@heybox/hb-sdk 0.6.0 → 0.6.2

package/README.md

@@ -421,7 +421,7 @@ try {
 2. 已运行过 `hb-sdk login` 登录 Heybox；多主体用户应确认 `hb-sdk remote entity current` 指向要发布的主体。
 3. 当前项目绑定的小程序必须属于服务端 current entity；如不一致，先运行 `hb-sdk remote entity switch <entity-id>` 切换主体。
 4. 如果需要以公司的名义发布小程序，需先找 @秦浩东 申请小程序开发权限。
-5. 每次部署都要在 `package.json` 里配置 `heybox.miniProgramProfile.name`、`iconUrl` 和至少一张 `coverImageUrls`，这些资料会随版本提交审核。
+5. 小程序名称、icon 和介绍图在开放平台版本发布中维护；CLI 项目配置只保留 `heybox.miniProgramId`。首次部署且无历史审核通过资料时，服务端使用默认名与默认图。
 6. 每次部署都要准备发布日志：`hb-sdk remote deploy --release-note "..."`。发布日志 trim 后不能为空，最多 500 个字符，允许换行；CI / 非 TTY 环境缺失时会直接失败，TTY 环境会提示输入。
 7. 项目根有 `scripts.build`，会被 CLI 通过 lockfile 自动选用的 `pnpm`、`yarn` 或 `npm` 触发；无 lockfile 时回退 `npm`。
 8. 构建产物落在 `dist/`，包含 `index.html` 和 `manifest.json`。
@@ -444,20 +444,7 @@ try {
 
 `--from-version <version>` 用于复用已经上传过的远端历史版本产物提交新一轮审核。该模式不读取本地 `dist/`，也不会执行 build 或上传；目标审核版本由服务端根据版本表最高 SemVer 自动派生。
 
-`manifest.json` 不会上传到 CDN，只作为 submit audit 请求的 `manifest` 字段提交。`sdkVersion` 由 SDK 构建自动生成，业务配置不能覆盖；复用历史 Version Artifact 时继续使用源 Artifact 的 `sdkVersion`。名称、icon 和介绍图从 `package.json.heybox.miniProgramProfile` 读取，并随 precheck 和 submit audit 一起提交：
-
-```json
-{
-  "heybox": {
-    "miniProgramId": "mp_xxxxxxxx",
-    "miniProgramProfile": {
-      "name": "我的小程序",
-      "iconUrl": "https://img.example.test/icon.png",
-      "coverImageUrls": ["https://img.example.test/cover.png"]
-    }
-  }
-}
-```
+`manifest.json` 不会上传到 CDN，只作为 submit audit 请求的 `manifest` 字段提交。`sdkVersion` 由 SDK 构建自动生成，业务配置不能覆盖；复用历史 Version Artifact 时继续使用源 Artifact 的 `sdkVersion`。CLI 的 precheck / submit audit **不传** name / icon / cover：服务端沿用最近一次审核通过的展示资料，没有则注入默认名「我的小程序」与平台默认图。正式名称与图片请在开放平台版本发布中修改；仍使用默认资料时可以 release，但无法 `square show` 对普通用户公开展示。
 
 内部测试或预发环境可通过 origin 级别的自定义地址切换后台环境：
 
@@ -490,7 +477,7 @@ hb-sdk remote deploy --env test --service-tag other-tag --release-note "灰度"
 
 `--env <name>` 会读取项目根下的 `.env.<name>`，`--env-file <path>` 显式指定路径且优先级高于 `--env`；两者也可通过 `HB_SDK_ENV=<name>` 触发。加载遵循 dotenv 惯例：不覆盖进程已有的同名变量，因此 CI 或命令行显式设置的值优先。使用 `--env <name>` 或 `HB_SDK_ENV=<name>` 执行 `remote deploy` 时，CLI 还会把同一个 `name` 作为 `--mode <name>` 传给项目 build，使 CLI 后端环境与 Vite mode 保持一致。文件仅支持 `KEY=VALUE`、空行和 `#` 注释，不做变量插值；文件不存在时静默跳过。`--verbose` 会打印生效的文件路径和被跳过的 key。
 
-`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。`--service-tag <tag>` 优先于 `HB_SDK_SERVICE_TAG`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。deploy 子构建会继承 `.env.<name>` 中的 `HB_SDK_SERVICE_TAG`，Vite 最低 SDK 版本门禁请求也会同时携带该 header 和 query；仓库内开发也可继续在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 path-prefix 级 `special_tag`。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
+`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。`--service-tag <tag>` 优先于 `HB_SDK_SERVICE_TAG`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query；`remote deploy` 的子构建不执行客户端最低版本门禁。仓库内开发也可继续在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 path-prefix 级 `special_tag`。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 
 ## hb-sdk remote 命令参考
 
@@ -548,7 +535,7 @@ CLI 登录态只供 CLI 命令访问黑盒接口时复用，不会注入 iframe
 ```json
 {
   "version": "1.2.3",
-  "sdkVersion": "0.6.0"
+  "sdkVersion": "0.6.1"
 }
 ```
 
@@ -570,7 +557,7 @@ export default defineConfig({
 
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
 
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、build 和 deploy 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 
 失败与警告语义：
 

package/dist/cli-chunks/{sdk-version-policy-B1CFC1Dk.cjs → context-DmxbC_iV.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var session = require('./session-DIcRjyDY.cjs');
+var session = require('./session-D7mPwyx4.cjs');
+var index = require('./index-CTyguEza.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var index = require('./index-CCeHouBU.cjs');
 
 const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
 function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
@@ -3214,91 +3214,6 @@ function isTruthyEnvFlag(value) {
         .toLowerCase());
 }
 
-const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
-async function resolveMinimumSdkVersion(options) {
-    const now = options.now ?? Date.now();
-    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
-    const cache = await readCache(cachePath);
-    let minimumSdkVersion;
-    try {
-        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
-    }
-    catch {
-        const cached = cache.environments[options.environment];
-        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
-        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
-            try {
-                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
-            }
-            catch {
-                // 非法缓存按不存在处理。
-            }
-        }
-        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
-    }
-    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
-    try {
-        await writeCache(cachePath, cache);
-    }
-    catch {
-        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
-    }
-    return minimumSdkVersion;
-}
-function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
-    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
-    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
-    if (!options.allowPrerelease && semverExports.prerelease(current) !== null) {
-        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
-    }
-    if (!semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
-        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
-    }
-    return current;
-}
-function validateSdkVersion(value, label) {
-    const normalized = String(value).trim();
-    const parsed = semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function validateStableSdkVersion(value, label) {
-    const normalized = validateSdkVersion(value, label);
-    if (semverExports.prerelease(normalized) !== null)
-        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
-    return normalized;
-}
-async function readCache(cachePath) {
-    try {
-        const parsed = JSON.parse(await fs.readFile(cachePath, 'utf8'));
-        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
-            return parsed;
-    }
-    catch {
-        // 缓存缺失或损坏时继续请求最新配置。
-    }
-    return { environments: {} };
-}
-async function writeCache(cachePath, cache) {
-    await fs.mkdir(path.dirname(cachePath), { recursive: true });
-    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
-    await fs.writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
-    await fs.rename(temporaryPath, cachePath);
-}
-
-const paths = index.envPaths('hb-sdk');
-async function enforceRemoteSdkVersion(options) {
-    const minimumSdkVersion = await resolveMinimumSdkVersion({
-        cacheDir: options.cacheDir ?? paths.cache,
-        environment: options.environment,
-        fetchMinimumSdkVersion: async () => (await getPublicSdkConfig({ baseUrl: options.environment, fetchImpl: options.fetchImpl })).minimum_sdk_version,
-    });
-    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
-}
-
 exports.ACTIVITY_UPLOAD_KEY_MAX_LENGTH = ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
 exports.MINIAPP_UPLOAD_BATCH_SIZE = MINIAPP_UPLOAD_BATCH_SIZE;
 exports.MINIAPP_UPLOAD_SCOPE = MINIAPP_UPLOAD_SCOPE;
@@ -3306,9 +3221,9 @@ exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
 exports.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH = PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
-exports.enforceRemoteSdkVersion = enforceRemoteSdkVersion;
 exports.getBoundMiniProgram = getBoundMiniProgram;
 exports.getMiniappUploadKey = getMiniappUploadKey;
+exports.getPublicSdkConfig = getPublicSdkConfig;
 exports.normalizeRelativePath = normalizeRelativePath;
 exports.readBoundMiniProgramId = readBoundMiniProgramId;
 exports.readBoundMiniProgramIdFromPackageJson = readBoundMiniProgramIdFromPackageJson;

package/dist/cli-chunks/{create-DYb53EQ-.cjs → create-CXBnqr5r.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-CTyguEza.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CPKTuA6q.cjs → dev-OCij_ecL.cjs}

@@ -9,9 +9,9 @@ var node_url = require('node:url');
 var net = require('node:net');
 var node_http = require('node:http');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CCeHouBU.cjs');
-var sdkVersionPolicy = require('./sdk-version-policy-B1CFC1Dk.cjs');
-var session = require('./session-DIcRjyDY.cjs');
+var index = require('./index-CTyguEza.cjs');
+var context = require('./context-DmxbC_iV.cjs');
+var session = require('./session-D7mPwyx4.cjs');
 require('node:process');
 require('node:buffer');
 require('node:util');
@@ -666,10 +666,95 @@ function createHeyboxProtocol(payload) {
     return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
 }
 
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
+const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
+async function resolveMinimumSdkVersion(options) {
+    const now = options.now ?? Date.now();
+    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
+    const cache = await readCache(cachePath);
+    let minimumSdkVersion;
+    try {
+        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
+    }
+    catch {
+        const cached = cache.environments[options.environment];
+        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
+        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
+            try {
+                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
+            }
+            catch {
+                // 非法缓存按不存在处理。
+            }
+        }
+        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
+    }
+    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
+    try {
+        await writeCache(cachePath, cache);
+    }
+    catch {
+        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
+    }
+    return minimumSdkVersion;
+}
+function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
+    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
+    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
+    if (!options.allowPrerelease && context.semverExports.prerelease(current) !== null) {
+        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
+    }
+    if (!context.semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
+        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
+    }
+    return current;
+}
+function validateSdkVersion(value, label) {
+    const normalized = String(value).trim();
+    const parsed = context.semverExports.parse(normalized);
+    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
+        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
+    }
+    return normalized;
+}
+function validateStableSdkVersion(value, label) {
+    const normalized = validateSdkVersion(value, label);
+    if (context.semverExports.prerelease(normalized) !== null)
+        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
+    return normalized;
+}
+async function readCache(cachePath) {
+    try {
+        const parsed = JSON.parse(await fs$1.readFile(cachePath, 'utf8'));
+        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
+            return parsed;
+    }
+    catch {
+        // 缓存缺失或损坏时继续请求最新配置。
+    }
+    return { environments: {} };
+}
+async function writeCache(cachePath, cache) {
+    await fs$1.mkdir(path.dirname(cachePath), { recursive: true });
+    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
+    await fs$1.writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
+    await fs$1.rename(temporaryPath, cachePath);
+}
+
+const paths = index.envPaths('hb-sdk');
+async function enforceRemoteSdkVersion(options) {
+    const minimumSdkVersion = await resolveMinimumSdkVersion({
+        cacheDir: options.cacheDir ?? paths.cache,
+        environment: options.environment,
+        fetchMinimumSdkVersion: async () => (await context.getPublicSdkConfig({ baseUrl: options.environment, fetchImpl: options.fetchImpl })).minimum_sdk_version,
+    });
+    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
+}
+
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.2';
 
 const DEFAULT_APP_PORT = 5173;
 const DEFAULT_MOCK_PORT = 5174;
@@ -682,7 +767,7 @@ async function runDevCommand(options, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
     const fetchImpl = runtime.fetchImpl ?? fetch;
     const environment = session.resolveHeyboxApiBaseUrl({ env: runtime.env });
-    await (runtime.enforceRemoteSdkVersion ?? sdkVersionPolicy.enforceRemoteSdkVersion)({
+    await (runtime.enforceRemoteSdkVersion ?? enforceRemoteSdkVersion)({
         sdkVersion: HB_SDK_VERSION,
         environment,
         fetchImpl,
@@ -771,14 +856,14 @@ async function runDevCommand(options, runtime = {}) {
     installShutdownHandlers(closers, runtime.process ?? process);
 }
 async function loadDevLaunchContext(options) {
-    const miniProgramId = await sdkVersionPolicy.readBoundMiniProgramId(options.projectRoot);
+    const miniProgramId = await context.readBoundMiniProgramId(options.projectRoot);
     if (!miniProgramId) {
         const nativeAppLaunchUnavailableReason = '当前项目未绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。';
         options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${nativeAppLaunchUnavailableReason}`);
         return { nativeAppLaunchUnavailableReason };
     }
     try {
-        const { detail, miniProgramId: verifiedMiniProgramId } = await options.logger.task('正在读取远端小程序权限', () => sdkVersionPolicy.getBoundMiniProgram({
+        const { detail, miniProgramId: verifiedMiniProgramId } = await options.logger.task('正在读取远端小程序权限', () => context.getBoundMiniProgram({
             cwd: options.projectRoot,
             env: options.env,
             fetchImpl: options.fetchImpl,
@@ -796,7 +881,7 @@ async function loadDevLaunchContext(options) {
     }
 }
 function canFallbackToDefaultRuntimePermissions(error) {
-    if (error instanceof sdkVersionPolicy.MiniProgramProjectBindingError) {
+    if (error instanceof context.MiniProgramProjectBindingError) {
         return error.code === 'MINI_PROGRAM_UNBOUND';
     }
     if (error instanceof TypeError && error.message === 'fetch failed') {

package/dist/cli-chunks/{doctor-TshFvqHC.cjs → doctor-DQIzL_3_.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-CTyguEza.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-CCeHouBU.cjs → index-CTyguEza.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CCeHouBU.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13323,7 +13323,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.6.0';
+const BUILT_CLI_VERSION = '0.6.2';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13644,31 +13644,31 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-DtXHSm8R.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BWN2-2Gk.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-DtXHSm8R.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BWN2-2Gk.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-DtXHSm8R.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BWN2-2Gk.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DYb53EQ-.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CXBnqr5r.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CPKTuA6q.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-OCij_ecL.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-TshFvqHC.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DQIzL_3_.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BWfn7qIN.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DxKtJ21x.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-NOO3q8_C.cjs → index-Ulhxo0YK.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-CCeHouBU.cjs');
+var index$2 = require('./index-CTyguEza.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$3 = require('assert');
 var require$$4$2 = require('events');
 var require$$1$1 = require('util');
-var sdkVersionPolicy = require('./sdk-version-policy-B1CFC1Dk.cjs');
+var context$1 = require('./context-DmxbC_iV.cjs');
 var require$$0$5 = require('net');
 var require$$0$4 = require('url');
 var require$$2$2 = require('http');
@@ -13707,7 +13707,7 @@ function requireSource () {
 		const ajv_1 = requireAjv$1();
 		const ajv_formats_1 = requireDist();
 		const debounceFn = requireDebounceFn();
-		const semver = sdkVersionPolicy.requireSemver();
+		const semver = context$1.requireSemver();
 		const onetime = index$2.requireOnetime();
 		const encryptionAlgorithm = 'aes-256-cbc';
 		const createPlainObject = () => {

package/dist/cli-chunks/{login-DtXHSm8R.cjs → login-BWN2-2Gk.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DIcRjyDY.cjs');
+var session = require('./session-D7mPwyx4.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-CTyguEza.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{remote-BWfn7qIN.cjs → remote-DxKtJ21x.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-CCeHouBU.cjs');
-var session = require('./session-DIcRjyDY.cjs');
+var index = require('./index-CTyguEza.cjs');
+var session = require('./session-D7mPwyx4.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var sdkVersionPolicy = require('./sdk-version-policy-B1CFC1Dk.cjs');
+var context = require('./context-DmxbC_iV.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -61,7 +61,7 @@ function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
         throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
     }
     const normalized = version.trim();
-    const parsed = sdkVersionPolicy.semverExports.parse(normalized);
+    const parsed = context.semverExports.parse(normalized);
     if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
         throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
     }
@@ -75,7 +75,7 @@ function getMiniappManifestVersionError(version) {
         return `必须是合法 SemVer：${String(version)}`;
     }
     const normalized = version.trim();
-    const parsed = sdkVersionPolicy.semverExports.parse(normalized);
+    const parsed = context.semverExports.parse(normalized);
     if (!parsed) {
         return `必须是合法 SemVer：${normalized}`;
     }
@@ -142,7 +142,7 @@ async function runUpload(options, runtime = {}) {
     const postCDNUploadCallback$1 = runtime.postCDNUploadCallback ?? postCDNUploadCallback;
     const createReadStream = runtime.createReadStream ?? fs.createReadStream;
     const orderedFiles = [...options.files].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-    const batches = chunkUploadFiles(orderedFiles, sdkVersionPolicy.MINIAPP_UPLOAD_BATCH_SIZE);
+    const batches = chunkUploadFiles(orderedFiles, context.MINIAPP_UPLOAD_BATCH_SIZE);
     await logger.task(`正在上传 ${orderedFiles.length} 个文件`, async (taskContext) => {
         logger.debug(`上传并发数: ${concurrency}`);
         logger.debug(`上传批次数: ${batches.length}`);
@@ -152,7 +152,7 @@ async function runUpload(options, runtime = {}) {
             logger.debug(`正在处理上传批次 ${batchIndex + 1}/${batches.length}，文件数: ${batch.length}`);
             logger.debug('正在获取 CDN 上传信息');
             const fileInfos = createUploadFileInfos(batch, options);
-            const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: sdkVersionPolicy.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
+            const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: context.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
             logger.debug(`CDN bucket: ${uploadInfo.bucket}`);
             logger.debug(`CDN region: ${uploadInfo.region}`);
             validateUploadInfoKeys(batch, uploadInfo.keys, options);
@@ -213,7 +213,7 @@ function createUploadFileInfos(files, options) {
         name: file.relativePath.split('/').pop() ?? file.relativePath,
         mimetype: file.mimeType,
         fsize: file.size,
-        path: sdkVersionPolicy.getMiniappUploadKey({
+        path: context.getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
             relativePath: file.relativePath,
@@ -225,7 +225,7 @@ function validateUploadInfoKeys(files, keys, options) {
         throw new index.CliError(`CDN 上传接口返回 key 数量异常：期望 ${files.length}，实际 ${keys.length}`);
     }
     for (let index$1 = 0; index$1 < files.length; index$1 += 1) {
-        const expectedKey = sdkVersionPolicy.getMiniappUploadKey({
+        const expectedKey = context.getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
             relativePath: files[index$1].relativePath,
@@ -264,7 +264,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-NOO3q8_C.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-Ulhxo0YK.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -308,10 +308,8 @@ function isRecord(value) {
 }
 
 async function precheckUserMiniprogramVersion(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(sdkVersionPolicy.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
-        name: options.name,
-        icon_url: options.iconUrl,
-        cover_image_urls: options.coverImageUrls.join(','),
+    return postUserMiniprogramVersionForm(context.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
+        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
         ...(options.version ? { version: options.version } : {}),
         ...(options.source_version ? { source_version: options.source_version } : {}),
         release_note: options.releaseNote,
@@ -319,10 +317,8 @@ async function precheckUserMiniprogramVersion(options, runtime = {}) {
     }, runtime);
 }
 async function submitUserMiniprogramAudit(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(sdkVersionPolicy.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
-        name: options.name,
-        icon_url: options.iconUrl,
-        cover_image_urls: options.coverImageUrls.join(','),
+    return postUserMiniprogramVersionForm(context.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
+        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
         ...(options.manifest ? { manifest: JSON.stringify(options.manifest) } : {}),
         ...(options.source_version ? { source_version: options.source_version } : {}),
         release_note: options.releaseNote,
@@ -8670,7 +8666,6 @@ async function runDeployCommand(options, runtime = {}) {
     if (typeof miniProgramId !== 'string' || !miniProgramId.trim()) {
         throw new Error('未在 package.json 中找到 heybox.miniProgramId，请先配置 mini program id');
     }
-    const miniProgramProfile = readMiniProgramVersionProfile(packageJson);
     const fromVersion = options.fromVersion?.trim();
     const releaseNote = await resolveDeployReleaseNote(options, runtime);
     const session$1 = await logger.task('正在校验 Heybox 登录态', () => (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }), { successText: 'Heybox 登录态有效' });
@@ -8682,7 +8677,6 @@ async function runDeployCommand(options, runtime = {}) {
         const precheck = await runVersionPrecheck({
             session: session$1,
             miniProgramId,
-            ...miniProgramProfile,
             ...historyArtifact,
             releaseNote,
             autoPublish,
@@ -8691,12 +8685,6 @@ async function runDeployCommand(options, runtime = {}) {
         if (!sourceSdkVersion) {
             throw new Error('历史产物缺少 sdkVersion，无法复用，请重新构建并上传新版本');
         }
-        await (runtime.enforceRemoteSdkVersion ?? sdkVersionPolicy.enforceRemoteSdkVersion)({
-            sdkVersion: sourceSdkVersion,
-            environment: apiBaseUrl,
-            fetchImpl: runtime.fetchImpl,
-            allowPrerelease: false,
-        });
         precheckVersion = precheck.version || precheck.version_normalized || fromVersion;
     }
     else {
@@ -8707,7 +8695,6 @@ async function runDeployCommand(options, runtime = {}) {
         await runVersionPrecheck({
             session: session$1,
             miniProgramId,
-            ...miniProgramProfile,
             version: precheckVersion,
             releaseNote,
             autoPublish,
@@ -8716,6 +8703,7 @@ async function runDeployCommand(options, runtime = {}) {
         const buildMode = env.HB_SDK_ENV?.trim();
         logger.info(`开始构建: ${pm} ${createBuildArgs(pm, buildMode).join(' ')}`);
         await runBuildScript(pm, projectRoot, runtime.spawn ?? childProcess.spawn, {
+            env,
             mode: buildMode,
             outputMode: options.buildOutputMode ?? 'inherit',
             stderr: runtime.stderr,
@@ -8729,27 +8717,21 @@ async function runDeployCommand(options, runtime = {}) {
         const distDir = path.join(projectRoot, 'dist');
         parsedManifest ??= await readDeployManifest(projectRoot, logger);
         ({ manifest, version } = parsedManifest);
-        await (runtime.enforceRemoteSdkVersion ?? sdkVersionPolicy.enforceRemoteSdkVersion)({
-            sdkVersion: parsedManifest.sdkVersion,
-            environment: apiBaseUrl,
-            fetchImpl: runtime.fetchImpl,
-            allowPrerelease: false,
-        });
         if (version !== precheckVersion) {
             throw new Error(`dist/manifest.json.version (${version}) 与预检版本 (${precheckVersion}) 不一致，请重新 build 后再 deploy`);
         }
         const uploadFiles = await logger.task('正在校验 dist 上传文件', async () => {
             const allFiles = await walkDistFiles(distDir);
-            const blocked = allFiles.find((entry) => sdkVersionPolicy.relativePathContainsNodeModulesSegment(entry.relativePath));
+            const blocked = allFiles.find((entry) => context.relativePathContainsNodeModulesSegment(entry.relativePath));
             if (blocked) {
                 throw new Error(`dist 目录含 node_modules：${blocked.relativePath}`);
             }
-            const files = allFiles.filter((entry) => sdkVersionPolicy.shouldUploadDistFile(entry.relativePath));
-            const pathError = sdkVersionPolicy.validateUploadPaths(files, { miniProgramId, version, maxLength: sdkVersionPolicy.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
+            const files = allFiles.filter((entry) => context.shouldUploadDistFile(entry.relativePath));
+            const pathError = context.validateUploadPaths(files, { miniProgramId, version, maxLength: context.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
             if (pathError) {
                 throw new Error(pathError);
             }
-            const sizeError = sdkVersionPolicy.validateUploadTotalSize(files);
+            const sizeError = context.validateUploadTotalSize(files);
             if (sizeError) {
                 throw new Error(sizeError);
             }
@@ -8765,8 +8747,8 @@ async function runDeployCommand(options, runtime = {}) {
     }
     try {
         const submitOptions = fromVersion
-            ? { session: session$1, miniProgramId, ...miniProgramProfile, ...historyArtifact, releaseNote, autoPublish }
-            : { session: session$1, miniProgramId, ...miniProgramProfile, manifest, releaseNote, autoPublish };
+            ? { session: session$1, miniProgramId, ...historyArtifact, releaseNote, autoPublish }
+            : { session: session$1, miniProgramId, manifest, releaseNote, autoPublish };
         submitAuditResult = await logger.task('正在提交审核', () => (runtime.submitUserMiniprogramAudit ?? submitUserMiniprogramAudit)(submitOptions, {
             baseUrl: apiBaseUrl,
             fetchImpl: runtime.fetchImpl,
@@ -8825,42 +8807,6 @@ function findProjectRoot(startDir) {
 async function readPackageJson(projectRoot) {
     return JSON.parse(await fs$1.readFile(path.join(projectRoot, 'package.json'), 'utf8'));
 }
-function readMiniProgramVersionProfile(packageJson) {
-    const profile = packageJson.heybox?.miniProgramProfile;
-    return {
-        name: readRequiredProfileText(profile?.name, 'heybox.miniProgramProfile.name'),
-        iconUrl: readRequiredHttpsUrl(profile?.iconUrl, 'heybox.miniProgramProfile.iconUrl'),
-        coverImageUrls: readCoverImageUrls(profile?.coverImageUrls),
-    };
-}
-function readRequiredProfileText(value, pathLabel) {
-    const text = typeof value === 'string' ? value.trim() : '';
-    if (!text) {
-        throw new Error(`${pathLabel} 不能为空；请在 package.json 配置本次提交审核的小程序资料`);
-    }
-    return text;
-}
-function readRequiredHttpsUrl(value, pathLabel) {
-    const text = readRequiredProfileText(value, pathLabel);
-    if (!/^https:\/\//i.test(text)) {
-        throw new Error(`${pathLabel} 必须是 HTTPS 地址`);
-    }
-    return text;
-}
-function readCoverImageUrls(value) {
-    if (!Array.isArray(value)) {
-        throw new Error('heybox.miniProgramProfile.coverImageUrls 至少配置 1 张 HTTPS 图片');
-    }
-    const urls = value.map((item) => (typeof item === 'string' ? item.trim() : '')).filter(Boolean);
-    if (urls.length === 0) {
-        throw new Error('heybox.miniProgramProfile.coverImageUrls 至少配置 1 张 HTTPS 图片');
-    }
-    const invalidUrl = urls.find((url) => !/^https:\/\//i.test(url));
-    if (invalidUrl) {
-        throw new Error(`heybox.miniProgramProfile.coverImageUrls 必须都是 HTTPS 地址：${invalidUrl}`);
-    }
-    return urls;
-}
 async function readDeployManifest(projectRoot, logger) {
     const distDir = path.join(projectRoot, 'dist');
     const manifestPath = path.join(distDir, 'manifest.json');
@@ -8950,6 +8896,7 @@ async function runBuildScript(pm, cwd, spawnImpl, options) {
         const buildArgs = createBuildArgs(pm, options.mode);
         const child = spawnImpl(pm, buildArgs, {
             cwd,
+            env: { ...process.env, ...options.env, HB_SDK_DEPLOY_BUILD: '1' },
             stdio: pipeStdoutToStderr ? ['inherit', 'pipe', 'inherit'] : 'inherit',
         });
         if (pipeStdoutToStderr) {
@@ -8993,7 +8940,7 @@ async function walkDistFiles(distDir) {
             }
             const fileStat = await fs$1.stat(absPath);
             results.push({
-                relativePath: sdkVersionPolicy.normalizeRelativePath(relPath),
+                relativePath: context.normalizeRelativePath(relPath),
                 absolutePath: absPath,
                 size: fileStat.size,
                 mimeType: inferMimeType(entry.name),
@@ -9152,7 +9099,7 @@ async function runRemoteDeployCommand(options, runtime) {
 async function createRemoteCommandContext(options, runtime) {
     index.applyServiceTagIfNeeded(options.serviceTag);
     const logger = resolveRemoteLogger(options, runtime);
-    const environment = await sdkVersionPolicy.resolveRemoteEnvironment({
+    const environment = await context.resolveRemoteEnvironment({
         allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl,
         apiBaseUrl: options.apiBaseUrl,
         env: options.env,
@@ -9162,10 +9109,10 @@ async function createRemoteCommandContext(options, runtime) {
         fetchImpl: runtime.fetchImpl,
         requireAuthSession: runtime.requireAuthSession,
     });
-    const packageJson = await sdkVersionPolicy.readMiniProgramProjectPackage(runtime.cwd ?? process.cwd());
-    const binding = sdkVersionPolicy.readBoundMiniProgramIdFromPackageJson(packageJson.packageJson);
+    const packageJson = await context.readMiniProgramProjectPackage(runtime.cwd ?? process.cwd());
+    const binding = context.readBoundMiniProgramIdFromPackageJson(packageJson.packageJson);
     const api = {
-        ...adaptRemoteApiClient(sdkVersionPolicy.createRemoteApiClientForEnvironment(environment)),
+        ...adaptRemoteApiClient(context.createRemoteApiClientForEnvironment(environment)),
         ...runtime.api,
     };
     logger.debug(`Heybox API: ${environment.apiBaseUrl}`);
@@ -9306,39 +9253,39 @@ async function remoteList(options, context, runtime) {
     }
     return finishRemoteCommand(options, runtime, output);
 }
-async function remoteCreate(options, context, runtime) {
-    if (context.binding && !options.forceBind) {
-        throw new Error(`当前项目已绑定 ${context.binding}；如需覆盖，请使用 --force-bind`);
+async function remoteCreate(options, context$1, runtime) {
+    if (context$1.binding && !options.forceBind) {
+        throw new Error(`当前项目已绑定 ${context$1.binding}；如需覆盖，请使用 --force-bind`);
     }
-    const access = await context.api.accessStatus();
+    const access = await context$1.api.accessStatus();
     if (access.status !== 'approved') {
         throw new Error(`当前 CLI 用户没有创建工坊小程序权限：${String(access.status ?? 'unknown')}`);
     }
-    await confirmCreateWithCurrentEntity(options, context, runtime);
-    const result = await context.api.createMiniProgram();
+    await confirmCreateWithCurrentEntity(options, context$1, runtime);
+    const result = await context$1.api.createMiniProgram();
     const miniProgramId = requireMiniProgramId(result);
-    await sdkVersionPolicy.writeBoundMiniProgramId(context.packageJson.projectRoot, miniProgramId, { force: options.forceBind });
+    await context.writeBoundMiniProgramId(context$1.packageJson.projectRoot, miniProgramId, { force: options.forceBind });
     const output = { changed: true, miniProgramId, remote: toCamelCaseDeep(result) };
     if (!options.json) {
-        context.logger.success(`创建并绑定成功：${miniProgramId}`);
+        context$1.logger.success(`创建并绑定成功：${miniProgramId}`);
     }
     return finishRemoteCommand(options, runtime, output);
 }
-async function remoteBind(options, context, runtime) {
+async function remoteBind(options, context$1, runtime) {
     const miniProgramId = requireNonEmpty(options.miniProgramId, 'remote bind 必须传 <mini-program-id>');
-    if (context.binding && context.binding !== miniProgramId && !options.force) {
-        throw new Error(`当前项目已绑定 ${context.binding}；如需覆盖本地绑定，请使用 --force`);
+    if (context$1.binding && context$1.binding !== miniProgramId && !options.force) {
+        throw new Error(`当前项目已绑定 ${context$1.binding}；如需覆盖本地绑定，请使用 --force`);
     }
-    const detail = await context.api.getMiniProgramDetail(miniProgramId);
+    const detail = await context$1.api.getMiniProgramDetail(miniProgramId);
     const verifiedId = requireMiniProgramId(detail);
-    await assertMiniProgramEntityMatchesCurrent(context, detail);
-    const changed = context.binding !== verifiedId;
+    await assertMiniProgramEntityMatchesCurrent(context$1, detail);
+    const changed = context$1.binding !== verifiedId;
     if (changed) {
-        await sdkVersionPolicy.writeBoundMiniProgramId(context.packageJson.projectRoot, verifiedId, { force: options.force });
+        await context.writeBoundMiniProgramId(context$1.packageJson.projectRoot, verifiedId, { force: options.force });
     }
     const output = { changed, miniProgramId: verifiedId, remote: toCamelCaseDeep(detail) };
     if (!options.json) {
-        context.logger.success(changed ? `绑定成功：${verifiedId}` : `已绑定：${verifiedId}`);
+        context$1.logger.success(changed ? `绑定成功：${verifiedId}` : `已绑定：${verifiedId}`);
     }
     return finishRemoteCommand(options, runtime, output);
 }

package/dist/cli-chunks/{session-DIcRjyDY.cjs → session-D7mPwyx4.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-CCeHouBU.cjs');
+var index = require('./index-CTyguEza.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-CCeHouBU.cjs');
+var index = require('./cli-chunks/index-CTyguEza.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/index.cjs.js

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/templates/vue3-vite-ts/README.md.ejs

@@ -21,7 +21,7 @@ npm run deploy
 
 - `npm run dev`：启动本地 Vite 服务和 `hb-sdk` 内置 mock runtime host，适合本地调试 SDK 能力；调试页内可点击按钮在 Mac 版 APP 中启动同一页面，也可以选择局域网网卡后用手机小黑盒 APP 扫码调试。手机需要与电脑处在同一局域网，并使用支持小程序调试壳的新版小黑盒 APP。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP，需要时请在系统浏览器中打开同一个调试页后重试。
 - `npm run build`：先执行 TypeScript 检查，再构建生产产物。
-- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在 `package.json.heybox.miniProgramProfile` 中配置并随版本审核提交。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
+- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在开放平台版本发布中维护；CLI 项目配置只保留 `heybox.miniProgramId`，首次部署服务端会使用默认名与默认图。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
 
 ## 更多能力
 

package/dist/templates/vue3-vite-ts/package.json.ejs

@@ -4,12 +4,7 @@
   "private": true,
   "type": "module",
   "heybox": {
-    "miniProgramId": "",
-    "miniProgramProfile": {
-      "name": "<%= packageName %>",
-      "iconUrl": "",
-      "coverImageUrls": []
-    }
+    "miniProgramId": ""
   },
   "scripts": {
     "hb-sdk": "hb-sdk",

package/dist/vite.cjs.js

@@ -10,7 +10,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.2';
 
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
@@ -11933,7 +11933,7 @@ function miniappManifest(options = {}) {
             hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         async buildStart() {
-            if (command !== 'build')
+            if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1')
                 return;
             try {
                 await (options.enforceSdkVersion ?? enforceViteSdkVersion)({
@@ -11966,10 +11966,10 @@ function miniappManifest(options = {}) {
             const sdkVersion = resolveSdkVersion();
             const outputRoot = path.resolve(root, outDir);
             const htmlFiles = collectHtmlFiles(outputRoot);
-            const unexpectedHtmlFiles = htmlFiles.filter(file => path.relative(outputRoot, file) !== 'index.html');
+            const unexpectedHtmlFiles = htmlFiles.filter((file) => path.relative(outputRoot, file) !== 'index.html');
             if (unexpectedHtmlFiles.length > 0) {
                 throw new Error(`工坊小程序只支持单页应用，构建产物不允许额外 HTML：${unexpectedHtmlFiles
-                    .map(file => path.relative(outputRoot, file).split(path.sep).join('/'))
+                    .map((file) => path.relative(outputRoot, file).split(path.sep).join('/'))
                     .join(', ')}`);
             }
             const indexHtmlPath = path.join(outputRoot, 'index.html');

package/dist/vite.esm.js

@@ -7,7 +7,7 @@ import { readFile, mkdir, writeFile, rename } from 'node:fs/promises';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.0';
+    : '0.6.2';
 
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
@@ -11930,7 +11930,7 @@ function miniappManifest(options = {}) {
             hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         async buildStart() {
-            if (command !== 'build')
+            if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1')
                 return;
             try {
                 await (options.enforceSdkVersion ?? enforceViteSdkVersion)({
@@ -11963,10 +11963,10 @@ function miniappManifest(options = {}) {
             const sdkVersion = resolveSdkVersion();
             const outputRoot = path.resolve(root, outDir);
             const htmlFiles = collectHtmlFiles(outputRoot);
-            const unexpectedHtmlFiles = htmlFiles.filter(file => path.relative(outputRoot, file) !== 'index.html');
+            const unexpectedHtmlFiles = htmlFiles.filter((file) => path.relative(outputRoot, file) !== 'index.html');
             if (unexpectedHtmlFiles.length > 0) {
                 throw new Error(`工坊小程序只支持单页应用，构建产物不允许额外 HTML：${unexpectedHtmlFiles
-                    .map(file => path.relative(outputRoot, file).split(path.sep).join('/'))
+                    .map((file) => path.relative(outputRoot, file).split(path.sep).join('/'))
                     .join(', ')}`);
             }
             const indexHtmlPath = path.join(outputRoot, 'index.html');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -92,7 +92,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.0"
+    "@heybox/hb-api": "~1.25.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/SKILL.md

@@ -52,14 +52,14 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 2. Use `hb-sdk dev` for local browser debugging through the built-in mock runtime host. The project must bind `package.json.heybox.miniProgramId` and the CLI must be logged in so dev can load the real Runtime permission snapshot before starting Vite.
 3. Use `hb-sdk remote ...` for developer-owned remote mini-program management. Top-level `hb-sdk deploy` has been hard-cut and must not be recommended as a compatibility alias.
 4. Use `hb-sdk remote entity list`, `hb-sdk remote entity current`, and `hb-sdk remote entity switch <entity-id>` to inspect or change the developer platform server-side current entity before remote management commands.
-5. Use `hb-sdk remote create` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified. Mini-program name, icon, and cover images belong in `package.json.heybox.miniProgramProfile` and are submitted with version audit.
+5. Use `hb-sdk remote create` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified. CLI project configuration contains only `package.json.heybox.miniProgramId`; mini-program name, icon, and cover images are maintained on the Open platform version-publish flow. On first submit without prior approved profile, the server injects a default name and default images.
 6. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for read/basic/preview management workflows. Mini-program name and image changes must go through version audit, so the CLI must not expose a basic-info update command.
-7. Use `hb-sdk remote deploy --release-note <text>` to build, upload, and submit the current project for audit. It reads `package.json.heybox.miniProgramId`, validates that the bound mini-program belongs to the server-side current entity before precheck/build/upload, prechecks `package.json.version` before build, runs the project's `build` script via the package manager auto-detected by lockfile, uploads `dist/` to CDN (skipping `manifest.json`, `.DS_Store`, `.map`), then calls the submit-audit API. When `--env <name>` or `HB_SDK_ENV=<name>` selects an environment preset, deploy also passes the same name to the project build as its Vite mode. The deploy upload pipeline rejects actual upload artifacts over 100MiB before any upload request, processes CDN upload metadata and callback confirmation at 50 files per batch, keeps 4-way upload concurrency within each batch, and validates CDN-returned keys exactly against the local expected upload keys.
+7. Use `hb-sdk remote deploy --release-note <text>` to build, upload, and submit the current project for audit. It reads `package.json.heybox.miniProgramId`, validates that the bound mini-program belongs to the server-side current entity before precheck/build/upload, prechecks `package.json.version` before build, runs the project's `build` script via the package manager auto-detected by lockfile, uploads `dist/` to CDN (skipping `manifest.json`, `.DS_Store`, `.map`), then calls the submit-audit API. Deploy and `--from-version` do not fetch or compare the client-side `minimumSdkVersion`; Manifest validation and server-side precheck / submit-audit policy still apply. When `--env <name>` or `HB_SDK_ENV=<name>` selects an environment preset, deploy also passes the same name to the project build as its Vite mode. The deploy upload pipeline rejects actual upload artifacts over 100MiB before any upload request, processes CDN upload metadata and callback confirmation at 50 files per batch, keeps 4-way upload concurrency within each batch, and validates CDN-returned keys exactly against the local expected upload keys.
 8. Use `hb-sdk remote deploy --from-version <version> --release-note <text>` to reuse a previously uploaded remote version artifact and submit a new audit version without reading local `dist`, building, or uploading.
 9. Always provide a concise release note before deploy. Non-interactive environments must pass `--release-note`; interactive terminals may prompt for it. The default is manual release after approval with `hb-sdk remote release <version>`; use `--auto-publish` when the audited version should automatically release after approval.
 10. Use `hb-sdk remote release <version>`, `hb-sdk remote withdraw <version>`, `hb-sdk remote take-down`, and `hb-sdk remote reopen` for dangerous remote changes. Interactive terminals should confirm after showing enough context; non-interactive environments must pass `--yes`.
 11. For internal test/staging backend operations, use origin-only custom URLs: `HB_SDK_API_BASE_URL` or `hb-sdk remote ... --api-base-url <url>` for remote platform APIs, and `HB_SDK_LOGIN_BASE_URL` or `hb-sdk login --login-base-url <url>` for browser login. CLI flags override env vars. API base URLs must be Heybox trusted HTTPS origins by default; use `--allow-unsafe-api-base-url` or `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` only for local backend debugging. Do not include path, query, or hash in these URLs.
-12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests and the Vite minimum-SDK-version gate. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
+12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests and the Vite minimum-SDK-version gate used by manual builds. Deploy builds skip that client-side version gate. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
 13. If a remote command targets a custom login environment, pass the same `--login-base-url` or `HB_SDK_LOGIN_BASE_URL` used for `hb-sdk login`; remote commands reject cached CLI login state from a different login origin.
 14. Add `--verbose` / `-v` only when diagnosing failures; default CLI errors are intentionally concise, while verbose output includes backend envelope, HTTP status, trace fields, raw body, or original submit-audit failure details.
 15. Use `--json` for script consumption of `hb-sdk remote` commands. With `--json`, stdout must contain exactly one JSON object; progress, warnings, update reminders, and verbose diagnostics must not pollute stdout.

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.0`
+- Version at generation time: `0.6.2`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -200,10 +200,7 @@ Use `@heybox/hb-sdk/vite` only in `vite.config.ts`. Do not import it from iframe
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { HB_SDK_VERSION } from '../core/version';
-import {
-  renderMiniappManifest,
-  validateMiniappPackageVersionForBuild,
-} from '../miniapp-manifest/schema';
+import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
 import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
@@ -243,12 +240,14 @@ interface MiniappManifestResolvedConfig {
   server: {
     host?: string | boolean;
     port?: number;
-    hmr?: boolean | {
-      clientPort?: number;
-      host?: string;
-      port?: number;
-      protocol?: 'ws' | 'wss';
-    };
+    hmr?:
+      | boolean
+      | {
+          clientPort?: number;
+          host?: string;
+          port?: number;
+          protocol?: 'ws' | 'wss';
+        };
   };
 }
 
@@ -281,7 +280,7 @@ export function miniappManifest(options: MiniappManifestOptions = {}): MiniappMa
       hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
     },
     async buildStart() {
-      if (command !== 'build') return;
+      if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1') return;
       try {
         await (options.enforceSdkVersion ?? defaultEnforceRemoteSdkVersion)({
           sdkVersion: resolveSdkVersion(),
@@ -313,11 +312,11 @@ export function miniappManifest(options: MiniappManifestOptions = {}): MiniappMa
       const sdkVersion = resolveSdkVersion();
       const outputRoot = path.resolve(root, outDir);
       const htmlFiles = collectHtmlFiles(outputRoot);
-      const unexpectedHtmlFiles = htmlFiles.filter(file => path.relative(outputRoot, file) !== 'index.html');
+      const unexpectedHtmlFiles = htmlFiles.filter((file) => path.relative(outputRoot, file) !== 'index.html');
       if (unexpectedHtmlFiles.length > 0) {
         throw new Error(
           `工坊小程序只支持单页应用，构建产物不允许额外 HTML：${unexpectedHtmlFiles
-            .map(file => path.relative(outputRoot, file).split(path.sep).join('/'))
+            .map((file) => path.relative(outputRoot, file).split(path.sep).join('/'))
             .join(', ')}`,
         );
       }
@@ -383,7 +382,7 @@ function resolveHmrWebSocketUrl(resolved: MiniappManifestResolvedConfig) {
 ```json
 {
   "version": "1.2.3",
-  "sdkVersion": "0.6.0"
+  "sdkVersion": "0.6.1"
 }
 ```
 
@@ -405,7 +404,7 @@ export default defineConfig({
 
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
 
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、build 和 deploy 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 
 失败与警告语义：
 

package/skill/references/cli.md

@@ -165,9 +165,11 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 
 `manifest.json` 仅作为提交审核接口的 `manifest` 字段提交，不会上传到 CDN。Vite 项目通过 `miniappManifest()` 插件生成；CLI 不会自动注入插件，请在 `vite.config.ts` 中显式挂载。小程序构建产物需要使用相对资源路径；`hb-sdk create` 模板会显式配置 `base: './'`，未配置 `base` 的项目也会由 `miniappManifest()` 在 build 时默认补成 `./`。构建产物只能在兼容的小黑盒 Runtime 中启动，普通浏览器直接打开时不会执行标准业务脚本。
 
+`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。开发者手动执行 Vite build 时仍会运行最低 SDK 版本门禁。
+
 默认发布策略是 `auto_publish=false`：运营审核通过后使用 `hb-sdk remote versions` 查看版本状态，再用 `hb-sdk remote release <version>` 发布。需要审核通过后自动发布并下架旧线上版本时，使用 `--auto-publish`。如需让指定用户预览未发布候选版本，使用 `hb-sdk remote allowlist add <heybox_id>` 管理预览白名单。
 
-内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`；deploy 子构建会继承 `.env.<name>` 中的 `HB_SDK_SERVICE_TAG`，Vite 最低 SDK 版本门禁请求也会同时携带该 header 和 query。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
+内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`；手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query，deploy 子构建不执行该门禁。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
 
 `hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 
@@ -254,20 +256,7 @@ hb-sdk remote square show
 
 `hb-sdk remote create` 会创建远端工坊小程序并写入当前项目绑定；已有绑定时必须传 `--force-bind` 才能覆盖。`hb-sdk remote bind <mini-program-id>` 会先校验当前 CLI 用户可管理目标小程序，再写入本地配置；`--force` 只允许覆盖本地绑定，不跳过远端校验。
 
-小程序名称、icon 和介绍图需要随版本提交审核，CLI 不再提供直接更新基础信息的命令。提交审核前在 `package.json.heybox.miniProgramProfile` 配置 `name`、HTTPS `iconUrl` 和至少一张 HTTPS `coverImageUrls`：
-
-```json
-{
-  "heybox": {
-    "miniProgramId": "mp_xxxxxxxx",
-    "miniProgramProfile": {
-      "name": "我的小程序",
-      "iconUrl": "https://img.example.test/icon.png",
-      "coverImageUrls": ["https://img.example.test/cover.png"]
-    }
-  }
-}
-```
+小程序名称、icon 和介绍图在开放平台「版本发布」中维护并随版本审核。CLI 项目配置只保留 `package.json.heybox.miniProgramId`；首次部署且没有历史审核资料时，服务端会使用默认名称「我的小程序」与平台默认图片。
 
 `hb-sdk remote square hide` 会隐藏当前绑定小程序在普通用户侧的小程序工坊广场展示；白名单用户仍可在小程序工坊广场看到，直接链接访问已发布版本也不受影响。`hb-sdk remote square show` 会恢复普通用户侧的小程序工坊广场展示。
 
@@ -279,7 +268,7 @@ Agent rules:
 
 - Use `hb-sdk remote entity list/current/switch` for developer entity inspection and switching.
 - Use `hb-sdk remote create` for create-and-bind and `hb-sdk remote bind <mini-program-id>` for binding an existing manageable remote mini-program.
-- Keep mini-program name, icon, and cover images in `package.json.heybox.miniProgramProfile`; these fields are submitted with version audit.
+- Do not require or submit mini-program name/icon/cover from CLI; maintain them on Open version publish. CLI project configuration contains only `package.json.heybox.miniProgramId`.
 - Explain that `remote create` creates under the current entity and that multi-entity non-TTY usage must confirm with `--yes`; `--yes` confirms current-entity usage but does not switch entities.
 - Explain that `remote bind` verifies the mini-program is manageable by the current entity and does not write `package.json.heybox.miniProgramId` on entity mismatch.
 - Use `hb-sdk remote info`, `hb-sdk remote access`, `hb-sdk remote list`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, `hb-sdk remote square show/hide`, and `hb-sdk remote allowlist ...` instead of sending users to Open when a matching CLI command exists.
@@ -396,7 +385,7 @@ npm run deploy
 
 - `npm run dev`：启动本地 Vite 服务和 `hb-sdk` 内置 mock runtime host，适合本地调试 SDK 能力；调试页内可点击按钮在 Mac 版 APP 中启动同一页面，也可以选择局域网网卡后用手机小黑盒 APP 扫码调试。手机需要与电脑处在同一局域网，并使用支持小程序调试壳的新版小黑盒 APP。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP，需要时请在系统浏览器中打开同一个调试页后重试。
 - `npm run build`：先执行 TypeScript 检查，再构建生产产物。
-- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在 `package.json.heybox.miniProgramProfile` 中配置并随版本审核提交。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
+- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在开放平台版本发布中维护；CLI 项目配置只保留 `heybox.miniProgramId`，首次部署服务端会使用默认名与默认图。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
 
 ## 更多能力
 

package/skill/scripts/sync-references.mjs

@@ -429,7 +429,7 @@ Agent rules:
 
 - Use \`hb-sdk remote entity list/current/switch\` for developer entity inspection and switching.
 - Use \`hb-sdk remote create\` for create-and-bind and \`hb-sdk remote bind <mini-program-id>\` for binding an existing manageable remote mini-program.
-- Keep mini-program name, icon, and cover images in \`package.json.heybox.miniProgramProfile\`; these fields are submitted with version audit.
+- Do not require or submit mini-program name/icon/cover from CLI; maintain them on Open version publish. CLI project configuration contains only \`package.json.heybox.miniProgramId\`.
 - Explain that \`remote create\` creates under the current entity and that multi-entity non-TTY usage must confirm with \`--yes\`; \`--yes\` confirms current-entity usage but does not switch entities.
 - Explain that \`remote bind\` verifies the mini-program is manageable by the current entity and does not write \`package.json.heybox.miniProgramId\` on entity mismatch.
 - Use \`hb-sdk remote info\`, \`hb-sdk remote access\`, \`hb-sdk remote list\`, \`hb-sdk remote versions\`, \`hb-sdk remote preview <version>\`, \`hb-sdk remote square show/hide\`, and \`hb-sdk remote allowlist ...\` instead of sending users to Open when a matching CLI command exists.

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.0+skill.451f74e19672",
+  "skillVersion": "0.6.2+skill.f2a041bb2256",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.0",
-    "compatibility": "0.6.0"
+    "version": "0.6.2",
+    "compatibility": "0.6.2"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-451f74e19672cca0953ebb9d47d6f2632c9341ba2c4f9bcf4a861d5344285673"
+  "integrity": "sha256-f2a041bb22563610e0fcaa991e2e5a2a94c331a029aafe4535083ecf89a4a6b0"
 }