@heybox/hb-sdk 0.8.0 → 0.8.1-alpha.10

package/dist/cli-chunks/{doctor-DU8rCfUF.cjs → doctor-BkfYdlnZ.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-MMW2ibQm.cjs');
+var index = require('./index-DDrytLTX.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-MMW2ibQm.cjs → index-DDrytLTX.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-MMW2ibQm.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DDrytLTX.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-MMW2ibQm.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DDrytLTX.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-MMW2ibQm.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DDrytLTX.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-MMW2ibQm.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DDrytLTX.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-MMW2ibQm.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DDrytLTX.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -3795,6 +3795,77 @@ const {
   Help,
 } = commander;
 
+/** Agent 输出只使用 stdout JSON/NDJSON，不混入交互提示。 */
+function installDevLogCommands(dev) {
+    dev.command('sandbox').description('查看设备沙箱').command('list')
+        .requiredOption('--device <id>', '设备会话 ID').option('--path <path>', '逻辑目录', '.')
+        .option('--port <port>', '调试台端口', '5174').option('--json', 'JSON 输出')
+        .action(async (options, command) => {
+        const port = Number(command.parent?.parent?.opts().port ?? options.port);
+        if (!Number.isInteger(port) || port < 1 || port > 65535)
+            throw new Error('端口无效');
+        const origin = `http://127.0.0.1:${port}`;
+        const bootstrap = await (await fetch(origin + '/__hb_sdk_bootstrap__', { signal: AbortSignal.timeout(5000), redirect: 'error' })).json();
+        const response = await fetch(origin + '/__hb_sdk__/sandbox', { method: 'POST', redirect: 'error', headers: { origin, 'content-type': 'application/json', 'x-hb-sdk-csrf': bootstrap.csrfToken }, body: JSON.stringify({ device: options.device, path: options.path }), signal: AbortSignal.timeout(12000) });
+        if (!response.ok)
+            throw new Error(`目录查询失败：HTTP ${response.status}`);
+        process.stdout.write(JSON.stringify(await response.json()) + '\n');
+    });
+    for (const kind of ['logs', 'devices']) {
+        dev
+            .command(kind)
+            .description(kind === 'logs' ? '读取多设备调试日志' : '列出调试设备会话')
+            .option('--port <port>', '调试台端口', '5174')
+            .option('--json', '输出机器可读 JSON')
+            .option('--device <id>', '设备会话 ID')
+            .option('--level <level>', '日志级别')
+            .option('--source <source>', '日志来源')
+            .option('--query <text>', '搜索输出')
+            .option('--callId <id>', '关联 SDK 调用 ID')
+            .option('--id <id>', '读取服务端日志 ID')
+            .option('--since <timestamp>', '设备时间下界，毫秒')
+            .option('--after <cursor>', '从游标后继续读取', '0')
+            .option('--limit <count>', '每页条数', '100')
+            .option('--follow', '持续输出 NDJSON')
+            .option('--duration <seconds>', '持续读取时长，默认 60 秒', '60')
+            .action(async (options, command) => {
+            const port = Number(command.parent?.opts().port ?? options.port);
+            const duration = Number(options.duration);
+            if (!Number.isInteger(port) || port < 1 || port > 65535 || !Number.isFinite(duration) || duration <= 0)
+                throw new Error('端口或持续时间无效');
+            const params = new URLSearchParams();
+            for (const key of ['device', 'level', 'source', 'query', 'after', 'limit', 'callId', 'id', 'since'])
+                if (options[key])
+                    params.set(key, options[key]);
+            let epoch = '';
+            const deadline = Date.now() + duration * 1000;
+            do {
+                const response = await fetch(`http://127.0.0.1:${port}/__hb_sdk__/device-logs?${params}`, {
+                    signal: AbortSignal.timeout(5000),
+                    redirect: 'error',
+                });
+                if (!response.ok)
+                    throw new Error(`日志读取失败：HTTP ${response.status}`);
+                const page = await response.json();
+                if (!page.epoch)
+                    throw new Error('当前调试台没有设备日志服务，请确认项目使用 miniappManifest 并通过 hb-sdk dev 启动');
+                if (epoch && epoch !== page.epoch) {
+                    params.set('after', '0');
+                    epoch = page.epoch;
+                    continue;
+                }
+                epoch = page.epoch;
+                process.stdout.write(JSON.stringify(kind === 'devices' ? { epoch, devices: page.devices } : page) + '\n');
+                params.set('after', String(page.nextCursor));
+                if (!options.follow)
+                    break;
+                if (!page.hasMore)
+                    await new Promise((resolve) => setTimeout(resolve, 1000));
+            } while (Date.now() < deadline);
+        });
+    }
+}
+
 var envPaths$1 = {exports: {}};
 
 var hasRequiredEnvPaths;
@@ -13353,7 +13424,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.8.0';
+const BUILT_CLI_VERSION = '0.8.1-alpha.10';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13447,6 +13518,7 @@ function createCliProgram(overrides = {}) {
         const logger = resolveLogger(command);
         await handlers.runDevCommand(options, { logger });
     }, handlers.printUpdateReminder, resolveLogger));
+    installDevLogCommands(program.commands.find(command => command.name() === 'dev'));
     addVerboseOption(program.command('build').description('构建当前小程序项目').option('--env <name>', '加载项目根下 .env.<name> 预设并作为 Vite mode')).action(async (...args) => {
         const command = readCommandFromActionArgs(args);
         if (!command) {
@@ -13701,39 +13773,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-B3TThMss.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-D2EX4R5_.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-B3TThMss.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-D2EX4R5_.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-B3TThMss.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-D2EX4R5_.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-PYCNacya.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CtqIXxDL.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BdAg3WGA.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BDOPSacf.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CyZuw7Yn.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-VxjconYc.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DU8rCfUF.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BkfYdlnZ.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-cR_wnaw2.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DOveC5jt.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DNvI7tHH.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-CfESZxO2.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-DATObqzK.cjs → index-lLaHzwfT.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-MMW2ibQm.cjs');
+var index$2 = require('./index-DDrytLTX.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-CtL8rsjB.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BtTDFqEL.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index.esm-BiAaAUFC.cjs → index.esm-Dy4qRhuo.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-MMW2ibQm.cjs');
-var dev = require('./dev-CyZuw7Yn.cjs');
+var index = require('./index-DDrytLTX.cjs');
+var dev = require('./dev-VxjconYc.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -22,16 +22,16 @@ require('os');
 require('readline');
 require('tty');
 require('assert');
+require('node:crypto');
 require('node:os');
 require('node:net');
-require('node:crypto');
 require('node:dns/promises');
 require('node:http');
-require('./context-m2W2XbL0.cjs');
-require('./runtime-permission-env-CtL8rsjB.cjs');
-require('./version-yEn1E2Bg.cjs');
+require('./context-t57bMfbr.cjs');
+require('./runtime-permission-env-BtTDFqEL.cjs');
+require('./version-C4nE66sX.cjs');
 require('node:async_hooks');
-require('./session-DjBkjaF8.cjs');
+require('./session-Dkhwjqhm.cjs');
 require('fs');
 require('constants');
 require('undici');
@@ -41,7 +41,8 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-BQj8YLI4.cjs');
+require('./project-vite-CFhz2THK.cjs');
+require('node:zlib');
 
 var bufferUtil = {exports: {}};
 

package/dist/cli-chunks/{login-B3TThMss.cjs → login-D2EX4R5_.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DjBkjaF8.cjs');
+var session = require('./session-Dkhwjqhm.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-MMW2ibQm.cjs');
+var index = require('./index-DDrytLTX.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-BQj8YLI4.cjs → project-vite-CFhz2THK.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-MMW2ibQm.cjs');
+var index = require('./index-DDrytLTX.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-DNvI7tHH.cjs → remote-CfESZxO2.cjs}

@@ -1,16 +1,17 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-MMW2ibQm.cjs');
-var session = require('./session-DjBkjaF8.cjs');
+var index = require('./index-DDrytLTX.cjs');
+var session = require('./session-Dkhwjqhm.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-CtL8rsjB.cjs');
-var runtimeGate = require('./runtime-gate-BEFp1w_s.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BtTDFqEL.cjs');
 var node_crypto = require('node:crypto');
-var context = require('./context-m2W2XbL0.cjs');
+require('node:zlib');
+var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
+var context = require('./context-t57bMfbr.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -23,7 +24,7 @@ require('buffer');
 require('util');
 require('fs');
 require('constants');
-require('./version-yEn1E2Bg.cjs');
+require('./version-C4nE66sX.cjs');
 require('node:async_hooks');
 
 async function getCDNUploadInfo(options, runtime = {}) {
@@ -86,15 +87,14 @@ async function createUserMiniprogramUploadSession(options, runtime = {}) {
     return postUserMiniprogramVersionForm(CREATE_USER_MINIPROGRAM_UPLOAD_SESSION_API_PATH, options, {
         version: options.version,
         artifact_signature: options.artifactSignature,
-        relative_paths: options.relativePaths.join(','),
-        file_sizes: options.fileSizes.map(size => String(size)).join(','),
+        files: JSON.stringify(options.files),
     }, runtime);
 }
 async function recordUserMiniprogramUploadResult(options, runtime = {}) {
     await postUserMiniprogramVersionForm(RECORD_USER_MINIPROGRAM_UPLOAD_RESULT_API_PATH, options, {
         version: options.version,
         session_id: options.sessionId,
-        keys: options.keys.join(','),
+        files: JSON.stringify(options.files),
     }, runtime);
 }
 async function postUserMiniprogramVersionForm(path, options, fields, runtime) {
@@ -209,7 +209,9 @@ async function runUpload(options, runtime = {}) {
                     miniProgramId: options.miniProgramId,
                     version: options.version,
                     sessionId: options.uploadSessionId,
-                    keys: successfulKeys,
+                    files: indexedFiles
+                        .filter((item) => successfulKeys.includes(item.key))
+                        .map((item) => ({ path: item.file.relativePath, size: item.file.size, sha256: item.file.sha256 })),
                 }, { baseUrl: runtime.baseUrl, fetchImpl });
             }
             if (firstUploadError) {
@@ -272,7 +274,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-DATObqzK.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-lLaHzwfT.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -315,24 +317,28 @@ function isRecord(value) {
     return Object.prototype.toString.call(value) === '[object Object]';
 }
 
-async function computeMiniappArtifactSignature(files, runtime = {}) {
+/** 单次流式读取同时生成整包签名和逐文件 SHA-256 receipt。 */
+async function computeMiniappArtifactReceipt(files, runtime = {}) {
     const preparedFiles = runtimePermissionEnv.prepareMiniappArtifactFiles(files);
     const hash = node_crypto.createHash('sha256');
     const createReadStream = runtime.createReadStream ?? fs.createReadStream;
     hash.update(runtimePermissionEnv.createMiniappArtifactSignatureHeader(preparedFiles.length));
     for (const file of preparedFiles) {
         hash.update(runtimePermissionEnv.createMiniappArtifactFileHeader(file));
+        const fileHash = node_crypto.createHash('sha256');
         let bytesRead = 0;
         for await (const chunk of createReadStream(file.absolutePath)) {
             const bytes = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
             bytesRead += bytes.byteLength;
             hash.update(bytes);
+            fileHash.update(bytes);
         }
         if (bytesRead !== file.size) {
             throw new Error(`构建产物在签名期间发生变化：${file.relativePath}`);
         }
+        Object.assign(file, { sha256: fileHash.digest('hex') });
     }
-    return hash.digest('hex');
+    return { artifactSignature: hash.digest('hex'), files: preparedFiles };
 }
 
 const DEPLOY_LOCKED_MESSAGE = '当前设备已有同版本产物正在上传，请等待完成后重试';
@@ -509,6 +515,7 @@ async function runDeployCommand(options, runtime = {}) {
         throw new Error('未在 package.json 中找到 heybox.miniProgramId，请先配置 mini program id');
     }
     const fromVersion = options.fromVersion?.trim();
+    const declaredPlatforms = fromVersion ? undefined : runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
     const releaseNote = await resolveDeployReleaseNote(options, runtime);
     const session$1 = await logger.task('正在校验 Heybox 登录态', () => (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }), { successText: 'Heybox 登录态有效' });
     logger.debug(`Heybox API: ${apiBaseUrl}`);
@@ -583,6 +590,9 @@ async function runDeployCommand(options, runtime = {}) {
             const distDir = path.join(projectRoot, 'dist');
             const parsedManifest = await readDeployManifest(projectRoot, logger);
             ({ manifest, version } = parsedManifest);
+            if (!declaredPlatforms || !runtimePermissionEnv.areMiniappPlatformsEqual(parsedManifest.platforms, declaredPlatforms)) {
+                throw new Error('dist/manifest.json.platforms 与 package.json#heybox.platforms 不一致，请重新 build 后再 deploy');
+            }
             if (version !== precheckVersion) {
                 throw new Error(`dist/manifest.json.version (${version}) 与预检版本 (${precheckVersion}) 不一致，请重新 build 后再 deploy`);
             }
@@ -597,7 +607,7 @@ async function runDeployCommand(options, runtime = {}) {
                 if (pathError) {
                     throw new Error(pathError);
                 }
-                const sizeError = runtimePermissionEnv.validateUploadTotalSize(files);
+                const sizeError = runtimePermissionEnv.validateMiniappUploadSizeBudgets(files);
                 if (sizeError) {
                     throw new Error(sizeError);
                 }
@@ -605,20 +615,23 @@ async function runDeployCommand(options, runtime = {}) {
                 return files;
             }, { successText: 'dist 上传文件校验完成' });
             // deploy 期间 dist 视为稳定构建输出；为避免持有大量文件描述符，签名和上传不会共享打开的文件句柄。
-            const artifactSignature = await logger.task('正在计算构建产物签名', () => (runtime.computeMiniappArtifactSignature ?? computeMiniappArtifactSignature)(uploadFiles), { successText: '构建产物签名计算完成' });
+            const artifactReceipt = await logger.task('正在计算构建产物签名', () => (runtime.computeMiniappArtifactReceipt ?? computeMiniappArtifactReceipt)(uploadFiles), { successText: '构建产物签名计算完成' });
+            runtimePermissionEnv.validateMiniappCompanionFileReceipts(manifest?.companions, artifactReceipt.files);
             const createdUploadSession = await logger.task('正在创建或恢复上传会话', async () => {
                 const result = await (runtime.createUserMiniprogramUploadSession ?? createUserMiniprogramUploadSession)({
                     session: session$1,
                     miniProgramId,
                     version,
-                    artifactSignature,
-                    relativePaths: uploadFiles.map((file) => file.relativePath),
-                    fileSizes: uploadFiles.map((file) => file.size),
+                    artifactSignature: artifactReceipt.artifactSignature,
+                    files: artifactReceipt.files.map((file) => ({ path: file.relativePath, size: file.size, sha256: file.sha256 })),
                 }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl });
                 if (typeof result.session_id !== 'string' || !result.session_id.trim()) {
                     throw new Error('创建上传会话失败：服务端未返回 session_id');
                 }
-                const resolved = runtimePermissionEnv.resolveMiniappUploadSessionFiles(uploadFiles, Array.isArray(result.files) ? result.files : [], Array.isArray(result.uploaded_keys) ? result.uploaded_keys : []);
+                if (result.file_receipt_version !== 1) {
+                    throw new Error('创建上传会话失败：服务端不支持文件完整性 receipt v1，请升级服务端后重试');
+                }
+                const resolved = runtimePermissionEnv.resolveMiniappUploadSessionFiles(artifactReceipt.files, Array.isArray(result.files) ? result.files : [], Array.isArray(result.uploaded_keys) ? result.uploaded_keys : []);
                 return {
                     sessionId: result.session_id.trim(),
                     files: resolved.files,
@@ -633,10 +646,10 @@ async function runDeployCommand(options, runtime = {}) {
             try {
                 if (createdUploadSession.missingFiles.length > 0) {
                     await assertDeployUploadFilesStillMatchSignature({
-                        computeMiniappArtifactSignature: runtime.computeMiniappArtifactSignature ?? computeMiniappArtifactSignature,
+                        computeMiniappArtifactReceipt: runtime.computeMiniappArtifactReceipt ?? computeMiniappArtifactReceipt,
                         distDir,
-                        expectedFiles: uploadFiles,
-                        expectedSignature: artifactSignature,
+                        expectedFiles: artifactReceipt.files,
+                        expectedSignature: artifactReceipt.artifactSignature,
                         miniProgramId,
                     });
                     await (runtime.runUpload ?? runUpload)({
@@ -734,11 +747,11 @@ async function readDeployManifest(projectRoot, logger) {
     if (!runtimeGate.hasMiniappRuntimeGate(entryHtml)) {
         throw new Error('dist/index.html 缺少平台 Runtime 启动门禁，请在 Vite 配置中启用 miniappManifest() 后重新 build');
     }
-    const { manifest, hadBom } = runtimeGate.parseMiniappManifestJson(await fs$1.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
+    const { manifest, hadBom } = runtimePermissionEnv.parseMiniappManifestJson(await fs$1.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
     if (hadBom) {
         logger.warn('dist/manifest.json 包含 BOM，已自动剥离');
     }
-    const validated = runtimeGate.validateMiniappManifestForDeploy(manifest);
+    const validated = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
     return {
         manifest: { ...manifest, platforms: validated.platforms },
         sdkVersion: validated.sdkVersion,
@@ -747,7 +760,7 @@ async function readDeployManifest(projectRoot, logger) {
     };
 }
 function validateVersionForDeploy(version, sourceLabel) {
-    if (typeof version !== 'string' || !runtimeGate.isValidMiniappManifestVersion(version)) {
+    if (typeof version !== 'string' || !runtimePermissionEnv.isValidMiniappManifestVersion(version)) {
         throw new Error(`${sourceLabel} 必须是合法 SemVer，允许 prerelease，不允许 build metadata 和 0.0.0：${String(version)}`);
     }
     return version.trim();
@@ -908,12 +921,12 @@ async function assertDeployUploadFilesStillMatchSignature(options) {
     if (pathError) {
         throw new Error(pathError);
     }
-    const sizeError = runtimePermissionEnv.validateUploadTotalSize(currentFiles);
+    const sizeError = runtimePermissionEnv.validateMiniappUploadSizeBudgets(currentFiles);
     if (sizeError) {
         throw new Error(sizeError);
     }
-    const currentSignature = await options.computeMiniappArtifactSignature(currentFiles);
-    if (currentSignature !== options.expectedSignature) {
+    const currentReceipt = await options.computeMiniappArtifactReceipt(currentFiles);
+    if (currentReceipt.artifactSignature !== options.expectedSignature) {
         throw new Error('dist 构建产物在签名后发生变化，请重新 build 后再 deploy');
     }
 }

package/dist/cli-chunks/{runtime-gate-BEFp1w_s.cjs → runtime-gate-BWb8QIcX.cjs}

@@ -1,109 +1,5 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-CtL8rsjB.cjs');
-
-const MINIAPP_PLATFORM_VALUES = ['android', 'ios', 'ohos', 'windows', 'macos', 'linux'];
-function isValidMiniappManifestVersion(version) {
-    return getMiniappManifestVersionError(version) === undefined;
-}
-function validateMiniappManifestVersion(version, sourceLabel = 'manifest.version') {
-    const error = getMiniappManifestVersionError(version);
-    if (error) {
-        throw new Error(`${sourceLabel} ${error}`);
-    }
-    return String(version).trim();
-}
-function parseMiniappManifestJson(raw, sourceLabel = 'manifest.json') {
-    const hadBom = raw.charCodeAt(0) === 0xfeff;
-    const text = hadBom ? raw.slice(1) : raw;
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch (error) {
-        throw new Error(`${sourceLabel} 不是合法 JSON：${formatReason(error)}`);
-    }
-    if (!isManifestRecord(parsed)) {
-        throw new Error(`${sourceLabel} 必须是 JSON 对象`);
-    }
-    return {
-        manifest: parsed,
-        hadBom,
-    };
-}
-function validateMiniappManifestForDeploy(manifest) {
-    const version = validateMiniappManifestVersion(manifest.version, 'manifest.version');
-    const sdkVersion = validateSdkVersion(manifest.sdkVersion, 'manifest.sdkVersion');
-    const permissions = runtimePermissionEnv.parseMiniappPermissions(manifest.permissions, {
-        present: Object.prototype.hasOwnProperty.call(manifest, 'permissions'),
-        sdkVersion,
-        sourceLabel: 'manifest.permissions',
-    });
-    return {
-        version,
-        sdkVersion,
-        platforms: validateMiniappPlatforms(manifest.platforms, 'manifest.platforms'),
-        ...(permissions.permissions === undefined ? {} : { permissions: permissions.permissions }),
-    };
-}
-function validateMiniappPlatforms(platforms, sourceLabel = 'platforms') {
-    if (!Array.isArray(platforms) || platforms.length === 0) {
-        throw new Error(`${sourceLabel} 必须是非空平台数组`);
-    }
-    const allowedPlatforms = new Set(MINIAPP_PLATFORM_VALUES);
-    const seen = new Set();
-    for (const platform of platforms) {
-        if (typeof platform !== 'string' || !allowedPlatforms.has(platform)) {
-            throw new Error(`${sourceLabel} 包含不支持的平台：${String(platform)}`);
-        }
-        if (seen.has(platform)) {
-            throw new Error(`${sourceLabel} 包含重复平台：${platform}`);
-        }
-        seen.add(platform);
-    }
-    return Object.freeze(MINIAPP_PLATFORM_VALUES.filter((platform) => seen.has(platform)));
-}
-function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
-    if (typeof version !== 'string' || version.trim() === '') {
-        throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
-    }
-    const normalized = version.trim();
-    const parsed = runtimePermissionEnv.semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function isManifestRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function getMiniappManifestVersionError(version) {
-    if (typeof version !== 'string' || version.trim() === '') {
-        return `必须是合法 SemVer：${String(version)}`;
-    }
-    const normalized = version.trim();
-    const parsed = runtimePermissionEnv.semverExports.parse(normalized);
-    if (!parsed) {
-        return `必须是合法 SemVer：${normalized}`;
-    }
-    if (parsed.build.length > 0) {
-        return `不能包含 build metadata：${normalized}`;
-    }
-    if (parsed.version !== normalized) {
-        return `必须是合法 SemVer：${normalized}`;
-    }
-    if (parsed.major === 0 && parsed.minor === 0 && parsed.patch === 0) {
-        return '不能是模板默认版本 0.0.0';
-    }
-    return undefined;
-}
-function formatReason(error) {
-    if (error instanceof Error && error.message) {
-        return error.message;
-    }
-    return String(error);
-}
-
 const UNDEFINED_CODE_POINTS = new Set([
     65534, 65535, 131070, 131071, 196606, 196607, 262142, 262143, 327678, 327679, 393214,
     393215, 458750, 458751, 524286, 524287, 589822, 589823, 655358, 655359, 720894,
@@ -8390,6 +8286,3 @@ function walk(node, visit) {
 }
 
 exports.hasMiniappRuntimeGate = hasMiniappRuntimeGate;
-exports.isValidMiniappManifestVersion = isValidMiniappManifestVersion;
-exports.parseMiniappManifestJson = parseMiniappManifestJson;
-exports.validateMiniappManifestForDeploy = validateMiniappManifestForDeploy;