@heybox/hb-sdk 0.6.8-alpha.2 → 0.6.9-alpha.0

package/dist/cli-chunks/{remote-O5_nRdZN.cjs → remote-A4-PKgOn.cjs}

@@ -1,15 +1,16 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-paN77avR.cjs');
-var session = require('./session-CiQplems.cjs');
+var index = require('./index-DofTxdoX.cjs');
+var session = require('./session-D5u3XzHN.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var index$1 = require('./index-v4-6fbXX.cjs');
-var runtimeGate = require('./runtime-gate-DfMJQGH9.cjs');
-var context = require('./context-CP7W_8aR.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DKrhgVM3.cjs');
+var runtimeGate = require('./runtime-gate-BWlU-R4h.cjs');
+var node_crypto = require('node:crypto');
+var context = require('./context-7rmakzS_.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -20,9 +21,9 @@ require('events');
 require('stream');
 require('buffer');
 require('util');
-require('node:crypto');
 require('fs');
 require('constants');
+require('node:async_hooks');
 
 async function getCDNUploadInfo(options, runtime = {}) {
     const body = new URLSearchParams();
@@ -59,6 +60,63 @@ async function postHeyboxApi(pathWithQuery, body, session$1, runtime) {
     return result;
 }
 
+const CREATE_USER_MINIPROGRAM_UPLOAD_SESSION_API_PATH = '/mall/developer/user_miniprogram/version/upload_session/create';
+const RECORD_USER_MINIPROGRAM_UPLOAD_RESULT_API_PATH = '/mall/developer/user_miniprogram/version/upload_session/record';
+async function precheckUserMiniprogramVersion(options, runtime = {}) {
+    return postUserMiniprogramVersionForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
+        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
+        ...(options.version ? { version: options.version } : {}),
+        ...(options.source_version ? { source_version: options.source_version } : {}),
+        release_note: options.releaseNote,
+        auto_publish: String(options.autoPublish),
+    }, runtime);
+}
+async function submitUserMiniprogramAudit(options, runtime = {}) {
+    return postUserMiniprogramVersionForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
+        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
+        ...(options.manifest ? { manifest: JSON.stringify(options.manifest) } : {}),
+        ...(options.source_version ? { source_version: options.source_version } : {}),
+        ...(options.sessionId ? { session_id: options.sessionId } : {}),
+        release_note: options.releaseNote,
+        auto_publish: String(options.autoPublish),
+    }, runtime);
+}
+async function createUserMiniprogramUploadSession(options, runtime = {}) {
+    return postUserMiniprogramVersionForm(CREATE_USER_MINIPROGRAM_UPLOAD_SESSION_API_PATH, options, {
+        version: options.version,
+        artifact_signature: options.artifactSignature,
+        relative_paths: options.relativePaths.join(','),
+        file_sizes: options.fileSizes.map(size => String(size)).join(','),
+    }, runtime);
+}
+async function recordUserMiniprogramUploadResult(options, runtime = {}) {
+    await postUserMiniprogramVersionForm(RECORD_USER_MINIPROGRAM_UPLOAD_RESULT_API_PATH, options, {
+        version: options.version,
+        session_id: options.sessionId,
+        keys: options.keys.join(','),
+    }, runtime);
+}
+async function postUserMiniprogramVersionForm(path, options, fields, runtime) {
+    const fetchImpl = runtime.fetchImpl ?? fetch;
+    const context = session.createHeyboxOpenPlatformRequestContext(options.session, path, {
+        contentType: 'application/x-www-form-urlencoded',
+    });
+    const body = new URLSearchParams();
+    body.set('mini_program_id', options.miniProgramId);
+    for (const [key, value] of Object.entries(fields)) {
+        body.set(key, value);
+    }
+    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
+        method: 'POST',
+        headers: context.headers,
+        body: body.toString(),
+    });
+    const result = await session.readHeyboxApiEnvelope(response, {
+        pathWithQuery: path,
+    });
+    return result ?? {};
+}
+
 const DEFAULT_CONCURRENCY = 4;
 async function runUpload(options, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
@@ -67,9 +125,15 @@ async function runUpload(options, runtime = {}) {
     const getCDNUploadInfo$1 = runtime.getCDNUploadInfo ?? getCDNUploadInfo;
     const getCDNUploadToken$1 = runtime.getCDNUploadToken ?? getCDNUploadToken;
     const postCDNUploadCallback$1 = runtime.postCDNUploadCallback ?? postCDNUploadCallback;
+    const recordUserMiniprogramUploadResult$1 = runtime.recordUserMiniprogramUploadResult ?? recordUserMiniprogramUploadResult;
     const createReadStream = runtime.createReadStream ?? fs.createReadStream;
-    const orderedFiles = [...options.files].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-    const batches = chunkUploadFiles(orderedFiles, index$1.MINIAPP_UPLOAD_BATCH_SIZE);
+    let createCosClient = runtime.createCosClient;
+    if (!createCosClient) {
+        const COS = await loadCosConstructor();
+        createCosClient = ({ uploadToken }) => createDefaultCosClient(uploadToken, COS);
+    }
+    const orderedFiles = runtimePermissionEnv.prepareMiniappArtifactFiles(options.files);
+    const batches = chunkUploadFiles(orderedFiles, runtimePermissionEnv.MINIAPP_UPLOAD_BATCH_SIZE);
     await logger.task(`正在上传 ${orderedFiles.length} 个文件`, async (taskContext) => {
         logger.debug(`上传并发数: ${concurrency}`);
         logger.debug(`上传批次数: ${batches.length}`);
@@ -78,25 +142,37 @@ async function runUpload(options, runtime = {}) {
             const batch = batches[batchIndex];
             logger.debug(`正在处理上传批次 ${batchIndex + 1}/${batches.length}，文件数: ${batch.length}`);
             logger.debug('正在获取 CDN 上传信息');
-            const fileInfos = createUploadFileInfos(batch, options);
-            const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: index$1.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
+            const fileInfos = createUploadFileInfos(batch);
+            const uploadInfo = await getCDNUploadInfo$1({
+                session: options.session,
+                scope: runtimePermissionEnv.MINIAPP_UPLOAD_SCOPE,
+                fileInfos,
+                needCache: false,
+            }, { baseUrl: runtime.baseUrl, fetchImpl });
             logger.debug(`CDN bucket: ${uploadInfo.bucket}`);
             logger.debug(`CDN region: ${uploadInfo.region}`);
-            validateUploadInfoKeys(batch, uploadInfo.keys, options);
+            validateUploadInfoKeys(batch, uploadInfo.keys);
             const indexedFiles = batch.map((file, index) => ({ file, key: uploadInfo.keys[index] }));
-            const batchKeys = indexedFiles.map(({ key }) => key);
-            logger.debug('正在获取 CDN 上传凭证');
-            const uploadToken = await getCDNUploadToken$1({
-                session: options.session,
-                bucket: uploadInfo.bucket,
-                keys: batchKeys,
-                mimetypes: indexedFiles.map(({ file }) => file.mimeType),
-                isMultipartUpload: 0,
-            }, { baseUrl: runtime.baseUrl, fetchImpl });
-            const cos = runtime.createCosClient ? runtime.createCosClient({ session: options.session, uploadToken }) : await createDefaultCosClient(uploadToken);
+            logger.debug('正在获取本批 CDN 上传凭证');
+            let uploadToken;
+            try {
+                uploadToken = await getCDNUploadToken$1({
+                    session: options.session,
+                    bucket: uploadInfo.bucket,
+                    keys: indexedFiles.map(item => item.key),
+                    mimetypes: indexedFiles.map(item => item.file.mimeType),
+                    isMultipartUpload: 0,
+                }, { baseUrl: runtime.baseUrl, fetchImpl });
+            }
+            catch (error) {
+                throw new index.CliError(`获取 CDN 上传凭证失败：${readErrorMessage(error)}`);
+            }
+            const cos = createCosClient({ session: options.session, uploadToken });
+            const successfulKeys = [];
             const queue = indexedFiles.slice();
+            let firstUploadError;
             const workers = Array.from({ length: Math.min(concurrency, indexedFiles.length) }, async () => {
-                while (queue.length > 0) {
+                while (queue.length > 0 && !firstUploadError) {
                     const uploadTask = queue.shift();
                     if (!uploadTask) {
                         return;
@@ -110,6 +186,7 @@ async function runUpload(options, runtime = {}) {
                             ContentLength: uploadTask.file.size,
                             ContentType: uploadTask.file.mimeType,
                         });
+                        successfulKeys.push(uploadTask.key);
                         completed += 1;
                         taskContext.update(`正在上传 ${completed}/${orderedFiles.length} 个文件`);
                         logger.debug(`[${String(completed).padStart(2)}/${orderedFiles.length}] ok ${uploadTask.file.relativePath} (${formatSize(uploadTask.file.size)})`);
@@ -118,13 +195,25 @@ async function runUpload(options, runtime = {}) {
                         completed += 1;
                         const message = readErrorMessage(error);
                         logger.debug(`[${String(completed).padStart(2)}/${orderedFiles.length}] error ${uploadTask.file.relativePath} -> ${message}`);
-                        throw new index.CliError(`上传文件失败：${uploadTask.file.relativePath} -> ${message}`, readVerboseUploadError(uploadTask.file.relativePath, error));
+                        firstUploadError ??= new index.CliError(`上传文件失败：${uploadTask.file.relativePath} -> ${message}`, readVerboseUploadError(uploadTask.file.relativePath, error));
                     }
                 }
             });
             await Promise.all(workers);
-            logger.debug('正在确认 CDN 上传结果');
-            await postCDNUploadCallback$1({ session: options.session, keys: batchKeys, isFinished: true }, { baseUrl: runtime.baseUrl, fetchImpl });
+            if (successfulKeys.length > 0) {
+                logger.debug('正在确认 CDN 上传结果');
+                await postCDNUploadCallback$1({ session: options.session, keys: successfulKeys, isFinished: true }, { baseUrl: runtime.baseUrl, fetchImpl });
+                await recordUserMiniprogramUploadResult$1({
+                    session: options.session,
+                    miniProgramId: options.miniProgramId,
+                    version: options.version,
+                    sessionId: options.uploadSessionId,
+                    keys: successfulKeys,
+                }, { baseUrl: runtime.baseUrl, fetchImpl });
+            }
+            if (firstUploadError) {
+                throw firstUploadError;
+            }
         }
     }, { successText: `已上传 ${orderedFiles.length} 个文件` });
 }
@@ -135,36 +224,27 @@ function chunkUploadFiles(files, batchSize) {
     }
     return batches;
 }
-function createUploadFileInfos(files, options) {
+function createUploadFileInfos(files) {
     return files.map((file) => ({
         name: file.relativePath.split('/').pop() ?? file.relativePath,
         mimetype: file.mimeType,
         fsize: file.size,
-        path: index$1.getMiniappUploadKey({
-            miniProgramId: options.miniProgramId,
-            version: options.version,
-            relativePath: file.relativePath,
-        }),
+        path: file.key,
     }));
 }
-function validateUploadInfoKeys(files, keys, options) {
+function validateUploadInfoKeys(files, keys) {
     if (keys.length !== files.length) {
         throw new index.CliError(`CDN 上传接口返回 key 数量异常：期望 ${files.length}，实际 ${keys.length}`);
     }
-    for (let index$2 = 0; index$2 < files.length; index$2 += 1) {
-        const expectedKey = index$1.getMiniappUploadKey({
-            miniProgramId: options.miniProgramId,
-            version: options.version,
-            relativePath: files[index$2].relativePath,
-        });
-        const actualKey = keys[index$2];
+    for (let index$1 = 0; index$1 < files.length; index$1 += 1) {
+        const expectedKey = files[index$1].key;
+        const actualKey = keys[index$1];
         if (actualKey !== expectedKey) {
-            throw new index.CliError(`CDN 上传接口返回 key 异常：${files[index$2].relativePath}`, [`CDN 上传接口返回 key 异常：${files[index$2].relativePath}`, `expected: ${expectedKey}`, `actual: ${actualKey}`].join('\n'));
+            throw new index.CliError(`CDN 上传接口返回 key 异常：${files[index$1].relativePath}`, [`CDN 上传接口返回 key 异常：${files[index$1].relativePath}`, `expected: ${expectedKey}`, `actual: ${actualKey}`].join('\n'));
         }
     }
 }
-async function createDefaultCosClient(uploadToken) {
-    const COS = await loadCosConstructor();
+function createDefaultCosClient(uploadToken, COS) {
     const cos = new COS({
         getAuthorization(_input, callback) {
             callback({
@@ -191,7 +271,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-jXyfZKy2.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-6HfcwZ_r.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -234,43 +314,162 @@ function isRecord(value) {
     return Object.prototype.toString.call(value) === '[object Object]';
 }
 
-async function precheckUserMiniprogramVersion(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(index$1.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
-        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
-        ...(options.version ? { version: options.version } : {}),
-        ...(options.source_version ? { source_version: options.source_version } : {}),
-        release_note: options.releaseNote,
-        auto_publish: String(options.autoPublish),
-    }, runtime);
+async function computeMiniappArtifactSignature(files, runtime = {}) {
+    const preparedFiles = runtimePermissionEnv.prepareMiniappArtifactFiles(files);
+    const hash = node_crypto.createHash('sha256');
+    const createReadStream = runtime.createReadStream ?? fs.createReadStream;
+    hash.update(runtimePermissionEnv.createMiniappArtifactSignatureHeader(preparedFiles.length));
+    for (const file of preparedFiles) {
+        hash.update(runtimePermissionEnv.createMiniappArtifactFileHeader(file));
+        let bytesRead = 0;
+        for await (const chunk of createReadStream(file.absolutePath)) {
+            const bytes = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+            bytesRead += bytes.byteLength;
+            hash.update(bytes);
+        }
+        if (bytesRead !== file.size) {
+            throw new Error(`构建产物在签名期间发生变化：${file.relativePath}`);
+        }
+    }
+    return hash.digest('hex');
 }
-async function submitUserMiniprogramAudit(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(index$1.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
-        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
-        ...(options.manifest ? { manifest: JSON.stringify(options.manifest) } : {}),
-        ...(options.source_version ? { source_version: options.source_version } : {}),
-        release_note: options.releaseNote,
-        auto_publish: String(options.autoPublish),
-    }, runtime);
+
+const DEPLOY_LOCKED_MESSAGE = '当前设备已有同版本产物正在上传，请等待完成后重试';
+const DEPLOY_LOCK_DIRECTORY_NAME = 'deploy-locks';
+const DEPLOY_LOCK_OWNER_FILE = 'owner.json';
+const INCOMPLETE_LOCK_GRACE_MS = 30_000;
+const defaultPaths = index.envPaths('hb-sdk', { suffix: '' });
+class DeployLockConflictError extends Error {
+}
+async function withDeployLock(scope, operation, options = {}) {
+    let lock;
+    try {
+        lock = await acquireDeployLock(scope, options);
+    }
+    catch (error) {
+        if (error instanceof DeployLockConflictError) {
+            throw error;
+        }
+        // 本地文件锁只减少重复操作，文件系统异常不阻断服务端上传流程。
+        return operation();
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        await lock.release().catch(() => undefined);
+    }
 }
-async function postUserMiniprogramVersionForm(path, options, fields, runtime) {
-    const fetchImpl = runtime.fetchImpl ?? fetch;
-    const context = session.createHeyboxOpenPlatformRequestContext(options.session, path, {
-        contentType: 'application/x-www-form-urlencoded',
-    });
-    const body = new URLSearchParams();
-    body.set('mini_program_id', options.miniProgramId);
-    for (const [key, value] of Object.entries(fields)) {
-        body.set(key, value);
+async function acquireDeployLock(scope, options = {}) {
+    const lockDirectory = getDeployLockDirectory(scope, options.cacheRoot);
+    const ownerFile = path.join(lockDirectory, DEPLOY_LOCK_OWNER_FILE);
+    const owner = {
+        version: 1,
+        pid: options.pid ?? process.pid,
+        token: options.token ?? node_crypto.randomBytes(16).toString('hex'),
+    };
+    await fs$1.mkdir(path.dirname(lockDirectory), { recursive: true, mode: 0o700 });
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        let created = false;
+        try {
+            await fs$1.mkdir(lockDirectory, { mode: 0o700 });
+            created = true;
+            await fs$1.writeFile(ownerFile, `${JSON.stringify(owner)}\n`, { encoding: 'utf8', mode: 0o600 });
+            return createDeployLock(lockDirectory, ownerFile, owner.token);
+        }
+        catch (error) {
+            if (created) {
+                await fs$1.rm(lockDirectory, { force: true, recursive: true });
+                throw error;
+            }
+            if (!isNodeError(error) || error.code !== 'EEXIST') {
+                throw error;
+            }
+            if (!(await canReclaimDeployLock(lockDirectory, ownerFile, options))) {
+                throw new DeployLockConflictError(DEPLOY_LOCKED_MESSAGE);
+            }
+            await reclaimDeployLock(lockDirectory, owner.token);
+        }
     }
-    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
-        method: 'POST',
-        headers: context.headers,
-        body: body.toString(),
-    });
-    const result = await session.readHeyboxApiEnvelope(response, {
-        pathWithQuery: path,
-    });
-    return result ?? {};
+    throw new DeployLockConflictError(DEPLOY_LOCKED_MESSAGE);
+}
+function getDeployLockDirectory(scope, cacheRoot = defaultPaths.cache) {
+    const scopeHash = node_crypto.createHash('sha256').update(`${scope.apiBaseUrl}\0${scope.miniProgramId}\0${scope.version}`).digest('hex');
+    return path.join(cacheRoot, DEPLOY_LOCK_DIRECTORY_NAME, scopeHash);
+}
+function createDeployLock(lockDirectory, ownerFile, token) {
+    let released = false;
+    return {
+        async release() {
+            if (released)
+                return;
+            released = true;
+            await removeOwnedLock(lockDirectory, ownerFile, token);
+        },
+    };
+}
+async function canReclaimDeployLock(lockDirectory, ownerFile, options) {
+    const owner = await readDeployLockOwner(ownerFile);
+    if (owner) {
+        return !(options.isProcessRunning ?? isProcessRunning)(owner.pid);
+    }
+    try {
+        const lockStat = await fs$1.stat(lockDirectory);
+        return (options.now ?? Date.now)() - lockStat.mtimeMs >= INCOMPLETE_LOCK_GRACE_MS;
+    }
+    catch (error) {
+        return isNodeError(error) && error.code === 'ENOENT';
+    }
+}
+async function removeOwnedLock(lockDirectory, ownerFile, token) {
+    const owner = await readDeployLockOwner(ownerFile);
+    if (owner?.token === token) {
+        await fs$1.rm(lockDirectory, { force: true, recursive: true });
+    }
+}
+async function reclaimDeployLock(lockDirectory, token) {
+    const reclaimDirectory = `${lockDirectory}.reclaim-${node_crypto.createHash('sha256').update(token).digest('hex')}`;
+    try {
+        await fs$1.rename(lockDirectory, reclaimDirectory);
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    await fs$1.rm(reclaimDirectory, { force: true, recursive: true });
+}
+async function readDeployLockOwner(ownerFile) {
+    try {
+        const value = JSON.parse(await fs$1.readFile(ownerFile, 'utf8'));
+        return isDeployLockOwner(value) ? value : null;
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === 'ENOENT')
+            return null;
+        if (error instanceof SyntaxError)
+            return null;
+        throw error;
+    }
+}
+function isDeployLockOwner(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.version === 1 &&
+        Number.isInteger(value.pid) &&
+        typeof value.token === 'string');
+}
+function isProcessRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return !isNodeError(error) || error.code !== 'ESRCH';
+    }
+}
+function isNodeError(error) {
+    return error instanceof Error && 'code' in error;
 }
 
 const SUPPORTED_PACKAGE_MANAGERS = [
@@ -312,110 +511,175 @@ async function runDeployCommand(options, runtime = {}) {
     const releaseNote = await resolveDeployReleaseNote(options, runtime);
     const session$1 = await logger.task('正在校验 Heybox 登录态', () => (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }), { successText: 'Heybox 登录态有效' });
     logger.debug(`Heybox API: ${apiBaseUrl}`);
-    let precheckVersion;
-    let parsedManifest;
-    const historyArtifact = fromVersion ? { source_version: fromVersion } : {};
-    if (fromVersion) {
-        const precheck = await runVersionPrecheck({
-            session: session$1,
-            miniProgramId,
-            ...historyArtifact,
-            releaseNote,
-            autoPublish,
-        }, runtime, apiBaseUrl, projectRoot, logger);
-        const sourceSdkVersion = typeof precheck.sdk_version === 'string' ? precheck.sdk_version.trim() : '';
-        if (!sourceSdkVersion) {
-            throw new Error('历史产物缺少 sdkVersion，无法复用，请重新构建并上传新版本');
-        }
-        precheckVersion = precheck.version || precheck.version_normalized || fromVersion;
-    }
-    else {
-        if (typeof packageJson.scripts?.build !== 'string') {
-            throw new Error('package.json scripts.build 未定义，请添加 build 脚本');
+    const uploadVersion = fromVersion ? '' : validateVersionForDeploy(packageJson.version, 'package.json.version');
+    const deploy = async () => {
+        let precheckVersion;
+        const historyArtifact = fromVersion ? { source_version: fromVersion } : {};
+        if (fromVersion) {
+            const precheck = await runVersionPrecheck({
+                session: session$1,
+                miniProgramId,
+                ...historyArtifact,
+                releaseNote,
+                autoPublish,
+            }, runtime, apiBaseUrl, projectRoot, logger);
+            const sourceSdkVersion = typeof precheck.sdk_version === 'string' ? precheck.sdk_version.trim() : '';
+            if (!sourceSdkVersion) {
+                throw new Error('历史产物缺少 sdkVersion，无法复用，请重新构建并上传新版本');
+            }
+            precheckVersion = precheck.version || precheck.version_normalized || fromVersion;
         }
-        precheckVersion = validateVersionForDeploy(packageJson.version, 'package.json.version');
-        await runVersionPrecheck({
-            session: session$1,
-            miniProgramId,
-            version: precheckVersion,
-            releaseNote,
-            autoPublish,
-        }, runtime, apiBaseUrl, projectRoot, logger);
-        const pm = detectPackageManager(projectRoot);
-        const platform = runtime.platform ?? process.platform;
-        const buildMode = validateBuildMode(env.HB_SDK_ENV?.trim(), platform);
-        logger.info(`开始构建: ${pm} ${createBuildArgs(pm, buildMode).join(' ')}`);
-        await runBuildScript(pm, projectRoot, runtime.spawn ?? childProcess.spawn, {
-            env,
-            mode: buildMode,
-            outputMode: options.buildOutputMode ?? 'inherit',
-            platform,
-            stderr: runtime.stderr,
-        });
-        logger.success('构建完成');
-    }
-    let submitAuditResult;
-    let version = precheckVersion;
-    let manifest;
-    if (!fromVersion) {
-        const distDir = path.join(projectRoot, 'dist');
-        parsedManifest ??= await readDeployManifest(projectRoot, logger);
-        ({ manifest, version } = parsedManifest);
-        if (version !== precheckVersion) {
-            throw new Error(`dist/manifest.json.version (${version}) 与预检版本 (${precheckVersion}) 不一致，请重新 build 后再 deploy`);
+        else {
+            if (typeof packageJson.scripts?.build !== 'string') {
+                throw new Error('package.json scripts.build 未定义，请添加 build 脚本');
+            }
+            precheckVersion = uploadVersion;
+            await runVersionPrecheck({
+                session: session$1,
+                miniProgramId,
+                version: precheckVersion,
+                releaseNote,
+                autoPublish,
+            }, runtime, apiBaseUrl, projectRoot, logger);
+            let skipPlatformCsp = false;
+            try {
+                const { detail } = await logger.task('正在读取远端小程序权限', () => (runtime.getBoundMiniProgram ?? context.getBoundMiniProgram)({
+                    allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl,
+                    apiBaseUrl,
+                    cwd: projectRoot,
+                    env,
+                    fetchImpl: runtime.fetchImpl,
+                    loginBaseUrl,
+                    session: session$1,
+                }), { successText: '已读取远端小程序权限' });
+                skipPlatformCsp = context.shouldSkipMiniappPlatformCsp(detail.runtime_permissions);
+            }
+            catch (error) {
+                logger.warn('未读取到远端 Runtime 权限，构建将继续注入平台 CSP。');
+                logger.debug(`远端 Runtime 权限读取失败详情：${index.readRedactedErrorMessage(error, { verbose: true })}`);
+            }
+            const pm = detectPackageManager(projectRoot);
+            const platform = runtime.platform ?? process.platform;
+            const buildMode = validateBuildMode(env.HB_SDK_ENV?.trim(), platform);
+            logger.info(`开始构建: ${pm} ${createBuildArgs(pm, buildMode).join(' ')}`);
+            await runBuildScript(pm, projectRoot, runtime.spawn ?? childProcess.spawn, {
+                env: runtimePermissionEnv.createMiniappPlatformCspEnv(env, skipPlatformCsp),
+                mode: buildMode,
+                outputMode: options.buildOutputMode ?? 'inherit',
+                platform,
+                stderr: runtime.stderr,
+            });
+            logger.success('构建完成');
         }
-        const uploadFiles = await logger.task('正在校验 dist 上传文件', async () => {
-            const allFiles = await walkDistFiles(distDir);
-            const blocked = allFiles.find((entry) => index$1.relativePathContainsNodeModulesSegment(entry.relativePath));
-            if (blocked) {
-                throw new Error(`dist 目录含 node_modules：${blocked.relativePath}`);
+        let submitAuditResult;
+        let version = precheckVersion;
+        let manifest;
+        let uploadSessionId = '';
+        if (!fromVersion) {
+            const distDir = path.join(projectRoot, 'dist');
+            const parsedManifest = await readDeployManifest(projectRoot, logger);
+            ({ manifest, version } = parsedManifest);
+            if (version !== precheckVersion) {
+                throw new Error(`dist/manifest.json.version (${version}) 与预检版本 (${precheckVersion}) 不一致，请重新 build 后再 deploy`);
             }
-            const files = allFiles.filter((entry) => index$1.shouldUploadDistFile(entry.relativePath));
-            const pathError = index$1.validateUploadPaths(files, { miniProgramId, version, maxLength: index$1.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
-            if (pathError) {
-                throw new Error(pathError);
+            const uploadFiles = await logger.task('正在校验 dist 上传文件', async () => {
+                const allFiles = await walkDistFiles(distDir);
+                const blocked = allFiles.find((entry) => runtimePermissionEnv.relativePathContainsNodeModulesSegment(entry.relativePath));
+                if (blocked) {
+                    throw new Error(`dist 目录含 node_modules：${blocked.relativePath}`);
+                }
+                const files = runtimePermissionEnv.prepareMiniappArtifactFiles(allFiles.filter((entry) => runtimePermissionEnv.shouldUploadDistFile(entry.relativePath)));
+                const pathError = runtimePermissionEnv.validateMiniappUploadPathLengths(files, { miniProgramId });
+                if (pathError) {
+                    throw new Error(pathError);
+                }
+                const sizeError = runtimePermissionEnv.validateUploadTotalSize(files);
+                if (sizeError) {
+                    throw new Error(sizeError);
+                }
+                logger.debug(`待上传文件数: ${files.length}`);
+                return files;
+            }, { successText: 'dist 上传文件校验完成' });
+            // deploy 期间 dist 视为稳定构建输出；为避免持有大量文件描述符，签名和上传不会共享打开的文件句柄。
+            const artifactSignature = await logger.task('正在计算构建产物签名', () => (runtime.computeMiniappArtifactSignature ?? computeMiniappArtifactSignature)(uploadFiles), { successText: '构建产物签名计算完成' });
+            const createdUploadSession = await logger.task('正在创建或恢复上传会话', async () => {
+                const result = await (runtime.createUserMiniprogramUploadSession ?? createUserMiniprogramUploadSession)({
+                    session: session$1,
+                    miniProgramId,
+                    version,
+                    artifactSignature,
+                    relativePaths: uploadFiles.map((file) => file.relativePath),
+                    fileSizes: uploadFiles.map((file) => file.size),
+                }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl });
+                if (typeof result.session_id !== 'string' || !result.session_id.trim()) {
+                    throw new Error('创建上传会话失败：服务端未返回 session_id');
+                }
+                const resolved = runtimePermissionEnv.resolveMiniappUploadSessionFiles(uploadFiles, Array.isArray(result.files) ? result.files : [], Array.isArray(result.uploaded_keys) ? result.uploaded_keys : []);
+                return {
+                    sessionId: result.session_id.trim(),
+                    files: resolved.files,
+                    missingFiles: resolved.missingFiles,
+                };
+            }, { successText: '上传会话已就绪' });
+            uploadSessionId = createdUploadSession.sessionId;
+            const uploadedCount = createdUploadSession.files.length - createdUploadSession.missingFiles.length;
+            if (uploadedCount > 0) {
+                logger.debug(`复用已上传文件: ${uploadedCount}/${createdUploadSession.files.length}`);
             }
-            const sizeError = index$1.validateUploadTotalSize(files);
-            if (sizeError) {
-                throw new Error(sizeError);
+            try {
+                if (createdUploadSession.missingFiles.length > 0) {
+                    await assertDeployUploadFilesStillMatchSignature({
+                        computeMiniappArtifactSignature: runtime.computeMiniappArtifactSignature ?? computeMiniappArtifactSignature,
+                        distDir,
+                        expectedFiles: uploadFiles,
+                        expectedSignature: artifactSignature,
+                        miniProgramId,
+                    });
+                    await (runtime.runUpload ?? runUpload)({
+                        session: session$1,
+                        files: createdUploadSession.missingFiles.map(({ file, key }) => ({ ...file, key })),
+                        miniProgramId,
+                        version,
+                        uploadSessionId,
+                    }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl, logger });
+                }
+            }
+            catch (error) {
+                throw translateHeyboxDeployError(error, { projectRoot, stage: 'upload', version });
             }
-            logger.debug(`待上传文件数: ${files.length}`);
-            return files;
-        }, { successText: 'dist 上传文件校验完成' });
+        }
         try {
-            await (runtime.runUpload ?? runUpload)({ session: session$1, miniProgramId, version, files: uploadFiles }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl, logger });
+            const submitOptions = fromVersion
+                ? { session: session$1, miniProgramId, ...historyArtifact, releaseNote, autoPublish }
+                : { session: session$1, miniProgramId, manifest, sessionId: uploadSessionId, releaseNote, autoPublish };
+            submitAuditResult = await logger.task('正在提交审核', () => (runtime.submitUserMiniprogramAudit ?? submitUserMiniprogramAudit)(submitOptions, {
+                baseUrl: apiBaseUrl,
+                fetchImpl: runtime.fetchImpl,
+            }), { successText: '审核提交完成' });
         }
         catch (error) {
-            throw translateHeyboxDeployError(error, { projectRoot, stage: 'upload', version });
+            throw translateHeyboxDeployError(error, { projectRoot, stage: 'submitAudit', version });
         }
-    }
-    try {
-        const submitOptions = fromVersion
-            ? { session: session$1, miniProgramId, ...historyArtifact, releaseNote, autoPublish }
-            : { session: session$1, miniProgramId, manifest, releaseNote, autoPublish };
-        submitAuditResult = await logger.task('正在提交审核', () => (runtime.submitUserMiniprogramAudit ?? submitUserMiniprogramAudit)(submitOptions, {
-            baseUrl: apiBaseUrl,
-            fetchImpl: runtime.fetchImpl,
-        }), { successText: '审核提交完成' });
-    }
-    catch (error) {
-        throw translateHeyboxDeployError(error, { projectRoot, stage: 'submitAudit', version });
-    }
-    printDeploySuccess({
-        autoPublish,
-        logger,
-        miniProgramId,
-        mode: options.successOutputMode ?? 'legacy',
-        protocolString: submitAuditResult.protocol_string,
-        version,
-    });
-    return {
-        autoPublish,
-        changed: true,
-        miniProgramId,
-        ...(submitAuditResult.protocol_string ? { protocolString: submitAuditResult.protocol_string } : {}),
-        version,
+        printDeploySuccess({
+            autoPublish,
+            logger,
+            miniProgramId,
+            mode: options.successOutputMode ?? 'legacy',
+            protocolString: submitAuditResult.protocol_string,
+            version,
+        });
+        return {
+            autoPublish,
+            changed: true,
+            miniProgramId,
+            ...(submitAuditResult.protocol_string ? { protocolString: submitAuditResult.protocol_string } : {}),
+            version,
+        };
     };
+    if (fromVersion) {
+        return deploy();
+    }
+    return (runtime.withDeployLock ?? withDeployLock)({ apiBaseUrl, miniProgramId, version: uploadVersion }, deploy);
 }
 function printDeploySuccess(options) {
     options.logger.success(`提交审核成功：${options.miniProgramId} ${options.version}`);
@@ -539,9 +803,7 @@ async function runBuildScript(pm, cwd, spawnImpl, options) {
         const pipeStdoutToStderr = options.outputMode === 'stderr';
         const buildArgs = createBuildArgs(pm, options.mode);
         const isWindows = options.platform === 'win32';
-        const [executable, args] = isWindows
-            ? createWindowsBuildCommand(pm, buildArgs)
-            : [pm, buildArgs];
+        const [executable, args] = isWindows ? createWindowsBuildCommand(pm, buildArgs) : [pm, buildArgs];
         const child = spawnImpl(executable, args, {
             cwd,
             env: { ...process.env, ...options.env },
@@ -602,7 +864,7 @@ async function walkDistFiles(distDir) {
             }
             const fileStat = await fs$1.stat(absPath);
             results.push({
-                relativePath: index$1.normalizeRelativePath(relPath),
+                relativePath: relPath,
                 absolutePath: absPath,
                 size: fileStat.size,
                 mimeType: inferMimeType(entry.name),
@@ -613,6 +875,31 @@ async function walkDistFiles(distDir) {
 function inferMimeType(fileName) {
     return MIME_BY_EXT[path.extname(fileName).toLowerCase()] || 'application/octet-stream';
 }
+async function assertDeployUploadFilesStillMatchSignature(options) {
+    const currentFiles = runtimePermissionEnv.prepareMiniappArtifactFiles((await walkDistFiles(options.distDir)).filter((entry) => runtimePermissionEnv.shouldUploadDistFile(entry.relativePath)));
+    const currentByPath = new Map(currentFiles.map(file => [file.relativePath, file]));
+    if (currentFiles.length !== options.expectedFiles.length) {
+        throw new Error('dist 构建产物在签名后发生变化，请重新执行 deploy');
+    }
+    for (const expected of options.expectedFiles) {
+        const current = currentByPath.get(expected.relativePath);
+        if (!current || current.size !== expected.size) {
+            throw new Error(`dist 构建产物在签名后发生变化：${expected.relativePath}`);
+        }
+    }
+    const pathError = runtimePermissionEnv.validateMiniappUploadPathLengths(currentFiles, { miniProgramId: options.miniProgramId });
+    if (pathError) {
+        throw new Error(pathError);
+    }
+    const sizeError = runtimePermissionEnv.validateUploadTotalSize(currentFiles);
+    if (sizeError) {
+        throw new Error(sizeError);
+    }
+    const currentSignature = await options.computeMiniappArtifactSignature(currentFiles);
+    if (currentSignature !== options.expectedSignature) {
+        throw new Error('dist 构建产物在签名后发生变化，请重新 build 后再 deploy');
+    }
+}
 function translateHeyboxDeployError(error, options) {
     const message = error instanceof Error && error.message ? error.message : String(error);
     if (isVersionLifecycleConflictMessage(message) && options.stage !== 'upload') {
@@ -627,18 +914,6 @@ function translateHeyboxDeployError(error, options) {
             `原始错误：${readVerboseDeployErrorMessage(error)}`,
         ].join('\n'));
     }
-    if (isDuplicateUploadErrorMessage(message) && options.stage === 'upload') {
-        const packageJsonPath = path.join(options.projectRoot, 'package.json');
-        const nextVersion = suggestNextPatchVersion(options.version);
-        return new index.CliError([
-            `当前小程序版本 ${options.version} 的上传文件已存在，不能覆盖同版本发布产物。`,
-            `请升级 ${packageJsonPath} 中的 version${nextVersion ? `（例如 ${nextVersion}）` : ''}，重新 build 后再 deploy。`,
-        ].join('\n'), [
-            `当前小程序版本 ${options.version} 的上传文件已存在，不能覆盖同版本发布产物。`,
-            `请升级 ${packageJsonPath} 中的 version${nextVersion ? `（例如 ${nextVersion}）` : ''}，重新 build 后再 deploy。`,
-            `原始错误：${readVerboseDeployErrorMessage(error)}`,
-        ].join('\n'));
-    }
     if (isAuthExpiredErrorMessage(message)) {
         if (options.stage === 'upload') {
             return new index.CliError([
@@ -654,9 +929,6 @@ function translateHeyboxDeployError(error, options) {
     }
     return error instanceof Error ? error : new Error(message);
 }
-function isDuplicateUploadErrorMessage(message) {
-    return /重名|duplicate|already exists|exists/i.test(message);
-}
 function isVersionLifecycleConflictMessage(message) {
     return /AlreadyExists\(6\)|不能复用|已进入线上生命周期|正在审核|活跃候选版本|同版本/i.test(message);
 }