@heybox/hb-sdk 0.9.0-alpha.3 → 0.9.0-alpha.5

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.0-alpha.5 - 2026-10-09
+
+### 文档与工具
+
+- 补齐网络超时与重试、Steam 授权、生命周期事件和展示操作的 API 说明，修正 Companion 退出订阅示例。
+- 为发布资料、Manifest 和浏览器预览工具补充参数、返回值、校验边界与资源释放说明，并纳入 API Reference。
+
+## 0.9.0-alpha.4 - 2026-10-08
+
+### 行为调整
+
+- `user.getSteamGameList()` 在支持完整文件能力的 Host 上复用持久化结果；文件能力不可用时保留内存缓存并正常回退请求。
+
+### 问题修复
+
+- 修复缓存存储故障、账号绑定变化和缓存治理异常影响 Steam 查询的问题。
+
 ## 0.9.0-alpha.3 - 2026-10-08
 
 ### 行为调整

package/dist/cli-chunks/{build-C4d4WXYT.cjs → build-Dg8PWtA3.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BCdawZhE.cjs');
 require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-CWUZK4aE.cjs');
-var index = require('./index-BtqxUixL.cjs');
-var projectVite = require('./project-vite-DSBP8NLj.cjs');
-require('./version-4zRtvcVD.cjs');
+var runtimeGate = require('./runtime-gate-BfnpIguo.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
+var projectVite = require('./project-vite-BQIL3ZLc.cjs');
+require('./version-JvV3LKTj.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-mt_ERryB.cjs → context-3O0-DEFd.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BCdawZhE.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var session = require('./session-CWCq-oeW.cjs');
+var session = require('./session-CLOFAoc0.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);

package/dist/cli-chunks/{create-LfZ8OhT6.cjs → create-C642TxNr.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-BtqxUixL.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
 require('node:module');
 require('os');
 require('node:crypto');

package/dist/cli-chunks/{dev-lgUgVorS.cjs → dev-DERtbUJV.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var context = require('./context-mt_ERryB.cjs');
+var context = require('./context-3O0-DEFd.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BCdawZhE.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -12,13 +12,13 @@ var node_http = require('node:http');
 var node_module = require('node:module');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-BtqxUixL.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-CWCq-oeW.cjs');
+var session = require('./session-CLOFAoc0.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-DSBP8NLj.cjs');
-var version = require('./version-4zRtvcVD.cjs');
+var projectVite = require('./project-vite-BQIL3ZLc.cjs');
+var version = require('./version-JvV3LKTj.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1993,8 +1993,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-lgUgVorS.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-lgUgVorS.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DERtbUJV.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DERtbUJV.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -11089,7 +11089,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-Deim9BX8.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-CvL0kH2-.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;

package/dist/cli-chunks/{doctor-BSJnY0Bu.cjs → doctor-0nMnAEZj.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-BtqxUixL.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-DVALw2rx.cjs → index-B3dWPrGS.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-BtqxUixL.cjs');
+var index$2 = require('./index-Bgh1vkq3.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BCdawZhE.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index-BtqxUixL.cjs → index-Bgh1vkq3.cjs}

@@ -235,19 +235,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bgh1vkq3.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bgh1vkq3.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bgh1vkq3.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bgh1vkq3.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BtqxUixL.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bgh1vkq3.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13554,7 +13554,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.9.0-alpha.3';
+const BUILT_CLI_VERSION = '0.9.0-alpha.5';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13913,39 +13913,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-TIFXGbKv.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CiwgEMNe.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-TIFXGbKv.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CiwgEMNe.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-TIFXGbKv.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CiwgEMNe.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-C4d4WXYT.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-Dg8PWtA3.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-LfZ8OhT6.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-C642TxNr.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-lgUgVorS.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-DERtbUJV.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BSJnY0Bu.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-0nMnAEZj.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DQzR5fMS.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-Cpioyedd.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DyGb3YBA.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-CjMqQIn-.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index.esm-Deim9BX8.cjs → index.esm-CvL0kH2-.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-BtqxUixL.cjs');
-var dev = require('./dev-lgUgVorS.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
+var dev = require('./dev-DERtbUJV.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -23,12 +23,12 @@ require('node:crypto');
 require('readline');
 require('tty');
 require('assert');
-require('./context-mt_ERryB.cjs');
-require('./runtime-permission-env-DdWYFrFT.cjs');
-require('./version-4zRtvcVD.cjs');
+require('./context-3O0-DEFd.cjs');
+require('./runtime-permission-env-BCdawZhE.cjs');
+require('./version-JvV3LKTj.cjs');
 require('node:async_hooks');
 require('sharp');
-require('./session-CWCq-oeW.cjs');
+require('./session-CLOFAoc0.cjs');
 require('fs');
 require('constants');
 require('node:os');
@@ -42,7 +42,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-DSBP8NLj.cjs');
+require('./project-vite-BQIL3ZLc.cjs');
 require('node:zlib');
 
 var bufferUtil = {exports: {}};

package/dist/cli-chunks/{login-TIFXGbKv.cjs → login-CiwgEMNe.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-CWCq-oeW.cjs');
+var session = require('./session-CLOFAoc0.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-BtqxUixL.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-DSBP8NLj.cjs → project-vite-BQIL3ZLc.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-BtqxUixL.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-DyGb3YBA.cjs → remote-CjMqQIn-.cjs}

@@ -1,18 +1,18 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
-var context = require('./context-mt_ERryB.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BCdawZhE.cjs');
+var context = require('./context-3O0-DEFd.cjs');
 var promises = require('node:readline/promises');
-var index = require('./index-BtqxUixL.cjs');
-var session = require('./session-CWCq-oeW.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
+var session = require('./session-CLOFAoc0.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
 var node_crypto = require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-CWUZK4aE.cjs');
-require('./version-4zRtvcVD.cjs');
+var runtimeGate = require('./runtime-gate-BfnpIguo.cjs');
+require('./version-JvV3LKTj.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:module');
@@ -318,7 +318,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-DVALw2rx.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-B3dWPrGS.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {

package/dist/cli-chunks/{runtime-gate-CWUZK4aE.cjs → runtime-gate-BfnpIguo.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-DdWYFrFT.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BCdawZhE.cjs');
 
 // Shorthands
 /**
@@ -27,6 +27,13 @@ function parse(html, options) {
 const RUNTIME_GATE_MARKER = 'data-heybox-runtime-gate';
 const RUNTIME_GATE_STYLE_MARKER = 'data-heybox-runtime-gate-style';
 const RUNTIME_GATE_BOOTSTRAP_MARKER = 'data-heybox-runtime-gate-bootstrap';
+/**
+ * 检查 HTML 是否包含 Runtime Gate 的三个结构标记。
+ *
+ * @param html - 待检查的完整 HTML 文本，使用 HTML parser 解析。
+ * @returns Gate、隐藏样式及 bootstrap 标记均出现时返回 `true`，否则返回 `false`。
+ * @remarks 只识别标记，不验证脚本内容、标记所在节点或宿主握手；不能据此判断页面安全或实际可运行。
+ */
 function hasMiniappRuntimeGate(html) {
     const document = parse(html);
     let hasGate = false;

package/dist/cli-chunks/{runtime-permission-env-DdWYFrFT.cjs → runtime-permission-env-BCdawZhE.cjs}

@@ -2,11 +2,18 @@
 
 var fs = require('node:fs');
 var path = require('node:path');
-var version = require('./version-4zRtvcVD.cjs');
+var version = require('./version-JvV3LKTj.cjs');
 require('node:crypto');
 var node_async_hooks = require('node:async_hooks');
 
-/** 校验配置或产物中的类别，省略与显式非法值严格区分。 */
+/**
+ * 校验项目配置或产物中的小程序类别。
+ *
+ * @param value - 待校验值，只接受 `tool`、`game`、`other` 或 `undefined`；不做 trim 或大小写转换。
+ * @param sourceLabel - 错误消息中的字段来源，默认 `package.json#heybox.category`。
+ * @returns 合法类别原值；输入 `undefined` 时返回 `undefined`，由发布流程另行检查是否必填。
+ * @throws `Error` 输入为其他值（包括 null 或空字符串）时抛出带字段来源的错误。
+ */
 function parseMiniappCategory(value, sourceLabel = 'package.json#heybox.category') {
     if (value === undefined)
         return undefined;
@@ -2802,7 +2809,14 @@ var semverExports = requireSemver();
 
 const BASIC_INFO_MAX_BYTES = 10 * 1024 * 1024;
 const BASIC_INFO_MAX_PIXELS = 40_000_000;
-/** 按 NFKC 和 Unicode 空白规范化名称，并校验 1–40 个字符及禁用字符。 */
+/**
+ * 规范化并校验小程序展示名称。
+ *
+ * @param raw - 原始名称，必须是字符串。
+ * @returns NFKC 规范化、去除首尾 Unicode White_Space 后的名称；不折叠规范化后的内部空白。
+ * @throws `Error` 输入不是字符串，或规范化后不是 1–40 个 Unicode code point、不含文字或数字，或包含控制字符、
+ * 格式字符、行/段分隔符以及 HTML 特殊字符 `<`、`>`、`&`、双引号或单引号时抛出。
+ */
 function normalizeBasicInfoName(raw) {
     if (typeof raw !== 'string')
         throw new Error('heybox.name 必须是字符串');
@@ -2823,7 +2837,17 @@ function validateBasicInfoPath(raw) {
         throw new Error('资料图片仅支持 JPEG、PNG、GIF、WebP');
     return raw;
 }
-/** 解析项目或构建资料；仅早于 0.8.2 且三项全部缺失时返回 undefined。 */
+/**
+ * 校验项目声明或 Manifest 中的小程序展示资料。
+ *
+ * @param value - `package.json#heybox` 或 Manifest 对象，读取 `name`、`icon`、`coverImages`。
+ * @param sdkVersion - 产物 SDK 版本，默认 `0.8.2`；用于判断历史产物是否允许缺失全部资料。
+ * @returns 名称规范化后的新资料对象；仅版本早于 `0.8.2` 且三项均无自有属性时返回 `undefined`。
+ * @throws `Error` SDK 版本非法、资料字段不齐、名称/图片路径非法，或封面不是 1–5 个互不重复的路径时抛出。
+ * @remarks
+ * 图片路径必须使用 `/` 分隔的非空相对路径，扩展名为 JPEG、PNG、GIF 或 WebP；拒绝 URL、点段、
+ * 控制字符和构建/缓存等保留目录。此函数只校验声明，不读取文件，也不验证图片字节、尺寸或存在性。
+ */
 function parseMiniappBasicInfo(value, sdkVersion = '0.8.2') {
     sdkVersion = sdkVersion.trim();
     if (!semverExports.valid(sdkVersion) || sdkVersion.startsWith('v') || sdkVersion.includes('+'))
@@ -3576,6 +3600,16 @@ function parseMiniappManifestJson(raw, sourceLabel = 'manifest.json') {
         hadBom,
     };
 }
+/**
+ * 校验发布 Manifest 并返回规范化后的已知字段。
+ *
+ * @param manifest - 从构建产物读取的 Manifest，图片和 Companion 路径相对构建目录。
+ * @returns 新对象：规范化版本、名称、平台与游戏绑定，省略空绑定及未声明的可选字段；不保留未知字段。
+ * @throws `Error` 版本、平台、资料、权限、窗口、游戏绑定或生成的 Companion 声明非法，以及类别缺失时抛出。
+ * @remarks
+ * 不修改输入对象，不执行文件 I/O；不会验证图片/归档是否存在、内容摘要是否匹配，也不查询远端发布资格。
+ * 成功仅表示 Manifest 字段通过校验，不能替代文件检查与服务端发布预检。
+ */
 function validateMiniappManifestForDeploy(manifest) {
     const version = validateMiniappManifestVersion(manifest.version, 'manifest.version');
     const sdkVersion = validateSdkVersion(manifest.sdkVersion, 'manifest.sdkVersion');
@@ -12091,30 +12125,13 @@ const textEncoder = new TextEncoder();
 /**
  * 将扫描到的相对路径转换为统一的 `/` 分隔形式。
  *
- * @param relativePath - 待整理的构建产物路径。TypeScript 入口声明为字符串；JavaScript 运行时会
- * 先计算 `relativePath || ''`，再通过 `String(...)` 强制转换。
- * @returns 仅统一分隔符形态的新字符串：所有 `\\` 转为 `/`，所有前导 `/` 被删除，其余连续
- * `/` 合并为一个。空字符串以及运行时传入的 `undefined`、`null`、`false`、`0`、`NaN` 等
- * falsy 值返回 `''`；truthy 非字符串按标准 `String(value)` 结果继续整理。
+ * @param relativePath - 待整理的构建产物路径。
+ * @returns 反斜杠转为 `/`、删除前导 `/`、合并连续 `/` 后的新字符串；空输入返回空字符串。
  *
  * @remarks
- * 这是面向 build/deploy 文件扫描结果的**格式 helper**，不是路径安全校验或 canonical path
- * parser。它不会 trim、URL decode、Unicode normalize、解析盘符，也不会拒绝或消解 `.` / `..`
- * segment、控制字符、Windows drive prefix 或尾随 `/`。例如 `/etc/passwd` 会变成
- * `etc/passwd`，`C:\\temp\\app.js` 会变成 `C:/temp/app.js`，`assets/../secret/` 仍保留点段
- * 和尾随 slash；调用方不能根据返回值推断原输入是安全相对路径。
- *
- * SDK 的 build/deploy 流程会把扫描路径先用本函数统一分隔符，再分别使用
- * {@link relativePathContainsNodeModulesSegment} 排除完整 `node_modules` 目录段、用
- * {@link shouldUploadDistFile} 过滤根 `manifest.json` / `.DS_Store` / source map。`hb-sdk build`
- * 随后校验大小预算；`hb-sdk remote deploy` 还会在签名和上传前通过
- * `validateUploadPaths()`、`prepareMiniappArtifactFiles()` 或
- * `validateMiniappUploadPathLengths()` 执行真正的空路径、点段、控制字符、重复和长度校验。
- * 这些步骤不能由本函数单独替代；`shouldUploadDistFile()` 也不会自行检查 `node_modules`。
- *
- * 不要把本函数与 `@heybox/hb-sdk/protocol` 的 `isMiniProgramRelativePath()` 混用：协议 guard
- * 不做转换，只接受已经规范的非空字符串，并拒绝前导/尾随 `/`、反斜杠、空 segment、`.`、
- * `..` 与控制字符；本函数则会改写部分非法形态并保留其余不安全内容。
+ * 仅整理文本格式，不做路径安全校验：保留点段、控制字符、盘符和尾随 `/`，不 trim 或 URL decode。
+ * 上传前仍需校验路径安全、唯一性与长度。协议 `isMiniProgramRelativePath()` 则只校验、不改写输入。
+ * JavaScript 非字符串输入按 `String(relativePath || '')` 转换，falsy 值回退为空串。
  *
  * @example
  * ```ts
@@ -12122,8 +12139,6 @@ const textEncoder = new TextEncoder();
  *
  * normalizeRelativePath('///dist\\assets//app.js'); // 'dist/assets/app.js'
  * normalizeRelativePath('assets/../secret///'); // 'assets/../secret/'，仍需安全校验
- * normalizeRelativePath(123 as unknown as string); // '123'，JavaScript 运行时强制转换
- * normalizeRelativePath(0 as unknown as string); // ''，falsy 值先回退为空串
  * ```
  *
  * @see {@link relativePathContainsNodeModulesSegment}
@@ -12139,40 +12154,21 @@ function normalizeRelativePath(relativePath) {
 /**
  * 判断路径中是否包含大小写不敏感的完整 `node_modules` 目录段。
  *
- * @param relativePath - 待检查的构建产物路径。函数先通过 {@link normalizeRelativePath} 把
- * 反斜杠改为 `/`、删除前导 `/` 并合并连续 `/`，再按 `/` 分段。
- * @returns 至少一个非空段大小写不敏感地等于完整 `node_modules` 时返回 `true`；空路径、
- * 空段及 `node_modules.txt`、`node_modules-old`、`@node_modules` 等相似名称返回 `false`。
+ * @param relativePath - 构建产物路径，先按 {@link normalizeRelativePath} 整理分隔符再分段比较。
+ * @returns 任意目录段大小写不敏感地等于 `node_modules` 时返回 `true`；空路径和相似名称返回 `false`。
  *
  * @remarks
- * 比较使用每个非空 segment 的 `toLowerCase() === 'node_modules'`，因此根目录或任意深度的
- * `node_modules`、`NODE_MODULES`、`Node_Modules` 都会命中。前导和重复 slash 会先被
- * `normalizeRelativePath` 整理；尾随 slash 产生的空段会被忽略。
- *
- * 这是同步、无副作用的**单一 predicate**，只回答“规范化后的文本是否包含该完整段”。它
- * 不 trim segment、不进行 URL/percent decode、Unicode normalize 或文件系统解析。例如
- * `node_modules%2Fpkg/index.js`、`%6eode_modules/pkg.js` 和 `node_modules.txt` 都不会命中；调用方
- * 不应传 URL，也不能把未命中解释为路径安全。
- *
- * 本函数不会拒绝或消解 `.` / `..`、绝对路径、Windows drive prefix、控制字符、空路径、
- * symlink、重复路径或超长路径。`assets/../node_modules/pkg.js` 仍会命中，因为点段保持原样；
- * 不含 `node_modules` 的危险路径则仍可能返回 `false`。签名或上传前必须继续执行对应的上传
- * 路径规范、唯一性和长度校验。
- *
- * SDK build/deploy 会在文件扫描后用本函数拒绝整个 `node_modules` 树，再用
- * {@link shouldUploadDistFile} 排除根 `manifest.json`、`.DS_Store` 和 source map。build 随后
- * 校验大小预算；deploy 还会执行上传路径安全、唯一性、长度与签名校验。这些步骤互不替代：`shouldUploadDistFile()` 本身不检查
- * `node_modules`，本函数也不决定普通文件是否应该上传。
+ * 只检查目录段文本，不 trim、URL decode 或解析文件系统。未命中不表示路径安全；点段仍保留。
+ * SDK 用它排除 `node_modules` 树，再用 {@link shouldUploadDistFile} 过滤其他不上传的文件；
+ * 路径安全、唯一性、长度与上传大小需分别校验。
  *
  * @example
  * ```ts
  * import { relativePathContainsNodeModulesSegment } from '@heybox/hb-sdk/miniapp-publish';
  *
  * relativePathContainsNodeModulesSegment('dist\\NODE_MODULES/pkg/index.js'); // true
- * relativePathContainsNodeModulesSegment('dist//vendor///node_modules/'); // true
  * relativePathContainsNodeModulesSegment('dist/node_modules.txt'); // false
  * relativePathContainsNodeModulesSegment('dist/node_modules%2Fpkg.js'); // false，不做 URL decode
- * relativePathContainsNodeModulesSegment('assets/../secret.js'); // false，但这不代表路径安全
  * ```
  *
  * @see [normalizeRelativePath](/reference/symbols/miniapp-publish/functions/normalizeRelativePath)

package/dist/cli-chunks/{session-CWCq-oeW.cjs → session-CLOFAoc0.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-BtqxUixL.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli-chunks/{skill-DQzR5fMS.cjs → skill-Cpioyedd.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var version = require('./version-4zRtvcVD.cjs');
+var version = require('./version-JvV3LKTj.cjs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
 var childProcess = require('node:child_process');
-var index = require('./index-BtqxUixL.cjs');
+var index = require('./index-Bgh1vkq3.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{version-4zRtvcVD.cjs → version-JvV3LKTj.cjs}

@@ -3,6 +3,6 @@
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.0-alpha.3';
+    : '0.9.0-alpha.5';
 
 exports.HB_SDK_VERSION = HB_SDK_VERSION;

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-BtqxUixL.cjs');
+var index = require('./cli-chunks/index-Bgh1vkq3.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');