npm - @heybox/hb-sdk - Versions diffs - 0.6.0 → 0.6.1 - Mend

@heybox/hb-sdk 0.6.0 → 0.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/README.md +3 -3
package/dist/cli-chunks/{sdk-version-policy-B1CFC1Dk.cjs → context-D0BowvGu.cjs} +3 -88
package/dist/cli-chunks/{create-DYb53EQ-.cjs → create-C0afRvs9.cjs} +1 -1
package/dist/cli-chunks/{dev-CPKTuA6q.cjs → dev-CN307p_G.cjs} +93 -8
package/dist/cli-chunks/{doctor-TshFvqHC.cjs → doctor-VW0nKg5q.cjs} +1 -1
package/dist/cli-chunks/{index-CCeHouBU.cjs → index-BnCDW-BB.cjs} +13 -13
package/dist/cli-chunks/{index-NOO3q8_C.cjs → index-DcZLSI_y.cjs} +3 -3
package/dist/cli-chunks/{login-DtXHSm8R.cjs → login-BsyENL1d.cjs} +2 -2
package/dist/cli-chunks/{remote-BWfn7qIN.cjs → remote-BSvvxvVv.cjs} +39 -49
package/dist/cli-chunks/{session-DIcRjyDY.cjs → session-0XuUaVOO.cjs} +1 -1
package/dist/cli.cjs +1 -1
package/dist/index.cjs.js +1 -1
package/dist/index.esm.js +1 -1
package/dist/vite.cjs.js +4 -4
package/dist/vite.esm.js +4 -4
package/package.json +2 -2
package/skill/SKILL.md +2 -2
package/skill/references/api-root.md +15 -16
package/skill/references/cli.md +3 -1
package/skill/skill.json +4 -4

package/README.md CHANGED Viewed

@@ -490,7 +490,7 @@ hb-sdk remote deploy --env test --service-tag other-tag --release-note "灰度"
 `--env <name>` 会读取项目根下的 `.env.<name>`，`--env-file <path>` 显式指定路径且优先级高于 `--env`；两者也可通过 `HB_SDK_ENV=<name>` 触发。加载遵循 dotenv 惯例：不覆盖进程已有的同名变量，因此 CI 或命令行显式设置的值优先。使用 `--env <name>` 或 `HB_SDK_ENV=<name>` 执行 `remote deploy` 时，CLI 还会把同一个 `name` 作为 `--mode <name>` 传给项目 build，使 CLI 后端环境与 Vite mode 保持一致。文件仅支持 `KEY=VALUE`、空行和 `#` 注释，不做变量插值；文件不存在时静默跳过。`--verbose` 会打印生效的文件路径和被跳过的 key。
-`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。`--service-tag <tag>` 优先于 `HB_SDK_SERVICE_TAG`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。deploy 子构建会继承 `.env.<name>` 中的 `HB_SDK_SERVICE_TAG`，Vite 最低 SDK 版本门禁请求也会同时携带该 header 和 query；仓库内开发也可继续在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 path-prefix 级 `special_tag`。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
+`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。`--service-tag <tag>` 优先于 `HB_SDK_SERVICE_TAG`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query；`remote deploy` 的子构建不执行客户端最低版本门禁。仓库内开发也可继续在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 path-prefix 级 `special_tag`。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 ## hb-sdk remote 命令参考
@@ -548,7 +548,7 @@ CLI 登录态只供 CLI 命令访问黑盒接口时复用，不会注入 iframe
 ```json
 {
   "version": "1.2.3",
-  "sdkVersion": "0.6.0"
+  "sdkVersion": "0.6.1"
 }
 ```
@@ -570,7 +570,7 @@ export default defineConfig({
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、build 和 deploy 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 失败与警告语义：

package/dist/cli-chunks/{sdk-version-policy-B1CFC1Dk.cjs → context-D0BowvGu.cjs} RENAMED Viewed

@@ -1,10 +1,10 @@
 'use strict';
-var session = require('./session-DIcRjyDY.cjs');
+var session = require('./session-0XuUaVOO.cjs');
+var index = require('./index-BnCDW-BB.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var index = require('./index-CCeHouBU.cjs');
 const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
 function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
@@ -3214,91 +3214,6 @@ function isTruthyEnvFlag(value) {
         .toLowerCase());
 }
-const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
-async function resolveMinimumSdkVersion(options) {
-    const now = options.now ?? Date.now();
-    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
-    const cache = await readCache(cachePath);
-    let minimumSdkVersion;
-    try {
-        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
-    }
-    catch {
-        const cached = cache.environments[options.environment];
-        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
-        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
-            try {
-                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
-            }
-            catch {
-                // 非法缓存按不存在处理。
-            }
-        }
-        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
-    }
-    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
-    try {
-        await writeCache(cachePath, cache);
-    }
-    catch {
-        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
-    }
-    return minimumSdkVersion;
-}
-function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
-    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
-    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
-    if (!options.allowPrerelease && semverExports.prerelease(current) !== null) {
-        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
-    }
-    if (!semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
-        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
-    }
-    return current;
-}
-function validateSdkVersion(value, label) {
-    const normalized = String(value).trim();
-    const parsed = semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function validateStableSdkVersion(value, label) {
-    const normalized = validateSdkVersion(value, label);
-    if (semverExports.prerelease(normalized) !== null)
-        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
-    return normalized;
-}
-async function readCache(cachePath) {
-    try {
-        const parsed = JSON.parse(await fs.readFile(cachePath, 'utf8'));
-        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
-            return parsed;
-    }
-    catch {
-        // 缓存缺失或损坏时继续请求最新配置。
-    }
-    return { environments: {} };
-}
-async function writeCache(cachePath, cache) {
-    await fs.mkdir(path.dirname(cachePath), { recursive: true });
-    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
-    await fs.writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
-    await fs.rename(temporaryPath, cachePath);
-}
-const paths = index.envPaths('hb-sdk');
-async function enforceRemoteSdkVersion(options) {
-    const minimumSdkVersion = await resolveMinimumSdkVersion({
-        cacheDir: options.cacheDir ?? paths.cache,
-        environment: options.environment,
-        fetchMinimumSdkVersion: async () => (await getPublicSdkConfig({ baseUrl: options.environment, fetchImpl: options.fetchImpl })).minimum_sdk_version,
-    });
-    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
-}
 exports.ACTIVITY_UPLOAD_KEY_MAX_LENGTH = ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
 exports.MINIAPP_UPLOAD_BATCH_SIZE = MINIAPP_UPLOAD_BATCH_SIZE;
 exports.MINIAPP_UPLOAD_SCOPE = MINIAPP_UPLOAD_SCOPE;
@@ -3306,9 +3221,9 @@ exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
 exports.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH = PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
-exports.enforceRemoteSdkVersion = enforceRemoteSdkVersion;
 exports.getBoundMiniProgram = getBoundMiniProgram;
 exports.getMiniappUploadKey = getMiniappUploadKey;
+exports.getPublicSdkConfig = getPublicSdkConfig;
 exports.normalizeRelativePath = normalizeRelativePath;
 exports.readBoundMiniProgramId = readBoundMiniProgramId;
 exports.readBoundMiniProgramIdFromPackageJson = readBoundMiniProgramIdFromPackageJson;

package/dist/cli-chunks/{create-DYb53EQ-.cjs → create-C0afRvs9.cjs} RENAMED Viewed

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-BnCDW-BB.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CPKTuA6q.cjs → dev-CN307p_G.cjs} RENAMED Viewed

@@ -9,9 +9,9 @@ var node_url = require('node:url');
 var net = require('node:net');
 var node_http = require('node:http');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CCeHouBU.cjs');
-var sdkVersionPolicy = require('./sdk-version-policy-B1CFC1Dk.cjs');
-var session = require('./session-DIcRjyDY.cjs');
+var index = require('./index-BnCDW-BB.cjs');
+var context = require('./context-D0BowvGu.cjs');
+var session = require('./session-0XuUaVOO.cjs');
 require('node:process');
 require('node:buffer');
 require('node:util');
@@ -666,10 +666,95 @@ function createHeyboxProtocol(payload) {
     return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
 }
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
+const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
+async function resolveMinimumSdkVersion(options) {
+    const now = options.now ?? Date.now();
+    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
+    const cache = await readCache(cachePath);
+    let minimumSdkVersion;
+    try {
+        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
+    }
+    catch {
+        const cached = cache.environments[options.environment];
+        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
+        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
+            try {
+                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
+            }
+            catch {
+                // 非法缓存按不存在处理。
+            }
+        }
+        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
+    }
+    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
+    try {
+        await writeCache(cachePath, cache);
+    }
+    catch {
+        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
+    }
+    return minimumSdkVersion;
+}
+function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
+    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
+    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
+    if (!options.allowPrerelease && context.semverExports.prerelease(current) !== null) {
+        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
+    }
+    if (!context.semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
+        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
+    }
+    return current;
+}
+function validateSdkVersion(value, label) {
+    const normalized = String(value).trim();
+    const parsed = context.semverExports.parse(normalized);
+    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
+        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
+    }
+    return normalized;
+}
+function validateStableSdkVersion(value, label) {
+    const normalized = validateSdkVersion(value, label);
+    if (context.semverExports.prerelease(normalized) !== null)
+        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
+    return normalized;
+}
+async function readCache(cachePath) {
+    try {
+        const parsed = JSON.parse(await fs$1.readFile(cachePath, 'utf8'));
+        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
+            return parsed;
+    }
+    catch {
+        // 缓存缺失或损坏时继续请求最新配置。
+    }
+    return { environments: {} };
+}
+async function writeCache(cachePath, cache) {
+    await fs$1.mkdir(path.dirname(cachePath), { recursive: true });
+    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
+    await fs$1.writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
+    await fs$1.rename(temporaryPath, cachePath);
+}
+const paths = index.envPaths('hb-sdk');
+async function enforceRemoteSdkVersion(options) {
+    const minimumSdkVersion = await resolveMinimumSdkVersion({
+        cacheDir: options.cacheDir ?? paths.cache,
+        environment: options.environment,
+        fetchMinimumSdkVersion: async () => (await context.getPublicSdkConfig({ baseUrl: options.environment, fetchImpl: options.fetchImpl })).minimum_sdk_version,
+    });
+    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
+}
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.1';
 const DEFAULT_APP_PORT = 5173;
 const DEFAULT_MOCK_PORT = 5174;
@@ -682,7 +767,7 @@ async function runDevCommand(options, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
     const fetchImpl = runtime.fetchImpl ?? fetch;
     const environment = session.resolveHeyboxApiBaseUrl({ env: runtime.env });
-    await (runtime.enforceRemoteSdkVersion ?? sdkVersionPolicy.enforceRemoteSdkVersion)({
+    await (runtime.enforceRemoteSdkVersion ?? enforceRemoteSdkVersion)({
         sdkVersion: HB_SDK_VERSION,
         environment,
         fetchImpl,
@@ -771,14 +856,14 @@ async function runDevCommand(options, runtime = {}) {
     installShutdownHandlers(closers, runtime.process ?? process);
 }
 async function loadDevLaunchContext(options) {
-    const miniProgramId = await sdkVersionPolicy.readBoundMiniProgramId(options.projectRoot);
+    const miniProgramId = await context.readBoundMiniProgramId(options.projectRoot);
     if (!miniProgramId) {
         const nativeAppLaunchUnavailableReason = '当前项目未绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。';
         options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${nativeAppLaunchUnavailableReason}`);
         return { nativeAppLaunchUnavailableReason };
     }
     try {
-        const { detail, miniProgramId: verifiedMiniProgramId } = await options.logger.task('正在读取远端小程序权限', () => sdkVersionPolicy.getBoundMiniProgram({
+        const { detail, miniProgramId: verifiedMiniProgramId } = await options.logger.task('正在读取远端小程序权限', () => context.getBoundMiniProgram({
             cwd: options.projectRoot,
             env: options.env,
             fetchImpl: options.fetchImpl,
@@ -796,7 +881,7 @@ async function loadDevLaunchContext(options) {
     }
 }
 function canFallbackToDefaultRuntimePermissions(error) {
-    if (error instanceof sdkVersionPolicy.MiniProgramProjectBindingError) {
+    if (error instanceof context.MiniProgramProjectBindingError) {
         return error.code === 'MINI_PROGRAM_UNBOUND';
     }
     if (error instanceof TypeError && error.message === 'fetch failed') {

package/dist/cli-chunks/{doctor-TshFvqHC.cjs → doctor-VW0nKg5q.cjs} RENAMED Viewed

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-BnCDW-BB.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-CCeHouBU.cjs → index-BnCDW-BB.cjs} RENAMED Viewed

@@ -234,19 +234,19 @@ function requireArgument () {
 var command = {};
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BnCDW-BB.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BnCDW-BB.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BnCDW-BB.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BnCDW-BB.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BnCDW-BB.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 var help = {};
@@ -13323,7 +13323,7 @@ function getPathname(pathWithQuery) {
 }
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.6.0';
+const BUILT_CLI_VERSION = '0.6.1';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13644,31 +13644,31 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-DtXHSm8R.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BsyENL1d.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-DtXHSm8R.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BsyENL1d.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-DtXHSm8R.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BsyENL1d.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DYb53EQ-.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-C0afRvs9.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CPKTuA6q.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CN307p_G.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-TshFvqHC.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-VW0nKg5q.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BWfn7qIN.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BSvvxvVv.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-NOO3q8_C.cjs → index-DcZLSI_y.cjs} RENAMED Viewed

@@ -1,13 +1,13 @@
 'use strict';
-var index$2 = require('./index-CCeHouBU.cjs');
+var index$2 = require('./index-BnCDW-BB.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$3 = require('assert');
 var require$$4$2 = require('events');
 var require$$1$1 = require('util');
-var sdkVersionPolicy = require('./sdk-version-policy-B1CFC1Dk.cjs');
+var context$1 = require('./context-D0BowvGu.cjs');
 var require$$0$5 = require('net');
 var require$$0$4 = require('url');
 var require$$2$2 = require('http');
@@ -13707,7 +13707,7 @@ function requireSource () {
 		const ajv_1 = requireAjv$1();
 		const ajv_formats_1 = requireDist();
 		const debounceFn = requireDebounceFn();
-		const semver = sdkVersionPolicy.requireSemver();
+		const semver = context$1.requireSemver();
 		const onetime = index$2.requireOnetime();
 		const encryptionAlgorithm = 'aes-256-cbc';
 		const createPlainObject = () => {

package/dist/cli-chunks/{login-DtXHSm8R.cjs → login-BsyENL1d.cjs} RENAMED Viewed

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DIcRjyDY.cjs');
+var session = require('./session-0XuUaVOO.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-BnCDW-BB.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{remote-BWfn7qIN.cjs → remote-BSvvxvVv.cjs} RENAMED Viewed

@@ -1,13 +1,13 @@
 'use strict';
 var promises = require('node:readline/promises');
-var index = require('./index-CCeHouBU.cjs');
-var session = require('./session-DIcRjyDY.cjs');
+var index = require('./index-BnCDW-BB.cjs');
+var session = require('./session-0XuUaVOO.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var sdkVersionPolicy = require('./sdk-version-policy-B1CFC1Dk.cjs');
+var context = require('./context-D0BowvGu.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -61,7 +61,7 @@ function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
         throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
     }
     const normalized = version.trim();
-    const parsed = sdkVersionPolicy.semverExports.parse(normalized);
+    const parsed = context.semverExports.parse(normalized);
     if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
         throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
     }
@@ -75,7 +75,7 @@ function getMiniappManifestVersionError(version) {
         return `必须是合法 SemVer：${String(version)}`;
     }
     const normalized = version.trim();
-    const parsed = sdkVersionPolicy.semverExports.parse(normalized);
+    const parsed = context.semverExports.parse(normalized);
     if (!parsed) {
         return `必须是合法 SemVer：${normalized}`;
     }
@@ -142,7 +142,7 @@ async function runUpload(options, runtime = {}) {
     const postCDNUploadCallback$1 = runtime.postCDNUploadCallback ?? postCDNUploadCallback;
     const createReadStream = runtime.createReadStream ?? fs.createReadStream;
     const orderedFiles = [...options.files].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-    const batches = chunkUploadFiles(orderedFiles, sdkVersionPolicy.MINIAPP_UPLOAD_BATCH_SIZE);
+    const batches = chunkUploadFiles(orderedFiles, context.MINIAPP_UPLOAD_BATCH_SIZE);
     await logger.task(`正在上传 ${orderedFiles.length} 个文件`, async (taskContext) => {
         logger.debug(`上传并发数: ${concurrency}`);
         logger.debug(`上传批次数: ${batches.length}`);
@@ -152,7 +152,7 @@ async function runUpload(options, runtime = {}) {
             logger.debug(`正在处理上传批次 ${batchIndex + 1}/${batches.length}，文件数: ${batch.length}`);
             logger.debug('正在获取 CDN 上传信息');
             const fileInfos = createUploadFileInfos(batch, options);
-            const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: sdkVersionPolicy.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
+            const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: context.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
             logger.debug(`CDN bucket: ${uploadInfo.bucket}`);
             logger.debug(`CDN region: ${uploadInfo.region}`);
             validateUploadInfoKeys(batch, uploadInfo.keys, options);
@@ -213,7 +213,7 @@ function createUploadFileInfos(files, options) {
         name: file.relativePath.split('/').pop() ?? file.relativePath,
         mimetype: file.mimeType,
         fsize: file.size,
-        path: sdkVersionPolicy.getMiniappUploadKey({
+        path: context.getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
             relativePath: file.relativePath,
@@ -225,7 +225,7 @@ function validateUploadInfoKeys(files, keys, options) {
         throw new index.CliError(`CDN 上传接口返回 key 数量异常：期望 ${files.length}，实际 ${keys.length}`);
     }
     for (let index$1 = 0; index$1 < files.length; index$1 += 1) {
-        const expectedKey = sdkVersionPolicy.getMiniappUploadKey({
+        const expectedKey = context.getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
             relativePath: files[index$1].relativePath,
@@ -264,7 +264,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-NOO3q8_C.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-DcZLSI_y.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -308,7 +308,7 @@ function isRecord(value) {
 }
 async function precheckUserMiniprogramVersion(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(sdkVersionPolicy.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
+    return postUserMiniprogramVersionForm(context.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
         name: options.name,
         icon_url: options.iconUrl,
         cover_image_urls: options.coverImageUrls.join(','),
@@ -319,7 +319,7 @@ async function precheckUserMiniprogramVersion(options, runtime = {}) {
     }, runtime);
 }
 async function submitUserMiniprogramAudit(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(sdkVersionPolicy.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
+    return postUserMiniprogramVersionForm(context.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
         name: options.name,
         icon_url: options.iconUrl,
         cover_image_urls: options.coverImageUrls.join(','),
@@ -8691,12 +8691,6 @@ async function runDeployCommand(options, runtime = {}) {
         if (!sourceSdkVersion) {
             throw new Error('历史产物缺少 sdkVersion，无法复用，请重新构建并上传新版本');
         }
-        await (runtime.enforceRemoteSdkVersion ?? sdkVersionPolicy.enforceRemoteSdkVersion)({
-            sdkVersion: sourceSdkVersion,
-            environment: apiBaseUrl,
-            fetchImpl: runtime.fetchImpl,
-            allowPrerelease: false,
-        });
         precheckVersion = precheck.version || precheck.version_normalized || fromVersion;
     }
     else {
@@ -8716,6 +8710,7 @@ async function runDeployCommand(options, runtime = {}) {
         const buildMode = env.HB_SDK_ENV?.trim();
         logger.info(`开始构建: ${pm} ${createBuildArgs(pm, buildMode).join(' ')}`);
         await runBuildScript(pm, projectRoot, runtime.spawn ?? childProcess.spawn, {
+            env,
             mode: buildMode,
             outputMode: options.buildOutputMode ?? 'inherit',
             stderr: runtime.stderr,
@@ -8729,27 +8724,21 @@ async function runDeployCommand(options, runtime = {}) {
         const distDir = path.join(projectRoot, 'dist');
         parsedManifest ??= await readDeployManifest(projectRoot, logger);
         ({ manifest, version } = parsedManifest);
-        await (runtime.enforceRemoteSdkVersion ?? sdkVersionPolicy.enforceRemoteSdkVersion)({
-            sdkVersion: parsedManifest.sdkVersion,
-            environment: apiBaseUrl,
-            fetchImpl: runtime.fetchImpl,
-            allowPrerelease: false,
-        });
         if (version !== precheckVersion) {
             throw new Error(`dist/manifest.json.version (${version}) 与预检版本 (${precheckVersion}) 不一致，请重新 build 后再 deploy`);
         }
         const uploadFiles = await logger.task('正在校验 dist 上传文件', async () => {
             const allFiles = await walkDistFiles(distDir);
-            const blocked = allFiles.find((entry) => sdkVersionPolicy.relativePathContainsNodeModulesSegment(entry.relativePath));
+            const blocked = allFiles.find((entry) => context.relativePathContainsNodeModulesSegment(entry.relativePath));
             if (blocked) {
                 throw new Error(`dist 目录含 node_modules：${blocked.relativePath}`);
             }
-            const files = allFiles.filter((entry) => sdkVersionPolicy.shouldUploadDistFile(entry.relativePath));
-            const pathError = sdkVersionPolicy.validateUploadPaths(files, { miniProgramId, version, maxLength: sdkVersionPolicy.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
+            const files = allFiles.filter((entry) => context.shouldUploadDistFile(entry.relativePath));
+            const pathError = context.validateUploadPaths(files, { miniProgramId, version, maxLength: context.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
             if (pathError) {
                 throw new Error(pathError);
             }
-            const sizeError = sdkVersionPolicy.validateUploadTotalSize(files);
+            const sizeError = context.validateUploadTotalSize(files);
             if (sizeError) {
                 throw new Error(sizeError);
             }
@@ -8950,6 +8939,7 @@ async function runBuildScript(pm, cwd, spawnImpl, options) {
         const buildArgs = createBuildArgs(pm, options.mode);
         const child = spawnImpl(pm, buildArgs, {
             cwd,
+            env: { ...process.env, ...options.env, HB_SDK_DEPLOY_BUILD: '1' },
             stdio: pipeStdoutToStderr ? ['inherit', 'pipe', 'inherit'] : 'inherit',
         });
         if (pipeStdoutToStderr) {
@@ -8993,7 +8983,7 @@ async function walkDistFiles(distDir) {
             }
             const fileStat = await fs$1.stat(absPath);
             results.push({
-                relativePath: sdkVersionPolicy.normalizeRelativePath(relPath),
+                relativePath: context.normalizeRelativePath(relPath),
                 absolutePath: absPath,
                 size: fileStat.size,
                 mimeType: inferMimeType(entry.name),
@@ -9152,7 +9142,7 @@ async function runRemoteDeployCommand(options, runtime) {
 async function createRemoteCommandContext(options, runtime) {
     index.applyServiceTagIfNeeded(options.serviceTag);
     const logger = resolveRemoteLogger(options, runtime);
-    const environment = await sdkVersionPolicy.resolveRemoteEnvironment({
+    const environment = await context.resolveRemoteEnvironment({
         allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl,
         apiBaseUrl: options.apiBaseUrl,
         env: options.env,
@@ -9162,10 +9152,10 @@ async function createRemoteCommandContext(options, runtime) {
         fetchImpl: runtime.fetchImpl,
         requireAuthSession: runtime.requireAuthSession,
     });
-    const packageJson = await sdkVersionPolicy.readMiniProgramProjectPackage(runtime.cwd ?? process.cwd());
-    const binding = sdkVersionPolicy.readBoundMiniProgramIdFromPackageJson(packageJson.packageJson);
+    const packageJson = await context.readMiniProgramProjectPackage(runtime.cwd ?? process.cwd());
+    const binding = context.readBoundMiniProgramIdFromPackageJson(packageJson.packageJson);
     const api = {
-        ...adaptRemoteApiClient(sdkVersionPolicy.createRemoteApiClientForEnvironment(environment)),
+        ...adaptRemoteApiClient(context.createRemoteApiClientForEnvironment(environment)),
         ...runtime.api,
     };
     logger.debug(`Heybox API: ${environment.apiBaseUrl}`);
@@ -9306,39 +9296,39 @@ async function remoteList(options, context, runtime) {
     }
     return finishRemoteCommand(options, runtime, output);
 }
-async function remoteCreate(options, context, runtime) {
-    if (context.binding && !options.forceBind) {
-        throw new Error(`当前项目已绑定 ${context.binding}；如需覆盖，请使用 --force-bind`);
+async function remoteCreate(options, context$1, runtime) {
+    if (context$1.binding && !options.forceBind) {
+        throw new Error(`当前项目已绑定 ${context$1.binding}；如需覆盖，请使用 --force-bind`);
     }
-    const access = await context.api.accessStatus();
+    const access = await context$1.api.accessStatus();
     if (access.status !== 'approved') {
         throw new Error(`当前 CLI 用户没有创建工坊小程序权限：${String(access.status ?? 'unknown')}`);
     }
-    await confirmCreateWithCurrentEntity(options, context, runtime);
-    const result = await context.api.createMiniProgram();
+    await confirmCreateWithCurrentEntity(options, context$1, runtime);
+    const result = await context$1.api.createMiniProgram();
     const miniProgramId = requireMiniProgramId(result);
-    await sdkVersionPolicy.writeBoundMiniProgramId(context.packageJson.projectRoot, miniProgramId, { force: options.forceBind });
+    await context.writeBoundMiniProgramId(context$1.packageJson.projectRoot, miniProgramId, { force: options.forceBind });
     const output = { changed: true, miniProgramId, remote: toCamelCaseDeep(result) };
     if (!options.json) {
-        context.logger.success(`创建并绑定成功：${miniProgramId}`);
+        context$1.logger.success(`创建并绑定成功：${miniProgramId}`);
     }
     return finishRemoteCommand(options, runtime, output);
 }
-async function remoteBind(options, context, runtime) {
+async function remoteBind(options, context$1, runtime) {
     const miniProgramId = requireNonEmpty(options.miniProgramId, 'remote bind 必须传 <mini-program-id>');
-    if (context.binding && context.binding !== miniProgramId && !options.force) {
-        throw new Error(`当前项目已绑定 ${context.binding}；如需覆盖本地绑定，请使用 --force`);
+    if (context$1.binding && context$1.binding !== miniProgramId && !options.force) {
+        throw new Error(`当前项目已绑定 ${context$1.binding}；如需覆盖本地绑定，请使用 --force`);
     }
-    const detail = await context.api.getMiniProgramDetail(miniProgramId);
+    const detail = await context$1.api.getMiniProgramDetail(miniProgramId);
     const verifiedId = requireMiniProgramId(detail);
-    await assertMiniProgramEntityMatchesCurrent(context, detail);
-    const changed = context.binding !== verifiedId;
+    await assertMiniProgramEntityMatchesCurrent(context$1, detail);
+    const changed = context$1.binding !== verifiedId;
     if (changed) {
-        await sdkVersionPolicy.writeBoundMiniProgramId(context.packageJson.projectRoot, verifiedId, { force: options.force });
+        await context.writeBoundMiniProgramId(context$1.packageJson.projectRoot, verifiedId, { force: options.force });
     }
     const output = { changed, miniProgramId: verifiedId, remote: toCamelCaseDeep(detail) };
     if (!options.json) {
-        context.logger.success(changed ? `绑定成功：${verifiedId}` : `已绑定：${verifiedId}`);
+        context$1.logger.success(changed ? `绑定成功：${verifiedId}` : `已绑定：${verifiedId}`);
     }
     return finishRemoteCommand(options, runtime, output);
 }

package/dist/cli-chunks/{session-DIcRjyDY.cjs → session-0XuUaVOO.cjs} RENAMED Viewed

@@ -1,6 +1,6 @@
 'use strict';
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-BnCDW-BB.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs CHANGED Viewed

@@ -1,6 +1,6 @@
 'use strict';
-var index = require('./cli-chunks/index-CCeHouBU.cjs');
+var index = require('./cli-chunks/index-BnCDW-BB.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/index.cjs.js CHANGED Viewed

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.1';
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js CHANGED Viewed

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.1';
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/vite.cjs.js CHANGED Viewed

@@ -10,7 +10,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.1';
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
@@ -11933,7 +11933,7 @@ function miniappManifest(options = {}) {
             hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         async buildStart() {
-            if (command !== 'build')
+            if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1')
                 return;
             try {
                 await (options.enforceSdkVersion ?? enforceViteSdkVersion)({
@@ -11966,10 +11966,10 @@ function miniappManifest(options = {}) {
             const sdkVersion = resolveSdkVersion();
             const outputRoot = path.resolve(root, outDir);
             const htmlFiles = collectHtmlFiles(outputRoot);
-            const unexpectedHtmlFiles = htmlFiles.filter(file => path.relative(outputRoot, file) !== 'index.html');
+            const unexpectedHtmlFiles = htmlFiles.filter((file) => path.relative(outputRoot, file) !== 'index.html');
             if (unexpectedHtmlFiles.length > 0) {
                 throw new Error(`工坊小程序只支持单页应用，构建产物不允许额外 HTML：${unexpectedHtmlFiles
-                    .map(file => path.relative(outputRoot, file).split(path.sep).join('/'))
+                    .map((file) => path.relative(outputRoot, file).split(path.sep).join('/'))
                     .join(', ')}`);
             }
             const indexHtmlPath = path.join(outputRoot, 'index.html');

package/dist/vite.esm.js CHANGED Viewed

@@ -7,7 +7,7 @@ import { readFile, mkdir, writeFile, rename } from 'node:fs/promises';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.1';
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
@@ -11930,7 +11930,7 @@ function miniappManifest(options = {}) {
             hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         async buildStart() {
-            if (command !== 'build')
+            if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1')
                 return;
             try {
                 await (options.enforceSdkVersion ?? enforceViteSdkVersion)({
@@ -11963,10 +11963,10 @@ function miniappManifest(options = {}) {
             const sdkVersion = resolveSdkVersion();
             const outputRoot = path.resolve(root, outDir);
             const htmlFiles = collectHtmlFiles(outputRoot);
-            const unexpectedHtmlFiles = htmlFiles.filter(file => path.relative(outputRoot, file) !== 'index.html');
+            const unexpectedHtmlFiles = htmlFiles.filter((file) => path.relative(outputRoot, file) !== 'index.html');
             if (unexpectedHtmlFiles.length > 0) {
                 throw new Error(`工坊小程序只支持单页应用，构建产物不允许额外 HTML：${unexpectedHtmlFiles
-                    .map(file => path.relative(outputRoot, file).split(path.sep).join('/'))
+                    .map((file) => path.relative(outputRoot, file).split(path.sep).join('/'))
                     .join(', ')}`);
             }
             const indexHtmlPath = path.join(outputRoot, 'index.html');

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -92,7 +92,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.0"
+    "@heybox/hb-api": "~1.25.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/SKILL.md CHANGED Viewed

@@ -54,12 +54,12 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 4. Use `hb-sdk remote entity list`, `hb-sdk remote entity current`, and `hb-sdk remote entity switch <entity-id>` to inspect or change the developer platform server-side current entity before remote management commands.
 5. Use `hb-sdk remote create` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified. Mini-program name, icon, and cover images belong in `package.json.heybox.miniProgramProfile` and are submitted with version audit.
 6. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for read/basic/preview management workflows. Mini-program name and image changes must go through version audit, so the CLI must not expose a basic-info update command.
-7. Use `hb-sdk remote deploy --release-note <text>` to build, upload, and submit the current project for audit. It reads `package.json.heybox.miniProgramId`, validates that the bound mini-program belongs to the server-side current entity before precheck/build/upload, prechecks `package.json.version` before build, runs the project's `build` script via the package manager auto-detected by lockfile, uploads `dist/` to CDN (skipping `manifest.json`, `.DS_Store`, `.map`), then calls the submit-audit API. When `--env <name>` or `HB_SDK_ENV=<name>` selects an environment preset, deploy also passes the same name to the project build as its Vite mode. The deploy upload pipeline rejects actual upload artifacts over 100MiB before any upload request, processes CDN upload metadata and callback confirmation at 50 files per batch, keeps 4-way upload concurrency within each batch, and validates CDN-returned keys exactly against the local expected upload keys.
+7. Use `hb-sdk remote deploy --release-note <text>` to build, upload, and submit the current project for audit. It reads `package.json.heybox.miniProgramId`, validates that the bound mini-program belongs to the server-side current entity before precheck/build/upload, prechecks `package.json.version` before build, runs the project's `build` script via the package manager auto-detected by lockfile, uploads `dist/` to CDN (skipping `manifest.json`, `.DS_Store`, `.map`), then calls the submit-audit API. Deploy and `--from-version` do not fetch or compare the client-side `minimumSdkVersion`; Manifest validation and server-side precheck / submit-audit policy still apply. When `--env <name>` or `HB_SDK_ENV=<name>` selects an environment preset, deploy also passes the same name to the project build as its Vite mode. The deploy upload pipeline rejects actual upload artifacts over 100MiB before any upload request, processes CDN upload metadata and callback confirmation at 50 files per batch, keeps 4-way upload concurrency within each batch, and validates CDN-returned keys exactly against the local expected upload keys.
 8. Use `hb-sdk remote deploy --from-version <version> --release-note <text>` to reuse a previously uploaded remote version artifact and submit a new audit version without reading local `dist`, building, or uploading.
 9. Always provide a concise release note before deploy. Non-interactive environments must pass `--release-note`; interactive terminals may prompt for it. The default is manual release after approval with `hb-sdk remote release <version>`; use `--auto-publish` when the audited version should automatically release after approval.
 10. Use `hb-sdk remote release <version>`, `hb-sdk remote withdraw <version>`, `hb-sdk remote take-down`, and `hb-sdk remote reopen` for dangerous remote changes. Interactive terminals should confirm after showing enough context; non-interactive environments must pass `--yes`.
 11. For internal test/staging backend operations, use origin-only custom URLs: `HB_SDK_API_BASE_URL` or `hb-sdk remote ... --api-base-url <url>` for remote platform APIs, and `HB_SDK_LOGIN_BASE_URL` or `hb-sdk login --login-base-url <url>` for browser login. CLI flags override env vars. API base URLs must be Heybox trusted HTTPS origins by default; use `--allow-unsafe-api-base-url` or `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` only for local backend debugging. Do not include path, query, or hash in these URLs.
-12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests and the Vite minimum-SDK-version gate. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
+12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests and the Vite minimum-SDK-version gate used by manual builds. Deploy builds skip that client-side version gate. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
 13. If a remote command targets a custom login environment, pass the same `--login-base-url` or `HB_SDK_LOGIN_BASE_URL` used for `hb-sdk login`; remote commands reject cached CLI login state from a different login origin.
 14. Add `--verbose` / `-v` only when diagnosing failures; default CLI errors are intentionally concise, while verbose output includes backend envelope, HTTP status, trace fields, raw body, or original submit-audit failure details.
 15. Use `--json` for script consumption of `hb-sdk remote` commands. With `--json`, stdout must contain exactly one JSON object; progress, warnings, update reminders, and verbose diagnostics must not pollute stdout.

package/skill/references/api-root.md CHANGED Viewed

@@ -19,7 +19,7 @@
 ## Package metadata
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.0`
+- Version at generation time: `0.6.1`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -200,10 +200,7 @@ Use `@heybox/hb-sdk/vite` only in `vite.config.ts`. Do not import it from iframe
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { HB_SDK_VERSION } from '../core/version';
-import {
-  renderMiniappManifest,
-  validateMiniappPackageVersionForBuild,
-} from '../miniapp-manifest/schema';
+import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
 import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
@@ -243,12 +240,14 @@ interface MiniappManifestResolvedConfig {
   server: {
     host?: string | boolean;
     port?: number;
-    hmr?: boolean | {
-      clientPort?: number;
-      host?: string;
-      port?: number;
-      protocol?: 'ws' | 'wss';
-    };
+    hmr?:
+      | boolean
+      | {
+          clientPort?: number;
+          host?: string;
+          port?: number;
+          protocol?: 'ws' | 'wss';
+        };
   };
 }
@@ -281,7 +280,7 @@ export function miniappManifest(options: MiniappManifestOptions = {}): MiniappMa
       hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
     },
     async buildStart() {
-      if (command !== 'build') return;
+      if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1') return;
       try {
         await (options.enforceSdkVersion ?? defaultEnforceRemoteSdkVersion)({
           sdkVersion: resolveSdkVersion(),
@@ -313,11 +312,11 @@ export function miniappManifest(options: MiniappManifestOptions = {}): MiniappMa
       const sdkVersion = resolveSdkVersion();
       const outputRoot = path.resolve(root, outDir);
       const htmlFiles = collectHtmlFiles(outputRoot);
-      const unexpectedHtmlFiles = htmlFiles.filter(file => path.relative(outputRoot, file) !== 'index.html');
+      const unexpectedHtmlFiles = htmlFiles.filter((file) => path.relative(outputRoot, file) !== 'index.html');
       if (unexpectedHtmlFiles.length > 0) {
         throw new Error(
           `工坊小程序只支持单页应用，构建产物不允许额外 HTML：${unexpectedHtmlFiles
-            .map(file => path.relative(outputRoot, file).split(path.sep).join('/'))
+            .map((file) => path.relative(outputRoot, file).split(path.sep).join('/'))
             .join(', ')}`,
         );
       }
@@ -383,7 +382,7 @@ function resolveHmrWebSocketUrl(resolved: MiniappManifestResolvedConfig) {
 ```json
 {
   "version": "1.2.3",
-  "sdkVersion": "0.6.0"
+  "sdkVersion": "0.6.1"
 }
 ```
@@ -405,7 +404,7 @@ export default defineConfig({
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、build 和 deploy 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 失败与警告语义：

package/skill/references/cli.md CHANGED Viewed

@@ -165,9 +165,11 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 `manifest.json` 仅作为提交审核接口的 `manifest` 字段提交，不会上传到 CDN。Vite 项目通过 `miniappManifest()` 插件生成；CLI 不会自动注入插件，请在 `vite.config.ts` 中显式挂载。小程序构建产物需要使用相对资源路径；`hb-sdk create` 模板会显式配置 `base: './'`，未配置 `base` 的项目也会由 `miniappManifest()` 在 build 时默认补成 `./`。构建产物只能在兼容的小黑盒 Runtime 中启动，普通浏览器直接打开时不会执行标准业务脚本。
+`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。开发者手动执行 Vite build 时仍会运行最低 SDK 版本门禁。
 默认发布策略是 `auto_publish=false`：运营审核通过后使用 `hb-sdk remote versions` 查看版本状态，再用 `hb-sdk remote release <version>` 发布。需要审核通过后自动发布并下架旧线上版本时，使用 `--auto-publish`。如需让指定用户预览未发布候选版本，使用 `hb-sdk remote allowlist add <heybox_id>` 管理预览白名单。
-内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`；deploy 子构建会继承 `.env.<name>` 中的 `HB_SDK_SERVICE_TAG`，Vite 最低 SDK 版本门禁请求也会同时携带该 header 和 query。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
+内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`；手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query，deploy 子构建不执行该门禁。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
 `hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。

package/skill/skill.json CHANGED Viewed

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.0+skill.451f74e19672",
+  "skillVersion": "0.6.1+skill.31b72826f59b",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.0",
-    "compatibility": "0.6.0"
+    "version": "0.6.1",
+    "compatibility": "0.6.1"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-451f74e19672cca0953ebb9d47d6f2632c9341ba2c4f9bcf4a861d5344285673"
+  "integrity": "sha256-31b72826f59beadd927f3f2cafcba36bbf9e035915a7734d0b990767fc34d926"
 }