@heybox/hb-sdk 0.6.6-alpha.2 → 0.6.6-alpha.4

package/dist/vite.cjs.js

@@ -2,12 +2,13 @@
 
 var node_fs = require('node:fs');
 var path = require('node:path');
+var node_async_hooks = require('node:async_hooks');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.2';
+    : '0.6.6-alpha.4';
 
 var re = {exports: {}};
 
@@ -11445,7 +11446,23 @@ const URL_ATTRIBUTES = {
     track: ['src'],
     video: ['src', 'poster'],
 };
-function enforceMiniappHtmlPolicy(html) {
+const PRODUCTION_CSP = [
+    "default-src 'none'",
+    "connect-src 'none'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "media-src 'self' blob:",
+    "manifest-src 'self'",
+    "frame-src 'none'",
+    "child-src 'none'",
+    "worker-src 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+].join('; ');
+function enforceMiniappHtmlPolicy(html, options = {}) {
     const document = parse(html);
     const htmlElement = findElement(document, 'html');
     const head = findElement(htmlElement ?? document, 'head');
@@ -11455,6 +11472,25 @@ function enforceMiniappHtmlPolicy(html) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
+    if (options.skipPlatformCsp) {
+        return serialize(document);
+    }
+    const content = options.hmrWebSocketUrl
+        ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
+        : PRODUCTION_CSP;
+    head.childNodes.unshift({
+        nodeName: 'meta',
+        tagName: 'meta',
+        attrs: [
+            { name: 'http-equiv', value: 'Content-Security-Policy' },
+            { name: 'content', value: content },
+            { name: 'data-heybox-platform-csp', value: '' },
+        ],
+        namespaceURI: 'http://www.w3.org/1999/xhtml',
+        childNodes: [],
+        parentNode: head,
+        sourceCodeLocation: undefined,
+    });
     return serialize(document);
 }
 function validateElement(element) {
@@ -11548,11 +11584,23 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
+const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
+const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
+const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
+new node_async_hooks.AsyncLocalStorage();
+Promise.resolve();
+function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
+    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
+}
+
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
+    const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
+    let command = 'build';
+    let hmrWebSocketUrl;
     /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
     let priorBuildError;
     return {
@@ -11569,6 +11617,8 @@ function miniappManifest() {
         configResolved(resolved) {
             root = resolved.root;
             outDir = resolved.build.outDir;
+            command = resolved.command;
+            hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         buildEnd(error) {
             if (error) {
@@ -11576,7 +11626,10 @@ function miniappManifest() {
             }
         },
         transformIndexHtml(html) {
-            return enforceMiniappHtmlPolicy(html);
+            return enforceMiniappHtmlPolicy(html, {
+                ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
+                skipPlatformCsp,
+            });
         },
         async closeBundle() {
             // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11598,7 +11651,7 @@ function miniappManifest() {
             if (!htmlFiles.includes(indexHtmlPath)) {
                 throw new Error('构建产物必须包含入口 dist/index.html');
             }
-            node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8')));
+            node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
             const manifestPath = path.join(outputRoot, 'manifest.json');
             node_fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
             node_fs.writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
@@ -11635,5 +11688,16 @@ function resolveSdkVersion() {
     }
     return packageJson.version;
 }
+function resolveHmrWebSocketUrl(resolved) {
+    const hmr = resolved.server.hmr;
+    if (hmr === false)
+        return undefined;
+    const options = typeof hmr === 'object' ? hmr : {};
+    const protocol = options.protocol ?? 'ws';
+    const configuredHost = options.host ?? resolved.server.host;
+    const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
+    const port = options.clientPort ?? options.port ?? resolved.server.port;
+    return `${protocol}://${host}${port ? `:${port}` : ''}`;
+}
 
 exports.miniappManifest = miniappManifest;

package/dist/vite.esm.js

@@ -1,10 +1,11 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
 
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.2';
+    : '0.6.6-alpha.4';
 
 var re = {exports: {}};
 
@@ -11442,7 +11443,23 @@ const URL_ATTRIBUTES = {
     track: ['src'],
     video: ['src', 'poster'],
 };
-function enforceMiniappHtmlPolicy(html) {
+const PRODUCTION_CSP = [
+    "default-src 'none'",
+    "connect-src 'none'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "media-src 'self' blob:",
+    "manifest-src 'self'",
+    "frame-src 'none'",
+    "child-src 'none'",
+    "worker-src 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+].join('; ');
+function enforceMiniappHtmlPolicy(html, options = {}) {
     const document = parse(html);
     const htmlElement = findElement(document, 'html');
     const head = findElement(htmlElement ?? document, 'head');
@@ -11452,6 +11469,25 @@ function enforceMiniappHtmlPolicy(html) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
+    if (options.skipPlatformCsp) {
+        return serialize(document);
+    }
+    const content = options.hmrWebSocketUrl
+        ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
+        : PRODUCTION_CSP;
+    head.childNodes.unshift({
+        nodeName: 'meta',
+        tagName: 'meta',
+        attrs: [
+            { name: 'http-equiv', value: 'Content-Security-Policy' },
+            { name: 'content', value: content },
+            { name: 'data-heybox-platform-csp', value: '' },
+        ],
+        namespaceURI: 'http://www.w3.org/1999/xhtml',
+        childNodes: [],
+        parentNode: head,
+        sourceCodeLocation: undefined,
+    });
     return serialize(document);
 }
 function validateElement(element) {
@@ -11545,11 +11581,23 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
+const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
+const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
+const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
+new AsyncLocalStorage();
+Promise.resolve();
+function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
+    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
+}
+
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
+    const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
+    let command = 'build';
+    let hmrWebSocketUrl;
     /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
     let priorBuildError;
     return {
@@ -11566,6 +11614,8 @@ function miniappManifest() {
         configResolved(resolved) {
             root = resolved.root;
             outDir = resolved.build.outDir;
+            command = resolved.command;
+            hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
         buildEnd(error) {
             if (error) {
@@ -11573,7 +11623,10 @@ function miniappManifest() {
             }
         },
         transformIndexHtml(html) {
-            return enforceMiniappHtmlPolicy(html);
+            return enforceMiniappHtmlPolicy(html, {
+                ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
+                skipPlatformCsp,
+            });
         },
         async closeBundle() {
             // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11595,7 +11648,7 @@ function miniappManifest() {
             if (!htmlFiles.includes(indexHtmlPath)) {
                 throw new Error('构建产物必须包含入口 dist/index.html');
             }
-            writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
+            writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
             const manifestPath = path.join(outputRoot, 'manifest.json');
             mkdirSync(path.dirname(manifestPath), { recursive: true });
             writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
@@ -11632,5 +11685,16 @@ function resolveSdkVersion() {
     }
     return packageJson.version;
 }
+function resolveHmrWebSocketUrl(resolved) {
+    const hmr = resolved.server.hmr;
+    if (hmr === false)
+        return undefined;
+    const options = typeof hmr === 'object' ? hmr : {};
+    const protocol = options.protocol ?? 'ws';
+    const configuredHost = options.host ?? resolved.server.host;
+    const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
+    const port = options.clientPort ?? options.port ?? resolved.server.port;
+    return `${protocol}://${host}${port ? `:${port}` : ''}`;
+}
 
 export { miniappManifest };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.6-alpha.2",
+  "version": "0.6.6-alpha.4",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -93,7 +93,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.5"
+    "@heybox/hb-api": "~1.25.6"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/SKILL.md

@@ -11,7 +11,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 
 1. If the task is workshop mini-program business code, use the root package import path `@heybox/hb-sdk`.
 2. If the task is parent-container runtime, bridge-server, protocol contract, or `@heybox/hb-sdk-runtime` work, use `@heybox/hb-sdk/protocol` only for shared constants and types.
-3. If the task is project scaffolding, local startup, browser Mock, device debugging, CLI login, Agent Skill diagnosis, or CLI troubleshooting, use the `hb-sdk` CLI workflow.
+3. If the task is project scaffolding, local startup, production build, browser Mock, device debugging, CLI login, Agent Skill diagnosis, or CLI troubleshooting, use the `hb-sdk` CLI workflow.
 4. If the task is reviewing a mini-program for submission, listing, audit, publishing, content compliance, data/privacy compliance, runtime quality, or icon/cover design requirements, use the online publishing rules workflow.
 5. If the task asks for direct login-state extraction, cookies, tokens, raw Heybox client protocols, or internal hb-sdk package paths, refuse that approach and use the public SDK or CLI boundary instead.
 6. If the task is not about Heybox workshop mini-program SDK usage, CLI usage, protocol contracts, or listing/audit/compliance review, do not apply this skill.
@@ -21,7 +21,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 1. For root SDK imports, singleton usage, modules, and errors, read `references/api-root.md`.
 2. For host/runtime protocol contracts only, read `references/api-protocol.md`. Do not use this reference for mini-program business code.
 3. For common business flows, read `references/recipes.md`.
-4. For CLI commands, local debugging, device debugging, CLI login, Agent Skill doctor, and update reminders, read `references/cli.md`.
+4. For CLI commands, production builds, local debugging, device debugging, CLI login, Agent Skill doctor, and update reminders, read `references/cli.md`.
 5. For allowed/forbidden capabilities and security boundaries, read `references/safety-boundaries.md`.
 6. For Vite build manifest behavior, read `references/api-root.md` and `references/safety-boundaries.md`.
 7. For generated documentation provenance and deeper API lookup paths, read `references/llms-index.md`.
@@ -45,30 +45,35 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 5. Handle `HbMiniProgramNetworkError` separately when HTTP completed but `validateStatus` rejected the status.
 6. Cancel lifecycle/event subscriptions returned by `on()` when the page or component unmounts.
 7. Use the default SDK instance exposed by the root package.
+8. Use `share.showShareMenu({ post })` or `share.screenshot({ post })` to preset editable community destinations and topics. Pass partition IDs through `topicIds` and topic text without surrounding `#` through `topics`; do not construct the underlying client post protocol.
 
 ## Step 5: Use CLI workflows
 
 1. Use `hb-sdk create <project-name>` to scaffold a workshop mini-program.
 2. Use `hb-sdk dev` for browser, Mac App, or mobile App debugging. These entries remain available without CLI login or project binding, but managed capabilities are denied by default.
 3. Use `--port`, `--mock-port`, and `--no-open` when the default local ports or browser opening behavior need to be controlled.
-4. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for development and publishing commands. This login does not change the mini-program user's login state.
-5. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
-6. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
-7. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management.
-8. Use `hb-sdk remote deploy --release-note <text>` to check, build, upload, and submit the current project for audit. Do not recommend the removed top-level `hb-sdk deploy` alias.
-9. After approval, use `hb-sdk remote release <version>` for manual release or `--auto-publish` when an eligible low-risk version should release automatically.
-10. Treat approval, release, and public display as separate states. Do not promise square, search, or recommendation visibility after release.
-11. Use `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and square visibility commands only after showing the target and obtaining required confirmation.
-12. Use `--json` for script consumption and `--verbose` only when concise output is insufficient for diagnosis.
-13. Use `hb-sdk doctor` to diagnose whether the local Skill matches the installed SDK; follow its output to install or refresh the Skill.
-14. Do not print or expose cookies, tokens, private headers, or other credentials.
+4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
+5. Keep `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the required Manifest or Runtime gate output is missing.
+6. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
+7. Existing projects may continue to use `vite build`; do not auto-migrate them. Do not invent `--mode`, `--json`, config, or output-directory flags for `hb-sdk build`.
+8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for development and publishing commands. This login does not change the mini-program user's login state.
+9. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
+10. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
+11. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management.
+12. Use `hb-sdk remote deploy --release-note <text>` to run the project's `scripts.build`, upload, and submit the current project for audit. Do not recommend the removed top-level `hb-sdk deploy` alias.
+13. After approval, use `hb-sdk remote release <version>` for manual release or `--auto-publish` when an eligible low-risk version should release automatically.
+14. Treat approval, release, and public display as separate states. Do not promise square, search, or recommendation visibility after release.
+15. Use `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and square visibility commands only after showing the target and obtaining required confirmation.
+16. Use `--json` for remote script consumption and `--verbose` only when concise output is insufficient for diagnosis.
+17. Use `hb-sdk doctor` to diagnose whether the local Skill matches the installed SDK; follow its output to install or refresh the Skill.
+18. Do not print or expose cookies, tokens, private headers, or other credentials.
 
 ## Step 6: Preserve capability boundaries
 
 For workshop mini-program business code:
 
 1. Do not read or request tokens, cookies, phone numbers, or private credentials from the SDK.
-2. Do not expose raw share protocol fields, JS callbacks, activity reporting, custom buttons, post publishing, or upload-only flows.
+2. Do not expose raw share protocol fields, JS callbacks, activity reporting, custom buttons, direct post publishing, or upload-only flows. Public `share.*({ post })` options only preset an editable client post flow and never publish automatically.
 3. Do not use unsupported storage operations such as delete, clear, info listing, or global client storage access.
 4. Use only the public `network.request` configuration.
 5. Do not use private package paths or client protocols.

package/skill/references/api-protocol.md

@@ -144,6 +144,7 @@ export type {
   MiniProgramScreenshotOptions,
   MiniProgramScreenshotRect,
   MiniProgramShareChannel,
+  MiniProgramSharePostOptions,
   MiniProgramShowShareMenuOptions,
 } from './modules/share';
 export type { GetStoragePayload, GetStorageResult, SetStoragePayload } from './modules/storage';
@@ -222,7 +223,7 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成，不
 
 | 导出面 | Classes | Functions | Interfaces | Types | Constants |
 | --- | ---: | ---: | ---: | ---: | ---: |
-| Root API | 2 | 3 | 66 | 57 | 0 |
-| Protocol API | 0 | 3 | 43 | 67 | 32 |
+| Root API | 2 | 3 | 67 | 57 | 0 |
+| Protocol API | 0 | 3 | 44 | 67 | 32 |
 | Miniapp Publish API | 0 | 5 | 2 | 0 | 0 |
 | Vite API | 0 | 1 | 0 | 0 | 0 |

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.6-alpha.2`
+- Version at generation time: `0.6.6-alpha.4`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -99,6 +99,7 @@ export type {
   MiniProgramScreenshotRect,
   MiniProgramShareChannel,
   MiniProgramShareModule,
+  MiniProgramSharePostOptions,
   MiniProgramShowShareMenuOptions,
   ScreenshotPayload,
   ScreenshotResult,
@@ -203,6 +204,7 @@ import { HB_SDK_VERSION } from '../core/version';
 import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
+import { shouldSkipMiniappPlatformCspFromEnv } from './runtime-permission-env';
 
 type MiniappManifestPlugin = {
   name: string;
@@ -229,15 +231,29 @@ interface MiniappManifestResolvedConfig {
   build: {
     outDir: string;
   };
-  server: Record<string, unknown>;
+  server: {
+    host?: string | boolean;
+    port?: number;
+    hmr?:
+      | boolean
+      | {
+          clientPort?: number;
+          host?: string;
+          port?: number;
+          protocol?: 'ws' | 'wss';
+        };
+  };
 }
 
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 
 export function miniappManifest(): MiniappManifestPlugin {
+  const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
   let root = process.cwd();
   let outDir = 'dist';
+  let command: 'build' | 'serve' = 'build';
+  let hmrWebSocketUrl: string | undefined;
   /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
   let priorBuildError: Error | undefined;
 
@@ -255,6 +271,8 @@ export function miniappManifest(): MiniappManifestPlugin {
     configResolved(resolved) {
       root = resolved.root;
       outDir = resolved.build.outDir;
+      command = resolved.command;
+      hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
     },
     buildEnd(error) {
       if (error) {
@@ -262,7 +280,10 @@ export function miniappManifest(): MiniappManifestPlugin {
       }
     },
     transformIndexHtml(html) {
-      return enforceMiniappHtmlPolicy(html);
+      return enforceMiniappHtmlPolicy(html, {
+        ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
+        skipPlatformCsp,
+      });
     },
     async closeBundle() {
       // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -287,7 +308,7 @@ export function miniappManifest(): MiniappManifestPlugin {
       if (!htmlFiles.includes(indexHtmlPath)) {
         throw new Error('构建产物必须包含入口 dist/index.html');
       }
-      writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
+      writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
 
       const manifestPath = path.join(outputRoot, 'manifest.json');
       mkdirSync(path.dirname(manifestPath), { recursive: true });
@@ -325,11 +346,22 @@ function resolveSdkVersion() {
   }
   return packageJson.version;
 }
+
+function resolveHmrWebSocketUrl(resolved: MiniappManifestResolvedConfig) {
+  const hmr = resolved.server.hmr;
+  if (hmr === false) return undefined;
+  const options = typeof hmr === 'object' ? hmr : {};
+  const protocol = options.protocol ?? 'ws';
+  const configuredHost = options.host ?? resolved.server.host;
+  const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
+  const port = options.clientPort ?? options.port ?? resolved.server.port;
+  return `${protocol}://${host}${port ? `:${port}` : ''}`;
+}
 ```
 
 ## Manifest
 
-`@heybox/hb-sdk/vite` 提供构建时插件 `miniappManifest()`。Vite 项目完成 `vite build` 后，会在输出目录写入 `manifest.json`：
+`@heybox/hb-sdk/vite` 提供构建时插件 `miniappManifest()`。项目通过 `hb-sdk build` 完成生产构建后，会在固定的 `dist/` 中写入 `manifest.json`：
 
 ```json
 {
@@ -338,7 +370,7 @@ function resolveSdkVersion() {
 }
 ```
 
-`version` 来自小程序项目自身的 `package.json.version`，`sdkVersion` 来自当前安装 SDK 的构建版本且不能由业务覆盖。`hb-sdk create` 生成的模板默认已注册插件；现有 Vite 项目可以在 `vite.config.ts` 中手动接入：
+`version` 来自小程序项目自身的 `package.json.version`，`sdkVersion` 来自当前安装 SDK 的构建版本且不能由业务覆盖。`hb-sdk build` 要求项目显式注册这个插件；`hb-sdk create` 生成的模板默认已注册，现有 Vite 项目可以在 `vite.config.ts` 中手动接入：
 
 ```ts
 import { miniappManifest } from '@heybox/hb-sdk/vite';
@@ -354,15 +386,17 @@ export default defineConfig({
 
 工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
 
-插件只接受单页应用：输出目录只能存在入口 `index.html`。build 和 dev 都不会注入平台 CSP；项目已有的 CSP 会原样保留。浏览器原生 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe 和表单等能力不再由 SDK 构建产物统一限制，是否可用由宿主环境、项目自身策略和审核规则共同决定；需要宿主授权的业务网络请求仍应使用 `network.request()`。
+插件只接受单页应用：输出目录只能存在入口 `index.html`。`hb-sdk dev` 和 `hb-sdk remote deploy` 会读取绑定小程序的远端 Runtime 权限；仅当 `network.request` 已启用且 `useOfficialDomain=true` 时跳过平台 CSP，否则 build 会把平台 CSP 插入 `<head>` 首位。直接运行 `vite build`、匿名 dev、非法快照或远端权限读取失败时均继续注入。已有 CSP 始终原样保留；注入平台 CSP 时，两份策略按浏览器交集生效。
+
+平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。跳过平台 CSP 时，这些能力不再由 SDK 构建产物统一限制，但需要宿主授权的业务网络请求仍应使用 `network.request()`。本地 Mock 权限覆盖不会改变构建 CSP，构建判定始终以远端权限快照为准。
 
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 仍会使 build 失败。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 
 失败与警告语义：
 
-- 读取 `package.json` 失败或 JSON 解析失败：`vite build` 直接失败，并输出具体原因。
-- `package.json.version` 不是非空字符串：`vite build` 直接失败。
-- `package.json.version` 仍是模板默认值 `0.0.0`：`vite build` 直接失败，必须改成实际 SemVer。
+- 读取 `package.json` 失败或 JSON 解析失败：build 直接失败，并输出具体原因。
+- `package.json.version` 不是非空字符串：build 直接失败。
+- `package.json.version` 仍是模板默认值 `0.0.0`：build 直接失败，必须改成实际 SemVer。
 - 版本号不是严格 SemVer、包含 build metadata 或缺少 `sdkVersion`：build/deploy 直接失败。
 
 `manifest.json` 不部署到 CDN，只交给发布流水线读取后上送后台；Host 通过后台 API 间接读取版本信息。第一阶段只支持 Vite 项目，非 Vite 打包器未来通过其他子入口扩展。
@@ -519,6 +553,10 @@ await share.showShareMenu({
   title: '我的小程序页面',
   desc: '来自黑盒小程序的分享',
   imageUrl: 'https://imgheybox.max-c.com/demo.png',
+  post: {
+    topicIds: [235709],
+    topics: ['无畏契约战绩'],
+  },
 });
 ```
 
@@ -526,15 +564,23 @@ await share.showShareMenu({
 `/tools/common_share?user_miniprogram_id=...` 分享落地页。只有确实要分享外部
 HTTP(S) 页面时才显式传 `url`。
 
+`post` 用于给“转发到社区”预置可编辑的分区与话题。`topicIds` 接受正整数或非空字符串并按首次出现顺序去重；`topics` 只传话题内容，不要包含首尾 `#`。`showShareMenu()` 只支持一个默认分区，并且不能与 `channel` 同时使用；本地 Mock、App Dev Shell 和开发 Runtime 会直接拒绝这类错误，生产 Runtime 会过滤非法项、只取第一个分区并继续普通分享。`post: null` 等同于不配置。
+
 截图分享：
 
 ```ts
 await share.screenshot({
   delay: 100,
   saveToAlbum: true,
+  post: {
+    topicIds: [235709, 66739],
+    topics: ['无畏契约战绩'],
+  },
 });
 ```
 
+截图分享支持多个预置分区；分区与话题仍由用户在客户端发帖页中确认和修改，SDK 不会直接发布内容。
+
 ### 基础 UI
 
 ```ts

package/skill/references/cli.md

@@ -8,6 +8,7 @@
 - packages/hb-sdk/src/cli/index.ts
 - packages/hb-sdk/src/cli/commands/create.ts
 - packages/hb-sdk/src/cli/commands/dev.ts
+- packages/hb-sdk/src/cli/commands/build.ts
 - packages/hb-sdk/src/cli/commands/login.ts
 - apps/docs/hb-sdk/guide/cli.md
 
@@ -17,6 +18,7 @@
 - [Command surface](#command-surface)
 - [Create a mini-program template](#create-a-mini-program-template)
 - [Local debugging](#local-debugging)
+- [Production build](#production-build)
 - [Deploy and publish](#deploy-and-publish)
 - [Developer account scope](#developer-account-scope)
 - [Remote management commands](#remote-management-commands)
@@ -34,6 +36,7 @@ Use the bundled `hb-sdk` CLI to create a workshop mini-program, open the local d
 ```text
 hb-sdk create <project-name>
 hb-sdk dev [--port <port>] [--mock-port <port>] [--no-open]
+hb-sdk build [--env <name>] [--verbose]
 hb-sdk login
 hb-sdk login status
 hb-sdk login clear
@@ -139,6 +142,35 @@ Dev Context 中调整的 `network.request` 权限不会修改线上配置，但
 
 Use `hb-sdk dev` to open the local debugging page. The "在 Mac 版 APP 中启动" button opens the page in the Mac App; the "Mobile App" QR code opens it in the phone App after a LAN interface is selected. These entries remain available without CLI login or project binding, but managed capabilities are denied by default. The phone and computer must be on the same LAN. If an embedded browser cannot open the App, use the system browser.
 
+## Production build
+
+## 生产构建
+
+```bash
+hb-sdk build [--env <name>] [--verbose]
+```
+
+`hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `vite.config.ts` 中显式注册 `miniappManifest()`。
+
+推荐由项目的 `scripts.build` 保留类型检查：
+
+```json
+{
+  "scripts": {
+    "build": "vue-tsc --noEmit && hb-sdk build"
+  }
+}
+```
+
+构建命令只支持 `--env` 和 `--verbose`。已有项目继续使用 `vite build` 仍然兼容，不会自动迁移。
+
+Agent rules:
+
+- Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry.
+- Require explicit `miniappManifest()` configuration and keep typechecking in the project's `scripts.build`.
+- Do not claim `hb-sdk build` needs login, binding, or network access, and do not invent unsupported build flags.
+- Existing `vite build` projects remain compatible and must not be auto-migrated.
+
 ## Deploy and publish
 
 ## 部署发布
@@ -158,7 +190,7 @@ hb-sdk remote bind mp_xxxxxxxx
 hb-sdk remote deploy --release-note "修复登录状态展示"
 ```
 
-这条命令会完成检查、构建、上传和提交审核。默认在审核通过后等待手动发布；普通低风险版本可以追加 `--auto-publish`。完整命令见 `hb-sdk remote --help`，提交要求见[小程序工坊上架规则](https://docs.xiaoheihe.cn/hb_sdk/guide/mini-program-publishing-rules)。
+这条命令会完成检查、执行项目的 `scripts.build`、上传和提交审核，因此项目定义的类型检查仍会执行。默认在审核通过后等待手动发布；普通低风险版本可以追加 `--auto-publish`。完整命令见 `hb-sdk remote --help`，提交要求见[小程序工坊上架规则](https://docs.xiaoheihe.cn/hb_sdk/guide/mini-program-publishing-rules)。
 
 Before publishing, `hb-sdk remote deploy` verifies that the bound mini-program belongs to the current developer account. If it does not, the command stops and asks the user to switch accounts.