@heybox/hb-sdk 0.6.7-alpha.0 → 0.6.7-alpha.2

package/dist/devtools/mock-host/main.js

@@ -3707,25 +3707,61 @@ function stringifyMiniProgramRuntimeJsonData(data, options) {
 }
 
 const LEADERBOARD_KEY_RE = /^[A-Za-z0-9_-]{1,64}$/;
+const DEFAULT_LEADERBOARD_KEY = 'default';
 const DEFAULT_LEADERBOARD_LIST_LIMIT = 20;
 const MAX_LEADERBOARD_LIST_LIMIT = 100;
 const MAX_LEADERBOARD_EXTRA_BYTES = 2048;
 const MAX_LEADERBOARD_SAFE_SCORE = Number.MAX_SAFE_INTEGER;
-/** 提交当前用户排行榜分数。 */
-async function submitMiniProgramRuntimeLeaderboardEntry(payload, options) {
-    const request = readLeaderboardPayload(payload, 'cloud.leaderboard.submit', 'submit');
+const LEADERBOARD_READ_CACHE_TTL_MS = 5 * 60 * 1000;
+const MAX_LEADERBOARD_LIST_CACHE_ENTRIES = 250;
+const MAX_LEADERBOARD_CACHE_BUCKETS = 3;
+/** 创建一组共享读缓存的排行榜 handler。 */
+function createMiniProgramRuntimeLeaderboardHandlers(options) {
+    const store = createLeaderboardReadStore();
+    return {
+        async submit(payload) {
+            const request = readLeaderboardPayload(payload, 'cloud.leaderboard.submit', 'submit');
+            const bucketKey = createLeaderboardBucketKey(options, request.key);
+            return submitLeaderboardEntry(request, options, () => store.invalidateMutableReads(bucketKey));
+        },
+        async getList(payload) {
+            const request = readLeaderboardPayload(payload, 'cloud.leaderboard.getList', 'list');
+            const bucketKey = createLeaderboardBucketKey(options, request.key);
+            const cacheKey = createLeaderboardCacheKey('list', request.limit, request.cursor ?? null);
+            return store.read(bucketKey, 'list', cacheKey, () => requestLeaderboardList(request, options));
+        },
+        async getCurrentUserEntry(payload) {
+            const request = readLeaderboardPayload(payload, 'cloud.leaderboard.getCurrentUserEntry', 'keyOnly');
+            const userId = await readCurrentUserId(options.platformAdapter);
+            const bucketKey = createLeaderboardBucketKey(options, request.key);
+            const cacheKey = createLeaderboardCacheKey('current', userId);
+            return store.read(bucketKey, 'current', cacheKey, () => requestCurrentUserLeaderboardEntry(request, userId, options));
+        },
+        async deleteCurrentUserEntry(payload) {
+            const request = readLeaderboardPayload(payload, 'cloud.leaderboard.deleteCurrentUserEntry', 'keyOnly');
+            const bucketKey = createLeaderboardBucketKey(options, request.key);
+            return deleteCurrentUserLeaderboardEntry(request, options, () => store.invalidateMutableReads(bucketKey));
+        },
+        async getInfo(payload) {
+            const request = readLeaderboardPayload(payload, 'cloud.leaderboard.getInfo', 'keyOnly');
+            const bucketKey = createLeaderboardBucketKey(options, request.key);
+            const cacheKey = createLeaderboardCacheKey('info');
+            return store.read(bucketKey, 'info', cacheKey, () => requestLeaderboardInfo(request, options));
+        },
+    };
+}
+async function submitLeaderboardEntry(request, options, onAdapterSuccess) {
     const userId = await readCurrentUserId(options.platformAdapter);
     const entry = await options.platformAdapter.cloud.leaderboard.submit({
         ...request,
         miniProgramId: options.identity?.miniProgramId,
         userId,
     });
+    onAdapterSuccess?.();
     assertLeaderboardEntry(entry, 'cloud.leaderboard.submit');
     return entry;
 }
-/** 读取排行榜列表。 */
-async function getMiniProgramRuntimeLeaderboardList(payload, options) {
-    const request = readLeaderboardPayload(payload, 'cloud.leaderboard.getList', 'list');
+async function requestLeaderboardList(request, options) {
     const result = await options.platformAdapter.cloud.leaderboard.getList({
         ...request,
         miniProgramId: options.identity?.miniProgramId,
@@ -3743,10 +3779,7 @@ async function getMiniProgramRuntimeLeaderboardList(payload, options) {
     }
     return result;
 }
-/** 读取当前用户在排行榜中的记录。 */
-async function getMiniProgramRuntimeCurrentUserLeaderboardEntry(payload, options) {
-    const request = readLeaderboardPayload(payload, 'cloud.leaderboard.getCurrentUserEntry', 'keyOnly');
-    const userId = await readCurrentUserId(options.platformAdapter);
+async function requestCurrentUserLeaderboardEntry(request, userId, options) {
     const entry = await options.platformAdapter.cloud.leaderboard.getCurrentUserEntry({
         ...request,
         miniProgramId: options.identity?.miniProgramId,
@@ -3757,24 +3790,21 @@ async function getMiniProgramRuntimeCurrentUserLeaderboardEntry(payload, options
     }
     return entry;
 }
-/** 删除当前用户在排行榜中的记录。 */
-async function deleteMiniProgramRuntimeCurrentUserLeaderboardEntry(payload, options) {
-    const request = readLeaderboardPayload(payload, 'cloud.leaderboard.deleteCurrentUserEntry', 'keyOnly');
+async function deleteCurrentUserLeaderboardEntry(request, options, onAdapterSuccess) {
     const userId = await readCurrentUserId(options.platformAdapter);
     const result = await options.platformAdapter.cloud.leaderboard.deleteCurrentUserEntry({
         ...request,
         miniProgramId: options.identity?.miniProgramId,
         userId,
     });
+    onAdapterSuccess?.();
     assertMiniProgramRuntimeRecord(result, 'cloud.leaderboard.deleteCurrentUserEntry 返回值必须是对象');
     if (typeof result.deleted !== 'boolean') {
         throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', 'cloud.leaderboard.deleteCurrentUserEntry 返回的 deleted 必须是布尔值');
     }
     return result;
 }
-/** 读取排行榜基础信息。 */
-async function getMiniProgramRuntimeLeaderboardInfo(payload, options) {
-    const request = readLeaderboardPayload(payload, 'cloud.leaderboard.getInfo', 'keyOnly');
+async function requestLeaderboardInfo(request, options) {
     const info = await options.platformAdapter.cloud.leaderboard.getInfo({
         ...request,
         miniProgramId: options.identity?.miniProgramId,
@@ -3791,6 +3821,138 @@ async function getMiniProgramRuntimeLeaderboardInfo(payload, options) {
     }
     return info;
 }
+function createLeaderboardReadStore() {
+    const buckets = new Map();
+    const inflight = new Map();
+    function getOrCreateBucket(bucketKey) {
+        const bucket = buckets.get(bucketKey);
+        if (bucket) {
+            return bucket;
+        }
+        pruneExpiredBuckets();
+        if (buckets.size >= MAX_LEADERBOARD_CACHE_BUCKETS) {
+            return undefined;
+        }
+        const nextBucket = {
+            generation: 0,
+            caches: {
+                list: new Map(),
+                current: new Map(),
+                info: new Map(),
+            },
+        };
+        buckets.set(bucketKey, nextBucket);
+        return nextBucket;
+    }
+    function read(bucketKey, kind, cacheKey, request) {
+        const bucket = getOrCreateBucket(bucketKey);
+        const cache = bucket?.caches[kind];
+        const cached = cache?.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            return Promise.resolve(cached.value);
+        }
+        cache?.delete(cacheKey);
+        const inflightKey = createLeaderboardInflightKey(bucketKey, cacheKey);
+        const existingInflight = inflight.get(inflightKey);
+        if (existingInflight) {
+            return existingInflight.promise;
+        }
+        const requestGeneration = bucket?.generation;
+        const promise = request()
+            .then((result) => {
+            if (bucket && cache && bucket.generation === requestGeneration) {
+                if (kind === 'list') {
+                    if (cache.size >= MAX_LEADERBOARD_LIST_CACHE_ENTRIES) {
+                        cache.delete(cache.keys().next().value);
+                    }
+                }
+                else {
+                    cache.clear();
+                }
+                cache.set(cacheKey, {
+                    expiresAt: Date.now() + LEADERBOARD_READ_CACHE_TTL_MS,
+                    value: result,
+                });
+            }
+            return result;
+        })
+            .finally(() => {
+            if (inflight.get(inflightKey)?.promise === promise) {
+                inflight.delete(inflightKey);
+            }
+            if (bucket) {
+                removeEmptyBucket(bucketKey, bucket);
+            }
+        });
+        inflight.set(inflightKey, { bucketKey, promise });
+        return promise;
+    }
+    function invalidateMutableReads(bucketKey) {
+        invalidateInflight(bucketKey);
+        const bucket = buckets.get(bucketKey);
+        if (!bucket) {
+            return;
+        }
+        bucket.generation += 1;
+        bucket.caches.list.clear();
+        bucket.caches.current.clear();
+    }
+    function invalidateInflight(bucketKey) {
+        inflight.forEach((entry, inflightKey) => {
+            if (entry.bucketKey === bucketKey) {
+                inflight.delete(inflightKey);
+            }
+        });
+    }
+    function pruneExpiredBuckets() {
+        const now = Date.now();
+        for (const [bucketKey, bucket] of buckets) {
+            removeExpiredCacheEntries(bucket, now);
+            if (isBucketEmpty(bucketKey, bucket)) {
+                buckets.delete(bucketKey);
+            }
+        }
+    }
+    function removeEmptyBucket(bucketKey, bucket) {
+        removeExpiredCacheEntries(bucket, Date.now());
+        if (buckets.get(bucketKey) === bucket && isBucketEmpty(bucketKey, bucket)) {
+            buckets.delete(bucketKey);
+        }
+    }
+    function removeExpiredCacheEntries(bucket, now) {
+        Object.values(bucket.caches).forEach((cache) => {
+            cache.forEach((entry, cacheKey) => {
+                if (entry.expiresAt <= now) {
+                    cache.delete(cacheKey);
+                }
+            });
+        });
+    }
+    function isBucketEmpty(bucketKey, bucket) {
+        return !hasInflight(bucketKey) && Object.values(bucket.caches).every(cache => cache.size === 0);
+    }
+    function hasInflight(bucketKey) {
+        for (const entry of inflight.values()) {
+            if (entry.bucketKey === bucketKey) {
+                return true;
+            }
+        }
+        return false;
+    }
+    return {
+        read,
+        invalidateMutableReads,
+    };
+}
+function createLeaderboardBucketKey(options, key) {
+    return JSON.stringify([options.identity?.miniProgramId ?? null, key ?? DEFAULT_LEADERBOARD_KEY]);
+}
+function createLeaderboardCacheKey(kind, ...parts) {
+    return JSON.stringify([kind, ...parts]);
+}
+function createLeaderboardInflightKey(bucketKey, cacheKey) {
+    return JSON.stringify([bucketKey, cacheKey]);
+}
 function readLeaderboardPayload(payload, methodName, shape) {
     if (payload === undefined && shape !== 'submit') {
         return shape === 'list' ? { limit: DEFAULT_LEADERBOARD_LIST_LIMIT } : {};
@@ -5505,6 +5667,10 @@ class MiniProgramMockRuntime {
         this.vibrates = [];
         this.openAppPages = [];
         this.evaluateRuntimePermission = createMiniProgramRuntimePermissionEvaluator(options.runtimePermissions);
+        this.leaderboardHandlers = createMiniProgramRuntimeLeaderboardHandlers({
+            identity: options.identity,
+            platformAdapter: adapter,
+        });
     }
     async runMethod(method, payload) {
         if (!isMiniProgramMockRuntimeMethod(method)) {
@@ -5634,19 +5800,19 @@ class MiniProgramMockRuntime {
         return requestMiniProgramRuntimeNetwork(payload, this.adapter);
     }
     submitLeaderboardEntry(payload) {
-        return submitMiniProgramRuntimeLeaderboardEntry(payload, { platformAdapter: this.adapter });
+        return this.leaderboardHandlers.submit(payload);
     }
     getLeaderboardList(payload) {
-        return getMiniProgramRuntimeLeaderboardList(payload, { platformAdapter: this.adapter });
+        return this.leaderboardHandlers.getList(payload);
     }
     getCurrentUserLeaderboardEntry(payload) {
-        return getMiniProgramRuntimeCurrentUserLeaderboardEntry(payload, { platformAdapter: this.adapter });
+        return this.leaderboardHandlers.getCurrentUserEntry(payload);
     }
     deleteCurrentUserLeaderboardEntry(payload) {
-        return deleteMiniProgramRuntimeCurrentUserLeaderboardEntry(payload, { platformAdapter: this.adapter });
+        return this.leaderboardHandlers.deleteCurrentUserEntry(payload);
     }
     getLeaderboardInfo(payload) {
-        return getMiniProgramRuntimeLeaderboardInfo(payload, { platformAdapter: this.adapter });
+        return this.leaderboardHandlers.getInfo(payload);
     }
     async showToast(payload) {
         const toast = readShowToastPayload(payload);

package/dist/index.cjs.js

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.0';
+    : '0.6.7-alpha.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.0';
+    : '0.6.7-alpha.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/vite.cjs.js

@@ -2,13 +2,12 @@
 
 var node_fs = require('node:fs');
 var path = require('node:path');
-var node_async_hooks = require('node:async_hooks');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.0';
+    : '0.6.7-alpha.2';
 
 var re = {exports: {}};
 
@@ -11433,13 +11432,17 @@ function walk$1(node, visit) {
 
 const FORBIDDEN_RESOURCE_HINTS = new Set(['dns-prefetch', 'preconnect', 'prerender']);
 const RELATIVE_URL_BASE = new URL('https://heybox-relative.invalid/');
+const OFFICIAL_RESOURCE_ROOT_DOMAINS = ['xiaoheihe.cn', 'max-c.com', 'debugmode.cn', 'maxjia.com'];
+const OFFICIAL_RESOURCE_SOURCES = OFFICIAL_RESOURCE_ROOT_DOMAINS.flatMap(rootDomain => [
+    `https://${rootDomain}`,
+    `https://*.${rootDomain}`,
+]);
 const URL_ATTRIBUTES = {
     audio: ['src'],
     embed: ['src'],
     iframe: ['src'],
     img: ['src'],
     input: ['src'],
-    link: ['href'],
     object: ['data'],
     script: ['src'],
     source: ['src', 'srcset'],
@@ -11449,11 +11452,11 @@ const URL_ATTRIBUTES = {
 const PRODUCTION_CSP = [
     "default-src 'none'",
     "connect-src 'none'",
-    "script-src 'self' 'unsafe-inline'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: blob:",
-    "font-src 'self' data:",
-    "media-src 'self' blob:",
+    `script-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `style-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `img-src 'self' data: blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `font-src 'self' data: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `media-src 'self' blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
     "manifest-src 'self'",
     "frame-src 'none'",
     "child-src 'none'",
@@ -11472,9 +11475,6 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
-    if (options.skipPlatformCsp) {
-        return serialize(document);
-    }
     const content = options.hmrWebSocketUrl
         ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
         : PRODUCTION_CSP;
@@ -11511,19 +11511,25 @@ function validateElement(element) {
         if (forbidden) {
             throw new Error(`index.html 不允许 rel="${forbidden}"`);
         }
-        if (rels.includes('preload') || rels.includes('modulepreload')) {
+        if (rels.includes('stylesheet')) {
+            validateResourceUrl(attrs.get('href'), '<link rel="stylesheet" href>', false, true);
+        }
+        else if (rels.includes('preload') || rels.includes('modulepreload')) {
             validateRelativeUrl(attrs.get('href'), `<link rel="${rels.includes('modulepreload') ? 'modulepreload' : 'preload'}" href>`, false);
         }
+        else {
+            validateRelativeUrl(attrs.get('href'), '<link href>', false);
+        }
     }
     for (const attribute of URL_ATTRIBUTES[tagName] ?? []) {
         const value = attrs.get(attribute);
         if (attribute === 'srcset') {
             for (const candidate of (value ?? '').split(',').map(item => item.trim().split(/\s+/)[0]).filter(Boolean)) {
-                validateRelativeUrl(candidate, `<${tagName} ${attribute}>`, true);
+                validateResourceUrl(candidate, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
             }
         }
         else {
-            validateRelativeUrl(value, `<${tagName} ${attribute}>`, true);
+            validateResourceUrl(value, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
         }
     }
 }
@@ -11538,16 +11544,43 @@ function removePlatformCspMarkers(node) {
     for (const child of node.childNodes)
         removePlatformCspMarkers(child);
 }
-function validateRelativeUrl(value, label, allowDataBlob) {
+function supportsOfficialResourceUrl(tagName, attribute) {
+    return ((tagName === 'script' && attribute === 'src') ||
+        (tagName === 'img' && attribute === 'src') ||
+        (tagName === 'source' && (attribute === 'src' || attribute === 'srcset')) ||
+        (tagName === 'audio' && attribute === 'src') ||
+        (tagName === 'track' && attribute === 'src') ||
+        (tagName === 'video' && (attribute === 'src' || attribute === 'poster')));
+}
+function validateResourceUrl(value, label, allowDataBlob, allowOfficialResourceUrl) {
     if (!value || value.startsWith('#'))
         return;
     const normalized = value.trim().toLowerCase();
     if (allowDataBlob && (normalized.startsWith('data:') || normalized.startsWith('blob:')))
         return;
+    if (allowOfficialResourceUrl && isOfficialResourceUrl(value))
+        return;
     if (!isRelativeUrl(value, normalized)) {
         throw new Error(`${label} 必须使用相对路径${allowDataBlob ? '或明确的 data:/blob: URL' : ''}：${value}`);
     }
 }
+function validateRelativeUrl(value, label, allowDataBlob) {
+    validateResourceUrl(value, label, allowDataBlob, false);
+}
+function isOfficialResourceUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password)
+            return false;
+        const hostname = url.hostname.toLowerCase();
+        if (hostname.endsWith('.'))
+            return false;
+        return OFFICIAL_RESOURCE_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+    }
+    catch {
+        return false;
+    }
+}
 function isRelativeUrl(value, normalized) {
     const browserNormalized = normalized.replace(/[\t\n\r]/g, '');
     if (browserNormalized.includes('\\') || browserNormalized.startsWith('//'))
@@ -11584,19 +11617,9 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
-const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
-const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
-const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
-new node_async_hooks.AsyncLocalStorage();
-Promise.resolve();
-function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
-    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
-    const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
@@ -11628,7 +11651,6 @@ function miniappManifest() {
         transformIndexHtml(html) {
             return enforceMiniappHtmlPolicy(html, {
                 ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
-                skipPlatformCsp,
             });
         },
         async closeBundle() {
@@ -11651,7 +11673,7 @@ function miniappManifest() {
             if (!htmlFiles.includes(indexHtmlPath)) {
                 throw new Error('构建产物必须包含入口 dist/index.html');
             }
-            node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
+            node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8')));
             const manifestPath = path.join(outputRoot, 'manifest.json');
             node_fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
             node_fs.writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
@@ -11693,7 +11715,7 @@ function resolveHmrWebSocketUrl(resolved) {
     if (hmr === false)
         return undefined;
     const options = typeof hmr === 'object' ? hmr : {};
-    const protocol = options.protocol ?? 'ws';
+    const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
     const configuredHost = options.host ?? resolved.server.host;
     const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
     const port = options.clientPort ?? options.port ?? resolved.server.port;

package/dist/vite.esm.js

@@ -1,11 +1,10 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
 import path from 'node:path';
-import { AsyncLocalStorage } from 'node:async_hooks';
 
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.0';
+    : '0.6.7-alpha.2';
 
 var re = {exports: {}};
 
@@ -11430,13 +11429,17 @@ function walk$1(node, visit) {
 
 const FORBIDDEN_RESOURCE_HINTS = new Set(['dns-prefetch', 'preconnect', 'prerender']);
 const RELATIVE_URL_BASE = new URL('https://heybox-relative.invalid/');
+const OFFICIAL_RESOURCE_ROOT_DOMAINS = ['xiaoheihe.cn', 'max-c.com', 'debugmode.cn', 'maxjia.com'];
+const OFFICIAL_RESOURCE_SOURCES = OFFICIAL_RESOURCE_ROOT_DOMAINS.flatMap(rootDomain => [
+    `https://${rootDomain}`,
+    `https://*.${rootDomain}`,
+]);
 const URL_ATTRIBUTES = {
     audio: ['src'],
     embed: ['src'],
     iframe: ['src'],
     img: ['src'],
     input: ['src'],
-    link: ['href'],
     object: ['data'],
     script: ['src'],
     source: ['src', 'srcset'],
@@ -11446,11 +11449,11 @@ const URL_ATTRIBUTES = {
 const PRODUCTION_CSP = [
     "default-src 'none'",
     "connect-src 'none'",
-    "script-src 'self' 'unsafe-inline'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: blob:",
-    "font-src 'self' data:",
-    "media-src 'self' blob:",
+    `script-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `style-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `img-src 'self' data: blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `font-src 'self' data: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `media-src 'self' blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
     "manifest-src 'self'",
     "frame-src 'none'",
     "child-src 'none'",
@@ -11469,9 +11472,6 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
-    if (options.skipPlatformCsp) {
-        return serialize(document);
-    }
     const content = options.hmrWebSocketUrl
         ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
         : PRODUCTION_CSP;
@@ -11508,19 +11508,25 @@ function validateElement(element) {
         if (forbidden) {
             throw new Error(`index.html 不允许 rel="${forbidden}"`);
         }
-        if (rels.includes('preload') || rels.includes('modulepreload')) {
+        if (rels.includes('stylesheet')) {
+            validateResourceUrl(attrs.get('href'), '<link rel="stylesheet" href>', false, true);
+        }
+        else if (rels.includes('preload') || rels.includes('modulepreload')) {
             validateRelativeUrl(attrs.get('href'), `<link rel="${rels.includes('modulepreload') ? 'modulepreload' : 'preload'}" href>`, false);
         }
+        else {
+            validateRelativeUrl(attrs.get('href'), '<link href>', false);
+        }
     }
     for (const attribute of URL_ATTRIBUTES[tagName] ?? []) {
         const value = attrs.get(attribute);
         if (attribute === 'srcset') {
             for (const candidate of (value ?? '').split(',').map(item => item.trim().split(/\s+/)[0]).filter(Boolean)) {
-                validateRelativeUrl(candidate, `<${tagName} ${attribute}>`, true);
+                validateResourceUrl(candidate, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
             }
         }
         else {
-            validateRelativeUrl(value, `<${tagName} ${attribute}>`, true);
+            validateResourceUrl(value, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
         }
     }
 }
@@ -11535,16 +11541,43 @@ function removePlatformCspMarkers(node) {
     for (const child of node.childNodes)
         removePlatformCspMarkers(child);
 }
-function validateRelativeUrl(value, label, allowDataBlob) {
+function supportsOfficialResourceUrl(tagName, attribute) {
+    return ((tagName === 'script' && attribute === 'src') ||
+        (tagName === 'img' && attribute === 'src') ||
+        (tagName === 'source' && (attribute === 'src' || attribute === 'srcset')) ||
+        (tagName === 'audio' && attribute === 'src') ||
+        (tagName === 'track' && attribute === 'src') ||
+        (tagName === 'video' && (attribute === 'src' || attribute === 'poster')));
+}
+function validateResourceUrl(value, label, allowDataBlob, allowOfficialResourceUrl) {
     if (!value || value.startsWith('#'))
         return;
     const normalized = value.trim().toLowerCase();
     if (allowDataBlob && (normalized.startsWith('data:') || normalized.startsWith('blob:')))
         return;
+    if (allowOfficialResourceUrl && isOfficialResourceUrl(value))
+        return;
     if (!isRelativeUrl(value, normalized)) {
         throw new Error(`${label} 必须使用相对路径${allowDataBlob ? '或明确的 data:/blob: URL' : ''}：${value}`);
     }
 }
+function validateRelativeUrl(value, label, allowDataBlob) {
+    validateResourceUrl(value, label, allowDataBlob, false);
+}
+function isOfficialResourceUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password)
+            return false;
+        const hostname = url.hostname.toLowerCase();
+        if (hostname.endsWith('.'))
+            return false;
+        return OFFICIAL_RESOURCE_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+    }
+    catch {
+        return false;
+    }
+}
 function isRelativeUrl(value, normalized) {
     const browserNormalized = normalized.replace(/[\t\n\r]/g, '');
     if (browserNormalized.includes('\\') || browserNormalized.startsWith('//'))
@@ -11581,19 +11614,9 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
-const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
-const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
-const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
-new AsyncLocalStorage();
-Promise.resolve();
-function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
-    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
-    const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
@@ -11625,7 +11648,6 @@ function miniappManifest() {
         transformIndexHtml(html) {
             return enforceMiniappHtmlPolicy(html, {
                 ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
-                skipPlatformCsp,
             });
         },
         async closeBundle() {
@@ -11648,7 +11670,7 @@ function miniappManifest() {
             if (!htmlFiles.includes(indexHtmlPath)) {
                 throw new Error('构建产物必须包含入口 dist/index.html');
             }
-            writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
+            writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
             const manifestPath = path.join(outputRoot, 'manifest.json');
             mkdirSync(path.dirname(manifestPath), { recursive: true });
             writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
@@ -11690,7 +11712,7 @@ function resolveHmrWebSocketUrl(resolved) {
     if (hmr === false)
         return undefined;
     const options = typeof hmr === 'object' ? hmr : {};
-    const protocol = options.protocol ?? 'ws';
+    const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
     const configuredHost = options.host ?? resolved.server.host;
     const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
     const port = options.clientPort ?? options.port ?? resolved.server.port;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.7-alpha.0",
+  "version": "0.6.7-alpha.2",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",