@heybox/hb-sdk-protocol 0.8.0-alpha.9 → 0.8.1-alpha.1

package/src/capabilities.ts

@@ -79,6 +79,7 @@ import type {
   VibratePayload,
   VibrateResult,
 } from './payloads';
+import type { MiniProgramPermissionRequirement } from './permission-catalog';
 
 export const AUTH_LOGIN_METHOD = 'auth.login' as const;
 export const USER_GET_INFO_METHOD = 'user.getInfo' as const;
@@ -186,140 +187,254 @@ export interface MiniProgramCapabilityDefinition {
   method: MiniProgramBridgeMethod;
   module: MiniProgramCapabilityModule;
   capability: MiniProgramBridgeMethod;
-  permission: string;
+  requirement: MiniProgramPermissionRequirement;
   risk: MiniProgramCapabilityRisk;
 }
 
 export const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
-  { method: AUTH_LOGIN_METHOD, module: 'auth', capability: AUTH_LOGIN_METHOD, permission: 'auth.login', risk: 'medium' },
-  { method: USER_GET_INFO_METHOD, module: 'user', capability: USER_GET_INFO_METHOD, permission: 'user.getInfo', risk: 'medium' },
+  {
+    method: AUTH_LOGIN_METHOD,
+    module: 'auth',
+    capability: AUTH_LOGIN_METHOD,
+    requirement: { kind: 'all', permissions: ['userInfo'] },
+    risk: 'medium',
+  },
+  {
+    method: USER_GET_INFO_METHOD,
+    module: 'user',
+    capability: USER_GET_INFO_METHOD,
+    requirement: { kind: 'all', permissions: ['userInfo'] },
+    risk: 'medium',
+  },
   {
     method: USER_REVOKE_AUTHORIZATION_METHOD,
     module: 'user',
     capability: USER_REVOKE_AUTHORIZATION_METHOD,
-    permission: 'user.revokeAuthorization',
+    requirement: { kind: 'none' },
     risk: 'high',
   },
   {
     method: USER_GET_STEAM_GAME_LIST_METHOD,
     module: 'user',
     capability: USER_GET_STEAM_GAME_LIST_METHOD,
-    permission: 'user.platformAccount.steam',
+    requirement: { kind: 'all', permissions: ['steamLibrary'] },
     risk: 'high',
   },
-  { method: SHARE_COPY_LINK_METHOD, module: 'share', capability: SHARE_COPY_LINK_METHOD, permission: 'share.copyLink', risk: 'medium' },
-  { method: SHARE_SHOW_SHARE_MENU_METHOD, module: 'share', capability: SHARE_SHOW_SHARE_MENU_METHOD, permission: 'share.basic', risk: 'low' },
-  { method: SHARE_SCREENSHOT_METHOD, module: 'share', capability: SHARE_SCREENSHOT_METHOD, permission: 'share.screenshot', risk: 'medium' },
+  {
+    method: SHARE_COPY_LINK_METHOD,
+    module: 'share',
+    capability: SHARE_COPY_LINK_METHOD,
+    requirement: { kind: 'all', permissions: ['share'] },
+    risk: 'medium',
+  },
+  {
+    method: SHARE_SHOW_SHARE_MENU_METHOD,
+    module: 'share',
+    capability: SHARE_SHOW_SHARE_MENU_METHOD,
+    requirement: { kind: 'all', permissions: ['share'] },
+    risk: 'low',
+  },
+  {
+    method: SHARE_SCREENSHOT_METHOD,
+    module: 'share',
+    capability: SHARE_SCREENSHOT_METHOD,
+    requirement: { kind: 'all', permissions: ['share'] },
+    risk: 'medium',
+  },
   {
     method: VIEWPORT_GET_WINDOW_INFO_METHOD,
     module: 'viewport',
     capability: VIEWPORT_GET_WINDOW_INFO_METHOD,
-    permission: 'viewport.windowInfo',
+    requirement: { kind: 'none' },
     risk: 'low',
   },
   {
     method: VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD,
     module: 'viewport',
     capability: VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD,
-    permission: 'viewport.navigationBarStyle',
+    requirement: { kind: 'none' },
     risk: 'low',
   },
-  { method: STORAGE_GET_STORAGE_METHOD, module: 'storage', capability: STORAGE_GET_STORAGE_METHOD, permission: 'storage.read', risk: 'low' },
-  { method: STORAGE_SET_STORAGE_METHOD, module: 'storage', capability: STORAGE_SET_STORAGE_METHOD, permission: 'storage.write', risk: 'medium' },
-  { method: NETWORK_REQUEST_METHOD, module: 'network', capability: NETWORK_REQUEST_METHOD, permission: 'network.request', risk: 'high' },
-  { method: NETWORK_DOWNLOAD_METHOD, module: 'network', capability: NETWORK_DOWNLOAD_METHOD, permission: 'network.request', risk: 'high' },
-  { method: FILES_PICK_FILES_METHOD, module: 'files', capability: FILES_PICK_FILES_METHOD, permission: 'files.external', risk: 'high' },
+  {
+    method: STORAGE_GET_STORAGE_METHOD,
+    module: 'storage',
+    capability: STORAGE_GET_STORAGE_METHOD,
+    requirement: { kind: 'all', permissions: ['storage'] },
+    risk: 'low',
+  },
+  {
+    method: STORAGE_SET_STORAGE_METHOD,
+    module: 'storage',
+    capability: STORAGE_SET_STORAGE_METHOD,
+    requirement: { kind: 'all', permissions: ['storage'] },
+    risk: 'medium',
+  },
+  {
+    method: NETWORK_REQUEST_METHOD,
+    module: 'network',
+    capability: NETWORK_REQUEST_METHOD,
+    requirement: { kind: 'all', permissions: ['network'] },
+    risk: 'high',
+  },
+  {
+    method: NETWORK_DOWNLOAD_METHOD,
+    module: 'network',
+    capability: NETWORK_DOWNLOAD_METHOD,
+    requirement: { kind: 'all', permissions: ['network', 'filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILES_PICK_FILES_METHOD,
+    module: 'files',
+    capability: FILES_PICK_FILES_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
   {
     method: FILES_PICK_DIRECTORY_METHOD,
     module: 'files',
     capability: FILES_PICK_DIRECTORY_METHOD,
-    permission: 'files.external',
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILES_SAVE_FILE_METHOD,
+    module: 'files',
+    capability: FILES_SAVE_FILE_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILE_CREATE_METHOD,
+    module: 'file',
+    capability: FILE_CREATE_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILE_REMOVE_METHOD,
+    module: 'file',
+    capability: FILE_REMOVE_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILE_EXISTS_METHOD,
+    module: 'file',
+    capability: FILE_EXISTS_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILE_READ_TEXT_METHOD,
+    module: 'file',
+    capability: FILE_READ_TEXT_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILE_WRITE_TEXT_METHOD,
+    module: 'file',
+    capability: FILE_WRITE_TEXT_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: FILE_READ_BYTES_METHOD,
+    module: 'file',
+    capability: FILE_READ_BYTES_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
     risk: 'high',
   },
-  { method: FILES_SAVE_FILE_METHOD, module: 'files', capability: FILES_SAVE_FILE_METHOD, permission: 'files.external', risk: 'high' },
-  { method: FILE_CREATE_METHOD, module: 'file', capability: FILE_CREATE_METHOD, permission: 'files.access', risk: 'high' },
-  { method: FILE_REMOVE_METHOD, module: 'file', capability: FILE_REMOVE_METHOD, permission: 'files.access', risk: 'high' },
-  { method: FILE_EXISTS_METHOD, module: 'file', capability: FILE_EXISTS_METHOD, permission: 'files.access', risk: 'high' },
-  { method: FILE_READ_TEXT_METHOD, module: 'file', capability: FILE_READ_TEXT_METHOD, permission: 'files.access', risk: 'high' },
-  { method: FILE_WRITE_TEXT_METHOD, module: 'file', capability: FILE_WRITE_TEXT_METHOD, permission: 'files.access', risk: 'high' },
-  { method: FILE_READ_BYTES_METHOD, module: 'file', capability: FILE_READ_BYTES_METHOD, permission: 'files.access', risk: 'high' },
-  { method: FILE_WRITE_BYTES_METHOD, module: 'file', capability: FILE_WRITE_BYTES_METHOD, permission: 'files.access', risk: 'high' },
-  { method: FILE_STAT_METHOD, module: 'file', capability: FILE_STAT_METHOD, permission: 'files.access', risk: 'high' },
+  {
+    method: FILE_WRITE_BYTES_METHOD,
+    module: 'file',
+    capability: FILE_WRITE_BYTES_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  { method: FILE_STAT_METHOD, module: 'file', capability: FILE_STAT_METHOD, requirement: { kind: 'all', permissions: ['filesystem'] }, risk: 'high' },
   {
     method: DIRECTORY_CREATE_METHOD,
     module: 'directory',
     capability: DIRECTORY_CREATE_METHOD,
-    permission: 'files.access',
+    requirement: { kind: 'all', permissions: ['filesystem'] },
     risk: 'high',
   },
   {
     method: DIRECTORY_REMOVE_METHOD,
     module: 'directory',
     capability: DIRECTORY_REMOVE_METHOD,
-    permission: 'files.access',
+    requirement: { kind: 'all', permissions: ['filesystem'] },
     risk: 'high',
   },
   {
     method: DIRECTORY_EXISTS_METHOD,
     module: 'directory',
     capability: DIRECTORY_EXISTS_METHOD,
-    permission: 'files.access',
+    requirement: { kind: 'all', permissions: ['filesystem'] },
+    risk: 'high',
+  },
+  {
+    method: DIRECTORY_LIST_METHOD,
+    module: 'directory',
+    capability: DIRECTORY_LIST_METHOD,
+    requirement: { kind: 'all', permissions: ['filesystem'] },
     risk: 'high',
   },
-  { method: DIRECTORY_LIST_METHOD, module: 'directory', capability: DIRECTORY_LIST_METHOD, permission: 'files.access', risk: 'high' },
-  { method: UI_SHOW_TOAST_METHOD, module: 'ui', capability: UI_SHOW_TOAST_METHOD, permission: 'ui.toast', risk: 'low' },
-  { method: UI_SHOW_LOADING_METHOD, module: 'ui', capability: UI_SHOW_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
-  { method: UI_HIDE_LOADING_METHOD, module: 'ui', capability: UI_HIDE_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
-  { method: DEVICE_VIBRATE_METHOD, module: 'device', capability: DEVICE_VIBRATE_METHOD, permission: 'device.vibrate', risk: 'low' },
+  { method: UI_SHOW_TOAST_METHOD, module: 'ui', capability: UI_SHOW_TOAST_METHOD, requirement: { kind: 'none' }, risk: 'low' },
+  { method: UI_SHOW_LOADING_METHOD, module: 'ui', capability: UI_SHOW_LOADING_METHOD, requirement: { kind: 'none' }, risk: 'low' },
+  { method: UI_HIDE_LOADING_METHOD, module: 'ui', capability: UI_HIDE_LOADING_METHOD, requirement: { kind: 'none' }, risk: 'low' },
+  { method: DEVICE_VIBRATE_METHOD, module: 'device', capability: DEVICE_VIBRATE_METHOD, requirement: { kind: 'none' }, risk: 'low' },
   {
     method: DEVICE_SET_CLIPBOARD_METHOD,
     module: 'device',
     capability: DEVICE_SET_CLIPBOARD_METHOD,
-    permission: 'device.clipboard.write',
+    requirement: { kind: 'all', permissions: ['clipboard'] },
     risk: 'medium',
   },
-  { method: NAVIGATION_CLOSE_METHOD, module: 'navigation', capability: NAVIGATION_CLOSE_METHOD, permission: 'navigation.close', risk: 'medium' },
-  { method: NAVIGATION_RELOAD_METHOD, module: 'navigation', capability: NAVIGATION_RELOAD_METHOD, permission: 'navigation.reload', risk: 'medium' },
+  { method: NAVIGATION_CLOSE_METHOD, module: 'navigation', capability: NAVIGATION_CLOSE_METHOD, requirement: { kind: 'none' }, risk: 'medium' },
+  { method: NAVIGATION_RELOAD_METHOD, module: 'navigation', capability: NAVIGATION_RELOAD_METHOD, requirement: { kind: 'none' }, risk: 'medium' },
   {
     method: NAVIGATION_OPEN_APP_PAGE_METHOD,
     module: 'navigation',
     capability: NAVIGATION_OPEN_APP_PAGE_METHOD,
-    permission: 'navigation.openAppPage',
+    requirement: { kind: 'none' },
     risk: 'medium',
   },
   {
     method: CLOUD_LEADERBOARD_SUBMIT_METHOD,
     module: 'cloud',
     capability: CLOUD_LEADERBOARD_SUBMIT_METHOD,
-    permission: 'cloud.leaderboard.write',
+    requirement: { kind: 'all', permissions: ['leaderboard'] },
     risk: 'medium',
   },
   {
     method: CLOUD_LEADERBOARD_GET_LIST_METHOD,
     module: 'cloud',
     capability: CLOUD_LEADERBOARD_GET_LIST_METHOD,
-    permission: 'cloud.leaderboard.read',
+    requirement: { kind: 'all', permissions: ['leaderboard'] },
     risk: 'low',
   },
   {
     method: CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD,
     module: 'cloud',
     capability: CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD,
-    permission: 'cloud.leaderboard.currentUserEntry.read',
+    requirement: { kind: 'all', permissions: ['leaderboard'] },
     risk: 'medium',
   },
   {
     method: CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD,
     module: 'cloud',
     capability: CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD,
-    permission: 'cloud.leaderboard.currentUserEntry.delete',
+    requirement: { kind: 'all', permissions: ['leaderboard'] },
     risk: 'medium',
   },
   {
     method: CLOUD_LEADERBOARD_GET_INFO_METHOD,
     module: 'cloud',
     capability: CLOUD_LEADERBOARD_GET_INFO_METHOD,
-    permission: 'cloud.leaderboard.info.read',
+    requirement: { kind: 'all', permissions: ['leaderboard'] },
     risk: 'low',
   },
 ] as const satisfies readonly MiniProgramCapabilityDefinition[];

package/src/index.ts

@@ -3,4 +3,5 @@ export * from './capabilities';
 export * from './constants';
 export * from './guards';
 export * from './payloads';
+export * from './permission-catalog';
 export * from './permissions';

package/src/permission-catalog.ts

@@ -0,0 +1,168 @@
+import type { MiniProgramBridgeMethod, MiniProgramCapabilityRisk } from './capabilities';
+
+export const MINI_PROGRAM_PERMISSION_KEYS = [
+  'userInfo',
+  'steamLibrary',
+  'share',
+  'storage',
+  'filesystem',
+  'clipboard',
+  'leaderboard',
+  'network',
+] as const;
+
+export type MiniProgramPermissionKey = (typeof MINI_PROGRAM_PERMISSION_KEYS)[number];
+export type MiniProgramPermissionRequirement =
+  | { readonly kind: 'none' }
+  | { readonly kind: 'all'; readonly permissions: readonly MiniProgramPermissionKey[] };
+export type MiniProgramPermissionAccess = 'declaration' | 'platform-approval';
+
+export interface MiniProgramPermissionConfigFieldDefinition {
+  readonly type: 'boolean';
+  readonly required: boolean;
+  readonly default: boolean;
+  readonly description: string;
+}
+
+export interface MiniProgramPermissionDefinition {
+  readonly key: MiniProgramPermissionKey;
+  readonly name: string;
+  readonly description: string;
+  readonly access: MiniProgramPermissionAccess;
+  readonly risk: MiniProgramCapabilityRisk;
+  readonly config: Readonly<Record<string, MiniProgramPermissionConfigFieldDefinition>>;
+  readonly methods: readonly MiniProgramBridgeMethod[];
+  readonly conditions: readonly string[];
+}
+
+export const MINI_PROGRAM_PERMISSION_CATALOG = [
+  {
+    key: 'userInfo',
+    name: '用户信息',
+    description: '登录小程序并读取当前用户的授权信息。',
+    access: 'declaration',
+    risk: 'medium',
+    config: {},
+    methods: ['auth.login', 'user.getInfo'],
+    conditions: ['继续执行黑盒登录、用户授权和可信手势规则。'],
+  },
+  {
+    key: 'steamLibrary',
+    name: 'Steam 游戏库',
+    description: '读取当前用户授权的 Steam 游戏库。',
+    access: 'declaration',
+    risk: 'high',
+    config: {},
+    methods: ['user.getSteamGameList'],
+    conditions: ['继续执行账号绑定和数据可用性规则。'],
+  },
+  {
+    key: 'share',
+    name: '分享',
+    description: '使用小程序分享、分享菜单和截图能力。',
+    access: 'declaration',
+    risk: 'medium',
+    config: {},
+    methods: ['share.copyLink', 'share.showShareMenu', 'share.screenshot'],
+    conditions: ['继续执行分享参数校验和 Host 支持检查。'],
+  },
+  {
+    key: 'storage',
+    name: '键值存储',
+    description: '读写按小程序隔离的简单键值数据。',
+    access: 'declaration',
+    risk: 'medium',
+    config: {},
+    methods: ['storage.getStorage', 'storage.setStorage'],
+    conditions: ['仅用于简单键值存储，不包含文件系统。'],
+  },
+  {
+    key: 'filesystem',
+    name: '文件系统',
+    description: '访问小程序沙盒文件和用户选择的外部文件。',
+    access: 'declaration',
+    risk: 'high',
+    config: {},
+    methods: [
+      'network.download',
+      'files.pickFiles',
+      'files.pickDirectory',
+      'files.saveFile',
+      'file.create',
+      'file.remove',
+      'file.exists',
+      'file.readText',
+      'file.writeText',
+      'file.readBytes',
+      'file.writeBytes',
+      'file.stat',
+      'directory.create',
+      'directory.remove',
+      'directory.exists',
+      'directory.list',
+    ],
+    conditions: ['外部文件继续要求有效的用户选择、会话句柄和匹配的读写模式。'],
+  },
+  {
+    key: 'clipboard',
+    name: '剪贴板',
+    description: '向系统剪贴板写入文本。',
+    access: 'declaration',
+    risk: 'medium',
+    config: {},
+    methods: ['device.setClipboard'],
+    conditions: ['继续执行文本长度和 Host 支持限制。'],
+  },
+  {
+    key: 'leaderboard',
+    name: '排行榜',
+    description: '读写小程序云排行榜。',
+    access: 'declaration',
+    risk: 'medium',
+    config: {},
+    methods: [
+      'cloud.leaderboard.submit',
+      'cloud.leaderboard.getList',
+      'cloud.leaderboard.getCurrentUserEntry',
+      'cloud.leaderboard.deleteCurrentUserEntry',
+      'cloud.leaderboard.getInfo',
+    ],
+    conditions: ['排行榜必须已创建，用户和资源规则保持不变。'],
+  },
+  {
+    key: 'network',
+    name: '网络',
+    description: '通过 network 模块请求或下载外部资源。',
+    access: 'platform-approval',
+    risk: 'high',
+    config: {
+      useOfficialDomain: {
+        type: 'boolean',
+        required: false,
+        default: false,
+        description: '是否申请访问小黑盒官方域名。',
+      },
+    },
+    methods: ['network.request', 'network.download'],
+    conditions: ['声明后仍需平台批准，并继续执行网络安全策略。'],
+  },
+] as const satisfies readonly MiniProgramPermissionDefinition[];
+
+export const MINI_PROGRAM_NO_DECLARATION_METHODS = [
+  'user.revokeAuthorization',
+  'ui.showToast',
+  'ui.showLoading',
+  'ui.hideLoading',
+  'viewport.getWindowInfo',
+  'viewport.setNavigationBarStyle',
+  'device.vibrate',
+  'navigation.close',
+  'navigation.reload',
+  'navigation.openAppPage',
+] as const satisfies readonly MiniProgramBridgeMethod[];
+
+const PERMISSION_KEY_SET = new Set<string>(MINI_PROGRAM_PERMISSION_KEYS);
+
+export function isMiniProgramPermissionKey(key: string): key is MiniProgramPermissionKey {
+  return PERMISSION_KEY_SET.has(key);
+}

package/src/permissions.ts

@@ -1,11 +1,13 @@
-const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
+import { MINI_PROGRAM_PERMISSION_KEYS, type MiniProgramPermissionKey } from './permission-catalog';
 
-export function isManagedMiniProgramRuntimePermissionKey(key: string) {
+const MANAGED_RUNTIME_PERMISSION_KEYS = new Set<string>(MINI_PROGRAM_PERMISSION_KEYS);
+
+export function isManagedMiniProgramRuntimePermissionKey(key: string): key is MiniProgramPermissionKey {
   return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
 }
 export type MiniProgramRuntimePermissionStatus = 'enabled' | 'disabled';
 export interface MiniProgramRuntimePermissionEntry {
-  key: string;
+  key: MiniProgramPermissionKey;
   status: MiniProgramRuntimePermissionStatus;
   config: Record<string, unknown>;
 }
@@ -16,7 +18,7 @@ export interface MiniProgramRuntimePermissionsSnapshot {
 }
 export interface ParsedMiniProgramRuntimePermissions {
   valid: boolean;
-  permissions: Record<string, MiniProgramRuntimePermissionEntry>;
+  permissions: Partial<Record<MiniProgramPermissionKey, MiniProgramRuntimePermissionEntry>>;
 }
 
 export function parseMiniProgramRuntimePermissions(snapshot: unknown): ParsedMiniProgramRuntimePermissions {
@@ -28,24 +30,40 @@ export function parseMiniProgramRuntimePermissions(snapshot: unknown): ParsedMin
   }
 
   const seenKeys = new Set<string>();
-  const permissions: Record<string, MiniProgramRuntimePermissionEntry> = {};
+  const permissions: Partial<Record<MiniProgramPermissionKey, MiniProgramRuntimePermissionEntry>> = {};
   for (const rawEntry of snapshot.entries) {
     if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
       return { valid: false, permissions: {} };
     }
-    const key = rawEntry.key.trim();
-    if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
+    const inputKey = rawEntry.key.trim();
+    const key = inputKey === 'network.request' ? 'network' : inputKey;
+    if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled')) {
       return { valid: false, permissions: {} };
     }
     seenKeys.add(key);
-    if (!isManagedMiniProgramRuntimePermissionKey(key)) continue;
-    if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
+    if (!isManagedMiniProgramRuntimePermissionKey(key)) {
+      if (!isRecord(rawEntry.config)) return { valid: false, permissions: {} };
+      continue;
+    }
+    if (key === 'network') {
+      const config = rawEntry.config;
+      if (!isRecord(config) || typeof config.useOfficialDomain !== 'boolean') {
+        return { valid: false, permissions: {} };
+      }
+      permissions[key] = {
+        key,
+        status: rawEntry.status,
+        config: { useOfficialDomain: config.useOfficialDomain },
+      };
+      continue;
+    }
+    if (rawEntry.config !== null && rawEntry.config !== undefined && (!isRecord(rawEntry.config) || Object.keys(rawEntry.config).length > 0)) {
       return { valid: false, permissions: {} };
     }
     permissions[key] = {
       key,
       status: rawEntry.status,
-      config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
+      config: {},
     };
   }
   return { valid: true, permissions };