@heybox/hb-sdk 0.6.6-alpha.2 → 0.6.6-alpha.3

package/dist/cli-chunks/{session-CTcelATz.cjs → session-YJ8xNESM.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-ByDy5HXi.cjs');
+var index = require('./index-QAkYgxPI.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-ByDy5HXi.cjs');
+var index = require('./cli-chunks/index-QAkYgxPI.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/mock-host/main.js

@@ -4245,15 +4245,150 @@ function getPositiveNumber(value, fallback) {
     return numberValue;
 }
 
+const MINI_PROGRAM_DEV_SHELL_PROTOCOL = 'heybox-mini-dev:';
+function isMiniProgramDevShellHref(href) {
+    try {
+        return isMiniProgramDevShellUrl(new URL(href));
+    }
+    catch {
+        return false;
+    }
+}
+function isMiniProgramDevShellUrl(url) {
+    return url.protocol === MINI_PROGRAM_DEV_SHELL_PROTOCOL;
+}
+
+function readMiniProgramRuntimeSharePostOptions(value, options) {
+    if (value === undefined || value === null) {
+        return {};
+    }
+    if (!isMiniProgramRuntimeRecord(value)) {
+        return invalidSharePostResult(`${options.method} post 必须是对象或 null`);
+    }
+    const topicIds = readTopicIds(value.topicIds);
+    const topics = readTopics(value.topics);
+    const invalidMessages = [...topicIds.invalidMessages, ...topics.invalidMessages];
+    let normalizedTopicIds = topicIds.values;
+    if (options.maxTopicIds !== undefined && normalizedTopicIds.length > options.maxTopicIds) {
+        invalidMessages.push(`${options.method} post.topicIds 最多允许 ${options.maxTopicIds} 项`);
+        normalizedTopicIds = normalizedTopicIds.slice(0, options.maxTopicIds);
+    }
+    const post = createNormalizedPostOptions(normalizedTopicIds, topics.values);
+    if (!post) {
+        invalidMessages.push(`${options.method} post 至少需要一个有效的 topicIds 或 topics`);
+    }
+    return {
+        post,
+        invalidMessage: invalidMessages[0],
+    };
+}
+function handleMiniProgramRuntimeSharePostValidation(result, platformAdapter, invoke) {
+    if (!result.invalidMessage) {
+        return invoke(result.post);
+    }
+    const invalidMessage = result.invalidMessage;
+    return isMiniProgramShareDevelopmentRuntime(platformAdapter).then((isDevelopment) => {
+        if (isDevelopment) {
+            throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', invalidMessage);
+        }
+        return invoke(result.post);
+    });
+}
+function readTopicIds(value) {
+    if (value === undefined) {
+        return { values: [], invalidMessages: [] };
+    }
+    if (!Array.isArray(value)) {
+        return { values: [], invalidMessages: ['post.topicIds 必须是数组'] };
+    }
+    const values = [];
+    const seen = new Set();
+    const invalidMessages = [];
+    for (const item of value) {
+        const normalized = normalizeTopicId(item);
+        if (!normalized) {
+            invalidMessages.push('post.topicIds 每项必须是正整数或非空字符串');
+            continue;
+        }
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            values.push(normalized);
+        }
+    }
+    return { values, invalidMessages };
+}
+function readTopics(value) {
+    if (value === undefined) {
+        return { values: [], invalidMessages: [] };
+    }
+    if (!Array.isArray(value)) {
+        return { values: [], invalidMessages: ['post.topics 必须是数组'] };
+    }
+    const values = [];
+    const seen = new Set();
+    const invalidMessages = [];
+    for (const item of value) {
+        const normalized = typeof item === 'string' ? item.trim() : '';
+        if (!normalized || normalized.startsWith('#') || normalized.endsWith('#')) {
+            invalidMessages.push('post.topics 每项必须是不含首尾 # 的非空字符串');
+            continue;
+        }
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            values.push(normalized);
+        }
+    }
+    return { values, invalidMessages };
+}
+function normalizeTopicId(value) {
+    if (typeof value === 'number') {
+        return Number.isSafeInteger(value) && value > 0 ? String(value) : undefined;
+    }
+    if (typeof value === 'string') {
+        return value.trim() || undefined;
+    }
+    return undefined;
+}
+function createNormalizedPostOptions(topicIds, topics) {
+    if (topicIds.length === 0 && topics.length === 0) {
+        return undefined;
+    }
+    return {
+        ...(topicIds.length > 0 ? { topicIds } : {}),
+        ...(topics.length > 0 ? { topics } : {}),
+    };
+}
+function invalidSharePostResult(message) {
+    return { invalidMessage: message };
+}
+async function isMiniProgramShareDevelopmentRuntime(platformAdapter) {
+    try {
+        if (isMiniProgramDevShellHref(platformAdapter.app.getCurrentHref())) {
+            return true;
+        }
+    }
+    catch {
+        // 环境读取失败时继续使用宿主的显式开发态判断。
+    }
+    try {
+        return Boolean(await platformAdapter.app.isDevRuntime?.());
+    }
+    catch {
+        return false;
+    }
+}
+
 /** 截图并唤起分享。 */
 function shareMiniProgramRuntimeScreenshot(payload, platformAdapter) {
     const options = readMiniProgramScreenshotOptions(payload);
     const rect = options.rect || getMiniProgramRuntimeViewportRect(platformAdapter);
-    return platformAdapter.share.shareScreenshot({
+    const postResult = readMiniProgramRuntimeSharePostOptions(payload && typeof payload === 'object' ? payload.post : undefined, { method: 'share.screenshot' });
+    return handleMiniProgramRuntimeSharePostValidation(postResult, platformAdapter, (post) => platformAdapter.share.shareScreenshot({
         rect,
         delay: options.delay,
         saveToAlbum: options.saveToAlbum,
-    });
+        post,
+    }));
 }
 function readMiniProgramScreenshotOptions(payload) {
     if (payload === undefined || payload === null) {
@@ -4288,7 +4423,17 @@ function readScreenshotRect(value) {
 
 /** 展示基础分享面板。 */
 function showMiniProgramRuntimeShareMenu(payload, platformAdapter, context = {}) {
-    return platformAdapter.share.showShareMenu(readMiniProgramShareMenuOptions(payload, platformAdapter, context));
+    const options = readMiniProgramShareMenuOptions(payload, platformAdapter, context);
+    let postResult = readMiniProgramRuntimeSharePostOptions(payload.post, {
+        maxTopicIds: 1,
+        method: 'share.showShareMenu',
+    });
+    if (options.channel && postResult.post) {
+        postResult = {
+            invalidMessage: postResult.invalidMessage || 'share.showShareMenu channel 与 post 不能同时使用',
+        };
+    }
+    return handleMiniProgramRuntimeSharePostValidation(postResult, platformAdapter, (post) => platformAdapter.share.showShareMenu({ ...options, post }));
 }
 function readMiniProgramShareMenuOptions(payload, platformAdapter, context) {
     assertMiniProgramRuntimeRecord(payload, 'share.showShareMenu 参数必须是对象');
@@ -5201,6 +5346,7 @@ function createBrowserMockRuntimePlatformAdapter(options) {
     return {
         app: {
             getCurrentHref: options.getCurrentHref,
+            isDevRuntime: () => true,
         },
         launch: {
             async getMiniProgramInfo() {

package/dist/index.cjs.js

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.2';
+    : '0.6.6-alpha.3';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.2';
+    : '0.6.6-alpha.3';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/templates/vue3-vite-ts/README.md.ejs

@@ -20,8 +20,8 @@ npm run deploy
 ## 开发模式
 
 - `npm run dev`：打开本地调试页，可以使用浏览器 Mock，也可以在 Mac 版 APP 或手机小黑盒 APP 中验收。手机和电脑需要处于同一局域网。
-- `npm run build`：先执行 TypeScript 检查，再构建生产产物。
-- `npm run deploy -- --release-note "..."`：检查、构建、上传并提交审核。首次提交前先运行 `npx hb-sdk login`，再用 `npx hb-sdk remote create` 创建小程序，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定已有小程序。审核通过后，用 `hb-sdk remote release <version>` 发布。
+- `npm run build`：先执行 TypeScript 检查，再通过 `hb-sdk build` 构建生产产物。
+- `npm run deploy -- --release-note "..."`：检查、执行项目的 `scripts.build`、上传并提交审核。首次提交前先运行 `npx hb-sdk login`，再用 `npx hb-sdk remote create` 创建小程序，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定已有小程序。审核通过后，用 `hb-sdk remote release <version>` 发布。
 
 ## 更多能力
 

package/dist/templates/vue3-vite-ts/package.json.ejs

@@ -10,7 +10,7 @@
     "hb-sdk": "hb-sdk",
     "dev": "hb-sdk dev",
     "deploy": "hb-sdk remote deploy",
-    "build": "vue-tsc --noEmit && vite build",
+    "build": "vue-tsc --noEmit && hb-sdk build",
     "preview": "vite preview",
     "typecheck": "vue-tsc --noEmit",
     "test:unit": "vitest run",

package/dist/vite.cjs.js

@@ -7,7 +7,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.2';
+    : '0.6.6-alpha.3';
 
 var re = {exports: {}};
 
@@ -11445,7 +11445,23 @@ const URL_ATTRIBUTES = {
     track: ['src'],
     video: ['src', 'poster'],
 };
-function enforceMiniappHtmlPolicy(html) {
+const PRODUCTION_CSP = [
+    "default-src 'none'",
+    "connect-src 'none'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "media-src 'self' blob:",
+    "manifest-src 'self'",
+    "frame-src 'none'",
+    "child-src 'none'",
+    "worker-src 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+].join('; ');
+function enforceMiniappHtmlPolicy(html, options = {}) {
     const document = parse(html);
     const htmlElement = findElement(document, 'html');
     const head = findElement(htmlElement ?? document, 'head');
@@ -11455,6 +11471,22 @@ function enforceMiniappHtmlPolicy(html) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
+    const content = options.hmrWebSocketUrl
+        ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
+        : PRODUCTION_CSP;
+    head.childNodes.unshift({
+        nodeName: 'meta',
+        tagName: 'meta',
+        attrs: [
+            { name: 'http-equiv', value: 'Content-Security-Policy' },
+            { name: 'content', value: content },
+            { name: 'data-heybox-platform-csp', value: '' },
+        ],
+        namespaceURI: 'http://www.w3.org/1999/xhtml',
+        childNodes: [],
+        parentNode: head,
+        sourceCodeLocation: undefined,
+    });
     return serialize(document);
 }
 function validateElement(element) {
@@ -11553,6 +11585,8 @@ const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
     let root = process.cwd();
     let outDir = 'dist';
+    let command = 'build';
+    let hmrWebSocketUrl;
     /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
     let priorBuildError;
     return {
@@ -11569,6 +11603,8 @@ function miniappManifest() {
         configResolved(resolved) {
             root = resolved.root;
             outDir = resolved.build.outDir;
+            command = resolved.command;
+            hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         buildEnd(error) {
             if (error) {
@@ -11576,7 +11612,7 @@ function miniappManifest() {
             }
         },
         transformIndexHtml(html) {
-            return enforceMiniappHtmlPolicy(html);
+            return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
         },
         async closeBundle() {
             // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11635,5 +11671,16 @@ function resolveSdkVersion() {
     }
     return packageJson.version;
 }
+function resolveHmrWebSocketUrl(resolved) {
+    const hmr = resolved.server.hmr;
+    if (hmr === false)
+        return undefined;
+    const options = typeof hmr === 'object' ? hmr : {};
+    const protocol = options.protocol ?? 'ws';
+    const configuredHost = options.host ?? resolved.server.host;
+    const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
+    const port = options.clientPort ?? options.port ?? resolved.server.port;
+    return `${protocol}://${host}${port ? `:${port}` : ''}`;
+}
 
 exports.miniappManifest = miniappManifest;

package/dist/vite.esm.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.2';
+    : '0.6.6-alpha.3';
 
 var re = {exports: {}};
 
@@ -11442,7 +11442,23 @@ const URL_ATTRIBUTES = {
     track: ['src'],
     video: ['src', 'poster'],
 };
-function enforceMiniappHtmlPolicy(html) {
+const PRODUCTION_CSP = [
+    "default-src 'none'",
+    "connect-src 'none'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "media-src 'self' blob:",
+    "manifest-src 'self'",
+    "frame-src 'none'",
+    "child-src 'none'",
+    "worker-src 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+].join('; ');
+function enforceMiniappHtmlPolicy(html, options = {}) {
     const document = parse(html);
     const htmlElement = findElement(document, 'html');
     const head = findElement(htmlElement ?? document, 'head');
@@ -11452,6 +11468,22 @@ function enforceMiniappHtmlPolicy(html) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
+    const content = options.hmrWebSocketUrl
+        ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
+        : PRODUCTION_CSP;
+    head.childNodes.unshift({
+        nodeName: 'meta',
+        tagName: 'meta',
+        attrs: [
+            { name: 'http-equiv', value: 'Content-Security-Policy' },
+            { name: 'content', value: content },
+            { name: 'data-heybox-platform-csp', value: '' },
+        ],
+        namespaceURI: 'http://www.w3.org/1999/xhtml',
+        childNodes: [],
+        parentNode: head,
+        sourceCodeLocation: undefined,
+    });
     return serialize(document);
 }
 function validateElement(element) {
@@ -11550,6 +11582,8 @@ const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
     let root = process.cwd();
     let outDir = 'dist';
+    let command = 'build';
+    let hmrWebSocketUrl;
     /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
     let priorBuildError;
     return {
@@ -11566,6 +11600,8 @@ function miniappManifest() {
         configResolved(resolved) {
             root = resolved.root;
             outDir = resolved.build.outDir;
+            command = resolved.command;
+            hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         buildEnd(error) {
             if (error) {
@@ -11573,7 +11609,7 @@ function miniappManifest() {
             }
         },
         transformIndexHtml(html) {
-            return enforceMiniappHtmlPolicy(html);
+            return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
         },
         async closeBundle() {
             // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11632,5 +11668,16 @@ function resolveSdkVersion() {
     }
     return packageJson.version;
 }
+function resolveHmrWebSocketUrl(resolved) {
+    const hmr = resolved.server.hmr;
+    if (hmr === false)
+        return undefined;
+    const options = typeof hmr === 'object' ? hmr : {};
+    const protocol = options.protocol ?? 'ws';
+    const configuredHost = options.host ?? resolved.server.host;
+    const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
+    const port = options.clientPort ?? options.port ?? resolved.server.port;
+    return `${protocol}://${host}${port ? `:${port}` : ''}`;
+}
 
 export { miniappManifest };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.6-alpha.2",
+  "version": "0.6.6-alpha.3",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",

package/skill/SKILL.md

@@ -11,7 +11,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 
 1. If the task is workshop mini-program business code, use the root package import path `@heybox/hb-sdk`.
 2. If the task is parent-container runtime, bridge-server, protocol contract, or `@heybox/hb-sdk-runtime` work, use `@heybox/hb-sdk/protocol` only for shared constants and types.
-3. If the task is project scaffolding, local startup, browser Mock, device debugging, CLI login, Agent Skill diagnosis, or CLI troubleshooting, use the `hb-sdk` CLI workflow.
+3. If the task is project scaffolding, local startup, production build, browser Mock, device debugging, CLI login, Agent Skill diagnosis, or CLI troubleshooting, use the `hb-sdk` CLI workflow.
 4. If the task is reviewing a mini-program for submission, listing, audit, publishing, content compliance, data/privacy compliance, runtime quality, or icon/cover design requirements, use the online publishing rules workflow.
 5. If the task asks for direct login-state extraction, cookies, tokens, raw Heybox client protocols, or internal hb-sdk package paths, refuse that approach and use the public SDK or CLI boundary instead.
 6. If the task is not about Heybox workshop mini-program SDK usage, CLI usage, protocol contracts, or listing/audit/compliance review, do not apply this skill.
@@ -21,7 +21,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 1. For root SDK imports, singleton usage, modules, and errors, read `references/api-root.md`.
 2. For host/runtime protocol contracts only, read `references/api-protocol.md`. Do not use this reference for mini-program business code.
 3. For common business flows, read `references/recipes.md`.
-4. For CLI commands, local debugging, device debugging, CLI login, Agent Skill doctor, and update reminders, read `references/cli.md`.
+4. For CLI commands, production builds, local debugging, device debugging, CLI login, Agent Skill doctor, and update reminders, read `references/cli.md`.
 5. For allowed/forbidden capabilities and security boundaries, read `references/safety-boundaries.md`.
 6. For Vite build manifest behavior, read `references/api-root.md` and `references/safety-boundaries.md`.
 7. For generated documentation provenance and deeper API lookup paths, read `references/llms-index.md`.
@@ -45,30 +45,35 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 5. Handle `HbMiniProgramNetworkError` separately when HTTP completed but `validateStatus` rejected the status.
 6. Cancel lifecycle/event subscriptions returned by `on()` when the page or component unmounts.
 7. Use the default SDK instance exposed by the root package.
+8. Use `share.showShareMenu({ post })` or `share.screenshot({ post })` to preset editable community destinations and topics. Pass partition IDs through `topicIds` and topic text without surrounding `#` through `topics`; do not construct the underlying client post protocol.
 
 ## Step 5: Use CLI workflows
 
 1. Use `hb-sdk create <project-name>` to scaffold a workshop mini-program.
 2. Use `hb-sdk dev` for browser, Mac App, or mobile App debugging. These entries remain available without CLI login or project binding, but managed capabilities are denied by default.
 3. Use `--port`, `--mock-port`, and `--no-open` when the default local ports or browser opening behavior need to be controlled.
-4. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for development and publishing commands. This login does not change the mini-program user's login state.
-5. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
-6. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
-7. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management.
-8. Use `hb-sdk remote deploy --release-note <text>` to check, build, upload, and submit the current project for audit. Do not recommend the removed top-level `hb-sdk deploy` alias.
-9. After approval, use `hb-sdk remote release <version>` for manual release or `--auto-publish` when an eligible low-risk version should release automatically.
-10. Treat approval, release, and public display as separate states. Do not promise square, search, or recommendation visibility after release.
-11. Use `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and square visibility commands only after showing the target and obtaining required confirmation.
-12. Use `--json` for script consumption and `--verbose` only when concise output is insufficient for diagnosis.
-13. Use `hb-sdk doctor` to diagnose whether the local Skill matches the installed SDK; follow its output to install or refresh the Skill.
-14. Do not print or expose cookies, tokens, private headers, or other credentials.
+4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
+5. Keep `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the required Manifest or Runtime gate output is missing.
+6. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
+7. Existing projects may continue to use `vite build`; do not auto-migrate them. Do not invent `--mode`, `--json`, config, or output-directory flags for `hb-sdk build`.
+8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for development and publishing commands. This login does not change the mini-program user's login state.
+9. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
+10. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
+11. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management.
+12. Use `hb-sdk remote deploy --release-note <text>` to run the project's `scripts.build`, upload, and submit the current project for audit. Do not recommend the removed top-level `hb-sdk deploy` alias.
+13. After approval, use `hb-sdk remote release <version>` for manual release or `--auto-publish` when an eligible low-risk version should release automatically.
+14. Treat approval, release, and public display as separate states. Do not promise square, search, or recommendation visibility after release.
+15. Use `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and square visibility commands only after showing the target and obtaining required confirmation.
+16. Use `--json` for remote script consumption and `--verbose` only when concise output is insufficient for diagnosis.
+17. Use `hb-sdk doctor` to diagnose whether the local Skill matches the installed SDK; follow its output to install or refresh the Skill.
+18. Do not print or expose cookies, tokens, private headers, or other credentials.
 
 ## Step 6: Preserve capability boundaries
 
 For workshop mini-program business code:
 
 1. Do not read or request tokens, cookies, phone numbers, or private credentials from the SDK.
-2. Do not expose raw share protocol fields, JS callbacks, activity reporting, custom buttons, post publishing, or upload-only flows.
+2. Do not expose raw share protocol fields, JS callbacks, activity reporting, custom buttons, direct post publishing, or upload-only flows. Public `share.*({ post })` options only preset an editable client post flow and never publish automatically.
 3. Do not use unsupported storage operations such as delete, clear, info listing, or global client storage access.
 4. Use only the public `network.request` configuration.
 5. Do not use private package paths or client protocols.

package/skill/references/api-protocol.md

@@ -144,6 +144,7 @@ export type {
   MiniProgramScreenshotOptions,
   MiniProgramScreenshotRect,
   MiniProgramShareChannel,
+  MiniProgramSharePostOptions,
   MiniProgramShowShareMenuOptions,
 } from './modules/share';
 export type { GetStoragePayload, GetStorageResult, SetStoragePayload } from './modules/storage';
@@ -222,7 +223,7 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成，不
 
 | 导出面 | Classes | Functions | Interfaces | Types | Constants |
 | --- | ---: | ---: | ---: | ---: | ---: |
-| Root API | 2 | 3 | 66 | 57 | 0 |
-| Protocol API | 0 | 3 | 43 | 67 | 32 |
+| Root API | 2 | 3 | 67 | 57 | 0 |
+| Protocol API | 0 | 3 | 44 | 67 | 32 |
 | Miniapp Publish API | 0 | 5 | 2 | 0 | 0 |
 | Vite API | 0 | 1 | 0 | 0 | 0 |