@heybox/hb-sdk 0.8.2-alpha.2 → 0.8.2-alpha.6

package/dist/vite.esm.js

@@ -1,333 +1,12 @@
-import { readFileSync, existsSync, realpathSync, lstatSync, readdirSync, readlinkSync, mkdirSync, writeFileSync, renameSync, rmSync, unwatchFile, createReadStream, watchFile, mkdtempSync, chmodSync } from 'node:fs';
-import { randomUUID, randomBytes, createHash, timingSafeEqual } from 'node:crypto';
-import { tmpdir, platform, arch } from 'node:os';
+import { createHash, randomUUID, randomBytes, timingSafeEqual } from 'node:crypto';
+import { constants as constants$1, readFileSync, existsSync, realpathSync, lstatSync, readdirSync, readlinkSync, mkdirSync, writeFileSync, renameSync, rmSync, unwatchFile, createReadStream, watchFile, mkdtempSync, chmodSync } from 'node:fs';
+import { readFile, mkdir, realpath, writeFile, stat, open } from 'node:fs/promises';
 import path from 'node:path';
+import sharp from 'sharp';
+import { tmpdir, platform, arch } from 'node:os';
 import { inflateRawSync } from 'node:zlib';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-/** 构建时替换为当前发布包的实际版本。 */
-const HB_SDK_VERSION = typeof undefined === 'string'
-    ? undefined
-    : '0.8.2-alpha.2';
-
-/**
- * iframe 与调试台页面的开发期 console 捕获转发。
- *
- * 双条件门控（iframe 转发）：
- * 1. 构建期：`hb-sdk dev`（vite serve）注入 `false`；`hb-sdk build` /
- *    `vite build`（生产）永不注入或替换为 `false`，本模块被死代码消除。
- * 2. 运行期：仅在 `window.name` 为 `__hb_sdk_mini_dev__` 的调试 iframe 中激活，
- *    用户设备上的正式运行环境没有该标记。
- *
- * 无侵入 patch `console.log/debug/info/warn/error`：原样放行（DevTools 不受影响）+
- * 通过 `window.parent.postMessage` 转发给调试台（CSP 的 connect-src 不约束 postMessage，
- * 网络上报由调试台页面代理）。发送全程静默：失败不得回打 console，避免自触发死循环。
- *
- * 激活时机：由 SDK 默认单例初始化时调用（业务 `import '@heybox/hb-sdk'` 即生效）；
- * iframe 标记由调试台 `iframe.name` 与 vite dev 注入的无依赖 bootstrap 共同设置。
- * 调试台页面自身（runtime 跑在这里，`[hb-sdk-runtime]` 日志不经过 iframe）另用
- * `installMiniDevConsoleSelfCapture` 接入「日志」页签（source: 'host'）。
- */
-const MINI_DEV_CONSOLE_EVENT_TYPE = 'hb-sdk:mini-dev-console';
-/** 调试台页面与 iframe bootstrap 共用的已安装标记（window/console 上的属性名）。 */
-const MINI_DEV_CONSOLE_INSTALL_FLAG = '__hb_sdk_mini_dev_console_installed__';
-
-/**
- * network.request 诊断日志的纯脱敏工具。
- *
- * @remarks
- * 放在 `core` 而非 `modules/network`：无错误类型依赖，供 SDK 错误文案、
- * modules observability、devtools Browser Dev Host / proxy 共用，并满足 boundary
- *（devtools 不得直接 import runtime capability modules）。
- */
-/** 敏感字段名：header / query / body key 共用。 */
-const SENSITIVE_KEY_PATTERN = /(authorization|cookie|password|passwd|secret|token|pkey|private[_-]?key|access[_-]?key|client[_-]?secret|api[_-]?key|apikey|session|jwt|refresh[_-]?token|csrf)/i;
-/**
- * 脱敏请求 URL：去掉 userinfo，并将 query / fragment 中的敏感参数值替换为 `[redacted]`。
- */
-function sanitizeNetworkRequestUrl(url) {
-    if (!url) {
-        return url;
-    }
-    try {
-        const parsed = new URL(url);
-        parsed.username = '';
-        parsed.password = '';
-        redactUrlSearchParams(parsed.searchParams);
-        if (parsed.hash && parsed.hash.length > 1) {
-            const hashBody = parsed.hash.slice(1);
-            if (hashBody.includes('=')) {
-                const hashParams = new URLSearchParams(hashBody);
-                if (redactUrlSearchParams(hashParams)) {
-                    parsed.hash = hashParams.toString();
-                }
-            }
-        }
-        return parsed.toString();
-    }
-    catch {
-        return redactSensitivePairsInRawText(url);
-    }
-}
-/**
- * 诊断 message 中的 URL 片段做脱敏，避免 error.message 二次泄漏 query secrets。
- */
-function sanitizeDiagnosticMessage(message) {
-    if (!message) {
-        return message;
-    }
-    return message.replace(/https?:\/\/[^\s]+/gi, matched => sanitizeNetworkRequestUrl(matched.replace(/[),.;]+$/g, '')));
-}
-function isSensitiveNetworkKey(key) {
-    return SENSITIVE_KEY_PATTERN.test(key.trim());
-}
-function redactUrlSearchParams(params) {
-    let changed = false;
-    for (const key of [...params.keys()]) {
-        if (isSensitiveNetworkKey(key)) {
-            params.set(key, '[redacted]');
-            changed = true;
-        }
-    }
-    return changed;
-}
-function redactSensitivePairsInRawText(text) {
-    return text.replace(/([?&#]|^|[?&])([^=&#\s]+)=([^&#\s]*)/g, (full, prefix, key, value) => {
-        if (!isSensitiveNetworkKey(key)) {
-            return full;
-        }
-        return `${prefix}${key}=[redacted]`;
-    });
-}
-
-const DEVICE_LOG_PATH = '/__hb_sdk__/device-logs';
-const registryKey = Symbol.for('@heybox/hb-sdk/device-logs');
-const registry = globalThis;
-const stores = (registry[registryKey] ??= new Map());
-function registerDeviceLogs(port, store) {
-    stores.set(port, store);
-    return () => {
-        if (stores.get(port) === store)
-            stores.delete(port);
-    };
-}
-class DeviceLogStore {
-    sandboxRequests = new Map();
-    listSandbox(id, path) {
-        const device = this.devices.get(id);
-        if (!device || Date.now() - device.lastSeen > 15000)
-            return Promise.resolve({ error: '设备已离线' });
-        if (path !== '.' && (!path || path.length > 1024 || /[\\\\\u0000-\u001f]/.test(path) || path.split('/').some(part => !part || part === '.' || part === '..')))
-            return Promise.resolve({ error: '无效目录路径' });
-        if (this.sandboxRequests.size >= 64)
-            return Promise.resolve({ error: '查询繁忙，请稍后重试' });
-        const requestId = randomUUID();
-        return new Promise(resolve => {
-            const timer = setTimeout(() => { this.sandboxRequests.delete(requestId); resolve({ error: '设备查询超时' }); }, 10000);
-            this.sandboxRequests.set(requestId, { id, path, requestId, resolve: value => { clearTimeout(timer); this.sandboxRequests.delete(requestId); resolve(value); } });
-        });
-    }
-    uploadToken = randomBytes(32).toString('hex');
-    epoch = randomUUID();
-    expiresAt = Date.now() + 12 * 60 * 60 * 1000;
-    cursor = 0;
-    logs = [];
-    devices = new Map();
-    query(params) {
-        const after = Math.max(0, Number(params.get('after')) || 0);
-        const limit = Math.min(500, Math.max(1, Number(params.get('limit')) || 100));
-        const selected = this.logs.filter((log) => log.cursor > after &&
-            (!params.get('device') || log.deviceSessionId === params.get('device')) &&
-            (!params.get('level') || log.level === params.get('level')) &&
-            (!params.get('source') || log.source === params.get('source')) &&
-            (!params.get('callId') || log.callId === params.get('callId')) &&
-            (!params.get('id') || String(log.cursor) === params.get('id')) &&
-            (!params.get('since') || log.timestamp >= Number(params.get('since'))) &&
-            (!params.get('query') || log.message.toLowerCase().includes(params.get('query').toLowerCase())));
-        const items = selected.slice(0, limit);
-        return {
-            schemaVersion: 1,
-            epoch: this.epoch,
-            items,
-            nextCursor: selected.length > limit ? items.at(-1).cursor : this.cursor,
-            hasMore: selected.length > limit,
-            gap: after > 0 && after < (this.logs[0]?.cursor ?? 1) - 1,
-            devices: [...this.devices.values()].map(({ id, name, platform, connectedAt, lastSeen }) => ({
-                id,
-                name,
-                platform,
-                connectedAt,
-                lastSeen,
-                online: Date.now() - lastSeen < 15000,
-            })),
-        };
-    }
-    async upload(req, res) {
-        const reply = (status, value) => {
-            res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-            res.end(JSON.stringify(value));
-        };
-        if (req.method !== 'POST') {
-            reply(405, {});
-            return;
-        }
-        if (Date.now() > this.expiresAt) {
-            reply(410, { code: 'EXPIRED' });
-            return;
-        }
-        let text = '';
-        try {
-            req.setEncoding('utf8');
-            for await (const chunk of req) {
-                text += chunk;
-                if (Buffer.byteLength(text) > 65536) {
-                    reply(413, {});
-                    return;
-                }
-            }
-            const body = JSON.parse(text);
-            if (body.register === true) {
-                if (req.headers['x-hb-log-token'] !== this.uploadToken) {
-                    reply(403, {});
-                    return;
-                }
-                const registrationId = typeof body.registrationId === 'string' && /^[a-f0-9]{32}$/.test(body.registrationId) ? body.registrationId : undefined;
-                const existing = registrationId && [...this.devices.values()].find(device => device.registrationId === registrationId);
-                if (existing) {
-                    reply(200, { id: existing.id, token: existing.token });
-                    return;
-                }
-                if (this.devices.size >= 64) {
-                    reply(429, {});
-                    return;
-                }
-                const id = randomUUID();
-                const platform = ['iOS', 'Android', 'Windows', 'macOS', 'Browser'].includes(body.platform) ? body.platform : 'Browser';
-                const device = {
-                    id,
-                    platform,
-                    registrationId,
-                    connectedAt: Date.now(),
-                    name: `${platform} · ${this.devices.size + 1}`,
-                    lastSeen: Date.now(),
-                    sequence: 0,
-                    token: randomBytes(32).toString('hex'),
-                    windowStart: Date.now(),
-                    count: 0,
-                };
-                this.devices.set(id, device);
-                reply(200, { id, token: device.token });
-                return;
-            }
-            const device = this.devices.get(body.id);
-            if (!device || req.headers['x-hb-log-token'] !== device.token) {
-                reply(403, {});
-                return;
-            }
-            if (!Array.isArray(body.logs) || body.logs.length > 50) {
-                reply(400, {});
-                return;
-            }
-            if (Date.now() - device.windowStart > 1000) {
-                device.windowStart = Date.now();
-                device.count = 0;
-            }
-            if (device.count + body.logs.length > 200) {
-                reply(429, {});
-                return;
-            }
-            device.count += body.logs.length;
-            device.lastSeen = Date.now();
-            if (body.sandboxResult && typeof body.sandboxResult === 'object') {
-                const result = body.sandboxResult;
-                const pending = this.sandboxRequests.get(result.requestId);
-                if (pending?.id === device.id) {
-                    const entries = Array.isArray(result.entries) ? result.entries.slice(0, 200).filter((entry) => entry && ['file', 'directory'].includes(entry.kind) && typeof entry.name === 'string' && entry.name.length <= 255 && !/[\\\\/\u0000-\u001f]/.test(entry.name) && !['.', '..'].includes(entry.name)).map((entry) => ({ name: entry.name, kind: entry.kind })) : [];
-                    pending.resolve({ deviceSessionId: device.id, requestId: pending.requestId, path: pending.path, timestamp: Date.now(), entries, error: result.error ? '设备不支持或无权读取此目录' : undefined, truncated: result.truncated === true });
-                }
-            }
-            for (const log of body.logs) {
-                if (!log || typeof log !== 'object')
-                    continue;
-                if (!Number.isSafeInteger(log.sequence) ||
-                    log.sequence <= device.sequence ||
-                    !Number.isFinite(log.timestamp) ||
-                    !['log', 'debug', 'info', 'warn', 'error'].includes(log.level) ||
-                    typeof log.message !== 'string')
-                    continue;
-                device.sequence = log.sequence;
-                this.logs.push({
-                    cursor: ++this.cursor,
-                    deviceSessionId: device.id,
-                    sequence: log.sequence,
-                    timestamp: log.timestamp,
-                    receivedAt: Date.now(),
-                    level: log.level,
-                    source: log.source === 'sdk' ? 'sdk' : 'app',
-                    message: sanitizeDiagnosticMessage(log.message)
-                        .replace(/(authorization|cookie|password|secret|token|pkey|api[_-]?key)(["'\s:=]+)([^\s,}]+)/gi, '$1$2[redacted]')
-                        .slice(0, 8192),
-                    truncated: log.truncated === true || log.message.length > 8192,
-                    ...(typeof log.method === 'string' ? { method: log.method.slice(0, 100) } : {}),
-                    ...(typeof log.callId === 'string' ? { callId: log.callId.slice(0, 100) } : {}),
-                    ...(typeof log.errorCode === 'string' && /^[A-Z0-9_]{1,100}$/.test(log.errorCode) ? { errorCode: log.errorCode } : {}),
-                    ...(log.outcome === 'success' || log.outcome === 'error' ? { outcome: log.outcome } : {}),
-                    ...(Number.isFinite(log.durationMs) ? { durationMs: Math.max(0, log.durationMs) } : {}),
-                });
-            }
-            if (this.logs.length > 5000)
-                this.logs.splice(0, this.logs.length - 5000);
-            reply(200, { sequence: device.sequence, sandboxRequest: [...this.sandboxRequests.values()].find(request => request.id === device.id) ? (() => { const request = [...this.sandboxRequests.values()].find(request => request.id === device.id); return { requestId: request.requestId, path: request.path }; })() : undefined });
-        }
-        catch {
-            reply(400, { code: 'INVALID_LOG_BATCH' });
-        }
-    }
-}
-/** 同源开发页面使用有界批量回传；传输失败不会递归写入 console。 */
-function deviceLogBootstrap(token) {
-    return `<script>(function(){if(window.__hb_sdk_device_logs_installed__)return;
-window.__hb_sdk_device_logs_installed__=true;
-window.__hb_sdk_mini_dev_console_installed__=true;
-var endpoint='${DEVICE_LOG_PATH}',credential='${token}',id='',queue=[],seq=0,busy=false,dropped=0;
-var registrationId=Array.from(crypto.getRandomValues(new Uint8Array(16)),function(n){return n.toString(16).padStart(2,'0')}).join('');
-var send=window.fetch.bind(window);
-var sandboxResult;
-function format(v){try{return typeof v==='string'?v:v instanceof Error?v.stack||v.message:JSON.stringify(v,function(k,value){return /authorization|cookie|password|secret|token|pkey|api.?key/i.test(k)?'[redacted]':value})}catch(e){return '[无法序列化]'}}function add(level,args,source){if(queue.length>=500){queue.shift();
-dropped++}var message=args.map(format).join(' ');
-message=message.replace(/https?:\\/\\/[^\\s]+/g,function(raw){try{var url=new URL(raw);
-url.username='';
-url.password='';
-url.search='';
-url.hash='';
-return url.href}catch(e){return '[URL]'}});
-message=message.replace(/(authorization|cookie|password|secret|token|pkey|api[_-]?key)([\\"'\\s:=]+)([^\\s,}]+)/gi,'$1$2[redacted]');
-queue.push({truncated:message.length>8192,sequence:++seq,timestamp:Date.now(),level:level,source:source||'app',message:message.slice(0,8192)})}window.__hbSdkDeviceLog=function(event){add(event.outcome==='error'?'error':'info',[event.method+' · '+event.outcome+' · '+event.durationMs+' ms'],'sdk');
-Object.assign(queue[queue.length-1],event)};
-['log','debug','info','warn','error'].forEach(function(level){var original=console[level];
-console[level]=function(){add(level,Array.prototype.slice.call(arguments));
-return original.apply(this,arguments)}});
-window.addEventListener('error',function(e){add('error',[e.message])});
-window.addEventListener('unhandledrejection',function(e){add('error',[e.reason])});
-async function flush(){if(busy)return;
-busy=true;
-try{if(!id){var ua=navigator.userAgent;
-var platform=window.name==='__hb_sdk_mini_dev__'?'Browser':/Android/i.test(ua)?'Android':/iPhone|iPad/i.test(ua)?'iOS':/Windows/i.test(ua)?'Windows':/Mac/i.test(ua)?'macOS':'Browser';
-var r=await send(endpoint,{method:'POST',headers:{'content-type':'application/json','x-hb-log-token':credential},body:JSON.stringify({register:true,platform:platform,registrationId:registrationId}),signal:AbortSignal.timeout(5000)});
-if(!r.ok)return;
-var d=await r.json();
-id=d.id;
-credential=d.token}if(dropped){add('warn',['日志缓冲已丢弃 '+dropped+' 条']);
-dropped=0}var batch=queue.slice(0,50);
-while(batch.length>1&&new TextEncoder().encode(JSON.stringify(batch)).length>48000)batch.pop();
-var result=await send(endpoint,{method:'POST',headers:{'content-type':'application/json','x-hb-log-token':credential},body:JSON.stringify({id:id,logs:batch,sandboxResult:sandboxResult}),signal:AbortSignal.timeout(5000)});
-if(result.ok){var ack=await result.json();sandboxResult=undefined;
-if(ack.sandboxRequest){try{var entries=await window.__hbSdkSandboxList(ack.sandboxRequest.path);sandboxResult={requestId:ack.sandboxRequest.requestId,entries:entries.slice(0,200),truncated:entries.length>200}}catch(e){sandboxResult={requestId:ack.sandboxRequest.requestId,error:true}}}
-queue=queue.filter(function(l){return l.sequence>ack.sequence})}}catch(e){}finally{busy=false}}setInterval(flush,1000);
-flush()})();
-</script>`;
-}
-
 var re = {exports: {}};
 
 var constants;
@@ -3111,7 +2790,480 @@ function requireSemver () {
 	return semver;
 }
 
-var semverExports = requireSemver();
+var semverExports = requireSemver();
+
+const BASIC_INFO_MAX_BYTES = 10 * 1024 * 1024;
+const BASIC_INFO_MAX_PIXELS = 40_000_000;
+/** 按 NFKC 和 Unicode 空白规范化名称，并校验 1–40 个字符及禁用字符。 */
+function normalizeBasicInfoName(raw) {
+    if (typeof raw !== 'string')
+        throw new Error('heybox.name 必须是字符串');
+    // 与 Go TrimSpace 一致（JS trim 额外移除 BOM，故使用 Unicode White_Space）。
+    const name = raw.normalize('NFKC').replace(/^\p{White_Space}+|\p{White_Space}+$/gu, '');
+    if (Array.from(name).length < 1 || Array.from(name).length > 40 || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}<>&"']/u.test(name) || !/[\p{L}\p{N}]/u.test(name)) {
+        throw new Error('名称须包含 1–40 个字符及文字或数字，不能包含控制字符或 HTML 特殊字符');
+    }
+    return name;
+}
+function validateBasicInfoPath(raw) {
+    if (typeof raw !== 'string' || !raw || /[\\:%?#\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(raw))
+        throw new Error('资料图片必须是项目内的规范相对路径');
+    const forbidden = new Set(['', '.', '..', '.git', 'node_modules', 'dist', '.hb-sdk', '.vite', '.cache', '.tmp', 'tmp']);
+    if (raw.split('/').some((part) => forbidden.has(part)))
+        throw new Error('资料图片路径包含禁止的目录');
+    if (!/\.(png|jpe?g|gif|webp)$/i.test(raw))
+        throw new Error('资料图片仅支持 JPEG、PNG、GIF、WebP');
+    return raw;
+}
+/** 解析项目或构建资料；仅早于 0.8.2 且三项全部缺失时返回 undefined。 */
+function parseMiniappBasicInfo(value, sdkVersion = '0.8.2') {
+    sdkVersion = sdkVersion.trim();
+    if (!semverExports.valid(sdkVersion) || sdkVersion.startsWith('v') || sdkVersion.includes('+'))
+        throw new Error('manifest.sdkVersion 必须是合法 SemVer');
+    const fields = ['name', 'icon', 'coverImages'];
+    const present = fields.filter((key) => Object.prototype.hasOwnProperty.call(value, key));
+    if (!present.length && semverExports.lt(sdkVersion, '0.8.2'))
+        return undefined;
+    if (present.length !== fields.length)
+        throw new Error('请配置 heybox.name、heybox.icon、heybox.coverImages，或运行 remote bind/dev/remote deploy 迁移已发布资料');
+    const name = normalizeBasicInfoName(value.name);
+    const icon = validateBasicInfoPath(value.icon);
+    if (!Array.isArray(value.coverImages) || value.coverImages.length < 1 || value.coverImages.length > 5)
+        throw new Error('coverImages 必须包含 1–5 张图片');
+    const coverImages = value.coverImages.map(validateBasicInfoPath);
+    if (new Set(coverImages).size !== coverImages.length)
+        throw new Error('封面路径不能重复');
+    return { name, icon, coverImages };
+}
+
+async function inspectBasicInfoImage(bytes, sourcePath, kind) {
+    const inspected = await inspectDecodedBasicInfoImage(bytes, kind);
+    const extensions = { jpg: ['jpg', 'jpeg'], png: ['png'], gif: ['gif'], webp: ['webp'] };
+    const ext = sourcePath.split('.').pop().toLowerCase();
+    if (!extensions[inspected.extension]?.includes(ext))
+        throw new Error('资料图片格式与扩展名不一致');
+    return inspected;
+}
+async function inspectDecodedBasicInfoImage(bytes, kind) {
+    if (!bytes.length || bytes.length > BASIC_INFO_MAX_BYTES)
+        throw new Error('资料图片不得为空或超过 10 MiB');
+    const decoder = sharp(bytes, { limitInputPixels: BASIC_INFO_MAX_PIXELS, failOn: 'warning' });
+    const metadata = await decoder.metadata();
+    const extensions = { jpeg: 'jpg', png: 'png', gif: 'gif', webp: 'webp' };
+    if (!metadata.format || !extensions[metadata.format])
+        throw new Error('资料图片格式不支持');
+    const width = metadata.width ?? 0;
+    const height = metadata.pageHeight ?? metadata.height ?? 0;
+    if (!width || !height || width * height > BASIC_INFO_MAX_PIXELS)
+        throw new Error('资料图片不得超过 4000 万像素');
+    if (kind === 'icon' && (width !== 200 || height !== 200))
+        throw new Error('icon 必须是 200×200');
+    // 强制解码而非只信任图片头；不将解码结果写回图片。
+    await decoder.stats();
+    return { sha256: createHash('sha256').update(bytes).digest('hex'), extension: extensions[metadata.format] };
+}
+async function readBasicInfoSource(projectRoot, relative, kind) {
+    validateBasicInfoPath(relative);
+    const root = await realpath(projectRoot);
+    const target = await realpath(path.join(root, relative));
+    const resolvedRelative = path.relative(root, target).split(path.sep).join('/');
+    validateBasicInfoPath(resolvedRelative);
+    if (resolvedRelative.startsWith('../') || path.isAbsolute(resolvedRelative))
+        throw new Error('资料图片不能逃逸项目目录');
+    const info = await stat(target);
+    if (!info.isFile() || info.size > BASIC_INFO_MAX_BYTES)
+        throw new Error('资料图片必须为不超过 10 MiB 的普通文件');
+    const file = await open(target, constants$1.O_RDONLY | constants$1.O_NOFOLLOW);
+    try {
+        const actual = await file.stat();
+        if (!actual.isFile() || actual.size > BASIC_INFO_MAX_BYTES)
+            throw new Error('资料图片文件已变化');
+        const bytes = await file.readFile();
+        return { bytes, ...(await inspectBasicInfoImage(bytes, relative, kind)) };
+    }
+    finally {
+        await file.close();
+    }
+}
+async function prepareMiniappBasicInfo(projectRoot, outputRoot, sdkVersion) {
+    const pkg = JSON.parse(await readFile(path.join(projectRoot, 'package.json'), 'utf8'));
+    const profile = parseMiniappBasicInfo(pkg.heybox ?? {}, sdkVersion);
+    if (!profile)
+        return undefined;
+    await mkdir(outputRoot, { recursive: true });
+    const output = { ...profile, coverImages: [] };
+    const entries = [
+        { path: profile.icon, kind: 'icon', label: 'icon' },
+        ...profile.coverImages.map((p, i) => ({ path: p, kind: 'cover', label: `cover-${String(i + 1).padStart(2, '0')}` })),
+    ];
+    for (const entry of entries) {
+        const sourceReal = await realpath(path.join(projectRoot, entry.path));
+        const outputReal = await realpath(outputRoot);
+        const fromOutput = path.relative(outputReal, sourceReal);
+        if (!fromOutput.startsWith('..') && !path.isAbsolute(fromOutput))
+            throw new Error('资料源文件不能位于构建输出目录');
+        const image = await readBasicInfoSource(projectRoot, entry.path, entry.kind);
+        const relative = `_hb/basic-info/${entry.label}.${image.sha256.slice(0, 12)}.${image.extension}`;
+        const target = path.join(outputRoot, relative);
+        await mkdir(outputRoot, { recursive: true });
+        await ensureBasicInfoDirectory(outputRoot, '_hb/basic-info');
+        // 全字节比较保证截断哈希冲突和 public 保留路径冲突不会静默覆盖。
+        try {
+            await writeFile(target, image.bytes, { flag: 'wx' });
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST' ||
+                !(await readBasicInfoSource(outputRoot, relative, entry.kind).then((existing) => existing.bytes.equals(image.bytes), () => false)))
+                throw new Error('构建资料保留目录冲突，请移除未知文件');
+        }
+        if (entry.kind === 'icon')
+            output.icon = relative;
+        else
+            output.coverImages.push(relative);
+    }
+    return output;
+}
+/** 逐级校验真实目录，避免保留目录或迁移目录中的符号链接将写入带到项目外。 */
+async function ensureBasicInfoDirectory(rootPath, relative) {
+    const root = await realpath(rootPath);
+    let current = root;
+    for (const part of relative.split('/')) {
+        if (!part || part === '.' || part === '..')
+            throw new Error('资料目录不合法');
+        current = path.join(current, part);
+        await mkdir(current).catch((error) => {
+            if (error.code !== 'EEXIST')
+                throw error;
+        });
+        const resolved = await realpath(current);
+        const within = path.relative(root, resolved);
+        if (within.startsWith('..') || path.isAbsolute(within))
+            throw new Error('资料目录不能逃逸项目');
+    }
+}
+
+/** 构建时替换为当前发布包的实际版本。 */
+const HB_SDK_VERSION = typeof undefined === 'string'
+    ? undefined
+    : '0.8.2-alpha.6';
+
+/**
+ * iframe 与调试台页面的开发期 console 捕获转发。
+ *
+ * 双条件门控（iframe 转发）：
+ * 1. 构建期：`hb-sdk dev`（vite serve）注入 `false`；`hb-sdk build` /
+ *    `vite build`（生产）永不注入或替换为 `false`，本模块被死代码消除。
+ * 2. 运行期：仅在 `window.name` 为 `__hb_sdk_mini_dev__` 的调试 iframe 中激活，
+ *    用户设备上的正式运行环境没有该标记。
+ *
+ * 无侵入 patch `console.log/debug/info/warn/error`：原样放行（DevTools 不受影响）+
+ * 通过 `window.parent.postMessage` 转发给调试台（CSP 的 connect-src 不约束 postMessage，
+ * 网络上报由调试台页面代理）。发送全程静默：失败不得回打 console，避免自触发死循环。
+ *
+ * 激活时机：由 SDK 默认单例初始化时调用（业务 `import '@heybox/hb-sdk'` 即生效）；
+ * iframe 标记由调试台 `iframe.name` 与 vite dev 注入的无依赖 bootstrap 共同设置。
+ * 调试台页面自身（runtime 跑在这里，`[hb-sdk-runtime]` 日志不经过 iframe）另用
+ * `installMiniDevConsoleSelfCapture` 接入「日志」页签（source: 'host'）。
+ */
+const MINI_DEV_CONSOLE_EVENT_TYPE = 'hb-sdk:mini-dev-console';
+/** 调试台页面与 iframe bootstrap 共用的已安装标记（window/console 上的属性名）。 */
+const MINI_DEV_CONSOLE_INSTALL_FLAG = '__hb_sdk_mini_dev_console_installed__';
+
+/**
+ * network.request 诊断日志的纯脱敏工具。
+ *
+ * @remarks
+ * 放在 `core` 而非 `modules/network`：无错误类型依赖，供 SDK 错误文案、
+ * modules observability、devtools Browser Dev Host / proxy 共用，并满足 boundary
+ *（devtools 不得直接 import runtime capability modules）。
+ */
+/** 敏感字段名：header / query / body key 共用。 */
+const SENSITIVE_KEY_PATTERN = /(authorization|cookie|password|passwd|secret|token|pkey|private[_-]?key|access[_-]?key|client[_-]?secret|api[_-]?key|apikey|session|jwt|refresh[_-]?token|csrf)/i;
+/**
+ * 脱敏请求 URL：去掉 userinfo，并将 query / fragment 中的敏感参数值替换为 `[redacted]`。
+ */
+function sanitizeNetworkRequestUrl(url) {
+    if (!url) {
+        return url;
+    }
+    try {
+        const parsed = new URL(url);
+        parsed.username = '';
+        parsed.password = '';
+        redactUrlSearchParams(parsed.searchParams);
+        if (parsed.hash && parsed.hash.length > 1) {
+            const hashBody = parsed.hash.slice(1);
+            if (hashBody.includes('=')) {
+                const hashParams = new URLSearchParams(hashBody);
+                if (redactUrlSearchParams(hashParams)) {
+                    parsed.hash = hashParams.toString();
+                }
+            }
+        }
+        return parsed.toString();
+    }
+    catch {
+        return redactSensitivePairsInRawText(url);
+    }
+}
+/**
+ * 诊断 message 中的 URL 片段做脱敏，避免 error.message 二次泄漏 query secrets。
+ */
+function sanitizeDiagnosticMessage(message) {
+    if (!message) {
+        return message;
+    }
+    return message.replace(/https?:\/\/[^\s]+/gi, matched => sanitizeNetworkRequestUrl(matched.replace(/[),.;]+$/g, '')));
+}
+function isSensitiveNetworkKey(key) {
+    return SENSITIVE_KEY_PATTERN.test(key.trim());
+}
+function redactUrlSearchParams(params) {
+    let changed = false;
+    for (const key of [...params.keys()]) {
+        if (isSensitiveNetworkKey(key)) {
+            params.set(key, '[redacted]');
+            changed = true;
+        }
+    }
+    return changed;
+}
+function redactSensitivePairsInRawText(text) {
+    return text.replace(/([?&#]|^|[?&])([^=&#\s]+)=([^&#\s]*)/g, (full, prefix, key, value) => {
+        if (!isSensitiveNetworkKey(key)) {
+            return full;
+        }
+        return `${prefix}${key}=[redacted]`;
+    });
+}
+
+const DEVICE_LOG_PATH = '/__hb_sdk__/device-logs';
+const registryKey = Symbol.for('@heybox/hb-sdk/device-logs');
+const registry = globalThis;
+const stores = (registry[registryKey] ??= new Map());
+function registerDeviceLogs(port, store) {
+    stores.set(port, store);
+    return () => {
+        if (stores.get(port) === store)
+            stores.delete(port);
+    };
+}
+class DeviceLogStore {
+    sandboxRequests = new Map();
+    listSandbox(id, path) {
+        const device = this.devices.get(id);
+        if (!device || Date.now() - device.lastSeen > 15000)
+            return Promise.resolve({ error: '设备已离线' });
+        if (path !== '.' && (!path || path.length > 1024 || /[\\\\\u0000-\u001f]/.test(path) || path.split('/').some(part => !part || part === '.' || part === '..')))
+            return Promise.resolve({ error: '无效目录路径' });
+        if (this.sandboxRequests.size >= 64)
+            return Promise.resolve({ error: '查询繁忙，请稍后重试' });
+        const requestId = randomUUID();
+        return new Promise(resolve => {
+            const timer = setTimeout(() => { this.sandboxRequests.delete(requestId); resolve({ error: '设备查询超时' }); }, 10000);
+            this.sandboxRequests.set(requestId, { id, path, requestId, resolve: value => { clearTimeout(timer); this.sandboxRequests.delete(requestId); resolve(value); } });
+        });
+    }
+    uploadToken = randomBytes(32).toString('hex');
+    epoch = randomUUID();
+    expiresAt = Date.now() + 12 * 60 * 60 * 1000;
+    cursor = 0;
+    logs = [];
+    devices = new Map();
+    query(params) {
+        const after = Math.max(0, Number(params.get('after')) || 0);
+        const limit = Math.min(500, Math.max(1, Number(params.get('limit')) || 100));
+        const selected = this.logs.filter((log) => log.cursor > after &&
+            (!params.get('device') || log.deviceSessionId === params.get('device')) &&
+            (!params.get('level') || log.level === params.get('level')) &&
+            (!params.get('source') || log.source === params.get('source')) &&
+            (!params.get('callId') || log.callId === params.get('callId')) &&
+            (!params.get('id') || String(log.cursor) === params.get('id')) &&
+            (!params.get('since') || log.timestamp >= Number(params.get('since'))) &&
+            (!params.get('query') || log.message.toLowerCase().includes(params.get('query').toLowerCase())));
+        const items = selected.slice(0, limit);
+        return {
+            schemaVersion: 1,
+            epoch: this.epoch,
+            items,
+            nextCursor: selected.length > limit ? items.at(-1).cursor : this.cursor,
+            hasMore: selected.length > limit,
+            gap: after > 0 && after < (this.logs[0]?.cursor ?? 1) - 1,
+            devices: [...this.devices.values()].map(({ id, name, platform, connectedAt, lastSeen }) => ({
+                id,
+                name,
+                platform,
+                connectedAt,
+                lastSeen,
+                online: Date.now() - lastSeen < 15000,
+            })),
+        };
+    }
+    async upload(req, res) {
+        const reply = (status, value) => {
+            res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+            res.end(JSON.stringify(value));
+        };
+        if (req.method !== 'POST') {
+            reply(405, {});
+            return;
+        }
+        if (Date.now() > this.expiresAt) {
+            reply(410, { code: 'EXPIRED' });
+            return;
+        }
+        let text = '';
+        try {
+            req.setEncoding('utf8');
+            for await (const chunk of req) {
+                text += chunk;
+                if (Buffer.byteLength(text) > 65536) {
+                    reply(413, {});
+                    return;
+                }
+            }
+            const body = JSON.parse(text);
+            if (body.register === true) {
+                if (req.headers['x-hb-log-token'] !== this.uploadToken) {
+                    reply(403, {});
+                    return;
+                }
+                const registrationId = typeof body.registrationId === 'string' && /^[a-f0-9]{32}$/.test(body.registrationId) ? body.registrationId : undefined;
+                const existing = registrationId && [...this.devices.values()].find(device => device.registrationId === registrationId);
+                if (existing) {
+                    reply(200, { id: existing.id, token: existing.token });
+                    return;
+                }
+                if (this.devices.size >= 64) {
+                    reply(429, {});
+                    return;
+                }
+                const id = randomUUID();
+                const platform = ['iOS', 'Android', 'Windows', 'macOS', 'Browser'].includes(body.platform) ? body.platform : 'Browser';
+                const device = {
+                    id,
+                    platform,
+                    registrationId,
+                    connectedAt: Date.now(),
+                    name: `${platform} · ${this.devices.size + 1}`,
+                    lastSeen: Date.now(),
+                    sequence: 0,
+                    token: randomBytes(32).toString('hex'),
+                    windowStart: Date.now(),
+                    count: 0,
+                };
+                this.devices.set(id, device);
+                reply(200, { id, token: device.token });
+                return;
+            }
+            const device = this.devices.get(body.id);
+            if (!device || req.headers['x-hb-log-token'] !== device.token) {
+                reply(403, {});
+                return;
+            }
+            if (!Array.isArray(body.logs) || body.logs.length > 50) {
+                reply(400, {});
+                return;
+            }
+            if (Date.now() - device.windowStart > 1000) {
+                device.windowStart = Date.now();
+                device.count = 0;
+            }
+            if (device.count + body.logs.length > 200) {
+                reply(429, {});
+                return;
+            }
+            device.count += body.logs.length;
+            device.lastSeen = Date.now();
+            if (body.sandboxResult && typeof body.sandboxResult === 'object') {
+                const result = body.sandboxResult;
+                const pending = this.sandboxRequests.get(result.requestId);
+                if (pending?.id === device.id) {
+                    const entries = Array.isArray(result.entries) ? result.entries.slice(0, 200).filter((entry) => entry && ['file', 'directory'].includes(entry.kind) && typeof entry.name === 'string' && entry.name.length <= 255 && !/[\\\\/\u0000-\u001f]/.test(entry.name) && !['.', '..'].includes(entry.name)).map((entry) => ({ name: entry.name, kind: entry.kind })) : [];
+                    pending.resolve({ deviceSessionId: device.id, requestId: pending.requestId, path: pending.path, timestamp: Date.now(), entries, error: result.error ? '设备不支持或无权读取此目录' : undefined, truncated: result.truncated === true });
+                }
+            }
+            for (const log of body.logs) {
+                if (!log || typeof log !== 'object')
+                    continue;
+                if (!Number.isSafeInteger(log.sequence) ||
+                    log.sequence <= device.sequence ||
+                    !Number.isFinite(log.timestamp) ||
+                    !['log', 'debug', 'info', 'warn', 'error'].includes(log.level) ||
+                    typeof log.message !== 'string')
+                    continue;
+                device.sequence = log.sequence;
+                this.logs.push({
+                    cursor: ++this.cursor,
+                    deviceSessionId: device.id,
+                    sequence: log.sequence,
+                    timestamp: log.timestamp,
+                    receivedAt: Date.now(),
+                    level: log.level,
+                    source: log.source === 'sdk' ? 'sdk' : 'app',
+                    message: sanitizeDiagnosticMessage(log.message)
+                        .replace(/(authorization|cookie|password|secret|token|pkey|api[_-]?key)(["'\s:=]+)([^\s,}]+)/gi, '$1$2[redacted]')
+                        .slice(0, 8192),
+                    truncated: log.truncated === true || log.message.length > 8192,
+                    ...(typeof log.method === 'string' ? { method: log.method.slice(0, 100) } : {}),
+                    ...(typeof log.callId === 'string' ? { callId: log.callId.slice(0, 100) } : {}),
+                    ...(typeof log.errorCode === 'string' && /^[A-Z0-9_]{1,100}$/.test(log.errorCode) ? { errorCode: log.errorCode } : {}),
+                    ...(log.outcome === 'success' || log.outcome === 'error' ? { outcome: log.outcome } : {}),
+                    ...(Number.isFinite(log.durationMs) ? { durationMs: Math.max(0, log.durationMs) } : {}),
+                });
+            }
+            if (this.logs.length > 5000)
+                this.logs.splice(0, this.logs.length - 5000);
+            reply(200, { sequence: device.sequence, sandboxRequest: [...this.sandboxRequests.values()].find(request => request.id === device.id) ? (() => { const request = [...this.sandboxRequests.values()].find(request => request.id === device.id); return { requestId: request.requestId, path: request.path }; })() : undefined });
+        }
+        catch {
+            reply(400, { code: 'INVALID_LOG_BATCH' });
+        }
+    }
+}
+/** 同源开发页面使用有界批量回传；传输失败不会递归写入 console。 */
+function deviceLogBootstrap(token) {
+    return `<script>(function(){if(window.__hb_sdk_device_logs_installed__)return;
+window.__hb_sdk_device_logs_installed__=true;
+window.__hb_sdk_mini_dev_console_installed__=true;
+var endpoint='${DEVICE_LOG_PATH}',credential='${token}',id='',queue=[],seq=0,busy=false,dropped=0;
+var registrationId=Array.from(crypto.getRandomValues(new Uint8Array(16)),function(n){return n.toString(16).padStart(2,'0')}).join('');
+var send=window.fetch.bind(window);
+var sandboxResult;
+function format(v){try{return typeof v==='string'?v:v instanceof Error?v.stack||v.message:JSON.stringify(v,function(k,value){return /authorization|cookie|password|secret|token|pkey|api.?key/i.test(k)?'[redacted]':value})}catch(e){return '[无法序列化]'}}function add(level,args,source){if(queue.length>=500){queue.shift();
+dropped++}var message=args.map(format).join(' ');
+message=message.replace(/https?:\\/\\/[^\\s]+/g,function(raw){try{var url=new URL(raw);
+url.username='';
+url.password='';
+url.search='';
+url.hash='';
+return url.href}catch(e){return '[URL]'}});
+message=message.replace(/(authorization|cookie|password|secret|token|pkey|api[_-]?key)([\\"'\\s:=]+)([^\\s,}]+)/gi,'$1$2[redacted]');
+queue.push({truncated:message.length>8192,sequence:++seq,timestamp:Date.now(),level:level,source:source||'app',message:message.slice(0,8192)})}window.__hbSdkDeviceLog=function(event){add(event.outcome==='error'?'error':'info',[event.method+' · '+event.outcome+' · '+event.durationMs+' ms'],'sdk');
+Object.assign(queue[queue.length-1],event)};
+['log','debug','info','warn','error'].forEach(function(level){var original=console[level];
+console[level]=function(){add(level,Array.prototype.slice.call(arguments));
+return original.apply(this,arguments)}});
+window.addEventListener('error',function(e){add('error',[e.message])});
+window.addEventListener('unhandledrejection',function(e){add('error',[e.reason])});
+async function flush(){if(busy)return;
+busy=true;
+try{if(!id){var ua=navigator.userAgent;
+var platform=window.name==='__hb_sdk_mini_dev__'?'Browser':/Android/i.test(ua)?'Android':/iPhone|iPad/i.test(ua)?'iOS':/Windows/i.test(ua)?'Windows':/Mac/i.test(ua)?'macOS':'Browser';
+var r=await send(endpoint,{method:'POST',headers:{'content-type':'application/json','x-hb-log-token':credential},body:JSON.stringify({register:true,platform:platform,registrationId:registrationId}),signal:AbortSignal.timeout(5000)});
+if(!r.ok)return;
+var d=await r.json();
+id=d.id;
+credential=d.token}if(dropped){add('warn',['日志缓冲已丢弃 '+dropped+' 条']);
+dropped=0}var batch=queue.slice(0,50);
+while(batch.length>1&&new TextEncoder().encode(JSON.stringify(batch)).length>48000)batch.pop();
+var result=await send(endpoint,{method:'POST',headers:{'content-type':'application/json','x-hb-log-token':credential},body:JSON.stringify({id:id,logs:batch,sandboxResult:sandboxResult}),signal:AbortSignal.timeout(5000)});
+if(result.ok){var ack=await result.json();sandboxResult=undefined;
+if(ack.sandboxRequest){try{var entries=await window.__hbSdkSandboxList(ack.sandboxRequest.path);sandboxResult={requestId:ack.sandboxRequest.requestId,entries:entries.slice(0,200),truncated:entries.length>200}}catch(e){sandboxResult={requestId:ack.sandboxRequest.requestId,error:true}}}
+queue=queue.filter(function(l){return l.sequence>ack.sequence})}}catch(e){}finally{busy=false}}setInterval(flush,1000);
+flush()})();
+</script>`;
+}
 
 /** 单个小程序版本最多声明的关联游戏数量。 */
 const MINIAPP_BIND_APP_IDS_MAX_COUNT = 20;
@@ -3454,6 +3606,7 @@ function renderMiniappManifest(manifest) {
     const output = {
         version: manifest.version,
         sdkVersion: manifest.sdkVersion,
+        ...(manifest.name === undefined ? {} : { name: manifest.name, icon: manifest.icon, coverImages: manifest.coverImages }),
         platforms,
         ...(manifest.permissions === undefined ? {} : { permissions: manifest.permissions }),
         ...(manifest.companions === undefined ? {} : { companions: manifest.companions }),
@@ -12819,29 +12972,29 @@ function renderRuntimeGateScript() {
 function removePlatformGateNodes(node) {
     if (!('childNodes' in node))
         return;
-    node.childNodes = node.childNodes.filter(child => !('tagName' in child) || !hasAttr(child, RUNTIME_GATE_MARKER));
+    node.childNodes = node.childNodes.filter((child) => !('tagName' in child) || !hasAttr(child, RUNTIME_GATE_MARKER));
     for (const child of node.childNodes)
         removePlatformGateNodes(child);
 }
 function readAttr(element, name) {
-    return element.attrs.find(attr => attr.name.toLowerCase() === name)?.value;
+    return element.attrs.find((attr) => attr.name.toLowerCase() === name)?.value;
 }
 function hasAttr(element, name) {
     return readAttr(element, name) !== undefined;
 }
 function setAttr(element, name, value) {
-    const attr = element.attrs.find(item => item.name.toLowerCase() === name);
+    const attr = element.attrs.find((item) => item.name.toLowerCase() === name);
     if (attr)
         attr.value = value;
     else
         element.attrs.push({ name, value });
 }
 function removeAttr(element, name) {
-    element.attrs = element.attrs.filter(attr => attr.name.toLowerCase() !== name);
+    element.attrs = element.attrs.filter((attr) => attr.name.toLowerCase() !== name);
 }
 function findElement$1(node, tagName) {
     let found;
-    walk$1(node, element => {
+    walk$1(node, (element) => {
         if (!found && element.tagName === tagName)
             found = element;
     });
@@ -12860,10 +13013,7 @@ function walk$1(node, visit) {
 const FORBIDDEN_RESOURCE_HINTS = new Set(['dns-prefetch', 'preconnect', 'prerender']);
 const RELATIVE_URL_BASE = new URL('https://heybox-relative.invalid/');
 const OFFICIAL_RESOURCE_ROOT_DOMAINS = ['xiaoheihe.cn', 'max-c.com', 'debugmode.cn', 'maxjia.com'];
-const OFFICIAL_RESOURCE_SOURCES = OFFICIAL_RESOURCE_ROOT_DOMAINS.flatMap(rootDomain => [
-    `https://${rootDomain}`,
-    `https://*.${rootDomain}`,
-]);
+const OFFICIAL_RESOURCE_SOURCES = OFFICIAL_RESOURCE_ROOT_DOMAINS.flatMap((rootDomain) => [`https://${rootDomain}`, `https://*.${rootDomain}`]);
 const URL_ATTRIBUTES = {
     audio: ['src'],
     embed: ['src'],
@@ -12900,14 +13050,12 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
         throw new Error('入口 index.html 必须包含 <head>');
     }
     removePlatformCspMarkers(document);
-    walk(document, element => validateElement(element));
+    walk(document, (element) => validateElement(element));
     injectMiniappRuntimeGate(document);
     if (options.skipPlatformCsp) {
         return serialize(document);
     }
-    const content = options.hmrWebSocketUrl
-        ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
-        : PRODUCTION_CSP;
+    const content = options.hmrWebSocketUrl ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`) : PRODUCTION_CSP;
     head.childNodes.unshift({
         nodeName: 'meta',
         tagName: 'meta',
@@ -12925,7 +13073,7 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
 }
 function validateElement(element) {
     const tagName = element.tagName.toLowerCase();
-    const attrs = new Map(element.attrs.map(attr => [attr.name.toLowerCase(), attr.value]));
+    const attrs = new Map(element.attrs.map((attr) => [attr.name.toLowerCase(), attr.value]));
     if (tagName === 'meta' && attrs.get('http-equiv')?.toLowerCase() === 'refresh') {
         throw new Error('index.html 不允许 meta refresh');
     }
@@ -12937,7 +13085,7 @@ function validateElement(element) {
     }
     if (tagName === 'link') {
         const rels = (attrs.get('rel') ?? '').toLowerCase().split(/\s+/).filter(Boolean);
-        const forbidden = rels.find(rel => FORBIDDEN_RESOURCE_HINTS.has(rel));
+        const forbidden = rels.find((rel) => FORBIDDEN_RESOURCE_HINTS.has(rel));
         if (forbidden) {
             throw new Error(`index.html 不允许 rel="${forbidden}"`);
         }
@@ -12954,7 +13102,10 @@ function validateElement(element) {
     for (const attribute of URL_ATTRIBUTES[tagName] ?? []) {
         const value = attrs.get(attribute);
         if (attribute === 'srcset') {
-            for (const candidate of (value ?? '').split(',').map(item => item.trim().split(/\s+/)[0]).filter(Boolean)) {
+            for (const candidate of (value ?? '')
+                .split(',')
+                .map((item) => item.trim().split(/\s+/)[0])
+                .filter(Boolean)) {
                 validateResourceUrl(candidate, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
             }
         }
@@ -12966,10 +13117,10 @@ function validateElement(element) {
 function removePlatformCspMarkers(node) {
     if (!('childNodes' in node))
         return;
-    node.childNodes = node.childNodes.filter(child => {
+    node.childNodes = node.childNodes.filter((child) => {
         if (!('tagName' in child))
             return true;
-        return !child.attrs.some(attr => attr.name.toLowerCase() === 'data-heybox-platform-csp');
+        return !child.attrs.some((attr) => attr.name.toLowerCase() === 'data-heybox-platform-csp');
     });
     for (const child of node.childNodes)
         removePlatformCspMarkers(child);
@@ -13005,7 +13156,7 @@ function isOfficialResourceUrl(value) {
         const hostname = url.hostname.toLowerCase();
         if (hostname.endsWith('.'))
             return false;
-        return OFFICIAL_RESOURCE_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+        return OFFICIAL_RESOURCE_ROOT_DOMAINS.some((rootDomain) => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
     }
     catch {
         return false;
@@ -13030,7 +13181,7 @@ function isRelativeUrl(value, normalized) {
 }
 function findElement(node, tagName) {
     let found;
-    walk(node, element => {
+    walk(node, (element) => {
         if (!found && element.tagName === tagName)
             found = element;
     });
@@ -13537,10 +13688,12 @@ function miniappManifest() {
                 throw new Error('构建产物必须包含入口 dist/index.html');
             }
             writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
+            const basicInfo = await prepareMiniappBasicInfo(companionConfig.projectRoot, outputRoot, sdkVersion);
             const manifestPath = path.join(outputRoot, 'manifest.json');
             const companions = prepareMiniappCompanions(companionDeclarations, { root: companionConfig.projectRoot, outputRoot, platforms });
             mkdirSync(path.dirname(manifestPath), { recursive: true });
             writeFileSync(manifestPath, renderMiniappManifest({
+                ...basicInfo,
                 version,
                 sdkVersion,
                 platforms,