = {}) {
-    const serviceTag = resolveHeyboxRylaiServiceTag(options.pathWithQuery);
-    return {
-        Cookie: session.cookieHeader,
-        Referer: HEYBOX_WEB_REFERER,
-        ...(options.contentType ? { 'Content-Type': options.contentType } : {}),
-        ...(serviceTag ? { 'x-rylai-service-tag': serviceTag } : {}),
-    };
-}
-function createHeyboxRequestContext(session$1, options = {}) {
-    const heyboxId = resolveHeyboxId(session$1);
-    const serviceTag = resolveHeyboxRylaiServiceTag(options.pathWithQuery);
-    return {
-        baseUrl: session.HEYBOX_API_BASE_URL,
-        headers: createHeyboxAuthHeaders(session$1, options),
-        platformParams: {
-            ...DEFAULT_PLATFORM_PARAMS,
-            ...options.platformParams,
-            ...(heyboxId ? { heybox_id: heyboxId } : {}),
-            ...(serviceTag ? { special_tag: serviceTag } : {}),
-        },
-    };
-}
-function createHeyboxOpenPlatformRequestContext(session, pathWithQuery, options = {}) {
-    return createHeyboxRequestContext(session, {
-        ...options,
-        pathWithQuery,
-        platformParams: {
-            x_app: 'heybox_website',
-            ...createHeyboxOpenPlatformSignParams(getApiPathname(pathWithQuery)),
-            ...options.platformParams,
-        },
-    });
-}
-function createHeyboxApiUrl(baseUrl, pathWithQuery, params) {
-    const url = new URL(pathWithQuery, baseUrl);
-    for (const [key, value] of Object.entries(params)) {
-        if (value !== '') {
-            url.searchParams.set(key, String(value));
-        }
-    }
-    return url.toString();
-}
-function getApiPathname(pathWithQuery) {
-    return new URL(pathWithQuery, session.HEYBOX_API_BASE_URL).pathname;
-}
-const ENVELOPE_BODY_PREVIEW_LENGTH = 1000;
-async function readHeyboxApiEnvelope(response, options) {
-    const rawBody = await response.text();
-    let envelope = null;
-    let parseError = null;
-    if (rawBody) {
-        try {
-            envelope = JSON.parse(rawBody);
-        }
-        catch (error) {
-            parseError = error;
-        }
-    }
-    const envelopeOk = envelope?.status === 'ok' && (!options.requireResult || envelope?.result !== undefined);
-    if (response.ok && envelopeOk) {
-        return envelope.result;
-    }
-    const { message, verboseMessage } = formatHeyboxEnvelopeError({
-        response,
-        envelope,
-        parseError,
-        rawBody,
-        pathWithQuery: options.pathWithQuery,
-    });
-    throw new index.CliError(message, verboseMessage);
-}
-function formatHeyboxEnvelopeError(input) {
-    const parts = [`Heybox API ${input.pathWithQuery} failed`, `HTTP ${input.response.status}`];
-    if (input.envelope) {
-        const msg = typeof input.envelope.msg === 'string' ? input.envelope.msg.trim() : '';
-        const sbeUserMessage = readSbeUserMessage(input.envelope.result);
-        parts.push(`msg=${msg || '(empty)'}`);
-        if (typeof input.envelope.status === 'string') {
-            parts.push(`envelope.status=${input.envelope.status}`);
-        }
-        const { status: _s, msg: _m, result: _r, ...extras } = input.envelope;
-        if (Object.keys(extras).length > 0) {
-            parts.push(`extras=${truncate(safeJsonStringify(extras), ENVELOPE_BODY_PREVIEW_LENGTH)}`);
-        }
-        if (input.envelope.result !== undefined) {
-            parts.push(`result=${truncate(safeJsonStringify(input.envelope.result), ENVELOPE_BODY_PREVIEW_LENGTH)}`);
-        }
-        return {
-            message: sbeUserMessage || msg || `Heybox API ${input.pathWithQuery} 请求失败`,
-            verboseMessage: parts.join(' '),
-        };
-    }
-    if (input.parseError) {
-        const parseMsg = input.parseError instanceof Error ? input.parseError.message : String(input.parseError);
-        parts.push(`parseError=${parseMsg}`);
-    }
-    parts.push(input.rawBody ? `body=${truncate(input.rawBody, ENVELOPE_BODY_PREVIEW_LENGTH)}` : 'body=(empty)');
-    return {
-        message: `Heybox API ${input.pathWithQuery} 请求失败`,
-        verboseMessage: parts.join(' '),
-    };
-}
-function readSbeUserMessage(result) {
-    if (!result || typeof result !== 'object') {
-        return '';
-    }
-    const sbe = result.sbe;
-    if (!sbe || typeof sbe !== 'object') {
-        return '';
-    }
-    const userMessage = sbe.user_message;
-    return typeof userMessage === 'string' ? userMessage.trim() : '';
-}
-function truncate(value, max) {
-    return value.length > max ? `${value.slice(0, max)}...(+${value.length - max} chars)` : value;
-}
-function safeJsonStringify(value) {
-    try {
-        return JSON.stringify(value);
-    }
-    catch {
-        return String(value);
-    }
-}
-
 async function getCDNUploadInfo(options, runtime = {}) {
     const body = new URLSearchParams();
     body.set('file_infos', JSON.stringify(options.fileInfos));
@@ -3228,17 +2954,17 @@ async function postCDNUploadCallback(options, runtime = {}) {
     const query = options.isFinished ? '?is_finished=true' : '';
     return postHeyboxApi(`/bbs/app/api/qcloud/cos/upload/callback/v2${query}`, body, options.session, runtime);
 }
-async function postHeyboxApi(pathWithQuery, body, session, runtime) {
+async function postHeyboxApi(pathWithQuery, body, session$1, runtime) {
     const fetchImpl = runtime.fetchImpl ?? fetch;
-    const context = createHeyboxOpenPlatformRequestContext(session, pathWithQuery, {
+    const context = session.createHeyboxOpenPlatformRequestContext(session$1, pathWithQuery, {
         contentType: 'application/x-www-form-urlencoded',
     });
-    const response = await fetchImpl(createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, pathWithQuery, context.platformParams), {
+    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, pathWithQuery, context.platformParams), {
         method: 'POST',
         headers: context.headers,
         body: body.toString(),
     });
-    const result = await readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: true });
+    const result = await session.readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: true });
     return result;
 }
 
@@ -3341,7 +3067,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-DRsyeAcg.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-CLne_LW7.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -3400,7 +3126,7 @@ async function submitUserMiniprogramAudit$1(options, runtime = {}) {
 }
 async function postUserMiniprogramVersionForm(path, options, fields, runtime) {
     const fetchImpl = runtime.fetchImpl ?? fetch;
-    const context = createHeyboxOpenPlatformRequestContext(options.session, path, {
+    const context = session.createHeyboxOpenPlatformRequestContext(options.session, path, {
         contentType: 'application/x-www-form-urlencoded',
     });
     const body = new URLSearchParams();
@@ -3408,12 +3134,12 @@ async function postUserMiniprogramVersionForm(path, options, fields, runtime) {
     for (const [key, value] of Object.entries(fields)) {
         body.set(key, value);
     }
-    const response = await fetchImpl(createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
+    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
         method: 'POST',
         headers: context.headers,
         body: body.toString(),
     });
-    const result = await readHeyboxApiEnvelope(response, {
+    const result = await session.readHeyboxApiEnvelope(response, {
         pathWithQuery: path,
     });
     return result ?? {};
@@ -3764,6 +3490,8 @@ function suggestNextPatchVersion(version) {
 
 function createRemoteApiClient(options) {
     return {
+        listDeveloperEntities: () => listDeveloperEntities(options),
+        switchDeveloperEntity: (requestOptions) => switchDeveloperEntity(requestOptions, options),
         getDeveloperAccessStatus: () => getDeveloperAccessStatus(options),
         listUserMiniprograms: (requestOptions = {}) => listUserMiniprograms(requestOptions, options),
         createUserMiniprogram: (requestOptions) => createUserMiniprogram(requestOptions, options),
@@ -3781,6 +3509,12 @@ function createRemoteApiClient(options) {
         listUserMiniprogramVersions: (requestOptions) => listUserMiniprogramVersions(requestOptions, options),
     };
 }
+async function listDeveloperEntities(runtime) {
+    return remoteGet(DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
+}
+async function switchDeveloperEntity(options, runtime) {
+    return (await remotePostForm(DEVELOPER_ENTITY_SWITCH_API_PATH, options, runtime, { requireResult: false })) ?? {};
+}
 async function getDeveloperAccessStatus(runtime) {
     return remoteGet(USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, {}, runtime);
 }
@@ -3831,30 +3565,36 @@ async function listUserMiniprogramVersions(options, runtime) {
 }
 async function remoteGet(path, query, runtime) {
     const pathWithQuery = createPathWithQuery(path, query);
-    const context = createHeyboxOpenPlatformRequestContext(runtime.session, pathWithQuery);
+    const context = session.createHeyboxOpenPlatformRequestContext(runtime.session, pathWithQuery);
     const fetchImpl = runtime.fetchImpl ?? fetch;
-    const response = await fetchImpl(createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, pathWithQuery, context.platformParams), {
+    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, pathWithQuery, context.platformParams), {
         method: 'GET',
         headers: context.headers,
     });
     return readRequiredResult(response, pathWithQuery);
 }
-async function remotePostForm(path, fields, runtime) {
-    const context = createHeyboxOpenPlatformRequestContext(runtime.session, path, {
+async function remotePostForm(path, fields, runtime, options = {}) {
+    const context = session.createHeyboxOpenPlatformRequestContext(runtime.session, path, {
         contentType: 'application/x-www-form-urlencoded',
     });
     const fetchImpl = runtime.fetchImpl ?? fetch;
-    const response = await fetchImpl(createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
+    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
         method: 'POST',
         headers: context.headers,
         body: createFormBody(fields),
     });
+    if (options.requireResult === false) {
+        return readOptionalResult(response, path);
+    }
     return readRequiredResult(response, path);
 }
 async function readRequiredResult(response, pathWithQuery) {
-    const result = await readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: true });
+    const result = await session.readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: true });
     return result;
 }
+async function readOptionalResult(response, pathWithQuery) {
+    return session.readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: false });
+}
 function createPathWithQuery(path, query) {
     const params = new URLSearchParams();
     for (const [key, value] of Object.entries(query)) {
@@ -4004,6 +3744,12 @@ async function runRemoteCommand(options, runtime = {}) {
     switch (options.command) {
         case 'access':
             return remoteAccess(options, context, runtime);
+        case 'entity:list':
+            return remoteEntityList(options, context, runtime);
+        case 'entity:current':
+            return remoteEntityCurrent(options, context, runtime);
+        case 'entity:switch':
+            return remoteEntitySwitch(options, context, runtime);
         case 'list':
             return remoteList(options, context, runtime);
         case 'create':
@@ -4035,6 +3781,9 @@ async function runRemoteCommand(options, runtime = {}) {
 }
 async function runRemoteDeployCommand(options, runtime) {
     const logger = resolveRemoteLogger(options, runtime);
+    const context = await createRemoteCommandContext(options, runtime);
+    const miniProgramId = requireBinding(context);
+    await assertBoundMiniProgramEntityMatchesCurrent(context, miniProgramId);
     const deployRuntime = {
         cwd: runtime.cwd,
         fetchImpl: runtime.fetchImpl,
@@ -4099,6 +3848,8 @@ function adaptRemoteApiClient(api) {
         updateAllowlist: ({ miniProgramId, heyboxIds }) => api.updatePreviewAllowlist({ mini_program_id: miniProgramId, heybox_ids: heyboxIds }),
         listVersions: (miniProgramId) => api.listUserMiniprogramVersions({ mini_program_id: miniProgramId, offset: 0, limit: 50 }),
         getPreviewInfo: ({ miniProgramId, version }) => api.getVersionPreviewInfo({ mini_program_id: miniProgramId, preview_version: version }),
+        listDeveloperEntities: () => api.listDeveloperEntities(),
+        switchDeveloperEntity: ({ entityId }) => api.switchDeveloperEntity({ entity_id: entityId }),
         releaseVersion: ({ miniProgramId, version }) => api.releaseUserMiniprogramVersion({ mini_program_id: miniProgramId, version }),
         withdrawVersion: ({ miniProgramId, reason, version }) => api.withdrawUserMiniprogramVersion({ mini_program_id: miniProgramId, version, reason }),
         takeDown: (miniProgramId) => api.takeDownUserMiniprogram({ mini_program_id: miniProgramId }),
@@ -4119,6 +3870,60 @@ async function remoteAccess(options, context, runtime) {
     }
     return finishRemoteCommand(options, runtime, output);
 }
+async function remoteEntityList(options, context, runtime) {
+    const result = await context.api.listDeveloperEntities();
+    const items = normalizeDeveloperEntities(result);
+    const output = { changed: false, items: toCamelCaseDeep(items), total: readNumber(result.total, items.length) };
+    if (!options.json) {
+        if (items.length === 0) {
+            context.logger.info('当前账号未绑定开发者主体');
+        }
+        else {
+            printDeveloperEntities(context.logger, items);
+        }
+    }
+    return finishRemoteCommand(options, runtime, output);
+}
+async function remoteEntityCurrent(options, context, runtime) {
+    const current = await requireCurrentDeveloperEntity(context);
+    const access = await context.api.accessStatus();
+    const output = { changed: false, current: toCamelCaseDeep(current), access: toCamelCaseDeep(access) };
+    if (!options.json) {
+        printDeveloperEntity(context.logger, current, '* ');
+        context.logger.info(`Access status: ${String(access.status ?? 'unknown')}`);
+        if (access.disabled_reason) {
+            context.logger.warn(`Disabled reason: ${String(access.disabled_reason)}`);
+        }
+    }
+    return finishRemoteCommand(options, runtime, output);
+}
+async function remoteEntitySwitch(options, context, runtime) {
+    const entityId = parseEntityId(options.entityId);
+    const entities = normalizeDeveloperEntities(await context.api.listDeveloperEntities());
+    const target = entities.find((entity) => entity.entity_id === entityId);
+    if (!target) {
+        throw new Error(`当前账号不可切换到开发者主体 ${entityId}；请先运行 hb-sdk remote entity list 查看可用主体`);
+    }
+    const result = await context.api.switchDeveloperEntity({ entityId });
+    const access = await context.api.accessStatus();
+    const switched = normalizeDeveloperEntity(result) ?? { ...target, is_current: true };
+    await session.setSelectedDeveloperEntitySnapshot({
+        entityId: switched.entity_id,
+        entityName: switched.entity_name || '--',
+        ...(switched.owner_heybox_id !== undefined ? { ownerHeyboxId: switched.owner_heybox_id } : {}),
+    }, {
+        cacheFile: options.cacheFile,
+        env: options.env,
+        loginBaseUrl: options.loginBaseUrl,
+        now: options.now,
+    });
+    const output = { changed: true, current: toCamelCaseDeep(switched), access: toCamelCaseDeep(access) };
+    if (!options.json) {
+        context.logger.success(`已切换开发者主体：${formatDeveloperEntity(switched)}`);
+        context.logger.info(`Access status: ${String(access.status ?? 'unknown')}`);
+    }
+    return finishRemoteCommand(options, runtime, output);
+}
 async function remoteList(options, context, runtime) {
     const result = await context.api.listMiniPrograms({ keyword: options.keyword, status: options.status });
     const items = Array.isArray(result.items) ? result.items : [];
@@ -4150,6 +3955,7 @@ async function remoteCreate(options, context, runtime) {
     if (access.status !== 'approved') {
         throw new Error(`当前 CLI 用户没有创建开发者用户小程序权限：${String(access.status ?? 'unknown')}`);
     }
+    await confirmCreateWithCurrentEntity(options, context, runtime);
     const result = await context.api.createMiniProgram({ name, previewImageUrl });
     const miniProgramId = requireMiniProgramId(result);
     await writeBoundMiniProgramId(context.packageJson.projectRoot, miniProgramId, { force: options.forceBind });
@@ -4166,6 +3972,7 @@ async function remoteBind(options, context, runtime) {
     }
     const detail = await context.api.getMiniProgramDetail(miniProgramId);
     const verifiedId = requireMiniProgramId(detail);
+    await assertMiniProgramEntityMatchesCurrent(context, detail);
     const changed = context.binding !== verifiedId;
     if (changed) {
         await writeBoundMiniProgramId(context.packageJson.projectRoot, verifiedId, { force: options.force });
@@ -4332,6 +4139,70 @@ function requireBinding(context) {
     }
     return context.binding;
 }
+async function requireCurrentDeveloperEntity(context) {
+    const entities = normalizeDeveloperEntities(await context.api.listDeveloperEntities());
+    const current = entities.find((entity) => entity.is_current === true);
+    if (!current) {
+        throw new Error('当前账号没有服务端 current 开发者主体；请先运行 hb-sdk remote entity list 查看可用主体，并用 hb-sdk remote entity switch <entity-id> 切换');
+    }
+    return current;
+}
+async function confirmCreateWithCurrentEntity(options, context, runtime) {
+    const entities = normalizeDeveloperEntities(await context.api.listDeveloperEntities());
+    if (entities.length <= 1) {
+        return;
+    }
+    const current = entities.find((entity) => entity.is_current === true);
+    if (!current) {
+        throw new Error('当前账号存在多个开发者主体，但没有服务端 current 主体；请先运行 hb-sdk remote entity switch <entity-id>');
+    }
+    if (!options.json) {
+        context.logger.info(`当前创建将归属开发者主体：${formatDeveloperEntity(current)}`);
+        context.logger.info(`如需切换主体，请先运行：hb-sdk remote entity switch <entity-id>`);
+    }
+    if (options.yes) {
+        return;
+    }
+    const isTTY = runtime.isTTY ?? Boolean(process.stdin.isTTY && process.stderr.isTTY);
+    if (!isTTY) {
+        throw new Error(`当前账号存在多个开发者主体，非交互环境执行 hb-sdk remote create 必须传 --yes 确认使用当前主体：${formatDeveloperEntity(current)}。如需切换，请先运行 hb-sdk remote entity switch <entity-id>`);
+    }
+    const accepted = runtime.promptConfirm
+        ? await runtime.promptConfirm(`确认使用当前开发者主体 ${formatDeveloperEntity(current)} 创建小程序？`)
+        : await promptConfirm(`确认使用当前开发者主体 ${formatDeveloperEntity(current)} 创建小程序？输入 yes 继续: `, runtime);
+    if (!accepted) {
+        throw new Error('已取消操作');
+    }
+}
+async function assertMiniProgramEntityMatchesCurrent(context, detail) {
+    if (!isValidEntityId(detail.entity_id)) {
+        return;
+    }
+    const current = await requireCurrentDeveloperEntity(context);
+    if (current.entity_id === detail.entity_id) {
+        return;
+    }
+    throw new Error(createEntityMismatchMessage({ current, target: createEntityFromMiniProgramDetail(detail) }));
+}
+async function assertBoundMiniProgramEntityMatchesCurrent(context, miniProgramId) {
+    const current = await requireCurrentDeveloperEntity(context);
+    const detail = await context.api.getMiniProgramDetail(miniProgramId);
+    requireMiniProgramId(detail);
+    if (!isValidEntityId(detail.entity_id)) {
+        throw new Error(`远端小程序 ${miniProgramId} 详情缺少 entity_id，无法校验当前主体一致性，已停止 deploy`);
+    }
+    if (current.entity_id !== detail.entity_id) {
+        throw new Error(createEntityMismatchMessage({ current, target: createEntityFromMiniProgramDetail(detail) }));
+    }
+}
+function createEntityMismatchMessage(options) {
+    return [
+        '当前开发者主体与远端小程序所属主体不一致，已停止操作。',
+        `当前主体：${formatDeveloperEntity(options.current)}`,
+        `小程序所属主体：${formatDeveloperEntity(options.target)}`,
+        `请先运行：hb-sdk remote entity switch ${options.target.entity_id}`,
+    ].join('\n');
+}
 function requireMiniProgramId(result) {
     const miniProgramId = result.mini_program_id;
     if (typeof miniProgramId !== 'string' || !miniProgramId.trim()) {
@@ -4339,6 +4210,50 @@ function requireMiniProgramId(result) {
     }
     return miniProgramId.trim();
 }
+function parseEntityId(value) {
+    const raw = requireNonEmpty(value, 'remote entity switch 必须传 <entity-id>');
+    if (!/^(0|[1-9]\d*)$/.test(raw)) {
+        throw new Error(`entity-id 只接受十进制数字：${raw}`);
+    }
+    const entityId = Number(raw);
+    if (!isValidEntityId(entityId)) {
+        throw new Error(`entity-id 超出有效范围：${raw}`);
+    }
+    return entityId;
+}
+function normalizeDeveloperEntities(result) {
+    const rawItems = Array.isArray(result.items) ? result.items : [];
+    return rawItems.map((item) => normalizeDeveloperEntity(item)).filter((item) => item !== undefined);
+}
+function normalizeDeveloperEntity(value) {
+    if (!value || typeof value !== 'object') {
+        return undefined;
+    }
+    const rawEntityId = value.entity_id;
+    if (!isValidEntityId(rawEntityId)) {
+        return undefined;
+    }
+    return {
+        ...value,
+        entity_id: rawEntityId,
+        entity_name: typeof value.entity_name === 'string' ? value.entity_name : undefined,
+        owner_heybox_id: isValidHeyboxIdNumber(value.owner_heybox_id)
+            ? value.owner_heybox_id
+            : undefined,
+        is_current: value.is_current === true,
+    };
+}
+function createEntityFromMiniProgramDetail(detail) {
+    return {
+        entity_id: detail.entity_id,
+        entity_name: typeof detail.developer_name === 'string' ? detail.developer_name : undefined,
+        owner_heybox_id: detail.owner_heybox_id,
+        is_current: false,
+    };
+}
+function isValidEntityId(value) {
+    return Number.isSafeInteger(value) && Number(value) > 0;
+}
 function requireNonEmpty(value, message) {
     const normalized = typeof value === 'string' ? value.trim() : '';
     if (!normalized) {
@@ -4466,6 +4381,19 @@ function printMiniProgramDetail(logger, detail) {
         logger.info(`Publish URL: ${detail.publish_url}`);
     }
 }
+function printDeveloperEntities(logger, entities) {
+    for (const entity of entities) {
+        printDeveloperEntity(logger, entity, entity.is_current ? '* ' : '  ');
+    }
+}
+function printDeveloperEntity(logger, entity, marker = '') {
+    logger.info(`${marker}${formatDeveloperEntity(entity)}${entity.is_current ? '  current' : ''}`);
+}
+function formatDeveloperEntity(entity) {
+    const name = entity.entity_name || '--';
+    const owner = entity.owner_heybox_id ? `  owner=${entity.owner_heybox_id}` : '';
+    return `${entity.entity_id ?? '--'}  ${name}${owner}`;
+}
 function printAllowlist(logger, result) {
     const items = Array.isArray(result.items) ? result.items : [];
     logger.info(`Limit: ${readNumber(result.limit, 0)}`);