@heybox/hb-sdk 0.6.7-alpha.1 → 0.6.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. package/README.md +3 -3
  2. package/dist/cli-chunks/{build-cBQK_qq-.cjs → build-DaHCCSLH.cjs} +25 -29
  3. package/dist/cli-chunks/{context-CfrdSQSg.cjs → context-cQXupHub.cjs} +23 -122
  4. package/dist/cli-chunks/{create-mp5nBLFJ.cjs → create-D2dSw7bl.cjs} +1 -1
  5. package/dist/cli-chunks/{dev-CSuSpwJC.cjs → dev-D6WhI3cC.cjs} +110 -21
  6. package/dist/cli-chunks/{doctor-nEv6ikeF.cjs → doctor-CtNS5Tt2.cjs} +21 -3
  7. package/dist/cli-chunks/{index-CZ1l6xci.cjs → index-B1w-Jpba.cjs} +14 -14
  8. package/dist/cli-chunks/{index-CgUdrl3g.cjs → index-C4y2G95g.cjs} +3 -3
  9. package/dist/cli-chunks/{runtime-permission-env-BSs4uCNa.cjs → index-v4-6fbXX.cjs} +29 -73
  10. package/dist/cli-chunks/{login-B2kXjmcM.cjs → login-D-ZK-n1E.cjs} +2 -2
  11. package/dist/cli-chunks/{project-vite-BGAleOVW.cjs → project-vite-J4lrUja0.cjs} +1 -1
  12. package/dist/cli-chunks/{remote-B5byhdC7.cjs → remote-BZNHAL5_.cjs} +44 -42
  13. package/dist/cli-chunks/{runtime-gate--rPXjiG6.cjs → runtime-gate-DfMJQGH9.cjs} +3 -3
  14. package/dist/cli-chunks/{session-BbDd1r6M.cjs → session-5ryBp2wZ.cjs} +1 -1
  15. package/dist/cli.cjs +1 -1
  16. package/dist/index.cjs.js +1 -1
  17. package/dist/index.esm.js +1 -1
  18. package/dist/miniapp-publish.cjs.js +29 -2
  19. package/dist/miniapp-publish.esm.js +29 -2
  20. package/dist/vite.cjs.js +50 -28
  21. package/dist/vite.esm.js +50 -28
  22. package/package.json +1 -1
  23. package/skill/references/api-root.md +7 -9
  24. package/skill/skill.json +4 -4
  25. package/types/vite/html-policy.d.ts +0 -1
  26. package/types/vite/index.d.ts +1 -0
  27. package/types/vite/runtime-permission-env.d.ts +0 -9
package/README.md CHANGED
@@ -598,11 +598,11 @@ export default defineConfig({
598
598
 
599
599
  工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
600
600
 
601
- 插件只接受单页应用：输出目录只能存在入口 `index.html`。`hb-sdk dev` 和 `hb-sdk remote deploy` 会读取绑定小程序的远端 Runtime 权限；仅当 `network.request` 已启用且 `useOfficialDomain=true` 时跳过平台 CSP，否则 build 会把平台 CSP 插入 `<head>` 首位。直接运行 `vite build`、匿名 dev、非法快照或远端权限读取失败时均继续注入。已有 CSP 始终原样保留；注入平台 CSP 时，两份策略按浏览器交集生效。
601
+ 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 和 dev 都会把平台 CSP 插入 `<head>` 首位，已有 CSP 始终原样保留；两份策略按浏览器交集生效。平台 CSP 在脚本、样式、图片、字体和媒体指令中放行 `xiaoheihe.cn`、`max-c.com`、`debugmode.cn`、`maxjia.com` 的 HTTPS 根域及子域；入口 HTML 中相应资源标签也可使用这些官方 HTTPS URL。
602
602
 
603
- 平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。跳过平台 CSP 时，这些能力不再由 SDK 构建产物统一限制，但需要宿主授权的业务网络请求仍应使用 `network.request()`。本地 Mock 权限覆盖不会改变构建 CSP，构建判定始终以远端权限快照为准。
603
+ 平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；`connect-src` 始终为 `'none'`，dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。需要宿主授权的业务网络请求仍应使用 `network.request()`。
604
604
 
605
- meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
605
+ meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、非官方外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
606
606
 
607
607
  失败与警告语义：
608
608
 
package/dist/cli-chunks/{build-cBQK_qq-.cjs → build-DaHCCSLH.cjs} RENAMED
@@ -3,11 +3,10 @@
3
3
  var fs$1 = require('node:fs');
4
4
  var fs = require('node:fs/promises');
5
5
  var path = require('node:path');
6
- var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
7
- var runtimeGate = require('./runtime-gate--rPXjiG6.cjs');
8
- var index = require('./index-CZ1l6xci.cjs');
9
- var projectVite = require('./project-vite-BGAleOVW.cjs');
10
- require('node:async_hooks');
6
+ var index$1 = require('./index-v4-6fbXX.cjs');
7
+ var runtimeGate = require('./runtime-gate-DfMJQGH9.cjs');
8
+ var index = require('./index-B1w-Jpba.cjs');
9
+ var projectVite = require('./project-vite-J4lrUja0.cjs');
11
10
  require('node:module');
12
11
  require('path');
13
12
  require('os');
@@ -26,28 +25,25 @@ async function runBuildCommand(_options = {}, runtime = {}) {
26
25
  const distDir = path.join(projectRoot, 'dist');
27
26
  const env = runtime.env ?? process.env;
28
27
  const mode = env.HB_SDK_ENV?.trim() || undefined;
29
- const skipPlatformCsp = runtimePermissionEnv.shouldSkipMiniappPlatformCspFromEnv(env);
30
28
  await fs.rm(distDir, { force: true, recursive: true });
31
29
  try {
32
- return await runtimePermissionEnv.withMiniappPlatformCspEnv(skipPlatformCsp, async () => {
33
- const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), {
34
- successText: '已加载项目 Vite',
35
- });
36
- await logger.task('正在构建小程序', () => vite.build({
37
- root: projectRoot,
38
- ...(mode ? { mode } : {}),
39
- plugins: [createFixedBuildOutputPlugin(projectRoot)],
40
- build: {
41
- outDir: 'dist',
42
- emptyOutDir: true,
43
- watch: null,
44
- write: true,
45
- },
46
- }), { successText: 'Vite 构建完成' });
47
- const result = await validateBuildOutput(projectRoot, logger);
48
- logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
49
- return result;
50
- }, env);
30
+ const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), {
31
+ successText: '已加载项目 Vite',
32
+ });
33
+ await logger.task('正在构建小程序', () => vite.build({
34
+ root: projectRoot,
35
+ ...(mode ? { mode } : {}),
36
+ plugins: [createFixedBuildOutputPlugin(projectRoot)],
37
+ build: {
38
+ outDir: 'dist',
39
+ emptyOutDir: true,
40
+ watch: null,
41
+ write: true,
42
+ },
43
+ }), { successText: 'Vite 构建完成' });
44
+ const result = await validateBuildOutput(projectRoot, logger);
45
+ logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
46
+ return result;
51
47
  }
52
48
  catch (error) {
53
49
  await fs.rm(distDir, { force: true, recursive: true });
@@ -93,8 +89,8 @@ async function validateBuildOutput(projectRoot, logger) {
93
89
  }
94
90
  const { sdkVersion, version } = runtimeGate.validateMiniappManifestForDeploy(manifest);
95
91
  const allFiles = await walkDistFiles(distDir);
96
- const uploadFiles = allFiles.filter((file) => runtimePermissionEnv.shouldUploadDistFile(file.relativePath));
97
- const sizeError = runtimePermissionEnv.validateUploadTotalSize(uploadFiles);
92
+ const uploadFiles = allFiles.filter((file) => index$1.shouldUploadDistFile(file.relativePath));
93
+ const sizeError = index$1.validateUploadTotalSize(uploadFiles);
98
94
  if (sizeError) {
99
95
  throw new Error(sizeError.replace('重新 deploy', '重新 build'));
100
96
  }
@@ -114,12 +110,12 @@ async function walkDistFiles(distDir) {
114
110
  const entries = await fs.readdir(absDir, { withFileTypes: true });
115
111
  for (const entry of entries) {
116
112
  const absPath = path.join(absDir, entry.name);
117
- const relPath = runtimePermissionEnv.normalizeRelativePath(relDir ? `${relDir}/${entry.name}` : entry.name);
113
+ const relPath = index$1.normalizeRelativePath(relDir ? `${relDir}/${entry.name}` : entry.name);
118
114
  const link = await fs.lstat(absPath);
119
115
  if (link.isSymbolicLink()) {
120
116
  throw new Error(`dist 目录包含 symlink，拒绝处理：${relPath}`);
121
117
  }
122
- if (runtimePermissionEnv.relativePathContainsNodeModulesSegment(relPath)) {
118
+ if (index$1.relativePathContainsNodeModulesSegment(relPath)) {
123
119
  throw new Error(`dist 目录含 node_modules：${relPath}`);
124
120
  }
125
121
  if (entry.isDirectory()) {
package/dist/cli-chunks/{context-CfrdSQSg.cjs → context-cQXupHub.cjs} RENAMED
@@ -1,106 +1,11 @@
1
1
  'use strict';
2
2
 
3
- var session = require('./session-BbDd1r6M.cjs');
4
- var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
3
+ var session = require('./session-5ryBp2wZ.cjs');
4
+ var index = require('./index-v4-6fbXX.cjs');
5
5
  var fs$1 = require('node:fs');
6
6
  var fs = require('node:fs/promises');
7
7
  var path = require('node:path');
8
8
 
9
- const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
10
- /**
11
- * 判断 permission key 是否由 Runtime 权限快照管理。
12
- *
13
- * @param key 待判断的 permission key。
14
- * @returns 该 key 需要读取 Runtime 权限快照时返回 `true`。
15
- */
16
- function isManagedMiniProgramRuntimePermissionKey(key) {
17
- return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
18
- }
19
- /**
20
- * 解析服务端权限快照；格式不完整时整份快照失效并 fail closed。
21
- *
22
- * @param snapshot 待校验的服务端权限快照。
23
- * @returns 解析状态和通过校验的受管权限。
24
- */
25
- function parseMiniProgramRuntimePermissions(snapshot) {
26
- if (!isRecord(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
27
- return { valid: false, permissions: {} };
28
- }
29
- if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
30
- return { valid: false, permissions: {} };
31
- }
32
- const seenKeys = new Set();
33
- const permissions = {};
34
- for (const rawEntry of snapshot.entries) {
35
- if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
36
- return { valid: false, permissions: {} };
37
- }
38
- const key = rawEntry.key.trim();
39
- if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
40
- return { valid: false, permissions: {} };
41
- }
42
- seenKeys.add(key);
43
- if (!isManagedMiniProgramRuntimePermissionKey(key)) {
44
- continue;
45
- }
46
- if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
47
- return { valid: false, permissions: {} };
48
- }
49
- permissions[key] = {
50
- key,
51
- status: rawEntry.status,
52
- config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
53
- };
54
- }
55
- return { valid: true, permissions };
56
- }
57
- function isRecord(value) {
58
- return typeof value === 'object' && value !== null && !Array.isArray(value);
59
- }
60
-
61
- const DEFAULT_PERMISSION_STATE = {
62
- networkRequest: {
63
- status: 'disabled',
64
- useOfficialDomain: false,
65
- },
66
- };
67
- function createMiniProgramMockPermissionState(context) {
68
- const parsed = parseMiniProgramRuntimePermissions(context.runtimePermissions);
69
- const networkRequest = parsed.permissions['network.request'];
70
- return parsed.valid && networkRequest
71
- ? {
72
- networkRequest: {
73
- status: networkRequest.status,
74
- useOfficialDomain: networkRequest.config.useOfficialDomain === true,
75
- },
76
- }
77
- : cloneDefaultPermissionState();
78
- }
79
- function shouldSkipMiniappPlatformCsp(runtimePermissions) {
80
- const parsed = parseMiniProgramRuntimePermissions(runtimePermissions);
81
- const networkRequest = parsed.permissions['network.request'];
82
- return parsed.valid && networkRequest?.status === 'enabled' && networkRequest.config.useOfficialDomain === true;
83
- }
84
- function createMiniProgramMockRuntimePermissions(state) {
85
- return {
86
- schema_version: 1,
87
- entries: [
88
- {
89
- key: 'network.request',
90
- status: state.networkRequest.status,
91
- config: {
92
- useOfficialDomain: state.networkRequest.useOfficialDomain,
93
- },
94
- },
95
- ],
96
- };
97
- }
98
- function cloneDefaultPermissionState() {
99
- return {
100
- networkRequest: { ...DEFAULT_PERMISSION_STATE.networkRequest },
101
- };
102
- }
103
-
104
9
  function createRemoteApiClient(options) {
105
10
  return {
106
11
  listDeveloperEntities: () => listDeveloperEntities(options),
@@ -127,74 +32,74 @@ function createRemoteApiClient(options) {
127
32
  };
128
33
  }
129
34
  async function listDeveloperEntities(runtime) {
130
- return remoteGet(runtimePermissionEnv.DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
35
+ return remoteGet(index.DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
131
36
  }
132
37
  async function switchDeveloperEntity(options, runtime) {
133
- return (await remotePostForm(runtimePermissionEnv.DEVELOPER_ENTITY_SWITCH_API_PATH, options, runtime, { requireResult: false })) ?? {};
38
+ return (await remotePostForm(index.DEVELOPER_ENTITY_SWITCH_API_PATH, options, runtime, { requireResult: false })) ?? {};
134
39
  }
135
40
  async function getDeveloperAccessStatus(runtime) {
136
- return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, {}, runtime);
41
+ return remoteGet(index.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, {}, runtime);
137
42
  }
138
43
  async function listUserMiniprograms(options, runtime) {
139
- return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_API_PATH, options, runtime);
44
+ return remoteGet(index.LIST_USER_MINIPROGRAM_API_PATH, options, runtime);
140
45
  }
141
46
  async function createUserMiniprogram(runtime) {
142
- return remotePostForm(runtimePermissionEnv.CREATE_USER_MINIPROGRAM_API_PATH, {}, runtime);
47
+ return remotePostForm(index.CREATE_USER_MINIPROGRAM_API_PATH, {}, runtime);
143
48
  }
144
49
  async function getUserMiniprogramDetail(options, runtime) {
145
- return remoteGet(runtimePermissionEnv.DETAIL_USER_MINIPROGRAM_API_PATH, options, runtime);
50
+ return remoteGet(index.DETAIL_USER_MINIPROGRAM_API_PATH, options, runtime);
146
51
  }
147
52
  async function getPreviewAllowlist(options, runtime) {
148
- return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
53
+ return remoteGet(index.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
149
54
  }
150
55
  async function updatePreviewAllowlist(options, runtime) {
151
- return remotePostForm(runtimePermissionEnv.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
56
+ return remotePostForm(index.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
152
57
  }
153
58
  async function createUserMiniprogramLeaderboard(options, runtime) {
154
- return remotePostForm(runtimePermissionEnv.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
59
+ return remotePostForm(index.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
155
60
  }
156
61
  async function getUserMiniprogramLeaderboard(options, runtime) {
157
- return remoteGet(runtimePermissionEnv.DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
62
+ return remoteGet(index.DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
158
63
  }
159
64
  async function listUserMiniprogramLeaderboards(options, runtime) {
160
- return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
65
+ return remoteGet(index.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
161
66
  }
162
67
  async function deleteUserMiniprogramLeaderboard(options, runtime) {
163
- return (await remotePostForm(runtimePermissionEnv.DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime, { requireResult: false })) ?? {};
68
+ return (await remotePostForm(index.DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime, { requireResult: false })) ?? {};
164
69
  }
165
70
  async function precheckUserMiniprogramVersion(options, runtime) {
166
- return remotePostForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
71
+ return remotePostForm(index.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
167
72
  }
168
73
  async function submitUserMiniprogramAudit(options, runtime) {
169
74
  const form = { ...options };
170
75
  if (form.manifest && typeof form.manifest !== 'string') {
171
76
  form.manifest = JSON.stringify(form.manifest);
172
77
  }
173
- return remotePostForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, form, runtime);
78
+ return remotePostForm(index.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, form, runtime);
174
79
  }
175
80
  async function getVersionPreviewInfo(options, runtime) {
176
- return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, {
81
+ return remoteGet(index.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, {
177
82
  mini_program_id: options.mini_program_id,
178
83
  preview_version: options.version,
179
84
  }, runtime);
180
85
  }
181
86
  async function withdrawUserMiniprogramVersion(options, runtime) {
182
- return remotePostForm(runtimePermissionEnv.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
87
+ return remotePostForm(index.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
183
88
  }
184
89
  async function releaseUserMiniprogramVersion(options, runtime) {
185
- return remotePostForm(runtimePermissionEnv.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
90
+ return remotePostForm(index.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
186
91
  }
187
92
  async function takeDownUserMiniprogram(options, runtime) {
188
- return remotePostForm(runtimePermissionEnv.TAKE_DOWN_USER_MINIPROGRAM_API_PATH, options, runtime);
93
+ return remotePostForm(index.TAKE_DOWN_USER_MINIPROGRAM_API_PATH, options, runtime);
189
94
  }
190
95
  async function reopenUserMiniprogram(options, runtime) {
191
- return remotePostForm(runtimePermissionEnv.REOPEN_USER_MINIPROGRAM_API_PATH, options, runtime);
96
+ return remotePostForm(index.REOPEN_USER_MINIPROGRAM_API_PATH, options, runtime);
192
97
  }
193
98
  async function updateSquareDisplay(options, runtime) {
194
- return remotePostForm(runtimePermissionEnv.UPDATE_SQUARE_DISPLAY_API_PATH, options, runtime);
99
+ return remotePostForm(index.UPDATE_SQUARE_DISPLAY_API_PATH, options, runtime);
195
100
  }
196
101
  async function listUserMiniprogramVersions(options, runtime) {
197
- return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
102
+ return remoteGet(index.LIST_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
198
103
  }
199
104
  async function remoteGet(path, query, runtime) {
200
105
  const pathWithQuery = createPathWithQuery(path, query);
@@ -397,14 +302,10 @@ function isTruthyEnvFlag(value) {
397
302
  }
398
303
 
399
304
  exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
400
- exports.createMiniProgramMockPermissionState = createMiniProgramMockPermissionState;
401
- exports.createMiniProgramMockRuntimePermissions = createMiniProgramMockRuntimePermissions;
402
305
  exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
403
306
  exports.getBoundMiniProgram = getBoundMiniProgram;
404
- exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;
405
307
  exports.readBoundMiniProgramId = readBoundMiniProgramId;
406
308
  exports.readBoundMiniProgramIdFromPackageJson = readBoundMiniProgramIdFromPackageJson;
407
309
  exports.readMiniProgramProjectPackage = readMiniProgramProjectPackage;
408
310
  exports.resolveRemoteEnvironment = resolveRemoteEnvironment;
409
- exports.shouldSkipMiniappPlatformCsp = shouldSkipMiniappPlatformCsp;
410
311
  exports.writeBoundMiniProgramId = writeBoundMiniProgramId;
package/dist/cli-chunks/{create-mp5nBLFJ.cjs → create-D2dSw7bl.cjs} RENAMED
@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
5
5
  var path = require('node:path');
6
6
  var require$$0 = require('fs');
7
7
  var require$$1 = require('path');
8
- var index = require('./index-CZ1l6xci.cjs');
8
+ var index = require('./index-B1w-Jpba.cjs');
9
9
  require('node:module');
10
10
  require('os');
11
11
  require('readline');
package/dist/cli-chunks/{dev-CSuSpwJC.cjs → dev-D6WhI3cC.cjs} RENAMED
@@ -6,33 +6,32 @@ var path = require('node:path');
6
6
  var net = require('node:net');
7
7
  var promises = require('node:dns/promises');
8
8
  var node_http = require('node:http');
9
- var context = require('./context-CfrdSQSg.cjs');
10
9
  var node_crypto = require('node:crypto');
11
10
  var undici = require('undici');
12
11
  var browser = require('./browser-RAy8e8cV.cjs');
13
- var index = require('./index-CZ1l6xci.cjs');
14
- var projectVite = require('./project-vite-BGAleOVW.cjs');
12
+ var index = require('./index-B1w-Jpba.cjs');
13
+ var projectVite = require('./project-vite-J4lrUja0.cjs');
14
+ var context = require('./context-cQXupHub.cjs');
15
15
  var fs$1 = require('node:fs/promises');
16
- var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
17
- require('./session-BbDd1r6M.cjs');
18
- require('fs');
19
- require('constants');
20
- require('stream');
21
- require('util');
22
- require('assert');
23
- require('path');
24
16
  require('node:process');
25
17
  require('node:buffer');
26
18
  require('node:url');
27
19
  require('node:util');
28
20
  require('node:child_process');
29
21
  require('node:module');
22
+ require('path');
30
23
  require('os');
31
24
  require('readline');
32
25
  require('tty');
26
+ require('assert');
33
27
  require('events');
28
+ require('stream');
34
29
  require('buffer');
35
- require('node:async_hooks');
30
+ require('util');
31
+ require('./session-5ryBp2wZ.cjs');
32
+ require('fs');
33
+ require('constants');
34
+ require('./index-v4-6fbXX.cjs');
36
35
 
37
36
  class Locked extends Error {
38
37
  constructor(port) {
@@ -196,6 +195,58 @@ async function getPorts(options) {
196
195
  throw new Error('No available ports found');
197
196
  }
198
197
 
198
+ const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
199
+ /**
200
+ * 判断 permission key 是否由 Runtime 权限快照管理。
201
+ *
202
+ * @param key 待判断的 permission key。
203
+ * @returns 该 key 需要读取 Runtime 权限快照时返回 `true`。
204
+ */
205
+ function isManagedMiniProgramRuntimePermissionKey(key) {
206
+ return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
207
+ }
208
+ /**
209
+ * 解析服务端权限快照；格式不完整时整份快照失效并 fail closed。
210
+ *
211
+ * @param snapshot 待校验的服务端权限快照。
212
+ * @returns 解析状态和通过校验的受管权限。
213
+ */
214
+ function parseMiniProgramRuntimePermissions(snapshot) {
215
+ if (!isRecord$2(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
216
+ return { valid: false, permissions: {} };
217
+ }
218
+ if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
219
+ return { valid: false, permissions: {} };
220
+ }
221
+ const seenKeys = new Set();
222
+ const permissions = {};
223
+ for (const rawEntry of snapshot.entries) {
224
+ if (!isRecord$2(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
225
+ return { valid: false, permissions: {} };
226
+ }
227
+ const key = rawEntry.key.trim();
228
+ if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord$2(rawEntry.config)) {
229
+ return { valid: false, permissions: {} };
230
+ }
231
+ seenKeys.add(key);
232
+ if (!isManagedMiniProgramRuntimePermissionKey(key)) {
233
+ continue;
234
+ }
235
+ if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
236
+ return { valid: false, permissions: {} };
237
+ }
238
+ permissions[key] = {
239
+ key,
240
+ status: rawEntry.status,
241
+ config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
242
+ };
243
+ }
244
+ return { valid: true, permissions };
245
+ }
246
+ function isRecord$2(value) {
247
+ return typeof value === 'object' && value !== null && !Array.isArray(value);
248
+ }
249
+
199
250
  /** Dev Shell 读取局域网 Dev Session endpoint 的 query 参数。 */
200
251
  /** Mock Host 创建和读取 Dev Session 的固定路径。 */
201
252
  const MINI_PROGRAM_DEV_CONTEXT_PATH = '/__hb_sdk__/dev-context';
@@ -641,7 +692,7 @@ function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
641
692
  !allowedMiniUrlOrigins.has(miniUrlOrigin.origin)) {
642
693
  throw new TypeError('mini_url_origin must be an allowed LAN origin');
643
694
  }
644
- const parsedPermissions = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
695
+ const parsedPermissions = parseMiniProgramRuntimePermissions(payload.runtime_permissions);
645
696
  if (!parsedPermissions.valid) {
646
697
  throw new TypeError('runtime_permissions is invalid');
647
698
  }
@@ -984,7 +1035,7 @@ async function handleDevPermissionMutation(request, response, controller) {
984
1035
  if (!isRecord$1(payload) || Object.keys(payload).length !== 1 || !Object.hasOwn(payload, 'runtime_permissions')) {
985
1036
  throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions update body is invalid');
986
1037
  }
987
- const parsed = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
1038
+ const parsed = parseMiniProgramRuntimePermissions(payload.runtime_permissions);
988
1039
  if (!parsed.valid) {
989
1040
  throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'runtime_permissions is invalid');
990
1041
  }
@@ -1167,10 +1218,48 @@ function createHeyboxProtocol(payload) {
1167
1218
  return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
1168
1219
  }
1169
1220
 
1221
+ const DEFAULT_PERMISSION_STATE = {
1222
+ networkRequest: {
1223
+ status: 'disabled',
1224
+ useOfficialDomain: false,
1225
+ },
1226
+ };
1227
+ function createMiniProgramMockPermissionState(context) {
1228
+ const parsed = parseMiniProgramRuntimePermissions(context.runtimePermissions);
1229
+ const networkRequest = parsed.permissions['network.request'];
1230
+ return parsed.valid && networkRequest
1231
+ ? {
1232
+ networkRequest: {
1233
+ status: networkRequest.status,
1234
+ useOfficialDomain: networkRequest.config.useOfficialDomain === true,
1235
+ },
1236
+ }
1237
+ : cloneDefaultPermissionState();
1238
+ }
1239
+ function createMiniProgramMockRuntimePermissions(state) {
1240
+ return {
1241
+ schema_version: 1,
1242
+ entries: [
1243
+ {
1244
+ key: 'network.request',
1245
+ status: state.networkRequest.status,
1246
+ config: {
1247
+ useOfficialDomain: state.networkRequest.useOfficialDomain,
1248
+ },
1249
+ },
1250
+ ],
1251
+ };
1252
+ }
1253
+ function cloneDefaultPermissionState() {
1254
+ return {
1255
+ networkRequest: { ...DEFAULT_PERMISSION_STATE.networkRequest },
1256
+ };
1257
+ }
1258
+
1170
1259
  /** 构建时替换为当前发布包的实际版本。 */
1171
1260
  const HB_SDK_VERSION = typeof undefined === 'string'
1172
1261
  ? undefined
1173
- : '0.6.7-alpha.1';
1262
+ : '0.6.7';
1174
1263
 
1175
1264
  class DevPermissionOverrideStoreError extends Error {
1176
1265
  code;
@@ -1341,7 +1430,7 @@ async function runDevCommand(options, runtime = {}) {
1341
1430
  projectRoot,
1342
1431
  });
1343
1432
  const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), { successText: '已加载项目 Vite' });
1344
- const appServer = await logger.task('正在创建 Vite dev server', () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions)), runtime.env, devLaunchContext.runtimePermissions), { successText: '已创建 Vite dev server' });
1433
+ const appServer = await logger.task('正在创建 Vite dev server', () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions)), runtime.env), { successText: '已创建 Vite dev server' });
1345
1434
  await logger.task('正在启动 Vite dev server', () => appServer.listen(appPort), {
1346
1435
  successText: 'Vite dev server 已启动',
1347
1436
  });
@@ -1458,7 +1547,7 @@ function createDevPermissionController(options) {
1458
1547
  source: devContext.source,
1459
1548
  ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
1460
1549
  ...(isRuntimePermissionsSnapshot(devContext.runtimePermissions) ? { remote_permissions: devContext.runtimePermissions } : {}),
1461
- ...(overrides ? { override_permissions: context.createMiniProgramMockRuntimePermissions(overrides) } : {}),
1550
+ ...(overrides ? { override_permissions: createMiniProgramMockRuntimePermissions(overrides) } : {}),
1462
1551
  ...(error ? { persistence_error: error } : {}),
1463
1552
  };
1464
1553
  };
@@ -1495,7 +1584,7 @@ function createDevPermissionController(options) {
1495
1584
  return createConfiguration(undefined);
1496
1585
  },
1497
1586
  async save(runtimePermissions) {
1498
- const overrides = context.createMiniProgramMockPermissionState({
1587
+ const overrides = createMiniProgramMockPermissionState({
1499
1588
  runtimePermissions,
1500
1589
  });
1501
1590
  try {
@@ -1513,7 +1602,7 @@ function createDevPermissionController(options) {
1513
1602
  };
1514
1603
  }
1515
1604
  function isRuntimePermissionsSnapshot(value) {
1516
- return context.parseMiniProgramRuntimePermissions(value).valid;
1605
+ return parseMiniProgramRuntimePermissions(value).valid;
1517
1606
  }
1518
1607
  async function loadRemoteDevContextWithTimeout(options) {
1519
1608
  const controller = new AbortController();
@@ -1655,11 +1744,11 @@ function rewriteLocalhostUrl(input) {
1655
1744
  function isLocalhostHost(hostname) {
1656
1745
  return hostname === 'localhost' || hostname === '::1' || hostname === '[::1]';
1657
1746
  }
1658
- async function withManagedDevOutputEnv(action, env = process.env, runtimePermissions) {
1747
+ async function withManagedDevOutputEnv(action, env = process.env) {
1659
1748
  const previousManagedOutput = env[MANAGED_DEV_OUTPUT_ENV];
1660
1749
  env[MANAGED_DEV_OUTPUT_ENV] = '1';
1661
1750
  try {
1662
- return await runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(runtimePermissions), action, env);
1751
+ return await action();
1663
1752
  }
1664
1753
  finally {
1665
1754
  if (previousManagedOutput === undefined) {
package/dist/cli-chunks/{doctor-nEv6ikeF.cjs → doctor-CtNS5Tt2.cjs} RENAMED
@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
4
4
  var fs = require('node:fs/promises');
5
5
  var os = require('node:os');
6
6
  var path = require('node:path');
7
- var index = require('./index-CZ1l6xci.cjs');
7
+ var index = require('./index-B1w-Jpba.cjs');
8
8
  require('node:module');
9
9
  require('path');
10
10
  require('os');
@@ -33,7 +33,7 @@ async function runDoctorCommand(runtime = {}) {
33
33
  }
34
34
  async function getDoctorResult(runtime = {}) {
35
35
  const currentSdkVersion = await readCurrentSdkVersion(runtime.packageJsonFiles);
36
- const localSkillJsonPath = resolveLocalSkillJsonPath(runtime);
36
+ const localSkillJsonPath = await resolveLocalSkillJsonPath(runtime);
37
37
  let remoteSkill;
38
38
  try {
39
39
  remoteSkill = await fetchRemoteSkill(runtime);
@@ -165,13 +165,31 @@ async function readCurrentSdkVersion(packageJsonCandidates = PACKAGE_JSON_CANDID
165
165
  }
166
166
  throw new Error('未能读取 @heybox/hb-sdk 当前版本号');
167
167
  }
168
- function resolveLocalSkillJsonPath(runtime) {
168
+ async function resolveLocalSkillJsonPath(runtime) {
169
169
  if (runtime.localSkillJsonPath) {
170
170
  return runtime.localSkillJsonPath;
171
171
  }
172
+ const projectSkillJsonPath = await findProjectSkillJsonPath(runtime.cwd ?? process.cwd());
173
+ if (projectSkillJsonPath) {
174
+ return projectSkillJsonPath;
175
+ }
172
176
  const codexHome = runtime.codexHome ?? runtime.env?.CODEX_HOME ?? process.env.CODEX_HOME ?? path.join(os.homedir(), '.codex');
173
177
  return path.join(codexHome, 'skills', index.HB_SDK_SKILL_NAME, 'skill.json');
174
178
  }
179
+ async function findProjectSkillJsonPath(startDir) {
180
+ let current = path.resolve(startDir);
181
+ while (true) {
182
+ const skillJsonPath = path.join(current, '.agents', 'skills', index.HB_SDK_SKILL_NAME, 'skill.json');
183
+ if ((await pathExists(path.join(current, 'package.json'))) && (await pathExists(skillJsonPath))) {
184
+ return skillJsonPath;
185
+ }
186
+ const parent = path.dirname(current);
187
+ if (parent === current) {
188
+ return undefined;
189
+ }
190
+ current = parent;
191
+ }
192
+ }
175
193
  async function pathExists(filePath) {
176
194
  try {
177
195
  await fs.access(filePath, fs$1.constants.F_OK);