@heybox/hb-sdk 0.6.6-alpha.3 → 0.6.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. package/README.md +3 -1
  2. package/dist/cli-chunks/{build-De-QADpA.cjs → build-egxk9rgs.cjs} +31 -26
  3. package/dist/cli-chunks/{context-CvZs9ZBf.cjs → context-B2Y0Du9z.cjs} +122 -23
  4. package/dist/cli-chunks/{create-B5gGBaSV.cjs → create-DPm5Sp-d.cjs} +1 -1
  5. package/dist/cli-chunks/{dev-BcCWCeac.cjs → dev-CEqWxCnf.cjs} +24 -113
  6. package/dist/cli-chunks/{doctor-BhBM4cWH.cjs → doctor-DqNzGi3s.cjs} +1 -1
  7. package/dist/cli-chunks/{index-DyUo67lf.cjs → index-CSc_4vi-.cjs} +3 -3
  8. package/dist/cli-chunks/{index-QAkYgxPI.cjs → index-DAJGwzpN.cjs} +14 -14
  9. package/dist/cli-chunks/{login-BNLH13Zd.cjs → login-DseHvHCN.cjs} +2 -2
  10. package/dist/cli-chunks/{project-vite-VcJMyz1l.cjs → project-vite-RXpbNaQD.cjs} +1 -1
  11. package/dist/cli-chunks/{remote-BE53wntR.cjs → remote-Cko4-pSc.cjs} +40 -22
  12. package/dist/cli-chunks/{runtime-gate-B2MQf1vc.cjs → runtime-gate--rPXjiG6.cjs} +3 -3
  13. package/dist/cli-chunks/{index-BQm5XmMC.cjs → runtime-permission-env-BSs4uCNa.cjs} +71 -0
  14. package/dist/cli-chunks/{session-YJ8xNESM.cjs → session-4SxzY4w1.cjs} +1 -1
  15. package/dist/cli.cjs +1 -1
  16. package/dist/index.cjs.js +1 -1
  17. package/dist/index.esm.js +1 -1
  18. package/dist/vite.cjs.js +20 -3
  19. package/dist/vite.esm.js +20 -3
  20. package/package.json +2 -2
  21. package/skill/references/api-root.md +11 -4
  22. package/skill/skill.json +4 -4
  23. package/types/vite/html-policy.d.ts +1 -0
  24. package/types/vite/runtime-permission-env.d.ts +9 -0
package/README.md CHANGED
@@ -598,7 +598,9 @@ export default defineConfig({
598
598
 
599
599
  工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
600
600
 
601
- 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
601
+ 插件只接受单页应用：输出目录只能存在入口 `index.html`。`hb-sdk dev` 和 `hb-sdk remote deploy` 会读取绑定小程序的远端 Runtime 权限；仅当 `network.request` 已启用且 `useOfficialDomain=true` 时跳过平台 CSP，否则 build 会把平台 CSP 插入 `<head>` 首位。直接运行 `vite build`、匿名 dev、非法快照或远端权限读取失败时均继续注入。已有 CSP 始终原样保留；注入平台 CSP 时，两份策略按浏览器交集生效。
602
+
603
+ 平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。跳过平台 CSP 时，这些能力不再由 SDK 构建产物统一限制，但需要宿主授权的业务网络请求仍应使用 `network.request()`。本地 Mock 权限覆盖不会改变构建 CSP，构建判定始终以远端权限快照为准。
602
604
 
603
605
  meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
604
606
 
package/dist/cli-chunks/{build-De-QADpA.cjs → build-egxk9rgs.cjs} RENAMED
@@ -3,10 +3,11 @@
3
3
  var fs$1 = require('node:fs');
4
4
  var fs = require('node:fs/promises');
5
5
  var path = require('node:path');
6
- var index$1 = require('./index-BQm5XmMC.cjs');
7
- var runtimeGate = require('./runtime-gate-B2MQf1vc.cjs');
8
- var index = require('./index-QAkYgxPI.cjs');
9
- var projectVite = require('./project-vite-VcJMyz1l.cjs');
6
+ var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
7
+ var runtimeGate = require('./runtime-gate--rPXjiG6.cjs');
8
+ var index = require('./index-DAJGwzpN.cjs');
9
+ var projectVite = require('./project-vite-RXpbNaQD.cjs');
10
+ require('node:async_hooks');
10
11
  require('node:module');
11
12
  require('path');
12
13
  require('os');
@@ -23,26 +24,30 @@ async function runBuildCommand(_options = {}, runtime = {}) {
23
24
  const logger = runtime.logger ?? index.createCliLogger();
24
25
  const projectRoot = projectVite.findProjectRoot(runtime.cwd ?? process.cwd());
25
26
  const distDir = path.join(projectRoot, 'dist');
26
- const mode = (runtime.env ?? process.env).HB_SDK_ENV?.trim() || undefined;
27
+ const env = runtime.env ?? process.env;
28
+ const mode = env.HB_SDK_ENV?.trim() || undefined;
29
+ const skipPlatformCsp = runtimePermissionEnv.shouldSkipMiniappPlatformCspFromEnv(env);
27
30
  await fs.rm(distDir, { force: true, recursive: true });
28
31
  try {
29
- const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), {
30
- successText: '已加载项目 Vite',
31
- });
32
- await logger.task('正在构建小程序', () => vite.build({
33
- root: projectRoot,
34
- ...(mode ? { mode } : {}),
35
- plugins: [createFixedBuildOutputPlugin(projectRoot)],
36
- build: {
37
- outDir: 'dist',
38
- emptyOutDir: true,
39
- watch: null,
40
- write: true,
41
- },
42
- }), { successText: 'Vite 构建完成' });
43
- const result = await validateBuildOutput(projectRoot, logger);
44
- logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
45
- return result;
32
+ return await runtimePermissionEnv.withMiniappPlatformCspEnv(skipPlatformCsp, async () => {
33
+ const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), {
34
+ successText: '已加载项目 Vite',
35
+ });
36
+ await logger.task('正在构建小程序', () => vite.build({
37
+ root: projectRoot,
38
+ ...(mode ? { mode } : {}),
39
+ plugins: [createFixedBuildOutputPlugin(projectRoot)],
40
+ build: {
41
+ outDir: 'dist',
42
+ emptyOutDir: true,
43
+ watch: null,
44
+ write: true,
45
+ },
46
+ }), { successText: 'Vite 构建完成' });
47
+ const result = await validateBuildOutput(projectRoot, logger);
48
+ logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
49
+ return result;
50
+ }, env);
46
51
  }
47
52
  catch (error) {
48
53
  await fs.rm(distDir, { force: true, recursive: true });
@@ -88,8 +93,8 @@ async function validateBuildOutput(projectRoot, logger) {
88
93
  }
89
94
  const { sdkVersion, version } = runtimeGate.validateMiniappManifestForDeploy(manifest);
90
95
  const allFiles = await walkDistFiles(distDir);
91
- const uploadFiles = allFiles.filter((file) => index$1.shouldUploadDistFile(file.relativePath));
92
- const sizeError = index$1.validateUploadTotalSize(uploadFiles);
96
+ const uploadFiles = allFiles.filter((file) => runtimePermissionEnv.shouldUploadDistFile(file.relativePath));
97
+ const sizeError = runtimePermissionEnv.validateUploadTotalSize(uploadFiles);
93
98
  if (sizeError) {
94
99
  throw new Error(sizeError.replace('重新 deploy', '重新 build'));
95
100
  }
@@ -109,12 +114,12 @@ async function walkDistFiles(distDir) {
109
114
  const entries = await fs.readdir(absDir, { withFileTypes: true });
110
115
  for (const entry of entries) {
111
116
  const absPath = path.join(absDir, entry.name);
112
- const relPath = index$1.normalizeRelativePath(relDir ? `${relDir}/${entry.name}` : entry.name);
117
+ const relPath = runtimePermissionEnv.normalizeRelativePath(relDir ? `${relDir}/${entry.name}` : entry.name);
113
118
  const link = await fs.lstat(absPath);
114
119
  if (link.isSymbolicLink()) {
115
120
  throw new Error(`dist 目录包含 symlink，拒绝处理：${relPath}`);
116
121
  }
117
- if (index$1.relativePathContainsNodeModulesSegment(relPath)) {
122
+ if (runtimePermissionEnv.relativePathContainsNodeModulesSegment(relPath)) {
118
123
  throw new Error(`dist 目录含 node_modules：${relPath}`);
119
124
  }
120
125
  if (entry.isDirectory()) {
package/dist/cli-chunks/{context-CvZs9ZBf.cjs → context-B2Y0Du9z.cjs} RENAMED
@@ -1,11 +1,106 @@
1
1
  'use strict';
2
2
 
3
- var session = require('./session-YJ8xNESM.cjs');
4
- var index = require('./index-BQm5XmMC.cjs');
3
+ var session = require('./session-4SxzY4w1.cjs');
4
+ var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
5
5
  var fs$1 = require('node:fs');
6
6
  var fs = require('node:fs/promises');
7
7
  var path = require('node:path');
8
8
 
9
+ const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
10
+ /**
11
+ * 判断 permission key 是否由 Runtime 权限快照管理。
12
+ *
13
+ * @param key 待判断的 permission key。
14
+ * @returns 该 key 需要读取 Runtime 权限快照时返回 `true`。
15
+ */
16
+ function isManagedMiniProgramRuntimePermissionKey(key) {
17
+ return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
18
+ }
19
+ /**
20
+ * 解析服务端权限快照；格式不完整时整份快照失效并 fail closed。
21
+ *
22
+ * @param snapshot 待校验的服务端权限快照。
23
+ * @returns 解析状态和通过校验的受管权限。
24
+ */
25
+ function parseMiniProgramRuntimePermissions(snapshot) {
26
+ if (!isRecord(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
27
+ return { valid: false, permissions: {} };
28
+ }
29
+ if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
30
+ return { valid: false, permissions: {} };
31
+ }
32
+ const seenKeys = new Set();
33
+ const permissions = {};
34
+ for (const rawEntry of snapshot.entries) {
35
+ if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
36
+ return { valid: false, permissions: {} };
37
+ }
38
+ const key = rawEntry.key.trim();
39
+ if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
40
+ return { valid: false, permissions: {} };
41
+ }
42
+ seenKeys.add(key);
43
+ if (!isManagedMiniProgramRuntimePermissionKey(key)) {
44
+ continue;
45
+ }
46
+ if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
47
+ return { valid: false, permissions: {} };
48
+ }
49
+ permissions[key] = {
50
+ key,
51
+ status: rawEntry.status,
52
+ config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
53
+ };
54
+ }
55
+ return { valid: true, permissions };
56
+ }
57
+ function isRecord(value) {
58
+ return typeof value === 'object' && value !== null && !Array.isArray(value);
59
+ }
60
+
61
+ const DEFAULT_PERMISSION_STATE = {
62
+ networkRequest: {
63
+ status: 'disabled',
64
+ useOfficialDomain: false,
65
+ },
66
+ };
67
+ function createMiniProgramMockPermissionState(context) {
68
+ const parsed = parseMiniProgramRuntimePermissions(context.runtimePermissions);
69
+ const networkRequest = parsed.permissions['network.request'];
70
+ return parsed.valid && networkRequest
71
+ ? {
72
+ networkRequest: {
73
+ status: networkRequest.status,
74
+ useOfficialDomain: networkRequest.config.useOfficialDomain === true,
75
+ },
76
+ }
77
+ : cloneDefaultPermissionState();
78
+ }
79
+ function shouldSkipMiniappPlatformCsp(runtimePermissions) {
80
+ const parsed = parseMiniProgramRuntimePermissions(runtimePermissions);
81
+ const networkRequest = parsed.permissions['network.request'];
82
+ return parsed.valid && networkRequest?.status === 'enabled' && networkRequest.config.useOfficialDomain === true;
83
+ }
84
+ function createMiniProgramMockRuntimePermissions(state) {
85
+ return {
86
+ schema_version: 1,
87
+ entries: [
88
+ {
89
+ key: 'network.request',
90
+ status: state.networkRequest.status,
91
+ config: {
92
+ useOfficialDomain: state.networkRequest.useOfficialDomain,
93
+ },
94
+ },
95
+ ],
96
+ };
97
+ }
98
+ function cloneDefaultPermissionState() {
99
+ return {
100
+ networkRequest: { ...DEFAULT_PERMISSION_STATE.networkRequest },
101
+ };
102
+ }
103
+
9
104
  function createRemoteApiClient(options) {
10
105
  return {
11
106
  listDeveloperEntities: () => listDeveloperEntities(options),
@@ -32,74 +127,74 @@ function createRemoteApiClient(options) {
32
127
  };
33
128
  }
34
129
  async function listDeveloperEntities(runtime) {
35
- return remoteGet(index.DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
130
+ return remoteGet(runtimePermissionEnv.DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
36
131
  }
37
132
  async function switchDeveloperEntity(options, runtime) {
38
- return (await remotePostForm(index.DEVELOPER_ENTITY_SWITCH_API_PATH, options, runtime, { requireResult: false })) ?? {};
133
+ return (await remotePostForm(runtimePermissionEnv.DEVELOPER_ENTITY_SWITCH_API_PATH, options, runtime, { requireResult: false })) ?? {};
39
134
  }
40
135
  async function getDeveloperAccessStatus(runtime) {
41
- return remoteGet(index.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, {}, runtime);
136
+ return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, {}, runtime);
42
137
  }
43
138
  async function listUserMiniprograms(options, runtime) {
44
- return remoteGet(index.LIST_USER_MINIPROGRAM_API_PATH, options, runtime);
139
+ return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_API_PATH, options, runtime);
45
140
  }
46
141
  async function createUserMiniprogram(runtime) {
47
- return remotePostForm(index.CREATE_USER_MINIPROGRAM_API_PATH, {}, runtime);
142
+ return remotePostForm(runtimePermissionEnv.CREATE_USER_MINIPROGRAM_API_PATH, {}, runtime);
48
143
  }
49
144
  async function getUserMiniprogramDetail(options, runtime) {
50
- return remoteGet(index.DETAIL_USER_MINIPROGRAM_API_PATH, options, runtime);
145
+ return remoteGet(runtimePermissionEnv.DETAIL_USER_MINIPROGRAM_API_PATH, options, runtime);
51
146
  }
52
147
  async function getPreviewAllowlist(options, runtime) {
53
- return remoteGet(index.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
148
+ return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
54
149
  }
55
150
  async function updatePreviewAllowlist(options, runtime) {
56
- return remotePostForm(index.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
151
+ return remotePostForm(runtimePermissionEnv.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
57
152
  }
58
153
  async function createUserMiniprogramLeaderboard(options, runtime) {
59
- return remotePostForm(index.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
154
+ return remotePostForm(runtimePermissionEnv.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
60
155
  }
61
156
  async function getUserMiniprogramLeaderboard(options, runtime) {
62
- return remoteGet(index.DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
157
+ return remoteGet(runtimePermissionEnv.DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
63
158
  }
64
159
  async function listUserMiniprogramLeaderboards(options, runtime) {
65
- return remoteGet(index.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
160
+ return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
66
161
  }
67
162
  async function deleteUserMiniprogramLeaderboard(options, runtime) {
68
- return (await remotePostForm(index.DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime, { requireResult: false })) ?? {};
163
+ return (await remotePostForm(runtimePermissionEnv.DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime, { requireResult: false })) ?? {};
69
164
  }
70
165
  async function precheckUserMiniprogramVersion(options, runtime) {
71
- return remotePostForm(index.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
166
+ return remotePostForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
72
167
  }
73
168
  async function submitUserMiniprogramAudit(options, runtime) {
74
169
  const form = { ...options };
75
170
  if (form.manifest && typeof form.manifest !== 'string') {
76
171
  form.manifest = JSON.stringify(form.manifest);
77
172
  }
78
- return remotePostForm(index.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, form, runtime);
173
+ return remotePostForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, form, runtime);
79
174
  }
80
175
  async function getVersionPreviewInfo(options, runtime) {
81
- return remoteGet(index.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, {
176
+ return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, {
82
177
  mini_program_id: options.mini_program_id,
83
178
  preview_version: options.version,
84
179
  }, runtime);
85
180
  }
86
181
  async function withdrawUserMiniprogramVersion(options, runtime) {
87
- return remotePostForm(index.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
182
+ return remotePostForm(runtimePermissionEnv.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
88
183
  }
89
184
  async function releaseUserMiniprogramVersion(options, runtime) {
90
- return remotePostForm(index.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
185
+ return remotePostForm(runtimePermissionEnv.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
91
186
  }
92
187
  async function takeDownUserMiniprogram(options, runtime) {
93
- return remotePostForm(index.TAKE_DOWN_USER_MINIPROGRAM_API_PATH, options, runtime);
188
+ return remotePostForm(runtimePermissionEnv.TAKE_DOWN_USER_MINIPROGRAM_API_PATH, options, runtime);
94
189
  }
95
190
  async function reopenUserMiniprogram(options, runtime) {
96
- return remotePostForm(index.REOPEN_USER_MINIPROGRAM_API_PATH, options, runtime);
191
+ return remotePostForm(runtimePermissionEnv.REOPEN_USER_MINIPROGRAM_API_PATH, options, runtime);
97
192
  }
98
193
  async function updateSquareDisplay(options, runtime) {
99
- return remotePostForm(index.UPDATE_SQUARE_DISPLAY_API_PATH, options, runtime);
194
+ return remotePostForm(runtimePermissionEnv.UPDATE_SQUARE_DISPLAY_API_PATH, options, runtime);
100
195
  }
101
196
  async function listUserMiniprogramVersions(options, runtime) {
102
- return remoteGet(index.LIST_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
197
+ return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
103
198
  }
104
199
  async function remoteGet(path, query, runtime) {
105
200
  const pathWithQuery = createPathWithQuery(path, query);
@@ -302,10 +397,14 @@ function isTruthyEnvFlag(value) {
302
397
  }
303
398
 
304
399
  exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
400
+ exports.createMiniProgramMockPermissionState = createMiniProgramMockPermissionState;
401
+ exports.createMiniProgramMockRuntimePermissions = createMiniProgramMockRuntimePermissions;
305
402
  exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
306
403
  exports.getBoundMiniProgram = getBoundMiniProgram;
404
+ exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;
307
405
  exports.readBoundMiniProgramId = readBoundMiniProgramId;
308
406
  exports.readBoundMiniProgramIdFromPackageJson = readBoundMiniProgramIdFromPackageJson;
309
407
  exports.readMiniProgramProjectPackage = readMiniProgramProjectPackage;
310
408
  exports.resolveRemoteEnvironment = resolveRemoteEnvironment;
409
+ exports.shouldSkipMiniappPlatformCsp = shouldSkipMiniappPlatformCsp;
311
410
  exports.writeBoundMiniProgramId = writeBoundMiniProgramId;
package/dist/cli-chunks/{create-B5gGBaSV.cjs → create-DPm5Sp-d.cjs} RENAMED
@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
5
5
  var path = require('node:path');
6
6
  var require$$0 = require('fs');
7
7
  var require$$1 = require('path');
8
- var index = require('./index-QAkYgxPI.cjs');
8
+ var index = require('./index-DAJGwzpN.cjs');
9
9
  require('node:module');
10
10
  require('os');
11
11
  require('readline');
package/dist/cli-chunks/{dev-BcCWCeac.cjs → dev-CEqWxCnf.cjs} RENAMED
@@ -6,32 +6,33 @@ var path = require('node:path');
6
6
  var net = require('node:net');
7
7
  var promises = require('node:dns/promises');
8
8
  var node_http = require('node:http');
9
+ var context = require('./context-B2Y0Du9z.cjs');
9
10
  var node_crypto = require('node:crypto');
10
11
  var undici = require('undici');
11
12
  var browser = require('./browser-RAy8e8cV.cjs');
12
- var index = require('./index-QAkYgxPI.cjs');
13
- var projectVite = require('./project-vite-VcJMyz1l.cjs');
14
- var context = require('./context-CvZs9ZBf.cjs');
13
+ var index = require('./index-DAJGwzpN.cjs');
14
+ var projectVite = require('./project-vite-RXpbNaQD.cjs');
15
15
  var fs$1 = require('node:fs/promises');
16
+ var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
17
+ require('./session-4SxzY4w1.cjs');
18
+ require('fs');
19
+ require('constants');
20
+ require('stream');
21
+ require('util');
22
+ require('assert');
23
+ require('path');
16
24
  require('node:process');
17
25
  require('node:buffer');
18
26
  require('node:url');
19
27
  require('node:util');
20
28
  require('node:child_process');
21
29
  require('node:module');
22
- require('path');
23
30
  require('os');
24
31
  require('readline');
25
32
  require('tty');
26
- require('assert');
27
33
  require('events');
28
- require('stream');
29
34
  require('buffer');
30
- require('util');
31
- require('./session-YJ8xNESM.cjs');
32
- require('fs');
33
- require('constants');
34
- require('./index-BQm5XmMC.cjs');
35
+ require('node:async_hooks');
35
36
 
36
37
  class Locked extends Error {
37
38
  constructor(port) {
@@ -195,58 +196,6 @@ async function getPorts(options) {
195
196
  throw new Error('No available ports found');
196
197
  }
197
198
 
198
- const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
199
- /**
200
- * 判断 permission key 是否由 Runtime 权限快照管理。
201
- *
202
- * @param key 待判断的 permission key。
203
- * @returns 该 key 需要读取 Runtime 权限快照时返回 `true`。
204
- */
205
- function isManagedMiniProgramRuntimePermissionKey(key) {
206
- return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
207
- }
208
- /**
209
- * 解析服务端权限快照；格式不完整时整份快照失效并 fail closed。
210
- *
211
- * @param snapshot 待校验的服务端权限快照。
212
- * @returns 解析状态和通过校验的受管权限。
213
- */
214
- function parseMiniProgramRuntimePermissions(snapshot) {
215
- if (!isRecord$2(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
216
- return { valid: false, permissions: {} };
217
- }
218
- if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
219
- return { valid: false, permissions: {} };
220
- }
221
- const seenKeys = new Set();
222
- const permissions = {};
223
- for (const rawEntry of snapshot.entries) {
224
- if (!isRecord$2(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
225
- return { valid: false, permissions: {} };
226
- }
227
- const key = rawEntry.key.trim();
228
- if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord$2(rawEntry.config)) {
229
- return { valid: false, permissions: {} };
230
- }
231
- seenKeys.add(key);
232
- if (!isManagedMiniProgramRuntimePermissionKey(key)) {
233
- continue;
234
- }
235
- if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
236
- return { valid: false, permissions: {} };
237
- }
238
- permissions[key] = {
239
- key,
240
- status: rawEntry.status,
241
- config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
242
- };
243
- }
244
- return { valid: true, permissions };
245
- }
246
- function isRecord$2(value) {
247
- return typeof value === 'object' && value !== null && !Array.isArray(value);
248
- }
249
-
250
199
  /** Dev Shell 读取局域网 Dev Session endpoint 的 query 参数。 */
251
200
  /** Mock Host 创建和读取 Dev Session 的固定路径。 */
252
201
  const MINI_PROGRAM_DEV_CONTEXT_PATH = '/__hb_sdk__/dev-context';
@@ -692,7 +641,7 @@ function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
692
641
  !allowedMiniUrlOrigins.has(miniUrlOrigin.origin)) {
693
642
  throw new TypeError('mini_url_origin must be an allowed LAN origin');
694
643
  }
695
- const parsedPermissions = parseMiniProgramRuntimePermissions(payload.runtime_permissions);
644
+ const parsedPermissions = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
696
645
  if (!parsedPermissions.valid) {
697
646
  throw new TypeError('runtime_permissions is invalid');
698
647
  }
@@ -1035,7 +984,7 @@ async function handleDevPermissionMutation(request, response, controller) {
1035
984
  if (!isRecord$1(payload) || Object.keys(payload).length !== 1 || !Object.hasOwn(payload, 'runtime_permissions')) {
1036
985
  throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions update body is invalid');
1037
986
  }
1038
- const parsed = parseMiniProgramRuntimePermissions(payload.runtime_permissions);
987
+ const parsed = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
1039
988
  if (!parsed.valid) {
1040
989
  throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'runtime_permissions is invalid');
1041
990
  }
@@ -1218,48 +1167,10 @@ function createHeyboxProtocol(payload) {
1218
1167
  return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
1219
1168
  }
1220
1169
 
1221
- const DEFAULT_PERMISSION_STATE = {
1222
- networkRequest: {
1223
- status: 'disabled',
1224
- useOfficialDomain: false,
1225
- },
1226
- };
1227
- function createMiniProgramMockPermissionState(context) {
1228
- const parsed = parseMiniProgramRuntimePermissions(context.runtimePermissions);
1229
- const networkRequest = parsed.permissions['network.request'];
1230
- return parsed.valid && networkRequest
1231
- ? {
1232
- networkRequest: {
1233
- status: networkRequest.status,
1234
- useOfficialDomain: networkRequest.config.useOfficialDomain === true,
1235
- },
1236
- }
1237
- : cloneDefaultPermissionState();
1238
- }
1239
- function createMiniProgramMockRuntimePermissions(state) {
1240
- return {
1241
- schema_version: 1,
1242
- entries: [
1243
- {
1244
- key: 'network.request',
1245
- status: state.networkRequest.status,
1246
- config: {
1247
- useOfficialDomain: state.networkRequest.useOfficialDomain,
1248
- },
1249
- },
1250
- ],
1251
- };
1252
- }
1253
- function cloneDefaultPermissionState() {
1254
- return {
1255
- networkRequest: { ...DEFAULT_PERMISSION_STATE.networkRequest },
1256
- };
1257
- }
1258
-
1259
1170
  /** 构建时替换为当前发布包的实际版本。 */
1260
1171
  const HB_SDK_VERSION = typeof undefined === 'string'
1261
1172
  ? undefined
1262
- : '0.6.6-alpha.3';
1173
+ : '0.6.6';
1263
1174
 
1264
1175
  class DevPermissionOverrideStoreError extends Error {
1265
1176
  code;
@@ -1430,7 +1341,7 @@ async function runDevCommand(options, runtime = {}) {
1430
1341
  projectRoot,
1431
1342
  });
1432
1343
  const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), { successText: '已加载项目 Vite' });
1433
- const appServer = await logger.task('正在创建 Vite dev server', () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions)), runtime.env), { successText: '已创建 Vite dev server' });
1344
+ const appServer = await logger.task('正在创建 Vite dev server', () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions)), runtime.env, devLaunchContext.runtimePermissions), { successText: '已创建 Vite dev server' });
1434
1345
  await logger.task('正在启动 Vite dev server', () => appServer.listen(appPort), {
1435
1346
  successText: 'Vite dev server 已启动',
1436
1347
  });
@@ -1547,7 +1458,7 @@ function createDevPermissionController(options) {
1547
1458
  source: devContext.source,
1548
1459
  ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
1549
1460
  ...(isRuntimePermissionsSnapshot(devContext.runtimePermissions) ? { remote_permissions: devContext.runtimePermissions } : {}),
1550
- ...(overrides ? { override_permissions: createMiniProgramMockRuntimePermissions(overrides) } : {}),
1461
+ ...(overrides ? { override_permissions: context.createMiniProgramMockRuntimePermissions(overrides) } : {}),
1551
1462
  ...(error ? { persistence_error: error } : {}),
1552
1463
  };
1553
1464
  };
@@ -1584,7 +1495,7 @@ function createDevPermissionController(options) {
1584
1495
  return createConfiguration(undefined);
1585
1496
  },
1586
1497
  async save(runtimePermissions) {
1587
- const overrides = createMiniProgramMockPermissionState({
1498
+ const overrides = context.createMiniProgramMockPermissionState({
1588
1499
  runtimePermissions,
1589
1500
  });
1590
1501
  try {
@@ -1602,7 +1513,7 @@ function createDevPermissionController(options) {
1602
1513
  };
1603
1514
  }
1604
1515
  function isRuntimePermissionsSnapshot(value) {
1605
- return parseMiniProgramRuntimePermissions(value).valid;
1516
+ return context.parseMiniProgramRuntimePermissions(value).valid;
1606
1517
  }
1607
1518
  async function loadRemoteDevContextWithTimeout(options) {
1608
1519
  const controller = new AbortController();
@@ -1744,18 +1655,18 @@ function rewriteLocalhostUrl(input) {
1744
1655
  function isLocalhostHost(hostname) {
1745
1656
  return hostname === 'localhost' || hostname === '::1' || hostname === '[::1]';
1746
1657
  }
1747
- async function withManagedDevOutputEnv(action, env = process.env) {
1748
- const previous = env[MANAGED_DEV_OUTPUT_ENV];
1658
+ async function withManagedDevOutputEnv(action, env = process.env, runtimePermissions) {
1659
+ const previousManagedOutput = env[MANAGED_DEV_OUTPUT_ENV];
1749
1660
  env[MANAGED_DEV_OUTPUT_ENV] = '1';
1750
1661
  try {
1751
- return await action();
1662
+ return await runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(runtimePermissions), action, env);
1752
1663
  }
1753
1664
  finally {
1754
- if (previous === undefined) {
1665
+ if (previousManagedOutput === undefined) {
1755
1666
  delete env[MANAGED_DEV_OUTPUT_ENV];
1756
1667
  }
1757
1668
  else {
1758
- env[MANAGED_DEV_OUTPUT_ENV] = previous;
1669
+ env[MANAGED_DEV_OUTPUT_ENV] = previousManagedOutput;
1759
1670
  }
1760
1671
  }
1761
1672
  }
package/dist/cli-chunks/{doctor-BhBM4cWH.cjs → doctor-DqNzGi3s.cjs} RENAMED
@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
4
4
  var fs = require('node:fs/promises');
5
5
  var os = require('node:os');
6
6
  var path = require('node:path');
7
- var index = require('./index-QAkYgxPI.cjs');
7
+ var index = require('./index-DAJGwzpN.cjs');
8
8
  require('node:module');
9
9
  require('path');
10
10
  require('os');
package/dist/cli-chunks/{index-DyUo67lf.cjs → index-CSc_4vi-.cjs} RENAMED
@@ -1,13 +1,13 @@
1
1
  'use strict';
2
2
 
3
- var index$2 = require('./index-QAkYgxPI.cjs');
3
+ var index$2 = require('./index-DAJGwzpN.cjs');
4
4
  var require$$0$2 = require('fs');
5
5
  var require$$2$1 = require('crypto');
6
6
  var require$$1$2 = require('path');
7
7
  var require$$0$3 = require('assert');
8
8
  var require$$4$2 = require('events');
9
9
  var require$$1$1 = require('util');
10
- var index$3 = require('./index-BQm5XmMC.cjs');
10
+ var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
11
11
  var require$$0$5 = require('net');
12
12
  var require$$0$4 = require('url');
13
13
  var require$$2$2 = require('http');
@@ -13707,7 +13707,7 @@ function requireSource () {
13707
13707
  const ajv_1 = requireAjv$1();
13708
13708
  const ajv_formats_1 = requireDist();
13709
13709
  const debounceFn = requireDebounceFn();
13710
- const semver = index$3.requireSemver();
13710
+ const semver = runtimePermissionEnv.requireSemver();
13711
13711
  const onetime = index$2.requireOnetime();
13712
13712
  const encryptionAlgorithm = 'aes-256-cbc';
13713
13713
  const createPlainObject = () => {
package/dist/cli-chunks/{index-QAkYgxPI.cjs → index-DAJGwzpN.cjs} RENAMED
@@ -234,19 +234,19 @@ function requireArgument () {
234
234
 
235
235
  var command = {};
236
236
 
237
- const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QAkYgxPI.cjs', document.baseURI).href)));
237
+ const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DAJGwzpN.cjs', document.baseURI).href)));
238
238
  function __require$4() { return require$5("node:events"); }
239
239
 
240
- const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QAkYgxPI.cjs', document.baseURI).href)));
240
+ const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DAJGwzpN.cjs', document.baseURI).href)));
241
241
  function __require$3() { return require$4("node:child_process"); }
242
242
 
243
- const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QAkYgxPI.cjs', document.baseURI).href)));
243
+ const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DAJGwzpN.cjs', document.baseURI).href)));
244
244
  function __require$2() { return require$3("node:path"); }
245
245
 
246
- const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QAkYgxPI.cjs', document.baseURI).href)));
246
+ const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DAJGwzpN.cjs', document.baseURI).href)));
247
247
  function __require$1() { return require$2("node:fs"); }
248
248
 
249
- const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-QAkYgxPI.cjs', document.baseURI).href)));
249
+ const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DAJGwzpN.cjs', document.baseURI).href)));
250
250
  function __require() { return require$1("node:process"); }
251
251
 
252
252
  var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
13347
13347
  }
13348
13348
 
13349
13349
  const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
13350
- const BUILT_CLI_VERSION = '0.6.6-alpha.3';
13350
+ const BUILT_CLI_VERSION = '0.6.6';
13351
13351
  const PACKAGE_JSON_CANDIDATES = [
13352
13352
  path.resolve(__dirname, '..', '..', 'package.json'),
13353
13353
  path.resolve(__dirname, '..', 'package.json'),
@@ -13680,35 +13680,35 @@ function createCommandLoggerResolver(options) {
13680
13680
  };
13681
13681
  }
13682
13682
  const defaultClearLoginStatus = async (...args) => {
13683
- const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BNLH13Zd.cjs'); });
13683
+ const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-DseHvHCN.cjs'); });
13684
13684
  return clearLoginStatus(...args);
13685
13685
  };
13686
13686
  const defaultLoginToHeybox = async (...args) => {
13687
- const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BNLH13Zd.cjs'); });
13687
+ const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-DseHvHCN.cjs'); });
13688
13688
  return loginToHeybox(...args);
13689
13689
  };
13690
13690
  const defaultPrintLoginStatus = async (...args) => {
13691
- const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BNLH13Zd.cjs'); });
13691
+ const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-DseHvHCN.cjs'); });
13692
13692
  return printLoginStatus(...args);
13693
13693
  };
13694
13694
  const defaultRunBuildCommand = async (...args) => {
13695
- const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-De-QADpA.cjs'); });
13695
+ const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-egxk9rgs.cjs'); });
13696
13696
  return runBuildCommand(...args);
13697
13697
  };
13698
13698
  const defaultRunCreateCommand = async (...args) => {
13699
- const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-B5gGBaSV.cjs'); });
13699
+ const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DPm5Sp-d.cjs'); });
13700
13700
  return runCreateCommand(...args);
13701
13701
  };
13702
13702
  const defaultRunDevCommand = async (...args) => {
13703
- const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-BcCWCeac.cjs'); });
13703
+ const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CEqWxCnf.cjs'); });
13704
13704
  return runDevCommand(...args);
13705
13705
  };
13706
13706
  const defaultRunDoctorCommand = async (...args) => {
13707
- const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BhBM4cWH.cjs'); });
13707
+ const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DqNzGi3s.cjs'); });
13708
13708
  return runDoctorCommand(...args);
13709
13709
  };
13710
13710
  const defaultRunRemoteCommand = async (...args) => {
13711
- const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BE53wntR.cjs'); });
13711
+ const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-Cko4-pSc.cjs'); });
13712
13712
  return runRemoteCommand(...args);
13713
13713
  };
13714
13714
  function resolveStandaloneLogger(options, verbose) {
package/dist/cli-chunks/{login-BNLH13Zd.cjs → login-DseHvHCN.cjs} RENAMED
@@ -3,9 +3,9 @@
3
3
  var promises = require('node:readline/promises');
4
4
  var node_crypto = require('node:crypto');
5
5
  var node_http = require('node:http');
6
- var session = require('./session-YJ8xNESM.cjs');
6
+ var session = require('./session-4SxzY4w1.cjs');
7
7
  var browser = require('./browser-RAy8e8cV.cjs');
8
- var index = require('./index-QAkYgxPI.cjs');
8
+ var index = require('./index-DAJGwzpN.cjs');
9
9
  require('node:path');
10
10
  require('fs');
11
11
  require('constants');
package/dist/cli-chunks/{project-vite-VcJMyz1l.cjs → project-vite-RXpbNaQD.cjs} RENAMED
@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
5
5
  var node_module = require('node:module');
6
6
  var path = require('node:path');
7
7
  var node_url = require('node:url');
8
- var index = require('./index-QAkYgxPI.cjs');
8
+ var index = require('./index-DAJGwzpN.cjs');
9
9
 
10
10
  function findProjectRoot(startDir) {
11
11
  let current = path.resolve(startDir);
package/dist/cli-chunks/{remote-BE53wntR.cjs → remote-Cko4-pSc.cjs} RENAMED
@@ -1,15 +1,15 @@
1
1
  'use strict';
2
2
 
3
3
  var promises = require('node:readline/promises');
4
- var index = require('./index-QAkYgxPI.cjs');
5
- var session = require('./session-YJ8xNESM.cjs');
4
+ var index = require('./index-DAJGwzpN.cjs');
5
+ var session = require('./session-4SxzY4w1.cjs');
6
6
  var childProcess = require('node:child_process');
7
7
  var fs = require('node:fs');
8
8
  var fs$1 = require('node:fs/promises');
9
9
  var path = require('node:path');
10
- var index$1 = require('./index-BQm5XmMC.cjs');
11
- var runtimeGate = require('./runtime-gate-B2MQf1vc.cjs');
12
- var context = require('./context-CvZs9ZBf.cjs');
10
+ var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
11
+ var runtimeGate = require('./runtime-gate--rPXjiG6.cjs');
12
+ var context = require('./context-B2Y0Du9z.cjs');
13
13
  require('node:module');
14
14
  require('path');
15
15
  require('os');
@@ -23,6 +23,7 @@ require('util');
23
23
  require('node:crypto');
24
24
  require('fs');
25
25
  require('constants');
26
+ require('node:async_hooks');
26
27
 
27
28
  async function getCDNUploadInfo(options, runtime = {}) {
28
29
  const body = new URLSearchParams();
@@ -69,7 +70,7 @@ async function runUpload(options, runtime = {}) {
69
70
  const postCDNUploadCallback$1 = runtime.postCDNUploadCallback ?? postCDNUploadCallback;
70
71
  const createReadStream = runtime.createReadStream ?? fs.createReadStream;
71
72
  const orderedFiles = [...options.files].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
72
- const batches = chunkUploadFiles(orderedFiles, index$1.MINIAPP_UPLOAD_BATCH_SIZE);
73
+ const batches = chunkUploadFiles(orderedFiles, runtimePermissionEnv.MINIAPP_UPLOAD_BATCH_SIZE);
73
74
  await logger.task(`正在上传 ${orderedFiles.length} 个文件`, async (taskContext) => {
74
75
  logger.debug(`上传并发数: ${concurrency}`);
75
76
  logger.debug(`上传批次数: ${batches.length}`);
@@ -79,7 +80,7 @@ async function runUpload(options, runtime = {}) {
79
80
  logger.debug(`正在处理上传批次 ${batchIndex + 1}/${batches.length}，文件数: ${batch.length}`);
80
81
  logger.debug('正在获取 CDN 上传信息');
81
82
  const fileInfos = createUploadFileInfos(batch, options);
82
- const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: index$1.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
83
+ const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: runtimePermissionEnv.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
83
84
  logger.debug(`CDN bucket: ${uploadInfo.bucket}`);
84
85
  logger.debug(`CDN region: ${uploadInfo.region}`);
85
86
  validateUploadInfoKeys(batch, uploadInfo.keys, options);
@@ -140,7 +141,7 @@ function createUploadFileInfos(files, options) {
140
141
  name: file.relativePath.split('/').pop() ?? file.relativePath,
141
142
  mimetype: file.mimeType,
142
143
  fsize: file.size,
143
- path: index$1.getMiniappUploadKey({
144
+ path: runtimePermissionEnv.getMiniappUploadKey({
144
145
  miniProgramId: options.miniProgramId,
145
146
  version: options.version,
146
147
  relativePath: file.relativePath,
@@ -151,15 +152,15 @@ function validateUploadInfoKeys(files, keys, options) {
151
152
  if (keys.length !== files.length) {
152
153
  throw new index.CliError(`CDN 上传接口返回 key 数量异常：期望 ${files.length}，实际 ${keys.length}`);
153
154
  }
154
- for (let index$2 = 0; index$2 < files.length; index$2 += 1) {
155
- const expectedKey = index$1.getMiniappUploadKey({
155
+ for (let index$1 = 0; index$1 < files.length; index$1 += 1) {
156
+ const expectedKey = runtimePermissionEnv.getMiniappUploadKey({
156
157
  miniProgramId: options.miniProgramId,
157
158
  version: options.version,
158
- relativePath: files[index$2].relativePath,
159
+ relativePath: files[index$1].relativePath,
159
160
  });
160
- const actualKey = keys[index$2];
161
+ const actualKey = keys[index$1];
161
162
  if (actualKey !== expectedKey) {
162
- throw new index.CliError(`CDN 上传接口返回 key 异常：${files[index$2].relativePath}`, [`CDN 上传接口返回 key 异常：${files[index$2].relativePath}`, `expected: ${expectedKey}`, `actual: ${actualKey}`].join('\n'));
163
+ throw new index.CliError(`CDN 上传接口返回 key 异常：${files[index$1].relativePath}`, [`CDN 上传接口返回 key 异常：${files[index$1].relativePath}`, `expected: ${expectedKey}`, `actual: ${actualKey}`].join('\n'));
163
164
  }
164
165
  }
165
166
  }
@@ -191,7 +192,7 @@ async function createDefaultCosClient(uploadToken) {
191
192
  };
192
193
  }
193
194
  async function loadCosConstructor() {
194
- const cosModule = await Promise.resolve().then(function () { return require('./index-DyUo67lf.cjs'); }).then(function (n) { return n.index; });
195
+ const cosModule = await Promise.resolve().then(function () { return require('./index-CSc_4vi-.cjs'); }).then(function (n) { return n.index; });
195
196
  return cosModule.default;
196
197
  }
197
198
  function formatSize(bytes) {
@@ -235,7 +236,7 @@ function isRecord(value) {
235
236
  }
236
237
 
237
238
  async function precheckUserMiniprogramVersion(options, runtime = {}) {
238
- return postUserMiniprogramVersionForm(index$1.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
239
+ return postUserMiniprogramVersionForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
239
240
  // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
240
241
  ...(options.version ? { version: options.version } : {}),
241
242
  ...(options.source_version ? { source_version: options.source_version } : {}),
@@ -244,7 +245,7 @@ async function precheckUserMiniprogramVersion(options, runtime = {}) {
244
245
  }, runtime);
245
246
  }
246
247
  async function submitUserMiniprogramAudit(options, runtime = {}) {
247
- return postUserMiniprogramVersionForm(index$1.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
248
+ return postUserMiniprogramVersionForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
248
249
  // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
249
250
  ...(options.manifest ? { manifest: JSON.stringify(options.manifest) } : {}),
250
251
  ...(options.source_version ? { source_version: options.source_version } : {}),
@@ -341,11 +342,28 @@ async function runDeployCommand(options, runtime = {}) {
341
342
  releaseNote,
342
343
  autoPublish,
343
344
  }, runtime, apiBaseUrl, projectRoot, logger);
345
+ let skipPlatformCsp = false;
346
+ try {
347
+ const { detail } = await logger.task('正在读取远端小程序权限', () => (runtime.getBoundMiniProgram ?? context.getBoundMiniProgram)({
348
+ allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl,
349
+ apiBaseUrl,
350
+ cwd: projectRoot,
351
+ env,
352
+ fetchImpl: runtime.fetchImpl,
353
+ loginBaseUrl,
354
+ session: session$1,
355
+ }), { successText: '已读取远端小程序权限' });
356
+ skipPlatformCsp = context.shouldSkipMiniappPlatformCsp(detail.runtime_permissions);
357
+ }
358
+ catch (error) {
359
+ logger.warn('未读取到远端 Runtime 权限，构建将继续注入平台 CSP。');
360
+ logger.debug(`远端 Runtime 权限读取失败详情：${index.readRedactedErrorMessage(error, { verbose: true })}`);
361
+ }
344
362
  const pm = detectPackageManager(projectRoot);
345
363
  const buildMode = env.HB_SDK_ENV?.trim();
346
364
  logger.info(`开始构建: ${pm} ${createBuildArgs(pm, buildMode).join(' ')}`);
347
365
  await runBuildScript(pm, projectRoot, runtime.spawn ?? childProcess.spawn, {
348
- env,
366
+ env: runtimePermissionEnv.createMiniappPlatformCspEnv(env, skipPlatformCsp),
349
367
  mode: buildMode,
350
368
  outputMode: options.buildOutputMode ?? 'inherit',
351
369
  stderr: runtime.stderr,
@@ -364,16 +382,16 @@ async function runDeployCommand(options, runtime = {}) {
364
382
  }
365
383
  const uploadFiles = await logger.task('正在校验 dist 上传文件', async () => {
366
384
  const allFiles = await walkDistFiles(distDir);
367
- const blocked = allFiles.find((entry) => index$1.relativePathContainsNodeModulesSegment(entry.relativePath));
385
+ const blocked = allFiles.find((entry) => runtimePermissionEnv.relativePathContainsNodeModulesSegment(entry.relativePath));
368
386
  if (blocked) {
369
387
  throw new Error(`dist 目录含 node_modules：${blocked.relativePath}`);
370
388
  }
371
- const files = allFiles.filter((entry) => index$1.shouldUploadDistFile(entry.relativePath));
372
- const pathError = index$1.validateUploadPaths(files, { miniProgramId, version, maxLength: index$1.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
389
+ const files = allFiles.filter((entry) => runtimePermissionEnv.shouldUploadDistFile(entry.relativePath));
390
+ const pathError = runtimePermissionEnv.validateUploadPaths(files, { miniProgramId, version, maxLength: runtimePermissionEnv.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
373
391
  if (pathError) {
374
392
  throw new Error(pathError);
375
393
  }
376
- const sizeError = index$1.validateUploadTotalSize(files);
394
+ const sizeError = runtimePermissionEnv.validateUploadTotalSize(files);
377
395
  if (sizeError) {
378
396
  throw new Error(sizeError);
379
397
  }
@@ -582,7 +600,7 @@ async function walkDistFiles(distDir) {
582
600
  }
583
601
  const fileStat = await fs$1.stat(absPath);
584
602
  results.push({
585
- relativePath: index$1.normalizeRelativePath(relPath),
603
+ relativePath: runtimePermissionEnv.normalizeRelativePath(relPath),
586
604
  absolutePath: absPath,
587
605
  size: fileStat.size,
588
606
  mimeType: inferMimeType(entry.name),
package/dist/cli-chunks/{runtime-gate-B2MQf1vc.cjs → runtime-gate--rPXjiG6.cjs} RENAMED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var index = require('./index-BQm5XmMC.cjs');
3
+ var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
4
4
 
5
5
  function isValidMiniappManifestVersion(version) {
6
6
  return getMiniappManifestVersionError(version) === undefined;
@@ -41,7 +41,7 @@ function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
41
41
  throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
42
42
  }
43
43
  const normalized = version.trim();
44
- const parsed = index.semverExports.parse(normalized);
44
+ const parsed = runtimePermissionEnv.semverExports.parse(normalized);
45
45
  if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
46
46
  throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
47
47
  }
@@ -55,7 +55,7 @@ function getMiniappManifestVersionError(version) {
55
55
  return `必须是合法 SemVer：${String(version)}`;
56
56
  }
57
57
  const normalized = version.trim();
58
- const parsed = index.semverExports.parse(normalized);
58
+ const parsed = runtimePermissionEnv.semverExports.parse(normalized);
59
59
  if (!parsed) {
60
60
  return `必须是合法 SemVer：${normalized}`;
61
61
  }
package/dist/cli-chunks/{index-BQm5XmMC.cjs → runtime-permission-env-BSs4uCNa.cjs} RENAMED
@@ -1,5 +1,7 @@
1
1
  'use strict';
2
2
 
3
+ var node_async_hooks = require('node:async_hooks');
4
+
3
5
  var re = {exports: {}};
4
6
 
5
7
  var constants;
@@ -2879,6 +2881,72 @@ function shouldUploadDistFile(relativePath) {
2879
2881
  return true;
2880
2882
  }
2881
2883
 
2884
+ const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
2885
+ const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
2886
+ const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
2887
+ const environmentScopeStorage = new node_async_hooks.AsyncLocalStorage();
2888
+ let environmentScopeTail = Promise.resolve();
2889
+ function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
2890
+ return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
2891
+ }
2892
+ function createMiniappPlatformCspEnv(env, skipPlatformCsp) {
2893
+ return {
2894
+ ...env,
2895
+ [HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV]: VERIFIED_RUNTIME_PERMISSION_CONTEXT,
2896
+ [HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV]: skipPlatformCsp ? '1' : '0',
2897
+ };
2898
+ }
2899
+ async function withMiniappPlatformCspEnv(skipPlatformCsp, action, env = process.env) {
2900
+ if (environmentScopeStorage.getStore()?.active) {
2901
+ return runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env);
2902
+ }
2903
+ let releaseScope = () => undefined;
2904
+ const previousScope = environmentScopeTail;
2905
+ environmentScopeTail = new Promise((resolve) => {
2906
+ releaseScope = resolve;
2907
+ });
2908
+ await previousScope;
2909
+ const scope = { active: true };
2910
+ try {
2911
+ return await environmentScopeStorage.run(scope, () => runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env));
2912
+ }
2913
+ finally {
2914
+ scope.active = false;
2915
+ releaseScope();
2916
+ }
2917
+ }
2918
+ async function runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env) {
2919
+ const targets = env === process.env ? [env] : [env, process.env];
2920
+ const previousValues = targets.map((target) => ({
2921
+ context: target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV],
2922
+ officialDomain: target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV],
2923
+ }));
2924
+ for (const target of targets) {
2925
+ target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] = VERIFIED_RUNTIME_PERMISSION_CONTEXT;
2926
+ target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] = skipPlatformCsp ? '1' : '0';
2927
+ }
2928
+ try {
2929
+ return await action();
2930
+ }
2931
+ finally {
2932
+ targets.forEach((target, index) => {
2933
+ const previousValue = previousValues[index];
2934
+ if (previousValue?.context === undefined) {
2935
+ delete target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV];
2936
+ }
2937
+ else {
2938
+ target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] = previousValue.context;
2939
+ }
2940
+ if (previousValue?.officialDomain === undefined) {
2941
+ delete target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV];
2942
+ }
2943
+ else {
2944
+ target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] = previousValue.officialDomain;
2945
+ }
2946
+ });
2947
+ }
2948
+ }
2949
+
2882
2950
  exports.ACTIVITY_UPLOAD_KEY_MAX_LENGTH = ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
2883
2951
  exports.CREATE_USER_MINIPROGRAM_API_PATH = CREATE_USER_MINIPROGRAM_API_PATH;
2884
2952
  exports.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH = CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH;
@@ -2903,11 +2971,14 @@ exports.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = USER_MINIPROGRAM_ACCESS_STATUS
2903
2971
  exports.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;
2904
2972
  exports.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH = USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH;
2905
2973
  exports.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH;
2974
+ exports.createMiniappPlatformCspEnv = createMiniappPlatformCspEnv;
2906
2975
  exports.getMiniappUploadKey = getMiniappUploadKey;
2907
2976
  exports.normalizeRelativePath = normalizeRelativePath;
2908
2977
  exports.relativePathContainsNodeModulesSegment = relativePathContainsNodeModulesSegment;
2909
2978
  exports.requireSemver = requireSemver;
2910
2979
  exports.semverExports = semverExports;
2980
+ exports.shouldSkipMiniappPlatformCspFromEnv = shouldSkipMiniappPlatformCspFromEnv;
2911
2981
  exports.shouldUploadDistFile = shouldUploadDistFile;
2912
2982
  exports.validateUploadPaths = validateUploadPaths;
2913
2983
  exports.validateUploadTotalSize = validateUploadTotalSize;
2984
+ exports.withMiniappPlatformCspEnv = withMiniappPlatformCspEnv;
package/dist/cli-chunks/{session-YJ8xNESM.cjs → session-4SxzY4w1.cjs} RENAMED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var index = require('./index-QAkYgxPI.cjs');
3
+ var index = require('./index-DAJGwzpN.cjs');
4
4
  var node_crypto = require('node:crypto');
5
5
  var path = require('node:path');
6
6
  var require$$0$2 = require('fs');
package/dist/cli.cjs CHANGED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var index = require('./cli-chunks/index-QAkYgxPI.cjs');
3
+ var index = require('./cli-chunks/index-DAJGwzpN.cjs');
4
4
  require('node:module');
5
5
  require('node:fs');
6
6
  require('node:fs/promises');
package/dist/index.cjs.js CHANGED
@@ -325,7 +325,7 @@ function createMessageId() {
325
325
  /** 构建时替换为当前发布包的实际版本。 */
326
326
  const HB_SDK_VERSION = typeof undefined === 'string'
327
327
  ? undefined
328
- : '0.6.6-alpha.3';
328
+ : '0.6.6';
329
329
 
330
330
  /**
331
331
  * 判断未知数据是否符合小程序 bridge 消息信封。
package/dist/index.esm.js CHANGED
@@ -321,7 +321,7 @@ function createMessageId() {
321
321
  /** 构建时替换为当前发布包的实际版本。 */
322
322
  const HB_SDK_VERSION = typeof undefined === 'string'
323
323
  ? undefined
324
- : '0.6.6-alpha.3';
324
+ : '0.6.6';
325
325
 
326
326
  /**
327
327
  * 判断未知数据是否符合小程序 bridge 消息信封。
package/dist/vite.cjs.js CHANGED
@@ -2,12 +2,13 @@
2
2
 
3
3
  var node_fs = require('node:fs');
4
4
  var path = require('node:path');
5
+ var node_async_hooks = require('node:async_hooks');
5
6
 
6
7
  var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
7
8
  /** 构建时替换为当前发布包的实际版本。 */
8
9
  const HB_SDK_VERSION = typeof undefined === 'string'
9
10
  ? undefined
10
- : '0.6.6-alpha.3';
11
+ : '0.6.6';
11
12
 
12
13
  var re = {exports: {}};
13
14
 
@@ -11471,6 +11472,9 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
11471
11472
  removePlatformCspMarkers(document);
11472
11473
  walk(document, element => validateElement(element));
11473
11474
  injectMiniappRuntimeGate(document);
11475
+ if (options.skipPlatformCsp) {
11476
+ return serialize(document);
11477
+ }
11474
11478
  const content = options.hmrWebSocketUrl
11475
11479
  ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
11476
11480
  : PRODUCTION_CSP;
@@ -11580,9 +11584,19 @@ function walk(node, visit) {
11580
11584
  walk(node.content, visit);
11581
11585
  }
11582
11586
 
11587
+ const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
11588
+ const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
11589
+ const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
11590
+ new node_async_hooks.AsyncLocalStorage();
11591
+ Promise.resolve();
11592
+ function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
11593
+ return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
11594
+ }
11595
+
11583
11596
  const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
11584
11597
  const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
11585
11598
  function miniappManifest() {
11599
+ const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
11586
11600
  let root = process.cwd();
11587
11601
  let outDir = 'dist';
11588
11602
  let command = 'build';
@@ -11612,7 +11626,10 @@ function miniappManifest() {
11612
11626
  }
11613
11627
  },
11614
11628
  transformIndexHtml(html) {
11615
- return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
11629
+ return enforceMiniappHtmlPolicy(html, {
11630
+ ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
11631
+ skipPlatformCsp,
11632
+ });
11616
11633
  },
11617
11634
  async closeBundle() {
11618
11635
  // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11634,7 +11651,7 @@ function miniappManifest() {
11634
11651
  if (!htmlFiles.includes(indexHtmlPath)) {
11635
11652
  throw new Error('构建产物必须包含入口 dist/index.html');
11636
11653
  }
11637
- node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8')));
11654
+ node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
11638
11655
  const manifestPath = path.join(outputRoot, 'manifest.json');
11639
11656
  node_fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
11640
11657
  node_fs.writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
package/dist/vite.esm.js CHANGED
@@ -1,10 +1,11 @@
1
1
  import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
2
2
  import path from 'node:path';
3
+ import { AsyncLocalStorage } from 'node:async_hooks';
3
4
 
4
5
  /** 构建时替换为当前发布包的实际版本。 */
5
6
  const HB_SDK_VERSION = typeof undefined === 'string'
6
7
  ? undefined
7
- : '0.6.6-alpha.3';
8
+ : '0.6.6';
8
9
 
9
10
  var re = {exports: {}};
10
11
 
@@ -11468,6 +11469,9 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
11468
11469
  removePlatformCspMarkers(document);
11469
11470
  walk(document, element => validateElement(element));
11470
11471
  injectMiniappRuntimeGate(document);
11472
+ if (options.skipPlatformCsp) {
11473
+ return serialize(document);
11474
+ }
11471
11475
  const content = options.hmrWebSocketUrl
11472
11476
  ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
11473
11477
  : PRODUCTION_CSP;
@@ -11577,9 +11581,19 @@ function walk(node, visit) {
11577
11581
  walk(node.content, visit);
11578
11582
  }
11579
11583
 
11584
+ const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
11585
+ const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
11586
+ const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
11587
+ new AsyncLocalStorage();
11588
+ Promise.resolve();
11589
+ function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
11590
+ return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
11591
+ }
11592
+
11580
11593
  const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
11581
11594
  const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
11582
11595
  function miniappManifest() {
11596
+ const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
11583
11597
  let root = process.cwd();
11584
11598
  let outDir = 'dist';
11585
11599
  let command = 'build';
@@ -11609,7 +11623,10 @@ function miniappManifest() {
11609
11623
  }
11610
11624
  },
11611
11625
  transformIndexHtml(html) {
11612
- return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
11626
+ return enforceMiniappHtmlPolicy(html, {
11627
+ ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
11628
+ skipPlatformCsp,
11629
+ });
11613
11630
  },
11614
11631
  async closeBundle() {
11615
11632
  // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11631,7 +11648,7 @@ function miniappManifest() {
11631
11648
  if (!htmlFiles.includes(indexHtmlPath)) {
11632
11649
  throw new Error('构建产物必须包含入口 dist/index.html');
11633
11650
  }
11634
- writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
11651
+ writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
11635
11652
  const manifestPath = path.join(outputRoot, 'manifest.json');
11636
11653
  mkdirSync(path.dirname(manifestPath), { recursive: true });
11637
11654
  writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@heybox/hb-sdk",
3
- "version": "0.6.6-alpha.3",
3
+ "version": "0.6.6",
4
4
  "sideEffects": [
5
5
  "./src/index.ts",
6
6
  "./src/core/singleton.ts",
@@ -93,7 +93,7 @@
93
93
  "vue": "^2.7.16",
94
94
  "vite": "^8.0.12",
95
95
  "vitest": "^3.2.4",
96
- "@heybox/hb-api": "~1.25.5"
96
+ "@heybox/hb-api": "~1.25.7"
97
97
  },
98
98
  "publishConfig": {
99
99
  "registry": "https://registry.npmjs.org/",
package/skill/references/api-root.md CHANGED
@@ -19,7 +19,7 @@
19
19
  ## Package metadata
20
20
 
21
21
  - Package: `@heybox/hb-sdk`
22
- - Version at generation time: `0.6.6-alpha.3`
22
+ - Version at generation time: `0.6.6`
23
23
  - Public root export: `@heybox/hb-sdk`
24
24
  - Protocol export: `@heybox/hb-sdk/protocol`
25
25
  - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -204,6 +204,7 @@ import { HB_SDK_VERSION } from '../core/version';
204
204
  import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
205
205
  import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
206
206
  import { enforceMiniappHtmlPolicy } from './html-policy';
207
+ import { shouldSkipMiniappPlatformCspFromEnv } from './runtime-permission-env';
207
208
 
208
209
  type MiniappManifestPlugin = {
209
210
  name: string;
@@ -248,6 +249,7 @@ const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
248
249
  const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
249
250
 
250
251
  export function miniappManifest(): MiniappManifestPlugin {
252
+ const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
251
253
  let root = process.cwd();
252
254
  let outDir = 'dist';
253
255
  let command: 'build' | 'serve' = 'build';
@@ -278,7 +280,10 @@ export function miniappManifest(): MiniappManifestPlugin {
278
280
  }
279
281
  },
280
282
  transformIndexHtml(html) {
281
- return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
283
+ return enforceMiniappHtmlPolicy(html, {
284
+ ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
285
+ skipPlatformCsp,
286
+ });
282
287
  },
283
288
  async closeBundle() {
284
289
  // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -303,7 +308,7 @@ export function miniappManifest(): MiniappManifestPlugin {
303
308
  if (!htmlFiles.includes(indexHtmlPath)) {
304
309
  throw new Error('构建产物必须包含入口 dist/index.html');
305
310
  }
306
- writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
311
+ writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
307
312
 
308
313
  const manifestPath = path.join(outputRoot, 'manifest.json');
309
314
  mkdirSync(path.dirname(manifestPath), { recursive: true });
@@ -381,7 +386,9 @@ export default defineConfig({
381
386
 
382
387
  工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
383
388
 
384
- 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
389
+ 插件只接受单页应用：输出目录只能存在入口 `index.html`。`hb-sdk dev` 和 `hb-sdk remote deploy` 会读取绑定小程序的远端 Runtime 权限；仅当 `network.request` 已启用且 `useOfficialDomain=true` 时跳过平台 CSP，否则 build 会把平台 CSP 插入 `<head>` 首位。直接运行 `vite build`、匿名 dev、非法快照或远端权限读取失败时均继续注入。已有 CSP 始终原样保留；注入平台 CSP 时，两份策略按浏览器交集生效。
390
+
391
+ 平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。跳过平台 CSP 时，这些能力不再由 SDK 构建产物统一限制，但需要宿主授权的业务网络请求仍应使用 `network.request()`。本地 Mock 权限覆盖不会改变构建 CSP，构建判定始终以远端权限快照为准。
385
392
 
386
393
  meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
387
394
 
package/skill/skill.json CHANGED
@@ -1,11 +1,11 @@
1
1
  {
2
2
  "name": "hb-sdk",
3
- "skillVersion": "0.6.6-alpha.3+skill.7940a3d57a8b",
3
+ "skillVersion": "0.6.6+skill.ec6411dd6834",
4
4
  "sdk": {
5
5
  "package": "@heybox/hb-sdk",
6
- "version": "0.6.6-alpha.3",
7
- "compatibility": "0.6.6-alpha.3"
6
+ "version": "0.6.6",
7
+ "compatibility": "0.6.6"
8
8
  },
9
9
  "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
10
- "integrity": "sha256-7940a3d57a8b57fb3045378c068cc875bea2def32d926fcef19e0accad67901b"
10
+ "integrity": "sha256-ec6411dd683403ca3e7e92ed169848274d6d7a7492759cbedfc38fb4b866e23a"
11
11
  }
package/types/vite/html-policy.d.ts CHANGED
@@ -1,4 +1,5 @@
1
1
  export declare const PRODUCTION_CSP: string;
2
2
  export declare function enforceMiniappHtmlPolicy(html: string, options?: {
3
3
  hmrWebSocketUrl?: string;
4
+ skipPlatformCsp?: boolean;
4
5
  }): string;
package/types/vite/runtime-permission-env.d.ts ADDED
@@ -0,0 +1,9 @@
1
+ export declare const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = "HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN";
2
+ export declare const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = "HB_SDK_RUNTIME_PERMISSION_CONTEXT";
3
+ export declare function shouldSkipMiniappPlatformCspFromEnv(env?: NodeJS.ProcessEnv): boolean;
4
+ export declare function createMiniappPlatformCspEnv(env: NodeJS.ProcessEnv, skipPlatformCsp: boolean): {
5
+ HB_SDK_RUNTIME_PERMISSION_CONTEXT: string;
6
+ HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN: string;
7
+ TZ?: string | undefined;
8
+ };
9
+ export declare function withMiniappPlatformCspEnv<T>(skipPlatformCsp: boolean, action: () => Promise<T>, env?: NodeJS.ProcessEnv): Promise<T>;