@heybox/hb-sdk 0.9.3 → 0.9.4-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.4-alpha.1 - 2026-10-26
+
+### 行为调整
+
+- [hb-sdk build](https://docs.xiaoheihe.cn/hb_sdk/guide/cli.html#%E7%94%9F%E4%BA%A7%E6%9E%84%E5%BB%BA) 与 [hb-sdk remote deploy](https://docs.xiaoheihe.cn/hb_sdk/guide/cli.html#%E9%83%A8%E7%BD%B2%E5%8F%91%E5%B8%83) 统一拒绝含真实反斜杠的文件名、空 `node_modules` 目录及符号链接；请调整产物内容后重新构建。
+
+## 0.9.4-alpha.0 - 2026-10-26
+
+### 问题修复
+
+- 修复部分旧版 iOS 设备无法打开小程序的问题，需要 Host 配套更新。
+- 修复小程序内返回上一页时，目标页面仍在加载却被提前判定失败的问题，需要 Host 配套更新。
+
 ## 0.9.3 - 2026-10-23
 
 ### 必须操作

package/dist/cli-chunks/{runtime-gate-BgWB2U5f.cjs → artifact-Dv6zPoPj.cjs}

@@ -1,18 +1,82 @@
 'use strict';
 
+var fs = require('node:fs');
+var fs$1 = require('node:fs/promises');
+var path = require('node:path');
+var runtimePermissionEnv = require('./runtime-permission-env-DLLffpOa.cjs');
+require('./version-hdMctv12.cjs');
+var index = require('./index-dXb0CRuR.cjs');
 var node_crypto = require('node:crypto');
+require('node:zlib');
 require('node:module');
 require('node:url');
-var fs = require('node:fs');
-var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DmJ1zEpa.cjs');
-var index = require('./index-CF6qh9ll.cjs');
 var _commonjsDynamicModules = require('./_commonjs-dynamic-modules-DUamuDzp.cjs');
 var require$$0$1 = require('fs');
 var require$$1 = require('path');
 var require$$0 = require('os');
 var require$$6 = require('inspector');
 
+// Shorthands
+/**
+ * Parses an HTML string.
+ *
+ * @param html Input HTML string.
+ * @param options Parsing options.
+ * @returns Document
+ *
+ * @example
+ *
+ * ```js
+ * const parse5 = require('parse5');
+ *
+ * const document = parse5.parse('<!DOCTYPE html><html><head></head><body>Hi there!</body></html>');
+ *
+ * console.log(document.childNodes[1].tagName); //> 'html'
+ *```
+ */
+function parse(html, options) {
+    return runtimePermissionEnv.Parser.parse(html, options);
+}
+
+const RUNTIME_GATE_MARKER = 'data-heybox-runtime-gate';
+const RUNTIME_GATE_STYLE_MARKER = 'data-heybox-runtime-gate-style';
+const RUNTIME_GATE_BOOTSTRAP_MARKER = 'data-heybox-runtime-gate-bootstrap';
+/**
+ * 检查 HTML 是否包含 Runtime Gate 的三个结构标记。
+ *
+ * @param html - 待检查的完整 HTML 文本，使用 HTML parser 解析。
+ * @returns Gate、隐藏样式及 bootstrap 标记均出现时返回 `true`，否则返回 `false`。
+ * @remarks 只识别标记，不验证脚本内容、标记所在节点或宿主握手；不能据此判断页面安全或实际可运行。
+ * @since 0.8.2
+ */
+function hasMiniappRuntimeGate(html) {
+    const document = parse(html);
+    let hasGate = false;
+    let hasGateStyle = false;
+    let hasGateBootstrap = false;
+    walk(document, (element) => {
+        hasGate ||= hasAttr(element, RUNTIME_GATE_MARKER);
+        hasGateStyle ||= hasAttr(element, RUNTIME_GATE_STYLE_MARKER);
+        hasGateBootstrap ||= hasAttr(element, RUNTIME_GATE_BOOTSTRAP_MARKER);
+    });
+    return hasGate && hasGateStyle && hasGateBootstrap;
+}
+function readAttr(element, name) {
+    return element.attrs.find((attr) => attr.name.toLowerCase() === name)?.value;
+}
+function hasAttr(element, name) {
+    return readAttr(element, name) !== undefined;
+}
+function walk(node, visit) {
+    if ('tagName' in node)
+        visit(node);
+    if ('childNodes' in node)
+        for (const child of node.childNodes)
+            walk(child, visit);
+    if ('content' in node && node.content)
+        walk(node.content, visit);
+}
+
 var typescript = {exports: {}};
 
 var sourceMapSupport = {exports: {}};
@@ -201881,67 +201945,74 @@ function verifyWorkspaceCardArtifacts(root, manifest) {
     }
 }
 
-// Shorthands
-/**
- * Parses an HTML string.
- *
- * @param html Input HTML string.
- * @param options Parsing options.
- * @returns Document
- *
- * @example
- *
- * ```js
- * const parse5 = require('parse5');
- *
- * const document = parse5.parse('<!DOCTYPE html><html><head></head><body>Hi there!</body></html>');
- *
- * console.log(document.childNodes[1].tagName); //> 'html'
- *```
- */
-function parse(html, options) {
-    return runtimePermissionEnv.Parser.parse(html, options);
-}
-
-const RUNTIME_GATE_MARKER = 'data-heybox-runtime-gate';
-const RUNTIME_GATE_STYLE_MARKER = 'data-heybox-runtime-gate-style';
-const RUNTIME_GATE_BOOTSTRAP_MARKER = 'data-heybox-runtime-gate-bootstrap';
-/**
- * 检查 HTML 是否包含 Runtime Gate 的三个结构标记。
- *
- * @param html - 待检查的完整 HTML 文本，使用 HTML parser 解析。
- * @returns Gate、隐藏样式及 bootstrap 标记均出现时返回 `true`，否则返回 `false`。
- * @remarks 只识别标记，不验证脚本内容、标记所在节点或宿主握手；不能据此判断页面安全或实际可运行。
- * @since 0.8.2
- */
-function hasMiniappRuntimeGate(html) {
-    const document = parse(html);
-    let hasGate = false;
-    let hasGateStyle = false;
-    let hasGateBootstrap = false;
-    walk(document, (element) => {
-        hasGate ||= hasAttr(element, RUNTIME_GATE_MARKER);
-        hasGateStyle ||= hasAttr(element, RUNTIME_GATE_STYLE_MARKER);
-        hasGateBootstrap ||= hasAttr(element, RUNTIME_GATE_BOOTSTRAP_MARKER);
-    });
-    return hasGate && hasGateStyle && hasGateBootstrap;
-}
-function readAttr(element, name) {
-    return element.attrs.find((attr) => attr.name.toLowerCase() === name)?.value;
-}
-function hasAttr(element, name) {
-    return readAttr(element, name) !== undefined;
+/** 仅描述读取时刻的产物；文件没有加锁，发布仍须生成并复核 receipt。 */
+async function inspectVersionArtifact(input) {
+    const distDir = path.join(input.projectRoot, 'dist');
+    const entryHtmlPath = path.join(distDir, 'index.html');
+    const manifestPath = path.join(distDir, 'manifest.json');
+    if (!fs.existsSync(manifestPath))
+        throw new Error('未找到 dist/manifest.json，请在 Vite 配置中显式启用 miniappManifest()');
+    if (!fs.existsSync(entryHtmlPath))
+        throw new Error('未找到 dist/index.html，Vite 构建产物不完整');
+    if (!hasMiniappRuntimeGate(await fs$1.readFile(entryHtmlPath, 'utf8'))) {
+        throw new Error('dist/index.html 缺少平台 Runtime 启动门禁，请在 Vite 配置中显式启用 miniappManifest()');
+    }
+    const { manifest, hadBom } = runtimePermissionEnv.parseMiniappManifestJson(await fs$1.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
+    const validated = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
+    const bindAppIds = validated.bindAppIds ?? [];
+    if (validated.workspaceCards) {
+        verifyWorkspaceCardsSnapshot({ ...validated, bindAppIds, workspaceCards: validated.workspaceCards });
+        verifyWorkspaceCardArtifacts(distDir, validated.workspaceCards);
+    }
+    const declared = input.declarations;
+    if (validated.category !== declared.category) {
+        throw new Error('dist/manifest.json.category 与 package.json#heybox.category 不一致，请重新 build');
+    }
+    if (!runtimePermissionEnv.areMiniappPlatformsEqual(validated.platforms, declared.platforms)) {
+        throw new Error('dist/manifest.json.platforms 与 package.json#heybox.platforms 不一致，请重新 build');
+    }
+    if (!runtimePermissionEnv.areMiniappWindowsEqual(validated.window, declared.window)) {
+        throw new Error('dist/manifest.json.window 与 package.json#heybox.window 不一致，请重新 build');
+    }
+    if (bindAppIds.length !== declared.bindAppIds.length || bindAppIds.some((value, index) => value !== declared.bindAppIds[index])) {
+        throw new Error('dist/manifest.json.bindAppIds 与 package.json#heybox.bindAppIds 不一致，请重新 build');
+    }
+    return {
+        distDir,
+        hadBom,
+        // 上送仍保留原始未知字段，只归一原有 deploy 已处理的字段。
+        manifest: { ...manifest, platforms: validated.platforms, ...(bindAppIds.length === 0 ? {} : { bindAppIds }) },
+        summary: { ...validated, bindAppIds },
+    };
 }
-function walk(node, visit) {
-    if ('tagName' in node)
-        visit(node);
-    if ('childNodes' in node)
-        for (const child of node.childNodes)
-            walk(child, visit);
-    if ('content' in node && node.content)
-        walk(node.content, visit);
+/** 扫描不依赖元数据对象，不能把先前校验误当作文件持续不变的凭证。 */
+async function inspectVersionArtifactFiles(distDir) {
+    const files = [];
+    await walk(distDir, '');
+    const uploadFiles = runtimePermissionEnv.prepareMiniappArtifactFiles(files.filter((file) => runtimePermissionEnv.shouldUploadDistFile(file.relativePath)));
+    const sizeError = runtimePermissionEnv.validateMiniappUploadSizeBudgets(uploadFiles);
+    if (sizeError)
+        throw new Error(sizeError);
+    return { files: uploadFiles, fileCount: uploadFiles.length, totalBytes: uploadFiles.reduce((total, file) => total + file.size, 0) };
+    async function walk(directory, prefix) {
+        for (const entry of await fs$1.readdir(directory, { withFileTypes: true })) {
+            const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const absolutePath = path.join(directory, entry.name);
+            const info = await fs$1.lstat(absolutePath);
+            if (info.isSymbolicLink())
+                throw new Error(`dist 目录包含 symlink，拒绝处理：${relativePath}`);
+            if (relativePath.includes('\\'))
+                throw new Error(`构建产物路径不能包含反斜杠：${relativePath}`);
+            // 在进入目录前检查，因此空的禁用目录同样拒绝。
+            if (runtimePermissionEnv.relativePathContainsNodeModulesSegment(relativePath))
+                throw new Error(`dist 目录含 node_modules：${relativePath}`);
+            if (info.isDirectory())
+                await walk(absolutePath, relativePath);
+            else if (info.isFile())
+                files.push({ relativePath, absolutePath, size: info.size });
+        }
+    }
 }
 
-exports.hasMiniappRuntimeGate = hasMiniappRuntimeGate;
-exports.verifyWorkspaceCardArtifacts = verifyWorkspaceCardArtifacts;
-exports.verifyWorkspaceCardsSnapshot = verifyWorkspaceCardsSnapshot;
+exports.inspectVersionArtifact = inspectVersionArtifact;
+exports.inspectVersionArtifactFiles = inspectVersionArtifactFiles;

package/dist/cli-chunks/{build-DrFbb0V-.cjs → build-BumRaEG6.cjs}

@@ -1,35 +1,32 @@
 'use strict';
 
-var runtimeGate = require('./runtime-gate-BgWB2U5f.cjs');
-var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DmJ1zEpa.cjs');
-var index = require('./index-CF6qh9ll.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DLLffpOa.cjs');
+var index = require('./index-dXb0CRuR.cjs');
 require('node:crypto');
+require('node:fs');
 require('node:zlib');
-var projectVite = require('./project-vite-Dnev8Z34.cjs');
-require('node:module');
-require('node:url');
-require('./_commonjs-dynamic-modules-DUamuDzp.cjs');
-require('fs');
-require('path');
-require('os');
-require('inspector');
-require('./version-C6b3tkax.cjs');
+var artifact = require('./artifact-Dv6zPoPj.cjs');
+var projectVite = require('./project-vite-BkRatXiB.cjs');
+require('./version-hdMctv12.cjs');
 require('node:async_hooks');
+require('node:module');
 require('readline');
+require('os');
 require('tty');
 require('assert');
 require('events');
 require('stream');
 require('buffer');
 require('util');
+require('path');
+require('fs');
 require('constants');
+require('node:url');
+require('./_commonjs-dynamic-modules-DUamuDzp.cjs');
+require('inspector');
 
-function areStringArraysEqual(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 async function runBuildCommand(_options = {}, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
     const projectRoot = projectVite.findProjectRoot(runtime.cwd ?? process.cwd());
@@ -89,84 +86,38 @@ function createFixedBuildOutputPlugin(projectRoot) {
     };
 }
 async function validateBuildOutput(projectRoot, logger, declaredPlatforms, declaredWindow, declaredBindAppIds, declaredCategory) {
-    const distDir = path.join(projectRoot, 'dist');
-    const entryHtmlPath = path.join(distDir, 'index.html');
-    const manifestPath = path.join(distDir, 'manifest.json');
-    if (!fs$1.existsSync(entryHtmlPath)) {
-        throw new Error('未找到 dist/index.html，Vite 构建产物不完整');
-    }
-    if (!fs$1.existsSync(manifestPath)) {
-        throw new Error('未找到 dist/manifest.json，请在 Vite 配置中显式启用 miniappManifest()');
-    }
-    const entryHtml = await fs.readFile(entryHtmlPath, 'utf8');
-    if (!runtimeGate.hasMiniappRuntimeGate(entryHtml)) {
-        throw new Error('dist/index.html 缺少平台 Runtime 启动门禁，请在 Vite 配置中显式启用 miniappManifest()');
-    }
-    const { manifest, hadBom } = runtimePermissionEnv.parseMiniappManifestJson(await fs.readFile(manifestPath, 'utf8'), 'dist/manifest.json');
-    if (hadBom) {
+    const artifact$1 = await artifact.inspectVersionArtifact({
+        projectRoot,
+        declarations: {
+            platforms: declaredPlatforms,
+            window: declaredWindow,
+            bindAppIds: declaredBindAppIds,
+            category: declaredCategory,
+        },
+    });
+    if (artifact$1.hadBom)
         logger.warn('dist/manifest.json 包含 BOM，已自动剥离');
+    let inventory;
+    try {
+        inventory = await artifact.inspectVersionArtifactFiles(artifact$1.distDir);
     }
-    const validated = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
-    if (validated.workspaceCards) {
-        runtimeGate.verifyWorkspaceCardsSnapshot({ ...validated, bindAppIds: validated.bindAppIds ?? [], workspaceCards: validated.workspaceCards });
-        runtimeGate.verifyWorkspaceCardArtifacts(distDir, validated.workspaceCards);
-    }
-    const { platforms, sdkVersion, version, permissions, window } = validated;
-    const bindAppIds = validated.bindAppIds ?? [];
-    if (validated.category !== declaredCategory) {
-        throw new Error('dist/manifest.json.category 与 package.json#heybox.category 不一致，请重新 build');
-    }
-    if (!runtimePermissionEnv.areMiniappPlatformsEqual(platforms, declaredPlatforms)) {
-        throw new Error('dist/manifest.json.platforms 与 package.json#heybox.platforms 不一致，请重新 build');
-    }
-    if (!runtimePermissionEnv.areMiniappWindowsEqual(window, declaredWindow)) {
-        throw new Error('dist/manifest.json.window 与 package.json#heybox.window 不一致，请重新 build');
-    }
-    if (!areStringArraysEqual(bindAppIds, declaredBindAppIds)) {
-        throw new Error('dist/manifest.json.bindAppIds 与 package.json#heybox.bindAppIds 不一致，请重新 build');
-    }
-    const allFiles = await walkDistFiles(distDir);
-    const uploadFiles = allFiles.filter((file) => runtimePermissionEnv.shouldUploadDistFile(file.relativePath));
-    const sizeError = runtimePermissionEnv.validateMiniappUploadSizeBudgets(uploadFiles);
-    if (sizeError) {
-        throw new Error(sizeError.replace('重新 deploy', '重新 build'));
+    catch (error) {
+        if (error instanceof Error)
+            error.message = error.message.replace('重新 deploy', '重新 build');
+        throw error;
     }
+    const { platforms, sdkVersion, version, permissions, bindAppIds } = artifact$1.summary;
     return {
-        distDir,
+        distDir: artifact$1.distDir,
         bindAppIds,
-        fileCount: uploadFiles.length,
+        fileCount: inventory.fileCount,
         sdkVersion,
         platforms,
         ...(permissions === undefined ? {} : { permissions }),
-        totalBytes: uploadFiles.reduce((total, file) => total + file.size, 0),
+        totalBytes: inventory.totalBytes,
         version,
     };
 }
-async function walkDistFiles(distDir) {
-    const results = [];
-    await walk(distDir, '');
-    return results;
-    async function walk(absDir, relDir) {
-        const entries = await fs.readdir(absDir, { withFileTypes: true });
-        for (const entry of entries) {
-            const absPath = path.join(absDir, entry.name);
-            const relPath = runtimePermissionEnv.normalizeRelativePath(relDir ? `${relDir}/${entry.name}` : entry.name);
-            const link = await fs.lstat(absPath);
-            if (link.isSymbolicLink()) {
-                throw new Error(`dist 目录包含 symlink，拒绝处理：${relPath}`);
-            }
-            if (runtimePermissionEnv.relativePathContainsNodeModulesSegment(relPath)) {
-                throw new Error(`dist 目录含 node_modules：${relPath}`);
-            }
-            if (entry.isDirectory()) {
-                await walk(absPath, relPath);
-            }
-            else if (entry.isFile()) {
-                results.push({ relativePath: relPath, size: (await fs.stat(absPath)).size });
-            }
-        }
-    }
-}
 function formatSize(bytes) {
     if (bytes < 1024)
         return `${bytes} B`;

package/dist/cli-chunks/{create-Ccse2SW7.cjs → create-BQimWyVw.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CF6qh9ll.cjs');
+var index = require('./index-dXb0CRuR.cjs');
 require('node:module');
 require('readline');
 require('os');

package/dist/cli-chunks/{deploy-lock-DaGpgsU7.cjs → deploy-lock-C79P53O1.cjs}

@@ -3,7 +3,7 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var index = require('./index-CF6qh9ll.cjs');
+var index = require('./index-dXb0CRuR.cjs');
 
 const DEPLOY_LOCKED_MESSAGE = '当前设备已有同版本产物正在上传，请等待完成后重试';
 const DEPLOY_LOCK_DIRECTORY_NAME = 'deploy-locks';