@heybox/hb-sdk 0.9.0-alpha.2 → 0.9.0-alpha.3

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.0-alpha.3 - 2026-10-08
+
+### 行为调整
+
+- Companion ZIP 使用 artifact 协议 v2 复用已验证内容，并在服务端异步完成校验后再提交审核；中断部署可重新执行续接。
+
 ## 0.9.0-alpha.2 - 2026-10-07
 
 ### 问题修复

package/README.md

@@ -456,6 +456,11 @@ hb-sdk remote deploy --release-note "本次更新说明"
 | `hb-sdk build`            | 执行生产构建与产物校验，不包含类型检查 |
 | `hb-sdk remote deploy`    | 构建、上传并提交当前版本审核           |
 
+`remote deploy` 要求服务端支持产物协议 v2，不会降级为旧上传流程。同一小程序已有相同 Companion ZIP 时，
+CLI 会复用已验证产物、跳过该 ZIP 的网络上传；Web 文件及发生变化的 ZIP 仍按当前版本上传。
+新 ZIP 使用会话专属凭证直传到以 SHA-256 命名的候选对象，强制禁止覆盖。服务端一次读取完成哈希和 ZIP 安全校验后直接引用，不再复制对象。CLI 轮询持久化 Finalize 状态并在全部 Companion ready 后提交审核；中断后重新执行 deploy 可续接，校验失败则使用新会话重传。
+每次部署仍会重新构建并计算本地产物摘要，审核与发布仍属于本次版本。
+
 `hb-sdk create` 默认生成可直接删除的 Vanilla JavaScript + Vite HelloWorld，只保留 SDK Toast 示例、三端 Manifest 和开发/构建/部署命令，不绑定业务框架或项目内测试工具。
 
 `hb-sdk dev` 会启动 Vue 3 Browser Dev Host。左侧诊断面板集中展示结构化日志、当前小程序作用域内的 Storage 快照和问题；日志区分 App、SDK、Network、Runtime、Host 来源，支持毫秒级时间、结果、耗时、重复计数、脱敏详情展开以及来源/级别筛选。右侧设备预览可在 iPhone 16 Pro Max（`440 x 956`）与 Pixel 9 Pro（`410 x 914`）间切换。切换预设只改变设备外框和 viewport，不会重新加载 iframe 或重启 Runtime；授权与操作弹窗、Toast、Loading 和振动反馈都限制在预览框内。

package/dist/cli-chunks/{build-CvxoPTJb.cjs → build-C4d4WXYT.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-w3sXIJU4.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
 require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-C1gdlVUB.cjs');
-var index = require('./index-QY5q1rWs.cjs');
-var projectVite = require('./project-vite-BA81QqiJ.cjs');
-require('./version-NZ-E_XUT.cjs');
+var runtimeGate = require('./runtime-gate-CWUZK4aE.cjs');
+var index = require('./index-BtqxUixL.cjs');
+var projectVite = require('./project-vite-DSBP8NLj.cjs');
+require('./version-4zRtvcVD.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-ChyajSZV.cjs → context-mt_ERryB.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-w3sXIJU4.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var session = require('./session-Dtkbu4vT.cjs');
+var session = require('./session-CWCq-oeW.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);

package/dist/cli-chunks/{create-vXFVQGD7.cjs → create-LfZ8OhT6.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-QY5q1rWs.cjs');
+var index = require('./index-BtqxUixL.cjs');
 require('node:module');
 require('os');
 require('node:crypto');

package/dist/cli-chunks/{dev-QH1jaFr1.cjs → dev-lgUgVorS.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var context = require('./context-ChyajSZV.cjs');
+var context = require('./context-mt_ERryB.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-w3sXIJU4.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -12,13 +12,13 @@ var node_http = require('node:http');
 var node_module = require('node:module');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-QY5q1rWs.cjs');
+var index = require('./index-BtqxUixL.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-Dtkbu4vT.cjs');
+var session = require('./session-CWCq-oeW.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-BA81QqiJ.cjs');
-var version = require('./version-NZ-E_XUT.cjs');
+var projectVite = require('./project-vite-DSBP8NLj.cjs');
+var version = require('./version-4zRtvcVD.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1993,8 +1993,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-QH1jaFr1.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-QH1jaFr1.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-lgUgVorS.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-lgUgVorS.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -11089,7 +11089,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-81ZfQF1o.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-Deim9BX8.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;

package/dist/cli-chunks/{doctor-CU25P_q2.cjs → doctor-BSJnY0Bu.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-QY5q1rWs.cjs');
+var index = require('./index-BtqxUixL.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-QY5q1rWs.cjs → index-BtqxUixL.cjs}

@@ -235,19 +235,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QY5q1rWs.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QY5q1rWs.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QY5q1rWs.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QY5q1rWs.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QY5q1rWs.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13554,7 +13554,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.9.0-alpha.2';
+const BUILT_CLI_VERSION = '0.9.0-alpha.3';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13913,39 +13913,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-DCNzO2CY.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-TIFXGbKv.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-DCNzO2CY.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-TIFXGbKv.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-DCNzO2CY.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-TIFXGbKv.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CvxoPTJb.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-C4d4WXYT.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-vXFVQGD7.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-LfZ8OhT6.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-QH1jaFr1.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-lgUgVorS.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-CU25P_q2.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BSJnY0Bu.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DKgQa7PY.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DQzR5fMS.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-CBuPWvcD.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DyGb3YBA.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-I2MJ0S1h.cjs → index-DVALw2rx.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-QY5q1rWs.cjs');
+var index$2 = require('./index-BtqxUixL.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-w3sXIJU4.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index.esm-81ZfQF1o.cjs → index.esm-Deim9BX8.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-QY5q1rWs.cjs');
-var dev = require('./dev-QH1jaFr1.cjs');
+var index = require('./index-BtqxUixL.cjs');
+var dev = require('./dev-lgUgVorS.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -23,12 +23,12 @@ require('node:crypto');
 require('readline');
 require('tty');
 require('assert');
-require('./context-ChyajSZV.cjs');
-require('./runtime-permission-env-w3sXIJU4.cjs');
-require('./version-NZ-E_XUT.cjs');
+require('./context-mt_ERryB.cjs');
+require('./runtime-permission-env-DdWYFrFT.cjs');
+require('./version-4zRtvcVD.cjs');
 require('node:async_hooks');
 require('sharp');
-require('./session-Dtkbu4vT.cjs');
+require('./session-CWCq-oeW.cjs');
 require('fs');
 require('constants');
 require('node:os');
@@ -42,7 +42,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-BA81QqiJ.cjs');
+require('./project-vite-DSBP8NLj.cjs');
 require('node:zlib');
 
 var bufferUtil = {exports: {}};

package/dist/cli-chunks/{login-DCNzO2CY.cjs → login-TIFXGbKv.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-Dtkbu4vT.cjs');
+var session = require('./session-CWCq-oeW.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-QY5q1rWs.cjs');
+var index = require('./index-BtqxUixL.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-BA81QqiJ.cjs → project-vite-DSBP8NLj.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-QY5q1rWs.cjs');
+var index = require('./index-BtqxUixL.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-CBuPWvcD.cjs → remote-DyGb3YBA.cjs}

@@ -1,18 +1,18 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-w3sXIJU4.cjs');
-var context = require('./context-ChyajSZV.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
+var context = require('./context-mt_ERryB.cjs');
 var promises = require('node:readline/promises');
-var index = require('./index-QY5q1rWs.cjs');
-var session = require('./session-Dtkbu4vT.cjs');
+var index = require('./index-BtqxUixL.cjs');
+var session = require('./session-CWCq-oeW.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
 var node_crypto = require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-C1gdlVUB.cjs');
-require('./version-NZ-E_XUT.cjs');
+var runtimeGate = require('./runtime-gate-CWUZK4aE.cjs');
+require('./version-4zRtvcVD.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:module');
@@ -68,6 +68,14 @@ async function postHeyboxApi(pathWithQuery, body, session$1, runtime) {
 
 const CREATE_USER_MINIPROGRAM_UPLOAD_SESSION_API_PATH = '/mall/developer/user_miniprogram/version/upload_session/create';
 const RECORD_USER_MINIPROGRAM_UPLOAD_RESULT_API_PATH = '/mall/developer/user_miniprogram/version/upload_session/record';
+const COMPANION_FINALIZATION_TIMEOUT_MS = 30 * 60_000;
+async function authorizeCompanionUpload(options, runtime = {}) {
+    const result = await postUserMiniprogramVersionForm('/mall/developer/user_miniprogram/version/upload_session/companion_authorization', options, { version: options.version, session_id: options.sessionId, relative_paths: options.relativePaths.join(','), artifact_protocol_version: '2' }, runtime);
+    if (!result.bucket || !result.region || !Array.isArray(result.keys) || !result.tmp_secret_id || !result.tmp_secret_key || !result.session_token || !(result.expired_time > result.start_time)) {
+        throw new Error('Companion 上传凭证响应不完整');
+    }
+    return result;
+}
 async function precheckUserMiniprogramVersion(options, runtime = {}) {
     return postUserMiniprogramVersionForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
         // 构建前轻预检不携带独立资料；权威准入读取构建 Manifest。
@@ -78,11 +86,12 @@ async function precheckUserMiniprogramVersion(options, runtime = {}) {
     }, runtime);
 }
 async function submitUserMiniprogramAudit(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, { session_id: options.sessionId, preflight_token: options.preflightToken }, runtime);
+    return postUserMiniprogramVersionForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, { session_id: options.sessionId, preflight_token: options.preflightToken, artifact_protocol_version: '2' }, runtime);
 }
 async function createUserMiniprogramUploadSession(options, runtime = {}) {
     return postUserMiniprogramVersionForm(CREATE_USER_MINIPROGRAM_UPLOAD_SESSION_API_PATH, options, {
         version: options.version,
+        artifact_protocol_version: '2',
         artifact_signature: options.artifactSignature,
         files: JSON.stringify(options.files),
         manifest: JSON.stringify(options.manifest),
@@ -91,11 +100,27 @@ async function createUserMiniprogramUploadSession(options, runtime = {}) {
     }, runtime);
 }
 async function recordUserMiniprogramUploadResult(options, runtime = {}) {
-    await postUserMiniprogramVersionForm(RECORD_USER_MINIPROGRAM_UPLOAD_RESULT_API_PATH, options, {
+    const fields = {
         version: options.version,
+        artifact_protocol_version: '2',
         session_id: options.sessionId,
         files: JSON.stringify(options.files),
-    }, runtime);
+    };
+    const deadline = Date.now() + COMPANION_FINALIZATION_TIMEOUT_MS;
+    for (;;) {
+        const result = await postUserMiniprogramVersionForm(RECORD_USER_MINIPROGRAM_UPLOAD_RESULT_API_PATH, options, fields, runtime);
+        if (result.artifact_protocol_version !== 2 || !Array.isArray(result.companion_files)) {
+            throw new Error('服务端未返回产物协议 v2 Finalize 状态');
+        }
+        const failed = result.companion_files.find((file) => file.state === 'failed');
+        if (failed)
+            throw new Error(failed.error || `Companion 归档验证失败：${failed.relative_path}`);
+        if (result.complete)
+            return;
+        if (Date.now() >= deadline)
+            throw new Error('Companion 归档验证超时，请稍后重试');
+        await new Promise((resolve) => setTimeout(resolve, Math.max(250, Math.min(result.retry_after_ms || 1000, 5000))));
+    }
 }
 async function postUserMiniprogramVersionForm(path, options, fields, runtime) {
     const fetchImpl = runtime.fetchImpl ?? fetch;
@@ -134,17 +159,21 @@ async function runUpload(options, runtime = {}) {
         createCosClient = ({ uploadToken }) => createDefaultCosClient(uploadToken, COS);
     }
     const orderedFiles = runtimePermissionEnv.prepareMiniappArtifactFiles(options.files);
-    const batches = chunkUploadFiles(orderedFiles, runtimePermissionEnv.MINIAPP_UPLOAD_BATCH_SIZE);
+    const batches = [false, true].flatMap(companion => chunkUploadFiles(orderedFiles.filter(file => file.relativePath.startsWith('companions/') === companion), runtimePermissionEnv.MINIAPP_UPLOAD_BATCH_SIZE));
     await logger.task(`正在上传 ${orderedFiles.length} 个文件`, async (taskContext) => {
         logger.debug(`上传并发数: ${concurrency}`);
         logger.debug(`上传批次数: ${batches.length}`);
         let completed = 0;
         for (let batchIndex = 0; batchIndex < batches.length; batchIndex += 1) {
             const batch = batches[batchIndex];
+            const companion = batch[0].relativePath.startsWith('companions/');
+            const grant = companion ? await (runtime.authorizeCompanionUpload ?? authorizeCompanionUpload)({
+                session: options.session, miniProgramId: options.miniProgramId, version: options.version, sessionId: options.uploadSessionId, relativePaths: batch.map(file => file.relativePath),
+            }, { baseUrl: runtime.baseUrl, fetchImpl }) : undefined;
             logger.debug(`正在处理上传批次 ${batchIndex + 1}/${batches.length}，文件数: ${batch.length}`);
             logger.debug('正在获取 CDN 上传信息');
             const fileInfos = createUploadFileInfos(batch);
-            const uploadInfo = await getCDNUploadInfo$1({
+            const uploadInfo = grant ?? await getCDNUploadInfo$1({
                 session: options.session,
                 scope: runtimePermissionEnv.MINIAPP_UPLOAD_SCOPE,
                 fileInfos,
@@ -157,7 +186,10 @@ async function runUpload(options, runtime = {}) {
             logger.debug('正在获取本批 CDN 上传凭证');
             let uploadToken;
             try {
-                uploadToken = await getCDNUploadToken$1({
+                uploadToken = grant ? {
+                    credentials: { tmpSecretId: grant.tmp_secret_id, tmpSecretKey: grant.tmp_secret_key, sessionToken: grant.session_token },
+                    startTime: grant.start_time, expiredTime: grant.expired_time,
+                } : await getCDNUploadToken$1({
                     session: options.session,
                     bucket: uploadInfo.bucket,
                     keys: indexedFiles.map(item => item.key),
@@ -186,6 +218,11 @@ async function runUpload(options, runtime = {}) {
                             Body: createReadStream(uploadTask.file.absolutePath),
                             ContentLength: uploadTask.file.size,
                             ContentType: uploadTask.file.mimeType,
+                            ...(companion ? { Headers: { 'x-cos-forbid-overwrite': 'true' } } : {}),
+                        }).catch(error => {
+                            if (companion && isExistingCompanionObject(error))
+                                return;
+                            throw error;
                         });
                         successfulKeys.push(uploadTask.key);
                         completed += 1;
@@ -203,7 +240,8 @@ async function runUpload(options, runtime = {}) {
             await Promise.all(workers);
             if (successfulKeys.length > 0) {
                 logger.debug('正在确认 CDN 上传结果');
-                await postCDNUploadCallback$1({ session: options.session, keys: successfulKeys, isFinished: true }, { baseUrl: runtime.baseUrl, fetchImpl });
+                if (!companion)
+                    await postCDNUploadCallback$1({ session: options.session, keys: successfulKeys, isFinished: true }, { baseUrl: runtime.baseUrl, fetchImpl });
                 await recordUserMiniprogramUploadResult$1({
                     session: options.session,
                     miniProgramId: options.miniProgramId,
@@ -227,6 +265,12 @@ function chunkUploadFiles(files, batchSize) {
     }
     return batches;
 }
+function isExistingCompanionObject(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const value = error;
+    return Number(value.statusCode) === 409 && value.code === 'ObjectAlreadyExists';
+}
 function createUploadFileInfos(files) {
     return files.map((file) => ({
         name: file.relativePath.split('/').pop() ?? file.relativePath,
@@ -264,7 +308,7 @@ function createDefaultCosClient(uploadToken, COS) {
             return new Promise((resolve, reject) => {
                 cos.putObject(params, (err, result) => {
                     if (err) {
-                        reject(err instanceof Error ? err : new Error(readErrorMessage(err)));
+                        reject(err);
                         return;
                     }
                     resolve(result);
@@ -274,7 +318,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-I2MJ0S1h.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-DVALw2rx.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -519,6 +563,9 @@ const MIME_BY_EXT = {
     '.woff': 'font/woff',
     '.woff2': 'font/woff2',
 };
+function formatDeployBytes(bytes) {
+    return `${(bytes / (1024 * 1024)).toFixed(2)} MiB`;
+}
 async function runDeployCommand(options, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
     const cwd = runtime.cwd ?? process.cwd();
@@ -691,24 +738,43 @@ async function runDeployCommand(options, runtime = {}) {
                 }
                 if (!result.preflight_token)
                     throw new Error('服务端未返回 preflight_token，请先升级服务端');
+                if (result.artifact_protocol_version !== 2) {
+                    throw new Error('创建上传会话失败：服务端不支持产物协议 v2，请升级服务端后重试');
+                }
                 if (result.file_receipt_version !== 1) {
                     throw new Error('创建上传会话失败：服务端不支持文件完整性 receipt v1，请升级服务端后重试');
                 }
-                const resolved = runtimePermissionEnv.resolveMiniappUploadSessionFiles(artifactReceipt.files, Array.isArray(result.files) ? result.files : [], Array.isArray(result.uploaded_keys) ? result.uploaded_keys : []);
+                if (!Array.isArray(result.files) || !Array.isArray(result.uploaded_keys) || !Array.isArray(result.reused_companion_files)) {
+                    throw new Error('创建上传会话失败：服务端返回的产物协议 v2 文件清单不完整');
+                }
+                const resolved = runtimePermissionEnv.resolveMiniappUploadSessionFiles(artifactReceipt.files, result.files, result.uploaded_keys, result.reused_companion_files);
                 return {
                     preflightToken: result.preflight_token,
                     sessionId: result.session_id.trim(),
                     files: resolved.files,
                     missingFiles: resolved.missingFiles,
+                    reusedCompanionFiles: resolved.reusedCompanionFiles,
                 };
             }, { successText: '上传会话已就绪' });
             uploadSessionId = createdUploadSession.sessionId;
             preflightToken = createdUploadSession.preflightToken;
             const uploadedCount = createdUploadSession.files.length - createdUploadSession.missingFiles.length;
             if (uploadedCount > 0) {
-                logger.debug(`复用已上传文件: ${uploadedCount}/${createdUploadSession.files.length}`);
+                logger.debug(`会话内已上传文件: ${uploadedCount}/${createdUploadSession.files.length}`);
             }
+            const reusedBytes = createdUploadSession.reusedCompanionFiles.reduce((sum, file) => sum + file.size, 0);
+            const uploadBytes = createdUploadSession.missingFiles.reduce((sum, { file }) => sum + file.size, 0);
+            logger.info(`Companion Blob 复用: ${createdUploadSession.reusedCompanionFiles.length} 个，免上传 ${formatDeployBytes(reusedBytes)}；实际待上传 ${formatDeployBytes(uploadBytes)}`);
             try {
+                const missingKeys = new Set(createdUploadSession.missingFiles.map(item => item.key));
+                const uploadedCompanions = createdUploadSession.files.filter(item => item.file.relativePath.startsWith('companions/') && !missingKeys.has(item.key));
+                for (let index = 0; index < uploadedCompanions.length; index += runtimePermissionEnv.MINIAPP_UPLOAD_BATCH_SIZE) {
+                    await (runtime.recordUserMiniprogramUploadResult ?? recordUserMiniprogramUploadResult)({
+                        session: session$1, miniProgramId, version, sessionId: uploadSessionId,
+                        files: uploadedCompanions.slice(index, index + runtimePermissionEnv.MINIAPP_UPLOAD_BATCH_SIZE)
+                            .map(({ file }) => ({ path: file.relativePath, size: file.size, sha256: file.sha256 })),
+                    }, { baseUrl: apiBaseUrl, fetchImpl: runtime.fetchImpl });
+                }
                 if (createdUploadSession.missingFiles.length > 0) {
                     await assertDeployUploadFilesStillMatchSignature({
                         computeMiniappArtifactReceipt: runtime.computeMiniappArtifactReceipt ?? computeMiniappArtifactReceipt,

package/dist/cli-chunks/{runtime-gate-C1gdlVUB.cjs → runtime-gate-CWUZK4aE.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-w3sXIJU4.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
 
 // Shorthands
 /**