@heybox/hb-sdk 0.8.1-alpha.2 → 0.8.1-alpha.3

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。内部集成、实现策略和审查证据不在此维护。
 
+## 0.8.1-alpha.3
+
+- 目标平台声明统一迁移到 `package.json#heybox.platforms`；`miniappManifest()` 恢复无参调用，并在构建时将该声明写入 `dist/manifest.json`。
+- `hb-sdk dev`、`hb-sdk build` 和普通 `hb-sdk remote deploy` 会拒绝缺失或非法的平台声明；build/deploy 也会拒绝与项目配置不一致的 Manifest。已有项目升级时需把原 Vite 参数中的 `platforms` 移入 `package.json#heybox`。
+
 ## 0.8.1-alpha.2
 
 - 新增 `environment.getInfo()` 与 `environment.getInfoSync()`，用于读取运行模式、小黑盒 App 版本、canonical 小程序 ID/版本、操作系统和 SDK 版本的冻结快照。

package/README.md

@@ -94,7 +94,17 @@ async function revokeAuthorizationFromUserAction() {
 
 `user.revokeAuthorization()` 位于无需声明白名单，不接收小程序 ID、黑盒用户 ID 或手势参数。调用必须来自可信用户操作，否则返回 `USER_GESTURE_REQUIRED`。撤销成功后，后续身份或授权读取会重新进入授权流程；SDK 不会替业务清理已经持久化的数据。
 
-已有 Vite 项目还需要启用构建插件：
+已有 Vite 项目先在 `package.json#heybox.platforms` 声明实际承诺适配的平台：
+
+```json
+{
+  "heybox": {
+    "platforms": ["android", "ios", "ohos"]
+  }
+}
+```
+
+再启用构建插件：
 
 ```ts
 import { miniappManifest } from '@heybox/hb-sdk/vite';
@@ -102,7 +112,7 @@ import { defineConfig } from 'vite';
 
 export default defineConfig({
   base: './',
-  plugins: [miniappManifest({ platforms: ['android', 'ios', 'ohos'] })],
+  plugins: [miniappManifest()],
 });
 ```
 
@@ -231,7 +241,7 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 - Host 文件错误只保留稳定 code 与 canonical 安全文案；原始 message、data、native path 和 credential 不会进入小程序。
 - `FileStat.size` 是非负 safe integer；`modifiedAt` / `createdAt` 若存在，单位为 Unix epoch milliseconds。
 - 仅当当前版本声明且平台已批准 `network` 时，`hb-sdk dev` 与 `hb-sdk remote deploy` 构建才会跳过平台 CSP；其他构建继续注入平台 CSP。`useOfficialDomain` 不参与 CSP 跳过判定。
-- 构建必须启用 `miniappManifest({ platforms })` 并显式声明实际承诺适配的平台，推荐统一使用 `hb-sdk build`。新项目模板中的 `['android', 'ios', 'ohos']` 只是初始配置，不代表已经完成真机验收。
+- 构建必须启用 `miniappManifest()`，并在 `package.json#heybox.platforms` 显式声明实际承诺适配的平台，推荐统一使用 `hb-sdk build`。新项目模板中的 `['android', 'ios', 'ohos']` 只是初始配置，不代表已经完成真机验收。
 
 私有 Page Channel 适配没有修改 `@heybox/hb-sdk` 公开 API 或 iframe wire；本次 files/download
 Runtime 能力随 `0.8.0-alpha.11` release family 发布，部署 detail 前必须保证

package/dist/cli-chunks/{build-FQoALfGC.cjs → build-B5Sbi8Sq.cjs}

@@ -3,11 +3,11 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-BPRwn4Yc.cjs');
-var runtimeGate = require('./runtime-gate-BMSY22AL.cjs');
-var index = require('./index-BEn7WaqA.cjs');
-var projectVite = require('./project-vite-BO8oOfcs.cjs');
-require('./version-BONZQWPR.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-XAZFauvZ.cjs');
+var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
+var index = require('./index-DCJN-V1y.cjs');
+var projectVite = require('./project-vite-DMxdOWsU.cjs');
+require('./version-BGzCIQhE.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');
@@ -28,6 +28,7 @@ async function runBuildCommand(_options = {}, runtime = {}) {
     const env = runtime.env ?? process.env;
     const mode = env.HB_SDK_ENV?.trim() || undefined;
     const skipPlatformCsp = runtimePermissionEnv.shouldSkipMiniappPlatformCspFromEnv(env);
+    const declaredPlatforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
     runtimePermissionEnv.readMiniappPermissionsFromPackageJson(projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
     await fs.rm(distDir, { force: true, recursive: true });
     try {
@@ -46,7 +47,7 @@ async function runBuildCommand(_options = {}, runtime = {}) {
                     write: true,
                 },
             }), { successText: 'Vite 构建完成' });
-            const result = await validateBuildOutput(projectRoot, logger);
+            const result = await validateBuildOutput(projectRoot, logger, declaredPlatforms);
             logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
             return result;
         }, env);
@@ -75,7 +76,7 @@ function createFixedBuildOutputPlugin(projectRoot) {
         },
     };
 }
-async function validateBuildOutput(projectRoot, logger) {
+async function validateBuildOutput(projectRoot, logger, declaredPlatforms) {
     const distDir = path.join(projectRoot, 'dist');
     const entryHtmlPath = path.join(distDir, 'index.html');
     const manifestPath = path.join(distDir, 'manifest.json');
@@ -89,11 +90,14 @@ async function validateBuildOutput(projectRoot, logger) {
     if (!runtimeGate.hasMiniappRuntimeGate(entryHtml)) {
         throw new Error('dist/index.html 缺少平台 Runtime 启动门禁，请在 Vite 配置中显式启用 miniappManifest()');
     }
-    const { manifest, hadBom } = runtimeGate.parseMiniappManifestJson(await fs.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
+    const { manifest, hadBom } = runtimePermissionEnv.parseMiniappManifestJson(await fs.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
     if (hadBom) {
         logger.warn('dist/manifest.json 包含 BOM，已自动剥离');
     }
-    const { platforms, sdkVersion, version, permissions } = runtimeGate.validateMiniappManifestForDeploy(manifest);
+    const { platforms, sdkVersion, version, permissions } = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
+    if (!runtimePermissionEnv.areMiniappPlatformsEqual(platforms, declaredPlatforms)) {
+        throw new Error('dist/manifest.json.platforms 与 package.json#heybox.platforms 不一致，请重新 build');
+    }
     const allFiles = await walkDistFiles(distDir);
     const uploadFiles = allFiles.filter((file) => runtimePermissionEnv.shouldUploadDistFile(file.relativePath));
     const sizeError = runtimePermissionEnv.validateUploadTotalSize(uploadFiles);

package/dist/cli-chunks/{context-CA_Q1lyH.cjs → context-DuxaBL3Y.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-BPRwn4Yc.cjs');
-var session = require('./session-C0eIKZ6V.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-XAZFauvZ.cjs');
+var session = require('./session-BnoHxzFq.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');

package/dist/cli-chunks/{create-BjIl4hy4.cjs → create-CIfZrg3F.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-BEn7WaqA.cjs');
+var index = require('./index-DCJN-V1y.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CiPQYsW_.cjs → dev-CFubP5kW.cjs}

@@ -8,17 +8,17 @@ var node_crypto = require('node:crypto');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
 var node_module = require('node:module');
-var context = require('./context-CA_Q1lyH.cjs');
-var runtimePermissionEnv = require('./runtime-permission-env-BPRwn4Yc.cjs');
+var context = require('./context-DuxaBL3Y.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-XAZFauvZ.cjs');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-BEn7WaqA.cjs');
+var index = require('./index-DCJN-V1y.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-C0eIKZ6V.cjs');
+var session = require('./session-BnoHxzFq.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-BO8oOfcs.cjs');
-var version = require('./version-BONZQWPR.cjs');
+var projectVite = require('./project-vite-DMxdOWsU.cjs');
+var version = require('./version-BGzCIQhE.cjs');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 class Locked extends Error {
@@ -1851,8 +1851,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CiPQYsW_.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CiPQYsW_.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CFubP5kW.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CFubP5kW.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -10902,7 +10902,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-DeEc_-uV.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-8hgZlNF8.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -14991,6 +14991,7 @@ async function runDevCommand(options, runtime = {}) {
         port: appPort,
     };
     const projectRoot = projectVite.findProjectRoot(runtime.cwd ?? process.cwd());
+    runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
     const { context: devLaunchContext, miniProgram } = await loadDevLaunchContext({
         env: runtime.env,
         fetchImpl,

package/dist/cli-chunks/{doctor-CS6c3n-W.cjs → doctor-IPKn3PBn.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-BEn7WaqA.cjs');
+var index = require('./index-DCJN-V1y.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-BEn7WaqA.cjs → index-DCJN-V1y.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BEn7WaqA.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DCJN-V1y.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BEn7WaqA.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DCJN-V1y.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BEn7WaqA.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DCJN-V1y.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BEn7WaqA.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DCJN-V1y.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BEn7WaqA.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DCJN-V1y.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13353,7 +13353,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.8.1-alpha.2';
+const BUILT_CLI_VERSION = '0.8.1-alpha.3';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13701,39 +13701,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BENCVgaQ.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CoB9jXxC.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BENCVgaQ.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CoB9jXxC.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BENCVgaQ.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CoB9jXxC.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-FQoALfGC.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-B5Sbi8Sq.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BjIl4hy4.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CIfZrg3F.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CiPQYsW_.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CFubP5kW.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-CS6c3n-W.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-IPKn3PBn.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DpInwbiA.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-CDEJtATn.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-IiVCXcSq.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-D4ZcngLn.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-CsP_x6y6.cjs → index-KHhdZ8eZ.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-BEn7WaqA.cjs');
+var index$2 = require('./index-DCJN-V1y.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-BPRwn4Yc.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-XAZFauvZ.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index.esm-DeEc_-uV.cjs → index.esm-8hgZlNF8.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-BEn7WaqA.cjs');
-var dev = require('./dev-CiPQYsW_.cjs');
+var index = require('./index-DCJN-V1y.cjs');
+var dev = require('./dev-CFubP5kW.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -27,11 +27,11 @@ require('node:net');
 require('node:crypto');
 require('node:dns/promises');
 require('node:http');
-require('./context-CA_Q1lyH.cjs');
-require('./runtime-permission-env-BPRwn4Yc.cjs');
-require('./version-BONZQWPR.cjs');
+require('./context-DuxaBL3Y.cjs');
+require('./runtime-permission-env-XAZFauvZ.cjs');
+require('./version-BGzCIQhE.cjs');
 require('node:async_hooks');
-require('./session-C0eIKZ6V.cjs');
+require('./session-BnoHxzFq.cjs');
 require('fs');
 require('constants');
 require('undici');
@@ -41,7 +41,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-BO8oOfcs.cjs');
+require('./project-vite-DMxdOWsU.cjs');
 
 var bufferUtil = {exports: {}};
 

package/dist/cli-chunks/{login-BENCVgaQ.cjs → login-CoB9jXxC.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-C0eIKZ6V.cjs');
+var session = require('./session-BnoHxzFq.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-BEn7WaqA.cjs');
+var index = require('./index-DCJN-V1y.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-BO8oOfcs.cjs → project-vite-DMxdOWsU.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-BEn7WaqA.cjs');
+var index = require('./index-DCJN-V1y.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-IiVCXcSq.cjs → remote-D4ZcngLn.cjs}

@@ -1,16 +1,16 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-BEn7WaqA.cjs');
-var session = require('./session-C0eIKZ6V.cjs');
+var index = require('./index-DCJN-V1y.cjs');
+var session = require('./session-BnoHxzFq.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-BPRwn4Yc.cjs');
-var runtimeGate = require('./runtime-gate-BMSY22AL.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-XAZFauvZ.cjs');
 var node_crypto = require('node:crypto');
-var context = require('./context-CA_Q1lyH.cjs');
+var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
+var context = require('./context-DuxaBL3Y.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -23,7 +23,7 @@ require('buffer');
 require('util');
 require('fs');
 require('constants');
-require('./version-BONZQWPR.cjs');
+require('./version-BGzCIQhE.cjs');
 require('node:async_hooks');
 
 async function getCDNUploadInfo(options, runtime = {}) {
@@ -272,7 +272,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-CsP_x6y6.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-KHhdZ8eZ.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -509,6 +509,7 @@ async function runDeployCommand(options, runtime = {}) {
         throw new Error('未在 package.json 中找到 heybox.miniProgramId，请先配置 mini program id');
     }
     const fromVersion = options.fromVersion?.trim();
+    const declaredPlatforms = fromVersion ? undefined : runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
     const releaseNote = await resolveDeployReleaseNote(options, runtime);
     const session$1 = await logger.task('正在校验 Heybox 登录态', () => (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }), { successText: 'Heybox 登录态有效' });
     logger.debug(`Heybox API: ${apiBaseUrl}`);
@@ -583,6 +584,9 @@ async function runDeployCommand(options, runtime = {}) {
             const distDir = path.join(projectRoot, 'dist');
             const parsedManifest = await readDeployManifest(projectRoot, logger);
             ({ manifest, version } = parsedManifest);
+            if (!declaredPlatforms || !runtimePermissionEnv.areMiniappPlatformsEqual(parsedManifest.platforms, declaredPlatforms)) {
+                throw new Error('dist/manifest.json.platforms 与 package.json#heybox.platforms 不一致，请重新 build 后再 deploy');
+            }
             if (version !== precheckVersion) {
                 throw new Error(`dist/manifest.json.version (${version}) 与预检版本 (${precheckVersion}) 不一致，请重新 build 后再 deploy`);
             }
@@ -734,11 +738,11 @@ async function readDeployManifest(projectRoot, logger) {
     if (!runtimeGate.hasMiniappRuntimeGate(entryHtml)) {
         throw new Error('dist/index.html 缺少平台 Runtime 启动门禁，请在 Vite 配置中启用 miniappManifest() 后重新 build');
     }
-    const { manifest, hadBom } = runtimeGate.parseMiniappManifestJson(await fs$1.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
+    const { manifest, hadBom } = runtimePermissionEnv.parseMiniappManifestJson(await fs$1.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
     if (hadBom) {
         logger.warn('dist/manifest.json 包含 BOM，已自动剥离');
     }
-    const validated = runtimeGate.validateMiniappManifestForDeploy(manifest);
+    const validated = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
     return {
         manifest: { ...manifest, platforms: validated.platforms },
         sdkVersion: validated.sdkVersion,
@@ -747,7 +751,7 @@ async function readDeployManifest(projectRoot, logger) {
     };
 }
 function validateVersionForDeploy(version, sourceLabel) {
-    if (typeof version !== 'string' || !runtimeGate.isValidMiniappManifestVersion(version)) {
+    if (typeof version !== 'string' || !runtimePermissionEnv.isValidMiniappManifestVersion(version)) {
         throw new Error(`${sourceLabel} 必须是合法 SemVer，允许 prerelease，不允许 build metadata 和 0.0.0：${String(version)}`);
     }
     return version.trim();

package/dist/cli-chunks/{runtime-gate-BMSY22AL.cjs → runtime-gate-BWb8QIcX.cjs}

@@ -1,109 +1,5 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-BPRwn4Yc.cjs');
-
-const MINIAPP_PLATFORM_VALUES = ['android', 'ios', 'ohos', 'windows', 'macos', 'linux'];
-function isValidMiniappManifestVersion(version) {
-    return getMiniappManifestVersionError(version) === undefined;
-}
-function validateMiniappManifestVersion(version, sourceLabel = 'manifest.version') {
-    const error = getMiniappManifestVersionError(version);
-    if (error) {
-        throw new Error(`${sourceLabel} ${error}`);
-    }
-    return String(version).trim();
-}
-function parseMiniappManifestJson(raw, sourceLabel = 'manifest.json') {
-    const hadBom = raw.charCodeAt(0) === 0xfeff;
-    const text = hadBom ? raw.slice(1) : raw;
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch (error) {
-        throw new Error(`${sourceLabel} 不是合法 JSON：${formatReason(error)}`);
-    }
-    if (!isManifestRecord(parsed)) {
-        throw new Error(`${sourceLabel} 必须是 JSON 对象`);
-    }
-    return {
-        manifest: parsed,
-        hadBom,
-    };
-}
-function validateMiniappManifestForDeploy(manifest) {
-    const version = validateMiniappManifestVersion(manifest.version, 'manifest.version');
-    const sdkVersion = validateSdkVersion(manifest.sdkVersion, 'manifest.sdkVersion');
-    const permissions = runtimePermissionEnv.parseMiniappPermissions(manifest.permissions, {
-        present: Object.prototype.hasOwnProperty.call(manifest, 'permissions'),
-        sdkVersion,
-        sourceLabel: 'manifest.permissions',
-    });
-    return {
-        version,
-        sdkVersion,
-        platforms: validateMiniappPlatforms(manifest.platforms, 'manifest.platforms'),
-        ...(permissions.permissions === undefined ? {} : { permissions: permissions.permissions }),
-    };
-}
-function validateMiniappPlatforms(platforms, sourceLabel = 'platforms') {
-    if (!Array.isArray(platforms) || platforms.length === 0) {
-        throw new Error(`${sourceLabel} 必须是非空平台数组`);
-    }
-    const allowedPlatforms = new Set(MINIAPP_PLATFORM_VALUES);
-    const seen = new Set();
-    for (const platform of platforms) {
-        if (typeof platform !== 'string' || !allowedPlatforms.has(platform)) {
-            throw new Error(`${sourceLabel} 包含不支持的平台：${String(platform)}`);
-        }
-        if (seen.has(platform)) {
-            throw new Error(`${sourceLabel} 包含重复平台：${platform}`);
-        }
-        seen.add(platform);
-    }
-    return Object.freeze(MINIAPP_PLATFORM_VALUES.filter((platform) => seen.has(platform)));
-}
-function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
-    if (typeof version !== 'string' || version.trim() === '') {
-        throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
-    }
-    const normalized = version.trim();
-    const parsed = runtimePermissionEnv.semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function isManifestRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function getMiniappManifestVersionError(version) {
-    if (typeof version !== 'string' || version.trim() === '') {
-        return `必须是合法 SemVer：${String(version)}`;
-    }
-    const normalized = version.trim();
-    const parsed = runtimePermissionEnv.semverExports.parse(normalized);
-    if (!parsed) {
-        return `必须是合法 SemVer：${normalized}`;
-    }
-    if (parsed.build.length > 0) {
-        return `不能包含 build metadata：${normalized}`;
-    }
-    if (parsed.version !== normalized) {
-        return `必须是合法 SemVer：${normalized}`;
-    }
-    if (parsed.major === 0 && parsed.minor === 0 && parsed.patch === 0) {
-        return '不能是模板默认版本 0.0.0';
-    }
-    return undefined;
-}
-function formatReason(error) {
-    if (error instanceof Error && error.message) {
-        return error.message;
-    }
-    return String(error);
-}
-
 const UNDEFINED_CODE_POINTS = new Set([
     65534, 65535, 131070, 131071, 196606, 196607, 262142, 262143, 327678, 327679, 393214,
     393215, 458750, 458751, 524286, 524287, 589822, 589823, 655358, 655359, 720894,
@@ -8390,6 +8286,3 @@ function walk(node, visit) {
 }
 
 exports.hasMiniappRuntimeGate = hasMiniappRuntimeGate;
-exports.isValidMiniappManifestVersion = isValidMiniappManifestVersion;
-exports.parseMiniappManifestJson = parseMiniappManifestJson;
-exports.validateMiniappManifestForDeploy = validateMiniappManifestForDeploy;

package/dist/cli-chunks/{runtime-permission-env-BPRwn4Yc.cjs → runtime-permission-env-XAZFauvZ.cjs}

@@ -2,7 +2,7 @@
 
 var fs = require('node:fs');
 var path = require('node:path');
-var version = require('./version-BONZQWPR.cjs');
+var version = require('./version-BGzCIQhE.cjs');
 var node_async_hooks = require('node:async_hooks');
 
 var re = {exports: {}};
@@ -3069,6 +3069,111 @@ function isRecord$1(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
+const MINIAPP_PLATFORM_VALUES = ['android', 'ios', 'ohos', 'windows', 'macos', 'linux'];
+function isValidMiniappManifestVersion(version) {
+    return getMiniappManifestVersionError(version) === undefined;
+}
+function validateMiniappManifestVersion(version, sourceLabel = 'manifest.version') {
+    const error = getMiniappManifestVersionError(version);
+    if (error) {
+        throw new Error(`${sourceLabel} ${error}`);
+    }
+    return String(version).trim();
+}
+function parseMiniappManifestJson(raw, sourceLabel = 'manifest.json') {
+    const hadBom = raw.charCodeAt(0) === 0xfeff;
+    const text = hadBom ? raw.slice(1) : raw;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`${sourceLabel} 不是合法 JSON：${formatReason$1(error)}`);
+    }
+    if (!isManifestRecord(parsed)) {
+        throw new Error(`${sourceLabel} 必须是 JSON 对象`);
+    }
+    return {
+        manifest: parsed,
+        hadBom,
+    };
+}
+function validateMiniappManifestForDeploy(manifest) {
+    const version = validateMiniappManifestVersion(manifest.version, 'manifest.version');
+    const sdkVersion = validateSdkVersion(manifest.sdkVersion, 'manifest.sdkVersion');
+    const permissions = parseMiniappPermissions(manifest.permissions, {
+        present: Object.prototype.hasOwnProperty.call(manifest, 'permissions'),
+        sdkVersion,
+        sourceLabel: 'manifest.permissions',
+    });
+    return {
+        version,
+        sdkVersion,
+        platforms: validateMiniappPlatforms(manifest.platforms, 'manifest.platforms'),
+        ...(permissions.permissions === undefined ? {} : { permissions: permissions.permissions }),
+    };
+}
+function validateMiniappPlatforms(platforms, sourceLabel = 'platforms') {
+    if (!Array.isArray(platforms) || platforms.length === 0) {
+        throw new Error(`${sourceLabel} 必须是非空平台数组`);
+    }
+    const allowedPlatforms = new Set(MINIAPP_PLATFORM_VALUES);
+    const seen = new Set();
+    for (const platform of platforms) {
+        if (typeof platform !== 'string' || !allowedPlatforms.has(platform)) {
+            throw new Error(`${sourceLabel} 包含不支持的平台：${String(platform)}`);
+        }
+        if (seen.has(platform)) {
+            throw new Error(`${sourceLabel} 包含重复平台：${platform}`);
+        }
+        seen.add(platform);
+    }
+    return Object.freeze(MINIAPP_PLATFORM_VALUES.filter((platform) => seen.has(platform)));
+}
+function areMiniappPlatformsEqual(left, right) {
+    return left.length === right.length && left.every((platform, index) => platform === right[index]);
+}
+function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
+    if (typeof version !== 'string' || version.trim() === '') {
+        throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
+    }
+    const normalized = version.trim();
+    const parsed = semverExports.parse(normalized);
+    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
+        throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
+    }
+    return normalized;
+}
+function isManifestRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function getMiniappManifestVersionError(version) {
+    if (typeof version !== 'string' || version.trim() === '') {
+        return `必须是合法 SemVer：${String(version)}`;
+    }
+    const normalized = version.trim();
+    const parsed = semverExports.parse(normalized);
+    if (!parsed) {
+        return `必须是合法 SemVer：${normalized}`;
+    }
+    if (parsed.build.length > 0) {
+        return `不能包含 build metadata：${normalized}`;
+    }
+    if (parsed.version !== normalized) {
+        return `必须是合法 SemVer：${normalized}`;
+    }
+    if (parsed.major === 0 && parsed.minor === 0 && parsed.patch === 0) {
+        return '不能是模板默认版本 0.0.0';
+    }
+    return undefined;
+}
+function formatReason$1(error) {
+    if (error instanceof Error && error.message) {
+        return error.message;
+    }
+    return String(error);
+}
+
 const MINIAPP_UPLOAD_SCOPE = 'activity';
 const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 const MINIAPP_UPLOAD_BATCH_SIZE = 50;
@@ -3359,14 +3464,16 @@ function findNearestPackageJsonPath(startDir) {
         current = parent;
     }
 }
+function readMiniappPlatformsFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return validateMiniappPlatforms(heybox?.platforms, 'package.json#heybox.platforms');
+}
 function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
     const { packageJson } = readMiniappPackageJson(root);
-    const heybox = packageJson.heybox;
-    if (heybox !== undefined && !isRecord(heybox)) {
-        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
-    }
-    const present = isRecord(heybox) && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
-    return parseMiniappPermissions(isRecord(heybox) ? heybox.permissions : undefined, {
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    const present = heybox !== undefined && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
+    return parseMiniappPermissions(heybox?.permissions, {
         present,
         sdkVersion,
     });
@@ -3397,6 +3504,12 @@ function readMiniappPackageJson(root, requireVersion) {
     }
     return { packageJson, version: typeof packageJson.version === 'string' ? packageJson.version.trim() : '' };
 }
+function readMiniappHeyboxConfig(packageJson) {
+    if (packageJson.heybox !== undefined && !isRecord(packageJson.heybox)) {
+        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
+    }
+    return packageJson.heybox;
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -3498,23 +3611,26 @@ exports.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = USER_MINIPROGRAM_ACCESS_STATUS
 exports.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;
 exports.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH = USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH;
 exports.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH;
+exports.areMiniappPlatformsEqual = areMiniappPlatformsEqual;
 exports.composeMiniappRuntimePermissions = composeMiniappRuntimePermissions;
 exports.createMiniappArtifactFileHeader = createMiniappArtifactFileHeader;
 exports.createMiniappArtifactSignatureHeader = createMiniappArtifactSignatureHeader;
 exports.createMiniappPlatformCspEnv = createMiniappPlatformCspEnv;
 exports.getMissingPermissionsWarning = getMissingPermissionsWarning;
+exports.isValidMiniappManifestVersion = isValidMiniappManifestVersion;
 exports.normalizeRelativePath = normalizeRelativePath;
 exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;
-exports.parseMiniappPermissions = parseMiniappPermissions;
+exports.parseMiniappManifestJson = parseMiniappManifestJson;
 exports.prepareMiniappArtifactFiles = prepareMiniappArtifactFiles;
 exports.readMiniappPermissionsFromPackageJson = readMiniappPermissionsFromPackageJson;
+exports.readMiniappPlatformsFromPackageJson = readMiniappPlatformsFromPackageJson;
 exports.relativePathContainsNodeModulesSegment = relativePathContainsNodeModulesSegment;
 exports.requireSemver = requireSemver;
 exports.resolveMiniappSdkVersion = resolveMiniappSdkVersion;
 exports.resolveMiniappUploadSessionFiles = resolveMiniappUploadSessionFiles;
-exports.semverExports = semverExports;
 exports.shouldSkipMiniappPlatformCspFromEnv = shouldSkipMiniappPlatformCspFromEnv;
 exports.shouldUploadDistFile = shouldUploadDistFile;
+exports.validateMiniappManifestForDeploy = validateMiniappManifestForDeploy;
 exports.validateMiniappUploadPathLengths = validateMiniappUploadPathLengths;
 exports.validateUploadTotalSize = validateUploadTotalSize;
 exports.withMiniappPlatformCspEnv = withMiniappPlatformCspEnv;

package/dist/cli-chunks/{session-C0eIKZ6V.cjs → session-BnoHxzFq.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-BEn7WaqA.cjs');
+var index = require('./index-DCJN-V1y.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli-chunks/{skill-DpInwbiA.cjs → skill-CDEJtATn.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
 var path = require('node:path');
-var version = require('./version-BONZQWPR.cjs');
+var version = require('./version-BGzCIQhE.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs/promises');
-var index = require('./index-BEn7WaqA.cjs');
+var index = require('./index-DCJN-V1y.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{version-BONZQWPR.cjs → version-BGzCIQhE.cjs}

@@ -3,6 +3,6 @@
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.2';
+    : '0.8.1-alpha.3';
 
 exports.HB_SDK_VERSION = HB_SDK_VERSION;

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-BEn7WaqA.cjs');
+var index = require('./cli-chunks/index-DCJN-V1y.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/index.cjs.js

@@ -799,7 +799,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.2';
+    : '0.8.1-alpha.3';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/index.esm.js

@@ -795,7 +795,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.2';
+    : '0.8.1-alpha.3';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/templates/vanilla-vite-js/README.md.ejs

@@ -9,6 +9,6 @@ npm run build
 npm run deploy -- --release-note "更新说明"
 ```
 
-`vite.config.js` 默认声明 `android`、`ios`、`ohos`。发布前请在每个声明的平台完成真机验收；需要支持桌面平台时，由项目自行加入并验收。
+`package.json#heybox.platforms` 默认声明 `android`、`ios`、`ohos`。发布前请在每个声明的平台完成真机验收；需要支持桌面平台时，由项目自行加入并验收。
 
 更多内容见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli) 和 [SDK 文档](https://docs.xiaoheihe.cn/hb_sdk/)。

package/dist/templates/vanilla-vite-js/package.json.ejs

@@ -5,6 +5,7 @@
   "type": "module",
   "heybox": {
     "miniProgramId": "",
+    "platforms": ["android", "ios", "ohos"],
     "permissions": {}
   },
   "scripts": {

package/dist/templates/vanilla-vite-js/vite.config.js

@@ -3,5 +3,5 @@ import { defineConfig } from 'vite';
 
 export default defineConfig({
   base: './',
-  plugins: [miniappManifest({ platforms: ['android', 'ios', 'ohos'] })],
+  plugins: [miniappManifest()],
 });

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.2';
+    : '0.8.1-alpha.3';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。
@@ -3085,14 +3085,16 @@ function findNearestPackageJsonPath(startDir) {
 function readMiniappVersionFromPackageJson(root) {
     return readMiniappPackageJson(root, true).version;
 }
+function readMiniappPlatformsFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root, false);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return validateMiniappPlatforms(heybox?.platforms, 'package.json#heybox.platforms');
+}
 function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
     const { packageJson } = readMiniappPackageJson(root, false);
-    const heybox = packageJson.heybox;
-    if (heybox !== undefined && !isRecord(heybox)) {
-        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
-    }
-    const present = isRecord(heybox) && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
-    return parseMiniappPermissions(isRecord(heybox) ? heybox.permissions : undefined, {
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    const present = heybox !== undefined && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
+    return parseMiniappPermissions(heybox?.permissions, {
         present,
         sdkVersion,
     });
@@ -3118,6 +3120,12 @@ function readMiniappPackageJson(root, requireVersion) {
     }
     return { packageJson, version: typeof packageJson.version === 'string' ? packageJson.version.trim() : '' };
 }
+function readMiniappHeyboxConfig(packageJson) {
+    if (packageJson.heybox !== undefined && !isRecord(packageJson.heybox)) {
+        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
+    }
+    return packageJson.heybox;
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -11903,8 +11911,7 @@ function injectMiniDevConsoleBootstrap(html) {
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 const miniDevLoggingConstant = ['__HB_SDK_DEV', 'LOGGING__'].join('_');
-function miniappManifest(options) {
-    const platforms = validateMiniappPlatforms(options?.platforms, 'miniappManifest().platforms');
+function miniappManifest() {
     const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
@@ -11951,7 +11958,8 @@ function miniappManifest(options) {
                 skipPlatformCsp,
             });
             return command === 'serve' ? injectMiniDevConsoleBootstrap(enforced) : enforced;
-        }, async closeBundle() {
+        },
+        async closeBundle() {
             // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
             // 若此时再抛「缺 index.html」等二次错误，会掩盖真实失败原因。
             if (priorBuildError) {
@@ -11959,6 +11967,7 @@ function miniappManifest(options) {
             }
             const version = validateMiniappPackageVersionForBuild(readMiniappVersionFromPackageJson(root));
             const sdkVersion = resolveSdkVersion();
+            const platforms = readMiniappPlatformsFromPackageJson(root);
             const parsedPermissions = readMiniappPermissionsFromPackageJson(root, sdkVersion);
             if (!parsedPermissions.declared)
                 this.warn(getMissingPermissionsWarning());

package/dist/vite.esm.js

@@ -5,7 +5,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.2';
+    : '0.8.1-alpha.3';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。
@@ -3082,14 +3082,16 @@ function findNearestPackageJsonPath(startDir) {
 function readMiniappVersionFromPackageJson(root) {
     return readMiniappPackageJson(root, true).version;
 }
+function readMiniappPlatformsFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root, false);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return validateMiniappPlatforms(heybox?.platforms, 'package.json#heybox.platforms');
+}
 function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
     const { packageJson } = readMiniappPackageJson(root, false);
-    const heybox = packageJson.heybox;
-    if (heybox !== undefined && !isRecord(heybox)) {
-        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
-    }
-    const present = isRecord(heybox) && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
-    return parseMiniappPermissions(isRecord(heybox) ? heybox.permissions : undefined, {
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    const present = heybox !== undefined && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
+    return parseMiniappPermissions(heybox?.permissions, {
         present,
         sdkVersion,
     });
@@ -3115,6 +3117,12 @@ function readMiniappPackageJson(root, requireVersion) {
     }
     return { packageJson, version: typeof packageJson.version === 'string' ? packageJson.version.trim() : '' };
 }
+function readMiniappHeyboxConfig(packageJson) {
+    if (packageJson.heybox !== undefined && !isRecord(packageJson.heybox)) {
+        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
+    }
+    return packageJson.heybox;
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -11900,8 +11908,7 @@ function injectMiniDevConsoleBootstrap(html) {
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 const miniDevLoggingConstant = ['__HB_SDK_DEV', 'LOGGING__'].join('_');
-function miniappManifest(options) {
-    const platforms = validateMiniappPlatforms(options?.platforms, 'miniappManifest().platforms');
+function miniappManifest() {
     const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
@@ -11948,7 +11955,8 @@ function miniappManifest(options) {
                 skipPlatformCsp,
             });
             return command === 'serve' ? injectMiniDevConsoleBootstrap(enforced) : enforced;
-        }, async closeBundle() {
+        },
+        async closeBundle() {
             // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
             // 若此时再抛「缺 index.html」等二次错误，会掩盖真实失败原因。
             if (priorBuildError) {
@@ -11956,6 +11964,7 @@ function miniappManifest(options) {
             }
             const version = validateMiniappPackageVersionForBuild(readMiniappVersionFromPackageJson(root));
             const sdkVersion = resolveSdkVersion();
+            const platforms = readMiniappPlatformsFromPackageJson(root);
             const parsedPermissions = readMiniappPermissionsFromPackageJson(root, sdkVersion);
             if (!parsedPermissions.declared)
                 this.warn(getMissingPermissionsWarning());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.8.1-alpha.2",
+  "version": "0.8.1-alpha.3",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -62,7 +62,7 @@
     "skills": "1.5.23",
     "undici": "^7.28.0",
     "ws": "^8.18.0",
-    "@heybox/hb-sdk-protocol": "0.8.1-alpha.2"
+    "@heybox/hb-sdk-protocol": "0.8.1-alpha.3"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -113,13 +113,13 @@
     "vue-tsc": "^3.3.7",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
     "@heybox-domain/heybox-theme": "~0.1.0",
+    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
+    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.3",
     "@heybox/hb-api": "~1.28.2",
-    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.2",
-    "@heybox/runtime-policy": "~0.2.0",
+    "@heybox/runtime": "~0.2.0",
     "@heybox/runtime-transport-fetch": "~0.2.0",
-    "@heybox/runtime": "~0.2.0"
+    "@heybox/runtime-policy": "~0.2.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/SKILL.md

@@ -61,7 +61,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 2. Use `hb-sdk dev` for Browser Mock and Mobile App debugging. Browser debugging can start without CLI login, project binding, or a remote Dev Context; capabilities that need those inputs fail explicitly. Mobile uses the single QR entry with the `open_inapp` and `heybox://` `openWindow` wrapper around a LAN short URL, then opens `heybox-mini-dev://sandbox` with the complete launch context.
 3. The debugging page does not edit permissions. Treat the validated remote permission snapshot as canonical Runtime input. Use `--port`, `--browser-dev-host-port`, and `--no-open` to control local endpoints and browser opening. Select a Mobile network interface the device can reach. `launch.json` is a LAN discovery document, not authentication, encryption, signing, or HMAC protection.
 4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
-5. Keep `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the required Manifest or Runtime gate output is missing.
+5. Declare the actual supported platforms in `package.json#heybox.platforms` and keep the no-argument `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the declaration, Manifest, or Runtime gate output is missing or inconsistent.
 6. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
 7. Existing projects may continue to use `vite build`; do not auto-migrate them. Do not invent `--mode`, `--json`, config, or output-directory flags for `hb-sdk build`.
 8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` for remote management, publishing, Mobile debugging, and optional Browser Mock Host `heybox-session` requests. Browser debugging itself can start without CLI login. Mini-program code must still call `auth.login()`; the debug page only confirms authorization. Do not paste CLI credentials into page JavaScript. Phone debugging continues to use the App login.
@@ -97,7 +97,7 @@ For CLI and local development:
 1. Do not print, persist in templates, or pass through pkey, cookies, tokens, or private credentials.
 2. Do not skip `auth.login()` in mini-program code. Browser Mock may reuse the Node `hb-sdk login` session for Host network requests, but the page must still call `auth.login()` and handle the authorization dialog. Never paste CLI credentials into page JavaScript.
 3. Use the built-in local debugging page instead of creating another browser Mock.
-4. Keep the Vite `miniappManifest()` plugin enabled.
+4. Keep target platforms in `package.json#heybox.platforms` and the no-argument Vite `miniappManifest()` plugin enabled. Do not configure platforms in Vite or maintain a second platform list.
 5. Do not suggest changing or resetting permissions in the `hb-sdk dev` debugging page; that UI does not exist. Diagnose permission behavior from the remote snapshot and capability result.
 6. Treat browser Mock results as development feedback only. Validate permissions, identity flows, and user interactions again in a real Heybox client before publishing.
 7. The Browser Dev Host offers iPhone 16 Pro Max (`440 x 956`) and Pixel 9 Pro (`410 x 914`) presets. Switching a preset must preserve the iframe, Runtime session, and page state. Authorization/action dialogs, Toast, Loading, and vibration feedback render inside the preview. Use the upper-right QR popover as the only Mobile QR entry.

package/skill/references/api-protocol.md

@@ -302,9 +302,9 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成，不
 | Root API | 2 | 4 | 67 | 62 | 2 |
 | Protocol API | 0 | 13 | 58 | 90 | 47 |
 | Miniapp Publish API | 0 | 5 | 2 | 0 | 0 |
-| Vite API | 0 | 1 | 5 | 1 | 1 |
+| Vite API | 0 | 1 | 4 | 1 | 1 |
 
-<!-- Generated by apps/docs/hb-sdk/scripts/generate-api-docs.ts; schemaVersion=4; fingerprint=1b6c6a8f921122d588700ac1323b6c46a2ee6d331c585078527612b218546757 -->
+<!-- Generated by apps/docs/hb-sdk/scripts/generate-api-docs.ts; schemaVersion=4; fingerprint=a8018ebd23e4d885efbe08f622a6cf4780dd152d5f90cc4a78d2eb7e15eca2e2 -->
 
 ## SDK API
 

package/skill/references/api-root.md

@@ -26,7 +26,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.8.1-alpha.2`
+- Version at generation time: `0.8.1-alpha.3`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -248,11 +248,13 @@ import {
   MINIAPP_PLATFORM_VALUES,
   renderMiniappManifest,
   validateMiniappPackageVersionForBuild,
-  validateMiniappPlatforms,
   type MiniappPlatform,
 } from '../miniapp-manifest/schema';
-import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
-import { readMiniappPermissionsFromPackageJson } from '../miniapp-manifest/node';
+import {
+  readMiniappPermissionsFromPackageJson,
+  readMiniappPlatformsFromPackageJson,
+  readMiniappVersionFromPackageJson,
+} from '../miniapp-manifest/node';
 import { getMissingPermissionsWarning } from '../miniapp-manifest/permissions';
 import { enforceMiniappHtmlPolicy } from './html-policy';
 import { shouldSkipMiniappPlatformCspFromEnv } from './runtime-permission-env';
@@ -322,16 +324,11 @@ function injectMiniDevConsoleBootstrap(html: string): string {
   return `${html.slice(0, insertAt)}${bootstrap}${html.slice(insertAt)}`;
 }
 
-export interface MiniappManifestOptions {
-  platforms: readonly MiniappPlatform[];
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 const miniDevLoggingConstant = ['__HB_SDK_DEV', 'LOGGING__'].join('_');
 
-export function miniappManifest(options: MiniappManifestOptions): MiniappManifestPlugin {
-  const platforms = validateMiniappPlatforms(options?.platforms, 'miniappManifest().platforms');
+export function miniappManifest(): MiniappManifestPlugin {
   const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
   let root = process.cwd();
   let outDir = 'dist';
@@ -379,7 +376,8 @@ export function miniappManifest(options: MiniappManifestOptions): MiniappManifes
         skipPlatformCsp,
       });
       return command === 'serve' ? injectMiniDevConsoleBootstrap(enforced) : enforced;
-    },    async closeBundle() {
+    },
+    async closeBundle() {
       // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
       // 若此时再抛「缺 index.html」等二次错误，会掩盖真实失败原因。
       if (priorBuildError) {
@@ -388,6 +386,7 @@ export function miniappManifest(options: MiniappManifestOptions): MiniappManifes
 
       const version = validateMiniappPackageVersionForBuild(readMiniappVersionFromPackageJson(root));
       const sdkVersion = resolveSdkVersion();
+      const platforms = readMiniappPlatformsFromPackageJson(root);
       const parsedPermissions = readMiniappPermissionsFromPackageJson(root, sdkVersion);
       if (!parsedPermissions.declared) this.warn(getMissingPermissionsWarning());
       const outputRoot = path.resolve(root, outDir);
@@ -469,7 +468,7 @@ function resolveHmrWebSocketUrl(resolved: MiniappManifestResolvedConfig) {
 hb-sdk build [--env <name>] [--verbose]
 ```
 
-`hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `vite.config.ts` 中显式注册 `miniappManifest()`。
+`hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `package.json#heybox.platforms` 声明目标平台，并在 `vite.config.ts` 中显式注册无参的 `miniappManifest()`；配置与构建产物不一致时构建失败。
 
 直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端批准结果，并与当前版本声明取交集；仅当有效 `network` 权限启用时才跳过平台 CSP，`useOfficialDomain` 不参与该判定。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
 

package/skill/references/cli.md

@@ -162,7 +162,7 @@ Browser Mock uses the Node `hb-sdk login` session to send Host `heybox-session`
 hb-sdk build [--env <name>] [--verbose]
 ```
 
-`hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `vite.config.ts` 中显式注册 `miniappManifest()`。
+`hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `package.json#heybox.platforms` 声明目标平台，并在 `vite.config.ts` 中显式注册无参的 `miniappManifest()`；配置与构建产物不一致时构建失败。
 
 直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端批准结果，并与当前版本声明取交集；仅当有效 `network` 权限启用时才跳过平台 CSP，`useOfficialDomain` 不参与该判定。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
 
@@ -181,7 +181,7 @@ hb-sdk build [--env <name>] [--verbose]
 Agent rules:
 
 - Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry.
-- Require explicit `miniappManifest()` configuration and keep typechecking in the project's `scripts.build`.
+- Require target platforms in `package.json#heybox.platforms`, keep the no-argument `miniappManifest()` configured, and keep typechecking in the project's `scripts.build`.
 - Do not claim `hb-sdk build` needs login, binding, or network access, and do not invent unsupported build flags.
 - Existing `vite build` projects remain compatible and must not be auto-migrated.
 

package/skill/references/examples.md

@@ -165,13 +165,21 @@ hb-sdk login clear
 
 ### Vite manifest plugin
 
+```json
+{
+  "heybox": {
+    "platforms": ["android", "ios", "ohos"]
+  }
+}
+```
+
 ```ts
 import { miniappManifest } from '@heybox/hb-sdk/vite';
 import { defineConfig } from 'vite';
 
 export default defineConfig({
   base: './',
-  plugins: [miniappManifest({ platforms: ['android', 'ios', 'ohos'] })],
+  plugins: [miniappManifest()],
 });
 ```
 

package/skill/references/safety-boundaries.md

@@ -35,7 +35,7 @@
 - Host 文件错误只保留稳定 code 与 canonical 安全文案；原始 message、data、native path 和 credential 不会进入小程序。
 - `FileStat.size` 是非负 safe integer；`modifiedAt` / `createdAt` 若存在，单位为 Unix epoch milliseconds。
 - 仅当当前版本声明且平台已批准 `network` 时，`hb-sdk dev` 与 `hb-sdk remote deploy` 构建才会跳过平台 CSP；其他构建继续注入平台 CSP。`useOfficialDomain` 不参与 CSP 跳过判定。
-- 构建必须启用 `miniappManifest({ platforms })` 并显式声明实际承诺适配的平台，推荐统一使用 `hb-sdk build`。新项目模板中的 `['android', 'ios', 'ohos']` 只是初始配置，不代表已经完成真机验收。
+- 构建必须启用 `miniappManifest()`，并在 `package.json#heybox.platforms` 显式声明实际承诺适配的平台，推荐统一使用 `hb-sdk build`。新项目模板中的 `['android', 'ios', 'ohos']` 只是初始配置，不代表已经完成真机验收。
 
 私有 Page Channel 适配没有修改 `@heybox/hb-sdk` 公开 API 或 iframe wire；本次 files/download
 Runtime 能力随 `0.8.0-alpha.11` release family 发布，部署 detail 前必须保证

package/skill/skill.json

@@ -1,16 +1,16 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.8.1-alpha.2+skill.99494863257b",
+  "skillVersion": "0.8.1-alpha.3+skill.c60361a729d0",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.2",
-    "compatibility": "0.8.1-alpha.2"
+    "version": "0.8.1-alpha.3",
+    "compatibility": "0.8.1-alpha.3"
   },
   "distribution": {
     "type": "npm",
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.2",
+    "version": "0.8.1-alpha.3",
     "path": "skill"
   },
-  "integrity": "sha256-99494863257b8e51843a42bb94c2e40555a1cc28f11ca0f7da37473e19424bdf"
+  "integrity": "sha256-c60361a729d0821a4a2d350d1d06a92ad94abfb77ae2f42320fce078fba023e1"
 }

package/types/miniapp-manifest/node.d.ts

@@ -1,4 +1,6 @@
 import { type ParsedMiniappPermissions } from './permissions';
+import type { MiniappPlatform } from './schema';
 export declare function readMiniappVersionFromPackageJson(root: string): string;
+export declare function readMiniappPlatformsFromPackageJson(root: string): readonly MiniappPlatform[];
 export declare function readMiniappPermissionsFromPackageJson(root: string, sdkVersion: string): ParsedMiniappPermissions;
 export declare function resolveMiniappSdkVersion(): string;

package/types/miniapp-manifest/schema.d.ts

@@ -27,4 +27,5 @@ export declare function validateMiniappManifestForDeploy(manifest: MiniappManife
     platforms: readonly ("android" | "ios" | "ohos" | "windows" | "macos" | "linux")[];
 };
 export declare function validateMiniappPlatforms(platforms: unknown, sourceLabel?: string): readonly MiniappPlatform[];
+export declare function areMiniappPlatformsEqual(left: readonly MiniappPlatform[], right: readonly MiniappPlatform[]): boolean;
 export declare function validateSdkVersion(version: unknown, sourceLabel?: string): string;

package/types/vite/index.d.ts

@@ -40,7 +40,4 @@ export interface MiniappManifestResolvedConfig {
 }
 export { MINIAPP_PLATFORM_VALUES };
 export type { MiniappPlatform };
-export interface MiniappManifestOptions {
-    platforms: readonly MiniappPlatform[];
-}
-export declare function miniappManifest(options: MiniappManifestOptions): MiniappManifestPlugin;
+export declare function miniappManifest(): MiniappManifestPlugin;