@heybox/hb-sdk 0.8.1-alpha.14 → 0.8.1-alpha.15

package/dist/devtools/browser-dev-host/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#f4f5f7" />
     <title>小程序工坊调试台</title>
-    <script type="module" crossorigin src="/assets/index-mfGqyKpq.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-C1GHFN_L.js">
+    <script type="module" crossorigin src="/assets/index-C3EtSrqt.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-BUVHeuGC.js">
     <link rel="stylesheet" crossorigin href="/assets/index-DXd5IZBz.css">
   </head>
   <body>

package/dist/index.cjs.js

@@ -835,7 +835,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.14';
+    : '0.8.1-alpha.15';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/index.esm.js

@@ -831,7 +831,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.14';
+    : '0.8.1-alpha.15';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/miniapp-publish.cjs.js

@@ -2785,6 +2785,35 @@ function requireSemver () {
 
 var semverExports = requireSemver();
 
+const MINIAPP_BIND_APP_IDS_MAX_COUNT = 20;
+function parseMiniappBindAppIds(value, options = {}) {
+    const sourceLabel = options.sourceLabel ?? 'package.json#heybox.bindAppIds';
+    if (value === undefined)
+        return Object.freeze([]);
+    if (!Array.isArray(value))
+        throw new Error(`${sourceLabel} 必须是字符串数组`);
+    if (value.length > MINIAPP_BIND_APP_IDS_MAX_COUNT) {
+        throw new Error(`${sourceLabel} 最多包含 ${MINIAPP_BIND_APP_IDS_MAX_COUNT} 个游戏 appid`);
+    }
+    const seen = new Set();
+    const appIds = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || !/^[1-9]\d*$/.test(item)) {
+            throw new Error(`${sourceLabel} 包含非法游戏 appid：${String(item)}`);
+        }
+        const numeric = Number(item);
+        if (!Number.isSafeInteger(numeric) || numeric > 2_147_483_647) {
+            throw new Error(`${sourceLabel} 包含超出正 int32 范围的游戏 appid：${item}`);
+        }
+        if (seen.has(item))
+            throw new Error(`${sourceLabel} 包含重复游戏 appid：${item}`);
+        seen.add(item);
+        appIds.push(item);
+    }
+    appIds.sort((left, right) => Number(left) - Number(right));
+    return Object.freeze(appIds);
+}
+
 function isValidMiniappManifestVersion(version) {
     return getMiniappManifestVersionError(version) === undefined;
 }
@@ -3222,6 +3251,7 @@ exports.getMiniProgramUploadAlias = getMiniProgramUploadAlias;
 exports.getMiniappUploadKey = getMiniappUploadKey;
 exports.isValidVersion = isValidMiniappManifestVersion;
 exports.normalizeRelativePath = normalizeRelativePath;
+exports.parseMiniappBindAppIds = parseMiniappBindAppIds;
 exports.prepareMiniappArtifactFiles = prepareMiniappArtifactFiles;
 exports.relativePathContainsNodeModulesSegment = relativePathContainsNodeModulesSegment;
 exports.resolveMiniappUploadSessionFiles = resolveMiniappUploadSessionFiles;

package/dist/miniapp-publish.esm.js

@@ -2783,6 +2783,35 @@ function requireSemver () {
 
 var semverExports = requireSemver();
 
+const MINIAPP_BIND_APP_IDS_MAX_COUNT = 20;
+function parseMiniappBindAppIds(value, options = {}) {
+    const sourceLabel = options.sourceLabel ?? 'package.json#heybox.bindAppIds';
+    if (value === undefined)
+        return Object.freeze([]);
+    if (!Array.isArray(value))
+        throw new Error(`${sourceLabel} 必须是字符串数组`);
+    if (value.length > MINIAPP_BIND_APP_IDS_MAX_COUNT) {
+        throw new Error(`${sourceLabel} 最多包含 ${MINIAPP_BIND_APP_IDS_MAX_COUNT} 个游戏 appid`);
+    }
+    const seen = new Set();
+    const appIds = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || !/^[1-9]\d*$/.test(item)) {
+            throw new Error(`${sourceLabel} 包含非法游戏 appid：${String(item)}`);
+        }
+        const numeric = Number(item);
+        if (!Number.isSafeInteger(numeric) || numeric > 2_147_483_647) {
+            throw new Error(`${sourceLabel} 包含超出正 int32 范围的游戏 appid：${item}`);
+        }
+        if (seen.has(item))
+            throw new Error(`${sourceLabel} 包含重复游戏 appid：${item}`);
+        seen.add(item);
+        appIds.push(item);
+    }
+    appIds.sort((left, right) => Number(left) - Number(right));
+    return Object.freeze(appIds);
+}
+
 function isValidMiniappManifestVersion(version) {
     return getMiniappManifestVersionError(version) === undefined;
 }
@@ -3187,4 +3216,4 @@ function compareBytes(left, right) {
     return left.length - right.length;
 }
 
-export { ACTIVITY_UPLOAD_KEY_MAX_LENGTH, CREATE_USER_MINIPROGRAM_API_PATH, CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, CREATE_USER_MINIPROGRAM_LOCAL_DEV_LAUNCH_TOKEN_API_PATH, DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, DETAIL_USER_MINIPROGRAM_API_PATH, DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, DEVELOPER_ENTITY_LIST_API_PATH, DEVELOPER_ENTITY_SWITCH_API_PATH, LIST_USER_MINIPROGRAM_API_PATH, LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, LIST_USER_MINIPROGRAM_VERSION_API_PATH, MINIAPP_COMPANION_UPLOAD_TEMPORARY_SIZE_LIMIT_BYTES, MINIAPP_UPLOAD_BATCH_SIZE, MINIAPP_UPLOAD_SCOPE, MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES, PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, REOPEN_USER_MINIPROGRAM_API_PATH, SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, TAKE_DOWN_USER_MINIPROGRAM_API_PATH, UPDATE_SQUARE_DISPLAY_API_PATH, UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, createMiniappArtifactFileHeader, createMiniappArtifactSignatureHeader, getMiniProgramUploadAlias, getMiniappUploadKey, isValidMiniappManifestVersion as isValidVersion, normalizeRelativePath, prepareMiniappArtifactFiles, relativePathContainsNodeModulesSegment, resolveMiniappUploadSessionFiles, shouldUploadDistFile, validateMiniappCompanionFileReceipts, validateMiniappUploadPathLengths, validateMiniappUploadSizeBudgets, validateUploadPaths, validateUploadTotalSize };
+export { ACTIVITY_UPLOAD_KEY_MAX_LENGTH, CREATE_USER_MINIPROGRAM_API_PATH, CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, CREATE_USER_MINIPROGRAM_LOCAL_DEV_LAUNCH_TOKEN_API_PATH, DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, DETAIL_USER_MINIPROGRAM_API_PATH, DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, DEVELOPER_ENTITY_LIST_API_PATH, DEVELOPER_ENTITY_SWITCH_API_PATH, LIST_USER_MINIPROGRAM_API_PATH, LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, LIST_USER_MINIPROGRAM_VERSION_API_PATH, MINIAPP_COMPANION_UPLOAD_TEMPORARY_SIZE_LIMIT_BYTES, MINIAPP_UPLOAD_BATCH_SIZE, MINIAPP_UPLOAD_SCOPE, MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES, PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, REOPEN_USER_MINIPROGRAM_API_PATH, SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, TAKE_DOWN_USER_MINIPROGRAM_API_PATH, UPDATE_SQUARE_DISPLAY_API_PATH, UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, createMiniappArtifactFileHeader, createMiniappArtifactSignatureHeader, getMiniProgramUploadAlias, getMiniappUploadKey, isValidMiniappManifestVersion as isValidVersion, normalizeRelativePath, parseMiniappBindAppIds, prepareMiniappArtifactFiles, relativePathContainsNodeModulesSegment, resolveMiniappUploadSessionFiles, shouldUploadDistFile, validateMiniappCompanionFileReceipts, validateMiniappUploadPathLengths, validateMiniappUploadSizeBudgets, validateUploadPaths, validateUploadTotalSize };

package/dist/vite.cjs.js

@@ -11,7 +11,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.14';
+    : '0.8.1-alpha.15';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。
@@ -3116,6 +3116,35 @@ function requireSemver () {
 
 var semverExports = requireSemver();
 
+const MINIAPP_BIND_APP_IDS_MAX_COUNT = 20;
+function parseMiniappBindAppIds(value, options = {}) {
+    const sourceLabel = options.sourceLabel ?? 'package.json#heybox.bindAppIds';
+    if (value === undefined)
+        return Object.freeze([]);
+    if (!Array.isArray(value))
+        throw new Error(`${sourceLabel} 必须是字符串数组`);
+    if (value.length > MINIAPP_BIND_APP_IDS_MAX_COUNT) {
+        throw new Error(`${sourceLabel} 最多包含 ${MINIAPP_BIND_APP_IDS_MAX_COUNT} 个游戏 appid`);
+    }
+    const seen = new Set();
+    const appIds = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || !/^[1-9]\d*$/.test(item)) {
+            throw new Error(`${sourceLabel} 包含非法游戏 appid：${String(item)}`);
+        }
+        const numeric = Number(item);
+        if (!Number.isSafeInteger(numeric) || numeric > 2_147_483_647) {
+            throw new Error(`${sourceLabel} 包含超出正 int32 范围的游戏 appid：${item}`);
+        }
+        if (seen.has(item))
+            throw new Error(`${sourceLabel} 包含重复游戏 appid：${item}`);
+        seen.add(item);
+        appIds.push(item);
+    }
+    appIds.sort((left, right) => Number(left) - Number(right));
+    return Object.freeze(appIds);
+}
+
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 const MINI_PROGRAM_MESSAGE_VERSION = 2;
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
@@ -3351,6 +3380,7 @@ function validateMiniappManifestVersion(version, sourceLabel = 'manifest.version
 function renderMiniappManifest(manifest) {
     const platforms = validateMiniappPlatforms(manifest.platforms, 'manifest.platforms');
     const window = validateMiniappWindow(manifest.window, 'manifest.window');
+    const bindAppIds = parseMiniappBindAppIds(manifest.bindAppIds, { sourceLabel: 'manifest.bindAppIds' });
     const output = {
         version: manifest.version,
         sdkVersion: manifest.sdkVersion,
@@ -3358,6 +3388,7 @@ function renderMiniappManifest(manifest) {
         ...(manifest.permissions === undefined ? {} : { permissions: manifest.permissions }),
         ...(manifest.companions === undefined ? {} : { companions: manifest.companions }),
         ...(window === undefined ? {} : { window }),
+        ...(bindAppIds.length === 0 ? {} : { bindAppIds }),
     };
     return `${JSON.stringify(output, null, 2)}\n`;
 }
@@ -3519,6 +3550,11 @@ function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
         sdkVersion,
     });
 }
+function readMiniappBindAppIdsFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root, false);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return parseMiniappBindAppIds(heybox?.bindAppIds);
+}
 function readMiniappPackageJson(root, requireVersion) {
     const packageJsonPath = findNearestPackageJsonPath(root);
     let content;
@@ -13302,6 +13338,7 @@ function miniappManifest() {
             const windowDeclaration = readMiniappWindowFromPackageJson(root);
             const companionConfig = readMiniappCompanionsFromPackageJson(root);
             const companionDeclarations = includeCompanions ? companionConfig.declarations : undefined;
+            const bindAppIds = readMiniappBindAppIdsFromPackageJson(root);
             if (!parsedPermissions.declared)
                 this.warn(getMissingPermissionsWarning());
             if (companionDeclarations && !parsedPermissions.permissions?.companion) {
@@ -13330,6 +13367,7 @@ function miniappManifest() {
                 ...(parsedPermissions.permissions === undefined ? {} : { permissions: parsedPermissions.permissions }),
                 ...(companions === undefined ? {} : { companions }),
                 ...(windowDeclaration === undefined ? {} : { window: windowDeclaration }),
+                ...(bindAppIds.length === 0 ? {} : { bindAppIds }),
             }));
         },
     };

package/dist/vite.esm.js

@@ -8,7 +8,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.14';
+    : '0.8.1-alpha.15';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。
@@ -3113,6 +3113,35 @@ function requireSemver () {
 
 var semverExports = requireSemver();
 
+const MINIAPP_BIND_APP_IDS_MAX_COUNT = 20;
+function parseMiniappBindAppIds(value, options = {}) {
+    const sourceLabel = options.sourceLabel ?? 'package.json#heybox.bindAppIds';
+    if (value === undefined)
+        return Object.freeze([]);
+    if (!Array.isArray(value))
+        throw new Error(`${sourceLabel} 必须是字符串数组`);
+    if (value.length > MINIAPP_BIND_APP_IDS_MAX_COUNT) {
+        throw new Error(`${sourceLabel} 最多包含 ${MINIAPP_BIND_APP_IDS_MAX_COUNT} 个游戏 appid`);
+    }
+    const seen = new Set();
+    const appIds = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || !/^[1-9]\d*$/.test(item)) {
+            throw new Error(`${sourceLabel} 包含非法游戏 appid：${String(item)}`);
+        }
+        const numeric = Number(item);
+        if (!Number.isSafeInteger(numeric) || numeric > 2_147_483_647) {
+            throw new Error(`${sourceLabel} 包含超出正 int32 范围的游戏 appid：${item}`);
+        }
+        if (seen.has(item))
+            throw new Error(`${sourceLabel} 包含重复游戏 appid：${item}`);
+        seen.add(item);
+        appIds.push(item);
+    }
+    appIds.sort((left, right) => Number(left) - Number(right));
+    return Object.freeze(appIds);
+}
+
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 const MINI_PROGRAM_MESSAGE_VERSION = 2;
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
@@ -3348,6 +3377,7 @@ function validateMiniappManifestVersion(version, sourceLabel = 'manifest.version
 function renderMiniappManifest(manifest) {
     const platforms = validateMiniappPlatforms(manifest.platforms, 'manifest.platforms');
     const window = validateMiniappWindow(manifest.window, 'manifest.window');
+    const bindAppIds = parseMiniappBindAppIds(manifest.bindAppIds, { sourceLabel: 'manifest.bindAppIds' });
     const output = {
         version: manifest.version,
         sdkVersion: manifest.sdkVersion,
@@ -3355,6 +3385,7 @@ function renderMiniappManifest(manifest) {
         ...(manifest.permissions === undefined ? {} : { permissions: manifest.permissions }),
         ...(manifest.companions === undefined ? {} : { companions: manifest.companions }),
         ...(window === undefined ? {} : { window }),
+        ...(bindAppIds.length === 0 ? {} : { bindAppIds }),
     };
     return `${JSON.stringify(output, null, 2)}\n`;
 }
@@ -3516,6 +3547,11 @@ function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
         sdkVersion,
     });
 }
+function readMiniappBindAppIdsFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root, false);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return parseMiniappBindAppIds(heybox?.bindAppIds);
+}
 function readMiniappPackageJson(root, requireVersion) {
     const packageJsonPath = findNearestPackageJsonPath(root);
     let content;
@@ -13299,6 +13335,7 @@ function miniappManifest() {
             const windowDeclaration = readMiniappWindowFromPackageJson(root);
             const companionConfig = readMiniappCompanionsFromPackageJson(root);
             const companionDeclarations = includeCompanions ? companionConfig.declarations : undefined;
+            const bindAppIds = readMiniappBindAppIdsFromPackageJson(root);
             if (!parsedPermissions.declared)
                 this.warn(getMissingPermissionsWarning());
             if (companionDeclarations && !parsedPermissions.permissions?.companion) {
@@ -13327,6 +13364,7 @@ function miniappManifest() {
                 ...(parsedPermissions.permissions === undefined ? {} : { permissions: parsedPermissions.permissions }),
                 ...(companions === undefined ? {} : { companions }),
                 ...(windowDeclaration === undefined ? {} : { window: windowDeclaration }),
+                ...(bindAppIds.length === 0 ? {} : { bindAppIds }),
             }));
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.8.1-alpha.14",
+  "version": "0.8.1-alpha.15",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -62,7 +62,7 @@
     "skills": "1.5.23",
     "undici": "^7.28.0",
     "ws": "^8.18.0",
-    "@heybox/hb-sdk-protocol": "0.8.1-alpha.14"
+    "@heybox/hb-sdk-protocol": "0.8.1-alpha.15"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -114,9 +114,9 @@
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
     "@heybox-domain/heybox-theme": "~0.1.0",
-    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
-    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.14",
     "@heybox/hb-api": "~1.28.3",
+    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.15",
+    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
     "@heybox/runtime": "~0.2.0",
     "@heybox/runtime-policy": "~0.2.0",
     "@heybox/runtime-transport-fetch": "~0.2.0"

package/skill/SKILL.md

@@ -66,20 +66,21 @@ Apply these instructions when writing, reviewing, or debugging code that consume
    For real PC Companion debugging, configure local artifacts in `package.json#heybox.companions`, keep `miniappManifest()` enabled, bind the project, and ensure COA has approved `companion`. `hb-sdk dev` validates immutable snapshots without requiring an upload; config or artifact changes rotate the snapshot while existing Sessions retain their original artifact. Prepare and launch the new artifact explicitly. Check separate Browser, Mobile and PC Companion readiness in the debugging workbench. Without a local declaration, use Browser Fake only for state/UI integration.
 4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
 5. Declare the actual supported platforms in `package.json#heybox.platforms` and keep the no-argument `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the declaration, Manifest, or Runtime gate output is missing or inconsistent.
-6. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
-7. Existing projects may continue to use `vite build`; do not auto-migrate them. Do not invent `--mode`, `--json`, config, or output-directory flags for `hb-sdk build`.
-8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` for remote management, publishing, Mobile debugging, and optional Browser Mock Host `heybox-session` requests. Browser debugging itself can start without CLI login. Mini-program code must still call `auth.login()`; the debug page only confirms authorization. Do not paste CLI credentials into page JavaScript. Phone debugging continues to use the App login.
-9. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
-10. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
-11. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management.
-12. Use `hb-sdk remote deploy --release-note <text>` to run the project's `scripts.build`, upload, and submit the current project for audit. Do not recommend the removed top-level `hb-sdk deploy` alias.
-13. `hb-sdk dev` and `hb-sdk remote deploy` skip the platform CSP only when the current version declares and the platform approves `network`. `useOfficialDomain` does not participate in CSP skip decisions. Direct `hb-sdk build`, direct Vite build, anonymous or invalid snapshots, and local Dev Context overrides must keep the platform CSP. Runtime Gate, Manifest, and HTML validation always remain active.
-14. After approval, use `hb-sdk remote release <version>` for manual release or `--auto-publish` when an eligible low-risk version should release automatically.
-15. Treat approval, release, and public display as separate states. Do not promise square, search, or recommendation visibility after release.
-16. Use `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and square visibility commands only after showing the target and obtaining required confirmation.
-17. Use `--json` for remote script consumption and `--verbose` only when concise output is insufficient for diagnosis.
-18. Use `hb-sdk doctor` to diagnose whether the local Skill matches the installed SDK; follow its output to install or refresh the Skill.
-19. Do not print or expose cookies, tokens, private headers, or other credentials.
+6. When a released version should be discoverable from specific PC game workspaces, declare canonical decimal string appids in `package.json#heybox.bindAppIds` (maximum 20). This is version metadata, not a Runtime permission. Missing or empty clears bindings; `--from-version` inherits the source artifact snapshot.
+7. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
+8. Existing projects may continue to use `vite build`; do not auto-migrate them. Do not invent `--mode`, `--json`, config, or output-directory flags for `hb-sdk build`.
+9. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` for remote management, publishing, Mobile debugging, and optional Browser Mock Host `heybox-session` requests. Browser debugging itself can start without CLI login. Mini-program code must still call `auth.login()`; the debug page only confirms authorization. Do not paste CLI credentials into page JavaScript. Phone debugging continues to use the App login.
+10. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
+11. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
+12. Use `hb-sdk remote info` to compare local/current/added/removed game bindings, and use `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management. These commands do not edit game bindings.
+13. Use `hb-sdk remote deploy --release-note <text>` to run the project's `scripts.build`, upload, and submit the current project for audit. Do not recommend the removed top-level `hb-sdk deploy` alias.
+14. `hb-sdk dev` and `hb-sdk remote deploy` skip the platform CSP only when the current version declares and the platform approves `network`. `useOfficialDomain` does not participate in CSP skip decisions. Direct `hb-sdk build`, direct Vite build, anonymous or invalid snapshots, and local Dev Context overrides must keep the platform CSP. Runtime Gate, Manifest, and HTML validation always remain active.
+15. After approval, use `hb-sdk remote release <version>` for manual release or `--auto-publish` when an eligible low-risk version should release automatically.
+16. Treat approval, release, and public display as separate states. Do not promise square, search, or recommendation visibility after release.
+17. Use `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and square visibility commands only after showing the target and obtaining required confirmation.
+18. Use `--json` for remote script consumption and `--verbose` only when concise output is insufficient for diagnosis.
+19. Use `hb-sdk doctor` to diagnose whether the local Skill matches the installed SDK; follow its output to install or refresh the Skill.
+20. Do not print or expose cookies, tokens, private headers, or other credentials.
 
 ## Step 6: Preserve capability boundaries
 

package/skill/references/api-protocol.md

@@ -301,10 +301,10 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成，不
 | --- | ---: | ---: | ---: | ---: | ---: |
 | Root API | 2 | 4 | 75 | 73 | 3 |
 | Protocol API | 0 | 13 | 58 | 90 | 47 |
-| Miniapp Publish API | 0 | 5 | 2 | 0 | 0 |
+| Miniapp Publish API | 0 | 6 | 3 | 0 | 0 |
 | Vite API | 0 | 1 | 5 | 1 | 3 |
 
-<!-- Generated by apps/docs/hb-sdk/scripts/generate-api-docs.ts; schemaVersion=4; fingerprint=7356ab1376630f8bed1028cf9fca72895fc3a1603b8742280c265c53fdeff423 -->
+<!-- Generated by apps/docs/hb-sdk/scripts/generate-api-docs.ts; schemaVersion=4; fingerprint=1dfd4c6306e8ac3680f60db083aa048395e38ffb49c30e19b49cc5db72249533 -->
 
 ## SDK API
 

package/skill/references/api-root.md

@@ -27,7 +27,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.8.1-alpha.14`
+- Version at generation time: `0.8.1-alpha.15`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -328,6 +328,8 @@ hb-sdk build [--env <name>] [--verbose]
 
 `hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `package.json#heybox.platforms` 声明目标平台，并在 `vite.config.ts` 中显式注册无参的 `miniappManifest()`；配置与构建产物不一致时构建失败。
 
+`hb-sdk remote info` 会只读展示 `package.json#heybox.bindAppIds`、当前线上绑定以及新增/移除差异。修改绑定必须更新项目配置并重新提交版本；CLI、Open 和 COA 都不提供第二个写入入口。普通 deploy 在上传文件前把实际构建 Manifest 交给服务端预检；`--from-version` 只使用源版本快照。
+
 直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端批准结果，并与当前版本声明取交集；仅当有效 `network` 权限启用时才跳过平台 CSP，`useOfficialDomain` 不参与该判定。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
 
 推荐由项目的 `scripts.build` 保留类型检查：

package/skill/references/cli.md

@@ -172,6 +172,8 @@ hb-sdk build [--env <name>] [--verbose]
 
 `hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `package.json#heybox.platforms` 声明目标平台，并在 `vite.config.ts` 中显式注册无参的 `miniappManifest()`；配置与构建产物不一致时构建失败。
 
+`hb-sdk remote info` 会只读展示 `package.json#heybox.bindAppIds`、当前线上绑定以及新增/移除差异。修改绑定必须更新项目配置并重新提交版本；CLI、Open 和 COA 都不提供第二个写入入口。普通 deploy 在上传文件前把实际构建 Manifest 交给服务端预检；`--from-version` 只使用源版本快照。
+
 直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端批准结果，并与当前版本声明取交集；仅当有效 `network` 权限启用时才跳过平台 CSP，`useOfficialDomain` 不参与该判定。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
 
 推荐由项目的 `scripts.build` 保留类型检查：

package/skill/skill.json

@@ -1,16 +1,16 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.8.1-alpha.14+skill.63b05480eba4",
+  "skillVersion": "0.8.1-alpha.15+skill.b220fbc77b56",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.14",
-    "compatibility": "0.8.1-alpha.14"
+    "version": "0.8.1-alpha.15",
+    "compatibility": "0.8.1-alpha.15"
   },
   "distribution": {
     "type": "npm",
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.14",
+    "version": "0.8.1-alpha.15",
     "path": "skill"
   },
-  "integrity": "sha256-63b05480eba4af0e9aeb126196230250ec8349fa1d84e84ebac8005fabe3a602"
+  "integrity": "sha256-b220fbc77b56021c0620c086c036ceba404be7a49741ffffb8bee9fce57706a7"
 }

package/types/miniapp-manifest/bindings.d.ts

@@ -0,0 +1,5 @@
+export declare const MINIAPP_BIND_APP_IDS_MAX_COUNT = 20;
+export interface ParseMiniappBindAppIdsOptions {
+    sourceLabel?: string;
+}
+export declare function parseMiniappBindAppIds(value: unknown, options?: ParseMiniappBindAppIdsOptions): readonly string[];

package/types/miniapp-manifest/index.d.ts

@@ -3,3 +3,4 @@ export * from './node';
 export * from './permissions';
 export * from './companions';
 export * from './companion-types';
+export * from './bindings';

package/types/miniapp-manifest/node.d.ts

@@ -17,4 +17,5 @@ export declare function readMiniappPlatformsFromPackageJson(root: string): reado
  */
 export declare function readMiniappWindowFromPackageJson(root: string): MiniappWindowDeclaration | undefined;
 export declare function readMiniappPermissionsFromPackageJson(root: string, sdkVersion: string): ParsedMiniappPermissions;
+export declare function readMiniappBindAppIdsFromPackageJson(root: string): readonly string[];
 export declare function resolveMiniappSdkVersion(): string;

package/types/miniapp-manifest/schema.d.ts

@@ -41,6 +41,7 @@ export interface MiniappManifest {
     permissions?: MiniappPermissionDeclarations;
     companions?: MiniappCompanionManifestDeclarations;
     window?: MiniappWindowDeclaration;
+    bindAppIds?: readonly string[];
 }
 export interface ParseMiniappManifestResult {
     manifest: MiniappManifest;
@@ -52,6 +53,7 @@ export declare function validateMiniappManifestVersion(version: unknown, sourceL
 export declare function renderMiniappManifest(manifest: MiniappManifest): string;
 export declare function parseMiniappManifestJson(raw: string, sourceLabel?: string): ParseMiniappManifestResult;
 export declare function validateMiniappManifestForDeploy(manifest: MiniappManifest): {
+    bindAppIds?: readonly string[] | undefined;
     window?: MiniappWindowDeclaration | undefined;
     companions?: MiniappCompanionManifestDeclarations | undefined;
     permissions?: Partial<Record<"userInfo" | "steamLibrary" | "share" | "storage" | "filesystem" | "clipboard" | "leaderboard" | "companion", import("./permissions").SimpleMiniappPermissionDeclaration> & {

package/types/miniapp-publish/index.d.ts

@@ -27,6 +27,7 @@ export declare const REOPEN_USER_MINIPROGRAM_API_PATH = "/mall/developer/user_mi
 export declare const UPDATE_SQUARE_DISPLAY_API_PATH = "/mall/developer/user_miniprogram/square_display/update";
 export declare const LIST_USER_MINIPROGRAM_VERSION_API_PATH = "/mall/developer/user_miniprogram/version/list";
 export { isValidMiniappManifestVersion as isValidVersion } from '../miniapp-manifest/schema';
+export { parseMiniappBindAppIds, type ParseMiniappBindAppIdsOptions } from '../miniapp-manifest/bindings';
 export declare function normalizeRelativePath(relativePath: string): string;
 export declare function relativePathContainsNodeModulesSegment(relativePath: string): boolean;
 export declare function getMiniProgramUploadAlias(miniProgramId: string): string;