@heybox/hb-sdk 0.5.18 → 0.6.0

package/dist/cli-chunks/{context-CKJlNcSN.cjs → sdk-version-policy-B1CFC1Dk.cjs}

@@ -1,9 +1,29 @@
 'use strict';
 
-var session = require('./session-dRGPpyS1.cjs');
+var session = require('./session-DIcRjyDY.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
+var index = require('./index-CCeHouBU.cjs');
+
+const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
+function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
+    return {
+        path: APIUserMiniprogramPublicSdkConfigPath,
+        searchParams: serviceTag ? { special_tag: serviceTag } : {},
+        headers: serviceTag ? { 'x-rylai-service-tag': serviceTag } : {},
+    };
+}
+function parseUserMiniprogramPublicSdkConfigResult(value) {
+    if (!isRecord(value) ||
+        typeof value.minimum_sdk_version !== 'string') {
+        throw new Error('公共 SDK 配置响应无效');
+    }
+    return value;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
 
 var re = {exports: {}};
 
@@ -2794,6 +2814,7 @@ const MINIAPP_UPLOAD_SCOPE = 'activity';
 const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 const MINIAPP_UPLOAD_BATCH_SIZE = 50;
 const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES = 100 * 1024 * 1024;
+const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = APIUserMiniprogramPublicSdkConfigPath;
 const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = '/mall/developer/user_miniprogram/access_status';
 const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
 const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
@@ -2909,6 +2930,20 @@ function createRemoteApiClient(options) {
         listUserMiniprogramVersions: (requestOptions) => listUserMiniprogramVersions(requestOptions, options),
     };
 }
+async function getPublicSdkConfig(runtime) {
+    const fetchImpl = runtime.fetchImpl ?? fetch;
+    const serviceTag = index.resolveHeyboxRylaiServiceTag(PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH);
+    const request = createUserMiniprogramPublicSdkConfigRequest(serviceTag);
+    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? 'https://api.xiaoheihe.cn', request.path, request.searchParams), {
+        method: 'GET',
+        headers: {
+            Referer: session.HEYBOX_WEB_REFERER,
+            ...request.headers,
+        },
+    });
+    const result = await readRequiredResult(response, request.path);
+    return parseUserMiniprogramPublicSdkConfigResult(result);
+}
 async function listDeveloperEntities(runtime) {
     return remoteGet(DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
 }
@@ -3179,6 +3214,91 @@ function isTruthyEnvFlag(value) {
         .toLowerCase());
 }
 
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
+const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
+async function resolveMinimumSdkVersion(options) {
+    const now = options.now ?? Date.now();
+    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
+    const cache = await readCache(cachePath);
+    let minimumSdkVersion;
+    try {
+        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
+    }
+    catch {
+        const cached = cache.environments[options.environment];
+        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
+        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
+            try {
+                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
+            }
+            catch {
+                // 非法缓存按不存在处理。
+            }
+        }
+        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
+    }
+    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
+    try {
+        await writeCache(cachePath, cache);
+    }
+    catch {
+        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
+    }
+    return minimumSdkVersion;
+}
+function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
+    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
+    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
+    if (!options.allowPrerelease && semverExports.prerelease(current) !== null) {
+        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
+    }
+    if (!semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
+        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
+    }
+    return current;
+}
+function validateSdkVersion(value, label) {
+    const normalized = String(value).trim();
+    const parsed = semverExports.parse(normalized);
+    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
+        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
+    }
+    return normalized;
+}
+function validateStableSdkVersion(value, label) {
+    const normalized = validateSdkVersion(value, label);
+    if (semverExports.prerelease(normalized) !== null)
+        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
+    return normalized;
+}
+async function readCache(cachePath) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(cachePath, 'utf8'));
+        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
+            return parsed;
+    }
+    catch {
+        // 缓存缺失或损坏时继续请求最新配置。
+    }
+    return { environments: {} };
+}
+async function writeCache(cachePath, cache) {
+    await fs.mkdir(path.dirname(cachePath), { recursive: true });
+    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
+    await fs.writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
+    await fs.rename(temporaryPath, cachePath);
+}
+
+const paths = index.envPaths('hb-sdk');
+async function enforceRemoteSdkVersion(options) {
+    const minimumSdkVersion = await resolveMinimumSdkVersion({
+        cacheDir: options.cacheDir ?? paths.cache,
+        environment: options.environment,
+        fetchMinimumSdkVersion: async () => (await getPublicSdkConfig({ baseUrl: options.environment, fetchImpl: options.fetchImpl })).minimum_sdk_version,
+    });
+    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
+}
+
 exports.ACTIVITY_UPLOAD_KEY_MAX_LENGTH = ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
 exports.MINIAPP_UPLOAD_BATCH_SIZE = MINIAPP_UPLOAD_BATCH_SIZE;
 exports.MINIAPP_UPLOAD_SCOPE = MINIAPP_UPLOAD_SCOPE;
@@ -3186,6 +3306,7 @@ exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
 exports.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH = PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
+exports.enforceRemoteSdkVersion = enforceRemoteSdkVersion;
 exports.getBoundMiniProgram = getBoundMiniProgram;
 exports.getMiniappUploadKey = getMiniappUploadKey;
 exports.normalizeRelativePath = normalizeRelativePath;

package/dist/cli-chunks/{session-dRGPpyS1.cjs → session-DIcRjyDY.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-CsOcGUzF.cjs');
+var index = require('./index-CCeHouBU.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');
@@ -3321,6 +3321,7 @@ function isRecord(value) {
     return Object.prototype.toString.call(value) === '[object Object]';
 }
 
+exports.HEYBOX_WEB_REFERER = HEYBOX_WEB_REFERER;
 exports.clearHeyboxAuthSession = clearHeyboxAuthSession;
 exports.createHeyboxApiUrl = createHeyboxApiUrl;
 exports.createHeyboxAuthSession = createHeyboxAuthSession;

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-CsOcGUzF.cjs');
+var index = require('./cli-chunks/index-CCeHouBU.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/mock-host/index.html

@@ -212,6 +212,42 @@
         overflow: auto;
       }
 
+      .csp-violations {
+        border: 1px solid #dc2626;
+        border-radius: 8px;
+        padding: 12px;
+        color: #7f1d1d;
+        background: #fef2f2;
+      }
+
+      .csp-violations[hidden] {
+        display: none;
+      }
+
+      .csp-violations > strong {
+        display: block;
+        color: #991b1b;
+        font-size: 14px;
+      }
+
+      .csp-violations ol {
+        display: grid;
+        gap: 8px;
+        margin: 8px 0 0;
+        padding-left: 20px;
+      }
+
+      .csp-violations li strong,
+      .csp-violations li span {
+        display: block;
+        overflow-wrap: anywhere;
+      }
+
+      .csp-violations li span {
+        margin-top: 2px;
+        font-size: 12px;
+      }
+
       .log {
         border: 1px solid #d7dee8;
         border-radius: 8px;
@@ -317,6 +353,10 @@
           <strong id="mini-url"></strong>
         </section>
 
+        <section class="csp-violations" id="csp-violations" hidden>
+          <strong>网络或资源请求已被 CSP 阻止</strong>
+        </section>
+
         <section class="block">
           <span>Mac App</span>
           <div class="actions" style="margin-top: 10px">

package/dist/devtools/mock-host/main.js

@@ -4,6 +4,8 @@ const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 const MINI_PROGRAM_MESSAGE_VERSION = 1;
 /** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
+/** SDK 向 Runtime 报告 CSP 违规的内部方法名。 */
+const SDK_CSP_VIOLATION_METHOD = 'sdk.csp.violation';
 
 /**
  * 登录授权能力方法名。
@@ -3373,6 +3375,76 @@ function requireBrowser () {
 
 var browserExports = requireBrowser();
 
+function createCSPViolationPanel(container) {
+    const seen = new Set();
+    const list = document.createElement('ol');
+    container.setAttribute('role', 'alert');
+    container.setAttribute('aria-live', 'assertive');
+    container.appendChild(list);
+    return {
+        report(payload) {
+            if (!isCSPViolationPayload(payload)) {
+                return false;
+            }
+            const key = createViolationKey(payload);
+            if (seen.has(key)) {
+                return false;
+            }
+            seen.add(key);
+            const item = document.createElement('li');
+            const directive = document.createElement('strong');
+            directive.textContent = payload.effectiveDirective;
+            const detail = document.createElement('span');
+            detail.textContent = formatBlockedResource(payload);
+            item.append(directive, detail);
+            list.appendChild(item);
+            container.hidden = false;
+            return true;
+        },
+    };
+}
+function isCSPViolationPayload(payload) {
+    if (!payload || typeof payload !== 'object') {
+        return false;
+    }
+    const candidate = payload;
+    return (typeof candidate.effectiveDirective === 'string' &&
+        typeof candidate.violatedDirective === 'string' &&
+        typeof candidate.disposition === 'string' &&
+        ['url', 'inline', 'eval', 'unknown'].includes(candidate.blockedResourceType ?? '') &&
+        typeof candidate.sdkVersion === 'string' &&
+        typeof candidate.timestamp === 'number' &&
+        isOptionalString(candidate.blockedOrigin) &&
+        isOptionalString(candidate.redactedPathname) &&
+        isOptionalString(candidate.sanitizedPathnameHash));
+}
+function isOptionalString(value) {
+    return value === undefined || typeof value === 'string';
+}
+function createViolationKey(payload) {
+    return [
+        payload.effectiveDirective,
+        payload.violatedDirective,
+        payload.disposition,
+        payload.blockedResourceType,
+        payload.blockedOrigin,
+        payload.redactedPathname,
+        payload.sanitizedPathnameHash,
+    ].join('\n');
+}
+function formatBlockedResource(payload) {
+    if (payload.blockedResourceType === 'url') {
+        return `${payload.blockedOrigin ?? '未知来源'}${payload.redactedPathname ?? ''}`;
+    }
+    if (payload.blockedResourceType === 'inline') {
+        return '内联资源';
+    }
+    if (payload.blockedResourceType === 'eval') {
+        return '动态代码执行';
+    }
+    return '未知资源';
+}
+
 async function getMiniProgramRuntimeUserInfo(platformAdapter) {
     const userId = await resolveCurrentUserId(platformAdapter);
     if (!userId) {
@@ -6211,6 +6283,7 @@ function isPlainRecord(value) {
 
 const NETWORK_PROXY_PATH = '/__hb_sdk_mock_network__';
 const MOCK_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
+const RUNTIME_GATE_PROBE_METHOD = 'runtime.gate.probe';
 const params = new URL(location.href).searchParams;
 const miniUrl = params.get('mini_url');
 let lanAddresses = [];
@@ -6230,6 +6303,7 @@ let currentUser = {
 const elements = {
     bridgeStatus: queryElement('#bridge-status'),
     copyDebugPageUrlButton: queryElement('#copy-debug-page-url-button'),
+    cspViolations: queryElement('#csp-violations'),
     debugPageCopyStatus: queryElement('#debug-page-copy-status'),
     debugPageUrl: queryElement('#debug-page-url'),
     device: queryElement('#device'),
@@ -6244,6 +6318,7 @@ const elements = {
     storageSnapshot: queryElement('#storage-snapshot'),
     userStatus: queryElement('#user-status'),
 };
+const cspViolationPanel = createCSPViolationPanel(elements.cspViolations);
 if (!miniUrl) {
     elements.device.innerHTML = '<div class="error">Missing mini_url query.</div>';
     throw new Error('Missing mini_url query.');
@@ -6323,6 +6398,12 @@ function handleMessage(event) {
     }
     if (message.type === 'request') {
         void handleRequest(message);
+        return;
+    }
+    if (message.type === 'event' && message.method === SDK_CSP_VIOLATION_METHOD) {
+        if (cspViolationPanel.report(message.payload)) {
+            pushLog(message.method, message.payload);
+        }
     }
 }
 function handleHandshake() {
@@ -6344,6 +6425,10 @@ async function handleRequest(message) {
     if (!message.id || !message.method) {
         return;
     }
+    if (!handshaken && message.method === RUNTIME_GATE_PROBE_METHOD) {
+        postResponse(message, { ready: true });
+        return;
+    }
     try {
         const payload = await runtime.runMethod(message.method, message.payload);
         postResponse(message, payload);

package/dist/index.cjs.js

@@ -74,6 +74,54 @@ class HbMiniProgramNetworkError extends Error {
     }
 }
 
+/** 将浏览器 CSP 事件转换为不包含原始 URL 敏感部分的 bridge 载荷。 */
+async function createCSPViolationPayload(event, baseHref, sdkVersion, cryptoImplementation) {
+    const { pathnameForHash, ...blockedResource } = normalizeBlockedResource(event.blockedURI, baseHref);
+    return {
+        effectiveDirective: event.effectiveDirective,
+        violatedDirective: event.violatedDirective,
+        disposition: event.disposition,
+        ...blockedResource,
+        sanitizedPathnameHash: pathnameForHash
+            ? await hashPathname(pathnameForHash, cryptoImplementation)
+            : undefined,
+        sdkVersion,
+        timestamp: Date.now(),
+    };
+}
+function normalizeBlockedResource(blockedURI, baseHref) {
+    if (blockedURI === 'inline' || blockedURI === 'eval' || blockedURI === 'wasm-eval') {
+        return {
+            blockedResourceType: blockedURI === 'inline' ? 'inline' : 'eval',
+        };
+    }
+    if (!blockedURI) {
+        return { blockedResourceType: 'unknown' };
+    }
+    try {
+        const url = new URL(blockedURI, baseHref);
+        const segmentCount = url.pathname.split('/').filter(Boolean).length;
+        return {
+            blockedResourceType: 'url',
+            blockedOrigin: url.origin === 'null' ? undefined : url.origin,
+            redactedPathname: segmentCount === 0 ? '/' : `/${Array(segmentCount).fill(':segment').join('/')}`,
+            pathnameForHash: url.pathname,
+        };
+    }
+    catch {
+        return { blockedResourceType: 'unknown' };
+    }
+}
+async function hashPathname(pathname, cryptoImplementation) {
+    try {
+        const digest = await cryptoImplementation.subtle.digest('SHA-256', new TextEncoder().encode(pathname));
+        return Array.from(new Uint8Array(digest), value => value.toString(16).padStart(2, '0')).join('');
+    }
+    catch {
+        return undefined;
+    }
+}
+
 /** SDK 内部事件总线，负责管理沙盒生命周期与业务事件监听。 */
 class MiniProgramEventBus {
     eventHandlers = new Map();
@@ -107,6 +155,100 @@ class MiniProgramEventBus {
     }
 }
 
+const historyObservers = new WeakMap();
+/** 共享同一个 History patch，并在最后一个订阅者退出时精确恢复原属性。 */
+function subscribeHistoryChanges(history, listener) {
+    let state = historyObservers.get(history);
+    if (!state) {
+        state = createHistoryObserver(history);
+        if (!state) {
+            return () => undefined;
+        }
+        historyObservers.set(history, state);
+    }
+    state.listeners.add(listener);
+    let active = true;
+    return () => {
+        if (!active) {
+            return;
+        }
+        active = false;
+        state.listeners.delete(listener);
+        if (state.listeners.size === 0) {
+            restoreHistoryObserver(history, state);
+            historyObservers.delete(history);
+        }
+    };
+}
+function createHistoryObserver(history) {
+    const listeners = new Set();
+    const originalPushState = readOriginalMethod(history, 'pushState');
+    const originalReplaceState = readOriginalMethod(history, 'replaceState');
+    const notify = () => {
+        [...listeners].forEach(currentListener => {
+            try {
+                currentListener();
+            }
+            catch {
+                // 单个 SDK 诊断失败不能影响 History API 或其他订阅者。
+            }
+        });
+    };
+    const patchedPushState = (...args) => {
+        originalPushState.value.apply(history, args);
+        notify();
+    };
+    const patchedReplaceState = (...args) => {
+        originalReplaceState.value.apply(history, args);
+        notify();
+    };
+    const state = {
+        listeners,
+        originalPushState,
+        originalReplaceState,
+        patchedPushState,
+        patchedReplaceState,
+    };
+    try {
+        definePatchedMethod(history, 'pushState', patchedPushState, originalPushState.descriptor);
+        definePatchedMethod(history, 'replaceState', patchedReplaceState, originalReplaceState.descriptor);
+        return state;
+    }
+    catch {
+        restoreHistoryObserver(history, state);
+        return undefined;
+    }
+}
+function readOriginalMethod(history, name) {
+    return {
+        descriptor: Object.getOwnPropertyDescriptor(history, name),
+        value: history[name],
+    };
+}
+function definePatchedMethod(history, name, value, originalDescriptor) {
+    Object.defineProperty(history, name, {
+        configurable: true,
+        enumerable: originalDescriptor?.enumerable ?? false,
+        writable: true,
+        value,
+    });
+}
+function restoreHistoryObserver(history, state) {
+    restoreMethod(history, 'pushState', state.patchedPushState, state.originalPushState);
+    restoreMethod(history, 'replaceState', state.patchedReplaceState, state.originalReplaceState);
+}
+function restoreMethod(history, name, patchedValue, original) {
+    if (history[name] !== patchedValue) {
+        return;
+    }
+    if (original.descriptor) {
+        Object.defineProperty(history, name, original.descriptor);
+    }
+    else {
+        delete history[name];
+    }
+}
+
 /** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 /** 小程序沙盒通信协议版本。 */
@@ -115,6 +257,12 @@ const MINI_PROGRAM_MESSAGE_VERSION = 1;
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 /** SDK 初始化时发给父容器的握手方法名。 */
 const SDK_HANDSHAKE_METHOD = 'sdk.handshake';
+/** Runtime 主动探测 SDK 当前文档地址的内部方法名。 */
+const RUNTIME_LOCATION_PROBE_METHOD = 'runtime.location.probe';
+/** SDK 向 Runtime 报告当前文档地址的内部方法名。 */
+const SDK_LOCATION_REPORT_METHOD = 'sdk.location.report';
+/** SDK 向 Runtime 报告 CSP 违规的内部方法名。 */
+const SDK_CSP_VIOLATION_METHOD = 'sdk.csp.violation';
 
 /** 获取浏览器全局 window。 */
 function getGlobalWindow() {
@@ -174,6 +322,11 @@ function createMessageId() {
     return `${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`;
 }
 
+/** 构建时替换为当前发布包的实际版本。 */
+const HB_SDK_VERSION = typeof undefined === 'string'
+    ? undefined
+    : '0.6.0';
+
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。
  *
@@ -203,6 +356,13 @@ class MiniProgramBridgeClient {
     pendingRequests = new Map();
     eventBus = new MiniProgramEventBus();
     handleMessage;
+    handlePopState = () => this.postLocationReport('popstate');
+    handleHashChange = () => this.postLocationReport('hashchange');
+    handlePageShow = () => this.postLocationReport('pageshow');
+    handleSecurityPolicyViolation = (event) => {
+        this.postCSPViolation(event);
+    };
+    unsubscribeHistoryChanges;
     started = false;
     readySettled = false;
     readyPromise;
@@ -290,6 +450,12 @@ class MiniProgramBridgeClient {
     destroy() {
         this.destroyed = true;
         this.selfWindow?.removeEventListener('message', this.handleMessage);
+        this.selfWindow?.removeEventListener('popstate', this.handlePopState);
+        this.selfWindow?.removeEventListener('hashchange', this.handleHashChange);
+        this.selfWindow?.removeEventListener('pageshow', this.handlePageShow);
+        this.selfWindow?.removeEventListener('securitypolicyviolation', this.handleSecurityPolicyViolation);
+        this.unsubscribeHistoryChanges?.();
+        this.unsubscribeHistoryChanges = undefined;
         const error = createSDKError('SDK_DESTROYED', '小程序 SDK 已销毁');
         this.failReady(error);
         this.rejectAllPending(error);
@@ -316,6 +482,13 @@ class MiniProgramBridgeClient {
             return;
         }
         this.selfWindow.addEventListener('message', this.handleMessage);
+        this.selfWindow.addEventListener('popstate', this.handlePopState);
+        this.selfWindow.addEventListener('hashchange', this.handleHashChange);
+        this.selfWindow.addEventListener('pageshow', this.handlePageShow);
+        this.selfWindow.addEventListener('securitypolicyviolation', this.handleSecurityPolicyViolation);
+        this.unsubscribeHistoryChanges = subscribeHistoryChanges(this.selfWindow.history, () => {
+            this.postLocationReport('history');
+        });
         this.readyTimer = setTimeout(() => {
             this.failReady(createSDKError('READY_TIMEOUT', '小程序沙盒握手超时'));
         }, this.timeout);
@@ -352,11 +525,12 @@ class MiniProgramBridgeClient {
             payload: {
                 href: this.selfWindow.location.href,
                 userAgent: this.selfWindow.navigator.userAgent,
+                sdkVersion: HB_SDK_VERSION,
             },
         });
     }
     onMessage(event) {
-        if (event.source && event.source !== this.targetWindow) {
+        if (event.source !== this.targetWindow) {
             return;
         }
         if (!isMiniProgramBridgeMessage(event.data) || event.data.nonce !== this.nonce) {
@@ -368,6 +542,59 @@ class MiniProgramBridgeClient {
         }
         if (event.data.type === 'response') {
             this.handleResponse(event.data);
+            return;
+        }
+        if (event.data.type === 'request' && event.data.method === RUNTIME_LOCATION_PROBE_METHOD) {
+            const payload = event.data.payload;
+            if (typeof payload?.probeId === 'string') {
+                this.postLocationReport('probe', payload.probeId);
+            }
+        }
+    }
+    postLocationReport(trigger, probeId) {
+        if (this.destroyed || !this.selfWindow) {
+            return;
+        }
+        try {
+            this.postMessage({
+                namespace: MINI_PROGRAM_MESSAGE_NAMESPACE,
+                version: MINI_PROGRAM_MESSAGE_VERSION,
+                nonce: this.nonce,
+                type: 'event',
+                method: SDK_LOCATION_REPORT_METHOD,
+                payload: {
+                    probeId,
+                    href: this.selfWindow.location.href,
+                    sdkVersion: HB_SDK_VERSION,
+                    trigger,
+                    timestamp: Date.now(),
+                },
+            });
+        }
+        catch {
+            // 内部诊断消息失败不能改变 Mini-program 自身的导航语义。
+        }
+    }
+    async postCSPViolation(event) {
+        if (!this.selfWindow) {
+            return;
+        }
+        try {
+            const payload = await createCSPViolationPayload(event, this.selfWindow.location.href, HB_SDK_VERSION, this.selfWindow.crypto);
+            if (this.destroyed) {
+                return;
+            }
+            this.postMessage({
+                namespace: MINI_PROGRAM_MESSAGE_NAMESPACE,
+                version: MINI_PROGRAM_MESSAGE_VERSION,
+                nonce: this.nonce,
+                type: 'event',
+                method: SDK_CSP_VIOLATION_METHOD,
+                payload,
+            });
+        }
+        catch {
+            // CSP 违规已经由浏览器阻断，诊断发送失败不影响页面继续降级运行。
         }
     }
     handleEvent(message) {
@@ -378,6 +605,9 @@ class MiniProgramBridgeClient {
         else if (eventName === 'ready' && !this.runtimeUnavailable) {
             this.resolveReadyOnce();
         }
+        else if (eventName === 'show' && !this.runtimeUnavailable) {
+            this.postLocationReport('resume');
+        }
         this.eventBus.emit(eventName, message.payload);
     }
     handleResponse(message) {
@@ -1120,7 +1350,7 @@ function createMiniProgramSDK(options) {
     return new MiniProgramSDK(options);
 }
 
-let defaultSDK = null;
+let defaultSDK = createMiniProgramSDK();
 function getDefaultSDK() {
     if (!defaultSDK) {
         defaultSDK = createMiniProgramSDK();
@@ -1234,10 +1464,8 @@ const hbSDK = {
 
 exports.HbMiniProgramNetworkError = HbMiniProgramNetworkError;
 exports.HbMiniProgramSDKError = HbMiniProgramSDKError;
-exports.MiniProgramSDK = MiniProgramSDK;
 exports.auth = auth;
 exports.cloud = cloud;
-exports.createMiniProgramSDK = createMiniProgramSDK;
 exports.default = hbSDK;
 exports.device = device;
 exports.navigation = navigation;