@heybox/hb-sdk 0.6.2 → 0.6.3

package/dist/vite.esm.js

@@ -1,17 +1,10 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
 import path from 'node:path';
-import require$$0 from 'path';
-import require$$1 from 'os';
-import { readFile, mkdir, writeFile, rename } from 'node:fs/promises';
 
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.2';
-
-function getDefaultExportFromCjs (x) {
-	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
-}
+    : '0.6.3';
 
 var re = {exports: {}};
 
@@ -11584,328 +11577,9 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
-var envPaths$1 = {exports: {}};
-
-var hasRequiredEnvPaths;
-
-function requireEnvPaths () {
-	if (hasRequiredEnvPaths) return envPaths$1.exports;
-	hasRequiredEnvPaths = 1;
-	const path = require$$0;
-	const os = require$$1;
-
-	const homedir = os.homedir();
-	const tmpdir = os.tmpdir();
-	const {env} = process;
-
-	const macos = name => {
-		const library = path.join(homedir, 'Library');
-
-		return {
-			data: path.join(library, 'Application Support', name),
-			config: path.join(library, 'Preferences', name),
-			cache: path.join(library, 'Caches', name),
-			log: path.join(library, 'Logs', name),
-			temp: path.join(tmpdir, name)
-		};
-	};
-
-	const windows = name => {
-		const appData = env.APPDATA || path.join(homedir, 'AppData', 'Roaming');
-		const localAppData = env.LOCALAPPDATA || path.join(homedir, 'AppData', 'Local');
-
-		return {
-			// Data/config/cache/log are invented by me as Windows isn't opinionated about this
-			data: path.join(localAppData, name, 'Data'),
-			config: path.join(appData, name, 'Config'),
-			cache: path.join(localAppData, name, 'Cache'),
-			log: path.join(localAppData, name, 'Log'),
-			temp: path.join(tmpdir, name)
-		};
-	};
-
-	// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
-	const linux = name => {
-		const username = path.basename(homedir);
-
-		return {
-			data: path.join(env.XDG_DATA_HOME || path.join(homedir, '.local', 'share'), name),
-			config: path.join(env.XDG_CONFIG_HOME || path.join(homedir, '.config'), name),
-			cache: path.join(env.XDG_CACHE_HOME || path.join(homedir, '.cache'), name),
-			// https://wiki.debian.org/XDGBaseDirectorySpecification#state
-			log: path.join(env.XDG_STATE_HOME || path.join(homedir, '.local', 'state'), name),
-			temp: path.join(tmpdir, username, name)
-		};
-	};
-
-	const envPaths = (name, options) => {
-		if (typeof name !== 'string') {
-			throw new TypeError(`Expected string, got ${typeof name}`);
-		}
-
-		options = Object.assign({suffix: 'nodejs'}, options);
-
-		if (options.suffix) {
-			// Add suffix to prevent possible conflict with native apps
-			name += `-${options.suffix}`;
-		}
-
-		if (process.platform === 'darwin') {
-			return macos(name);
-		}
-
-		if (process.platform === 'win32') {
-			return windows(name);
-		}
-
-		return linux(name);
-	};
-
-	envPaths$1.exports = envPaths;
-	// TODO: Remove this for the next major release
-	envPaths$1.exports.default = envPaths;
-	return envPaths$1.exports;
-}
-
-var envPathsExports = requireEnvPaths();
-var envPaths = /*@__PURE__*/getDefaultExportFromCjs(envPathsExports);
-
-const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
-function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
-    return {
-        path: APIUserMiniprogramPublicSdkConfigPath,
-        searchParams: serviceTag ? { special_tag: serviceTag } : {},
-        headers: serviceTag ? { 'x-rylai-service-tag': serviceTag } : {},
-    };
-}
-function parseUserMiniprogramPublicSdkConfigResult(value) {
-    if (!isRecord(value) ||
-        typeof value.minimum_sdk_version !== 'string') {
-        throw new Error('公共 SDK 配置响应无效');
-    }
-    return value;
-}
-function parseUserMiniprogramPublicSdkConfigEnvelope(value) {
-    if (!isRecord(value) || value.status !== 'ok') {
-        throw new Error('公共 SDK 配置响应无效');
-    }
-    return parseUserMiniprogramPublicSdkConfigResult(value.result);
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null;
-}
-
-const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = APIUserMiniprogramPublicSdkConfigPath;
-
-const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
-async function resolveMinimumSdkVersion(options) {
-    const now = options.now ?? Date.now();
-    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
-    const cache = await readCache(cachePath);
-    let minimumSdkVersion;
-    try {
-        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
-    }
-    catch {
-        const cached = cache.environments[options.environment];
-        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
-        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
-            try {
-                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
-            }
-            catch {
-                // 非法缓存按不存在处理。
-            }
-        }
-        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
-    }
-    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
-    try {
-        await writeCache(cachePath, cache);
-    }
-    catch {
-        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
-    }
-    return minimumSdkVersion;
-}
-function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
-    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
-    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
-    if (!options.allowPrerelease && semverExports.prerelease(current) !== null) {
-        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
-    }
-    if (!semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
-        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
-    }
-    return current;
-}
-function validateSdkVersion(value, label) {
-    const normalized = String(value).trim();
-    const parsed = semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function validateStableSdkVersion(value, label) {
-    const normalized = validateSdkVersion(value, label);
-    if (semverExports.prerelease(normalized) !== null)
-        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
-    return normalized;
-}
-async function readCache(cachePath) {
-    try {
-        const parsed = JSON.parse(await readFile(cachePath, 'utf8'));
-        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
-            return parsed;
-    }
-    catch {
-        // 缓存缺失或损坏时继续请求最新配置。
-    }
-    return { environments: {} };
-}
-async function writeCache(cachePath, cache) {
-    await mkdir(path.dirname(cachePath), { recursive: true });
-    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
-    await writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
-    await rename(temporaryPath, cachePath);
-}
-
-const globalHeyboxCliRequestConfig = {};
-function readHeyboxCliRequestConfig() {
-    return normalizeHeyboxRylaiServiceTagConfig(globalHeyboxCliRequestConfig);
-}
-function resolveHeyboxRylaiServiceTag(pathWithQuery, config = readHeyboxCliRequestConfig()) {
-    const normalized = normalizeHeyboxRylaiServiceTagConfig(config);
-    const pathname = getPathname(pathWithQuery) ;
-    const specialTag = normalized.special_tag;
-    if (pathname && specialTag?.path_prefix_list.some((prefix) => pathname.startsWith(prefix))) {
-        return specialTag.tag_name;
-    }
-    return normalized.default_tag;
-}
-function normalizeHeyboxRylaiServiceTagConfig(config) {
-    const defaultTag = normalizeHeyboxRylaiServiceTag(config.default_tag);
-    const specialTagName = normalizeHeyboxRylaiServiceTag(config.special_tag?.tag_name);
-    const pathPrefixList = config.special_tag?.path_prefix_list?.filter(isValidPathPrefix) || [];
-    return {
-        ...(defaultTag ? { default_tag: defaultTag } : {}),
-        ...(specialTagName && pathPrefixList.length
-            ? {
-                special_tag: {
-                    tag_name: specialTagName,
-                    path_prefix_list: pathPrefixList,
-                },
-            }
-            : {}),
-    };
-}
-function normalizeHeyboxRylaiServiceTag(value) {
-    const tag = String(value ?? '').trim();
-    if (!tag) {
-        return undefined;
-    }
-    if (/[\r\n]/.test(tag)) {
-        throw new Error('x-rylai-service-tag 不允许包含换行符');
-    }
-    return tag;
-}
-function isValidPathPrefix(value) {
-    return typeof value === 'string' && value.startsWith('/') && !/[\r\n]/.test(value);
-}
-function getPathname(pathWithQuery) {
-    try {
-        return new URL(pathWithQuery, 'https://api.xiaoheihe.cn').pathname;
-    }
-    catch {
-        return '';
-    }
-}
-
-const paths = envPaths('hb-sdk');
-async function enforceViteSdkVersion(options) {
-    const fetchImpl = options.fetchImpl ?? fetch;
-    const serviceTag = resolveHeyboxRylaiServiceTag(PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH, {
-        default_tag: options.serviceTag,
-    });
-    const minimumSdkVersion = await resolveMinimumSdkVersion({
-        cacheDir: options.cacheDir ?? paths.cache,
-        environment: options.environment,
-        fetchMinimumSdkVersion: async () => {
-            const request = createUserMiniprogramPublicSdkConfigRequest(serviceTag);
-            const url = new URL(request.path, options.environment);
-            for (const [key, value] of Object.entries(request.searchParams)) {
-                url.searchParams.set(key, value);
-            }
-            const response = await fetchImpl(url, {
-                headers: request.headers,
-            });
-            if (!response.ok) {
-                throw new Error('公共 SDK 配置响应无效');
-            }
-            return parseUserMiniprogramPublicSdkConfigEnvelope(await response.json())
-                .minimum_sdk_version;
-        },
-    });
-    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
-}
-
-const HEYBOX_API_BASE_URL = 'https://api.xiaoheihe.cn';
-const TRUSTED_HEYBOX_API_HOST_SUFFIXES = ['.xiaoheihe.cn', '.debugmode.cn'];
-function resolveHeyboxApiBaseUrl(options = {}) {
-    const env = options.env;
-    const baseUrl = normalizeHeyboxOriginUrl(options.apiBaseUrl ?? env?.HB_SDK_API_BASE_URL ?? HEYBOX_API_BASE_URL, 'Heybox API baseUrl');
-    assertSafeHeyboxApiBaseUrl(baseUrl, {
-        allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl === true || isTruthyEnvFlag(env?.HB_SDK_ALLOW_UNSAFE_API_BASE_URL),
-    });
-    return baseUrl;
-}
-function normalizeHeyboxOriginUrl(value, label) {
-    const raw = String(value ?? '').trim();
-    if (!raw) {
-        throw new Error(`${label} 不能为空`);
-    }
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        throw new Error(`${label} 必须是合法的 http(s) origin：${raw}`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`${label} 只支持 http(s) 协议：${raw}`);
-    }
-    if (url.username || url.password) {
-        throw new Error(`${label} 不允许包含用户名或密码：${raw}`);
-    }
-    const rawSuffix = raw.match(/^[a-z][a-z\d+.-]*:\/\/[^/?#]+(.*)$/i)?.[1] ?? '';
-    if ((rawSuffix && rawSuffix !== '/') || url.search || url.hash) {
-        throw new Error(`${label} 只支持 origin，不允许包含 path、query 或 hash：${raw}`);
-    }
-    return url.origin;
-}
-function assertSafeHeyboxApiBaseUrl(origin, options) {
-    if (options.allowUnsafeApiBaseUrl) {
-        return;
-    }
-    const url = new URL(origin);
-    if (url.protocol !== 'https:' || !isTrustedHeyboxApiHost(url.hostname)) {
-        throw new Error('Heybox API baseUrl 默认只允许 Heybox 受信 HTTPS origin；本地调试请显式使用 --allow-unsafe-api-base-url 或 HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1');
-    }
-}
-function isTrustedHeyboxApiHost(hostname) {
-    return TRUSTED_HEYBOX_API_HOST_SUFFIXES.some((suffix) => hostname === suffix.slice(1) || hostname.endsWith(suffix));
-}
-function isTruthyEnvFlag(value) {
-    return ['1', 'true', 'yes', 'on'].includes(String(value ?? '')
-        .trim()
-        .toLowerCase());
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
-function miniappManifest(options = {}) {
+function miniappManifest() {
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
@@ -11929,22 +11603,6 @@ function miniappManifest(options = {}) {
             command = resolved.command;
             hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
-        async buildStart() {
-            if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1')
-                return;
-            try {
-                await (options.enforceSdkVersion ?? enforceViteSdkVersion)({
-                    sdkVersion: resolveSdkVersion(),
-                    environment: resolveHeyboxApiBaseUrl({ env: process.env }),
-                    serviceTag: process.env.HB_SDK_SERVICE_TAG,
-                    allowPrerelease: true,
-                });
-            }
-            catch (error) {
-                priorBuildError = toError(error);
-                throw priorBuildError;
-            }
-        },
         buildEnd(error) {
             if (error) {
                 priorBuildError = priorBuildError ?? toError(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",

package/skill/SKILL.md

@@ -59,7 +59,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 9. Always provide a concise release note before deploy. Non-interactive environments must pass `--release-note`; interactive terminals may prompt for it. The default is manual release after approval with `hb-sdk remote release <version>`; use `--auto-publish` when the audited version should automatically release after approval.
 10. Use `hb-sdk remote release <version>`, `hb-sdk remote withdraw <version>`, `hb-sdk remote take-down`, and `hb-sdk remote reopen` for dangerous remote changes. Interactive terminals should confirm after showing enough context; non-interactive environments must pass `--yes`.
 11. For internal test/staging backend operations, use origin-only custom URLs: `HB_SDK_API_BASE_URL` or `hb-sdk remote ... --api-base-url <url>` for remote platform APIs, and `HB_SDK_LOGIN_BASE_URL` or `hb-sdk login --login-base-url <url>` for browser login. CLI flags override env vars. API base URLs must be Heybox trusted HTTPS origins by default; use `--allow-unsafe-api-base-url` or `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` only for local backend debugging. Do not include path, query, or hash in these URLs.
-12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests and the Vite minimum-SDK-version gate used by manual builds. Deploy builds skip that client-side version gate. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
+12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
 13. If a remote command targets a custom login environment, pass the same `--login-base-url` or `HB_SDK_LOGIN_BASE_URL` used for `hb-sdk login`; remote commands reject cached CLI login state from a different login origin.
 14. Add `--verbose` / `-v` only when diagnosing failures; default CLI errors are intentionally concise, while verbose output includes backend envelope, HTTP status, trace fields, raw body, or original submit-audit failure details.
 15. Use `--json` for script consumption of `hb-sdk remote` commands. With `--json`, stdout must contain exactly one JSON object; progress, warnings, update reminders, and verbose diagnostics must not pollute stdout.

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.2`
+- Version at generation time: `0.6.3`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -203,25 +203,17 @@ import { HB_SDK_VERSION } from '../core/version';
 import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
-import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
-import { resolveHeyboxApiBaseUrl } from '../cli/auth/base-url';
 
 type MiniappManifestPlugin = {
   name: string;
   config: (config: MiniappManifestUserConfig) => MiniappManifestUserConfig | void;
   configResolved: (resolved: MiniappManifestResolvedConfig) => void;
-  buildStart: () => Promise<void>;
   /** Rollup 在构建失败后仍会跑 closeBundle；用 buildEnd 记录真实错误，避免二次校验掩盖原因。 */
   buildEnd: (error?: Error) => void;
   transformIndexHtml: (html: string) => string;
   closeBundle: (this: MiniappManifestPluginContext) => Promise<void>;
 };
 
-export interface MiniappManifestOptions {
-  /** 仅供平台测试和自托管 Remote Environment adapter 使用。 */
-  enforceSdkVersion?: typeof defaultEnforceRemoteSdkVersion;
-}
-
 interface MiniappManifestUserConfig {
   base?: string;
   define?: Record<string, string>;
@@ -254,7 +246,7 @@ interface MiniappManifestResolvedConfig {
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 
-export function miniappManifest(options: MiniappManifestOptions = {}): MiniappManifestPlugin {
+export function miniappManifest(): MiniappManifestPlugin {
   let root = process.cwd();
   let outDir = 'dist';
   let command: 'build' | 'serve' = 'build';
@@ -279,20 +271,6 @@ export function miniappManifest(options: MiniappManifestOptions = {}): MiniappMa
       command = resolved.command;
       hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
     },
-    async buildStart() {
-      if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1') return;
-      try {
-        await (options.enforceSdkVersion ?? defaultEnforceRemoteSdkVersion)({
-          sdkVersion: resolveSdkVersion(),
-          environment: resolveHeyboxApiBaseUrl({ env: process.env }),
-          serviceTag: process.env.HB_SDK_SERVICE_TAG,
-          allowPrerelease: true,
-        });
-      } catch (error) {
-        priorBuildError = toError(error);
-        throw priorBuildError;
-      }
-    },
     buildEnd(error) {
       if (error) {
         priorBuildError = priorBuildError ?? toError(error);
@@ -404,7 +382,7 @@ export default defineConfig({
 
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
 
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 
 失败与警告语义：
 

package/skill/references/cli.md

@@ -165,11 +165,11 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 
 `manifest.json` 仅作为提交审核接口的 `manifest` 字段提交，不会上传到 CDN。Vite 项目通过 `miniappManifest()` 插件生成；CLI 不会自动注入插件，请在 `vite.config.ts` 中显式挂载。小程序构建产物需要使用相对资源路径；`hb-sdk create` 模板会显式配置 `base: './'`，未配置 `base` 的项目也会由 `miniappManifest()` 在 build 时默认补成 `./`。构建产物只能在兼容的小黑盒 Runtime 中启动，普通浏览器直接打开时不会执行标准业务脚本。
 
-`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。开发者手动执行 Vite build 时仍会运行最低 SDK 版本门禁。
+`dev`、手动 Vite build、`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。
 
 默认发布策略是 `auto_publish=false`：运营审核通过后使用 `hb-sdk remote versions` 查看版本状态，再用 `hb-sdk remote release <version>` 发布。需要审核通过后自动发布并下架旧线上版本时，使用 `--auto-publish`。如需让指定用户预览未发布候选版本，使用 `hb-sdk remote allowlist add <heybox_id>` 管理预览白名单。
 
-内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`；手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query，deploy 子构建不执行该门禁。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
+内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
 
 `hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.2+skill.f2a041bb2256",
+  "skillVersion": "0.6.3+skill.e46d946d0d66",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.2",
-    "compatibility": "0.6.2"
+    "version": "0.6.3",
+    "compatibility": "0.6.3"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-f2a041bb22563610e0fcaa991e2e5a2a94c331a029aafe4535083ecf89a4a6b0"
+  "integrity": "sha256-e46d946d0d668d1f9fc60d49d0552ff3f7d8c15d69823e979b20307cdcb42a36"
 }

package/types/miniapp-publish/index.d.ts

@@ -2,7 +2,6 @@ export declare const MINIAPP_UPLOAD_SCOPE = "activity";
 export declare const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 export declare const MINIAPP_UPLOAD_BATCH_SIZE = 50;
 export declare const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES: number;
-export declare const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = "/user_miniprogram/public/sdk_config";
 export declare const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = "/mall/developer/user_miniprogram/access_status";
 export declare const DEVELOPER_ENTITY_LIST_API_PATH = "/mall/developer/entity/list";
 export declare const DEVELOPER_ENTITY_SWITCH_API_PATH = "/mall/developer/entity/switch";

package/types/vite/index.d.ts

@@ -1,18 +1,12 @@
-import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
 type MiniappManifestPlugin = {
     name: string;
     config: (config: MiniappManifestUserConfig) => MiniappManifestUserConfig | void;
     configResolved: (resolved: MiniappManifestResolvedConfig) => void;
-    buildStart: () => Promise<void>;
     /** Rollup 在构建失败后仍会跑 closeBundle；用 buildEnd 记录真实错误，避免二次校验掩盖原因。 */
     buildEnd: (error?: Error) => void;
     transformIndexHtml: (html: string) => string;
     closeBundle: (this: MiniappManifestPluginContext) => Promise<void>;
 };
-export interface MiniappManifestOptions {
-    /** 仅供平台测试和自托管 Remote Environment adapter 使用。 */
-    enforceSdkVersion?: typeof defaultEnforceRemoteSdkVersion;
-}
 interface MiniappManifestUserConfig {
     base?: string;
     define?: Record<string, string>;
@@ -37,5 +31,5 @@ interface MiniappManifestResolvedConfig {
         };
     };
 }
-export declare function miniappManifest(options?: MiniappManifestOptions): MiniappManifestPlugin;
+export declare function miniappManifest(): MiniappManifestPlugin;
 export {};

package/types/cli/auth/base-url.d.ts

@@ -1,20 +0,0 @@
-export interface HeyboxBaseUrlEnv extends NodeJS.ProcessEnv {
-    HB_SDK_API_BASE_URL?: string;
-    HB_SDK_ALLOW_UNSAFE_API_BASE_URL?: string;
-    HB_SDK_LOGIN_BASE_URL?: string;
-}
-export interface HeyboxBaseUrlResolveOptions {
-    env?: HeyboxBaseUrlEnv;
-}
-export interface HeyboxApiBaseUrlResolveOptions extends HeyboxBaseUrlResolveOptions {
-    allowUnsafeApiBaseUrl?: boolean;
-    apiBaseUrl?: string;
-}
-export interface HeyboxLoginBaseUrlResolveOptions extends HeyboxBaseUrlResolveOptions {
-    loginBaseUrl?: string;
-}
-export declare const HEYBOX_API_BASE_URL = "https://api.xiaoheihe.cn";
-export declare const HEYBOX_LOGIN_BASE_URL = "https://login.xiaoheihe.cn";
-export declare function resolveHeyboxApiBaseUrl(options?: HeyboxApiBaseUrlResolveOptions): string;
-export declare function resolveHeyboxLoginBaseUrl(options?: HeyboxLoginBaseUrlResolveOptions): string;
-export declare function normalizeHeyboxOriginUrl(value: string, label: string): string;

package/types/cli/config.d.ts

@@ -1,11 +0,0 @@
-import type { RylaiServiceTagConfig } from '@heybox/hb-types';
-export type HeyboxCliRequestConfig = RylaiServiceTagConfig;
-export declare function configureHeyboxCliRequestConfig(config: HeyboxCliRequestConfig): void;
-export declare function readHeyboxCliRequestConfig(): HeyboxCliRequestConfig;
-/**
- * 当 tag 为非空字符串时，把它设为 CLI 全局 default_tag；为空时不改动现有配置，
- * 避免清掉 env 预设阶段已注入的值。
- */
-export declare function applyServiceTagIfNeeded(tag: unknown): void;
-export declare function resolveHeyboxRylaiServiceTag(pathWithQuery?: string, config?: RylaiServiceTagConfig): string | undefined;
-export declare function normalizeHeyboxRylaiServiceTagConfig(config: HeyboxCliRequestConfig): RylaiServiceTagConfig;

package/types/miniapp-manifest/sdk-version-policy.d.ts

@@ -1,9 +0,0 @@
-export declare function resolveMinimumSdkVersion(options: {
-    cacheDir: string;
-    environment: string;
-    fetchMinimumSdkVersion: () => Promise<string>;
-    now?: number;
-}): Promise<string>;
-export declare function validateCurrentSdkVersion(currentSdkVersion: string, minimumSdkVersion: string, options: {
-    allowPrerelease: boolean;
-}): string;

package/types/vite/sdk-version-gate.d.ts

@@ -1,8 +0,0 @@
-export declare function enforceViteSdkVersion(options: {
-    sdkVersion: string;
-    environment: string;
-    fetchImpl?: typeof fetch;
-    cacheDir?: string;
-    allowPrerelease: boolean;
-    serviceTag?: string;
-}): Promise<string>;