@heybox/hb-sdk 0.8.2-alpha.1 → 0.8.2-alpha.5

package/dist/cli-chunks/{runtime-gate-BWb8QIcX.cjs → runtime-permission-env-COWketgE.cjs}

@@ -1,5 +1,3673 @@
 'use strict';
 
+var fs = require('node:fs');
+var path = require('node:path');
+var version = require('./version-hHrSPRwW.cjs');
+require('node:crypto');
+var node_async_hooks = require('node:async_hooks');
+
+var re = {exports: {}};
+
+var constants;
+var hasRequiredConstants;
+
+function requireConstants () {
+	if (hasRequiredConstants) return constants;
+	hasRequiredConstants = 1;
+
+	// Note: this is the semver.org version of the spec that it implements
+	// Not necessarily the package version of this code.
+	const SEMVER_SPEC_VERSION = '2.0.0';
+
+	const MAX_LENGTH = 256;
+	const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
+	/* istanbul ignore next */ 9007199254740991;
+
+	// Max safe segment length for coercion.
+	const MAX_SAFE_COMPONENT_LENGTH = 16;
+
+	// Max safe length for a build identifier. The max length minus 6 characters for
+	// the shortest version with a build 0.0.0+BUILD.
+	const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6;
+
+	const RELEASE_TYPES = [
+	  'major',
+	  'premajor',
+	  'minor',
+	  'preminor',
+	  'patch',
+	  'prepatch',
+	  'prerelease',
+	];
+
+	constants = {
+	  MAX_LENGTH,
+	  MAX_SAFE_COMPONENT_LENGTH,
+	  MAX_SAFE_BUILD_LENGTH,
+	  MAX_SAFE_INTEGER,
+	  RELEASE_TYPES,
+	  SEMVER_SPEC_VERSION,
+	  FLAG_INCLUDE_PRERELEASE: 0b001,
+	  FLAG_LOOSE: 0b010,
+	};
+	return constants;
+}
+
+var debug_1;
+var hasRequiredDebug;
+
+function requireDebug () {
+	if (hasRequiredDebug) return debug_1;
+	hasRequiredDebug = 1;
+
+	const debug = (
+	  typeof process === 'object' &&
+	  process.env &&
+	  process.env.NODE_DEBUG &&
+	  /\bsemver\b/i.test(process.env.NODE_DEBUG)
+	) ? (...args) => console.error('SEMVER', ...args)
+	  : () => {};
+
+	debug_1 = debug;
+	return debug_1;
+}
+
+var hasRequiredRe;
+
+function requireRe () {
+	if (hasRequiredRe) return re.exports;
+	hasRequiredRe = 1;
+	(function (module, exports) {
+
+		const {
+		  MAX_SAFE_COMPONENT_LENGTH,
+		  MAX_SAFE_BUILD_LENGTH,
+		  MAX_LENGTH,
+		} = requireConstants();
+		const debug = requireDebug();
+		exports = module.exports = {};
+
+		// The actual regexps go on exports.re
+		const re = exports.re = [];
+		const safeRe = exports.safeRe = [];
+		const src = exports.src = [];
+		const safeSrc = exports.safeSrc = [];
+		const t = exports.t = {};
+		let R = 0;
+
+		const LETTERDASHNUMBER = '[a-zA-Z0-9-]';
+
+		// Replace some greedy regex tokens to prevent regex dos issues. These regex are
+		// used internally via the safeRe object since all inputs in this library get
+		// normalized first to trim and collapse all extra whitespace. The original
+		// regexes are exported for userland consumption and lower level usage. A
+		// future breaking change could export the safer regex only with a note that
+		// all input should have extra whitespace removed.
+		const safeRegexReplacements = [
+		  ['\\s', 1],
+		  ['\\d', MAX_LENGTH],
+		  [LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
+		];
+
+		const makeSafeRegex = (value) => {
+		  for (const [token, max] of safeRegexReplacements) {
+		    value = value
+		      .split(`${token}*`).join(`${token}{0,${max}}`)
+		      .split(`${token}+`).join(`${token}{1,${max}}`);
+		  }
+		  return value
+		};
+
+		const createToken = (name, value, isGlobal) => {
+		  const safe = makeSafeRegex(value);
+		  const index = R++;
+		  debug(name, index, value);
+		  t[name] = index;
+		  src[index] = value;
+		  safeSrc[index] = safe;
+		  re[index] = new RegExp(value, isGlobal ? 'g' : undefined);
+		  safeRe[index] = new RegExp(safe, isGlobal ? 'g' : undefined);
+		};
+
+		// The following Regular Expressions can be used for tokenizing,
+		// validating, and parsing SemVer version strings.
+
+		// ## Numeric Identifier
+		// A single `0`, or a non-zero digit followed by zero or more digits.
+
+		createToken('NUMERICIDENTIFIER', '0|[1-9]\\d*');
+		createToken('NUMERICIDENTIFIERLOOSE', '\\d+');
+
+		// ## Non-numeric Identifier
+		// Zero or more digits, followed by a letter or hyphen, and then zero or
+		// more letters, digits, or hyphens.
+
+		createToken('NONNUMERICIDENTIFIER', `\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`);
+
+		// ## Main Version
+		// Three dot-separated numeric identifiers.
+
+		createToken('MAINVERSION', `(${src[t.NUMERICIDENTIFIER]})\\.` +
+		                   `(${src[t.NUMERICIDENTIFIER]})\\.` +
+		                   `(${src[t.NUMERICIDENTIFIER]})`);
+
+		createToken('MAINVERSIONLOOSE', `(${src[t.NUMERICIDENTIFIERLOOSE]})\\.` +
+		                        `(${src[t.NUMERICIDENTIFIERLOOSE]})\\.` +
+		                        `(${src[t.NUMERICIDENTIFIERLOOSE]})`);
+
+		// ## Pre-release Version Identifier
+		// A numeric identifier, or a non-numeric identifier.
+		// Non-numeric identifiers include numeric identifiers but can be longer.
+		// Therefore non-numeric identifiers must go first.
+
+		createToken('PRERELEASEIDENTIFIER', `(?:${src[t.NONNUMERICIDENTIFIER]
+		}|${src[t.NUMERICIDENTIFIER]})`);
+
+		createToken('PRERELEASEIDENTIFIERLOOSE', `(?:${src[t.NONNUMERICIDENTIFIER]
+		}|${src[t.NUMERICIDENTIFIERLOOSE]})`);
+
+		// ## Pre-release Version
+		// Hyphen, followed by one or more dot-separated pre-release version
+		// identifiers.
+
+		createToken('PRERELEASE', `(?:-(${src[t.PRERELEASEIDENTIFIER]
+		}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`);
+
+		createToken('PRERELEASELOOSE', `(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]
+		}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`);
+
+		// ## Build Metadata Identifier
+		// Any combination of digits, letters, or hyphens.
+
+		createToken('BUILDIDENTIFIER', `${LETTERDASHNUMBER}+`);
+
+		// ## Build Metadata
+		// Plus sign, followed by one or more period-separated build metadata
+		// identifiers.
+
+		createToken('BUILD', `(?:\\+(${src[t.BUILDIDENTIFIER]
+		}(?:\\.${src[t.BUILDIDENTIFIER]})*))`);
+
+		// ## Full Version String
+		// A main version, followed optionally by a pre-release version and
+		// build metadata.
+
+		// Note that the only major, minor, patch, and pre-release sections of
+		// the version string are capturing groups.  The build metadata is not a
+		// capturing group, because it should not ever be used in version
+		// comparison.
+
+		createToken('FULLPLAIN', `v?${src[t.MAINVERSION]
+		}${src[t.PRERELEASE]}?${
+		  src[t.BUILD]}?`);
+
+		createToken('FULL', `^${src[t.FULLPLAIN]}$`);
+
+		// like full, but allows v1.2.3 and =1.2.3, which people do sometimes.
+		// also, 1.0.0alpha1 (prerelease without the hyphen) which is pretty
+		// common in the npm registry.
+		createToken('LOOSEPLAIN', `[v=\\s]*${src[t.MAINVERSIONLOOSE]
+		}${src[t.PRERELEASELOOSE]}?${
+		  src[t.BUILD]}?`);
+
+		createToken('LOOSE', `^${src[t.LOOSEPLAIN]}$`);
+
+		createToken('GTLT', '((?:<|>)?=?)');
+
+		// Something like "2.*" or "1.2.x".
+		// Note that "x.x" is a valid xRange identifier, meaning "any version"
+		// Only the first item is strictly required.
+		createToken('XRANGEIDENTIFIERLOOSE', `${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);
+		createToken('XRANGEIDENTIFIER', `${src[t.NUMERICIDENTIFIER]}|x|X|\\*`);
+
+		createToken('XRANGEPLAIN', `[v=\\s]*(${src[t.XRANGEIDENTIFIER]})` +
+		                   `(?:\\.(${src[t.XRANGEIDENTIFIER]})` +
+		                   `(?:\\.(${src[t.XRANGEIDENTIFIER]})` +
+		                   `(?:${src[t.PRERELEASE]})?${
+		                     src[t.BUILD]}?` +
+		                   `)?)?`);
+
+		createToken('XRANGEPLAINLOOSE', `[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})` +
+		                        `(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})` +
+		                        `(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})` +
+		                        `(?:${src[t.PRERELEASELOOSE]})?${
+		                          src[t.BUILD]}?` +
+		                        `)?)?`);
+
+		createToken('XRANGE', `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`);
+		createToken('XRANGELOOSE', `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`);
+
+		// Coercion.
+		// Extract anything that could conceivably be a part of a valid semver
+		createToken('COERCEPLAIN', `${'(^|[^\\d])' +
+		              '(\\d{1,'}${MAX_SAFE_COMPONENT_LENGTH}})` +
+		              `(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?` +
+		              `(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`);
+		createToken('COERCE', `${src[t.COERCEPLAIN]}(?:$|[^\\d])`);
+		createToken('COERCEFULL', src[t.COERCEPLAIN] +
+		              `(?:${src[t.PRERELEASE]})?` +
+		              `(?:${src[t.BUILD]})?` +
+		              `(?:$|[^\\d])`);
+		createToken('COERCERTL', src[t.COERCE], true);
+		createToken('COERCERTLFULL', src[t.COERCEFULL], true);
+
+		// Tilde ranges.
+		// Meaning is "reasonably at or greater than"
+		createToken('LONETILDE', '(?:~>?)');
+
+		createToken('TILDETRIM', `(\\s*)${src[t.LONETILDE]}\\s+`, true);
+		exports.tildeTrimReplace = '$1~';
+
+		createToken('TILDE', `^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`);
+		createToken('TILDELOOSE', `^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`);
+
+		// Caret ranges.
+		// Meaning is "at least and backwards compatible with"
+		createToken('LONECARET', '(?:\\^)');
+
+		createToken('CARETTRIM', `(\\s*)${src[t.LONECARET]}\\s+`, true);
+		exports.caretTrimReplace = '$1^';
+
+		createToken('CARET', `^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`);
+		createToken('CARETLOOSE', `^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`);
+
+		// A simple gt/lt/eq thing, or just "" to indicate "any version"
+		createToken('COMPARATORLOOSE', `^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`);
+		createToken('COMPARATOR', `^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`);
+
+		// An expression to strip any whitespace between the gtlt and the thing
+		// it modifies, so that `> 1.2.3` ==> `>1.2.3`
+		createToken('COMPARATORTRIM', `(\\s*)${src[t.GTLT]
+		}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`, true);
+		exports.comparatorTrimReplace = '$1$2$3';
+
+		// Something like `1.2.3 - 1.2.4`
+		// Note that these all use the loose form, because they'll be
+		// checked against either the strict or loose comparator form
+		// later.
+		createToken('HYPHENRANGE', `^\\s*(${src[t.XRANGEPLAIN]})` +
+		                   `\\s+-\\s+` +
+		                   `(${src[t.XRANGEPLAIN]})` +
+		                   `\\s*$`);
+
+		createToken('HYPHENRANGELOOSE', `^\\s*(${src[t.XRANGEPLAINLOOSE]})` +
+		                        `\\s+-\\s+` +
+		                        `(${src[t.XRANGEPLAINLOOSE]})` +
+		                        `\\s*$`);
+
+		// Star ranges basically just allow anything at all.
+		createToken('STAR', '(<|>)?=?\\s*\\*');
+		// >=0.0.0 is like a star
+		createToken('GTE0', '^\\s*>=\\s*0\\.0\\.0\\s*$');
+		createToken('GTE0PRE', '^\\s*>=\\s*0\\.0\\.0-0\\s*$'); 
+	} (re, re.exports));
+	return re.exports;
+}
+
+var parseOptions_1;
+var hasRequiredParseOptions;
+
+function requireParseOptions () {
+	if (hasRequiredParseOptions) return parseOptions_1;
+	hasRequiredParseOptions = 1;
+
+	// parse out just the options we care about
+	const looseOption = Object.freeze({ loose: true });
+	const emptyOpts = Object.freeze({ });
+	const parseOptions = options => {
+	  if (!options) {
+	    return emptyOpts
+	  }
+
+	  if (typeof options !== 'object') {
+	    return looseOption
+	  }
+
+	  return options
+	};
+	parseOptions_1 = parseOptions;
+	return parseOptions_1;
+}
+
+var identifiers;
+var hasRequiredIdentifiers;
+
+function requireIdentifiers () {
+	if (hasRequiredIdentifiers) return identifiers;
+	hasRequiredIdentifiers = 1;
+
+	const numeric = /^[0-9]+$/;
+	const compareIdentifiers = (a, b) => {
+	  if (typeof a === 'number' && typeof b === 'number') {
+	    return a === b ? 0 : a < b ? -1 : 1
+	  }
+
+	  const anum = numeric.test(a);
+	  const bnum = numeric.test(b);
+
+	  if (anum && bnum) {
+	    a = +a;
+	    b = +b;
+	  }
+
+	  return a === b ? 0
+	    : (anum && !bnum) ? -1
+	    : (bnum && !anum) ? 1
+	    : a < b ? -1
+	    : 1
+	};
+
+	const rcompareIdentifiers = (a, b) => compareIdentifiers(b, a);
+
+	identifiers = {
+	  compareIdentifiers,
+	  rcompareIdentifiers,
+	};
+	return identifiers;
+}
+
+var semver$1;
+var hasRequiredSemver$1;
+
+function requireSemver$1 () {
+	if (hasRequiredSemver$1) return semver$1;
+	hasRequiredSemver$1 = 1;
+
+	const debug = requireDebug();
+	const { MAX_LENGTH, MAX_SAFE_INTEGER } = requireConstants();
+	const { safeRe: re, t } = requireRe();
+
+	const parseOptions = requireParseOptions();
+	const { compareIdentifiers } = requireIdentifiers();
+	class SemVer {
+	  constructor (version, options) {
+	    options = parseOptions(options);
+
+	    if (version instanceof SemVer) {
+	      if (version.loose === !!options.loose &&
+	        version.includePrerelease === !!options.includePrerelease) {
+	        return version
+	      } else {
+	        version = version.version;
+	      }
+	    } else if (typeof version !== 'string') {
+	      throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`)
+	    }
+
+	    if (version.length > MAX_LENGTH) {
+	      throw new TypeError(
+	        `version is longer than ${MAX_LENGTH} characters`
+	      )
+	    }
+
+	    debug('SemVer', version, options);
+	    this.options = options;
+	    this.loose = !!options.loose;
+	    // this isn't actually relevant for versions, but keep it so that we
+	    // don't run into trouble passing this.options around.
+	    this.includePrerelease = !!options.includePrerelease;
+
+	    const m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL]);
+
+	    if (!m) {
+	      throw new TypeError(`Invalid Version: ${version}`)
+	    }
+
+	    this.raw = version;
+
+	    // these are actually numbers
+	    this.major = +m[1];
+	    this.minor = +m[2];
+	    this.patch = +m[3];
+
+	    if (this.major > MAX_SAFE_INTEGER || this.major < 0) {
+	      throw new TypeError('Invalid major version')
+	    }
+
+	    if (this.minor > MAX_SAFE_INTEGER || this.minor < 0) {
+	      throw new TypeError('Invalid minor version')
+	    }
+
+	    if (this.patch > MAX_SAFE_INTEGER || this.patch < 0) {
+	      throw new TypeError('Invalid patch version')
+	    }
+
+	    // numberify any prerelease numeric ids
+	    if (!m[4]) {
+	      this.prerelease = [];
+	    } else {
+	      this.prerelease = m[4].split('.').map((id) => {
+	        if (/^[0-9]+$/.test(id)) {
+	          const num = +id;
+	          if (num >= 0 && num < MAX_SAFE_INTEGER) {
+	            return num
+	          }
+	        }
+	        return id
+	      });
+	    }
+
+	    this.build = m[5] ? m[5].split('.') : [];
+	    this.format();
+	  }
+
+	  format () {
+	    this.version = `${this.major}.${this.minor}.${this.patch}`;
+	    if (this.prerelease.length) {
+	      this.version += `-${this.prerelease.join('.')}`;
+	    }
+	    return this.version
+	  }
+
+	  toString () {
+	    return this.version
+	  }
+
+	  compare (other) {
+	    debug('SemVer.compare', this.version, this.options, other);
+	    if (!(other instanceof SemVer)) {
+	      if (typeof other === 'string' && other === this.version) {
+	        return 0
+	      }
+	      other = new SemVer(other, this.options);
+	    }
+
+	    if (other.version === this.version) {
+	      return 0
+	    }
+
+	    return this.compareMain(other) || this.comparePre(other)
+	  }
+
+	  compareMain (other) {
+	    if (!(other instanceof SemVer)) {
+	      other = new SemVer(other, this.options);
+	    }
+
+	    if (this.major < other.major) {
+	      return -1
+	    }
+	    if (this.major > other.major) {
+	      return 1
+	    }
+	    if (this.minor < other.minor) {
+	      return -1
+	    }
+	    if (this.minor > other.minor) {
+	      return 1
+	    }
+	    if (this.patch < other.patch) {
+	      return -1
+	    }
+	    if (this.patch > other.patch) {
+	      return 1
+	    }
+	    return 0
+	  }
+
+	  comparePre (other) {
+	    if (!(other instanceof SemVer)) {
+	      other = new SemVer(other, this.options);
+	    }
+
+	    // NOT having a prerelease is > having one
+	    if (this.prerelease.length && !other.prerelease.length) {
+	      return -1
+	    } else if (!this.prerelease.length && other.prerelease.length) {
+	      return 1
+	    } else if (!this.prerelease.length && !other.prerelease.length) {
+	      return 0
+	    }
+
+	    let i = 0;
+	    do {
+	      const a = this.prerelease[i];
+	      const b = other.prerelease[i];
+	      debug('prerelease compare', i, a, b);
+	      if (a === undefined && b === undefined) {
+	        return 0
+	      } else if (b === undefined) {
+	        return 1
+	      } else if (a === undefined) {
+	        return -1
+	      } else if (a === b) {
+	        continue
+	      } else {
+	        return compareIdentifiers(a, b)
+	      }
+	    } while (++i)
+	  }
+
+	  compareBuild (other) {
+	    if (!(other instanceof SemVer)) {
+	      other = new SemVer(other, this.options);
+	    }
+
+	    let i = 0;
+	    do {
+	      const a = this.build[i];
+	      const b = other.build[i];
+	      debug('build compare', i, a, b);
+	      if (a === undefined && b === undefined) {
+	        return 0
+	      } else if (b === undefined) {
+	        return 1
+	      } else if (a === undefined) {
+	        return -1
+	      } else if (a === b) {
+	        continue
+	      } else {
+	        return compareIdentifiers(a, b)
+	      }
+	    } while (++i)
+	  }
+
+	  // preminor will bump the version up to the next minor release, and immediately
+	  // down to pre-release. premajor and prepatch work the same way.
+	  inc (release, identifier, identifierBase) {
+	    if (release.startsWith('pre')) {
+	      if (!identifier && identifierBase === false) {
+	        throw new Error('invalid increment argument: identifier is empty')
+	      }
+	      // Avoid an invalid semver results
+	      if (identifier) {
+	        const match = `-${identifier}`.match(this.options.loose ? re[t.PRERELEASELOOSE] : re[t.PRERELEASE]);
+	        if (!match || match[1] !== identifier) {
+	          throw new Error(`invalid identifier: ${identifier}`)
+	        }
+	      }
+	    }
+
+	    switch (release) {
+	      case 'premajor':
+	        this.prerelease.length = 0;
+	        this.patch = 0;
+	        this.minor = 0;
+	        this.major++;
+	        this.inc('pre', identifier, identifierBase);
+	        break
+	      case 'preminor':
+	        this.prerelease.length = 0;
+	        this.patch = 0;
+	        this.minor++;
+	        this.inc('pre', identifier, identifierBase);
+	        break
+	      case 'prepatch':
+	        // If this is already a prerelease, it will bump to the next version
+	        // drop any prereleases that might already exist, since they are not
+	        // relevant at this point.
+	        this.prerelease.length = 0;
+	        this.inc('patch', identifier, identifierBase);
+	        this.inc('pre', identifier, identifierBase);
+	        break
+	      // If the input is a non-prerelease version, this acts the same as
+	      // prepatch.
+	      case 'prerelease':
+	        if (this.prerelease.length === 0) {
+	          this.inc('patch', identifier, identifierBase);
+	        }
+	        this.inc('pre', identifier, identifierBase);
+	        break
+	      case 'release':
+	        if (this.prerelease.length === 0) {
+	          throw new Error(`version ${this.raw} is not a prerelease`)
+	        }
+	        this.prerelease.length = 0;
+	        break
+
+	      case 'major':
+	        // If this is a pre-major version, bump up to the same major version.
+	        // Otherwise increment major.
+	        // 1.0.0-5 bumps to 1.0.0
+	        // 1.1.0 bumps to 2.0.0
+	        if (
+	          this.minor !== 0 ||
+	          this.patch !== 0 ||
+	          this.prerelease.length === 0
+	        ) {
+	          this.major++;
+	        }
+	        this.minor = 0;
+	        this.patch = 0;
+	        this.prerelease = [];
+	        break
+	      case 'minor':
+	        // If this is a pre-minor version, bump up to the same minor version.
+	        // Otherwise increment minor.
+	        // 1.2.0-5 bumps to 1.2.0
+	        // 1.2.1 bumps to 1.3.0
+	        if (this.patch !== 0 || this.prerelease.length === 0) {
+	          this.minor++;
+	        }
+	        this.patch = 0;
+	        this.prerelease = [];
+	        break
+	      case 'patch':
+	        // If this is not a pre-release version, it will increment the patch.
+	        // If it is a pre-release it will bump up to the same patch version.
+	        // 1.2.0-5 patches to 1.2.0
+	        // 1.2.0 patches to 1.2.1
+	        if (this.prerelease.length === 0) {
+	          this.patch++;
+	        }
+	        this.prerelease = [];
+	        break
+	      // This probably shouldn't be used publicly.
+	      // 1.0.0 'pre' would become 1.0.0-0 which is the wrong direction.
+	      case 'pre': {
+	        const base = Number(identifierBase) ? 1 : 0;
+
+	        if (this.prerelease.length === 0) {
+	          this.prerelease = [base];
+	        } else {
+	          let i = this.prerelease.length;
+	          while (--i >= 0) {
+	            if (typeof this.prerelease[i] === 'number') {
+	              this.prerelease[i]++;
+	              i = -2;
+	            }
+	          }
+	          if (i === -1) {
+	            // didn't increment anything
+	            if (identifier === this.prerelease.join('.') && identifierBase === false) {
+	              throw new Error('invalid increment argument: identifier already exists')
+	            }
+	            this.prerelease.push(base);
+	          }
+	        }
+	        if (identifier) {
+	          // 1.2.0-beta.1 bumps to 1.2.0-beta.2,
+	          // 1.2.0-beta.fooblz or 1.2.0-beta bumps to 1.2.0-beta.0
+	          let prerelease = [identifier, base];
+	          if (identifierBase === false) {
+	            prerelease = [identifier];
+	          }
+	          if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
+	            if (isNaN(this.prerelease[1])) {
+	              this.prerelease = prerelease;
+	            }
+	          } else {
+	            this.prerelease = prerelease;
+	          }
+	        }
+	        break
+	      }
+	      default:
+	        throw new Error(`invalid increment argument: ${release}`)
+	    }
+	    this.raw = this.format();
+	    if (this.build.length) {
+	      this.raw += `+${this.build.join('.')}`;
+	    }
+	    return this
+	  }
+	}
+
+	semver$1 = SemVer;
+	return semver$1;
+}
+
+var parse_1;
+var hasRequiredParse;
+
+function requireParse () {
+	if (hasRequiredParse) return parse_1;
+	hasRequiredParse = 1;
+
+	const SemVer = requireSemver$1();
+	const parse = (version, options, throwErrors = false) => {
+	  if (version instanceof SemVer) {
+	    return version
+	  }
+	  try {
+	    return new SemVer(version, options)
+	  } catch (er) {
+	    if (!throwErrors) {
+	      return null
+	    }
+	    throw er
+	  }
+	};
+
+	parse_1 = parse;
+	return parse_1;
+}
+
+var valid_1;
+var hasRequiredValid$1;
+
+function requireValid$1 () {
+	if (hasRequiredValid$1) return valid_1;
+	hasRequiredValid$1 = 1;
+
+	const parse = requireParse();
+	const valid = (version, options) => {
+	  const v = parse(version, options);
+	  return v ? v.version : null
+	};
+	valid_1 = valid;
+	return valid_1;
+}
+
+var clean_1;
+var hasRequiredClean;
+
+function requireClean () {
+	if (hasRequiredClean) return clean_1;
+	hasRequiredClean = 1;
+
+	const parse = requireParse();
+	const clean = (version, options) => {
+	  const s = parse(version.trim().replace(/^[=v]+/, ''), options);
+	  return s ? s.version : null
+	};
+	clean_1 = clean;
+	return clean_1;
+}
+
+var inc_1;
+var hasRequiredInc;
+
+function requireInc () {
+	if (hasRequiredInc) return inc_1;
+	hasRequiredInc = 1;
+
+	const SemVer = requireSemver$1();
+
+	const inc = (version, release, options, identifier, identifierBase) => {
+	  if (typeof (options) === 'string') {
+	    identifierBase = identifier;
+	    identifier = options;
+	    options = undefined;
+	  }
+
+	  try {
+	    return new SemVer(
+	      version instanceof SemVer ? version.version : version,
+	      options
+	    ).inc(release, identifier, identifierBase).version
+	  } catch (er) {
+	    return null
+	  }
+	};
+	inc_1 = inc;
+	return inc_1;
+}
+
+var diff_1;
+var hasRequiredDiff;
+
+function requireDiff () {
+	if (hasRequiredDiff) return diff_1;
+	hasRequiredDiff = 1;
+
+	const parse = requireParse();
+
+	const diff = (version1, version2) => {
+	  const v1 = parse(version1, null, true);
+	  const v2 = parse(version2, null, true);
+	  const comparison = v1.compare(v2);
+
+	  if (comparison === 0) {
+	    return null
+	  }
+
+	  const v1Higher = comparison > 0;
+	  const highVersion = v1Higher ? v1 : v2;
+	  const lowVersion = v1Higher ? v2 : v1;
+	  const highHasPre = !!highVersion.prerelease.length;
+	  const lowHasPre = !!lowVersion.prerelease.length;
+
+	  if (lowHasPre && !highHasPre) {
+	    // Going from prerelease -> no prerelease requires some special casing
+
+	    // If the low version has only a major, then it will always be a major
+	    // Some examples:
+	    // 1.0.0-1 -> 1.0.0
+	    // 1.0.0-1 -> 1.1.1
+	    // 1.0.0-1 -> 2.0.0
+	    if (!lowVersion.patch && !lowVersion.minor) {
+	      return 'major'
+	    }
+
+	    // If the main part has no difference
+	    if (lowVersion.compareMain(highVersion) === 0) {
+	      if (lowVersion.minor && !lowVersion.patch) {
+	        return 'minor'
+	      }
+	      return 'patch'
+	    }
+	  }
+
+	  // add the `pre` prefix if we are going to a prerelease version
+	  const prefix = highHasPre ? 'pre' : '';
+
+	  if (v1.major !== v2.major) {
+	    return prefix + 'major'
+	  }
+
+	  if (v1.minor !== v2.minor) {
+	    return prefix + 'minor'
+	  }
+
+	  if (v1.patch !== v2.patch) {
+	    return prefix + 'patch'
+	  }
+
+	  // high and low are prereleases
+	  return 'prerelease'
+	};
+
+	diff_1 = diff;
+	return diff_1;
+}
+
+var major_1;
+var hasRequiredMajor;
+
+function requireMajor () {
+	if (hasRequiredMajor) return major_1;
+	hasRequiredMajor = 1;
+
+	const SemVer = requireSemver$1();
+	const major = (a, loose) => new SemVer(a, loose).major;
+	major_1 = major;
+	return major_1;
+}
+
+var minor_1;
+var hasRequiredMinor;
+
+function requireMinor () {
+	if (hasRequiredMinor) return minor_1;
+	hasRequiredMinor = 1;
+
+	const SemVer = requireSemver$1();
+	const minor = (a, loose) => new SemVer(a, loose).minor;
+	minor_1 = minor;
+	return minor_1;
+}
+
+var patch_1;
+var hasRequiredPatch;
+
+function requirePatch () {
+	if (hasRequiredPatch) return patch_1;
+	hasRequiredPatch = 1;
+
+	const SemVer = requireSemver$1();
+	const patch = (a, loose) => new SemVer(a, loose).patch;
+	patch_1 = patch;
+	return patch_1;
+}
+
+var prerelease_1;
+var hasRequiredPrerelease;
+
+function requirePrerelease () {
+	if (hasRequiredPrerelease) return prerelease_1;
+	hasRequiredPrerelease = 1;
+
+	const parse = requireParse();
+	const prerelease = (version, options) => {
+	  const parsed = parse(version, options);
+	  return (parsed && parsed.prerelease.length) ? parsed.prerelease : null
+	};
+	prerelease_1 = prerelease;
+	return prerelease_1;
+}
+
+var compare_1;
+var hasRequiredCompare;
+
+function requireCompare () {
+	if (hasRequiredCompare) return compare_1;
+	hasRequiredCompare = 1;
+
+	const SemVer = requireSemver$1();
+	const compare = (a, b, loose) =>
+	  new SemVer(a, loose).compare(new SemVer(b, loose));
+
+	compare_1 = compare;
+	return compare_1;
+}
+
+var rcompare_1;
+var hasRequiredRcompare;
+
+function requireRcompare () {
+	if (hasRequiredRcompare) return rcompare_1;
+	hasRequiredRcompare = 1;
+
+	const compare = requireCompare();
+	const rcompare = (a, b, loose) => compare(b, a, loose);
+	rcompare_1 = rcompare;
+	return rcompare_1;
+}
+
+var compareLoose_1;
+var hasRequiredCompareLoose;
+
+function requireCompareLoose () {
+	if (hasRequiredCompareLoose) return compareLoose_1;
+	hasRequiredCompareLoose = 1;
+
+	const compare = requireCompare();
+	const compareLoose = (a, b) => compare(a, b, true);
+	compareLoose_1 = compareLoose;
+	return compareLoose_1;
+}
+
+var compareBuild_1;
+var hasRequiredCompareBuild;
+
+function requireCompareBuild () {
+	if (hasRequiredCompareBuild) return compareBuild_1;
+	hasRequiredCompareBuild = 1;
+
+	const SemVer = requireSemver$1();
+	const compareBuild = (a, b, loose) => {
+	  const versionA = new SemVer(a, loose);
+	  const versionB = new SemVer(b, loose);
+	  return versionA.compare(versionB) || versionA.compareBuild(versionB)
+	};
+	compareBuild_1 = compareBuild;
+	return compareBuild_1;
+}
+
+var sort_1;
+var hasRequiredSort;
+
+function requireSort () {
+	if (hasRequiredSort) return sort_1;
+	hasRequiredSort = 1;
+
+	const compareBuild = requireCompareBuild();
+	const sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose));
+	sort_1 = sort;
+	return sort_1;
+}
+
+var rsort_1;
+var hasRequiredRsort;
+
+function requireRsort () {
+	if (hasRequiredRsort) return rsort_1;
+	hasRequiredRsort = 1;
+
+	const compareBuild = requireCompareBuild();
+	const rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose));
+	rsort_1 = rsort;
+	return rsort_1;
+}
+
+var gt_1;
+var hasRequiredGt;
+
+function requireGt () {
+	if (hasRequiredGt) return gt_1;
+	hasRequiredGt = 1;
+
+	const compare = requireCompare();
+	const gt = (a, b, loose) => compare(a, b, loose) > 0;
+	gt_1 = gt;
+	return gt_1;
+}
+
+var lt_1;
+var hasRequiredLt;
+
+function requireLt () {
+	if (hasRequiredLt) return lt_1;
+	hasRequiredLt = 1;
+
+	const compare = requireCompare();
+	const lt = (a, b, loose) => compare(a, b, loose) < 0;
+	lt_1 = lt;
+	return lt_1;
+}
+
+var eq_1;
+var hasRequiredEq;
+
+function requireEq () {
+	if (hasRequiredEq) return eq_1;
+	hasRequiredEq = 1;
+
+	const compare = requireCompare();
+	const eq = (a, b, loose) => compare(a, b, loose) === 0;
+	eq_1 = eq;
+	return eq_1;
+}
+
+var neq_1;
+var hasRequiredNeq;
+
+function requireNeq () {
+	if (hasRequiredNeq) return neq_1;
+	hasRequiredNeq = 1;
+
+	const compare = requireCompare();
+	const neq = (a, b, loose) => compare(a, b, loose) !== 0;
+	neq_1 = neq;
+	return neq_1;
+}
+
+var gte_1;
+var hasRequiredGte;
+
+function requireGte () {
+	if (hasRequiredGte) return gte_1;
+	hasRequiredGte = 1;
+
+	const compare = requireCompare();
+	const gte = (a, b, loose) => compare(a, b, loose) >= 0;
+	gte_1 = gte;
+	return gte_1;
+}
+
+var lte_1;
+var hasRequiredLte;
+
+function requireLte () {
+	if (hasRequiredLte) return lte_1;
+	hasRequiredLte = 1;
+
+	const compare = requireCompare();
+	const lte = (a, b, loose) => compare(a, b, loose) <= 0;
+	lte_1 = lte;
+	return lte_1;
+}
+
+var cmp_1;
+var hasRequiredCmp;
+
+function requireCmp () {
+	if (hasRequiredCmp) return cmp_1;
+	hasRequiredCmp = 1;
+
+	const eq = requireEq();
+	const neq = requireNeq();
+	const gt = requireGt();
+	const gte = requireGte();
+	const lt = requireLt();
+	const lte = requireLte();
+
+	const cmp = (a, op, b, loose) => {
+	  switch (op) {
+	    case '===':
+	      if (typeof a === 'object') {
+	        a = a.version;
+	      }
+	      if (typeof b === 'object') {
+	        b = b.version;
+	      }
+	      return a === b
+
+	    case '!==':
+	      if (typeof a === 'object') {
+	        a = a.version;
+	      }
+	      if (typeof b === 'object') {
+	        b = b.version;
+	      }
+	      return a !== b
+
+	    case '':
+	    case '=':
+	    case '==':
+	      return eq(a, b, loose)
+
+	    case '!=':
+	      return neq(a, b, loose)
+
+	    case '>':
+	      return gt(a, b, loose)
+
+	    case '>=':
+	      return gte(a, b, loose)
+
+	    case '<':
+	      return lt(a, b, loose)
+
+	    case '<=':
+	      return lte(a, b, loose)
+
+	    default:
+	      throw new TypeError(`Invalid operator: ${op}`)
+	  }
+	};
+	cmp_1 = cmp;
+	return cmp_1;
+}
+
+var coerce_1;
+var hasRequiredCoerce;
+
+function requireCoerce () {
+	if (hasRequiredCoerce) return coerce_1;
+	hasRequiredCoerce = 1;
+
+	const SemVer = requireSemver$1();
+	const parse = requireParse();
+	const { safeRe: re, t } = requireRe();
+
+	const coerce = (version, options) => {
+	  if (version instanceof SemVer) {
+	    return version
+	  }
+
+	  if (typeof version === 'number') {
+	    version = String(version);
+	  }
+
+	  if (typeof version !== 'string') {
+	    return null
+	  }
+
+	  options = options || {};
+
+	  let match = null;
+	  if (!options.rtl) {
+	    match = version.match(options.includePrerelease ? re[t.COERCEFULL] : re[t.COERCE]);
+	  } else {
+	    // Find the right-most coercible string that does not share
+	    // a terminus with a more left-ward coercible string.
+	    // Eg, '1.2.3.4' wants to coerce '2.3.4', not '3.4' or '4'
+	    // With includePrerelease option set, '1.2.3.4-rc' wants to coerce '2.3.4-rc', not '2.3.4'
+	    //
+	    // Walk through the string checking with a /g regexp
+	    // Manually set the index so as to pick up overlapping matches.
+	    // Stop when we get a match that ends at the string end, since no
+	    // coercible string can be more right-ward without the same terminus.
+	    const coerceRtlRegex = options.includePrerelease ? re[t.COERCERTLFULL] : re[t.COERCERTL];
+	    let next;
+	    while ((next = coerceRtlRegex.exec(version)) &&
+	        (!match || match.index + match[0].length !== version.length)
+	    ) {
+	      if (!match ||
+	            next.index + next[0].length !== match.index + match[0].length) {
+	        match = next;
+	      }
+	      coerceRtlRegex.lastIndex = next.index + next[1].length + next[2].length;
+	    }
+	    // leave it in a clean state
+	    coerceRtlRegex.lastIndex = -1;
+	  }
+
+	  if (match === null) {
+	    return null
+	  }
+
+	  const major = match[2];
+	  const minor = match[3] || '0';
+	  const patch = match[4] || '0';
+	  const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : '';
+	  const build = options.includePrerelease && match[6] ? `+${match[6]}` : '';
+
+	  return parse(`${major}.${minor}.${patch}${prerelease}${build}`, options)
+	};
+	coerce_1 = coerce;
+	return coerce_1;
+}
+
+var truncate_1;
+var hasRequiredTruncate;
+
+function requireTruncate () {
+	if (hasRequiredTruncate) return truncate_1;
+	hasRequiredTruncate = 1;
+
+	const parse = requireParse();
+	const constants = requireConstants();
+	const SemVer = requireSemver$1();
+
+	const truncate = (version, truncation, options) => {
+	  if (!constants.RELEASE_TYPES.includes(truncation)) {
+	    return null
+	  }
+
+	  const clonedVersion = cloneInputVersion(version, options);
+	  return clonedVersion && doTruncation(clonedVersion, truncation)
+	};
+
+	const cloneInputVersion = (version, options) => {
+	  const versionStringToParse = (
+	    version instanceof SemVer ? version.version : version
+	  );
+
+	  return parse(versionStringToParse, options)
+	};
+
+	const doTruncation = (version, truncation) => {
+	  if (isPrerelease(truncation)) {
+	    return version.version
+	  }
+
+	  version.prerelease = [];
+
+	  switch (truncation) {
+	    case 'major':
+	      version.minor = 0;
+	      version.patch = 0;
+	      break
+	    case 'minor':
+	      version.patch = 0;
+	      break
+	  }
+
+	  return version.format()
+	};
+
+	const isPrerelease = (type) => {
+	  return type.startsWith('pre')
+	};
+
+	truncate_1 = truncate;
+	return truncate_1;
+}
+
+var lrucache;
+var hasRequiredLrucache;
+
+function requireLrucache () {
+	if (hasRequiredLrucache) return lrucache;
+	hasRequiredLrucache = 1;
+
+	class LRUCache {
+	  constructor () {
+	    this.max = 1000;
+	    this.map = new Map();
+	  }
+
+	  get (key) {
+	    const value = this.map.get(key);
+	    if (value === undefined) {
+	      return undefined
+	    } else {
+	      // Remove the key from the map and add it to the end
+	      this.map.delete(key);
+	      this.map.set(key, value);
+	      return value
+	    }
+	  }
+
+	  delete (key) {
+	    return this.map.delete(key)
+	  }
+
+	  set (key, value) {
+	    const deleted = this.delete(key);
+
+	    if (!deleted && value !== undefined) {
+	      // If cache is full, delete the least recently used item
+	      if (this.map.size >= this.max) {
+	        const firstKey = this.map.keys().next().value;
+	        this.delete(firstKey);
+	      }
+
+	      this.map.set(key, value);
+	    }
+
+	    return this
+	  }
+	}
+
+	lrucache = LRUCache;
+	return lrucache;
+}
+
+var range;
+var hasRequiredRange;
+
+function requireRange () {
+	if (hasRequiredRange) return range;
+	hasRequiredRange = 1;
+
+	const SPACE_CHARACTERS = /\s+/g;
+
+	// hoisted class for cyclic dependency
+	class Range {
+	  constructor (range, options) {
+	    options = parseOptions(options);
+
+	    if (range instanceof Range) {
+	      if (
+	        range.loose === !!options.loose &&
+	        range.includePrerelease === !!options.includePrerelease
+	      ) {
+	        return range
+	      } else {
+	        return new Range(range.raw, options)
+	      }
+	    }
+
+	    if (range instanceof Comparator) {
+	      // just put it in the set and return
+	      this.raw = range.value;
+	      this.set = [[range]];
+	      this.formatted = undefined;
+	      return this
+	    }
+
+	    this.options = options;
+	    this.loose = !!options.loose;
+	    this.includePrerelease = !!options.includePrerelease;
+
+	    // First reduce all whitespace as much as possible so we do not have to rely
+	    // on potentially slow regexes like \s*. This is then stored and used for
+	    // future error messages as well.
+	    this.raw = range.trim().replace(SPACE_CHARACTERS, ' ');
+
+	    // First, split on ||
+	    this.set = this.raw
+	      .split('||')
+	      // map the range to a 2d array of comparators
+	      .map(r => this.parseRange(r.trim()))
+	      // throw out any comparator lists that are empty
+	      // this generally means that it was not a valid range, which is allowed
+	      // in loose mode, but will still throw if the WHOLE range is invalid.
+	      .filter(c => c.length);
+
+	    if (!this.set.length) {
+	      throw new TypeError(`Invalid SemVer Range: ${this.raw}`)
+	    }
+
+	    // if we have any that are not the null set, throw out null sets.
+	    if (this.set.length > 1) {
+	      // keep the first one, in case they're all null sets
+	      const first = this.set[0];
+	      this.set = this.set.filter(c => !isNullSet(c[0]));
+	      if (this.set.length === 0) {
+	        this.set = [first];
+	      } else if (this.set.length > 1) {
+	        // if we have any that are *, then the range is just *
+	        for (const c of this.set) {
+	          if (c.length === 1 && isAny(c[0])) {
+	            this.set = [c];
+	            break
+	          }
+	        }
+	      }
+	    }
+
+	    this.formatted = undefined;
+	  }
+
+	  get range () {
+	    if (this.formatted === undefined) {
+	      this.formatted = '';
+	      for (let i = 0; i < this.set.length; i++) {
+	        if (i > 0) {
+	          this.formatted += '||';
+	        }
+	        const comps = this.set[i];
+	        for (let k = 0; k < comps.length; k++) {
+	          if (k > 0) {
+	            this.formatted += ' ';
+	          }
+	          this.formatted += comps[k].toString().trim();
+	        }
+	      }
+	    }
+	    return this.formatted
+	  }
+
+	  format () {
+	    return this.range
+	  }
+
+	  toString () {
+	    return this.range
+	  }
+
+	  parseRange (range) {
+	    // strip build metadata so it can't bleed into the version
+	    range = range.replace(BUILDSTRIPRE, '');
+
+	    // memoize range parsing for performance.
+	    // this is a very hot path, and fully deterministic.
+	    const memoOpts =
+	      (this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) |
+	      (this.options.loose && FLAG_LOOSE);
+	    const memoKey = memoOpts + ':' + range;
+	    const cached = cache.get(memoKey);
+	    if (cached) {
+	      return cached
+	    }
+
+	    const loose = this.options.loose;
+	    // `1.2.3 - 1.2.4` => `>=1.2.3 <=1.2.4`
+	    const hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE];
+	    range = range.replace(hr, hyphenReplace(this.options.includePrerelease));
+	    debug('hyphen replace', range);
+
+	    // `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
+	    range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace);
+	    debug('comparator trim', range);
+
+	    // `~ 1.2.3` => `~1.2.3`
+	    range = range.replace(re[t.TILDETRIM], tildeTrimReplace);
+	    debug('tilde trim', range);
+
+	    // `^ 1.2.3` => `^1.2.3`
+	    range = range.replace(re[t.CARETTRIM], caretTrimReplace);
+	    debug('caret trim', range);
+
+	    // At this point, the range is completely trimmed and
+	    // ready to be split into comparators.
+
+	    let rangeList = range
+	      .split(' ')
+	      .map(comp => parseComparator(comp, this.options))
+	      .join(' ')
+	      .split(/\s+/)
+	      // >=0.0.0 is equivalent to *
+	      .map(comp => replaceGTE0(comp, this.options));
+
+	    if (loose) {
+	      // in loose mode, throw out any that are not valid comparators
+	      rangeList = rangeList.filter(comp => {
+	        debug('loose invalid filter', comp, this.options);
+	        return !!comp.match(re[t.COMPARATORLOOSE])
+	      });
+	    }
+	    debug('range list', rangeList);
+
+	    // if any comparators are the null set, then replace with JUST null set
+	    // if more than one comparator, remove any * comparators
+	    // also, don't include the same comparator more than once
+	    const rangeMap = new Map();
+	    const comparators = rangeList.map(comp => new Comparator(comp, this.options));
+	    for (const comp of comparators) {
+	      if (isNullSet(comp)) {
+	        return [comp]
+	      }
+	      rangeMap.set(comp.value, comp);
+	    }
+	    if (rangeMap.size > 1 && rangeMap.has('')) {
+	      rangeMap.delete('');
+	    }
+
+	    const result = [...rangeMap.values()];
+	    cache.set(memoKey, result);
+	    return result
+	  }
+
+	  intersects (range, options) {
+	    if (!(range instanceof Range)) {
+	      throw new TypeError('a Range is required')
+	    }
+
+	    return this.set.some((thisComparators) => {
+	      return (
+	        isSatisfiable(thisComparators, options) &&
+	        range.set.some((rangeComparators) => {
+	          return (
+	            isSatisfiable(rangeComparators, options) &&
+	            thisComparators.every((thisComparator) => {
+	              return rangeComparators.every((rangeComparator) => {
+	                return thisComparator.intersects(rangeComparator, options)
+	              })
+	            })
+	          )
+	        })
+	      )
+	    })
+	  }
+
+	  // if ANY of the sets match ALL of its comparators, then pass
+	  test (version) {
+	    if (!version) {
+	      return false
+	    }
+
+	    if (typeof version === 'string') {
+	      try {
+	        version = new SemVer(version, this.options);
+	      } catch (er) {
+	        return false
+	      }
+	    }
+
+	    for (let i = 0; i < this.set.length; i++) {
+	      if (testSet(this.set[i], version, this.options)) {
+	        return true
+	      }
+	    }
+	    return false
+	  }
+	}
+
+	range = Range;
+
+	const LRU = requireLrucache();
+	const cache = new LRU();
+
+	const parseOptions = requireParseOptions();
+	const Comparator = requireComparator();
+	const debug = requireDebug();
+	const SemVer = requireSemver$1();
+	const {
+	  safeRe: re,
+	  src,
+	  t,
+	  comparatorTrimReplace,
+	  tildeTrimReplace,
+	  caretTrimReplace,
+	} = requireRe();
+	const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = requireConstants();
+
+	// unbounded global build-metadata stripper used by parseRange
+	const BUILDSTRIPRE = new RegExp(src[t.BUILD], 'g');
+
+	const isNullSet = c => c.value === '<0.0.0-0';
+	const isAny = c => c.value === '';
+
+	// take a set of comparators and determine whether there
+	// exists a version which can satisfy it
+	const isSatisfiable = (comparators, options) => {
+	  let result = true;
+	  const remainingComparators = comparators.slice();
+	  let testComparator = remainingComparators.pop();
+
+	  while (result && remainingComparators.length) {
+	    result = remainingComparators.every((otherComparator) => {
+	      return testComparator.intersects(otherComparator, options)
+	    });
+
+	    testComparator = remainingComparators.pop();
+	  }
+
+	  return result
+	};
+
+	// comprised of xranges, tildes, stars, and gtlt's at this point.
+	// already replaced the hyphen ranges
+	// turn into a set of JUST comparators.
+	const parseComparator = (comp, options) => {
+	  comp = comp.replace(re[t.BUILD], '');
+	  debug('comp', comp, options);
+	  comp = replaceCarets(comp, options);
+	  debug('caret', comp);
+	  comp = replaceTildes(comp, options);
+	  debug('tildes', comp);
+	  comp = replaceXRanges(comp, options);
+	  debug('xrange', comp);
+	  comp = replaceStars(comp, options);
+	  debug('stars', comp);
+	  return comp
+	};
+
+	const isX = id => !id || id.toLowerCase() === 'x' || id === '*';
+
+	// ~, ~> --> * (any, kinda silly)
+	// ~2, ~2.x, ~2.x.x, ~>2, ~>2.x ~>2.x.x --> >=2.0.0 <3.0.0-0
+	// ~2.0, ~2.0.x, ~>2.0, ~>2.0.x --> >=2.0.0 <2.1.0-0
+	// ~1.2, ~1.2.x, ~>1.2, ~>1.2.x --> >=1.2.0 <1.3.0-0
+	// ~1.2.3, ~>1.2.3 --> >=1.2.3 <1.3.0-0
+	// ~1.2.0, ~>1.2.0 --> >=1.2.0 <1.3.0-0
+	// ~0.0.1 --> >=0.0.1 <0.1.0-0
+	const replaceTildes = (comp, options) => {
+	  return comp
+	    .trim()
+	    .split(/\s+/)
+	    .map((c) => replaceTilde(c, options))
+	    .join(' ')
+	};
+
+	const replaceTilde = (comp, options) => {
+	  const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
+	  return comp.replace(r, (_, M, m, p, pr) => {
+	    debug('tilde', comp, _, M, m, p, pr);
+	    let ret;
+
+	    if (isX(M)) {
+	      ret = '';
+	    } else if (isX(m)) {
+	      ret = `>=${M}.0.0 <${+M + 1}.0.0-0`;
+	    } else if (isX(p)) {
+	      // ~1.2 == >=1.2.0 <1.3.0-0
+	      ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`;
+	    } else if (pr) {
+	      debug('replaceTilde pr', pr);
+	      ret = `>=${M}.${m}.${p}-${pr
+	      } <${M}.${+m + 1}.0-0`;
+	    } else {
+	      // ~1.2.3 == >=1.2.3 <1.3.0-0
+	      ret = `>=${M}.${m}.${p
+	      } <${M}.${+m + 1}.0-0`;
+	    }
+
+	    debug('tilde return', ret);
+	    return ret
+	  })
+	};
+
+	// ^ --> * (any, kinda silly)
+	// ^2, ^2.x, ^2.x.x --> >=2.0.0 <3.0.0-0
+	// ^2.0, ^2.0.x --> >=2.0.0 <3.0.0-0
+	// ^1.2, ^1.2.x --> >=1.2.0 <2.0.0-0
+	// ^1.2.3 --> >=1.2.3 <2.0.0-0
+	// ^1.2.0 --> >=1.2.0 <2.0.0-0
+	// ^0.0.1 --> >=0.0.1 <0.0.2-0
+	// ^0.1.0 --> >=0.1.0 <0.2.0-0
+	const replaceCarets = (comp, options) => {
+	  return comp
+	    .trim()
+	    .split(/\s+/)
+	    .map((c) => replaceCaret(c, options))
+	    .join(' ')
+	};
+
+	const replaceCaret = (comp, options) => {
+	  debug('caret', comp, options);
+	  const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET];
+	  const z = options.includePrerelease ? '-0' : '';
+	  return comp.replace(r, (_, M, m, p, pr) => {
+	    debug('caret', comp, _, M, m, p, pr);
+	    let ret;
+
+	    if (isX(M)) {
+	      ret = '';
+	    } else if (isX(m)) {
+	      ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
+	    } else if (isX(p)) {
+	      if (M === '0') {
+	        ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`;
+	      } else {
+	        ret = `>=${M}.${m}.0${z} <${+M + 1}.0.0-0`;
+	      }
+	    } else if (pr) {
+	      debug('replaceCaret pr', pr);
+	      if (M === '0') {
+	        if (m === '0') {
+	          ret = `>=${M}.${m}.${p}-${pr
+	          } <${M}.${m}.${+p + 1}-0`;
+	        } else {
+	          ret = `>=${M}.${m}.${p}-${pr
+	          } <${M}.${+m + 1}.0-0`;
+	        }
+	      } else {
+	        ret = `>=${M}.${m}.${p}-${pr
+	        } <${+M + 1}.0.0-0`;
+	      }
+	    } else {
+	      debug('no pr');
+	      if (M === '0') {
+	        if (m === '0') {
+	          ret = `>=${M}.${m}.${p
+	          }${z} <${M}.${m}.${+p + 1}-0`;
+	        } else {
+	          ret = `>=${M}.${m}.${p
+	          }${z} <${M}.${+m + 1}.0-0`;
+	        }
+	      } else {
+	        ret = `>=${M}.${m}.${p
+	        } <${+M + 1}.0.0-0`;
+	      }
+	    }
+
+	    debug('caret return', ret);
+	    return ret
+	  })
+	};
+
+	const replaceXRanges = (comp, options) => {
+	  debug('replaceXRanges', comp, options);
+	  return comp
+	    .split(/\s+/)
+	    .map((c) => replaceXRange(c, options))
+	    .join(' ')
+	};
+
+	const replaceXRange = (comp, options) => {
+	  comp = comp.trim();
+	  const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
+	  return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
+	    debug('xRange', comp, ret, gtlt, M, m, p, pr);
+	    const xM = isX(M);
+	    const xm = xM || isX(m);
+	    const xp = xm || isX(p);
+	    const anyX = xp;
+
+	    if (gtlt === '=' && anyX) {
+	      gtlt = '';
+	    }
+
+	    // if we're including prereleases in the match, then we need
+	    // to fix this to -0, the lowest possible prerelease value
+	    pr = options.includePrerelease ? '-0' : '';
+
+	    if (xM) {
+	      if (gtlt === '>' || gtlt === '<') {
+	        // nothing is allowed
+	        ret = '<0.0.0-0';
+	      } else {
+	        // nothing is forbidden
+	        ret = '*';
+	      }
+	    } else if (gtlt && anyX) {
+	      // we know patch is an x, because we have any x at all.
+	      // replace X with 0
+	      if (xm) {
+	        m = 0;
+	      }
+	      p = 0;
+
+	      if (gtlt === '>') {
+	        // >1 => >=2.0.0
+	        // >1.2 => >=1.3.0
+	        gtlt = '>=';
+	        if (xm) {
+	          M = +M + 1;
+	          m = 0;
+	          p = 0;
+	        } else {
+	          m = +m + 1;
+	          p = 0;
+	        }
+	      } else if (gtlt === '<=') {
+	        // <=0.7.x is actually <0.8.0, since any 0.7.x should
+	        // pass.  Similarly, <=7.x is actually <8.0.0, etc.
+	        gtlt = '<';
+	        if (xm) {
+	          M = +M + 1;
+	        } else {
+	          m = +m + 1;
+	        }
+	      }
+
+	      if (gtlt === '<') {
+	        pr = '-0';
+	      }
+
+	      ret = `${gtlt + M}.${m}.${p}${pr}`;
+	    } else if (xm) {
+	      ret = `>=${M}.0.0${pr} <${+M + 1}.0.0-0`;
+	    } else if (xp) {
+	      ret = `>=${M}.${m}.0${pr
+	      } <${M}.${+m + 1}.0-0`;
+	    }
+
+	    debug('xRange return', ret);
+
+	    return ret
+	  })
+	};
+
+	// Because * is AND-ed with everything else in the comparator,
+	// and '' means "any version", just remove the *s entirely.
+	const replaceStars = (comp, options) => {
+	  debug('replaceStars', comp, options);
+	  // Looseness is ignored here.  star is always as loose as it gets!
+	  return comp
+	    .trim()
+	    .replace(re[t.STAR], '')
+	};
+
+	const replaceGTE0 = (comp, options) => {
+	  debug('replaceGTE0', comp, options);
+	  return comp
+	    .trim()
+	    .replace(re[options.includePrerelease ? t.GTE0PRE : t.GTE0], '')
+	};
+
+	// This function is passed to string.replace(re[t.HYPHENRANGE])
+	// M, m, patch, prerelease, build
+	// 1.2 - 3.4.5 => >=1.2.0 <=3.4.5
+	// 1.2.3 - 3.4 => >=1.2.0 <3.5.0-0 Any 3.4.x will do
+	// 1.2 - 3.4 => >=1.2.0 <3.5.0-0
+	// TODO build?
+	const hyphenReplace = incPr => ($0,
+	  from, fM, fm, fp, fpr, fb,
+	  to, tM, tm, tp, tpr) => {
+	  if (isX(fM)) {
+	    from = '';
+	  } else if (isX(fm)) {
+	    from = `>=${fM}.0.0${incPr ? '-0' : ''}`;
+	  } else if (isX(fp)) {
+	    from = `>=${fM}.${fm}.0${incPr ? '-0' : ''}`;
+	  } else if (fpr) {
+	    from = `>=${from}`;
+	  } else {
+	    from = `>=${from}${incPr ? '-0' : ''}`;
+	  }
+
+	  if (isX(tM)) {
+	    to = '';
+	  } else if (isX(tm)) {
+	    to = `<${+tM + 1}.0.0-0`;
+	  } else if (isX(tp)) {
+	    to = `<${tM}.${+tm + 1}.0-0`;
+	  } else if (tpr) {
+	    to = `<=${tM}.${tm}.${tp}-${tpr}`;
+	  } else if (incPr) {
+	    to = `<${tM}.${tm}.${+tp + 1}-0`;
+	  } else {
+	    to = `<=${to}`;
+	  }
+
+	  return `${from} ${to}`.trim()
+	};
+
+	const testSet = (set, version, options) => {
+	  for (let i = 0; i < set.length; i++) {
+	    if (!set[i].test(version)) {
+	      return false
+	    }
+	  }
+
+	  if (version.prerelease.length && !options.includePrerelease) {
+	    // Find the set of versions that are allowed to have prereleases
+	    // For example, ^1.2.3-pr.1 desugars to >=1.2.3-pr.1 <2.0.0
+	    // That should allow `1.2.3-pr.2` to pass.
+	    // However, `1.2.4-alpha.notready` should NOT be allowed,
+	    // even though it's within the range set by the comparators.
+	    for (let i = 0; i < set.length; i++) {
+	      debug(set[i].semver);
+	      if (set[i].semver === Comparator.ANY) {
+	        continue
+	      }
+
+	      if (set[i].semver.prerelease.length > 0) {
+	        const allowed = set[i].semver;
+	        if (allowed.major === version.major &&
+	            allowed.minor === version.minor &&
+	            allowed.patch === version.patch) {
+	          return true
+	        }
+	      }
+	    }
+
+	    // Version has a -pre, but it's not one of the ones we like.
+	    return false
+	  }
+
+	  return true
+	};
+	return range;
+}
+
+var comparator;
+var hasRequiredComparator;
+
+function requireComparator () {
+	if (hasRequiredComparator) return comparator;
+	hasRequiredComparator = 1;
+
+	const ANY = Symbol('SemVer ANY');
+	// hoisted class for cyclic dependency
+	class Comparator {
+	  static get ANY () {
+	    return ANY
+	  }
+
+	  constructor (comp, options) {
+	    options = parseOptions(options);
+
+	    if (comp instanceof Comparator) {
+	      if (comp.loose === !!options.loose) {
+	        return comp
+	      } else {
+	        comp = comp.value;
+	      }
+	    }
+
+	    comp = comp.trim().split(/\s+/).join(' ');
+	    debug('comparator', comp, options);
+	    this.options = options;
+	    this.loose = !!options.loose;
+	    this.parse(comp);
+
+	    if (this.semver === ANY) {
+	      this.value = '';
+	    } else {
+	      this.value = this.operator + this.semver.version;
+	    }
+
+	    debug('comp', this);
+	  }
+
+	  parse (comp) {
+	    const r = this.options.loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR];
+	    const m = comp.match(r);
+
+	    if (!m) {
+	      throw new TypeError(`Invalid comparator: ${comp}`)
+	    }
+
+	    this.operator = m[1] !== undefined ? m[1] : '';
+	    if (this.operator === '=') {
+	      this.operator = '';
+	    }
+
+	    // if it literally is just '>' or '' then allow anything.
+	    if (!m[2]) {
+	      this.semver = ANY;
+	    } else {
+	      this.semver = new SemVer(m[2], this.options.loose);
+	    }
+	  }
+
+	  toString () {
+	    return this.value
+	  }
+
+	  test (version) {
+	    debug('Comparator.test', version, this.options.loose);
+
+	    if (this.semver === ANY || version === ANY) {
+	      return true
+	    }
+
+	    if (typeof version === 'string') {
+	      try {
+	        version = new SemVer(version, this.options);
+	      } catch (er) {
+	        return false
+	      }
+	    }
+
+	    return cmp(version, this.operator, this.semver, this.options)
+	  }
+
+	  intersects (comp, options) {
+	    if (!(comp instanceof Comparator)) {
+	      throw new TypeError('a Comparator is required')
+	    }
+
+	    if (this.operator === '') {
+	      if (this.value === '') {
+	        return true
+	      }
+	      return new Range(comp.value, options).test(this.value)
+	    } else if (comp.operator === '') {
+	      if (comp.value === '') {
+	        return true
+	      }
+	      return new Range(this.value, options).test(comp.semver)
+	    }
+
+	    options = parseOptions(options);
+
+	    // Special cases where nothing can possibly be lower
+	    if (options.includePrerelease &&
+	      (this.value === '<0.0.0-0' || comp.value === '<0.0.0-0')) {
+	      return false
+	    }
+	    if (!options.includePrerelease &&
+	      (this.value.startsWith('<0.0.0') || comp.value.startsWith('<0.0.0'))) {
+	      return false
+	    }
+
+	    // Same direction increasing (> or >=)
+	    if (this.operator.startsWith('>') && comp.operator.startsWith('>')) {
+	      return true
+	    }
+	    // Same direction decreasing (< or <=)
+	    if (this.operator.startsWith('<') && comp.operator.startsWith('<')) {
+	      return true
+	    }
+	    // same SemVer and both sides are inclusive (<= or >=)
+	    if (
+	      (this.semver.version === comp.semver.version) &&
+	      this.operator.includes('=') && comp.operator.includes('=')) {
+	      return true
+	    }
+	    // opposite directions less than
+	    if (cmp(this.semver, '<', comp.semver, options) &&
+	      this.operator.startsWith('>') && comp.operator.startsWith('<')) {
+	      return true
+	    }
+	    // opposite directions greater than
+	    if (cmp(this.semver, '>', comp.semver, options) &&
+	      this.operator.startsWith('<') && comp.operator.startsWith('>')) {
+	      return true
+	    }
+	    return false
+	  }
+	}
+
+	comparator = Comparator;
+
+	const parseOptions = requireParseOptions();
+	const { safeRe: re, t } = requireRe();
+	const cmp = requireCmp();
+	const debug = requireDebug();
+	const SemVer = requireSemver$1();
+	const Range = requireRange();
+	return comparator;
+}
+
+var satisfies_1;
+var hasRequiredSatisfies;
+
+function requireSatisfies () {
+	if (hasRequiredSatisfies) return satisfies_1;
+	hasRequiredSatisfies = 1;
+
+	const Range = requireRange();
+	const satisfies = (version, range, options) => {
+	  try {
+	    range = new Range(range, options);
+	  } catch (er) {
+	    return false
+	  }
+	  return range.test(version)
+	};
+	satisfies_1 = satisfies;
+	return satisfies_1;
+}
+
+var toComparators_1;
+var hasRequiredToComparators;
+
+function requireToComparators () {
+	if (hasRequiredToComparators) return toComparators_1;
+	hasRequiredToComparators = 1;
+
+	const Range = requireRange();
+
+	// Mostly just for testing and legacy API reasons
+	const toComparators = (range, options) =>
+	  new Range(range, options).set
+	    .map(comp => comp.map(c => c.value).join(' ').trim().split(' '));
+
+	toComparators_1 = toComparators;
+	return toComparators_1;
+}
+
+var maxSatisfying_1;
+var hasRequiredMaxSatisfying;
+
+function requireMaxSatisfying () {
+	if (hasRequiredMaxSatisfying) return maxSatisfying_1;
+	hasRequiredMaxSatisfying = 1;
+
+	const SemVer = requireSemver$1();
+	const Range = requireRange();
+
+	const maxSatisfying = (versions, range, options) => {
+	  let max = null;
+	  let maxSV = null;
+	  let rangeObj = null;
+	  try {
+	    rangeObj = new Range(range, options);
+	  } catch (er) {
+	    return null
+	  }
+	  versions.forEach((v) => {
+	    if (rangeObj.test(v)) {
+	      // satisfies(v, range, options)
+	      if (!max || maxSV.compare(v) === -1) {
+	        // compare(max, v, true)
+	        max = v;
+	        maxSV = new SemVer(max, options);
+	      }
+	    }
+	  });
+	  return max
+	};
+	maxSatisfying_1 = maxSatisfying;
+	return maxSatisfying_1;
+}
+
+var minSatisfying_1;
+var hasRequiredMinSatisfying;
+
+function requireMinSatisfying () {
+	if (hasRequiredMinSatisfying) return minSatisfying_1;
+	hasRequiredMinSatisfying = 1;
+
+	const SemVer = requireSemver$1();
+	const Range = requireRange();
+	const minSatisfying = (versions, range, options) => {
+	  let min = null;
+	  let minSV = null;
+	  let rangeObj = null;
+	  try {
+	    rangeObj = new Range(range, options);
+	  } catch (er) {
+	    return null
+	  }
+	  versions.forEach((v) => {
+	    if (rangeObj.test(v)) {
+	      // satisfies(v, range, options)
+	      if (!min || minSV.compare(v) === 1) {
+	        // compare(min, v, true)
+	        min = v;
+	        minSV = new SemVer(min, options);
+	      }
+	    }
+	  });
+	  return min
+	};
+	minSatisfying_1 = minSatisfying;
+	return minSatisfying_1;
+}
+
+var minVersion_1;
+var hasRequiredMinVersion;
+
+function requireMinVersion () {
+	if (hasRequiredMinVersion) return minVersion_1;
+	hasRequiredMinVersion = 1;
+
+	const SemVer = requireSemver$1();
+	const Range = requireRange();
+	const gt = requireGt();
+
+	const minVersion = (range, loose) => {
+	  range = new Range(range, loose);
+
+	  let minver = new SemVer('0.0.0');
+	  if (range.test(minver)) {
+	    return minver
+	  }
+
+	  minver = new SemVer('0.0.0-0');
+	  if (range.test(minver)) {
+	    return minver
+	  }
+
+	  minver = null;
+	  for (let i = 0; i < range.set.length; ++i) {
+	    const comparators = range.set[i];
+
+	    let setMin = null;
+	    comparators.forEach((comparator) => {
+	      // Clone to avoid manipulating the comparator's semver object.
+	      const compver = new SemVer(comparator.semver.version);
+	      switch (comparator.operator) {
+	        case '>':
+	          if (compver.prerelease.length === 0) {
+	            compver.patch++;
+	          } else {
+	            compver.prerelease.push(0);
+	          }
+	          compver.raw = compver.format();
+	          /* fallthrough */
+	        case '':
+	        case '>=':
+	          if (!setMin || gt(compver, setMin)) {
+	            setMin = compver;
+	          }
+	          break
+	        case '<':
+	        case '<=':
+	          /* Ignore maximum versions */
+	          break
+	        /* istanbul ignore next */
+	        default:
+	          throw new Error(`Unexpected operation: ${comparator.operator}`)
+	      }
+	    });
+	    if (setMin && (!minver || gt(minver, setMin))) {
+	      minver = setMin;
+	    }
+	  }
+
+	  if (minver && range.test(minver)) {
+	    return minver
+	  }
+
+	  return null
+	};
+	minVersion_1 = minVersion;
+	return minVersion_1;
+}
+
+var valid;
+var hasRequiredValid;
+
+function requireValid () {
+	if (hasRequiredValid) return valid;
+	hasRequiredValid = 1;
+
+	const Range = requireRange();
+	const validRange = (range, options) => {
+	  try {
+	    // Return '*' instead of '' so that truthiness works.
+	    // This will throw if it's invalid anyway
+	    return new Range(range, options).range || '*'
+	  } catch (er) {
+	    return null
+	  }
+	};
+	valid = validRange;
+	return valid;
+}
+
+var outside_1;
+var hasRequiredOutside;
+
+function requireOutside () {
+	if (hasRequiredOutside) return outside_1;
+	hasRequiredOutside = 1;
+
+	const SemVer = requireSemver$1();
+	const Comparator = requireComparator();
+	const { ANY } = Comparator;
+	const Range = requireRange();
+	const satisfies = requireSatisfies();
+	const gt = requireGt();
+	const lt = requireLt();
+	const lte = requireLte();
+	const gte = requireGte();
+
+	const outside = (version, range, hilo, options) => {
+	  version = new SemVer(version, options);
+	  range = new Range(range, options);
+
+	  let gtfn, ltefn, ltfn, comp, ecomp;
+	  switch (hilo) {
+	    case '>':
+	      gtfn = gt;
+	      ltefn = lte;
+	      ltfn = lt;
+	      comp = '>';
+	      ecomp = '>=';
+	      break
+	    case '<':
+	      gtfn = lt;
+	      ltefn = gte;
+	      ltfn = gt;
+	      comp = '<';
+	      ecomp = '<=';
+	      break
+	    default:
+	      throw new TypeError('Must provide a hilo val of "<" or ">"')
+	  }
+
+	  // If it satisfies the range it is not outside
+	  if (satisfies(version, range, options)) {
+	    return false
+	  }
+
+	  // From now on, variable terms are as if we're in "gtr" mode.
+	  // but note that everything is flipped for the "ltr" function.
+
+	  for (let i = 0; i < range.set.length; ++i) {
+	    const comparators = range.set[i];
+
+	    let high = null;
+	    let low = null;
+
+	    comparators.forEach((comparator) => {
+	      if (comparator.semver === ANY) {
+	        comparator = new Comparator('>=0.0.0');
+	      }
+	      high = high || comparator;
+	      low = low || comparator;
+	      if (gtfn(comparator.semver, high.semver, options)) {
+	        high = comparator;
+	      } else if (ltfn(comparator.semver, low.semver, options)) {
+	        low = comparator;
+	      }
+	    });
+
+	    // If the edge version comparator has a operator then our version
+	    // isn't outside it
+	    if (high.operator === comp || high.operator === ecomp) {
+	      return false
+	    }
+
+	    // If the lowest version comparator has an operator and our version
+	    // is less than it then it isn't higher than the range
+	    if ((!low.operator || low.operator === comp) &&
+	        ltefn(version, low.semver)) {
+	      return false
+	    } else if (low.operator === ecomp && ltfn(version, low.semver)) {
+	      return false
+	    }
+	  }
+	  return true
+	};
+
+	outside_1 = outside;
+	return outside_1;
+}
+
+var gtr_1;
+var hasRequiredGtr;
+
+function requireGtr () {
+	if (hasRequiredGtr) return gtr_1;
+	hasRequiredGtr = 1;
+
+	// Determine if version is greater than all the versions possible in the range.
+	const outside = requireOutside();
+	const gtr = (version, range, options) => outside(version, range, '>', options);
+	gtr_1 = gtr;
+	return gtr_1;
+}
+
+var ltr_1;
+var hasRequiredLtr;
+
+function requireLtr () {
+	if (hasRequiredLtr) return ltr_1;
+	hasRequiredLtr = 1;
+
+	const outside = requireOutside();
+	// Determine if version is less than all the versions possible in the range
+	const ltr = (version, range, options) => outside(version, range, '<', options);
+	ltr_1 = ltr;
+	return ltr_1;
+}
+
+var intersects_1;
+var hasRequiredIntersects;
+
+function requireIntersects () {
+	if (hasRequiredIntersects) return intersects_1;
+	hasRequiredIntersects = 1;
+
+	const Range = requireRange();
+	const intersects = (r1, r2, options) => {
+	  r1 = new Range(r1, options);
+	  r2 = new Range(r2, options);
+	  return r1.intersects(r2, options)
+	};
+	intersects_1 = intersects;
+	return intersects_1;
+}
+
+var simplify;
+var hasRequiredSimplify;
+
+function requireSimplify () {
+	if (hasRequiredSimplify) return simplify;
+	hasRequiredSimplify = 1;
+
+	// given a set of versions and a range, create a "simplified" range
+	// that includes the same versions that the original range does
+	// If the original range is shorter than the simplified one, return that.
+	const satisfies = requireSatisfies();
+	const compare = requireCompare();
+	simplify = (versions, range, options) => {
+	  const set = [];
+	  let first = null;
+	  let prev = null;
+	  const v = versions.sort((a, b) => compare(a, b, options));
+	  for (const version of v) {
+	    const included = satisfies(version, range, options);
+	    if (included) {
+	      prev = version;
+	      if (!first) {
+	        first = version;
+	      }
+	    } else {
+	      if (prev) {
+	        set.push([first, prev]);
+	      }
+	      prev = null;
+	      first = null;
+	    }
+	  }
+	  if (first) {
+	    set.push([first, null]);
+	  }
+
+	  const ranges = [];
+	  for (const [min, max] of set) {
+	    if (min === max) {
+	      ranges.push(min);
+	    } else if (!max && min === v[0]) {
+	      ranges.push('*');
+	    } else if (!max) {
+	      ranges.push(`>=${min}`);
+	    } else if (min === v[0]) {
+	      ranges.push(`<=${max}`);
+	    } else {
+	      ranges.push(`${min} - ${max}`);
+	    }
+	  }
+	  const simplified = ranges.join(' || ');
+	  const original = typeof range.raw === 'string' ? range.raw : String(range);
+	  return simplified.length < original.length ? simplified : range
+	};
+	return simplify;
+}
+
+var subset_1;
+var hasRequiredSubset;
+
+function requireSubset () {
+	if (hasRequiredSubset) return subset_1;
+	hasRequiredSubset = 1;
+
+	const Range = requireRange();
+	const Comparator = requireComparator();
+	const { ANY } = Comparator;
+	const satisfies = requireSatisfies();
+	const compare = requireCompare();
+
+	// Complex range `r1 || r2 || ...` is a subset of `R1 || R2 || ...` iff:
+	// - Every simple range `r1, r2, ...` is a null set, OR
+	// - Every simple range `r1, r2, ...` which is not a null set is a subset of
+	//   some `R1, R2, ...`
+	//
+	// Simple range `c1 c2 ...` is a subset of simple range `C1 C2 ...` iff:
+	// - If c is only the ANY comparator
+	//   - If C is only the ANY comparator, return true
+	//   - Else if in prerelease mode, return false
+	//   - else replace c with `[>=0.0.0]`
+	// - If C is only the ANY comparator
+	//   - if in prerelease mode, return true
+	//   - else replace C with `[>=0.0.0]`
+	// - Let EQ be the set of = comparators in c
+	// - If EQ is more than one, return true (null set)
+	// - Let GT be the highest > or >= comparator in c
+	// - Let LT be the lowest < or <= comparator in c
+	// - If GT and LT, and GT.semver > LT.semver, return true (null set)
+	// - If any C is a = range, and GT or LT are set, return false
+	// - If EQ
+	//   - If GT, and EQ does not satisfy GT, return true (null set)
+	//   - If LT, and EQ does not satisfy LT, return true (null set)
+	//   - If EQ satisfies every C, return true
+	//   - Else return false
+	// - If GT
+	//   - If GT.semver is lower than any > or >= comp in C, return false
+	//   - If GT is >=, and GT.semver does not satisfy every C, return false
+	//   - If GT.semver has a prerelease, and not in prerelease mode
+	//     - If no C has a prerelease and the GT.semver tuple, return false
+	// - If LT
+	//   - If LT.semver is greater than any < or <= comp in C, return false
+	//   - If LT is <=, and LT.semver does not satisfy every C, return false
+	//   - If LT.semver has a prerelease, and not in prerelease mode
+	//     - If no C has a prerelease and the LT.semver tuple, return false
+	// - Else return true
+
+	const subset = (sub, dom, options = {}) => {
+	  if (sub === dom) {
+	    return true
+	  }
+
+	  sub = new Range(sub, options);
+	  dom = new Range(dom, options);
+	  let sawNonNull = false;
+
+	  OUTER: for (const simpleSub of sub.set) {
+	    for (const simpleDom of dom.set) {
+	      const isSub = simpleSubset(simpleSub, simpleDom, options);
+	      sawNonNull = sawNonNull || isSub !== null;
+	      if (isSub) {
+	        continue OUTER
+	      }
+	    }
+	    // the null set is a subset of everything, but null simple ranges in
+	    // a complex range should be ignored.  so if we saw a non-null range,
+	    // then we know this isn't a subset, but if EVERY simple range was null,
+	    // then it is a subset.
+	    if (sawNonNull) {
+	      return false
+	    }
+	  }
+	  return true
+	};
+
+	const minimumVersionWithPreRelease = [new Comparator('>=0.0.0-0')];
+	const minimumVersion = [new Comparator('>=0.0.0')];
+
+	const simpleSubset = (sub, dom, options) => {
+	  if (sub === dom) {
+	    return true
+	  }
+
+	  if (sub.length === 1 && sub[0].semver === ANY) {
+	    if (dom.length === 1 && dom[0].semver === ANY) {
+	      return true
+	    } else if (options.includePrerelease) {
+	      sub = minimumVersionWithPreRelease;
+	    } else {
+	      sub = minimumVersion;
+	    }
+	  }
+
+	  if (dom.length === 1 && dom[0].semver === ANY) {
+	    if (options.includePrerelease) {
+	      return true
+	    } else {
+	      dom = minimumVersion;
+	    }
+	  }
+
+	  const eqSet = new Set();
+	  let gt, lt;
+	  for (const c of sub) {
+	    if (c.operator === '>' || c.operator === '>=') {
+	      gt = higherGT(gt, c, options);
+	    } else if (c.operator === '<' || c.operator === '<=') {
+	      lt = lowerLT(lt, c, options);
+	    } else {
+	      eqSet.add(c.semver);
+	    }
+	  }
+
+	  if (eqSet.size > 1) {
+	    return null
+	  }
+
+	  let gtltComp;
+	  if (gt && lt) {
+	    gtltComp = compare(gt.semver, lt.semver, options);
+	    if (gtltComp > 0) {
+	      return null
+	    } else if (gtltComp === 0 && (gt.operator !== '>=' || lt.operator !== '<=')) {
+	      return null
+	    }
+	  }
+
+	  // will iterate one or zero times
+	  for (const eq of eqSet) {
+	    if (gt && !satisfies(eq, String(gt), options)) {
+	      return null
+	    }
+
+	    if (lt && !satisfies(eq, String(lt), options)) {
+	      return null
+	    }
+
+	    for (const c of dom) {
+	      if (!satisfies(eq, String(c), options)) {
+	        return false
+	      }
+	    }
+
+	    return true
+	  }
+
+	  let higher, lower;
+	  let hasDomLT, hasDomGT;
+	  // if the subset has a prerelease, we need a comparator in the superset
+	  // with the same tuple and a prerelease, or it's not a subset
+	  let needDomLTPre = lt &&
+	    !options.includePrerelease &&
+	    lt.semver.prerelease.length ? lt.semver : false;
+	  let needDomGTPre = gt &&
+	    !options.includePrerelease &&
+	    gt.semver.prerelease.length ? gt.semver : false;
+	  // exception: <1.2.3-0 is the same as <1.2.3
+	  if (needDomLTPre && needDomLTPre.prerelease.length === 1 &&
+	      lt.operator === '<' && needDomLTPre.prerelease[0] === 0) {
+	    needDomLTPre = false;
+	  }
+
+	  for (const c of dom) {
+	    hasDomGT = hasDomGT || c.operator === '>' || c.operator === '>=';
+	    hasDomLT = hasDomLT || c.operator === '<' || c.operator === '<=';
+	    if (gt) {
+	      if (needDomGTPre) {
+	        if (c.semver.prerelease && c.semver.prerelease.length &&
+	            c.semver.major === needDomGTPre.major &&
+	            c.semver.minor === needDomGTPre.minor &&
+	            c.semver.patch === needDomGTPre.patch) {
+	          needDomGTPre = false;
+	        }
+	      }
+	      if (c.operator === '>' || c.operator === '>=') {
+	        higher = higherGT(gt, c, options);
+	        if (higher === c && higher !== gt) {
+	          return false
+	        }
+	      } else if (gt.operator === '>=' && !c.test(gt.semver)) {
+	        return false
+	      }
+	    }
+	    if (lt) {
+	      if (needDomLTPre) {
+	        if (c.semver.prerelease && c.semver.prerelease.length &&
+	            c.semver.major === needDomLTPre.major &&
+	            c.semver.minor === needDomLTPre.minor &&
+	            c.semver.patch === needDomLTPre.patch) {
+	          needDomLTPre = false;
+	        }
+	      }
+	      if (c.operator === '<' || c.operator === '<=') {
+	        lower = lowerLT(lt, c, options);
+	        if (lower === c && lower !== lt) {
+	          return false
+	        }
+	      } else if (lt.operator === '<=' && !c.test(lt.semver)) {
+	        return false
+	      }
+	    }
+	    if (!c.operator && (lt || gt) && gtltComp !== 0) {
+	      return false
+	    }
+	  }
+
+	  // if there was a < or >, and nothing in the dom, then must be false
+	  // UNLESS it was limited by another range in the other direction.
+	  // Eg, >1.0.0 <1.0.1 is still a subset of <2.0.0
+	  if (gt && hasDomLT && !lt && gtltComp !== 0) {
+	    return false
+	  }
+
+	  if (lt && hasDomGT && !gt && gtltComp !== 0) {
+	    return false
+	  }
+
+	  // we needed a prerelease range in a specific tuple, but didn't get one
+	  // then this isn't a subset.  eg >=1.2.3-pre is not a subset of >=1.0.0,
+	  // because it includes prereleases in the 1.2.3 tuple
+	  if (needDomGTPre || needDomLTPre) {
+	    return false
+	  }
+
+	  return true
+	};
+
+	// >=1.2.3 is lower than >1.2.3
+	const higherGT = (a, b, options) => {
+	  if (!a) {
+	    return b
+	  }
+	  const comp = compare(a.semver, b.semver, options);
+	  return comp > 0 ? a
+	    : comp < 0 ? b
+	    : b.operator === '>' && a.operator === '>=' ? b
+	    : a
+	};
+
+	// <=1.2.3 is higher than <1.2.3
+	const lowerLT = (a, b, options) => {
+	  if (!a) {
+	    return b
+	  }
+	  const comp = compare(a.semver, b.semver, options);
+	  return comp < 0 ? a
+	    : comp > 0 ? b
+	    : b.operator === '<' && a.operator === '<=' ? b
+	    : a
+	};
+
+	subset_1 = subset;
+	return subset_1;
+}
+
+var semver;
+var hasRequiredSemver;
+
+function requireSemver () {
+	if (hasRequiredSemver) return semver;
+	hasRequiredSemver = 1;
+
+	// just pre-load all the stuff that index.js lazily exports
+	const internalRe = requireRe();
+	const constants = requireConstants();
+	const SemVer = requireSemver$1();
+	const identifiers = requireIdentifiers();
+	const parse = requireParse();
+	const valid = requireValid$1();
+	const clean = requireClean();
+	const inc = requireInc();
+	const diff = requireDiff();
+	const major = requireMajor();
+	const minor = requireMinor();
+	const patch = requirePatch();
+	const prerelease = requirePrerelease();
+	const compare = requireCompare();
+	const rcompare = requireRcompare();
+	const compareLoose = requireCompareLoose();
+	const compareBuild = requireCompareBuild();
+	const sort = requireSort();
+	const rsort = requireRsort();
+	const gt = requireGt();
+	const lt = requireLt();
+	const eq = requireEq();
+	const neq = requireNeq();
+	const gte = requireGte();
+	const lte = requireLte();
+	const cmp = requireCmp();
+	const coerce = requireCoerce();
+	const truncate = requireTruncate();
+	const Comparator = requireComparator();
+	const Range = requireRange();
+	const satisfies = requireSatisfies();
+	const toComparators = requireToComparators();
+	const maxSatisfying = requireMaxSatisfying();
+	const minSatisfying = requireMinSatisfying();
+	const minVersion = requireMinVersion();
+	const validRange = requireValid();
+	const outside = requireOutside();
+	const gtr = requireGtr();
+	const ltr = requireLtr();
+	const intersects = requireIntersects();
+	const simplifyRange = requireSimplify();
+	const subset = requireSubset();
+	semver = {
+	  parse,
+	  valid,
+	  clean,
+	  inc,
+	  diff,
+	  major,
+	  minor,
+	  patch,
+	  prerelease,
+	  compare,
+	  rcompare,
+	  compareLoose,
+	  compareBuild,
+	  sort,
+	  rsort,
+	  gt,
+	  lt,
+	  eq,
+	  neq,
+	  gte,
+	  lte,
+	  cmp,
+	  coerce,
+	  truncate,
+	  Comparator,
+	  Range,
+	  satisfies,
+	  toComparators,
+	  maxSatisfying,
+	  minSatisfying,
+	  minVersion,
+	  validRange,
+	  outside,
+	  gtr,
+	  ltr,
+	  intersects,
+	  simplifyRange,
+	  subset,
+	  SemVer,
+	  re: internalRe.re,
+	  src: internalRe.src,
+	  tokens: internalRe.t,
+	  SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
+	  RELEASE_TYPES: constants.RELEASE_TYPES,
+	  compareIdentifiers: identifiers.compareIdentifiers,
+	  rcompareIdentifiers: identifiers.rcompareIdentifiers,
+	};
+	return semver;
+}
+
+var semverExports = requireSemver();
+
+const BASIC_INFO_MAX_BYTES = 10 * 1024 * 1024;
+const BASIC_INFO_MAX_PIXELS = 40_000_000;
+/** 按 NFKC 和 Unicode 空白规范化名称，并校验 1–40 个字符及禁用字符。 */
+function normalizeBasicInfoName(raw) {
+    if (typeof raw !== 'string')
+        throw new Error('heybox.name 必须是字符串');
+    // 与 Go TrimSpace 一致（JS trim 额外移除 BOM，故使用 Unicode White_Space）。
+    const name = raw.normalize('NFKC').replace(/^\p{White_Space}+|\p{White_Space}+$/gu, '');
+    if (Array.from(name).length < 1 || Array.from(name).length > 40 || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}<>&"']/u.test(name) || !/[\p{L}\p{N}]/u.test(name)) {
+        throw new Error('名称须包含 1–40 个字符及文字或数字，不能包含控制字符或 HTML 特殊字符');
+    }
+    return name;
+}
+function validateBasicInfoPath(raw) {
+    if (typeof raw !== 'string' || !raw || /[\\:%?#\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(raw))
+        throw new Error('资料图片必须是项目内的规范相对路径');
+    const forbidden = new Set(['', '.', '..', '.git', 'node_modules', 'dist', '.hb-sdk', '.vite', '.cache', '.tmp', 'tmp']);
+    if (raw.split('/').some((part) => forbidden.has(part)))
+        throw new Error('资料图片路径包含禁止的目录');
+    if (!/\.(png|jpe?g|gif|webp)$/i.test(raw))
+        throw new Error('资料图片仅支持 JPEG、PNG、GIF、WebP');
+    return raw;
+}
+/** 解析项目或构建资料；仅早于 0.8.2 且三项全部缺失时返回 undefined。 */
+function parseMiniappBasicInfo(value, sdkVersion = '0.8.2') {
+    sdkVersion = sdkVersion.trim();
+    if (!semverExports.valid(sdkVersion) || sdkVersion.startsWith('v') || sdkVersion.includes('+'))
+        throw new Error('manifest.sdkVersion 必须是合法 SemVer');
+    const fields = ['name', 'icon', 'coverImages'];
+    const present = fields.filter((key) => Object.prototype.hasOwnProperty.call(value, key));
+    if (!present.length && semverExports.lt(sdkVersion, '0.8.2'))
+        return undefined;
+    if (present.length !== fields.length)
+        throw new Error('请配置 heybox.name、heybox.icon、heybox.coverImages，或运行 remote bind/dev/remote deploy 迁移已发布资料');
+    const name = normalizeBasicInfoName(value.name);
+    const icon = validateBasicInfoPath(value.icon);
+    if (!Array.isArray(value.coverImages) || value.coverImages.length < 1 || value.coverImages.length > 5)
+        throw new Error('coverImages 必须包含 1–5 张图片');
+    const coverImages = value.coverImages.map(validateBasicInfoPath);
+    if (new Set(coverImages).size !== coverImages.length)
+        throw new Error('封面路径不能重复');
+    return { name, icon, coverImages };
+}
+
+/** 单个小程序版本最多声明的关联游戏数量。 */
+const MINIAPP_BIND_APP_IDS_MAX_COUNT = 20;
+/**
+ * 校验并规范化小程序关联的游戏 App ID。
+ *
+ * @param value - 不可信声明。`undefined` 和 `[]` 均返回空绑定；其他值必须是最多 20 项的
+ * 字符串数组，不接受 `null`、单个字符串、number 数组或类数组对象。
+ * @param options - 可选诊断来源；`sourceLabel` 默认 `package.json#heybox.bindAppIds`，并原样
+ * 作为所有错误消息的前缀。
+ * @returns 新建、按 appid 数值升序排列且经 `Object.freeze` 冻结的 `readonly string[]`。
+ * 输入数组及其顺序不会被修改；空输入也返回新的冻结空数组。
+ * @throws `Error` `${sourceLabel} 必须是字符串数组`：`value` 不是数组。
+ * @throws `Error` `${sourceLabel} 最多包含 20 个游戏 appid`：输入数组超过 20 项；数量检查
+ * 先于逐项格式检查。
+ * @throws `Error` `${sourceLabel} 包含非法游戏 appid：<value>`：任一项不是 string，或不匹配
+ * `/^[1-9]\d*$/`。因此空串、首尾空白、`0`、前导零、正负号、小数、指数和非十进制字符
+ * 都不会被自动修正。
+ * @throws `Error` `${sourceLabel} 包含超出正 int32 范围的游戏 appid：<value>`：十进制值
+ * 大于 `2147483647` 或不能成为安全整数。
+ * @throws `Error` `${sourceLabel} 包含重复游戏 appid：<value>`：规范字符串在同一数组重复。
+ *
+ * @remarks
+ * 合法范围是闭区间 `1..2147483647`，每项在输出中仍保持十进制 string。排序按数值而不是
+ * 字典序执行，所以 `['3513350', '730', '10']` 输出为 `['10', '730', '3513350']`。
+ * 函数先复制后排序并冻结结果，不排序或冻结调用方传入的数组。
+ *
+ * 这是同步、纯离线的格式规范化函数，不访问网络，也不确认 appid 是否真实存在、可绑定或
+ * 属于当前开发者。`miniappManifest()` 用它校验 `package.json#heybox.bindAppIds` 并把非空结果
+ * 写入 Manifest；远端 deploy 预检和提审才校验游戏可用性。缺失和空数组在普通构建中都表示
+ * 无绑定，函数本身不处理 `remote deploy --from-version` 的历史快照继承语义。
+ *
+ * `bindAppIds` 是版本发布元数据，不是 Runtime 权限，也不会因调用
+ * [navigation.openAppPage](/reference/sdk/navigation/openAppPage) 而变化。后者的 `appId` 是一次
+ * 页面导航参数，允许 string 或 number、只要求字符串化后非空，不适用本函数的数组、int32、
+ * 前导零、去重、20 项或排序规则。
+ *
+ * @example
+ * ```ts
+ * import { parseMiniappBindAppIds } from '@heybox/hb-sdk/miniapp-publish'
+ *
+ * const declared = ['3513350', '730', '10']
+ * const appIds = parseMiniappBindAppIds(declared)
+ *
+ * console.log(appIds) // ['10', '730', '3513350']
+ * console.log(declared) // ['3513350', '730', '10']，输入顺序不变
+ * console.log(Object.isFrozen(appIds)) // true
+ * ```
+ *
+ * @see [miniappManifest](/reference/symbols/vite/functions/miniappManifest)
+ * @see [navigation.openAppPage](/reference/sdk/navigation/openAppPage)
+ * @see [CLI 与远端发布](/guide/cli#生产构建)
+ */
+function parseMiniappBindAppIds(value, options = {}) {
+    const sourceLabel = options.sourceLabel ?? 'package.json#heybox.bindAppIds';
+    if (value === undefined)
+        return Object.freeze([]);
+    if (!Array.isArray(value))
+        throw new Error(`${sourceLabel} 必须是字符串数组`);
+    if (value.length > MINIAPP_BIND_APP_IDS_MAX_COUNT) {
+        throw new Error(`${sourceLabel} 最多包含 ${MINIAPP_BIND_APP_IDS_MAX_COUNT} 个游戏 appid`);
+    }
+    const seen = new Set();
+    const appIds = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || !/^[1-9]\d*$/.test(item)) {
+            throw new Error(`${sourceLabel} 包含非法游戏 appid：${String(item)}`);
+        }
+        const numeric = Number(item);
+        if (!Number.isSafeInteger(numeric) || numeric > 2_147_483_647) {
+            throw new Error(`${sourceLabel} 包含超出正 int32 范围的游戏 appid：${item}`);
+        }
+        if (seen.has(item))
+            throw new Error(`${sourceLabel} 包含重复游戏 appid：${item}`);
+        seen.add(item);
+        appIds.push(item);
+    }
+    appIds.sort((left, right) => Number(left) - Number(right));
+    return Object.freeze(appIds);
+}
+
+/**
+ * 所有小程序 iframe bridge envelope 共用的固定 namespace。
+ *
+ * @remarks 该值用于排除无关 `postMessage` 数据，不负责验证消息来源；接收方仍须校验 source 和 nonce，
+ * 并在 origin 可以固定且协议模式要求时校验 origin。
+ */
+
+const MINI_PROGRAM_PERMISSION_KEYS = [
+    'userInfo',
+    'steamLibrary',
+    'share',
+    'storage',
+    'filesystem',
+    'clipboard',
+    'leaderboard',
+    'network',
+    'companion',
+];
+const MINI_PROGRAM_PERMISSION_CATALOG = [
+    {
+        key: 'userInfo',
+        name: '用户信息',
+        description: '登录小程序并读取当前用户的授权信息。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['auth.login', 'user.getInfo'],
+        conditions: ['继续执行黑盒登录、用户授权和可信手势规则。'],
+    },
+    {
+        key: 'steamLibrary',
+        name: 'Steam 游戏库',
+        description: '读取当前用户授权的 Steam 游戏库。',
+        access: 'declaration',
+        risk: 'high',
+        config: {},
+        methods: ['user.getSteamGameList'],
+        conditions: ['继续执行账号绑定和数据可用性规则。'],
+    },
+    {
+        key: 'share',
+        name: '分享',
+        description: '使用小程序分享、分享菜单和截图能力。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['share.copyLink', 'share.showShareMenu', 'share.screenshot'],
+        conditions: ['继续执行分享参数校验和 Host 支持检查。'],
+    },
+    {
+        key: 'storage',
+        name: '键值存储',
+        description: '读写按小程序隔离的简单键值数据。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['storage.getStorage', 'storage.setStorage'],
+        conditions: ['仅用于简单键值存储，不包含文件系统。'],
+    },
+    {
+        key: 'filesystem',
+        name: '文件系统',
+        description: '访问小程序沙盒文件和用户选择的外部文件。',
+        access: 'declaration',
+        risk: 'high',
+        config: {},
+        methods: [
+            'network.download',
+            'files.pickFiles',
+            'files.pickDirectory',
+            'files.saveFile',
+            'file.create',
+            'file.remove',
+            'file.exists',
+            'file.readText',
+            'file.writeText',
+            'file.readBytes',
+            'file.writeBytes',
+            'file.stat',
+            'directory.create',
+            'directory.remove',
+            'directory.exists',
+            'directory.list',
+        ],
+        conditions: ['外部文件继续要求有效的用户选择、会话句柄和匹配的读写模式。'],
+    },
+    {
+        key: 'clipboard',
+        name: '剪贴板',
+        description: '向系统剪贴板写入文本。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['device.setClipboard'],
+        conditions: ['继续执行文本长度和 Host 支持限制。'],
+    },
+    {
+        key: 'leaderboard',
+        name: '排行榜',
+        description: '读写小程序云排行榜。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: [
+            'cloud.leaderboard.submit',
+            'cloud.leaderboard.getList',
+            'cloud.leaderboard.getCurrentUserEntry',
+            'cloud.leaderboard.deleteCurrentUserEntry',
+            'cloud.leaderboard.getInfo',
+        ],
+        conditions: ['排行榜必须已创建，用户和资源规则保持不变。'],
+    },
+    {
+        key: 'network',
+        name: '网络',
+        description: '通过 network 模块请求或下载外部资源。',
+        access: 'platform-approval',
+        risk: 'high',
+        config: {
+            useOfficialDomain: {
+                type: 'boolean',
+                required: false,
+                default: false,
+                description: '是否申请访问小黑盒官方域名。',
+            },
+        },
+        methods: ['network.request', 'network.download'],
+        conditions: ['声明后仍需平台批准，并继续执行网络安全策略。'],
+    },
+    {
+        key: 'companion',
+        name: '桌面辅助应用',
+        description: '下载、准备并运行随当前小程序版本发布的受管桌面程序。',
+        access: 'platform-approval',
+        risk: 'high',
+        config: {},
+        methods: [
+            'companion.getInfo',
+            'companion.getPreparationStatus',
+            'companion.prepare',
+            'companion.cancelPreparation',
+            'companion.getActiveSession',
+            'companion.launch',
+            'companion.session.write',
+            'companion.session.closeStdin',
+            'companion.session.terminate',
+            'companion.session.ackOutput',
+            'companion.openAttachment',
+            'companion.showNotification',
+        ],
+        conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
+    },
+];
+new Set(MINI_PROGRAM_PERMISSION_KEYS);
+
+const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(MINI_PROGRAM_PERMISSION_KEYS);
+/**
+ * 判断字符串是否是当前协议目录管理的 canonical runtime permission key。
+ *
+ * @param key - 已确认类型为 `string` 的候选权限 key；若输入来自 `unknown` 边界，调用方须先完成字符串检查。
+ * @returns 与 `MINI_PROGRAM_PERMISSION_KEYS` 中某项精确相等时返回 `true`，并将 TypeScript 类型收窄为
+ * `MiniProgramPermissionKey`；未知、历史或格式不同的字符串返回 `false`。
+ *
+ * @remarks
+ * 当前 canonical key 集合固定为：
+ *
+ * - `userInfo`
+ * - `steamLibrary`
+ * - `share`
+ * - `storage`
+ * - `filesystem`
+ * - `clipboard`
+ * - `leaderboard`
+ * - `network`
+ * - `companion`
+ *
+ * 匹配大小写敏感且按原字符串执行。该 guard 不 trim，因此 `' network '` 返回 `false`；历史权限 key
+ * `network.request` 也返回 `false`，即使同名 capability method 仍是公开 method。消费完整 schema v1 权限快照时
+ * 应使用 {@link parseMiniProgramRuntimePermissions}，由解析边界统一 trim，并把历史 `network.request` 归一为
+ * canonical `network`。未知的 future key 同样返回 `false`；本 guard 不负责 parser 的前向兼容忽略策略。
+ *
+ * 类型谓词只把字符串收窄为 `MiniProgramPermissionKey` union，不读取权限 entry、status 或 config，也不检查
+ * Manifest。返回 `true` 不表示权限已声明、平台已批准、Runtime snapshot 中存在、status 为 `enabled`、Host 支持，
+ * 或当前 capability 已获准执行。尤其 `network` 与 `companion` 还需要平台批准；其他 declaration 权限也继续受
+ * 各自适用的 Host、用户授权、可信手势、参数与业务策略约束。
+ *
+ * `MINI_PROGRAM_PERMISSION_CATALOG` 提供每个 key 的展示信息、access、风险、配置字段和 method 集合；具体 bridge
+ * method 是否要求某项权限应以 {@link MINI_PROGRAM_PROTOCOL_CAPABILITIES} 的 `requirement` 为准。`kind: 'none'`
+ * 的 method 不会因为某个 key 被本 guard 识别而新增权限要求。
+ *
+ * @example
+ * ```ts
+ * import { isManagedMiniProgramRuntimePermissionKey } from '@heybox/hb-sdk/protocol';
+ *
+ * function acceptPermissionKey(candidate: unknown) {
+ *   if (typeof candidate !== 'string') return undefined;
+ *   return isManagedMiniProgramRuntimePermissionKey(candidate) ? candidate : undefined;
+ * }
+ *
+ * acceptPermissionKey('filesystem'); // 'filesystem'
+ * acceptPermissionKey('network'); // 'network'
+ * acceptPermissionKey(' network '); // undefined：guard 不 trim
+ * acceptPermissionKey('network.request'); // undefined：legacy key 只由 snapshot parser 归一化
+ * ```
+ *
+ * @see [parseMiniProgramRuntimePermissions](/reference/symbols/protocol/functions/parseMiniProgramRuntimePermissions) 完整 snapshot 的 trim、legacy 归一化与 config 校验。
+ * @see [MINI_PROGRAM_PROTOCOL_CAPABILITIES](/reference/symbols/protocol/constants/MINI_PROGRAM_PROTOCOL_CAPABILITIES) method 到 permission requirement 的权威映射。
+ * @see [权限声明](/guide/permissions) Manifest 声明、平台批准与 Runtime 状态的完整流程。
+ */
+function isManagedMiniProgramRuntimePermissionKey(key) {
+    return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
+}
+/**
+ * 将不可信的 schema v1 runtime permission snapshot 解析为独立的 canonical 权限映射。
+ *
+ * @param snapshot - Host、服务端、dev context 或持久化边界提供的普通反序列化数据；调用方不需要先做
+ * 类型断言。Proxy trap 或 getter 自身抛出的异常会原样传播。
+ * @returns {@link ParsedMiniProgramRuntimePermissions}。完整 snapshot 合法时返回
+ * `{ valid: true, permissions }`；顶层、entry、状态、重复 key 或已知 config 任一校验失败时统一
+ * 返回 `{ valid: false, permissions: {} }`，不会保留部分权限。
+ *
+ * @remarks
+ * 顶层必须是对象，`schema_version` 必须严格等于数字 `1`，`entries` 必须是数组。`revision`
+ * 可省略；存在时必须是大于或等于 `0` 的整数。revision 只参与输入校验，不会复制到返回值。
+ * 顶层与 entry 的其他字段会被忽略，以便 schema v1 内前向扩展。
+ *
+ * 每个 entry 必须是对象，`key` 必须是 trim 后非空的字符串，`status` 必须严格为
+ * `'enabled'` 或 `'disabled'`。解析器先 trim key，再把唯一的历史别名 `network.request`
+ * 归一为 canonical `network`；大小写不会转换。重复检查基于归一化后的所有 key，因此
+ * `network` 与 ` network.request ` 冲突，两个相同未知 future key 也会让整个 snapshot fail
+ * closed。
+ *
+ * 是否属于当前受管 key 由 {@link isManagedMiniProgramRuntimePermissionKey} 与权限目录决定。
+ * 为兼容较新服务端，非空、状态合法且不重复的未知 key 会被忽略；其 `config` 可以缺失、为
+ * `null`、数组或任意未来结构，均不会使已认识的权限失效。未知 entry 不会出现在返回映射中。
+ *
+ * 已知权限严格执行当前 schema：`network` 必须提供对象 config，且
+ * `useOfficialDomain` 必须是 boolean；其他额外 network config 字段会丢弃，返回值只复制该
+ * boolean。其余当前权限是无配置项权限，输入 config 可以缺失、为 `null` 或 `{}`，并统一输出
+ * `{}`；非空对象、数组或其他值会使整个 snapshot 无效。Runtime snapshot 必须显式包含
+ * network 的有效 boolean，即使 Manifest 目录把省略 `useOfficialDomain` 的开发者默认值定义为
+ * `false`。
+ *
+ * 返回的 canonical entry/config 都是新对象；修改原 snapshot、entry 或嵌套 network config
+ * 不会改变解析结果。`permissions` 是 Partial map：合法空 entries、只包含未知权限，或没有某个
+ * canonical key 时，解析仍可 `valid: true`，对应属性保持缺失。
+ *
+ * `valid: true` 只表示 snapshot 可安全消费，不代表 entry 已启用，更不代表某个 capability 已获
+ * 授权。Runtime consumer 应先查 {@link MINI_PROGRAM_PROTOCOL_CAPABILITIES} 中目标 method 的
+ * `requirement`：`kind: 'none'` 不读取权限；`kind: 'all'` 要求列出的每个 canonical entry 都存在
+ * 且 `status === 'enabled'`。之后仍需通过 Host capability、可信手势、用户授权、参数和业务
+ * policy。当前 Runtime 对 `valid: false` 按空权限表 fail closed，受保护 method 会得到
+ * `PERMISSION_NOT_DECLARED`，而不是沿用输入中的部分 enabled entry。
+ *
+ * @example
+ * ```ts
+ * import { parseMiniProgramRuntimePermissions } from '@heybox/hb-sdk/protocol';
+ *
+ * const parsed = parseMiniProgramRuntimePermissions({
+ *   schema_version: 1,
+ *   revision: 4,
+ *   entries: [
+ *     {
+ *       key: ' network.request ',
+ *       status: 'enabled',
+ *       config: { useOfficialDomain: false, futureField: 'discarded' },
+ *     },
+ *     { key: 'future.permission', status: 'disabled', config: null },
+ *   ],
+ * });
+ *
+ * // legacy key 已归一化；未知 future key 被忽略。
+ * if (parsed.valid && parsed.permissions.network?.status === 'enabled') {
+ *   console.log(parsed.permissions.network.config.useOfficialDomain); // false
+ *   // 继续执行 capability requirement、Host 与业务 policy 校验。
+ * }
+ * ```
+ *
+ * @see {@link ParsedMiniProgramRuntimePermissions}
+ * @see {@link MiniProgramRuntimePermissionsSnapshot}
+ * @see {@link isManagedMiniProgramRuntimePermissionKey}
+ * @see {@link MINI_PROGRAM_PROTOCOL_CAPABILITIES}
+ * @see {@link https://docs.xiaoheihe.cn/hb_sdk/guide/permissions | 权限声明}
+ */
+function parseMiniProgramRuntimePermissions(snapshot) {
+    if (!isRecord$4(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
+        return { valid: false, permissions: {} };
+    }
+    if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
+        return { valid: false, permissions: {} };
+    }
+    const seenKeys = new Set();
+    const permissions = {};
+    for (const rawEntry of snapshot.entries) {
+        if (!isRecord$4(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
+            return { valid: false, permissions: {} };
+        }
+        const inputKey = rawEntry.key.trim();
+        const key = inputKey === 'network.request' ? 'network' : inputKey;
+        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled')) {
+            return { valid: false, permissions: {} };
+        }
+        seenKeys.add(key);
+        if (!isManagedMiniProgramRuntimePermissionKey(key)) {
+            // 未知权限必须忽略，不能让 config:null / 缺字段把已认识的批准一起否掉。
+            // 服务端会对无 config 的 message 字段输出 null（Rylai EmitUnpopulated）。
+            continue;
+        }
+        if (key === 'network') {
+            const config = rawEntry.config;
+            if (!isRecord$4(config) || typeof config.useOfficialDomain !== 'boolean') {
+                return { valid: false, permissions: {} };
+            }
+            permissions[key] = {
+                key,
+                status: rawEntry.status,
+                config: { useOfficialDomain: config.useOfficialDomain },
+            };
+            continue;
+        }
+        if (rawEntry.config !== null && rawEntry.config !== undefined && (!isRecord$4(rawEntry.config) || Object.keys(rawEntry.config).length > 0)) {
+            return { valid: false, permissions: {} };
+        }
+        permissions[key] = {
+            key,
+            status: rawEntry.status,
+            config: {},
+        };
+    }
+    return { valid: true, permissions };
+}
+function isRecord$4(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+const MINIAPP_PERMISSION_KEYS = MINI_PROGRAM_PERMISSION_KEYS;
+function parseMiniappPermissions(value, options) {
+    const sourceLabel = options.sourceLabel ?? 'package.json#heybox.permissions';
+    if (!options.present) {
+        if (requiresExplicitPermissions(options.sdkVersion)) {
+            throw new Error(`${sourceLabel} 在 @heybox/hb-sdk ${options.sdkVersion} 中必须声明；无权限需求时请配置空对象 {}`);
+        }
+        return { declared: false };
+    }
+    if (!isRecord$3(value)) {
+        throw new Error(`${sourceLabel} 必须是 JSON 对象`);
+    }
+    const knownKeys = new Set(MINIAPP_PERMISSION_KEYS);
+    for (const key of Object.keys(value)) {
+        if (!knownKeys.has(key))
+            throw new Error(`${sourceLabel} 包含未知权限：${key}`);
+    }
+    const permissions = {};
+    for (const key of MINIAPP_PERMISSION_KEYS) {
+        if (!Object.prototype.hasOwnProperty.call(value, key))
+            continue;
+        const declaration = value[key];
+        const itemLabel = `${sourceLabel}.${key}`;
+        if (!isRecord$3(declaration))
+            throw new Error(`${itemLabel} 必须是 JSON 对象`);
+        const definition = MINI_PROGRAM_PERMISSION_CATALOG.find((item) => item.key === key);
+        if (!definition)
+            throw new Error(`权限目录缺少定义：${key}`);
+        const allowedFields = new Set(['enabled', ...Object.keys(definition.config)]);
+        for (const field of Object.keys(declaration)) {
+            if (!allowedFields.has(field))
+                throw new Error(`${itemLabel} 包含未知字段：${field}`);
+        }
+        if (typeof declaration.enabled !== 'boolean')
+            throw new Error(`${itemLabel}.enabled 必须是 boolean`);
+        let useOfficialDomain = false;
+        if (key === 'network') {
+            if (declaration.useOfficialDomain !== undefined && typeof declaration.useOfficialDomain !== 'boolean') {
+                throw new Error(`${itemLabel}.useOfficialDomain 必须是 boolean`);
+            }
+            useOfficialDomain = declaration.useOfficialDomain === true;
+        }
+        if (!declaration.enabled)
+            continue;
+        permissions[key] = key === 'network' ? { enabled: true, useOfficialDomain } : { enabled: true };
+    }
+    return { declared: true, permissions: permissions };
+}
+function requiresExplicitPermissions(sdkVersion) {
+    const parsed = semverExports.parse(sdkVersion);
+    if (!parsed)
+        throw new Error(`sdkVersion 必须是合法 SemVer：${sdkVersion}`);
+    return parsed.major > 0 || parsed.minor >= 9;
+}
+function getMissingPermissionsWarning(sourceLabel = 'package.json#heybox.permissions') {
+    return `${sourceLabel} 尚未声明。当前按 0.8 兼容行为构建；0.9.0 起将拒绝构建，请尽快补充权限声明（无权限需求时配置 {}）。`;
+}
+function composeMiniappRuntimePermissions(local, approvals) {
+    const parsedApprovals = parseMiniProgramRuntimePermissions(approvals);
+    const approvalRevision = isRecord$3(approvals) && Number.isInteger(approvals.revision) ? approvals.revision : undefined;
+    const views = [];
+    const entries = [];
+    for (const definition of MINI_PROGRAM_PERMISSION_CATALOG) {
+        const declaration = local.permissions?.[definition.key];
+        const declared = !local.declared || declaration?.enabled === true;
+        if (definition.access === 'declaration') {
+            views.push({ key: definition.key, access: definition.access, declared, approved: null, effective: declared });
+            if (declared)
+                entries.push({ key: definition.key, status: 'enabled', config: {} });
+            continue;
+        }
+        const approval = parsedApprovals.valid ? parsedApprovals.permissions[definition.key] : undefined;
+        const approved = approval?.status === 'enabled';
+        const effective = declared && approved;
+        if (definition.key !== 'network') {
+            views.push({
+                key: definition.key,
+                access: definition.access,
+                declared,
+                approved,
+                effective,
+            });
+            if (declared) {
+                entries.push({ key: definition.key, status: effective ? 'enabled' : 'disabled', config: {} });
+            }
+            continue;
+        }
+        const requestedOfficialDomain = declaration?.enabled === true && 'useOfficialDomain' in declaration && declaration.useOfficialDomain;
+        const approvedOfficialDomain = approval?.config.useOfficialDomain === true;
+        const effectiveOfficialDomain = effective && (local.declared ? requestedOfficialDomain : true) && approvedOfficialDomain;
+        views.push({
+            key: definition.key,
+            access: definition.access,
+            declared,
+            approved,
+            requestedConfig: { useOfficialDomain: requestedOfficialDomain },
+            approvedConfig: { useOfficialDomain: approvedOfficialDomain },
+            effective,
+            effectiveConfig: { useOfficialDomain: effectiveOfficialDomain },
+        });
+        if (declared) {
+            entries.push({ key: definition.key, status: effective ? 'enabled' : 'disabled', config: { useOfficialDomain: effectiveOfficialDomain } });
+        }
+    }
+    return {
+        runtimePermissions: { schema_version: 1, ...(approvalRevision === undefined ? {} : { revision: approvalRevision }), entries },
+        views,
+    };
+}
+function isRecord$3(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/**
+ * `package.json#heybox.platforms` 接受的平台值，顺序同时是 Manifest 的规范化输出顺序。
+ *
+ * @remarks 项目仍应只声明实际完成适配并经过验收的平台；模板默认值不是自动兼容承诺。
+ */
+const MINIAPP_PLATFORM_VALUES = ['android', 'ios', 'ohos', 'windows', 'macos', 'linux'];
+/** 窗口尺寸字段的脏值兜底上限；真正的上限是宿主侧显示器 workArea。 */
+const MINIAPP_WINDOW_SIZE_MAX = 16_384;
+const MINIAPP_WINDOW_NUMBER_FIELDS = ['defaultWidth', 'defaultHeight', 'minWidth', 'minHeight'];
+const MINIAPP_WINDOW_ALLOWED_FIELDS = [...MINIAPP_WINDOW_NUMBER_FIELDS, 'resizable'];
+/**
+ * 桌面平台子集：从唯一平台词表 `MINIAPP_PLATFORM_VALUES` 派生，`satisfies` 阻止它漂移出词表。
+ * 小程序声明其中任一平台，即视为该项目承诺适配 PC / 桌面端；调试台据此取舍桌面调试入口。
+ *
+ * 注意：子集只表达「声明为桌面」，不保证已有可用的客户端基线——例如 `linux` 目前既没有 `@hbPlatform` 声明，
+ * 也没有 Companion target，仅声明 `linux` 的项目会展示入口但未必能真正打开。
+ */
+const MINIAPP_DESKTOP_PLATFORM_VALUES = ['windows', 'macos', 'linux'];
+function hasMiniappDesktopPlatform(platforms) {
+    if (!platforms)
+        return false;
+    return MINIAPP_DESKTOP_PLATFORM_VALUES.some((platform) => platforms.includes(platform));
+}
+/**
+ * 判断小程序版本是否符合公开 Manifest 版本规则。
+ *
+ * @param version - 待判断的 `package.json.version` / Manifest 版本字符串；首尾空白会先被
+ * 移除，但函数不会把规范化后的字符串返回给调用方。
+ * @returns trim 后满足小程序严格版本规则时返回 `true`，否则返回 `false`。对类型声明允许的
+ * 字符串输入，该函数只返回布尔值，不抛出校验错误。
+ *
+ * @remarks
+ * 接受形式为 canonical SemVer `MAJOR.MINOR.PATCH[-PRERELEASE]`。trim 后的输入必须与
+ * `semver` 严格解析得到的 `version` 完全相同，因此不完整版本（如 `1.2`）、`v` / `=`
+ * 前缀、范围表达式、额外段，以及 major/minor/patch 或纯数字 prerelease 标识中的前导零
+ * 都返回 `false`。只有首尾空白会被忽略，内部空白不会被修复。
+ *
+ * 合法 prerelease（如 `1.2.3-alpha.1`、`0.0.1-rc.0`）可以使用。build metadata 即使符合
+ * 标准 SemVer（如 `1.2.3+build.1`）也被小程序发布合同显式禁止。模板占位 core
+ * `0.0.0` 同样禁止，包括 `0.0.0-alpha` 等 prerelease；至少应提升 patch/minor/major
+ * 之一，例如 `0.0.1-alpha.1`。
+ *
+ * 这是无 I/O、无状态修改的 predicate，适合表单即时判断。实际 Vite / `hb-sdk build`
+ * 流程会调用同规则的 package version validator：成功时返回 trim 后版本并写入 Manifest，
+ * 失败时抛出带 `package.json.version` 来源的错误；调用本函数为 `true` 不能跳过正式构建。
+ *
+ * {@link resolveMiniappManifestPlatforms} 处理的是 Manifest `sdkVersion` 对平台声明策略的
+ * SemVer precedence，不是当前小程序的发布 `version`。不要用本函数替代平台解析，也不要
+ * 把项目 version 当作 sdkVersion 传入。
+ *
+ * @example
+ * ```ts
+ * import { isValidVersion } from '@heybox/hb-sdk/miniapp-publish'
+ *
+ * isValidVersion(' 1.2.3 ') // true
+ * isValidVersion('1.2.3-alpha.1') // true
+ * isValidVersion('0.0.1-alpha.1') // true
+ * isValidVersion('1.2') // false
+ * isValidVersion('v1.2.3') // false
+ * isValidVersion('1.2.3+build.1') // false
+ * isValidVersion('0.0.0-alpha') // false
+ * ```
+ *
+ * @see {@link resolveMiniappManifestPlatforms}
+ * @see {@link https://docs.xiaoheihe.cn/hb_sdk/reference/symbols/vite/functions/miniappManifest | miniappManifest}
+ */
+function isValidMiniappManifestVersion(version) {
+    return getMiniappManifestVersionError(version) === undefined;
+}
+function validateMiniappManifestVersion(version, sourceLabel = 'manifest.version') {
+    const error = getMiniappManifestVersionError(version);
+    if (error) {
+        throw new Error(`${sourceLabel} ${error}`);
+    }
+    return String(version).trim();
+}
+function parseMiniappManifestJson(raw, sourceLabel = 'manifest.json') {
+    const hadBom = raw.charCodeAt(0) === 0xfeff;
+    const text = hadBom ? raw.slice(1) : raw;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`${sourceLabel} 不是合法 JSON：${formatReason$1(error)}`);
+    }
+    if (!isManifestRecord(parsed)) {
+        throw new Error(`${sourceLabel} 必须是 JSON 对象`);
+    }
+    return {
+        manifest: parsed,
+        hadBom,
+    };
+}
+function validateMiniappManifestForDeploy(manifest) {
+    const version = validateMiniappManifestVersion(manifest.version, 'manifest.version');
+    const sdkVersion = validateSdkVersion(manifest.sdkVersion, 'manifest.sdkVersion');
+    const permissions = parseMiniappPermissions(manifest.permissions, {
+        present: Object.prototype.hasOwnProperty.call(manifest, 'permissions'),
+        sdkVersion,
+        sourceLabel: 'manifest.permissions',
+    });
+    const companions = validateGeneratedCompanions(manifest.companions);
+    const window = validateMiniappWindow(manifest.window, 'manifest.window');
+    const bindAppIds = parseMiniappBindAppIds(manifest.bindAppIds, { sourceLabel: 'manifest.bindAppIds' });
+    return {
+        version,
+        sdkVersion,
+        ...parseMiniappBasicInfo(manifest, sdkVersion),
+        platforms: validateMiniappPlatforms(manifest.platforms, 'manifest.platforms'),
+        ...(permissions.permissions === undefined ? {} : { permissions: permissions.permissions }),
+        ...(companions === undefined ? {} : { companions }),
+        ...(window === undefined ? {} : { window }),
+        ...(bindAppIds.length === 0 ? {} : { bindAppIds }),
+    };
+}
+function validateGeneratedCompanions(value) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord$2(value) || Object.keys(value).length === 0)
+        throw new Error('manifest.companions 必须是非空对象');
+    for (const [alias, definition] of Object.entries(value)) {
+        if (!/^[a-z][a-z0-9-]{0,31}$/.test(alias) ||
+            !isRecord$2(definition) ||
+            typeof definition.displayName !== 'string' ||
+            !definition.displayName ||
+            Array.from(definition.displayName).length > 120 ||
+            !Array.isArray(definition.capabilities) ||
+            definition.capabilities.some((capability) => capability !== 'stdio' && capability !== 'attachments' && capability !== 'notifications') ||
+            new Set(definition.capabilities).size !== definition.capabilities.length ||
+            !isRecord$2(definition.targets) ||
+            Object.keys(definition.targets).length === 0)
+            throw new Error(`manifest.companions.${alias} 不合法`);
+        for (const [target, artifact] of Object.entries(definition.targets)) {
+            if (isRecord$2(artifact) && artifact.elevation === 'required') {
+                throw new Error(`manifest.companions.${alias}.targets.${target}.elevation V1 仅支持 none，暂不支持管理员权限启动`);
+            }
+            if ((target !== 'windows-x64' && target !== 'macos-arm64') ||
+                !isRecord$2(artifact) ||
+                artifact.path !== `companions/${alias}/${target}.zip` ||
+                !Number.isSafeInteger(artifact.size) ||
+                Number(artifact.size) <= 0 ||
+                typeof artifact.sha256 !== 'string' ||
+                !/^[a-f0-9]{64}$/.test(artifact.sha256) ||
+                !isRecord$2(artifact.entrypoint) ||
+                (artifact.entrypoint.kind !== 'executable' && artifact.entrypoint.kind !== 'app-bundle') ||
+                typeof artifact.entrypoint.path !== 'string' ||
+                !artifact.entrypoint.path ||
+                artifact.elevation !== 'none' ||
+                !isValidGeneratedCompanionArgs(artifact.args)) {
+                throw new Error(`manifest.companions.${alias}.targets.${target} 不合法`);
+            }
+        }
+    }
+    return value;
+}
+function isValidGeneratedCompanionArgs(value) {
+    if (!Array.isArray(value) || value.length > 64)
+        return false;
+    let totalBytes = 0;
+    for (const arg of value) {
+        if (typeof arg !== 'string' || /[\u0000\r\n]/.test(arg))
+            return false;
+        const bytes = new TextEncoder().encode(arg).length;
+        if (bytes > 1024)
+            return false;
+        totalBytes += bytes;
+    }
+    return totalBytes <= 16_384;
+}
+function validateMiniappPlatforms(platforms, sourceLabel = 'platforms') {
+    if (!Array.isArray(platforms) || platforms.length === 0) {
+        throw new Error(`${sourceLabel} 必须是非空平台数组`);
+    }
+    const allowedPlatforms = new Set(MINIAPP_PLATFORM_VALUES);
+    const seen = new Set();
+    for (const platform of platforms) {
+        if (typeof platform !== 'string' || !allowedPlatforms.has(platform)) {
+            throw new Error(`${sourceLabel} 包含不支持的平台：${String(platform)}`);
+        }
+        if (seen.has(platform)) {
+            throw new Error(`${sourceLabel} 包含重复平台：${platform}`);
+        }
+        seen.add(platform);
+    }
+    return Object.freeze(MINIAPP_PLATFORM_VALUES.filter((platform) => seen.has(platform)));
+}
+function areMiniappPlatformsEqual(left, right) {
+    return left.length === right.length && left.every((platform, index) => platform === right[index]);
+}
+/**
+ * 校验并归一化 `package.json#heybox.window` / `manifest.window` 声明。
+ *
+ * @remarks
+ * 与 `heybox.permissions` 同样的严格风格：未知字段报错，不做静默忽略。
+ * `width` / `height` 显式给出改名提示；`x` / `y` 按未知字段显式报错（`INV-NO-DEV-POSITION`）。
+ * 未声明时返回 `undefined`，由调用方决定不写入产物。
+ * @param value - 待校验的原始声明（不可信输入）。
+ * @param sourceLabel - 报错前缀，默认指向开发者声明路径。
+ * @throws 当声明不是非空对象、含未知字段、数值/布尔类型不合法或 min/default 不配对时抛出。
+ */
+function validateMiniappWindow(value, sourceLabel = 'package.json#heybox.window') {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord$2(value) || Object.keys(value).length === 0) {
+        throw new Error(`${sourceLabel} 至少需要声明 defaultWidth/defaultHeight/minWidth/minHeight/resizable 之一`);
+    }
+    if (Object.prototype.hasOwnProperty.call(value, 'width') || Object.prototype.hasOwnProperty.call(value, 'height')) {
+        throw new Error(`${sourceLabel} 请使用 defaultWidth/defaultHeight，而不是 width/height`);
+    }
+    for (const key of Object.keys(value)) {
+        if (!MINIAPP_WINDOW_ALLOWED_FIELDS.includes(key)) {
+            throw new Error(`${sourceLabel} 包含未知字段：${key}`);
+        }
+    }
+    const window = {};
+    for (const field of MINIAPP_WINDOW_NUMBER_FIELDS) {
+        if (!Object.prototype.hasOwnProperty.call(value, field))
+            continue;
+        const size = value[field];
+        if (typeof size !== 'number' || !Number.isSafeInteger(size) || size <= 0) {
+            throw new Error(`${sourceLabel}.${field} 必须是正整数`);
+        }
+        if (size > MINIAPP_WINDOW_SIZE_MAX) {
+            throw new Error(`${sourceLabel}.${field} 不能大于 ${MINIAPP_WINDOW_SIZE_MAX}`);
+        }
+        window[field] = size;
+    }
+    if (Object.prototype.hasOwnProperty.call(value, 'resizable')) {
+        if (typeof value.resizable !== 'boolean') {
+            throw new Error(`${sourceLabel}.resizable 必须是 boolean`);
+        }
+        window.resizable = value.resizable;
+    }
+    for (const [minimum, fallback] of [
+        ['minWidth', 'defaultWidth'],
+        ['minHeight', 'defaultHeight'],
+    ]) {
+        const minimumValue = window[minimum];
+        if (minimumValue === undefined)
+            continue;
+        const fallbackValue = window[fallback];
+        if (fallbackValue === undefined) {
+            throw new Error(`${sourceLabel}.${minimum} 必须与 ${fallback} 同时声明`);
+        }
+        if (minimumValue > fallbackValue) {
+            throw new Error(`${sourceLabel}.${minimum} 必须小于等于 ${fallback}`);
+        }
+    }
+    return window;
+}
+/** 比较两份窗口声明是否逐字段一致；未声明视同 `undefined`。 */
+function areMiniappWindowsEqual(left, right) {
+    if (left === undefined || right === undefined)
+        return left === right;
+    return (left.defaultWidth === right.defaultWidth &&
+        left.defaultHeight === right.defaultHeight &&
+        left.minWidth === right.minWidth &&
+        left.minHeight === right.minHeight &&
+        left.resizable === right.resizable);
+}
+function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
+    if (typeof version !== 'string' || version.trim() === '') {
+        throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
+    }
+    const normalized = version.trim();
+    const parsed = semverExports.parse(normalized);
+    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
+        throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
+    }
+    return normalized;
+}
+function isManifestRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isRecord$2(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function getMiniappManifestVersionError(version) {
+    if (typeof version !== 'string' || version.trim() === '') {
+        return `必须是合法 SemVer：${String(version)}`;
+    }
+    const normalized = version.trim();
+    const parsed = semverExports.parse(normalized);
+    if (!parsed) {
+        return `必须是合法 SemVer：${normalized}`;
+    }
+    if (parsed.build.length > 0) {
+        return `不能包含 build metadata：${normalized}`;
+    }
+    if (parsed.version !== normalized) {
+        return `必须是合法 SemVer：${normalized}`;
+    }
+    if (parsed.major === 0 && parsed.minor === 0 && parsed.patch === 0) {
+        return '不能是模板默认版本 0.0.0';
+    }
+    return undefined;
+}
+function formatReason$1(error) {
+    if (error instanceof Error && error.message) {
+        return error.message;
+    }
+    return String(error);
+}
+
 const UNDEFINED_CODE_POINTS = new Set([
     65534, 65535, 131070, 131071, 196606, 196607, 262142, 262143, 327678, 327679, 393214,
     393215, 458750, 458751, 524286, 524287, 589822, 589823, 655358, 655359, 720894,
@@ -8232,57 +11900,882 @@ new Set([
     TAG_NAMES.WBR,
 ]);
 
-// Shorthands
+/** CDN 上传接口使用的小程序产物业务 scope。 */
+const MINIAPP_UPLOAD_SCOPE = 'activity';
+/** 完整 CDN 上传 key 的默认长度上限；旧固定版本流程按字符计数，上传会话流程按 UTF-8 bytes 计数。 */
+const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
+/** 单次向 CDN 申请上传信息时包含的最大文件数；当前合同固定为 `50`。 */
+const MINIAPP_UPLOAD_BATCH_SIZE = 50;
+/** Web 构建产物的默认总大小上限，单位为 bytes；当前为 100 MiB。 */
+const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES = 100 * 1024 * 1024;
+/** Companion 归档的临时总大小上限，单位为 bytes；当前为 500 MiB。 */
+const MINIAPP_COMPANION_UPLOAD_TEMPORARY_SIZE_LIMIT_BYTES = 500 * 1024 * 1024;
+/** 查询当前开发者账号是否具备小程序访问资格的开放平台 API 路径。 */
+const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = '/mall/developer/user_miniprogram/access_status';
+/** 查询当前开发者可管理主体列表的开放平台 API 路径。 */
+const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
+/** 切换当前开发者主体的开放平台 API 路径。 */
+const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
+/** 查询当前主体下小程序列表的开放平台 API 路径。 */
+const LIST_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/list';
+/** 创建小程序的开放平台 API 路径。 */
+const CREATE_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/create';
+/** 查询单个小程序详情的开放平台 API 路径。 */
+const DETAIL_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/detail';
+/** 创建本地开发启动凭据的开放平台 API 路径。 */
+const CREATE_USER_MINIPROGRAM_LOCAL_DEV_LAUNCH_TOKEN_API_PATH = '/mall/developer/user_miniprogram/local_dev_launch_token';
+/** 查询小程序预览白名单的开放平台 API 路径。 */
+const USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist';
+/** 更新小程序预览白名单的开放平台 API 路径。 */
+const UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = '/mall/developer/user_miniprogram/preview_allowlist/update';
+/** 创建小程序云排行榜的开放平台 API 路径。 */
+const CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH = '/mall/developer/user_miniprogram/leaderboard/create';
+/** 查询单个小程序云排行榜详情的开放平台 API 路径。 */
+const DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH = '/mall/developer/user_miniprogram/leaderboard/detail';
+/** 查询小程序云排行榜列表的开放平台 API 路径。 */
+const LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH = '/mall/developer/user_miniprogram/leaderboard/list';
+/** 删除小程序云排行榜的开放平台 API 路径。 */
+const DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH = '/mall/developer/user_miniprogram/leaderboard/delete';
+/** 在上传或复用版本前执行发布预检的开放平台 API 路径。 */
+const PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/precheck';
+/** 将小程序版本提交审核的开放平台 API 路径。 */
+const SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = '/mall/developer/user_miniprogram/version/submit_audit';
+/** 查询小程序版本预览信息的开放平台 API 路径。 */
+const USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH = '/mall/developer/user_miniprogram/version/preview_info';
+/** 撤回待审核小程序版本的开放平台 API 路径。 */
+const WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/withdraw';
+/** 发布审核通过的小程序版本的开放平台 API 路径。 */
+const RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/release';
+/** 下架当前线上小程序的开放平台 API 路径。 */
+const TAKE_DOWN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/take_down';
+/** 重新开放已下架小程序的开放平台 API 路径。 */
+const REOPEN_USER_MINIPROGRAM_API_PATH = '/mall/developer/user_miniprogram/reopen';
+/** 更新小程序广场展示状态的开放平台 API 路径。 */
+const UPDATE_SQUARE_DISPLAY_API_PATH = '/mall/developer/user_miniprogram/square_display/update';
+/** 查询小程序历史版本列表的开放平台 API 路径。 */
+const LIST_USER_MINIPROGRAM_VERSION_API_PATH = '/mall/developer/user_miniprogram/version/list';
+const FNV_OFFSET = 0x811c9dc5;
+const FNV_PRIME = 0x01000193;
+const MINIAPP_UPLOAD_SESSION_REF_LENGTH = 10;
+const MINIAPP_ARTIFACT_SIGNATURE_MAGIC = 'heybox-user-miniprogram-artifact\0v1\0';
+const UNPAIRED_SURROGATE_PATTERN = /[\ud800-\udbff](?![\udc00-\udfff])|(^|[^\ud800-\udbff])[\udc00-\udfff]/;
+const textEncoder = new TextEncoder();
+/**
+ * 将扫描到的相对路径转换为统一的 `/` 分隔形式。
+ *
+ * @param relativePath - 待整理的构建产物路径。TypeScript 入口声明为字符串；JavaScript 运行时会
+ * 先计算 `relativePath || ''`，再通过 `String(...)` 强制转换。
+ * @returns 仅统一分隔符形态的新字符串：所有 `\\` 转为 `/`，所有前导 `/` 被删除，其余连续
+ * `/` 合并为一个。空字符串以及运行时传入的 `undefined`、`null`、`false`、`0`、`NaN` 等
+ * falsy 值返回 `''`；truthy 非字符串按标准 `String(value)` 结果继续整理。
+ *
+ * @remarks
+ * 这是面向 build/deploy 文件扫描结果的**格式 helper**，不是路径安全校验或 canonical path
+ * parser。它不会 trim、URL decode、Unicode normalize、解析盘符，也不会拒绝或消解 `.` / `..`
+ * segment、控制字符、Windows drive prefix 或尾随 `/`。例如 `/etc/passwd` 会变成
+ * `etc/passwd`，`C:\\temp\\app.js` 会变成 `C:/temp/app.js`，`assets/../secret/` 仍保留点段
+ * 和尾随 slash；调用方不能根据返回值推断原输入是安全相对路径。
+ *
+ * SDK 的 build/deploy 流程会把扫描路径先用本函数统一分隔符，再分别使用
+ * {@link relativePathContainsNodeModulesSegment} 排除完整 `node_modules` 目录段、用
+ * {@link shouldUploadDistFile} 过滤根 `manifest.json` / `.DS_Store` / source map。`hb-sdk build`
+ * 随后校验大小预算；`hb-sdk remote deploy` 还会在签名和上传前通过
+ * `validateUploadPaths()`、`prepareMiniappArtifactFiles()` 或
+ * `validateMiniappUploadPathLengths()` 执行真正的空路径、点段、控制字符、重复和长度校验。
+ * 这些步骤不能由本函数单独替代；`shouldUploadDistFile()` 也不会自行检查 `node_modules`。
+ *
+ * 不要把本函数与 `@heybox/hb-sdk/protocol` 的 `isMiniProgramRelativePath()` 混用：协议 guard
+ * 不做转换，只接受已经规范的非空字符串，并拒绝前导/尾随 `/`、反斜杠、空 segment、`.`、
+ * `..` 与控制字符；本函数则会改写部分非法形态并保留其余不安全内容。
+ *
+ * @example
+ * ```ts
+ * import { normalizeRelativePath } from '@heybox/hb-sdk/miniapp-publish';
+ *
+ * normalizeRelativePath('///dist\\assets//app.js'); // 'dist/assets/app.js'
+ * normalizeRelativePath('assets/../secret///'); // 'assets/../secret/'，仍需安全校验
+ * normalizeRelativePath(123 as unknown as string); // '123'，JavaScript 运行时强制转换
+ * normalizeRelativePath(0 as unknown as string); // ''，falsy 值先回退为空串
+ * ```
+ *
+ * @see {@link relativePathContainsNodeModulesSegment}
+ * @see {@link shouldUploadDistFile}
+ * @see {@link https://docs.xiaoheihe.cn/hb_sdk/reference/symbols/protocol/functions/isMiniProgramRelativePath | isMiniProgramRelativePath}
+ */
+function normalizeRelativePath(relativePath) {
+    return String(relativePath || '')
+        .replace(/\\/g, '/')
+        .replace(/^\/+/, '')
+        .replace(/\/+/g, '/');
+}
+/**
+ * 判断路径中是否包含大小写不敏感的完整 `node_modules` 目录段。
+ *
+ * @param relativePath - 待检查的构建产物路径。函数先通过 {@link normalizeRelativePath} 把
+ * 反斜杠改为 `/`、删除前导 `/` 并合并连续 `/`，再按 `/` 分段。
+ * @returns 至少一个非空段大小写不敏感地等于完整 `node_modules` 时返回 `true`；空路径、
+ * 空段及 `node_modules.txt`、`node_modules-old`、`@node_modules` 等相似名称返回 `false`。
+ *
+ * @remarks
+ * 比较使用每个非空 segment 的 `toLowerCase() === 'node_modules'`，因此根目录或任意深度的
+ * `node_modules`、`NODE_MODULES`、`Node_Modules` 都会命中。前导和重复 slash 会先被
+ * `normalizeRelativePath` 整理；尾随 slash 产生的空段会被忽略。
+ *
+ * 这是同步、无副作用的**单一 predicate**，只回答“规范化后的文本是否包含该完整段”。它
+ * 不 trim segment、不进行 URL/percent decode、Unicode normalize 或文件系统解析。例如
+ * `node_modules%2Fpkg/index.js`、`%6eode_modules/pkg.js` 和 `node_modules.txt` 都不会命中；调用方
+ * 不应传 URL，也不能把未命中解释为路径安全。
+ *
+ * 本函数不会拒绝或消解 `.` / `..`、绝对路径、Windows drive prefix、控制字符、空路径、
+ * symlink、重复路径或超长路径。`assets/../node_modules/pkg.js` 仍会命中，因为点段保持原样；
+ * 不含 `node_modules` 的危险路径则仍可能返回 `false`。签名或上传前必须继续执行对应的上传
+ * 路径规范、唯一性和长度校验。
+ *
+ * SDK build/deploy 会在文件扫描后用本函数拒绝整个 `node_modules` 树，再用
+ * {@link shouldUploadDistFile} 排除根 `manifest.json`、`.DS_Store` 和 source map。build 随后
+ * 校验大小预算；deploy 还会执行上传路径安全、唯一性、长度与签名校验。这些步骤互不替代：`shouldUploadDistFile()` 本身不检查
+ * `node_modules`，本函数也不决定普通文件是否应该上传。
+ *
+ * @example
+ * ```ts
+ * import { relativePathContainsNodeModulesSegment } from '@heybox/hb-sdk/miniapp-publish';
+ *
+ * relativePathContainsNodeModulesSegment('dist\\NODE_MODULES/pkg/index.js'); // true
+ * relativePathContainsNodeModulesSegment('dist//vendor///node_modules/'); // true
+ * relativePathContainsNodeModulesSegment('dist/node_modules.txt'); // false
+ * relativePathContainsNodeModulesSegment('dist/node_modules%2Fpkg.js'); // false，不做 URL decode
+ * relativePathContainsNodeModulesSegment('assets/../secret.js'); // false，但这不代表路径安全
+ * ```
+ *
+ * @see [normalizeRelativePath](/reference/symbols/miniapp-publish/functions/normalizeRelativePath)
+ * @see [shouldUploadDistFile](/reference/symbols/miniapp-publish/functions/shouldUploadDistFile)
+ * @see [miniapp-publish](/reference/miniapp-publish/)
+ */
+function relativePathContainsNodeModulesSegment(relativePath) {
+    return normalizeRelativePath(relativePath)
+        .split('/')
+        .some((segment) => segment.length > 0 && segment.toLowerCase() === 'node_modules');
+}
+/**
+ * 为小程序 ID 计算稳定、紧凑的上传路径别名。
+ *
+ * @param miniProgramId - 小程序 ID。
+ * @returns 基于 32-bit FNV-1a 结果生成的 base36 字符串。
+ * @remarks 该别名只用于缩短上传 key，不是加密摘要，也不能用于鉴权或隐藏小程序身份。
+ * @example
+ * ```ts
+ * const alias = getMiniProgramUploadAlias('mp_example');
+ * console.log(/^[a-z0-9]+$/.test(alias)); // true
+ * ```
+ */
+function getMiniProgramUploadAlias(miniProgramId) {
+    let hash = FNV_OFFSET;
+    const input = String(miniProgramId || '');
+    for (let i = 0; i < input.length; i += 1) {
+        hash ^= input.charCodeAt(i);
+        hash = Math.imul(hash, FNV_PRIME) >>> 0;
+    }
+    return hash.toString(36);
+}
 /**
- * Parses an HTML string.
+ * 校验一组构建产物的总大小是否超过给定上限。
  *
- * @param html Input HTML string.
- * @param options Parsing options.
- * @returns Document
+ * @param items - 要累计的条目。函数按数组顺序读取每项 `size`，经 `Number(...)` 转换后仅
+ * 累加有限且大于 `0` 的值；不修改、过滤或排序输入数组，也不读取 `relativePath`。
+ * @param options - 可选 byte 上限；默认 `104857600` bytes（100 MiB）。自定义上限不会改变
+ * 固定错误文案。
+ * @returns 总和严格大于上限时返回唯一固定字符串
+ * `构建产物总大小超过 100MB，请删除未引用资源或压缩图片后重新 deploy`；总和小于或等于
+ * 上限时返回 `undefined`。函数不会因超限抛异常，调用方决定是否把返回文本转成 `Error`。
  *
+ * @remarks
+ * 计算等价于把每项规范成 `Number.isFinite(Number(size)) && Number(size) > 0 ? Number(size) : 0`
+ * 后求和，不取整、不去重，也不设置单文件上限。因此一个文件可以占满全部预算，多个同路径
+ * 条目会重复计数，正小数会按 JavaScript number 原值加入；总和恰等 `limitBytes` 时通过，
+ * 多 1 byte 才返回错误。
+ *
+ * 在声明的 TypeScript 输入契约内，该函数以返回值报告预算结果，不为非有限/非正 size 抛错。
+ * 固定错误文本不包含首个文件、实际总量或自定义上限，即使测试/集成传了其他 `limitBytes`，
+ * 文案仍写 `100MB` 和 `重新 deploy`。`hb-sdk build` 的调用方会把末尾提示改成 `重新 build`。
+ *
+ * 该函数只校验一个未分组列表的总量，不读取文件系统，不执行 stat，也不校验路径、安全性、
+ * 文件数量、重复项、单文件大小或内容。调用方应先用
+ * [shouldUploadDistFile](/reference/symbols/miniapp-publish/functions/shouldUploadDistFile) 选择真正
+ * 上传的文件，并完成 `node_modules`、路径规范/唯一性/长度等校验；被提前过滤的 Manifest、
+ * `.DS_Store` 和 source map 才不会计入总量。
+ *
+ * Web 与 Companion 需要独立预算时使用 `validateMiniappUploadSizeBudgets()`：它按
+ * `relativePath` 的 `companions/` 前缀分组，Web 组复用本函数的默认 100 MiB 规则，Companion
+ * 组使用独立 500 MiB 上限。直接调用本函数不会识别或分开这些路径。
+ *
+ * @example
+ * ```ts
+ * import { validateUploadTotalSize } from '@heybox/hb-sdk/miniapp-publish';
+ *
+ * const atLimit = validateUploadTotalSize(
+ *   [
+ *     { relativePath: 'assets/app.js', size: 1_024 },
+ *     { relativePath: 'assets/ignored-negative.js', size: -1 },
+ *     { relativePath: 'assets/ignored-nan.js', size: Number.NaN },
+ *   ],
+ *   { limitBytes: 1_024 },
+ * )
+ * console.log(atLimit) // undefined，恰等上限
+ *
+ * const overLimit = validateUploadTotalSize(
+ *   [{ relativePath: 'assets/app.js', size: 1_025 }],
+ *   { limitBytes: 1_024 },
+ * )
+ * if (overLimit) throw new Error(overLimit)
+ * ```
+ *
+ * @see {@link UploadSizeItem}
+ * @see {@link ValidateUploadTotalSizeOptions}
+ * @see [shouldUploadDistFile](/reference/symbols/miniapp-publish/functions/shouldUploadDistFile)
+ * @see [miniapp-publish](/reference/miniapp-publish/)
+ */
+function validateUploadTotalSize(items, options = {}) {
+    const limit = options.limitBytes ?? MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES;
+    const total = items.reduce((sum, item) => {
+        const size = Number(item.size);
+        return sum + (Number.isFinite(size) && size > 0 ? size : 0);
+    }, 0);
+    if (total > limit) {
+        return '构建产物总大小超过 100MB，请删除未引用资源或压缩图片后重新 deploy';
+    }
+    return undefined;
+}
+/**
+ * 分别校验 Web 构建产物与 Companion 归档的总大小预算。
+ *
+ * @param items - 全部待上传文件；规范化后以 `companions/` 开头的路径计入 Companion 预算，其余计入 Web 预算。
+ * @param options - 可选测试或集成覆盖项：`webLimitBytes` 为 Web 上限，`companionLimitBytes` 为 Companion 上限，单位均为 bytes。
+ * @returns Web 或 Companion 的第一个超限提示；两类总量均不超过各自上限时返回 `undefined`。
+ * @remarks Web 默认上限为 100 MiB，Companion 默认上限为 500 MiB；两类预算不会相互借用。
+ * @example
+ * ```ts
+ * const error = validateMiniappUploadSizeBudgets([
+ *   { relativePath: 'index.html', size: 1_024 },
+ *   { relativePath: 'companions/runner/windows-x64.zip', size: 8_192 },
+ * ]);
+ * if (error) throw new Error(error);
+ * ```
+ */
+function validateMiniappUploadSizeBudgets(items, options = {}) {
+    const companionItems = items.filter((item) => normalizeRelativePath(item.relativePath).startsWith('companions/'));
+    const webItems = items.filter((item) => !normalizeRelativePath(item.relativePath).startsWith('companions/'));
+    const webError = validateUploadTotalSize(webItems, { limitBytes: options.webLimitBytes ?? MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES });
+    if (webError)
+        return webError;
+    const companionTotal = companionItems.reduce((sum, item) => sum + (Number.isFinite(item.size) && item.size > 0 ? item.size : 0), 0);
+    const companionLimit = options.companionLimitBytes ?? MINIAPP_COMPANION_UPLOAD_TEMPORARY_SIZE_LIMIT_BYTES;
+    if (companionTotal > companionLimit)
+        return 'Companion 归档总大小超过 500MiB 上限，请缩减归档后重新 deploy';
+    return undefined;
+}
+/**
+ * 判断 `dist` 中的文件是否应作为版本产物上传。
+ *
+ * @param relativePath - `dist` 根目录下的文件路径。判断前先经 {@link normalizeRelativePath}
+ * 统一斜杠、删除前导 `/` 并合并连续 `/`；函数不读取文件系统或文件内容。
+ * @returns 以下规范化结果返回 `false`：空路径、精确等于根 `manifest.json`、精确 basename 为
+ * `.DS_Store` 的任意层级路径，以及以大小写不敏感 `.map` 结尾的路径。其他值返回 `true`。
+ *
+ * @remarks
+ * 过滤顺序以 `normalizeRelativePath(relativePath)` 的结果为准：
+ *
+ * - `''` 返回 `false`。
+ * - 只有精确根路径 `manifest.json` 返回 `false`；`/manifest.json` 规范化后也会命中。
+ *   `assets/manifest.json` 会保留，因为它不是根文件。匹配大小写敏感，所以
+ *   `Manifest.json` 不会作为生成 Manifest 被过滤。
+ * - 根或任意子目录中精确名为 `.DS_Store` 的最终 segment 返回 `false`，匹配大小写敏感；
+ *   `.ds_store`、`.DS_Store.bak` 会保留。
+ * - 整条规范化路径经 `toLowerCase()` 后以 `.map` 结尾即返回 `false`，因此 `.map`、
+ *   `app.js.map`、`app.js.MAP` 都会过滤，而 `app.js.map.txt` 会保留。
+ *
+ * 根 `manifest.json` 是发布流水线单独读取并上送后台的版本元数据，不作为 CDN 文件上传；
+ * 子目录同名文件仍被视为普通业务产物。该 predicate 只做上传集合选择，不验证输入确实是
+ * 文件，也不检查扩展名白名单、文件存在性或内容。
+ *
+ * `true` 不代表路径安全。本函数不会 URL decode，也不会拒绝 `node_modules`、symlink、绝对
+ * 路径、Windows drive prefix、`.` / `..`、空 segment、控制字符、重复路径或超长路径。
+ * build/deploy 必须另外使用 {@link relativePathContainsNodeModulesSegment} 拒绝依赖目录；deploy
+ * 还需在签名/上传前执行路径规范、唯一性和长度校验。
+ *
+ * build/deploy 会先扫描并完成上述独立边界，再以本函数过滤候选文件。build 对保留文件校验
+ * 上传大小预算；deploy 额外执行 artifact 排序/签名与路径长度校验。因此被过滤的根 Manifest、Finder
+ * 元数据和 source map 不计入上传文件数或大小；本函数自身不读取 `size`，也不能替代
+ * `validateUploadTotalSize()` / `validateMiniappUploadSizeBudgets()`。
+ *
+ * @example
+ * ```ts
+ * import { shouldUploadDistFile } from '@heybox/hb-sdk/miniapp-publish';
+ *
+ * shouldUploadDistFile('/manifest.json'); // false，规范化后是根 manifest.json
+ * shouldUploadDistFile('assets/manifest.json'); // true
+ * shouldUploadDistFile('assets/.DS_Store'); // false
+ * shouldUploadDistFile('assets/.ds_store'); // true，.DS_Store 区分大小写
+ * shouldUploadDistFile('assets/app.js.MAP'); // false，.map 后缀不区分大小写
+ * shouldUploadDistFile('assets/app.js.map.txt'); // true
+ * shouldUploadDistFile('node_modules/pkg/index.js'); // true，必须另做 node_modules 检查
+ * shouldUploadDistFile('assets/../secret.js'); // true，但这不代表路径安全
+ * ```
+ *
+ * @see [normalizeRelativePath](/reference/symbols/miniapp-publish/functions/normalizeRelativePath)
+ * @see [relativePathContainsNodeModulesSegment](/reference/symbols/miniapp-publish/functions/relativePathContainsNodeModulesSegment)
+ * @see [validateUploadTotalSize](/reference/symbols/miniapp-publish/functions/validateUploadTotalSize)
+ * @see [miniapp-publish](/reference/miniapp-publish/)
+ */
+function shouldUploadDistFile(relativePath) {
+    const normalized = normalizeRelativePath(relativePath);
+    if (!normalized) {
+        return false;
+    }
+    if (normalized === 'manifest.json') {
+        return false;
+    }
+    if (normalized === '.DS_Store' || normalized.endsWith('/.DS_Store')) {
+        return false;
+    }
+    if (normalized.toLowerCase().endsWith('.map')) {
+        return false;
+    }
+    return true;
+}
+/**
+ * 校验构建产物路径和大小，并按路径的 UTF-8 字节序稳定排序。
+ *
+ * @param files - 待处理的构建产物文件；允许携带 `absolutePath`、`sha256` 等附加字段。
+ * @returns 新建的有序文件列表；每个结果保留输入条目的附加字段，输入数组顺序不变。
+ * @throws `Error` 当文件数超过 uint32、路径为空或不规范、路径重复，或大小不是非负 safe integer 时抛出。
+ * @remarks 路径必须已经使用规范 `/` 分隔形式；此函数不会把反斜杠或点目录段自动改写为其他路径。
+ * @example
+ * ```ts
+ * const files = prepareMiniappArtifactFiles([
+ *   { relativePath: 'index.html', size: 15, absolutePath: '/tmp/dist/index.html' },
+ *   { relativePath: 'assets/app.js', size: 42, absolutePath: '/tmp/dist/assets/app.js' },
+ * ]);
+ *
+ * console.log(files.map((file) => file.relativePath));
+ * // ['assets/app.js', 'index.html']
+ * ```
+ */
+function prepareMiniappArtifactFiles(files) {
+    if (files.length > 0xffffffff) {
+        throw new Error('构建产物文件数量超出签名协议上限');
+    }
+    const usedPaths = new Set();
+    const prepared = files.map((file) => {
+        const relativePath = normalizeMiniappArtifactRelativePath(file.relativePath);
+        if (usedPaths.has(relativePath)) {
+            throw new Error(`构建产物包含重复文件路径：${relativePath}`);
+        }
+        usedPaths.add(relativePath);
+        validateArtifactFileSize(file.size, relativePath);
+        return { ...file, relativePath };
+    });
+    return prepared.sort((left, right) => compareBytes(textEncoder.encode(left.relativePath), textEncoder.encode(right.relativePath)));
+}
+/**
+ * 按服务端 session key 前缀校验最终上传路径的 UTF-8 字节长度。
+ *
+ * @param files - 待上传的构建产物文件；每个路径都必须是规范相对路径。
+ * @param options - `miniProgramId` 用于计算上传别名，`maxLength` 是完整 key 的最大 UTF-8 bytes，默认 {@link ACTIVITY_UPLOAD_KEY_MAX_LENGTH}。
+ * @returns 第一个超长路径的错误提示；全部合法时返回 `undefined`。
+ * @throws `Error` 当任一文件路径为空或不符合构建产物路径规则时抛出。
+ * @remarks 会话引用按固定 10 个 ASCII 字符估算，因此该校验不依赖真实 session ID。
+ * @example
+ * ```ts
+ * const error = validateMiniappUploadPathLengths(
+ *   [{ relativePath: 'assets/app.js' }],
+ *   { miniProgramId: 'mp_example' },
+ * );
+ * if (error) throw new Error(error);
+ * ```
+ */
+function validateMiniappUploadPathLengths(files, options) {
+    const maxLength = options.maxLength ?? ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
+    const prefix = `/u/${getMiniProgramUploadAlias(options.miniProgramId)}/${'x'.repeat(MINIAPP_UPLOAD_SESSION_REF_LENGTH)}/`;
+    const prefixLength = textEncoder.encode(prefix).length;
+    const tooLongFile = files.find((file) => {
+        const relativePath = normalizeMiniappArtifactRelativePath(file.relativePath);
+        return prefixLength + textEncoder.encode(relativePath).length > maxLength;
+    });
+    return tooLongFile ? `文件路径过长，请缩短构建产物文件名或目录层级：${tooLongFile.relativePath}` : undefined;
+}
+/**
+ * 创建 v1 整包签名头。
+ *
+ * @param fileCount - 参与签名的文件数量；必须是 `0` 到 `0xffffffff` 的整数。
+ * @returns 新的字节数组，依次包含固定协议标识和 big-endian uint32 文件数。
+ * @throws `Error` 当文件数不是整数、为负数或超出 uint32 范围时抛出。
+ * @example
+ * ```ts
+ * const header = createMiniappArtifactSignatureHeader(2);
+ * // 将 header 写入 SHA-256，再按排序结果依次写入文件 header 和内容。
+ * ```
+ */
+function createMiniappArtifactSignatureHeader(fileCount) {
+    if (!Number.isInteger(fileCount) || fileCount < 0 || fileCount > 0xffffffff) {
+        throw new Error('构建产物文件数量超出签名协议上限');
+    }
+    return concatBytes(textEncoder.encode(MINIAPP_ARTIFACT_SIGNATURE_MAGIC), encodeUint32BE(fileCount));
+}
+/**
+ * 创建单个文件的 v1 framing header。
+ *
+ * @param file - 构建产物文件；路径必须规范，大小必须是非负 safe integer。
+ * @returns 新的字节数组，依次包含 big-endian uint32 路径字节数、UTF-8 路径和 big-endian uint64 文件大小。
+ * @throws `Error` 当路径为空或不规范，或大小不是非负 safe integer 时抛出。
+ * @example
+ * ```ts
+ * const header = createMiniappArtifactFileHeader({
+ *   relativePath: 'assets/app.js',
+ *   size: 42,
+ * });
+ * ```
+ */
+function createMiniappArtifactFileHeader(file) {
+    const relativePath = normalizeMiniappArtifactRelativePath(file.relativePath);
+    validateArtifactFileSize(file.size, relativePath);
+    const pathBytes = textEncoder.encode(relativePath);
+    return concatBytes(encodeUint32BE(pathBytes.length), pathBytes, encodeUint64BE(file.size));
+}
+/**
+ * 校验服务端 session 文件映射，并计算仍需上传的文件。
+ *
+ * @param localFiles - 本地构建产物 receipt；除 `relativePath` 和 `size` 外，每项必须包含 64 位小写十六进制 `sha256`。
+ * @param serverFiles - 服务端签发的文件映射；数量、路径、大小和 SHA-256 必须与本地产物一一一致。
+ * @param uploadedKeys - 服务端已确认上传成功的 key；每个值都必须属于当前会话，重复值会被去重。
+ * @returns
+ * 包含三个字段的对象：`files` 是按路径 UTF-8 字节序排列的全部 `{ file, key }` 映射，
+ * `missingFiles` 是其中尚未确认上传的映射，`uploadedKeys` 是去重后的已上传 key。
+ * @throws `Error` 当本地产物不规范，服务端映射数量或字段无效、重复或不匹配，或已上传 key 不属于当前产物时抛出。
  * @example
+ * ```ts
+ * const resolved = resolveMiniappUploadSessionFiles(
+ *   [{ relativePath: 'index.html', size: 15, sha256: 'a'.repeat(64) }],
+ *   [{
+ *     relative_path: 'index.html',
+ *     key: '/u/abc/sessionref/index.html',
+ *     size: 15,
+ *     sha256: 'a'.repeat(64),
+ *   }],
+ *   [],
+ * );
+ *
+ * console.log(resolved.missingFiles.length); // 1
+ * ```
+ */
+function resolveMiniappUploadSessionFiles(localFiles, serverFiles, uploadedKeys) {
+    const preparedFiles = prepareMiniappArtifactFiles(localFiles);
+    if (serverFiles.length !== preparedFiles.length) {
+        throw new Error(`上传会话文件数量异常：期望 ${preparedFiles.length}，实际 ${serverFiles.length}`);
+    }
+    const mappings = new Map();
+    const serverSizes = new Map();
+    const serverHashes = new Map();
+    const knownKeys = new Set();
+    for (const serverFile of serverFiles) {
+        const relativePath = normalizeMiniappArtifactRelativePath(serverFile.relative_path);
+        if (mappings.has(relativePath)) {
+            throw new Error(`上传会话返回重复文件路径：${relativePath}`);
+        }
+        const key = String(serverFile.key || '');
+        if (!key) {
+            throw new Error(`上传会话未返回文件 key：${relativePath}`);
+        }
+        if (knownKeys.has(key)) {
+            throw new Error(`上传会话返回重复文件 key：${relativePath}`);
+        }
+        const size = Number(serverFile.size);
+        if (!Number.isSafeInteger(size) || size < 0) {
+            throw new Error(`上传会话返回文件大小异常：${relativePath}`);
+        }
+        const sha256 = String(serverFile.sha256 || '');
+        if (!/^[a-f0-9]{64}$/.test(sha256)) {
+            throw new Error(`上传会话返回文件 SHA-256 异常：${relativePath}`);
+        }
+        mappings.set(relativePath, key);
+        serverSizes.set(relativePath, size);
+        serverHashes.set(relativePath, sha256);
+        knownKeys.add(key);
+    }
+    const files = preparedFiles.map((file) => {
+        const key = mappings.get(file.relativePath);
+        if (!key) {
+            throw new Error(`上传会话缺少文件映射：${file.relativePath}`);
+        }
+        if (serverSizes.get(file.relativePath) !== file.size) {
+            throw new Error(`上传会话文件大小与本地构建不一致：${file.relativePath}`);
+        }
+        if (!('sha256' in file) || serverHashes.get(file.relativePath) !== file.sha256) {
+            throw new Error(`上传会话文件 SHA-256 与本地构建不一致：${file.relativePath}`);
+        }
+        return { file, key };
+    });
+    const completed = new Set();
+    for (const rawKey of uploadedKeys) {
+        const key = String(rawKey || '');
+        if (!knownKeys.has(key)) {
+            throw new Error('上传会话返回了不属于当前产物的已上传文件');
+        }
+        completed.add(key);
+    }
+    return {
+        files,
+        missingFiles: files.filter((file) => !completed.has(file.key)),
+        uploadedKeys: [...completed],
+    };
+}
+/**
+ * 校验 Manifest 中所有 Companion 归档都精确属于当前上传 receipt。
  *
- * ```js
- * const parse5 = require('parse5');
+ * @param companions - `manifest.companions` 原始值；没有 Companion 时传 `undefined`。
+ * @param files - 当前版本的逐文件上传 receipt；只有 `companions/` 前缀文件参与本校验。
+ * @returns 校验成功时不返回值。
+ * @throws `Error` 当必要的 `targets`/artifact 字段缺失，引用不存在的归档、大小或 SHA-256 不一致，
+ * 或 receipt 中存在未被 Manifest 引用的 Companion 归档时抛出。
+ * @remarks 本函数只交叉校验 Companion 声明与上传 receipt，不替代完整 Manifest schema 校验。
+ * 非 Companion Web 文件会被忽略；`companions` 省略时 receipt 中也不能存在 Companion 归档。
+ * @example
+ * ```ts
+ * const receipt = [{
+ *   relativePath: 'companions/runner/windows-x64.zip',
+ *   size: 42,
+ *   sha256: 'a'.repeat(64),
+ * }];
  *
- * const document = parse5.parse('<!DOCTYPE html><html><head></head><body>Hi there!</body></html>');
+ * validateMiniappCompanionFileReceipts({
+ *   runner: {
+ *     targets: {
+ *       'windows-x64': { path: receipt[0].relativePath, size: 42, sha256: receipt[0].sha256 },
+ *     },
+ *   },
+ * }, receipt);
+ * ```
+ */
+function validateMiniappCompanionFileReceipts(companions, files) {
+    const companionFiles = new Map(files.filter((file) => file.relativePath.startsWith('companions/')).map((file) => [file.relativePath, file]));
+    if (companions === undefined) {
+        if (companionFiles.size > 0)
+            throw new Error('dist 包含未被 manifest.companions 引用的 Companion 归档');
+        return;
+    }
+    if (!isRecord$1(companions))
+        throw new Error('manifest.companions 必须是对象');
+    const referenced = new Set();
+    for (const definition of Object.values(companions)) {
+        if (!isRecord$1(definition) || !isRecord$1(definition.targets))
+            throw new Error('manifest.companions targets 不合法');
+        for (const artifact of Object.values(definition.targets)) {
+            if (!isRecord$1(artifact) || typeof artifact.path !== 'string' || typeof artifact.size !== 'number' || typeof artifact.sha256 !== 'string') {
+                throw new Error('manifest.companions artifact 不合法');
+            }
+            const file = companionFiles.get(artifact.path);
+            if (!file)
+                throw new Error(`manifest.companions 引用的归档不在当前上传 receipt：${artifact.path}`);
+            if (file.size !== artifact.size)
+                throw new Error(`Companion 归档大小与 manifest 不一致：${artifact.path}`);
+            if (file.sha256 !== artifact.sha256)
+                throw new Error(`Companion 归档 SHA-256 与 manifest 不一致：${artifact.path}`);
+            referenced.add(artifact.path);
+        }
+    }
+    const extra = [...companionFiles.keys()].find((relativePath) => !referenced.has(relativePath));
+    if (extra)
+        throw new Error(`Companion 归档未被 manifest.companions 引用：${extra}`);
+}
+function isRecord$1(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function normalizeMiniappArtifactRelativePath(relativePath) {
+    const value = String(relativePath || '');
+    if (!value) {
+        throw new Error('构建产物包含空文件路径');
+    }
+    if (value.includes('\\')) {
+        throw new Error(`构建产物路径不能包含反斜杠：${value}`);
+    }
+    if (value.startsWith('/') || value.endsWith('/') || /^[a-zA-Z]:\//.test(value)) {
+        throw new Error(`构建产物必须使用相对文件路径：${value}`);
+    }
+    if (containsControlCharacter(value) || UNPAIRED_SURROGATE_PATTERN.test(value)) {
+        throw new Error(`构建产物路径包含非法字符：${value}`);
+    }
+    if (value.split('/').some((segment) => !segment || segment === '.' || segment === '..')) {
+        throw new Error(`构建产物路径包含非法目录段：${value}`);
+    }
+    if (value.includes(',')) {
+        throw new Error(`构建产物路径不能包含逗号：${value}`);
+    }
+    if (value.includes('*') || value.includes('?')) {
+        throw new Error(`构建产物路径不能包含通配符：${value}`);
+    }
+    return value;
+}
+function containsControlCharacter(value) {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) {
+            return true;
+        }
+    }
+    return false;
+}
+function validateArtifactFileSize(size, relativePath) {
+    if (!Number.isSafeInteger(size) || size < 0) {
+        throw new Error(`构建产物文件大小无效：${relativePath}`);
+    }
+}
+function encodeUint32BE(value) {
+    const bytes = new Uint8Array(4);
+    new DataView(bytes.buffer).setUint32(0, value, false);
+    return bytes;
+}
+function encodeUint64BE(value) {
+    const bytes = new Uint8Array(8);
+    const view = new DataView(bytes.buffer);
+    view.setUint32(0, Math.floor(value / 0x100000000), false);
+    view.setUint32(4, value % 0x100000000, false);
+    return bytes;
+}
+function concatBytes(...parts) {
+    const result = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        result.set(part, offset);
+        offset += part.length;
+    }
+    return result;
+}
+function compareBytes(left, right) {
+    const length = Math.min(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        if (left[index] !== right[index]) {
+            return left[index] - right[index];
+        }
+    }
+    return left.length - right.length;
+}
+
+function findNearestPackageJsonPath(startDir) {
+    let current = path.resolve(startDir);
+    while (true) {
+        const packageJsonPath = path.join(current, 'package.json');
+        if (fs.existsSync(packageJsonPath)) {
+            return packageJsonPath;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return path.join(path.resolve(startDir), 'package.json');
+        }
+        current = parent;
+    }
+}
+function readMiniappPlatformsFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return validateMiniappPlatforms(heybox?.platforms, 'package.json#heybox.platforms');
+}
+/**
+ * 读取并校验 `package.json#heybox.window`。
  *
- * console.log(document.childNodes[1].tagName); //> 'html'
- *```
+ * @returns 合法声明；未声明时返回 `undefined`，调用方不得向 manifest 写入空对象或 `null`。
+ * @throws 当声明违反 {@link validateMiniappWindow} 的规则时抛出，报错前缀为 `package.json#heybox.window`。
  */
-function parse(html, options) {
-    return Parser.parse(html, options);
-}
-
-const RUNTIME_GATE_MARKER = 'data-heybox-runtime-gate';
-const RUNTIME_GATE_STYLE_MARKER = 'data-heybox-runtime-gate-style';
-const RUNTIME_GATE_BOOTSTRAP_MARKER = 'data-heybox-runtime-gate-bootstrap';
-function hasMiniappRuntimeGate(html) {
-    const document = parse(html);
-    let hasGate = false;
-    let hasGateStyle = false;
-    let hasGateBootstrap = false;
-    walk(document, element => {
-        hasGate ||= hasAttr(element, RUNTIME_GATE_MARKER);
-        hasGateStyle ||= hasAttr(element, RUNTIME_GATE_STYLE_MARKER);
-        hasGateBootstrap ||= hasAttr(element, RUNTIME_GATE_BOOTSTRAP_MARKER);
+function readMiniappWindowFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return validateMiniappWindow(heybox?.window, 'package.json#heybox.window');
+}
+function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
+    const { packageJson } = readMiniappPackageJson(root);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    const present = heybox !== undefined && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
+    return parseMiniappPermissions(heybox?.permissions, {
+        present,
+        sdkVersion,
     });
-    return hasGate && hasGateStyle && hasGateBootstrap;
 }
-function readAttr(element, name) {
-    return element.attrs.find(attr => attr.name.toLowerCase() === name)?.value;
+function readMiniappBindAppIdsFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return parseMiniappBindAppIds(heybox?.bindAppIds);
+}
+function resolveMiniappSdkVersion() {
+    if (!version.HB_SDK_VERSION.startsWith('__HB_SDK_'))
+        return version.HB_SDK_VERSION;
+    const packageJson = JSON.parse(fs.readFileSync(path.resolve(__dirname, '..', '..', 'package.json'), 'utf8'));
+    if (typeof packageJson.version !== 'string' || !packageJson.version)
+        throw new Error('未能读取 @heybox/hb-sdk 当前版本号');
+    return packageJson.version;
+}
+function readMiniappPackageJson(root, requireVersion) {
+    const packageJsonPath = findNearestPackageJsonPath(root);
+    let content;
+    try {
+        content = fs.readFileSync(packageJsonPath, 'utf8');
+    }
+    catch (error) {
+        throw new Error(`@heybox/hb-sdk 读取 package.json 失败：${formatReason(error)}`);
+    }
+    let packageJson;
+    try {
+        packageJson = JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`@heybox/hb-sdk 解析 package.json 失败：${formatReason(error)}`);
+    }
+    return { packageJson, packageJsonPath, version: typeof packageJson.version === 'string' ? packageJson.version.trim() : '' };
+}
+function readMiniappHeyboxConfig(packageJson) {
+    if (packageJson.heybox === undefined)
+        return undefined;
+    if (!isRecord(packageJson.heybox)) {
+        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
+    }
+    return packageJson.heybox;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-function hasAttr(element, name) {
-    return readAttr(element, name) !== undefined;
+function formatReason(error) {
+    if (error instanceof Error && error.message) {
+        return error.message;
+    }
+    return String(error);
 }
-function walk(node, visit) {
-    if ('tagName' in node)
-        visit(node);
-    if ('childNodes' in node)
-        for (const child of node.childNodes)
-            walk(child, visit);
-    if ('content' in node && node.content)
-        walk(node.content, visit);
+
+Array.from({ length: 256 }, (_, value) => {
+    let crc = value;
+    for (let bit = 0; bit < 8; bit++)
+        crc = (crc >>> 1) ^ ((crc & 1) ? 0xedb88320 : 0);
+    return crc >>> 0;
+});
+
+const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
+const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
+const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
+const environmentScopeStorage = new node_async_hooks.AsyncLocalStorage();
+let environmentScopeTail = Promise.resolve();
+function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
+    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
+}
+function createMiniappPlatformCspEnv(env, skipPlatformCsp) {
+    return {
+        ...env,
+        [HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV]: VERIFIED_RUNTIME_PERMISSION_CONTEXT,
+        [HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV]: skipPlatformCsp ? '1' : '0',
+    };
+}
+async function withMiniappPlatformCspEnv(skipPlatformCsp, action, env = process.env) {
+    if (environmentScopeStorage.getStore()?.active) {
+        return runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env);
+    }
+    let releaseScope = () => undefined;
+    const previousScope = environmentScopeTail;
+    environmentScopeTail = new Promise((resolve) => {
+        releaseScope = resolve;
+    });
+    await previousScope;
+    const scope = { active: true };
+    try {
+        return await environmentScopeStorage.run(scope, () => runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env));
+    }
+    finally {
+        scope.active = false;
+        releaseScope();
+    }
+}
+async function runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env) {
+    const targets = env === process.env ? [env] : [env, process.env];
+    const previousValues = targets.map((target) => ({
+        context: target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV],
+        officialDomain: target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV],
+    }));
+    for (const target of targets) {
+        target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] = VERIFIED_RUNTIME_PERMISSION_CONTEXT;
+        target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] = skipPlatformCsp ? '1' : '0';
+    }
+    try {
+        return await action();
+    }
+    finally {
+        targets.forEach((target, index) => {
+            const previousValue = previousValues[index];
+            if (previousValue?.context === undefined) {
+                delete target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV];
+            }
+            else {
+                target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] = previousValue.context;
+            }
+            if (previousValue?.officialDomain === undefined) {
+                delete target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV];
+            }
+            else {
+                target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] = previousValue.officialDomain;
+            }
+        });
+    }
 }
 
-exports.hasMiniappRuntimeGate = hasMiniappRuntimeGate;
+exports.BASIC_INFO_MAX_BYTES = BASIC_INFO_MAX_BYTES;
+exports.BASIC_INFO_MAX_PIXELS = BASIC_INFO_MAX_PIXELS;
+exports.CREATE_USER_MINIPROGRAM_API_PATH = CREATE_USER_MINIPROGRAM_API_PATH;
+exports.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH = CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH;
+exports.CREATE_USER_MINIPROGRAM_LOCAL_DEV_LAUNCH_TOKEN_API_PATH = CREATE_USER_MINIPROGRAM_LOCAL_DEV_LAUNCH_TOKEN_API_PATH;
+exports.DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH = DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH;
+exports.DETAIL_USER_MINIPROGRAM_API_PATH = DETAIL_USER_MINIPROGRAM_API_PATH;
+exports.DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH = DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH;
+exports.DEVELOPER_ENTITY_LIST_API_PATH = DEVELOPER_ENTITY_LIST_API_PATH;
+exports.DEVELOPER_ENTITY_SWITCH_API_PATH = DEVELOPER_ENTITY_SWITCH_API_PATH;
+exports.LIST_USER_MINIPROGRAM_API_PATH = LIST_USER_MINIPROGRAM_API_PATH;
+exports.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH = LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH;
+exports.LIST_USER_MINIPROGRAM_VERSION_API_PATH = LIST_USER_MINIPROGRAM_VERSION_API_PATH;
+exports.MINIAPP_UPLOAD_BATCH_SIZE = MINIAPP_UPLOAD_BATCH_SIZE;
+exports.MINIAPP_UPLOAD_SCOPE = MINIAPP_UPLOAD_SCOPE;
+exports.MINI_PROGRAM_PERMISSION_KEYS = MINI_PROGRAM_PERMISSION_KEYS;
+exports.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH = PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH;
+exports.Parser = Parser;
+exports.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = RELEASE_USER_MINIPROGRAM_VERSION_API_PATH;
+exports.REOPEN_USER_MINIPROGRAM_API_PATH = REOPEN_USER_MINIPROGRAM_API_PATH;
+exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH;
+exports.TAKE_DOWN_USER_MINIPROGRAM_API_PATH = TAKE_DOWN_USER_MINIPROGRAM_API_PATH;
+exports.UPDATE_SQUARE_DISPLAY_API_PATH = UPDATE_SQUARE_DISPLAY_API_PATH;
+exports.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;
+exports.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = USER_MINIPROGRAM_ACCESS_STATUS_API_PATH;
+exports.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;
+exports.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH = USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH;
+exports.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH;
+exports.areMiniappPlatformsEqual = areMiniappPlatformsEqual;
+exports.areMiniappWindowsEqual = areMiniappWindowsEqual;
+exports.composeMiniappRuntimePermissions = composeMiniappRuntimePermissions;
+exports.createMiniappArtifactFileHeader = createMiniappArtifactFileHeader;
+exports.createMiniappArtifactSignatureHeader = createMiniappArtifactSignatureHeader;
+exports.createMiniappPlatformCspEnv = createMiniappPlatformCspEnv;
+exports.getMissingPermissionsWarning = getMissingPermissionsWarning;
+exports.hasMiniappDesktopPlatform = hasMiniappDesktopPlatform;
+exports.isValidMiniappManifestVersion = isValidMiniappManifestVersion;
+exports.normalizeBasicInfoName = normalizeBasicInfoName;
+exports.normalizeRelativePath = normalizeRelativePath;
+exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;
+exports.parseMiniappBasicInfo = parseMiniappBasicInfo;
+exports.parseMiniappManifestJson = parseMiniappManifestJson;
+exports.prepareMiniappArtifactFiles = prepareMiniappArtifactFiles;
+exports.readMiniappBindAppIdsFromPackageJson = readMiniappBindAppIdsFromPackageJson;
+exports.readMiniappPermissionsFromPackageJson = readMiniappPermissionsFromPackageJson;
+exports.readMiniappPlatformsFromPackageJson = readMiniappPlatformsFromPackageJson;
+exports.readMiniappWindowFromPackageJson = readMiniappWindowFromPackageJson;
+exports.relativePathContainsNodeModulesSegment = relativePathContainsNodeModulesSegment;
+exports.requireSemver = requireSemver;
+exports.resolveMiniappSdkVersion = resolveMiniappSdkVersion;
+exports.resolveMiniappUploadSessionFiles = resolveMiniappUploadSessionFiles;
+exports.shouldSkipMiniappPlatformCspFromEnv = shouldSkipMiniappPlatformCspFromEnv;
+exports.shouldUploadDistFile = shouldUploadDistFile;
+exports.validateBasicInfoPath = validateBasicInfoPath;
+exports.validateMiniappCompanionFileReceipts = validateMiniappCompanionFileReceipts;
+exports.validateMiniappManifestForDeploy = validateMiniappManifestForDeploy;
+exports.validateMiniappUploadPathLengths = validateMiniappUploadPathLengths;
+exports.validateMiniappUploadSizeBudgets = validateMiniappUploadSizeBudgets;
+exports.withMiniappPlatformCspEnv = withMiniappPlatformCspEnv;