npm - @heybox/hb-sdk - Versions diffs - 0.6.2 → 0.6.4-alpha.0 - Mend

@heybox/hb-sdk 0.6.2 → 0.6.4-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (30) hide show

package/README.md +5 -3
package/dist/cli-chunks/{context-DmxbC_iV.cjs → context-BCwksd8H.cjs} +1 -37
package/dist/cli-chunks/{create-CXBnqr5r.cjs → create-BO8GHVi0.cjs} +1 -1
package/dist/cli-chunks/{dev-OCij_ecL.cjs → dev-DmgKnEC2.cjs} +59 -133
package/dist/cli-chunks/{doctor-DQIzL_3_.cjs → doctor-BlKB4f78.cjs} +1 -1
package/dist/cli-chunks/{index-Ulhxo0YK.cjs → index-PxkpQ5of.cjs} +2 -2
package/dist/cli-chunks/{index-CTyguEza.cjs → index-Q0G1SsEs.cjs} +13 -13
package/dist/cli-chunks/{login-BWN2-2Gk.cjs → login-Cxdo4B6Z.cjs} +2 -2
package/dist/cli-chunks/{remote-DxKtJ21x.cjs → remote-C1Rsb1dx.cjs} +5 -5
package/dist/cli-chunks/{session-D7mPwyx4.cjs → session-CC3Oz3Xc.cjs} +1 -2
package/dist/cli.cjs +1 -1
package/dist/devtools/mock-host/index.html +54 -1
package/dist/devtools/mock-host/main.js +196 -6
package/dist/index.cjs.js +1 -1
package/dist/index.esm.js +1 -1
package/dist/miniapp-publish.cjs.js +0 -4
package/dist/miniapp-publish.esm.js +1 -4
package/dist/vite.cjs.js +2 -344
package/dist/vite.esm.js +2 -344
package/package.json +2 -2
package/skill/SKILL.md +5 -3
package/skill/references/api-root.md +6 -26
package/skill/references/cli.md +7 -5
package/skill/skill.json +4 -4
package/types/miniapp-publish/index.d.ts +0 -1
package/types/vite/index.d.ts +1 -7
package/types/cli/auth/base-url.d.ts +0 -20
package/types/cli/config.d.ts +0 -11
package/types/miniapp-manifest/sdk-version-policy.d.ts +0 -9
package/types/vite/sdk-version-gate.d.ts +0 -8

package/README.md CHANGED Viewed

@@ -57,7 +57,9 @@ SDK 需要在黑盒小程序 iframe 容器内运行。父容器会为页面注
 npm run dev
 ```
-调试页会通过 iframe 加载本地页面并补齐小程序 bridge 环境；浏览器 Mock 从 mock host 的同源只读 bootstrap 接口读取服务端保留的 Runtime 权限快照，URL query 不能提供或覆盖权限。项目已绑定 `heybox.miniProgramId` 时，可以点击调试页里的「在 Mac 版 APP 中启动」按钮，或在「Mobile App」区域选择局域网网卡后用手机小黑盒 APP 扫码；真机 dev shell 只携带绑定的小程序 ID 和本地页面地址，H5 宿主按 ID 从公开详情接口读取可信 Runtime 权限快照。项目未绑定时仍可使用默认拒绝受管能力的浏览器 Mock，但 Mac 和手机真机入口会明确提示先运行 `hb-sdk remote create` 或 `hb-sdk remote bind <mini-program-id>`，并保持不可用。真实容器加载开发 `mini_url` 前会提示“即将打开未经验证的开发网页。该页面可能由本机或局域网服务提供，请确认来源可信后继续。”，用户确认后才继续加载。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP；遇到这种情况时，请在系统浏览器中打开同一个调试页后重试。
+调试页会通过 iframe 加载本地页面并补齐小程序 bridge 环境。`hb-sdk dev` 的基础启动只依赖本地页面地址：即使项目未绑定、CLI 未登录或远端暂时不可用，浏览器 Mock、Mac 启动协议和手机二维码也会继续生成，真机 dev shell 以匿名本地沙箱加载 `mini_url`，不会把公开 `detail` 查询作为启动门禁。项目已绑定时会限时 3 秒读取远端 dev context；成功后 Mock Host 用真实 Runtime 权限快照初始化本地模拟，失败或超时则显示脱敏警告，并默认拒绝 `network.request` 等受管能力。
+Mock Host 可以在内存中调整 devtools-only 权限模拟，不会重建 iframe，因此不影响 Vite HMR；本地设置不会修改线上权限。调试页会对比已读取的线上快照，提示本地放开但上线后会返回 `PERMISSION_DENIED` 的差异。权限快照只通过 mock host 的同源只读 bootstrap 接口传递，URL query 不能提供或覆盖权限。真实容器加载开发 `mini_url` 前会提示“即将打开未经验证的开发网页。该页面可能由本机或局域网服务提供，请确认来源可信后继续。”，用户确认后才继续加载。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP；遇到这种情况时，请在系统浏览器中打开同一个调试页后重试。
 在未使用脚手架的 Vite 项目中，可以把命令加到 `package.json`：
@@ -477,7 +479,7 @@ hb-sdk remote deploy --env test --service-tag other-tag --release-note "灰度"
 `--env <name>` 会读取项目根下的 `.env.<name>`，`--env-file <path>` 显式指定路径且优先级高于 `--env`；两者也可通过 `HB_SDK_ENV=<name>` 触发。加载遵循 dotenv 惯例：不覆盖进程已有的同名变量，因此 CI 或命令行显式设置的值优先。使用 `--env <name>` 或 `HB_SDK_ENV=<name>` 执行 `remote deploy` 时，CLI 还会把同一个 `name` 作为 `--mode <name>` 传给项目 build，使 CLI 后端环境与 Vite mode 保持一致。文件仅支持 `KEY=VALUE`、空行和 `#` 注释，不做变量插值；文件不存在时静默跳过。`--verbose` 会打印生效的文件路径和被跳过的 key。
-`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。`--service-tag <tag>` 优先于 `HB_SDK_SERVICE_TAG`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query；`remote deploy` 的子构建不执行客户端最低版本门禁。仓库内开发也可继续在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 path-prefix 级 `special_tag`。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
+`--api-base-url` 优先于 `HB_SDK_API_BASE_URL`，影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`--login-base-url` 优先于 `HB_SDK_LOGIN_BASE_URL`，用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。`--service-tag <tag>` 优先于 `HB_SDK_SERVICE_TAG`，给 Heybox 后台请求附加 `x-rylai-service-tag` header，并复用命中的 tag 追加 `special_tag` 请求参数，用于开发环境路由或灰度验证。仓库内开发也可继续在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置 path-prefix 级 `special_tag`。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。`hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 ## hb-sdk remote 命令参考
@@ -557,7 +559,7 @@ export default defineConfig({
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 失败与警告语义：

package/dist/cli-chunks/{context-DmxbC_iV.cjs → context-BCwksd8H.cjs} RENAMED Viewed

@@ -1,30 +1,10 @@
 'use strict';
-var session = require('./session-D7mPwyx4.cjs');
-var index = require('./index-CTyguEza.cjs');
+var session = require('./session-CC3Oz3Xc.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
-function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
-    return {
-        path: APIUserMiniprogramPublicSdkConfigPath,
-        searchParams: serviceTag ? { special_tag: serviceTag } : {},
-        headers: serviceTag ? { 'x-rylai-service-tag': serviceTag } : {},
-    };
-}
-function parseUserMiniprogramPublicSdkConfigResult(value) {
-    if (!isRecord(value) ||
-        typeof value.minimum_sdk_version !== 'string') {
-        throw new Error('公共 SDK 配置响应无效');
-    }
-    return value;
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null;
-}
 var re = {exports: {}};
 var constants;
@@ -2814,7 +2794,6 @@ const MINIAPP_UPLOAD_SCOPE = 'activity';
 const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 const MINIAPP_UPLOAD_BATCH_SIZE = 50;
 const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES = 100 * 1024 * 1024;
-const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = APIUserMiniprogramPublicSdkConfigPath;
 const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = '/mall/developer/user_miniprogram/access_status';
 const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
 const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
@@ -2930,20 +2909,6 @@ function createRemoteApiClient(options) {
         listUserMiniprogramVersions: (requestOptions) => listUserMiniprogramVersions(requestOptions, options),
     };
 }
-async function getPublicSdkConfig(runtime) {
-    const fetchImpl = runtime.fetchImpl ?? fetch;
-    const serviceTag = index.resolveHeyboxRylaiServiceTag(PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH);
-    const request = createUserMiniprogramPublicSdkConfigRequest(serviceTag);
-    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? 'https://api.xiaoheihe.cn', request.path, request.searchParams), {
-        method: 'GET',
-        headers: {
-            Referer: session.HEYBOX_WEB_REFERER,
-            ...request.headers,
-        },
-    });
-    const result = await readRequiredResult(response, request.path);
-    return parseUserMiniprogramPublicSdkConfigResult(result);
-}
 async function listDeveloperEntities(runtime) {
     return remoteGet(DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
 }
@@ -3223,7 +3188,6 @@ exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_A
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
 exports.getBoundMiniProgram = getBoundMiniProgram;
 exports.getMiniappUploadKey = getMiniappUploadKey;
-exports.getPublicSdkConfig = getPublicSdkConfig;
 exports.normalizeRelativePath = normalizeRelativePath;
 exports.readBoundMiniProgramId = readBoundMiniProgramId;
 exports.readBoundMiniProgramIdFromPackageJson = readBoundMiniProgramIdFromPackageJson;

package/dist/cli-chunks/{create-CXBnqr5r.cjs → create-BO8GHVi0.cjs} RENAMED Viewed

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CTyguEza.cjs');
+var index = require('./index-Q0G1SsEs.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-OCij_ecL.cjs → dev-DmgKnEC2.cjs} RENAMED Viewed

@@ -9,9 +9,8 @@ var node_url = require('node:url');
 var net = require('node:net');
 var node_http = require('node:http');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CTyguEza.cjs');
-var context = require('./context-DmxbC_iV.cjs');
-var session = require('./session-D7mPwyx4.cjs');
+var index = require('./index-Q0G1SsEs.cjs');
+var context = require('./context-BCwksd8H.cjs');
 require('node:process');
 require('node:buffer');
 require('node:util');
@@ -25,6 +24,7 @@ require('events');
 require('stream');
 require('buffer');
 require('util');
+require('./session-CC3Oz3Xc.cjs');
 require('node:crypto');
 require('fs');
 require('constants');
@@ -223,6 +223,7 @@ async function startMiniProgramMockHostServer(options) {
     assertCompleteMiniProgramMockHostRoot(root);
     const bootstrapJson = serializeMockHostBootstrap({
         defaultLanAddressId: options.defaultLanAddressId,
+        devContext: options.devContext,
         lanAddresses: options.lanAddresses ?? [],
         macAppProtocol: options.macAppProtocol,
         nativeAppLaunchUnavailableReason: options.nativeAppLaunchUnavailableReason,
@@ -666,113 +667,23 @@ function createHeyboxProtocol(payload) {
     return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
 }
-const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
-async function resolveMinimumSdkVersion(options) {
-    const now = options.now ?? Date.now();
-    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
-    const cache = await readCache(cachePath);
-    let minimumSdkVersion;
-    try {
-        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
-    }
-    catch {
-        const cached = cache.environments[options.environment];
-        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
-        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
-            try {
-                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
-            }
-            catch {
-                // 非法缓存按不存在处理。
-            }
-        }
-        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
-    }
-    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
-    try {
-        await writeCache(cachePath, cache);
-    }
-    catch {
-        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
-    }
-    return minimumSdkVersion;
-}
-function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
-    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
-    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
-    if (!options.allowPrerelease && context.semverExports.prerelease(current) !== null) {
-        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
-    }
-    if (!context.semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
-        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
-    }
-    return current;
-}
-function validateSdkVersion(value, label) {
-    const normalized = String(value).trim();
-    const parsed = context.semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function validateStableSdkVersion(value, label) {
-    const normalized = validateSdkVersion(value, label);
-    if (context.semverExports.prerelease(normalized) !== null)
-        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
-    return normalized;
-}
-async function readCache(cachePath) {
-    try {
-        const parsed = JSON.parse(await fs$1.readFile(cachePath, 'utf8'));
-        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
-            return parsed;
-    }
-    catch {
-        // 缓存缺失或损坏时继续请求最新配置。
-    }
-    return { environments: {} };
-}
-async function writeCache(cachePath, cache) {
-    await fs$1.mkdir(path.dirname(cachePath), { recursive: true });
-    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
-    await fs$1.writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
-    await fs$1.rename(temporaryPath, cachePath);
-}
-const paths = index.envPaths('hb-sdk');
-async function enforceRemoteSdkVersion(options) {
-    const minimumSdkVersion = await resolveMinimumSdkVersion({
-        cacheDir: options.cacheDir ?? paths.cache,
-        environment: options.environment,
-        fetchMinimumSdkVersion: async () => (await context.getPublicSdkConfig({ baseUrl: options.environment, fetchImpl: options.fetchImpl })).minimum_sdk_version,
-    });
-    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
-}
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.2';
+    : '0.6.4-alpha.0';
 const DEFAULT_APP_PORT = 5173;
 const DEFAULT_MOCK_PORT = 5174;
+const DEFAULT_DEV_CONTEXT_TIMEOUT_MS = 3000;
 const DEV_LISTEN_HOST = '0.0.0.0';
 const LOCAL_DEV_URL_HOST = '127.0.0.1';
+const DEV_CONTEXT_UNAVAILABLE_WARNING = '远端 dev context 不可用，已继续匿名调试。';
 // Shared with Heybox H5 Vite plugins so hb-sdk can own the launch output.
 const MANAGED_DEV_OUTPUT_ENV = 'HEYBOX_DEV_SERVER_MANAGED_OUTPUT';
 const VITE_LOG_LEVEL = 'warn';
 async function runDevCommand(options, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
     const fetchImpl = runtime.fetchImpl ?? fetch;
-    const environment = session.resolveHeyboxApiBaseUrl({ env: runtime.env });
-    await (runtime.enforceRemoteSdkVersion ?? enforceRemoteSdkVersion)({
-        sdkVersion: HB_SDK_VERSION,
-        environment,
-        fetchImpl,
-        allowPrerelease: true,
-    });
     const openUrl = runtime.openExternalUrl ?? browser.openExternalUrl;
     const networkInterfaceSnapshot = (runtime.networkInterfaces ?? os.networkInterfaces)();
     const getPortImpl = runtime.getPort ?? getPorts;
@@ -793,6 +704,7 @@ async function runDevCommand(options, runtime = {}) {
         fetchImpl,
         logger,
         projectRoot,
+        timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
     });
     const vite = await logger.task('正在加载项目 Vite', () => loadProjectVite(projectRoot), { successText: '已加载项目 Vite' });
     const appServer = await logger.task('正在创建 Vite dev server', () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions)), runtime.env), { successText: '已创建 Vite dev server' });
@@ -816,18 +728,16 @@ async function runDevCommand(options, runtime = {}) {
     try {
         mockHost = await logger.task('正在启动 Mock runtime host', () => startMiniProgramMockHostServer({
             appUrl,
+            devContext: devLaunchContext,
             fetchImpl,
             getPort: getPortImpl,
             defaultLanAddressId: lanAddresses[0]?.id,
             lanAddresses,
-            macAppProtocol: devLaunchContext.miniProgramId
-                ? createMacAppProtocol(appUrl, {
-                    miniProgramId: devLaunchContext.miniProgramId,
-                    runtimeUrl: options.runtimeUrl,
-                    sdkVersion: HB_SDK_VERSION,
-                })
-                : undefined,
-            nativeAppLaunchUnavailableReason: devLaunchContext.nativeAppLaunchUnavailableReason,
+            macAppProtocol: createMacAppProtocol(appUrl, {
+                miniProgramId: devLaunchContext.miniProgramId,
+                runtimeUrl: options.runtimeUrl,
+                sdkVersion: HB_SDK_VERSION,
+            }),
             port: options.mockPort ?? DEFAULT_MOCK_PORT,
             root: runtime.mockHostRoot,
             rootCandidates: runtime.mockHostRootCandidates,
@@ -842,12 +752,10 @@ async function runDevCommand(options, runtime = {}) {
     logger.success('Mock runtime host 已就绪');
     logger.info(`Mock runtime host: ${mockHost.url}`);
     logger.info(`Mini program URL: ${appUrl}`);
-    if (devLaunchContext.miniProgramId) {
-        logger.info('Mac APP: use the button in Mock runtime host');
-        logger.info('Mobile APP: scan the QR code in Mock runtime host');
-    }
-    else {
-        logger.warn(`Mac/Mobile APP 真机调试不可用：${devLaunchContext.nativeAppLaunchUnavailableReason}`);
+    logger.info('Mac APP: use the button in Mock runtime host');
+    logger.info('Mobile APP: scan the QR code in Mock runtime host');
+    if (devLaunchContext.source === 'anonymous') {
+        logger.warn('当前使用匿名本地沙箱；真机调试可用，但不会携带远端小程序身份或权限。');
     }
     if (options.open !== false) {
         logger.debug('正在打开浏览器调试页');
@@ -858,40 +766,61 @@ async function runDevCommand(options, runtime = {}) {
 async function loadDevLaunchContext(options) {
     const miniProgramId = await context.readBoundMiniProgramId(options.projectRoot);
     if (!miniProgramId) {
-        const nativeAppLaunchUnavailableReason = '当前项目未绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。';
-        options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${nativeAppLaunchUnavailableReason}`);
-        return { nativeAppLaunchUnavailableReason };
+        const anonymousReason = '当前项目未绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。';
+        options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${anonymousReason}`);
+        return {
+            source: 'anonymous',
+            warning: anonymousReason,
+        };
     }
     try {
-        const { detail, miniProgramId: verifiedMiniProgramId } = await options.logger.task('正在读取远端小程序权限', () => context.getBoundMiniProgram({
-            cwd: options.projectRoot,
-            env: options.env,
+        const { detail, miniProgramId: verifiedMiniProgramId } = await options.logger.task('正在读取远端小程序权限', () => loadRemoteDevContextWithTimeout({
             fetchImpl: options.fetchImpl,
+            load: fetchImpl => context.getBoundMiniProgram({
+                cwd: options.projectRoot,
+                env: options.env,
+                fetchImpl,
+            }),
+            timeoutMs: options.timeoutMs,
         }), { successText: '已读取远端小程序权限' });
-        return { miniProgramId: verifiedMiniProgramId, runtimePermissions: detail.runtime_permissions };
+        return {
+            source: 'remote',
+            miniProgramId: verifiedMiniProgramId,
+            runtimePermissions: detail.runtime_permissions,
+        };
     }
     catch (error) {
-        if (!canFallbackToDefaultRuntimePermissions(error)) {
+        if (error instanceof context.MiniProgramProjectBindingError &&
+            error.code !== 'MINI_PROGRAM_UNBOUND') {
             throw error;
         }
-        options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${index.readErrorMessage(error)}`);
+        options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${DEV_CONTEXT_UNAVAILABLE_WARNING}`);
         return {
-            nativeAppLaunchUnavailableReason: '当前绑定尚未通过开发者权限验证。请先运行 hb-sdk login，并确认网络可用后重试。',
+            source: 'anonymous',
+            warning: DEV_CONTEXT_UNAVAILABLE_WARNING,
         };
     }
 }
-function canFallbackToDefaultRuntimePermissions(error) {
-    if (error instanceof context.MiniProgramProjectBindingError) {
-        return error.code === 'MINI_PROGRAM_UNBOUND';
-    }
-    if (error instanceof TypeError && error.message === 'fetch failed') {
-        return true;
+async function loadRemoteDevContextWithTimeout(options) {
+    const controller = new AbortController();
+    const fetchImpl = ((input, init) => options.fetchImpl(input, { ...init, signal: controller.signal }));
+    let timeout;
+    try {
+        return await Promise.race([
+            options.load(fetchImpl),
+            new Promise((_resolve, reject) => {
+                timeout = setTimeout(() => {
+                    controller.abort();
+                    reject(new Error('dev context timeout'));
+                }, Math.max(1, options.timeoutMs));
+            }),
+        ]);
     }
-    if (error instanceof index.CliError) {
-        return (error.httpStatus === 429 ||
-            (error.httpStatus !== undefined && error.httpStatus >= 500 && error.httpStatus < 600));
+    finally {
+        if (timeout) {
+            clearTimeout(timeout);
+        }
     }
-    return error instanceof Error && 'code' in error && error.code === 'AUTH_SESSION_MISSING';
 }
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);
@@ -1076,9 +1005,6 @@ async function closeAll(closers) {
     await Promise.allSettled(closers.map((close) => close()));
 }
 function createLanAddressCandidates(options) {
-    if (!options.miniProgramId) {
-        return [];
-    }
     const viteNetworkUrlByHost = new Map(options.viteNetworkUrls
         .map((url) => [readUrlHost(url), url])
         .filter((entry) => Boolean(entry[0])));

package/dist/cli-chunks/{doctor-DQIzL_3_.cjs → doctor-BlKB4f78.cjs} RENAMED Viewed

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-CTyguEza.cjs');
+var index = require('./index-Q0G1SsEs.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-Ulhxo0YK.cjs → index-PxkpQ5of.cjs} RENAMED Viewed

@@ -1,13 +1,13 @@
 'use strict';
-var index$2 = require('./index-CTyguEza.cjs');
+var index$2 = require('./index-Q0G1SsEs.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$3 = require('assert');
 var require$$4$2 = require('events');
 var require$$1$1 = require('util');
-var context$1 = require('./context-DmxbC_iV.cjs');
+var context$1 = require('./context-BCwksd8H.cjs');
 var require$$0$5 = require('net');
 var require$$0$4 = require('url');
 var require$$2$2 = require('http');

package/dist/cli-chunks/{index-CTyguEza.cjs → index-Q0G1SsEs.cjs} RENAMED Viewed

@@ -234,19 +234,19 @@ function requireArgument () {
 var command = {};
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Q0G1SsEs.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Q0G1SsEs.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Q0G1SsEs.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Q0G1SsEs.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CTyguEza.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Q0G1SsEs.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 var help = {};
@@ -13323,7 +13323,7 @@ function getPathname(pathWithQuery) {
 }
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.6.2';
+const BUILT_CLI_VERSION = '0.6.4-alpha.0';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13644,31 +13644,31 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BWN2-2Gk.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-Cxdo4B6Z.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BWN2-2Gk.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-Cxdo4B6Z.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BWN2-2Gk.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-Cxdo4B6Z.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CXBnqr5r.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BO8GHVi0.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-OCij_ecL.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-DmgKnEC2.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DQIzL_3_.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BlKB4f78.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DxKtJ21x.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-C1Rsb1dx.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{login-BWN2-2Gk.cjs → login-Cxdo4B6Z.cjs} RENAMED Viewed

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-D7mPwyx4.cjs');
+var session = require('./session-CC3Oz3Xc.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CTyguEza.cjs');
+var index = require('./index-Q0G1SsEs.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{remote-DxKtJ21x.cjs → remote-C1Rsb1dx.cjs} RENAMED Viewed

@@ -1,13 +1,13 @@
 'use strict';
 var promises = require('node:readline/promises');
-var index = require('./index-CTyguEza.cjs');
-var session = require('./session-D7mPwyx4.cjs');
+var index = require('./index-Q0G1SsEs.cjs');
+var session = require('./session-CC3Oz3Xc.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var context = require('./context-DmxbC_iV.cjs');
+var context = require('./context-BCwksd8H.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -264,7 +264,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-Ulhxo0YK.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-PxkpQ5of.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -8896,7 +8896,7 @@ async function runBuildScript(pm, cwd, spawnImpl, options) {
         const buildArgs = createBuildArgs(pm, options.mode);
         const child = spawnImpl(pm, buildArgs, {
             cwd,
-            env: { ...process.env, ...options.env, HB_SDK_DEPLOY_BUILD: '1' },
+            env: { ...process.env, ...options.env },
             stdio: pipeStdoutToStderr ? ['inherit', 'pipe', 'inherit'] : 'inherit',
         });
         if (pipeStdoutToStderr) {

package/dist/cli-chunks/{session-D7mPwyx4.cjs → session-CC3Oz3Xc.cjs} RENAMED Viewed

@@ -1,6 +1,6 @@
 'use strict';
-var index = require('./index-CTyguEza.cjs');
+var index = require('./index-Q0G1SsEs.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');
@@ -3321,7 +3321,6 @@ function isRecord(value) {
     return Object.prototype.toString.call(value) === '[object Object]';
 }
-exports.HEYBOX_WEB_REFERER = HEYBOX_WEB_REFERER;
 exports.clearHeyboxAuthSession = clearHeyboxAuthSession;
 exports.createHeyboxApiUrl = createHeyboxApiUrl;
 exports.createHeyboxAuthSession = createHeyboxAuthSession;

package/dist/cli.cjs CHANGED Viewed

@@ -1,6 +1,6 @@
 'use strict';
-var index = require('./cli-chunks/index-CTyguEza.cjs');
+var index = require('./cli-chunks/index-Q0G1SsEs.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');