@heybox/hb-sdk 0.5.17 → 0.6.0

package/dist/cli-chunks/{context-mav2gs13.cjs → sdk-version-policy-B1CFC1Dk.cjs}

@@ -1,9 +1,29 @@
 'use strict';
 
-var session = require('./session-BMSThs93.cjs');
+var session = require('./session-DIcRjyDY.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
+var index = require('./index-CCeHouBU.cjs');
+
+const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
+function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
+    return {
+        path: APIUserMiniprogramPublicSdkConfigPath,
+        searchParams: serviceTag ? { special_tag: serviceTag } : {},
+        headers: serviceTag ? { 'x-rylai-service-tag': serviceTag } : {},
+    };
+}
+function parseUserMiniprogramPublicSdkConfigResult(value) {
+    if (!isRecord(value) ||
+        typeof value.minimum_sdk_version !== 'string') {
+        throw new Error('公共 SDK 配置响应无效');
+    }
+    return value;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
 
 var re = {exports: {}};
 
@@ -2794,6 +2814,7 @@ const MINIAPP_UPLOAD_SCOPE = 'activity';
 const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 const MINIAPP_UPLOAD_BATCH_SIZE = 50;
 const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES = 100 * 1024 * 1024;
+const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = APIUserMiniprogramPublicSdkConfigPath;
 const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = '/mall/developer/user_miniprogram/access_status';
 const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
 const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
@@ -2909,6 +2930,20 @@ function createRemoteApiClient(options) {
         listUserMiniprogramVersions: (requestOptions) => listUserMiniprogramVersions(requestOptions, options),
     };
 }
+async function getPublicSdkConfig(runtime) {
+    const fetchImpl = runtime.fetchImpl ?? fetch;
+    const serviceTag = index.resolveHeyboxRylaiServiceTag(PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH);
+    const request = createUserMiniprogramPublicSdkConfigRequest(serviceTag);
+    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? 'https://api.xiaoheihe.cn', request.path, request.searchParams), {
+        method: 'GET',
+        headers: {
+            Referer: session.HEYBOX_WEB_REFERER,
+            ...request.headers,
+        },
+    });
+    const result = await readRequiredResult(response, request.path);
+    return parseUserMiniprogramPublicSdkConfigResult(result);
+}
 async function listDeveloperEntities(runtime) {
     return remoteGet(DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
 }
@@ -3179,6 +3214,91 @@ function isTruthyEnvFlag(value) {
         .toLowerCase());
 }
 
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
+const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
+async function resolveMinimumSdkVersion(options) {
+    const now = options.now ?? Date.now();
+    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
+    const cache = await readCache(cachePath);
+    let minimumSdkVersion;
+    try {
+        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
+    }
+    catch {
+        const cached = cache.environments[options.environment];
+        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
+        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
+            try {
+                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
+            }
+            catch {
+                // 非法缓存按不存在处理。
+            }
+        }
+        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
+    }
+    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
+    try {
+        await writeCache(cachePath, cache);
+    }
+    catch {
+        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
+    }
+    return minimumSdkVersion;
+}
+function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
+    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
+    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
+    if (!options.allowPrerelease && semverExports.prerelease(current) !== null) {
+        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
+    }
+    if (!semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
+        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
+    }
+    return current;
+}
+function validateSdkVersion(value, label) {
+    const normalized = String(value).trim();
+    const parsed = semverExports.parse(normalized);
+    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
+        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
+    }
+    return normalized;
+}
+function validateStableSdkVersion(value, label) {
+    const normalized = validateSdkVersion(value, label);
+    if (semverExports.prerelease(normalized) !== null)
+        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
+    return normalized;
+}
+async function readCache(cachePath) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(cachePath, 'utf8'));
+        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
+            return parsed;
+    }
+    catch {
+        // 缓存缺失或损坏时继续请求最新配置。
+    }
+    return { environments: {} };
+}
+async function writeCache(cachePath, cache) {
+    await fs.mkdir(path.dirname(cachePath), { recursive: true });
+    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
+    await fs.writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
+    await fs.rename(temporaryPath, cachePath);
+}
+
+const paths = index.envPaths('hb-sdk');
+async function enforceRemoteSdkVersion(options) {
+    const minimumSdkVersion = await resolveMinimumSdkVersion({
+        cacheDir: options.cacheDir ?? paths.cache,
+        environment: options.environment,
+        fetchMinimumSdkVersion: async () => (await getPublicSdkConfig({ baseUrl: options.environment, fetchImpl: options.fetchImpl })).minimum_sdk_version,
+    });
+    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
+}
+
 exports.ACTIVITY_UPLOAD_KEY_MAX_LENGTH = ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
 exports.MINIAPP_UPLOAD_BATCH_SIZE = MINIAPP_UPLOAD_BATCH_SIZE;
 exports.MINIAPP_UPLOAD_SCOPE = MINIAPP_UPLOAD_SCOPE;
@@ -3186,6 +3306,7 @@ exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
 exports.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH = PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
+exports.enforceRemoteSdkVersion = enforceRemoteSdkVersion;
 exports.getBoundMiniProgram = getBoundMiniProgram;
 exports.getMiniappUploadKey = getMiniappUploadKey;
 exports.normalizeRelativePath = normalizeRelativePath;

package/dist/cli-chunks/{session-BMSThs93.cjs → session-DIcRjyDY.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-Dor8wa6R.cjs');
+var index = require('./index-CCeHouBU.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');
@@ -67,57 +67,6 @@ function isTruthyEnvFlag(value) {
         .toLowerCase());
 }
 
-const globalHeyboxCliRequestConfig = {};
-function readHeyboxCliRequestConfig() {
-    return normalizeHeyboxRylaiServiceTagConfig(globalHeyboxCliRequestConfig);
-}
-function resolveHeyboxRylaiServiceTag(pathWithQuery, config = readHeyboxCliRequestConfig()) {
-    const normalized = normalizeHeyboxRylaiServiceTagConfig(config);
-    const pathname = pathWithQuery ? getPathname(pathWithQuery) : '';
-    const specialTag = normalized.special_tag;
-    if (pathname && specialTag?.path_prefix_list.some((prefix) => pathname.startsWith(prefix))) {
-        return specialTag.tag_name;
-    }
-    return normalized.default_tag;
-}
-function normalizeHeyboxRylaiServiceTagConfig(config) {
-    const defaultTag = normalizeHeyboxRylaiServiceTag(config.default_tag);
-    const specialTagName = normalizeHeyboxRylaiServiceTag(config.special_tag?.tag_name);
-    const pathPrefixList = config.special_tag?.path_prefix_list?.filter(isValidPathPrefix) || [];
-    return {
-        ...(defaultTag ? { default_tag: defaultTag } : {}),
-        ...(specialTagName && pathPrefixList.length
-            ? {
-                special_tag: {
-                    tag_name: specialTagName,
-                    path_prefix_list: pathPrefixList,
-                },
-            }
-            : {}),
-    };
-}
-function normalizeHeyboxRylaiServiceTag(value) {
-    const tag = String(value ?? '').trim();
-    if (!tag) {
-        return undefined;
-    }
-    if (/[\r\n]/.test(tag)) {
-        throw new Error('x-rylai-service-tag 不允许包含换行符');
-    }
-    return tag;
-}
-function isValidPathPrefix(value) {
-    return typeof value === 'string' && value.startsWith('/') && !/[\r\n]/.test(value);
-}
-function getPathname(pathWithQuery) {
-    try {
-        return new URL(pathWithQuery, 'https://api.xiaoheihe.cn').pathname;
-    }
-    catch {
-        return '';
-    }
-}
-
 const SIGN_VERSION = '999.0.4';
 const SIGN_CHARSET = 'AB45STUVWZEFGJ6CH01D237IXYPQRKLMN89';
 function createHeyboxOpenPlatformSignParams(pathname, options = {}) {
@@ -217,7 +166,7 @@ function resolveHeyboxId(session) {
         ?.slice('heybox_id='.length);
 }
 function createHeyboxAuthHeaders(session, options = {}) {
-    const serviceTag = resolveHeyboxRylaiServiceTag(options.pathWithQuery);
+    const serviceTag = index.resolveHeyboxRylaiServiceTag(options.pathWithQuery);
     return {
         Cookie: session.cookieHeader,
         Referer: HEYBOX_WEB_REFERER,
@@ -227,7 +176,7 @@ function createHeyboxAuthHeaders(session, options = {}) {
 }
 function createHeyboxRequestContext(session, options = {}) {
     const heyboxId = resolveHeyboxId(session);
-    const serviceTag = resolveHeyboxRylaiServiceTag(options.pathWithQuery);
+    const serviceTag = index.resolveHeyboxRylaiServiceTag(options.pathWithQuery);
     return {
         baseUrl: HEYBOX_API_BASE_URL,
         headers: createHeyboxAuthHeaders(session, options),
@@ -3372,6 +3321,7 @@ function isRecord(value) {
     return Object.prototype.toString.call(value) === '[object Object]';
 }
 
+exports.HEYBOX_WEB_REFERER = HEYBOX_WEB_REFERER;
 exports.clearHeyboxAuthSession = clearHeyboxAuthSession;
 exports.createHeyboxApiUrl = createHeyboxApiUrl;
 exports.createHeyboxAuthSession = createHeyboxAuthSession;

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-Dor8wa6R.cjs');
+var index = require('./cli-chunks/index-CCeHouBU.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/mock-host/index.html

@@ -212,6 +212,42 @@
         overflow: auto;
       }
 
+      .csp-violations {
+        border: 1px solid #dc2626;
+        border-radius: 8px;
+        padding: 12px;
+        color: #7f1d1d;
+        background: #fef2f2;
+      }
+
+      .csp-violations[hidden] {
+        display: none;
+      }
+
+      .csp-violations > strong {
+        display: block;
+        color: #991b1b;
+        font-size: 14px;
+      }
+
+      .csp-violations ol {
+        display: grid;
+        gap: 8px;
+        margin: 8px 0 0;
+        padding-left: 20px;
+      }
+
+      .csp-violations li strong,
+      .csp-violations li span {
+        display: block;
+        overflow-wrap: anywhere;
+      }
+
+      .csp-violations li span {
+        margin-top: 2px;
+        font-size: 12px;
+      }
+
       .log {
         border: 1px solid #d7dee8;
         border-radius: 8px;
@@ -317,6 +353,10 @@
           <strong id="mini-url"></strong>
         </section>
 
+        <section class="csp-violations" id="csp-violations" hidden>
+          <strong>网络或资源请求已被 CSP 阻止</strong>
+        </section>
+
         <section class="block">
           <span>Mac App</span>
           <div class="actions" style="margin-top: 10px">

package/dist/devtools/mock-host/main.js

@@ -4,6 +4,8 @@ const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 const MINI_PROGRAM_MESSAGE_VERSION = 1;
 /** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
+/** SDK 向 Runtime 报告 CSP 违规的内部方法名。 */
+const SDK_CSP_VIOLATION_METHOD = 'sdk.csp.violation';
 
 /**
  * 登录授权能力方法名。
@@ -3373,6 +3375,76 @@ function requireBrowser () {
 
 var browserExports = requireBrowser();
 
+function createCSPViolationPanel(container) {
+    const seen = new Set();
+    const list = document.createElement('ol');
+    container.setAttribute('role', 'alert');
+    container.setAttribute('aria-live', 'assertive');
+    container.appendChild(list);
+    return {
+        report(payload) {
+            if (!isCSPViolationPayload(payload)) {
+                return false;
+            }
+            const key = createViolationKey(payload);
+            if (seen.has(key)) {
+                return false;
+            }
+            seen.add(key);
+            const item = document.createElement('li');
+            const directive = document.createElement('strong');
+            directive.textContent = payload.effectiveDirective;
+            const detail = document.createElement('span');
+            detail.textContent = formatBlockedResource(payload);
+            item.append(directive, detail);
+            list.appendChild(item);
+            container.hidden = false;
+            return true;
+        },
+    };
+}
+function isCSPViolationPayload(payload) {
+    if (!payload || typeof payload !== 'object') {
+        return false;
+    }
+    const candidate = payload;
+    return (typeof candidate.effectiveDirective === 'string' &&
+        typeof candidate.violatedDirective === 'string' &&
+        typeof candidate.disposition === 'string' &&
+        ['url', 'inline', 'eval', 'unknown'].includes(candidate.blockedResourceType ?? '') &&
+        typeof candidate.sdkVersion === 'string' &&
+        typeof candidate.timestamp === 'number' &&
+        isOptionalString(candidate.blockedOrigin) &&
+        isOptionalString(candidate.redactedPathname) &&
+        isOptionalString(candidate.sanitizedPathnameHash));
+}
+function isOptionalString(value) {
+    return value === undefined || typeof value === 'string';
+}
+function createViolationKey(payload) {
+    return [
+        payload.effectiveDirective,
+        payload.violatedDirective,
+        payload.disposition,
+        payload.blockedResourceType,
+        payload.blockedOrigin,
+        payload.redactedPathname,
+        payload.sanitizedPathnameHash,
+    ].join('\n');
+}
+function formatBlockedResource(payload) {
+    if (payload.blockedResourceType === 'url') {
+        return `${payload.blockedOrigin ?? '未知来源'}${payload.redactedPathname ?? ''}`;
+    }
+    if (payload.blockedResourceType === 'inline') {
+        return '内联资源';
+    }
+    if (payload.blockedResourceType === 'eval') {
+        return '动态代码执行';
+    }
+    return '未知资源';
+}
+
 async function getMiniProgramRuntimeUserInfo(platformAdapter) {
     const userId = await resolveCurrentUserId(platformAdapter);
     if (!userId) {
@@ -6211,6 +6283,7 @@ function isPlainRecord(value) {
 
 const NETWORK_PROXY_PATH = '/__hb_sdk_mock_network__';
 const MOCK_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
+const RUNTIME_GATE_PROBE_METHOD = 'runtime.gate.probe';
 const params = new URL(location.href).searchParams;
 const miniUrl = params.get('mini_url');
 let lanAddresses = [];
@@ -6230,6 +6303,7 @@ let currentUser = {
 const elements = {
     bridgeStatus: queryElement('#bridge-status'),
     copyDebugPageUrlButton: queryElement('#copy-debug-page-url-button'),
+    cspViolations: queryElement('#csp-violations'),
     debugPageCopyStatus: queryElement('#debug-page-copy-status'),
     debugPageUrl: queryElement('#debug-page-url'),
     device: queryElement('#device'),
@@ -6244,6 +6318,7 @@ const elements = {
     storageSnapshot: queryElement('#storage-snapshot'),
     userStatus: queryElement('#user-status'),
 };
+const cspViolationPanel = createCSPViolationPanel(elements.cspViolations);
 if (!miniUrl) {
     elements.device.innerHTML = '<div class="error">Missing mini_url query.</div>';
     throw new Error('Missing mini_url query.');
@@ -6323,6 +6398,12 @@ function handleMessage(event) {
     }
     if (message.type === 'request') {
         void handleRequest(message);
+        return;
+    }
+    if (message.type === 'event' && message.method === SDK_CSP_VIOLATION_METHOD) {
+        if (cspViolationPanel.report(message.payload)) {
+            pushLog(message.method, message.payload);
+        }
     }
 }
 function handleHandshake() {
@@ -6344,6 +6425,10 @@ async function handleRequest(message) {
     if (!message.id || !message.method) {
         return;
     }
+    if (!handshaken && message.method === RUNTIME_GATE_PROBE_METHOD) {
+        postResponse(message, { ready: true });
+        return;
+    }
     try {
         const payload = await runtime.runMethod(message.method, message.payload);
         postResponse(message, payload);