@heybox/hb-sdk 0.5.5 → 0.5.7

package/README.md

@@ -341,10 +341,9 @@ try {
 | `hb-sdk remote entity current`                                                          | 查看服务端 current entity，以及该主体的小程序工坊权限状态。                                                           |
 | `hb-sdk remote entity switch <entity-id>`                                               | 切换开发者平台服务端 current entity；不会修改项目绑定的小程序 ID。                                                    |
 | `hb-sdk remote list [--status <status>] [--keyword <text>]`                             | 列出当前 CLI 用户可管理的远端工坊小程序，用于发现并绑定当前项目。                                                     |
-| `hb-sdk remote create --name <name> [--preview-image-url <url>] [--yes] [--force-bind]` | 在服务端 current entity 下创建远端工坊小程序并写入当前项目的 `package.json.heybox.miniProgramId`。                    |
+| `hb-sdk remote create [--yes] [--force-bind]`                                           | 在服务端 current entity 下创建远端工坊小程序并写入当前项目的 `package.json.heybox.miniProgramId`。                    |
 | `hb-sdk remote bind <mini-program-id> [--force]`                                        | 校验当前 CLI 用户可管理目标小程序后，再把它绑定到当前项目。                                                           |
 | `hb-sdk remote info`                                                                    | 查看当前项目绑定的小程序详情。                                                                                        |
-| `hb-sdk remote update [--name <name>] [--preview-image-url <url>]`                      | 更新绑定小程序的名称或远程预览图 URL。                                                                                |
 | `hb-sdk remote allowlist list/add/remove/set ...`                                       | 管理绑定小程序的预览白名单。                                                                                          |
 | `hb-sdk remote deploy --release-note <text> [--skip-build] [--auto-publish]`            | 构建、上传并提交当前小程序版本审核；`--skip-build` 跳过 build 直接上传 `dist/`。                                      |
 | `hb-sdk remote versions`                                                                | 列出绑定小程序的远端版本。                                                                                            |
@@ -353,6 +352,8 @@ try {
 | `hb-sdk remote withdraw <version> [--yes] [--reason <text>]`                            | 撤回审核中或已通过但未发布的版本；非 TTY 环境必须传 `--yes`。                                                         |
 | `hb-sdk remote take-down [--yes]`                                                       | 下架当前线上小程序；非 TTY 环境必须传 `--yes`。                                                                       |
 | `hb-sdk remote reopen [--yes]`                                                          | 重新上架已下架的小程序；非 TTY 环境必须传 `--yes`。                                                                   |
+| `hb-sdk remote square hide [--yes]`                                                     | 隐藏当前绑定小程序在普通用户侧的小程序工坊广场展示；白名单用户仍可见，直接链接不受影响；非 TTY 环境必须传 `--yes`。   |
+| `hb-sdk remote square show`                                                             | 恢复当前绑定小程序在普通用户侧的小程序工坊广场展示。                                                                  |
 
 远端平台操作统一放在 `hb-sdk remote` 命令组下；顶层 `hb-sdk deploy` 已硬切删除，不再作为兼容别名保留。`hb-sdk login` 仍是顶层命令，因为它管理 CLI 登录态，不绑定到某个具体小程序。开发者主体的事实源是服务端 current entity；CLI 登录缓存中的 `selectedEntity` 只是上次选择时的提示快照，用于 `login status` 展示和漂移排障，不能作为权限或归属判断依据。
 
@@ -375,7 +376,8 @@ try {
 2. 已运行过 `hb-sdk login` 登录 Heybox；多主体用户应确认 `hb-sdk remote entity current` 指向要发布的主体。
 3. 当前项目绑定的小程序必须属于服务端 current entity；如不一致，先运行 `hb-sdk remote entity switch <entity-id>` 切换主体。
 4. 如果需要以公司的名义发布小程序，需先找 @秦浩东 申请小程序开发权限。
-5. 每次部署都要准备发布日志：`hb-sdk remote deploy --release-note "..."`。发布日志 trim 后不能为空，最多 500 个字符，允许换行；CI / 非 TTY 环境缺失时会直接失败，TTY 环境会提示输入。
+5. 每次部署都要在 `package.json` 里配置 `heybox.miniProgramProfile.name`、`iconUrl` 和至少一张 `coverImageUrls`，这些资料会随版本提交审核。
+6. 每次部署都要准备发布日志：`hb-sdk remote deploy --release-note "..."`。发布日志 trim 后不能为空，最多 500 个字符，允许换行；CI / 非 TTY 环境缺失时会直接失败，TTY 环境会提示输入。
 6. 项目根有 `scripts.build`，会被 CLI 通过 lockfile 自动选用的 `pnpm`、`yarn` 或 `npm` 触发；无 lockfile 时回退 `npm`。
 7. 构建产物落在 `dist/`，包含 `index.html` 和 `manifest.json`。
 
@@ -397,7 +399,20 @@ try {
 
 `--skip-build` 用于 CI 双阶段：上一步已经 build 完缓存好了 `dist/`，本步只做预检、上传和提交审核。`dist/manifest.json` 或 `dist/index.html` 缺失会立即报错。
 
-`manifest.json` 不会上传到 CDN，只作为 submit audit 请求的 `manifest` 字段提交。这与 Vite 插件文档中的契约一致。
+`manifest.json` 不会上传到 CDN，只作为 submit audit 请求的 `manifest` 字段提交。这与 Vite 插件文档中的契约一致。名称、icon 和介绍图从 `package.json.heybox.miniProgramProfile` 读取，并随 precheck 和 submit audit 一起提交：
+
+```json
+{
+  "heybox": {
+    "miniProgramId": "mp_xxxxxxxx",
+    "miniProgramProfile": {
+      "name": "我的小程序",
+      "iconUrl": "https://img.example.test/icon.png",
+      "coverImageUrls": ["https://img.example.test/cover.png"]
+    }
+  }
+}
+```
 
 内部测试或预发环境可通过 origin 级别的自定义地址切换后台环境：
 
@@ -413,7 +428,7 @@ hb-sdk remote deploy --verbose --api-base-url https://api.test.xiaoheihe.cn --lo
 HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://127.0.0.1:8080 --release-note "本地后台联调"
 ```
 
-`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情、基础信息和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。仓库内开发可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 `default_tag` 或 path-prefix 级 `special_tag`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
+`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。仓库内开发可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 `default_tag` 或 path-prefix 级 `special_tag`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 
 ## hb-sdk remote 命令参考
 
@@ -426,10 +441,9 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 | `hb-sdk remote entity current`                                                          | 查看服务端 current entity 和该主体的小程序工坊权限状态。                                                                                           |
 | `hb-sdk remote entity switch <entity-id>`                                               | 切换服务端 current entity；只允许切到 `entity list` 返回的主体。                                                                                   |
 | `hb-sdk remote list [--status <status>] [--keyword <text>]`                             | 列出 current entity 下当前 CLI 用户可管理的小程序，并标出当前绑定项。                                                                              |
-| `hb-sdk remote create --name <name> [--preview-image-url <url>] [--yes] [--force-bind]` | 在 current entity 下创建远端小程序并绑定当前项目；多主体非 TTY 环境必须传 `--yes` 确认使用当前主体；已有绑定时必须显式传 `--force-bind` 才能覆盖。 |
+| `hb-sdk remote create [--yes] [--force-bind]`                                           | 在 current entity 下创建远端小程序并绑定当前项目；多主体非 TTY 环境必须传 `--yes` 确认使用当前主体；已有绑定时必须显式传 `--force-bind` 才能覆盖。 |
 | `hb-sdk remote bind <mini-program-id> [--force]`                                        | 先校验 current entity 可管理目标小程序，再写入当前项目绑定；`--force` 只允许覆盖本地绑定，不跳过远端校验或主体一致性校验。                         |
 | `hb-sdk remote info`                                                                    | 查看当前绑定小程序的远端详情。                                                                                                                     |
-| `hb-sdk remote update [--name <name>] [--preview-image-url <url>]`                      | 更新名称或远程预览图 URL，至少传一个变更字段。                                                                                                     |
 | `hb-sdk remote allowlist list`                                                          | 查看预览白名单。                                                                                                                                   |
 | `hb-sdk remote allowlist add <heybox-id...>`                                            | 添加十进制 Heybox ID 到预览白名单。                                                                                                                |
 | `hb-sdk remote allowlist remove <heybox-id...>`                                         | 从预览白名单移除非 owner 条目。                                                                                                                    |
@@ -441,6 +455,8 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 | `hb-sdk remote withdraw <version> [--yes] [--reason <text>]`                            | 撤回审核中或已通过但未发布的版本；交互式终端会确认，非 TTY 必须传 `--yes`。                                                                        |
 | `hb-sdk remote take-down [--yes]`                                                       | 下架当前线上小程序；交互式终端会确认，非 TTY 必须传 `--yes`。                                                                                      |
 | `hb-sdk remote reopen [--yes]`                                                          | 重新上架已下架的小程序；交互式终端会确认，非 TTY 必须传 `--yes`。                                                                                  |
+| `hb-sdk remote square hide [--yes]`                                                     | 隐藏当前绑定小程序在普通用户侧的小程序工坊广场展示；白名单用户仍可见，直接链接不受影响；交互式终端会确认，非 TTY 必须传 `--yes`。                  |
+| `hb-sdk remote square show`                                                             | 恢复当前绑定小程序在普通用户侧的小程序工坊广场展示。                                                                                               |
 
 CLI 登录态只供 CLI 命令访问黑盒接口时复用，不会注入 iframe SDK，也不会改变 `auth.login()`、`user.getInfo()`、`network.request()` 或 mock 宿主中的用户状态。`hb-sdk login` 成功后会尝试读取开发者主体列表：单主体自动确认或切换为 current entity，多主体交互式环境要求选择主体，多主体非 TTY 环境只提示后续运行 `hb-sdk remote entity switch <entity-id>`；显式传 `--no-select-entity` 时只写登录态，不修改服务端 current entity。`hb-sdk login status` 默认展示脱敏状态、`heyboxId`、`loginBaseUrl`、登录时间和本地 `selectedEntity` 提示快照；`--verbose` 额外展示 cache 路径。不输出 `pkey`、cookie 或完整请求头。`selectedEntity` 不是权限事实源，每次 remote 命令仍以服务端 current entity 为准。
 

package/dist/cli-chunks/{create-DS-dZw7W.cjs → create-fSN-k8or.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-D-F9nQns.cjs');
+var index = require('./index-BXthiT6e.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CWXTB0AZ.cjs → dev-yLCS61CI.cjs}

@@ -9,7 +9,7 @@ var node_url = require('node:url');
 var net = require('node:net');
 var node_http = require('node:http');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-D-F9nQns.cjs');
+var index = require('./index-BXthiT6e.cjs');
 require('node:process');
 require('node:buffer');
 require('node:util');

package/dist/cli-chunks/{doctor-CJWXCZQI.cjs → doctor-DT-_jcH7.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-D-F9nQns.cjs');
+var index = require('./index-BXthiT6e.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-D-F9nQns.cjs → index-BXthiT6e.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-D-F9nQns.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BXthiT6e.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-D-F9nQns.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BXthiT6e.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-D-F9nQns.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BXthiT6e.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-D-F9nQns.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BXthiT6e.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-D-F9nQns.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BXthiT6e.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13094,7 +13094,7 @@ function readErrorMessage(error, options = {}) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.5.5';
+const BUILT_CLI_VERSION = '0.5.7';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13239,10 +13239,7 @@ function installRemoteCommands(program, handlers, resolveLogger) {
     addRemotePublicOptions(remote
         .command('create')
         .description('创建远程工坊小程序并绑定当前项目')
-        .requiredOption('--name <name>', '小程序名称')
-        .option('--preview-image-url <url>', '远程预览图 HTTPS URL')
         .option('--force-bind', '允许覆盖当前 package.json 中已有绑定')).option('--yes', '多开发者主体时确认使用服务端 current 主体创建').action(createRemoteAction(handlers, resolveLogger, 'create', (command) => ({
-        ...pickOptions(command, ['name', 'previewImageUrl']),
         forceBind: Boolean(readCommandOptionsWithAncestors(command).forceBind),
         ...readYesOption(command),
     })));
@@ -13251,11 +13248,6 @@ function installRemoteCommands(program, handlers, resolveLogger) {
         miniProgramId: readStringArgument(miniProgramId, 'mini-program-id'),
     })));
     addRemotePublicOptions(remote.command('info').description('查看当前绑定的远程工坊小程序详情')).action(createRemoteAction(handlers, resolveLogger, 'info'));
-    addRemotePublicOptions(remote
-        .command('update')
-        .description('更新当前绑定的远程工坊小程序基础信息')
-        .option('--name <name>', '小程序名称')
-        .option('--preview-image-url <url>', '远程预览图 HTTPS URL')).action(createRemoteAction(handlers, resolveLogger, 'update', (command) => pickOptions(command, ['name', 'previewImageUrl'])));
     const allowlist = addRemotePublicOptions(remote.command('allowlist').description('管理当前绑定小程序的预览白名单'));
     addRemotePublicOptions(allowlist.command('list').description('查看预览白名单')).action(createRemoteAction(handlers, resolveLogger, 'allowlist:list'));
     addRemotePublicOptions(allowlist.command('add').description('添加预览白名单 Heybox ID').argument('<heybox-id...>', 'Heybox ID')).action(createRemoteAction(handlers, resolveLogger, 'allowlist:add', (_command, heyboxIds) => ({
@@ -13300,6 +13292,9 @@ function installRemoteCommands(program, handlers, resolveLogger) {
     })));
     addRemotePublicOptions(remote.command('take-down').description('下架当前在线小程序').option('--yes', '跳过危险操作确认')).action(createRemoteAction(handlers, resolveLogger, 'take-down', (command) => readYesOption(command)));
     addRemotePublicOptions(remote.command('reopen').description('重新上架已下架小程序').option('--yes', '跳过危险操作确认')).action(createRemoteAction(handlers, resolveLogger, 'reopen', (command) => readYesOption(command)));
+    const square = addRemotePublicOptions(remote.command('square').description('管理当前绑定小程序的广场展示状态'));
+    addRemotePublicOptions(square.command('hide').description('隐藏当前小程序在普通用户侧的小程序工坊广场展示').option('--yes', '跳过危险操作确认')).action(createRemoteAction(handlers, resolveLogger, 'square:hide', (command) => readYesOption(command)));
+    addRemotePublicOptions(square.command('show').description('恢复当前小程序在普通用户侧的小程序工坊广场展示')).action(createRemoteAction(handlers, resolveLogger, 'square:show'));
 }
 function createRemoteAction(handlers, resolveLogger, commandName, getCommandOptions = () => ({})) {
     return withUpdateReminder(async (...args) => {
@@ -13377,31 +13372,31 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CvUTmVDe.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-D2E_Ucky.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CvUTmVDe.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-D2E_Ucky.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CvUTmVDe.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-D2E_Ucky.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DS-dZw7W.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-fSN-k8or.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CWXTB0AZ.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-yLCS61CI.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-CJWXCZQI.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DT-_jcH7.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-TcGy7SWm.cjs'); }).then(function (n) { return n.remote; });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-UTCipPnV.cjs'); }).then(function (n) { return n.remote; });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-CQjVwycx.cjs → index-DCTFE1Sf.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-D-F9nQns.cjs');
+var index$2 = require('./index-BXthiT6e.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$3 = require('assert');
 var require$$4$2 = require('events');
 var require$$1$1 = require('util');
-var remote = require('./remote-TcGy7SWm.cjs');
+var remote = require('./remote-UTCipPnV.cjs');
 var require$$0$5 = require('net');
 var require$$0$4 = require('url');
 var require$$2$2 = require('http');

package/dist/cli-chunks/{login-CvUTmVDe.cjs → login-D2E_Ucky.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DIGS_hBV.cjs');
+var session = require('./session-CNAnXfwl.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-D-F9nQns.cjs');
+var index = require('./index-BXthiT6e.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{remote-TcGy7SWm.cjs → remote-UTCipPnV.cjs}

@@ -1,12 +1,12 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var session = require('./session-DIGS_hBV.cjs');
+var session = require('./session-CNAnXfwl.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var index = require('./index-D-F9nQns.cjs');
+var index = require('./index-BXthiT6e.cjs');
 
 var re = {exports: {}};
 
@@ -2817,9 +2817,7 @@ function parseMiniappManifestJson(raw, sourceLabel = 'manifest.json') {
         throw new Error(`${sourceLabel} 必须是 JSON 对象`);
     }
     return {
-        manifest: {
-            version: parsed.version,
-        },
+        manifest: parsed,
         hadBom,
     };
 }
@@ -2865,7 +2863,6 @@ const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
 const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
 const LIST_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/list';
 const CREATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/create';
-const UPDATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/update';
 const DETAIL_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/detail';
 const USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist';
 const UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist/update';
@@ -2876,6 +2873,7 @@ const WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_minipro
 const RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/release';
 const TAKE_DOWN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/take_down';
 const REOPEN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/reopen';
+const UPDATE_SQUARE_DISPLAY_API_PATH = '/mall/developer/user_miniprogram/square_display/update';
 const LIST_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/list';
 const FNV_OFFSET = 0x811c9dc5;
 const FNV_PRIME = 0x01000193;
@@ -3113,7 +3111,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-CQjVwycx.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-DCTFE1Sf.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -3158,6 +3156,9 @@ function isRecord(value) {
 
 async function precheckUserMiniprogramVersion$1(options, runtime = {}) {
     return postUserMiniprogramVersionForm(PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
+        name: options.name,
+        icon_url: options.iconUrl,
+        cover_image_urls: options.coverImageUrls.join(','),
         version: options.version,
         release_note: options.releaseNote,
         auto_publish: String(options.autoPublish),
@@ -3165,6 +3166,9 @@ async function precheckUserMiniprogramVersion$1(options, runtime = {}) {
 }
 async function submitUserMiniprogramAudit$1(options, runtime = {}) {
     return postUserMiniprogramVersionForm(SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
+        name: options.name,
+        icon_url: options.iconUrl,
+        cover_image_urls: options.coverImageUrls.join(','),
         manifest: JSON.stringify(options.manifest),
         release_note: options.releaseNote,
         auto_publish: String(options.autoPublish),
@@ -3226,6 +3230,7 @@ async function runDeployCommand(options, runtime = {}) {
     if (typeof miniProgramId !== 'string' || !miniProgramId.trim()) {
         throw new Error('未在 package.json 中找到 heybox.miniProgramId，请先配置 mini program id');
     }
+    const miniProgramProfile = readMiniProgramVersionProfile(packageJson);
     const releaseNote = await resolveDeployReleaseNote(options, runtime);
     const session$1 = await logger.task('正在校验 Heybox 登录态', () => (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }), { successText: 'Heybox 登录态有效' });
     logger.debug(`Heybox API: ${apiBaseUrl}`);
@@ -3239,6 +3244,7 @@ async function runDeployCommand(options, runtime = {}) {
         await runVersionPrecheck({
             session: session$1,
             miniProgramId,
+            ...miniProgramProfile,
             version: precheckVersion,
             releaseNote,
             autoPublish,
@@ -3257,6 +3263,7 @@ async function runDeployCommand(options, runtime = {}) {
         await runVersionPrecheck({
             session: session$1,
             miniProgramId,
+            ...miniProgramProfile,
             version: precheckVersion,
             releaseNote,
             autoPublish,
@@ -3294,7 +3301,7 @@ async function runDeployCommand(options, runtime = {}) {
         throw translateHeyboxDeployError(error, { projectRoot, stage: 'upload', version });
     }
     try {
-        submitAuditResult = await logger.task('正在提交审核', () => (runtime.submitUserMiniprogramAudit ?? submitUserMiniprogramAudit$1)({ session: session$1, miniProgramId, manifest, releaseNote, autoPublish }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl }), { successText: '审核提交完成' });
+        submitAuditResult = await logger.task('正在提交审核', () => (runtime.submitUserMiniprogramAudit ?? submitUserMiniprogramAudit$1)({ session: session$1, miniProgramId, ...miniProgramProfile, manifest, releaseNote, autoPublish }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl }), { successText: '审核提交完成' });
     }
     catch (error) {
         throw translateHeyboxDeployError(error, { projectRoot, stage: 'submitAudit', version });
@@ -3342,6 +3349,44 @@ function findProjectRoot(startDir) {
 async function readPackageJson(projectRoot) {
     return JSON.parse(await fs$1.readFile(path.join(projectRoot, 'package.json'), 'utf8'));
 }
+function readMiniProgramVersionProfile(packageJson) {
+    const profile = packageJson.heybox?.miniProgramProfile;
+    return {
+        name: readRequiredProfileText(profile?.name, 'heybox.miniProgramProfile.name'),
+        iconUrl: readRequiredHttpsUrl(profile?.iconUrl, 'heybox.miniProgramProfile.iconUrl'),
+        coverImageUrls: readCoverImageUrls(profile?.coverImageUrls),
+    };
+}
+function readRequiredProfileText(value, pathLabel) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!text) {
+        throw new Error(`${pathLabel} 不能为空；请在 package.json 配置本次提交审核的小程序资料`);
+    }
+    return text;
+}
+function readRequiredHttpsUrl(value, pathLabel) {
+    const text = readRequiredProfileText(value, pathLabel);
+    if (!/^https:\/\//i.test(text)) {
+        throw new Error(`${pathLabel} 必须是 HTTPS 地址`);
+    }
+    return text;
+}
+function readCoverImageUrls(value) {
+    if (!Array.isArray(value)) {
+        throw new Error('heybox.miniProgramProfile.coverImageUrls 至少配置 1 张 HTTPS 图片');
+    }
+    const urls = value
+        .map((item) => (typeof item === 'string' ? item.trim() : ''))
+        .filter(Boolean);
+    if (urls.length === 0) {
+        throw new Error('heybox.miniProgramProfile.coverImageUrls 至少配置 1 张 HTTPS 图片');
+    }
+    const invalidUrl = urls.find((url) => !/^https:\/\//i.test(url));
+    if (invalidUrl) {
+        throw new Error(`heybox.miniProgramProfile.coverImageUrls 必须都是 HTTPS 地址：${invalidUrl}`);
+    }
+    return urls;
+}
 async function readDeployManifest(projectRoot, logger) {
     const distDir = path.join(projectRoot, 'dist');
     const manifestPath = path.join(distDir, 'manifest.json');
@@ -3544,8 +3589,7 @@ function createRemoteApiClient(options) {
         switchDeveloperEntity: (requestOptions) => switchDeveloperEntity(requestOptions, options),
         getDeveloperAccessStatus: () => getDeveloperAccessStatus(options),
         listUserMiniprograms: (requestOptions = {}) => listUserMiniprograms(requestOptions, options),
-        createUserMiniprogram: (requestOptions) => createUserMiniprogram(requestOptions, options),
-        updateUserMiniprogram: (requestOptions) => updateUserMiniprogram(requestOptions, options),
+        createUserMiniprogram: () => createUserMiniprogram(options),
         getUserMiniprogramDetail: (requestOptions) => getUserMiniprogramDetail(requestOptions, options),
         getPreviewAllowlist: (requestOptions) => getPreviewAllowlist(requestOptions, options),
         updatePreviewAllowlist: (requestOptions) => updatePreviewAllowlist(requestOptions, options),
@@ -3556,6 +3600,7 @@ function createRemoteApiClient(options) {
         releaseUserMiniprogramVersion: (requestOptions) => releaseUserMiniprogramVersion(requestOptions, options),
         takeDownUserMiniprogram: (requestOptions) => takeDownUserMiniprogram(requestOptions, options),
         reopenUserMiniprogram: (requestOptions) => reopenUserMiniprogram(requestOptions, options),
+        updateSquareDisplay: (requestOptions) => updateSquareDisplay(requestOptions, options),
         listUserMiniprogramVersions: (requestOptions) => listUserMiniprogramVersions(requestOptions, options),
     };
 }
@@ -3571,11 +3616,8 @@ async function getDeveloperAccessStatus(runtime) {
 async function listUserMiniprograms(options, runtime) {
     return remoteGet(LIST_USER_MINIPROGRAM_API_PATH, options, runtime);
 }
-async function createUserMiniprogram(options, runtime) {
-    return remotePostForm(CREATE_USER_MINIPROGRAM_API_PATH, options, runtime);
-}
-async function updateUserMiniprogram(options, runtime) {
-    return remotePostForm(UPDATE_USER_MINIPROGRAM_API_PATH, options, runtime);
+async function createUserMiniprogram(runtime) {
+    return remotePostForm(CREATE_USER_MINIPROGRAM_API_PATH, {}, runtime);
 }
 async function getUserMiniprogramDetail(options, runtime) {
     return remoteGet(DETAIL_USER_MINIPROGRAM_API_PATH, options, runtime);
@@ -3613,6 +3655,9 @@ async function takeDownUserMiniprogram(options, runtime) {
 async function reopenUserMiniprogram(options, runtime) {
     return remotePostForm(REOPEN_USER_MINIPROGRAM_API_PATH, options, runtime);
 }
+async function updateSquareDisplay(options, runtime) {
+    return remotePostForm(UPDATE_SQUARE_DISPLAY_API_PATH, options, runtime);
+}
 async function listUserMiniprogramVersions(options, runtime) {
     return remoteGet(LIST_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
 }
@@ -3811,8 +3856,6 @@ async function runRemoteCommand(options, runtime = {}) {
             return remoteBind(options, context, runtime);
         case 'info':
             return remoteInfo(options, context, runtime);
-        case 'update':
-            return remoteUpdate(options, context, runtime);
         case 'allowlist:list':
             return remoteAllowlistList(options, context, runtime);
         case 'allowlist:add':
@@ -3828,6 +3871,9 @@ async function runRemoteCommand(options, runtime = {}) {
         case 'take-down':
         case 'reopen':
             return remoteDangerousWrite(options, context, runtime);
+        case 'square:hide':
+        case 'square:show':
+            return remoteSquareWrite(options, context, runtime);
         default:
             throw new Error(`不支持的 remote 命令：${String(options.command)}`);
     }
@@ -3894,8 +3940,7 @@ function adaptRemoteApiClient(api) {
     return {
         accessStatus: () => api.getDeveloperAccessStatus(),
         listMiniPrograms: ({ keyword, limit = 200, offset = 0, status }) => api.listUserMiniprograms({ keyword, status, offset, limit }),
-        createMiniProgram: ({ name, previewImageUrl }) => api.createUserMiniprogram({ name, ...(previewImageUrl ? { preview_image_url: previewImageUrl } : {}) }),
-        updateMiniProgram: ({ miniProgramId, name, previewImageUrl }) => api.updateUserMiniprogram({ mini_program_id: miniProgramId, name, preview_image_url: previewImageUrl }),
+        createMiniProgram: () => api.createUserMiniprogram(),
         getMiniProgramDetail: (miniProgramId) => api.getUserMiniprogramDetail({ mini_program_id: miniProgramId }),
         getAllowlist: (miniProgramId) => api.getPreviewAllowlist({ mini_program_id: miniProgramId }),
         updateAllowlist: ({ miniProgramId, heyboxIds }) => api.updatePreviewAllowlist({ mini_program_id: miniProgramId, heybox_ids: heyboxIds }),
@@ -3907,6 +3952,7 @@ function adaptRemoteApiClient(api) {
         withdrawVersion: ({ miniProgramId, reason, version }) => api.withdrawUserMiniprogramVersion({ mini_program_id: miniProgramId, version, reason }),
         takeDown: (miniProgramId) => api.takeDownUserMiniprogram({ mini_program_id: miniProgramId }),
         reopen: (miniProgramId) => api.reopenUserMiniprogram({ mini_program_id: miniProgramId }),
+        updateSquareDisplay: ({ miniProgramId, isHidden }) => api.updateSquareDisplay({ mini_program_id: miniProgramId, is_hidden: isHidden }),
     };
 }
 async function remoteAccess(options, context, runtime) {
@@ -4008,14 +4054,12 @@ async function remoteCreate(options, context, runtime) {
     if (context.binding && !options.forceBind) {
         throw new Error(`当前项目已绑定 ${context.binding}；如需覆盖，请使用 --force-bind`);
     }
-    const name = requireNonEmpty(options.name, 'remote create 必须传 --name <name>');
-    const previewImageUrl = validateOptionalHttpsUrl(options.previewImageUrl, '--preview-image-url');
     const access = await context.api.accessStatus();
     if (access.status !== 'approved') {
         throw new Error(`当前 CLI 用户没有创建工坊小程序权限：${String(access.status ?? 'unknown')}`);
     }
     await confirmCreateWithCurrentEntity(options, context, runtime);
-    const result = await context.api.createMiniProgram({ name, previewImageUrl });
+    const result = await context.api.createMiniProgram();
     const miniProgramId = requireMiniProgramId(result);
     await writeBoundMiniProgramId(context.packageJson.projectRoot, miniProgramId, { force: options.forceBind });
     const output = { changed: true, miniProgramId, remote: toCamelCaseDeep(result) };
@@ -4051,25 +4095,6 @@ async function remoteInfo(options, context, runtime) {
     }
     return finishRemoteCommand(options, runtime, output);
 }
-async function remoteUpdate(options, context, runtime) {
-    const miniProgramId = requireBinding(context);
-    const hasName = options.name !== undefined;
-    const hasPreviewImageUrl = options.previewImageUrl !== undefined;
-    if (!hasName && !hasPreviewImageUrl) {
-        throw new Error('remote update 至少需要传 --name 或 --preview-image-url');
-    }
-    const detail = await context.api.getMiniProgramDetail(miniProgramId);
-    const nextName = hasName ? requireNonEmpty(options.name, '--name 不能为空') : requireNonEmpty(detail.name, '远端详情缺少 name，无法补全 update 请求');
-    const nextPreviewImageUrl = hasPreviewImageUrl
-        ? validateOptionalHttpsUrl(options.previewImageUrl, '--preview-image-url') ?? ''
-        : String(detail.preview_image_url ?? '');
-    const result = await context.api.updateMiniProgram({ miniProgramId, name: nextName, previewImageUrl: nextPreviewImageUrl });
-    const output = { changed: true, miniProgramId, remote: toCamelCaseDeep(result) };
-    if (!options.json) {
-        context.logger.success(`更新成功：${miniProgramId}`);
-    }
-    return finishRemoteCommand(options, runtime, output);
-}
 async function remoteAllowlistList(options, context, runtime) {
     const miniProgramId = requireBinding(context);
     const result = await context.api.getAllowlist(miniProgramId);
@@ -4157,6 +4182,25 @@ async function remoteDangerousWrite(options, context, runtime) {
     const result = await context.api.reopen(miniProgramId);
     return finishDangerousWrite(options, runtime, context.logger, miniProgramId, result, { status: result.status });
 }
+async function remoteSquareWrite(options, context, runtime) {
+    const miniProgramId = requireBinding(context);
+    const isHidden = options.command === 'square:hide';
+    if (isHidden) {
+        const detail = await context.api.getMiniProgramDetail(miniProgramId);
+        await confirmDangerousRemoteChange(options, runtime, context.logger, {
+            miniProgramId,
+            name: detail.name,
+            operation: 'square hide',
+            status: detail.status,
+        });
+    }
+    const result = await context.api.updateSquareDisplay({ miniProgramId, isHidden });
+    const output = { changed: true, isHidden: result.is_hidden === true, miniProgramId, remote: toCamelCaseDeep(result) };
+    if (!options.json) {
+        context.logger.success(`${isHidden ? '隐藏' : '展示'}广场展示状态成功：${miniProgramId}`);
+    }
+    return finishRemoteCommand(options, runtime, output);
+}
 function finishDangerousWrite(options, runtime, logger, miniProgramId, result, extras) {
     const output = { changed: true, miniProgramId, ...extras, remote: toCamelCaseDeep(result) };
     if (!options.json) {
@@ -4380,23 +4424,6 @@ function requireNonEmpty(value, message) {
     }
     return normalized;
 }
-function validateOptionalHttpsUrl(value, label) {
-    if (value === undefined) {
-        return undefined;
-    }
-    const raw = requireNonEmpty(value, `${label} 不能为空`);
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        throw new Error(`${label} 必须是合法 HTTPS URL`);
-    }
-    if (url.protocol !== 'https:') {
-        throw new Error(`${label} 只接受 HTTPS URL`);
-    }
-    return raw;
-}
 function parseHeyboxIds(values) {
     if (values.length === 0) {
         throw new Error('请传入至少一个十进制 heybox_id');

package/dist/cli-chunks/{session-DIGS_hBV.cjs → session-CNAnXfwl.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-D-F9nQns.cjs');
+var index = require('./index-BXthiT6e.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-D-F9nQns.cjs');
+var index = require('./cli-chunks/index-BXthiT6e.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/miniapp-publish.cjs.js

@@ -2818,7 +2818,6 @@ const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
 const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
 const LIST_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/list';
 const CREATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/create';
-const UPDATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/update';
 const DETAIL_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/detail';
 const USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist';
 const UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist/update';
@@ -2829,6 +2828,7 @@ const WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_minipro
 const RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/release';
 const TAKE_DOWN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/take_down';
 const REOPEN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/reopen';
+const UPDATE_SQUARE_DISPLAY_API_PATH = '/mall/developer/user_miniprogram/square_display/update';
 const LIST_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/list';
 const FNV_OFFSET = 0x811c9dc5;
 const FNV_PRIME = 0x01000193;
@@ -2914,7 +2914,7 @@ exports.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = RELEASE_USER_MINIPROGRAM_VER
 exports.REOPEN_USER_MINIPROGRAM_API_PATH = REOPEN_USER_MINIPROGRAM_API_PATH;
 exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH;
 exports.TAKE_DOWN_USER_MINIPROGRAM_API_PATH = TAKE_DOWN_USER_MINIPROGRAM_API_PATH;
-exports.UPDATE_USER_MINIPROGRAM_API_PATH = UPDATE_USER_MINIPROGRAM_API_PATH;
+exports.UPDATE_SQUARE_DISPLAY_API_PATH = UPDATE_SQUARE_DISPLAY_API_PATH;
 exports.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;
 exports.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = USER_MINIPROGRAM_ACCESS_STATUS_API_PATH;
 exports.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;

package/dist/miniapp-publish.esm.js

@@ -2816,7 +2816,6 @@ const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
 const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
 const LIST_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/list';
 const CREATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/create';
-const UPDATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/update';
 const DETAIL_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/detail';
 const USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist';
 const UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist/update';
@@ -2827,6 +2826,7 @@ const WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_minipro
 const RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/release';
 const TAKE_DOWN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/take_down';
 const REOPEN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/reopen';
+const UPDATE_SQUARE_DISPLAY_API_PATH = '/mall/developer/user_miniprogram/square_display/update';
 const LIST_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/list';
 const FNV_OFFSET = 0x811c9dc5;
 const FNV_PRIME = 0x01000193;
@@ -2897,4 +2897,4 @@ function shouldUploadDistFile(relativePath) {
     return true;
 }
 
-export { ACTIVITY_UPLOAD_KEY_MAX_LENGTH, CREATE_USER_MINIPROGRAM_API_PATH, DETAIL_USER_MINIPROGRAM_API_PATH, DEVELOPER_ENTITY_LIST_API_PATH, DEVELOPER_ENTITY_SWITCH_API_PATH, LIST_USER_MINIPROGRAM_API_PATH, LIST_USER_MINIPROGRAM_VERSION_API_PATH, MINIAPP_UPLOAD_BATCH_SIZE, MINIAPP_UPLOAD_SCOPE, MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES, PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, REOPEN_USER_MINIPROGRAM_API_PATH, SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, TAKE_DOWN_USER_MINIPROGRAM_API_PATH, UPDATE_USER_MINIPROGRAM_API_PATH, UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, getMiniProgramUploadAlias, getMiniappUploadKey, isValidMiniappManifestVersion as isValidVersion, normalizeRelativePath, relativePathContainsNodeModulesSegment, shouldUploadDistFile, validateUploadPaths, validateUploadTotalSize };
+export { ACTIVITY_UPLOAD_KEY_MAX_LENGTH, CREATE_USER_MINIPROGRAM_API_PATH, DETAIL_USER_MINIPROGRAM_API_PATH, DEVELOPER_ENTITY_LIST_API_PATH, DEVELOPER_ENTITY_SWITCH_API_PATH, LIST_USER_MINIPROGRAM_API_PATH, LIST_USER_MINIPROGRAM_VERSION_API_PATH, MINIAPP_UPLOAD_BATCH_SIZE, MINIAPP_UPLOAD_SCOPE, MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES, PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, REOPEN_USER_MINIPROGRAM_API_PATH, SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, TAKE_DOWN_USER_MINIPROGRAM_API_PATH, UPDATE_SQUARE_DISPLAY_API_PATH, UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, getMiniProgramUploadAlias, getMiniappUploadKey, isValidMiniappManifestVersion as isValidVersion, normalizeRelativePath, relativePathContainsNodeModulesSegment, shouldUploadDistFile, validateUploadPaths, validateUploadTotalSize };

package/dist/templates/vue3-vite-ts/README.md.ejs

@@ -21,7 +21,7 @@ npm run deploy
 
 - `npm run dev`：启动本地 Vite 服务和 `hb-sdk` 内置 mock runtime host，适合本地调试 SDK 能力；调试页内可点击按钮在 Mac 版 APP 中启动同一页面，也可以选择局域网网卡后用手机小黑盒 APP 扫码调试。手机需要与电脑处在同一局域网，并使用支持小程序调试壳的新版小黑盒 APP。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP，需要时请在系统浏览器中打开同一个调试页后重试。
 - `npm run build`：先执行 TypeScript 检查，再构建生产产物。
-- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create --name "..."` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
+- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在 `package.json.heybox.miniProgramProfile` 中配置并随版本审核提交。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
 
 ## 更多能力
 

package/dist/templates/vue3-vite-ts/package.json.ejs

@@ -4,7 +4,12 @@
   "private": true,
   "type": "module",
   "heybox": {
-    "miniProgramId": ""
+    "miniProgramId": "",
+    "miniProgramProfile": {
+      "name": "<%= packageName %>",
+      "iconUrl": "",
+      "coverImageUrls": []
+    }
   },
   "scripts": {
     "hb-sdk": "hb-sdk",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "",
   "exports": {
     ".": {
@@ -121,6 +121,10 @@
     "test:unit": "NODE_OPTIONS='--conditions=heybox' vitest run",
     "test:unit:coverage": "NODE_OPTIONS='--conditions=heybox' vitest run --coverage",
     "test:vite": "vitest run --config vitest.vite.config.ts",
-    "test:watch": "NODE_OPTIONS='--conditions=heybox' vitest"
+    "test:watch": "NODE_OPTIONS='--conditions=heybox' vitest",
+    "changelog:draft": "node scripts/changelog-draft.cjs",
+    "check:changelog": "node scripts/check-changelog.cjs",
+    "release:prepare": "node scripts/release-prepare.cjs",
+    "release:tag": "node scripts/release-tag.cjs"
   }
 }

package/skill/SKILL.md

@@ -50,8 +50,8 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 2. Use `hb-sdk dev` for local browser debugging through the built-in mock runtime host.
 3. Use `hb-sdk remote ...` for developer-owned remote mini-program management. Top-level `hb-sdk deploy` has been hard-cut and must not be recommended as a compatibility alias.
 4. Use `hb-sdk remote entity list`, `hb-sdk remote entity current`, and `hb-sdk remote entity switch <entity-id>` to inspect or change the developer platform server-side current entity before remote management commands.
-5. Use `hb-sdk remote create --name <name>` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified.
-6. Use `hb-sdk remote info`, `hb-sdk remote update`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for read/basic/preview management workflows. Discovery commands show the server-side current entity scope; write commands target the current project binding rather than arbitrary ids.
+5. Use `hb-sdk remote create` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified. Mini-program name, icon, and cover images belong in `package.json.heybox.miniProgramProfile` and are submitted with version audit.
+6. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for read/basic/preview management workflows. Mini-program name and image changes must go through version audit, so the CLI must not expose a basic-info update command.
 7. Use `hb-sdk remote deploy --release-note <text>` to build, upload, and submit the current project for audit. It reads `package.json.heybox.miniProgramId`, validates that the bound mini-program belongs to the server-side current entity before precheck/build/upload, prechecks `package.json.version` before build, runs the project's `build` script via the package manager auto-detected by lockfile, uploads `dist/` to CDN (skipping `manifest.json`, `.DS_Store`, `.map`), then calls the submit-audit API. The deploy upload pipeline rejects actual upload artifacts over 100MiB before any upload request, processes CDN upload metadata and callback confirmation at 50 files per batch, keeps 4-way upload concurrency within each batch, and validates CDN-returned keys exactly against the local expected upload keys.
 8. Use `hb-sdk remote deploy --skip-build --release-note <text>` only when the `dist/` directory is already prepared by an upstream CI stage. In this mode the CLI reads `dist/manifest.json.version` before precheck. Missing `dist/manifest.json` or `dist/index.html` aborts the run.
 9. Always provide a concise release note before deploy. Non-interactive environments must pass `--release-note`; interactive terminals may prompt for it. The default is manual release after approval with `hb-sdk remote release <version>`; use `--auto-publish` when the audited version should automatically release after approval.
@@ -103,17 +103,18 @@ For host/runtime/protocol-maintenance code:
 2. When modifying docs, skill instructions, CLI guidance, or public agent-skill sync points, start with:
    - `pnpm --filter @heybox/hb-sdk run check:docs-sync`
    - `cat packages/hb-sdk/DOC_SYNC_CHECKLIST.md`
-3. When modifying this repo's source skill at `packages/hb-sdk/skill` and preparing distributable artifacts, also run:
+3. When preparing a package release, run `pnpm --filter @heybox/hb-sdk run release:prepare -- --bump patch` or `pnpm --filter @heybox/hb-sdk run release:prepare -- --version <x.y.z>`. The release assistant updates both package versions, inserts `packages/hb-sdk/CHANGELOG.md`, and runs `check:changelog`. Use `--ai-command "<command>"` or `HB_SDK_CHANGELOG_AI_COMMAND` when an AI writer should rewrite the Conventional Commit draft. Review the entry for Mini-program developers and Host/Runtime integration maintainers, and do not expose Runtime internal adapter, state-machine, or security-policy details.
+4. When modifying this repo's source skill at `packages/hb-sdk/skill` and preparing distributable artifacts, also run:
    - `node packages/hb-sdk/skill/scripts/package-skill.mjs`
-4. When modifying CLI, mock runtime, package exports, or package dependency direction, also run:
+5. When modifying CLI, mock runtime, package exports, or package dependency direction, also run:
    - `pnpm --filter @heybox/hb-sdk run check:boundary`
    - `pnpm --filter @heybox/hb-sdk run test:unit`
-5. Inspect the generated zip before distribution:
+6. Inspect the generated zip before distribution:
    - `unzip -l packages/hb-sdk/hb-sdk.zip | sed -n '1,120p'`
-6. When adding or modifying the deploy command or its upload pipeline, also run:
+7. When adding or modifying the deploy command or its upload pipeline, also run:
    - `pnpm --filter @heybox/hb-sdk run check:boundary`
    - `pnpm --filter @heybox/hb-sdk run test:unit`
    - Verify `dist/cli.cjs` does not have any `require('cos-nodejs-sdk-v5')` left after `build:cli`; the boundary check enforces this automatically.
-7. Verify public payload sync before publishing:
+8. Verify public payload sync before publishing:
    - `pnpm --filter @heybox-spa/open run sync:agent-skills`
    - `pnpm --filter @heybox-spa/open run check:agent-skills`

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.5.5`
+- Version at generation time: `0.5.7`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`

package/skill/references/cli.md

@@ -49,10 +49,9 @@ hb-sdk remote entity list
 hb-sdk remote entity current
 hb-sdk remote entity switch <entity-id>
 hb-sdk remote list [--status <status>] [--keyword <text>]
-hb-sdk remote create --name <name> [--preview-image-url <url>] [--yes] [--force-bind]
+hb-sdk remote create [--yes] [--force-bind]
 hb-sdk remote bind <mini-program-id> [--force]
 hb-sdk remote info
-hb-sdk remote update [--name <name>] [--preview-image-url <url>]
 hb-sdk remote allowlist list
 hb-sdk remote allowlist add <heybox-id...>
 hb-sdk remote allowlist remove <heybox-id...>
@@ -64,6 +63,8 @@ hb-sdk remote release <version> [--yes]
 hb-sdk remote withdraw <version> [--yes] [--reason <text>]
 hb-sdk remote take-down [--yes]
 hb-sdk remote reopen [--yes]
+hb-sdk remote square hide [--yes]
+hb-sdk remote square show
 
 Removed: hb-sdk deploy
 ```
@@ -166,7 +167,7 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 
 默认发布策略是 `auto_publish=false`：运营审核通过后使用 `hb-sdk remote versions` 查看版本状态，再用 `hb-sdk remote release <version>` 发布。需要审核通过后自动发布并下架旧线上版本时，使用 `--auto-publish`。如需让指定用户预览未发布候选版本，使用 `hb-sdk remote allowlist add <heybox_id>` 管理预览白名单。
 
-内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情、基础信息和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 `default_tag` 或 path-prefix 级 `special_tag`。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
+内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 `default_tag` 或 path-prefix 级 `special_tag`。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
 
 `hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 
@@ -202,7 +203,7 @@ The authoritative current entity is the developer platform server-side current e
 
 Agent rules:
 
-- Treat the server-side current entity as the authority for remote create, bind, deploy, list, access, versions, preview, release, withdraw, take-down, and reopen workflows.
+- Treat the server-side current entity as the authority for remote create, bind, deploy, list, access, versions, preview, release, withdraw, take-down, reopen, and square-display workflows.
 - Treat CLI `selectedEntity` as a display/debug snapshot only; it can drift from the server-side current entity and must not be used as a permission source.
 - Use `hb-sdk remote entity current` when a user needs to confirm which entity create/deploy will use.
 - Use `hb-sdk remote entity switch <entity-id>` to change entity scope. Do not recommend `--entity-id` or an environment variable as a remote command override.
@@ -219,10 +220,9 @@ Agent rules:
 ```bash
 hb-sdk remote access
 hb-sdk remote list
-hb-sdk remote create --name "我的小程序"
+hb-sdk remote create
 hb-sdk remote bind mp_xxxxxxxx
 hb-sdk remote info
-hb-sdk remote update --name "新名称"
 hb-sdk remote allowlist add 12345678
 hb-sdk remote versions
 hb-sdk remote preview 1.2.3
@@ -230,23 +230,44 @@ hb-sdk remote release 1.2.3
 hb-sdk remote withdraw 1.2.3 --reason "需要修复说明"
 hb-sdk remote take-down
 hb-sdk remote reopen
+hb-sdk remote square hide
+hb-sdk remote square show
 ```
 
 `hb-sdk remote create` 会创建远端工坊小程序并写入当前项目绑定；已有绑定时必须传 `--force-bind` 才能覆盖。`hb-sdk remote bind <mini-program-id>` 会先校验当前 CLI 用户可管理目标小程序，再写入本地配置；`--force` 只允许覆盖本地绑定，不跳过远端校验。
 
-`hb-sdk remote release`、`hb-sdk remote withdraw`、`hb-sdk remote take-down` 和 `hb-sdk remote reopen` 会改变审核、发布或用户侧可见状态。交互式终端会展示小程序 id、名称、当前状态、目标版本和操作，再要求确认；非 TTY 环境必须传 `--yes`。
+小程序名称、icon 和介绍图需要随版本提交审核，CLI 不再提供直接更新基础信息的命令。提交审核前在 `package.json.heybox.miniProgramProfile` 配置 `name`、HTTPS `iconUrl` 和至少一张 HTTPS `coverImageUrls`：
+
+```json
+{
+  "heybox": {
+    "miniProgramId": "mp_xxxxxxxx",
+    "miniProgramProfile": {
+      "name": "我的小程序",
+      "iconUrl": "https://img.example.test/icon.png",
+      "coverImageUrls": ["https://img.example.test/cover.png"]
+    }
+  }
+}
+```
+
+`hb-sdk remote square hide` 会隐藏当前绑定小程序在普通用户侧的小程序工坊广场展示；白名单用户仍可在小程序工坊广场看到，直接链接访问已发布版本也不受影响。`hb-sdk remote square show` 会恢复普通用户侧的小程序工坊广场展示。
+
+`hb-sdk remote release`、`hb-sdk remote withdraw`、`hb-sdk remote take-down`、`hb-sdk remote reopen` 和 `hb-sdk remote square hide` 会改变审核、发布或用户侧可见状态。交互式终端会展示小程序 id、名称、当前状态、目标版本和操作，再要求确认；非 TTY 环境必须传 `--yes`。
 
 所有 `hb-sdk remote` 子命令都支持 `--json`。开启后 stdout 只输出一个 JSON 对象；进度、警告、版本提醒和 verbose 诊断不能污染 stdout。
 
 Agent rules:
 
 - Use `hb-sdk remote entity list/current/switch` for developer entity inspection and switching.
-- Use `hb-sdk remote create --name <name>` for create-and-bind and `hb-sdk remote bind <mini-program-id>` for binding an existing manageable remote mini-program.
+- Use `hb-sdk remote create` for create-and-bind and `hb-sdk remote bind <mini-program-id>` for binding an existing manageable remote mini-program.
+- Keep mini-program name, icon, and cover images in `package.json.heybox.miniProgramProfile`; these fields are submitted with version audit.
 - Explain that `remote create` creates under the current entity and that multi-entity non-TTY usage must confirm with `--yes`; `--yes` confirms current-entity usage but does not switch entities.
 - Explain that `remote bind` verifies the mini-program is manageable by the current entity and does not write `package.json.heybox.miniProgramId` on entity mismatch.
-- Use `hb-sdk remote info`, `hb-sdk remote update`, `hb-sdk remote access`, `hb-sdk remote list`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` instead of sending users to Open when a matching CLI command exists.
+- Use `hb-sdk remote info`, `hb-sdk remote access`, `hb-sdk remote list`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, `hb-sdk remote square show/hide`, and `hb-sdk remote allowlist ...` instead of sending users to Open when a matching CLI command exists.
+- Do not expose a CLI basic-info update command; mini-program name and image changes must go through version audit.
 - Treat `hb-sdk remote list` as discovery only. Dangerous write commands still target the bound mini-program from `package.json.heybox.miniProgramId`.
-- Require confirmation or `--yes` for `hb-sdk remote release`, `hb-sdk remote withdraw`, `hb-sdk remote take-down`, and `hb-sdk remote reopen`.
+- Require confirmation or `--yes` for `hb-sdk remote release`, `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and `hb-sdk remote square hide`.
 - Use `--json` for script consumption and keep stdout as exactly one JSON object.
 
 ## CLI login cache
@@ -357,7 +378,7 @@ npm run deploy
 
 - `npm run dev`：启动本地 Vite 服务和 `hb-sdk` 内置 mock runtime host，适合本地调试 SDK 能力；调试页内可点击按钮在 Mac 版 APP 中启动同一页面，也可以选择局域网网卡后用手机小黑盒 APP 扫码调试。手机需要与电脑处在同一局域网，并使用支持小程序调试壳的新版小黑盒 APP。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP，需要时请在系统浏览器中打开同一个调试页后重试。
 - `npm run build`：先执行 TypeScript 检查，再构建生产产物。
-- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create --name "..."` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
+- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在 `package.json.heybox.miniProgramProfile` 中配置并随版本审核提交。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
 
 ## 更多能力
 

package/skill/scripts/sync-references.mjs

@@ -218,10 +218,9 @@ hb-sdk remote entity list
 hb-sdk remote entity current
 hb-sdk remote entity switch <entity-id>
 hb-sdk remote list [--status <status>] [--keyword <text>]
-hb-sdk remote create --name <name> [--preview-image-url <url>] [--yes] [--force-bind]
+hb-sdk remote create [--yes] [--force-bind]
 hb-sdk remote bind <mini-program-id> [--force]
 hb-sdk remote info
-hb-sdk remote update [--name <name>] [--preview-image-url <url>]
 hb-sdk remote allowlist list
 hb-sdk remote allowlist add <heybox-id...>
 hb-sdk remote allowlist remove <heybox-id...>
@@ -233,6 +232,8 @@ hb-sdk remote release <version> [--yes]
 hb-sdk remote withdraw <version> [--yes] [--reason <text>]
 hb-sdk remote take-down [--yes]
 hb-sdk remote reopen [--yes]
+hb-sdk remote square hide [--yes]
+hb-sdk remote square show
 
 Removed: hb-sdk deploy`;
 
@@ -401,7 +402,7 @@ ${cliRemoteEntitySection}
 
 Agent rules:
 
-- Treat the server-side current entity as the authority for remote create, bind, deploy, list, access, versions, preview, release, withdraw, take-down, and reopen workflows.
+- Treat the server-side current entity as the authority for remote create, bind, deploy, list, access, versions, preview, release, withdraw, take-down, reopen, and square-display workflows.
 - Treat CLI \`selectedEntity\` as a display/debug snapshot only; it can drift from the server-side current entity and must not be used as a permission source.
 - Use \`hb-sdk remote entity current\` when a user needs to confirm which entity create/deploy will use.
 - Use \`hb-sdk remote entity switch <entity-id>\` to change entity scope. Do not recommend \`--entity-id\` or an environment variable as a remote command override.
@@ -414,12 +415,14 @@ ${cliRemoteSection}
 Agent rules:
 
 - Use \`hb-sdk remote entity list/current/switch\` for developer entity inspection and switching.
-- Use \`hb-sdk remote create --name <name>\` for create-and-bind and \`hb-sdk remote bind <mini-program-id>\` for binding an existing manageable remote mini-program.
+- Use \`hb-sdk remote create\` for create-and-bind and \`hb-sdk remote bind <mini-program-id>\` for binding an existing manageable remote mini-program.
+- Keep mini-program name, icon, and cover images in \`package.json.heybox.miniProgramProfile\`; these fields are submitted with version audit.
 - Explain that \`remote create\` creates under the current entity and that multi-entity non-TTY usage must confirm with \`--yes\`; \`--yes\` confirms current-entity usage but does not switch entities.
 - Explain that \`remote bind\` verifies the mini-program is manageable by the current entity and does not write \`package.json.heybox.miniProgramId\` on entity mismatch.
-- Use \`hb-sdk remote info\`, \`hb-sdk remote update\`, \`hb-sdk remote access\`, \`hb-sdk remote list\`, \`hb-sdk remote versions\`, \`hb-sdk remote preview <version>\`, and \`hb-sdk remote allowlist ...\` instead of sending users to Open when a matching CLI command exists.
+- Use \`hb-sdk remote info\`, \`hb-sdk remote access\`, \`hb-sdk remote list\`, \`hb-sdk remote versions\`, \`hb-sdk remote preview <version>\`, \`hb-sdk remote square show/hide\`, and \`hb-sdk remote allowlist ...\` instead of sending users to Open when a matching CLI command exists.
+- Do not expose a CLI basic-info update command; mini-program name and image changes must go through version audit.
 - Treat \`hb-sdk remote list\` as discovery only. Dangerous write commands still target the bound mini-program from \`package.json.heybox.miniProgramId\`.
-- Require confirmation or \`--yes\` for \`hb-sdk remote release\`, \`hb-sdk remote withdraw\`, \`hb-sdk remote take-down\`, and \`hb-sdk remote reopen\`.
+- Require confirmation or \`--yes\` for \`hb-sdk remote release\`, \`hb-sdk remote withdraw\`, \`hb-sdk remote take-down\`, \`hb-sdk remote reopen\`, and \`hb-sdk remote square hide\`.
 - Use \`--json\` for script consumption and keep stdout as exactly one JSON object.
 
 ## CLI login cache

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.5.5+skill.0d0c16cf3747",
+  "skillVersion": "0.5.7+skill.90b5f340fde8",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.5.5",
-    "compatibility": "0.5.5"
+    "version": "0.5.7",
+    "compatibility": "0.5.7"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-0d0c16cf374723b36892f32dae70ea0f8a50a0f44aa507691f8e9a75d6c43fb6"
+  "integrity": "sha256-90b5f340fde847a24ce8fe26b6f2134999c19deb0ac0585a431149ca97aa117b"
 }

package/types/miniapp-publish/index.d.ts

@@ -7,7 +7,6 @@ export declare const DEVELOPER_ENTITY_LIST_API_PATH = "/mall/developer/entity/li
 export declare const DEVELOPER_ENTITY_SWITCH_API_PATH = "/mall/developer/entity/switch";
 export declare const LIST_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_miniprogram/list";
 export declare const CREATE_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_miniprogram/create";
-export declare const UPDATE_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_miniprogram/update";
 export declare const DETAIL_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_miniprogram/detail";
 export declare const USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = "/mall/developer/user_miniprogram/preview_allowlist";
 export declare const UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = "/mall/developer/user_miniprogram/preview_allowlist/update";
@@ -18,6 +17,7 @@ export declare const WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = "/mall/develop
 export declare const RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = "/mall/developer/user_miniprogram/version/release";
 export declare const TAKE_DOWN_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_miniprogram/take_down";
 export declare const REOPEN_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_miniprogram/reopen";
+export declare const UPDATE_SQUARE_DISPLAY_API_PATH = "/mall/developer/user_miniprogram/square_display/update";
 export declare const LIST_USER_MINIPROGRAM_VERSION_API_PATH = "/mall/developer/user_miniprogram/version/list";
 export { isValidMiniappManifestVersion as isValidVersion } from '../miniapp-manifest/schema';
 export declare function normalizeRelativePath(relativePath: string): string;