@heybox/hb-sdk 0.8.2-alpha.2 → 0.8.2-alpha.6

package/CHANGELOG.md

@@ -1,6 +1,49 @@
 # Changelog
 
-本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。内部集成、实现策略和审查证据不在此维护。
+本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
+
+## 0.8.2-alpha.6
+
+### 行为调整
+
+- 随包 Agent Skill 改为每次从 canonical [`llms.txt`](https://docs.xiaoheihe.cn/hb_sdk/llms.txt) 按需读取公开文档，不再内置 API、CLI 和示例副本；索引或必需页面不可用时停止 hb-sdk 专项工作，不使用旧快照兜底。
+- `hb-sdk doctor` 会把安装目录中残留的旧版 references 或其他额外内容判为完整性异常，使用 `hb-sdk skill install --force` 可覆盖刷新。
+
+### 文档与工具
+
+- 新增 `package.json#heybox` 项目配置指南，补齐版本资料、平台、权限、窗口、关联游戏、Companion 与远端绑定字段，以及构建和远端命令关系。
+- 修正创建项目、本地调试和远端管理文档：`hb-sdk dev` 启动前必须完成 CLI 登录与项目绑定，同时明确无需预先绑定的发现和建绑命令。
+
+## 0.8.2-alpha.5
+
+- 无面向小程序开发者的可见变化。
+
+## 0.8.2-alpha.4
+
+- Companion 准备与启动的 Host 可信授权信息新增可选归档 SHA-256，供宿主展示产物完整性；公开 SDK `CompanionInfo` 与 iframe 返回保持不变。
+- 补充授权弹窗展示产物来源、签名状态、目标平台、人类可读归档大小和完整 SHA-256 的文档说明。
+
+## 0.8.2-alpha.3 - 2026-09-21
+
+> 摘要：预发布验证版本名称和图片项目化、正式资料自动迁移及上传前发布预检。
+> 影响级别：必须操作
+> 开发者动作：仅测试项目升级至 0.8.2-alpha.3，在 package.json#heybox 配置 name、icon、coverImages；已有正式发布版本可通过 bind/dev/deploy 自动迁移全缺失配置。
+> 兼容范围：这是 0.8.2 稳定版前的验证版本；满足最低 SDK 策略的旧产物继续兼容，平台与权限的 0.9.0 切点不变。
+
+### 必须操作
+
+- 在项目声明名称、icon 和 1–5 张封面；图片使用项目内 JPEG、PNG、GIF 或 WebP，icon 为 200×200，单图不超过 10 MiB 和 4000 万像素。提交前替换脚手架占位图。
+- 每次部署重新构建当前项目，不再复用历史版本产物。详见[版本资料与迁移](https://docs.xiaoheihe.cn/hb_sdk/guide/version-profile)。
+
+### 新增能力
+
+- bind/dev/deploy 在三项资料全部缺失时迁移当前正式发布快照，已下架项目也可迁移；部分配置和从未发布的项目需手工配置。
+- remote info 只读比较本地和已发布资料；图片无法读取时显示 unavailable。
+
+### 行为调整
+
+- build 保持离线，图片原样进入构建产物；Open 展示构建资料的只读预览。
+- 不合规发布在上传前反馈；提交失败后保留已上传文件，再次提交相同构建时复用。
 
 ## 0.8.2-alpha.2
 

package/README.md

@@ -2,7 +2,7 @@
 
 小黑盒 APP 小程序工坊的前端 SDK 与开发 CLI，用于创建、调试、构建和发布工坊小程序，并在业务页面中调用小黑盒开放能力。
 
-运行环境要求 Node.js `>=22.20.0`。`@heybox/hb-sdk` npm 包同时包含与当前 SDK 版本严格对应的 Agent Skill；Skill 不再依赖 Open 远端分发。
+运行环境要求 Node.js `>=22.20.0`。`@heybox/hb-sdk` npm 包同时包含与当前 SDK 版本严格对应的轻量 Agent Skill 入口和完整性 manifest；Skill 不内置 API、CLI 或示例副本，使用时需要联网读取 [`llms.txt`](https://docs.xiaoheihe.cn/hb_sdk/llms.txt) 及其链接的 Markdown 页面。
 
 SDK 只提供面向小程序开发者的稳定接口，不提供客户端内部协议、登录凭据或私有实现入口。本地浏览器调试请使用 `hb-sdk dev` 提供的 Mock 环境，发布前仍需在小黑盒 APP 中完成真机验收。
 
@@ -18,6 +18,9 @@ SDK 只提供面向小程序开发者的稳定接口，不提供客户端内部
 npx @heybox/hb-sdk@latest create my-miniapp
 cd my-miniapp
 npm install
+npm run hb-sdk -- login
+npm run hb-sdk -- remote create
+# 已有远端小程序时改用：npm run hb-sdk -- remote bind <mini-program-id>
 npm run dev
 ```
 
@@ -47,7 +50,7 @@ hb-sdk skill install --agent codex cursor
 hb-sdk skill install --all-agents
 ```
 
-使用 `hb-sdk doctor` 或 `hb-sdk doctor --json` 检查各 Agent 的 Skill 是否与当前 npm 包匹配；已有内容被修改时，使用 `--force` 才会覆盖。
+使用 `hb-sdk doctor` 或 `hb-sdk doctor --json` 检查各 Agent 的 Skill 是否与当前 npm 包匹配；已有内容被修改或残留旧版离线 references 时，使用 `--force` 覆盖。`doctor` 不访问网络，因此不会检查线上文档是否可用。
 
 SDK 会在导入时启动握手，能力调用会自动等待 SDK 就绪。声明 `userInfo` 后，可通过 `user.getInfo()` 读取当前小程序内的隔离身份和已授权资料：
 
@@ -117,7 +120,7 @@ async function revokeAuthorizationFromUserAction() {
 }
 ```
 
-`bindAppIds` 只接受规范十进制字符串（形如 `/^[1-9]\d*$/`，拒绝前导零、空串与非数字），每项必须是正 int32（最大 `2147483647`），数组内不允许重复，最多 20 项，并按数值升序写入 Manifest。它不是权限，构建不联网；游戏真实性在远端预检和提审时校验。字段缺失或 `[]` 都表示清空绑定，`remote deploy --from-version` 则继承源版本快照。PC 展示仍受 `platforms` 过滤。
+`bindAppIds` 只接受规范十进制字符串（形如 `/^[1-9]\d*$/`，拒绝前导零、空串与非数字），每项必须是正 int32（最大 `2147483647`），数组内不允许重复，最多 20 项，并按数值升序写入 Manifest。它不是权限，构建不联网；游戏真实性在远端预检和提审时校验。字段缺失或 `[]` 都表示清空绑定。PC 展示仍受 `platforms` 过滤。
 
 再启用构建插件：
 
@@ -415,3 +418,7 @@ hb-sdk remote deploy --release-note "本次更新说明"
 - [Runtime Host 迁移](./docs/runtime-host-migration.md)
 
 Host/Runtime 集成维护者请先阅读 [`@heybox/hb-sdk-runtime` README](../hb-sdk-runtime/README.md)、[Runtime Reference](../hb-sdk-runtime/docs/reference/) 和 [`@heybox/hb-sdk-protocol` README](../hb-sdk-protocol/README.md)。
+
+## 版本名称与图片（0.8.2）
+
+在 `package.json#heybox` 配置 `name`、`icon`、`coverImages`。图片为项目内文件，icon 200×200、封面 1–5 张，单张不超过 10 MiB 和 4000 万像素。构建原样复制到版本产物，发布时才更新线上资料。全缺失配置可通过 bind/dev/deploy 从当前正式发布快照自动迁移；离线 build 不迁移。详见[版本资料与迁移指南](https://docs.xiaoheihe.cn/hb_sdk/guide/version-profile)。

package/dist/cli-chunks/{build-bVThH3Z5.cjs → build-TOcahJhW.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DiTeD75Q.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-CAhESVDA.cjs');
 require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
-var index = require('./index-CDtcZVWv.cjs');
-var projectVite = require('./project-vite-CXgdzIYw.cjs');
-require('./version-QiVEs76a.cjs');
+var runtimeGate = require('./runtime-gate-B_fHNic6.cjs');
+var index = require('./index-CP14FXez.cjs');
+var projectVite = require('./project-vite-HKW4tSBX.cjs');
+require('./version-tRrcrp9F.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-DpKqGnjp.cjs → context-Bk0adtVQ.cjs}

@@ -1,10 +1,327 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-DiTeD75Q.cjs');
-var session = require('./session-CIoBspg-.cjs');
-var fs$1 = require('node:fs');
+var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
+var runtimePermissionEnv = require('./runtime-permission-env-CAhESVDA.cjs');
+var fs$1 = require('node:fs');
+var sharp = require('sharp');
+var session = require('./session-COr9TQ6O.cjs');
+
+async function inspectBasicInfoImage(bytes, sourcePath, kind) {
+    const inspected = await inspectDecodedBasicInfoImage(bytes, kind);
+    const extensions = { jpg: ['jpg', 'jpeg'], png: ['png'], gif: ['gif'], webp: ['webp'] };
+    const ext = sourcePath.split('.').pop().toLowerCase();
+    if (!extensions[inspected.extension]?.includes(ext))
+        throw new Error('资料图片格式与扩展名不一致');
+    return inspected;
+}
+async function inspectRemoteBasicInfoImage(bytes, kind) {
+    return inspectDecodedBasicInfoImage(bytes, kind);
+}
+async function inspectDecodedBasicInfoImage(bytes, kind) {
+    if (!bytes.length || bytes.length > runtimePermissionEnv.BASIC_INFO_MAX_BYTES)
+        throw new Error('资料图片不得为空或超过 10 MiB');
+    const decoder = sharp(bytes, { limitInputPixels: runtimePermissionEnv.BASIC_INFO_MAX_PIXELS, failOn: 'warning' });
+    const metadata = await decoder.metadata();
+    const extensions = { jpeg: 'jpg', png: 'png', gif: 'gif', webp: 'webp' };
+    if (!metadata.format || !extensions[metadata.format])
+        throw new Error('资料图片格式不支持');
+    const width = metadata.width ?? 0;
+    const height = metadata.pageHeight ?? metadata.height ?? 0;
+    if (!width || !height || width * height > runtimePermissionEnv.BASIC_INFO_MAX_PIXELS)
+        throw new Error('资料图片不得超过 4000 万像素');
+    if (kind === 'icon' && (width !== 200 || height !== 200))
+        throw new Error('icon 必须是 200×200');
+    // 强制解码而非只信任图片头；不将解码结果写回图片。
+    await decoder.stats();
+    return { sha256: node_crypto.createHash('sha256').update(bytes).digest('hex'), extension: extensions[metadata.format] };
+}
+async function readBasicInfoSource(projectRoot, relative, kind) {
+    runtimePermissionEnv.validateBasicInfoPath(relative);
+    const root = await fs.realpath(projectRoot);
+    const target = await fs.realpath(path.join(root, relative));
+    const resolvedRelative = path.relative(root, target).split(path.sep).join('/');
+    runtimePermissionEnv.validateBasicInfoPath(resolvedRelative);
+    if (resolvedRelative.startsWith('../') || path.isAbsolute(resolvedRelative))
+        throw new Error('资料图片不能逃逸项目目录');
+    const info = await fs.stat(target);
+    if (!info.isFile() || info.size > runtimePermissionEnv.BASIC_INFO_MAX_BYTES)
+        throw new Error('资料图片必须为不超过 10 MiB 的普通文件');
+    const file = await fs.open(target, fs$1.constants.O_RDONLY | fs$1.constants.O_NOFOLLOW);
+    try {
+        const actual = await file.stat();
+        if (!actual.isFile() || actual.size > runtimePermissionEnv.BASIC_INFO_MAX_BYTES)
+            throw new Error('资料图片文件已变化');
+        const bytes = await file.readFile();
+        return { bytes, ...(await inspectBasicInfoImage(bytes, relative, kind)) };
+    }
+    finally {
+        await file.close();
+    }
+}
+/** 逐级校验真实目录，避免保留目录或迁移目录中的符号链接将写入带到项目外。 */
+async function ensureBasicInfoDirectory(rootPath, relative) {
+    const root = await fs.realpath(rootPath);
+    let current = root;
+    for (const part of relative.split('/')) {
+        if (!part || part === '.' || part === '..')
+            throw new Error('资料目录不合法');
+        current = path.join(current, part);
+        await fs.mkdir(current).catch((error) => {
+            if (error.code !== 'EEXIST')
+                throw error;
+        });
+        const resolved = await fs.realpath(current);
+        const within = path.relative(root, resolved);
+        if (within.startsWith('..') || path.isAbsolute(within))
+            throw new Error('资料目录不能逃逸项目');
+    }
+}
+
+class MiniProgramProjectBindingError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'MiniProgramProjectBindingError';
+    }
+}
+function findMiniProgramProjectRoot(startDir) {
+    let current = path.resolve(startDir);
+    while (true) {
+        if (fs$1.existsSync(path.join(current, 'package.json'))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            throw new MiniProgramProjectBindingError('当前目录或父目录未找到 package.json', 'PACKAGE_JSON_NOT_FOUND');
+        }
+        current = parent;
+    }
+}
+async function readMiniProgramProjectPackage(startDir) {
+    const projectRoot = findMiniProgramProjectRoot(startDir);
+    const packageJsonPath = path.join(projectRoot, 'package.json');
+    const raw = await fs.readFile(packageJsonPath, 'utf8');
+    let packageJson;
+    try {
+        packageJson = JSON.parse(raw);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new MiniProgramProjectBindingError(`package.json 不是合法 JSON：${packageJsonPath}\n${message}`, 'PACKAGE_JSON_INVALID');
+    }
+    return {
+        projectRoot,
+        packageJsonPath,
+        packageJson,
+        raw,
+        indent: detectJsonIndent(raw),
+        trailingNewline: raw.endsWith('\r\n') ? '\r\n' : raw.endsWith('\n') ? '\n' : '',
+    };
+}
+function readBoundMiniProgramIdFromPackageJson(packageJson) {
+    const value = packageJson.heybox?.miniProgramId;
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+async function readBoundMiniProgramId(startDir) {
+    return readBoundMiniProgramIdFromPackageJson((await readMiniProgramProjectPackage(startDir)).packageJson);
+}
+async function requireBoundMiniProgramId(startDir) {
+    const context = await readMiniProgramProjectPackage(startDir);
+    const miniProgramId = readBoundMiniProgramIdFromPackageJson(context.packageJson);
+    if (!miniProgramId) {
+        throw new MiniProgramProjectBindingError(`当前项目未绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。\n配置位置：${context.packageJsonPath}#heybox.miniProgramId`, 'MINI_PROGRAM_UNBOUND');
+    }
+    return { ...context, miniProgramId };
+}
+async function writeBoundMiniProgramId(startDir, miniProgramId, options = {}) {
+    const context = await readMiniProgramProjectPackage(startDir);
+    const normalizedMiniProgramId = String(miniProgramId).trim();
+    if (!normalizedMiniProgramId) {
+        throw new MiniProgramProjectBindingError('miniProgramId 不能为空', 'PACKAGE_JSON_INVALID');
+    }
+    const currentMiniProgramId = readBoundMiniProgramIdFromPackageJson(context.packageJson);
+    if (currentMiniProgramId && currentMiniProgramId !== normalizedMiniProgramId && !options.force) {
+        throw new MiniProgramProjectBindingError(`当前项目已绑定小程序 ${currentMiniProgramId}。如需覆盖本地绑定，请使用 --force。`, 'MINI_PROGRAM_BINDING_EXISTS');
+    }
+    if (currentMiniProgramId === normalizedMiniProgramId) {
+        return {
+            ...context,
+            changed: false,
+            miniProgramId: normalizedMiniProgramId,
+        };
+    }
+    if (context.packageJson.heybox !== undefined && !isPlainObject(context.packageJson.heybox)) {
+        throw new MiniProgramProjectBindingError('package.json heybox 字段必须是对象，不能写入 miniProgramId', 'PACKAGE_JSON_HEYBOX_INVALID');
+    }
+    context.packageJson.heybox = {
+        ...(context.packageJson.heybox ?? {}),
+        miniProgramId: normalizedMiniProgramId,
+    };
+    await fs.writeFile(context.packageJsonPath, `${JSON.stringify(context.packageJson, null, context.indent)}${context.trailingNewline || '\n'}`, 'utf8');
+    return {
+        ...context,
+        changed: true,
+        miniProgramId: normalizedMiniProgramId,
+    };
+}
+function detectJsonIndent(raw) {
+    const match = raw.match(/\n(\s+)"[^"]+":/);
+    return match?.[1] ?? 2;
+}
+function isPlainObject(value) {
+    return Object.prototype.toString.call(value) === '[object Object]';
+}
+
+function trustedProfileUrl(raw) {
+    const url = new URL(raw);
+    const trusted = ['max-c.com', 'xiaoheihe.cn', 'heybox.com'];
+    if (url.protocol !== 'https:' ||
+        url.username ||
+        url.password ||
+        (url.port && url.port !== '443') ||
+        !trusted.some((host) => url.hostname === host || url.hostname.endsWith(`.${host}`)))
+        throw new Error('线上资料图片 URL 不受信任');
+    return url;
+}
+async function downloadImage(raw, fetchImpl) {
+    const response = await fetchImpl(trustedProfileUrl(raw), { redirect: 'error', signal: AbortSignal.timeout(15_000) });
+    if (!response.ok || !response.body)
+        throw new Error('下载线上资料图片失败');
+    if (Number(response.headers.get('content-length')) > runtimePermissionEnv.BASIC_INFO_MAX_BYTES)
+        throw new Error('图片超过 10 MiB');
+    const chunks = [];
+    let size = 0;
+    const reader = response.body.getReader();
+    try {
+        for (;;) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            size += part.value.length;
+            if (size > runtimePermissionEnv.BASIC_INFO_MAX_BYTES)
+                throw new Error('图片超过 10 MiB');
+            chunks.push(part.value);
+        }
+    }
+    finally {
+        await reader.cancel();
+    }
+    return Buffer.concat(chunks);
+}
+/** package-last 提交：失败只清理本次新增素材，原配置始终保留。 */
+async function migrateBasicInfo(cwd, detail, miniProgramId, fetchImpl = fetch, force = false) {
+    const context = await readMiniProgramProjectPackage(cwd);
+    const heybox = context.packageJson.heybox ?? {};
+    const existing = heybox.miniProgramId;
+    if (existing && existing !== miniProgramId && !force)
+        throw new Error('当前项目已绑定其他小程序，请使用 --force');
+    const fields = ['name', 'icon', 'coverImages'];
+    const present = fields.filter((key) => Object.prototype.hasOwnProperty.call(heybox, key));
+    if (present.length && present.length !== 3)
+        throw new Error(`资料配置不完整，请补齐 ${fields.filter((key) => !present.includes(key)).join('、')}`);
+    const created = [];
+    const temp = `${context.packageJsonPath}.${node_crypto.randomUUID()}.tmp`;
+    try {
+        let profile = present.length ? runtimePermissionEnv.parseMiniappBasicInfo(heybox) : undefined;
+        if (profile) {
+            await readBasicInfoSource(context.projectRoot, profile.icon, 'icon');
+            for (const cover of profile.coverImages)
+                await readBasicInfoSource(context.projectRoot, cover, 'cover');
+            if (existing === miniProgramId)
+                return { changed: false, miniProgramId };
+        }
+        else {
+            if (detail.mini_program_id !== miniProgramId)
+                throw new Error('远端小程序身份不一致');
+            const snapshot = detail.published_basic_info;
+            if (!snapshot?.version ||
+                !snapshot.icon_url ||
+                !Array.isArray(snapshot.cover_image_urls) ||
+                snapshot.cover_image_urls.length < 1 ||
+                snapshot.cover_image_urls.length > 5)
+                throw new Error('没有当前正式发布快照，请手工配置 heybox.name/icon/coverImages');
+            profile = { name: runtimePermissionEnv.normalizeBasicInfoName(snapshot.name), icon: '', coverImages: [] };
+            const entries = [
+                { url: snapshot.icon_url, kind: 'icon', label: 'icon' },
+                ...snapshot.cover_image_urls.map((url, i) => ({ url, kind: 'cover', label: `cover-${String(i + 1).padStart(2, '0')}` })),
+            ];
+            for (const entry of entries) {
+                const bytes = await downloadImage(entry.url, fetchImpl);
+                const image = await inspectRemoteBasicInfoImage(bytes, entry.kind);
+                const relative = `assets/heybox/${entry.label}.${image.sha256.slice(0, 12)}.${image.extension}`;
+                const target = path.join(context.projectRoot, relative);
+                await ensureBasicInfoDirectory(context.projectRoot, 'assets/heybox');
+                try {
+                    await fs.writeFile(target, bytes, { flag: 'wx' });
+                    created.push(target);
+                }
+                catch (error) {
+                    if (error.code !== 'EEXIST' ||
+                        !(await readBasicInfoSource(context.projectRoot, relative, entry.kind).then((existing) => existing.bytes.equals(bytes), () => false)))
+                        throw new Error('迁移素材名称冲突，未覆盖已有文件');
+                }
+                if (entry.kind === 'icon')
+                    profile.icon = relative;
+                else
+                    profile.coverImages.push(relative);
+            }
+        }
+        // 避免覆盖用户在下载期间修改的配置。
+        if ((await fs.readFile(context.packageJsonPath, 'utf8')) !== context.raw)
+            throw new Error('package.json 已变化，请重试迁移');
+        context.packageJson.heybox = { ...heybox, miniProgramId, ...profile };
+        await fs.writeFile(temp, JSON.stringify(context.packageJson, null, context.indent) + context.trailingNewline, { flag: 'wx' });
+        await fs.rename(temp, context.packageJsonPath);
+        return { changed: true, miniProgramId };
+    }
+    catch (error) {
+        // 若用户同时修改了 package，保留可能已被引用的素材供重试复用。
+        if ((await fs.readFile(context.packageJsonPath, 'utf8').catch(() => '')) === context.raw) {
+            await Promise.all(created.map((file) => fs.unlink(file).catch(() => { })));
+        }
+        throw error;
+    }
+    finally {
+        await fs.unlink(temp).catch(() => { });
+    }
+}
+async function compareBasicInfo(cwd, detail, fetchImpl = fetch) {
+    const context = await readMiniProgramProjectPackage(cwd);
+    const published = detail.published_basic_info;
+    let local;
+    try {
+        local = runtimePermissionEnv.parseMiniappBasicInfo(context.packageJson.heybox ?? {});
+    }
+    catch {
+        return { status: 'unavailable' };
+    }
+    if (!local || !published?.version)
+        return { status: 'unavailable', local, published };
+    try {
+        const pairs = [
+            { local: local.icon, remote: published.icon_url, kind: 'icon' },
+            ...local.coverImages.map((p, i) => ({ local: p, remote: published.cover_image_urls[i], kind: 'cover' })),
+        ];
+        let changed = local.name !== runtimePermissionEnv.normalizeBasicInfoName(published.name) || local.coverImages.length !== published.cover_image_urls.length;
+        for (const pair of pairs) {
+            if (!pair.remote) {
+                changed = true;
+                continue;
+            }
+            const source = await readBasicInfoSource(context.projectRoot, pair.local, pair.kind);
+            const bytes = await downloadImage(pair.remote, fetchImpl);
+            const remote = await inspectRemoteBasicInfoImage(bytes, pair.kind);
+            changed ||= source.sha256 !== remote.sha256;
+        }
+        return { status: changed ? 'changed' : 'unchanged', local, published };
+    }
+    catch {
+        return { status: 'unavailable', local, published };
+    }
+}
 
 function shouldSkipMiniappPlatformCsp(runtimePermissions) {
     const parsed = runtimePermissionEnv.parseMiniProgramRuntimePermissions(runtimePermissions);
@@ -149,11 +466,9 @@ async function precheckUserMiniprogramVersion(options, runtime) {
     return remotePostForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
 }
 async function submitUserMiniprogramAudit(options, runtime) {
-    const form = { ...options };
-    if (form.manifest && typeof form.manifest !== 'string') {
-        form.manifest = JSON.stringify(form.manifest);
-    }
-    return remotePostForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, form, runtime);
+    return remotePostForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, {
+        mini_program_id: options.mini_program_id, session_id: options.session_id, preflight_token: options.preflight_token,
+    }, runtime);
 }
 async function getVersionPreviewInfo(options, runtime) {
     return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, {
@@ -240,102 +555,6 @@ function createFormBody(fields) {
     return body.toString();
 }
 
-class MiniProgramProjectBindingError extends Error {
-    code;
-    constructor(message, code) {
-        super(message);
-        this.code = code;
-        this.name = 'MiniProgramProjectBindingError';
-    }
-}
-function findMiniProgramProjectRoot(startDir) {
-    let current = path.resolve(startDir);
-    while (true) {
-        if (fs$1.existsSync(path.join(current, 'package.json'))) {
-            return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-            throw new MiniProgramProjectBindingError('当前目录或父目录未找到 package.json', 'PACKAGE_JSON_NOT_FOUND');
-        }
-        current = parent;
-    }
-}
-async function readMiniProgramProjectPackage(startDir) {
-    const projectRoot = findMiniProgramProjectRoot(startDir);
-    const packageJsonPath = path.join(projectRoot, 'package.json');
-    const raw = await fs.readFile(packageJsonPath, 'utf8');
-    let packageJson;
-    try {
-        packageJson = JSON.parse(raw);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        throw new MiniProgramProjectBindingError(`package.json 不是合法 JSON：${packageJsonPath}\n${message}`, 'PACKAGE_JSON_INVALID');
-    }
-    return {
-        projectRoot,
-        packageJsonPath,
-        packageJson,
-        raw,
-        indent: detectJsonIndent(raw),
-        trailingNewline: raw.endsWith('\r\n') ? '\r\n' : raw.endsWith('\n') ? '\n' : '',
-    };
-}
-function readBoundMiniProgramIdFromPackageJson(packageJson) {
-    const value = packageJson.heybox?.miniProgramId;
-    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
-}
-async function readBoundMiniProgramId(startDir) {
-    return readBoundMiniProgramIdFromPackageJson((await readMiniProgramProjectPackage(startDir)).packageJson);
-}
-async function requireBoundMiniProgramId(startDir) {
-    const context = await readMiniProgramProjectPackage(startDir);
-    const miniProgramId = readBoundMiniProgramIdFromPackageJson(context.packageJson);
-    if (!miniProgramId) {
-        throw new MiniProgramProjectBindingError(`当前项目未绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。\n配置位置：${context.packageJsonPath}#heybox.miniProgramId`, 'MINI_PROGRAM_UNBOUND');
-    }
-    return { ...context, miniProgramId };
-}
-async function writeBoundMiniProgramId(startDir, miniProgramId, options = {}) {
-    const context = await readMiniProgramProjectPackage(startDir);
-    const normalizedMiniProgramId = String(miniProgramId).trim();
-    if (!normalizedMiniProgramId) {
-        throw new MiniProgramProjectBindingError('miniProgramId 不能为空', 'PACKAGE_JSON_INVALID');
-    }
-    const currentMiniProgramId = readBoundMiniProgramIdFromPackageJson(context.packageJson);
-    if (currentMiniProgramId && currentMiniProgramId !== normalizedMiniProgramId && !options.force) {
-        throw new MiniProgramProjectBindingError(`当前项目已绑定小程序 ${currentMiniProgramId}。如需覆盖本地绑定，请使用 --force。`, 'MINI_PROGRAM_BINDING_EXISTS');
-    }
-    if (currentMiniProgramId === normalizedMiniProgramId) {
-        return {
-            ...context,
-            changed: false,
-            miniProgramId: normalizedMiniProgramId,
-        };
-    }
-    if (context.packageJson.heybox !== undefined && !isPlainObject(context.packageJson.heybox)) {
-        throw new MiniProgramProjectBindingError('package.json heybox 字段必须是对象，不能写入 miniProgramId', 'PACKAGE_JSON_HEYBOX_INVALID');
-    }
-    context.packageJson.heybox = {
-        ...(context.packageJson.heybox ?? {}),
-        miniProgramId: normalizedMiniProgramId,
-    };
-    await fs.writeFile(context.packageJsonPath, `${JSON.stringify(context.packageJson, null, context.indent)}${context.trailingNewline || '\n'}`, 'utf8');
-    return {
-        ...context,
-        changed: true,
-        miniProgramId: normalizedMiniProgramId,
-    };
-}
-function detectJsonIndent(raw) {
-    const match = raw.match(/\n(\s+)"[^"]+":/);
-    return match?.[1] ?? 2;
-}
-function isPlainObject(value) {
-    return Object.prototype.toString.call(value) === '[object Object]';
-}
-
 async function resolveRemoteEnvironment(options = {}, runtime = {}) {
     const env = options.env ?? process.env;
     const apiBaseUrl = session.resolveHeyboxApiBaseUrl({ ...options, env });
@@ -393,12 +612,15 @@ function isTruthyEnvFlag(value) {
 }
 
 exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
+exports.compareBasicInfo = compareBasicInfo;
 exports.createBrowserDevPermissionState = createBrowserDevPermissionState;
 exports.createBrowserDevRuntimePermissions = createBrowserDevRuntimePermissions;
 exports.createLocalDevLaunchToken = createLocalDevLaunchToken;
 exports.createMobileDevSessionRuntimePermissions = createMobileDevSessionRuntimePermissions;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
 exports.getBoundMiniProgram = getBoundMiniProgram;
+exports.migrateBasicInfo = migrateBasicInfo;
+exports.readBasicInfoSource = readBasicInfoSource;
 exports.readBoundMiniProgramId = readBoundMiniProgramId;
 exports.readBoundMiniProgramIdFromPackageJson = readBoundMiniProgramIdFromPackageJson;
 exports.readMiniProgramProjectPackage = readMiniProgramProjectPackage;

package/dist/cli-chunks/{create-BWC2343y.cjs → create-BxIgQ4SF.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CDtcZVWv.cjs');
+var index = require('./index-CP14FXez.cjs');
 require('node:module');
 require('os');
 require('node:crypto');
@@ -1336,6 +1336,10 @@ async function renderTemplateDirectory(sourceDir, targetDir, data) {
         if (!entry.isFile()) {
             continue;
         }
+        if (!entry.name.endsWith('.ejs')) {
+            await fs.copyFile(sourcePath, targetPath);
+            continue;
+        }
         const content = await fs.readFile(sourcePath, 'utf8');
         const rendered = ejsExports.render(content, data, {
             filename: sourcePath,