@heybox/hb-sdk 0.8.2-alpha.2 → 0.8.2-alpha.6

package/dist/cli-chunks/{remote-ibQybNiM.cjs → remote-BLdGzViG.cjs}

@@ -1,17 +1,20 @@
 'use strict';
 
+var runtimePermissionEnv = require('./runtime-permission-env-CAhESVDA.cjs');
+var context = require('./context-Bk0adtVQ.cjs');
 var promises = require('node:readline/promises');
-var index = require('./index-CDtcZVWv.cjs');
-var session = require('./session-CIoBspg-.cjs');
+var index = require('./index-CP14FXez.cjs');
+var session = require('./session-COr9TQ6O.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DiTeD75Q.cjs');
 var node_crypto = require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
-var context = require('./context-DpKqGnjp.cjs');
+var runtimeGate = require('./runtime-gate-B_fHNic6.cjs');
+require('./version-tRrcrp9F.cjs');
+require('node:async_hooks');
+require('sharp');
 require('node:module');
 require('path');
 require('os');
@@ -24,8 +27,9 @@ require('buffer');
 require('util');
 require('fs');
 require('constants');
-require('./version-QiVEs76a.cjs');
-require('node:async_hooks');
+
+// 脚手架开发占位图；构建可用，提审前必须替换。
+const BASIC_INFO_PLACEHOLDER_SHA256 = 'd14e54b30f5e6d1bcbf51267bc82b06a0af7c333f2945bcc16b4e1adc3b123dd';
 
 async function getCDNUploadInfo(options, runtime = {}) {
     const body = new URLSearchParams();
@@ -66,29 +70,24 @@ const CREATE_USER_MINIPROGRAM_UPLOAD_SESSION_API_PATH = '/mall/developer/user_mi
 const RECORD_USER_MINIPROGRAM_UPLOAD_RESULT_API_PATH = '/mall/developer/user_miniprogram/version/upload_session/record';
 async function precheckUserMiniprogramVersion(options, runtime = {}) {
     return postUserMiniprogramVersionForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
-        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
+        // 构建前轻预检不携带独立资料；权威准入读取构建 Manifest。
         ...(options.version ? { version: options.version } : {}),
-        ...(options.source_version ? { source_version: options.source_version } : {}),
         ...(options.manifest ? { manifest: JSON.stringify(options.manifest) } : {}),
         release_note: options.releaseNote,
         auto_publish: String(options.autoPublish),
     }, runtime);
 }
 async function submitUserMiniprogramAudit(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
-        // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
-        ...(options.manifest ? { manifest: JSON.stringify(options.manifest) } : {}),
-        ...(options.source_version ? { source_version: options.source_version } : {}),
-        ...(options.sessionId ? { session_id: options.sessionId } : {}),
-        release_note: options.releaseNote,
-        auto_publish: String(options.autoPublish),
-    }, runtime);
+    return postUserMiniprogramVersionForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, { session_id: options.sessionId, preflight_token: options.preflightToken }, runtime);
 }
 async function createUserMiniprogramUploadSession(options, runtime = {}) {
     return postUserMiniprogramVersionForm(CREATE_USER_MINIPROGRAM_UPLOAD_SESSION_API_PATH, options, {
         version: options.version,
         artifact_signature: options.artifactSignature,
         files: JSON.stringify(options.files),
+        manifest: JSON.stringify(options.manifest),
+        release_note: options.releaseNote,
+        auto_publish: String(options.autoPublish),
     }, runtime);
 }
 async function recordUserMiniprogramUploadResult(options, runtime = {}) {
@@ -275,7 +274,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-D3FMcOZq.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-CjWRMwuI.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -515,32 +514,29 @@ async function runDeployCommand(options, runtime = {}) {
     if (typeof miniProgramId !== 'string' || !miniProgramId.trim()) {
         throw new Error('未在 package.json 中找到 heybox.miniProgramId，请先配置 mini program id');
     }
-    const fromVersion = options.fromVersion?.trim();
-    const declaredPlatforms = fromVersion ? undefined : runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
-    const declaredWindow = fromVersion ? undefined : runtimePermissionEnv.readMiniappWindowFromPackageJson(projectRoot);
-    const declaredBindAppIds = fromVersion ? undefined : runtimePermissionEnv.readMiniappBindAppIdsFromPackageJson(projectRoot);
+    const declaredPlatforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
+    const declaredWindow = runtimePermissionEnv.readMiniappWindowFromPackageJson(projectRoot);
+    const declaredBindAppIds = runtimePermissionEnv.readMiniappBindAppIdsFromPackageJson(projectRoot);
     const releaseNote = await resolveDeployReleaseNote(options, runtime);
     const session$1 = await logger.task('正在校验 Heybox 登录态', () => (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }), { successText: 'Heybox 登录态有效' });
     logger.debug(`Heybox API: ${apiBaseUrl}`);
-    const uploadVersion = fromVersion ? '' : validateVersionForDeploy(packageJson.version, 'package.json.version');
+    const uploadVersion = validateVersionForDeploy(packageJson.version, 'package.json.version');
     const deploy = async () => {
         let precheckVersion;
-        const historyArtifact = fromVersion ? { source_version: fromVersion } : {};
-        if (fromVersion) {
-            const precheck = await runVersionPrecheck({
-                session: session$1,
-                miniProgramId,
-                ...historyArtifact,
-                releaseNote,
-                autoPublish,
-            }, runtime, apiBaseUrl, projectRoot, logger);
-            const sourceSdkVersion = typeof precheck.sdk_version === 'string' ? precheck.sdk_version.trim() : '';
-            if (!sourceSdkVersion) {
-                throw new Error('历史产物缺少 sdkVersion，无法复用，请重新构建并上传新版本');
+        {
+            const configuredProfile = runtimePermissionEnv.parseMiniappBasicInfo(packageJson.heybox ?? {}, '0.8.1');
+            if (!configuredProfile) {
+                const bound = await (runtime.getBoundMiniProgram ?? context.getBoundMiniProgram)({
+                    allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl,
+                    apiBaseUrl,
+                    cwd: projectRoot,
+                    env,
+                    fetchImpl: runtime.fetchImpl,
+                    loginBaseUrl,
+                    session: session$1,
+                });
+                await context.migrateBasicInfo(projectRoot, bound.detail, miniProgramId, runtime.fetchImpl);
             }
-            precheckVersion = precheck.version || precheck.version_normalized || fromVersion;
-        }
-        else {
             const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
             if (typeof packageJson.scripts?.build !== 'string') {
                 throw new Error('package.json scripts.build 未定义，请添加 build 脚本');
@@ -589,7 +585,8 @@ async function runDeployCommand(options, runtime = {}) {
         let version = precheckVersion;
         let manifest;
         let uploadSessionId = '';
-        if (!fromVersion) {
+        let preflightToken = '';
+        {
             const distDir = path.join(projectRoot, 'dist');
             const parsedManifest = await readDeployManifest(projectRoot, logger);
             ({ manifest, version } = parsedManifest);
@@ -634,28 +631,54 @@ async function runDeployCommand(options, runtime = {}) {
             // deploy 期间 dist 视为稳定构建输出；为避免持有大量文件描述符，签名和上传不会共享打开的文件句柄。
             const artifactReceipt = await logger.task('正在计算构建产物签名', () => (runtime.computeMiniappArtifactReceipt ?? computeMiniappArtifactReceipt)(uploadFiles), { successText: '构建产物签名计算完成' });
             runtimePermissionEnv.validateMiniappCompanionFileReceipts(manifest?.companions, artifactReceipt.files);
+            const profile = runtimePermissionEnv.parseMiniappBasicInfo(manifest, String(manifest.sdkVersion));
+            if (profile) {
+                const localProfile = runtimePermissionEnv.parseMiniappBasicInfo((await readPackageJson(projectRoot)).heybox ?? {});
+                if (localProfile.name !== profile.name || localProfile.coverImages.length !== profile.coverImages.length)
+                    throw new Error('构建资料与 package.json 声明不一致，请重新构建');
+                const sources = [localProfile.icon, ...localProfile.coverImages];
+                const refs = [{ path: profile.icon, kind: 'icon' }, ...profile.coverImages.map((path) => ({ path, kind: 'cover' }))];
+                for (const [index, ref] of refs.entries()) {
+                    const image = await context.readBasicInfoSource(distDir, ref.path, ref.kind);
+                    const source = await context.readBasicInfoSource(projectRoot, sources[index], ref.kind);
+                    if (source.sha256 !== image.sha256)
+                        throw new Error('构建图片与项目声明不一致，请重新构建');
+                    if (image.sha256 === BASIC_INFO_PLACEHOLDER_SHA256)
+                        throw new Error('请替换脚手架占位图片后再提交审核');
+                    const receipt = artifactReceipt.files.find((file) => file.relativePath === ref.path);
+                    if (!receipt || receipt.sha256 !== image.sha256 || receipt.size !== image.bytes.length)
+                        throw new Error('资料图片与产物 receipt 不一致');
+                }
+            }
             const createdUploadSession = await logger.task('正在创建或恢复上传会话', async () => {
                 const result = await (runtime.createUserMiniprogramUploadSession ?? createUserMiniprogramUploadSession)({
                     session: session$1,
                     miniProgramId,
                     version,
+                    manifest,
+                    releaseNote,
+                    autoPublish,
                     artifactSignature: artifactReceipt.artifactSignature,
                     files: artifactReceipt.files.map((file) => ({ path: file.relativePath, size: file.size, sha256: file.sha256 })),
                 }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl });
                 if (typeof result.session_id !== 'string' || !result.session_id.trim()) {
                     throw new Error('创建上传会话失败：服务端未返回 session_id');
                 }
+                if (!result.preflight_token)
+                    throw new Error('服务端未返回 preflight_token，请先升级服务端');
                 if (result.file_receipt_version !== 1) {
                     throw new Error('创建上传会话失败：服务端不支持文件完整性 receipt v1，请升级服务端后重试');
                 }
                 const resolved = runtimePermissionEnv.resolveMiniappUploadSessionFiles(artifactReceipt.files, Array.isArray(result.files) ? result.files : [], Array.isArray(result.uploaded_keys) ? result.uploaded_keys : []);
                 return {
+                    preflightToken: result.preflight_token,
                     sessionId: result.session_id.trim(),
                     files: resolved.files,
                     missingFiles: resolved.missingFiles,
                 };
             }, { successText: '上传会话已就绪' });
             uploadSessionId = createdUploadSession.sessionId;
+            preflightToken = createdUploadSession.preflightToken;
             const uploadedCount = createdUploadSession.files.length - createdUploadSession.missingFiles.length;
             if (uploadedCount > 0) {
                 logger.debug(`复用已上传文件: ${uploadedCount}/${createdUploadSession.files.length}`);
@@ -683,15 +706,14 @@ async function runDeployCommand(options, runtime = {}) {
             }
         }
         try {
-            const submitOptions = fromVersion
-                ? { session: session$1, miniProgramId, ...historyArtifact, releaseNote, autoPublish }
-                : { session: session$1, miniProgramId, manifest, sessionId: uploadSessionId, releaseNote, autoPublish };
+            const submitOptions = { session: session$1, miniProgramId, sessionId: uploadSessionId, preflightToken };
             submitAuditResult = await logger.task('正在提交审核', () => (runtime.submitUserMiniprogramAudit ?? submitUserMiniprogramAudit)(submitOptions, {
                 baseUrl: apiBaseUrl,
                 fetchImpl: runtime.fetchImpl,
             }), { successText: '审核提交完成' });
         }
         catch (error) {
+            logger.warn('提交未完成；已上传文件会保留，再次部署相同产物时只补传缺失文件。');
             throw translateHeyboxDeployError(error, { projectRoot, stage: 'submitAudit', version });
         }
         printDeploySuccess({
@@ -710,10 +732,6 @@ async function runDeployCommand(options, runtime = {}) {
             version,
         };
     };
-    if (fromVersion) {
-        logger.info('平台声明：未分类（复用历史产物）');
-        return deploy();
-    }
     return (runtime.withDeployLock ?? withDeployLock)({ apiBaseUrl, miniProgramId, version: uploadVersion }, deploy);
 }
 function printDeploySuccess(options) {
@@ -826,14 +844,14 @@ async function maybePromptReleaseNote(runtime) {
 }
 async function runVersionPrecheck(options, runtime, apiBaseUrl, projectRoot, logger) {
     try {
-        const label = options.version ?? options.source_version ?? '';
+        const label = options.version ?? '';
         return await logger.task(`正在预检版本 ${label}`, () => (runtime.precheckUserMiniprogramVersion ?? precheckUserMiniprogramVersion)(options, {
             baseUrl: apiBaseUrl,
             fetchImpl: runtime.fetchImpl,
         }), { successText: `版本 ${label} 预检通过` });
     }
     catch (error) {
-        throw translateHeyboxDeployError(error, { projectRoot, stage: 'precheck', version: options.version ?? options.source_version ?? '' });
+        throw translateHeyboxDeployError(error, { projectRoot, stage: 'precheck', version: options.version ?? '' });
     }
 }
 function detectPackageManager(projectRoot) {
@@ -1077,7 +1095,6 @@ async function runRemoteDeployCommand(options, runtime) {
         apiBaseUrl: options.apiBaseUrl,
         autoPublish: options.autoPublish,
         env: options.env,
-        fromVersion: options.fromVersion,
         loginBaseUrl: options.loginBaseUrl,
         releaseNote: options.releaseNote,
         buildOutputMode: options.json ? 'stderr' : 'inherit',
@@ -1256,6 +1273,7 @@ async function remoteCreate(options, context$1, runtime) {
         throw new Error(`当前 CLI 用户没有创建工坊小程序权限：${String(access.status ?? 'unknown')}`);
     }
     await confirmCreateWithCurrentEntity(options, context$1, runtime);
+    runtimePermissionEnv.parseMiniappBasicInfo(context$1.packageJson.packageJson.heybox ?? {});
     const result = await context$1.api.createMiniProgram();
     const miniProgramId = requireMiniProgramId(result);
     await context.writeBoundMiniProgramId(context$1.packageJson.projectRoot, miniProgramId, { force: options.forceBind });
@@ -1272,23 +1290,22 @@ async function remoteBind(options, context$1, runtime) {
     }
     const detail = await context$1.api.getMiniProgramDetail(miniProgramId);
     const verifiedId = requireMiniProgramId(detail);
+    if (verifiedId !== miniProgramId)
+        throw new Error('远端返回的小程序 ID 与绑定目标不一致');
     await assertMiniProgramEntityMatchesCurrent(context$1, detail);
-    const changed = context$1.binding !== verifiedId;
-    if (changed) {
-        await context.writeBoundMiniProgramId(context$1.packageJson.projectRoot, verifiedId, { force: options.force });
-    }
+    const { changed } = await context.migrateBasicInfo(context$1.packageJson.projectRoot, detail, verifiedId, runtime.fetchImpl, options.force);
     const output = { changed, miniProgramId: verifiedId, remote: toCamelCaseDeep(detail) };
     if (!options.json) {
         context$1.logger.success(changed ? `绑定成功：${verifiedId}` : `已绑定：${verifiedId}`);
     }
     return finishRemoteCommand(options, runtime, output);
 }
-async function remoteInfo(options, context, runtime) {
-    const miniProgramId = requireBinding(context);
-    const detail = await context.api.getMiniProgramDetail(miniProgramId);
-    const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(context.packageJson.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
+async function remoteInfo(options, context$1, runtime) {
+    const miniProgramId = requireBinding(context$1);
+    const detail = await context$1.api.getMiniProgramDetail(miniProgramId);
+    const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(context$1.packageJson.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
     const permissionViews = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions).views;
-    const localBindAppIds = runtimePermissionEnv.readMiniappBindAppIdsFromPackageJson(context.packageJson.projectRoot);
+    const localBindAppIds = runtimePermissionEnv.readMiniappBindAppIdsFromPackageJson(context$1.packageJson.projectRoot);
     const currentBindApps = normalizeRemoteBoundApps(detail.bind_apps);
     const currentByID = new Map(currentBindApps.map((item) => [item.appid, item]));
     const local = localBindAppIds.map((appid) => currentByID.get(appid) ?? { appid });
@@ -1297,9 +1314,12 @@ async function remoteInfo(options, context, runtime) {
     const localIDs = new Set(localBindAppIds);
     const removed = currentBindApps.filter((item) => !localIDs.has(item.appid));
     const bindings = { local, current: currentBindApps, added, removed };
-    const output = { changed: false, miniProgramId, detail: toCamelCaseDeep(detail), permissions: permissionViews, bindings };
+    const basicInfo = await context.compareBasicInfo(context$1.packageJson.projectRoot, detail, runtime.fetchImpl);
+    const output = { changed: false, miniProgramId, detail: toCamelCaseDeep(detail), permissions: permissionViews, bindings, basicInfo };
+    if (!options.json)
+        context$1.logger.info(`版本资料：${basicInfo.status}`);
     if (!options.json) {
-        printMiniProgramDetail(context.logger, detail, permissionViews, bindings);
+        printMiniProgramDetail(context$1.logger, detail, permissionViews, bindings);
     }
     return finishRemoteCommand(options, runtime, output);
 }

package/dist/cli-chunks/runtime-gate-B_fHNic6.cjs

@@ -0,0 +1,58 @@
+'use strict';
+
+var runtimePermissionEnv = require('./runtime-permission-env-CAhESVDA.cjs');
+
+// Shorthands
+/**
+ * Parses an HTML string.
+ *
+ * @param html Input HTML string.
+ * @param options Parsing options.
+ * @returns Document
+ *
+ * @example
+ *
+ * ```js
+ * const parse5 = require('parse5');
+ *
+ * const document = parse5.parse('<!DOCTYPE html><html><head></head><body>Hi there!</body></html>');
+ *
+ * console.log(document.childNodes[1].tagName); //> 'html'
+ *```
+ */
+function parse(html, options) {
+    return runtimePermissionEnv.Parser.parse(html, options);
+}
+
+const RUNTIME_GATE_MARKER = 'data-heybox-runtime-gate';
+const RUNTIME_GATE_STYLE_MARKER = 'data-heybox-runtime-gate-style';
+const RUNTIME_GATE_BOOTSTRAP_MARKER = 'data-heybox-runtime-gate-bootstrap';
+function hasMiniappRuntimeGate(html) {
+    const document = parse(html);
+    let hasGate = false;
+    let hasGateStyle = false;
+    let hasGateBootstrap = false;
+    walk(document, (element) => {
+        hasGate ||= hasAttr(element, RUNTIME_GATE_MARKER);
+        hasGateStyle ||= hasAttr(element, RUNTIME_GATE_STYLE_MARKER);
+        hasGateBootstrap ||= hasAttr(element, RUNTIME_GATE_BOOTSTRAP_MARKER);
+    });
+    return hasGate && hasGateStyle && hasGateBootstrap;
+}
+function readAttr(element, name) {
+    return element.attrs.find((attr) => attr.name.toLowerCase() === name)?.value;
+}
+function hasAttr(element, name) {
+    return readAttr(element, name) !== undefined;
+}
+function walk(node, visit) {
+    if ('tagName' in node)
+        visit(node);
+    if ('childNodes' in node)
+        for (const child of node.childNodes)
+            walk(child, visit);
+    if ('content' in node && node.content)
+        walk(node.content, visit);
+}
+
+exports.hasMiniappRuntimeGate = hasMiniappRuntimeGate;