@heybox/hb-sdk 0.6.7-alpha.1 → 0.6.7-alpha.2

package/dist/cli-chunks/{runtime-permission-env-BSs4uCNa.cjs → index-BQm5XmMC.cjs}

@@ -1,7 +1,5 @@
 'use strict';
 
-var node_async_hooks = require('node:async_hooks');
-
 var re = {exports: {}};
 
 var constants;
@@ -2881,72 +2879,6 @@ function shouldUploadDistFile(relativePath) {
     return true;
 }
 
-const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
-const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
-const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
-const environmentScopeStorage = new node_async_hooks.AsyncLocalStorage();
-let environmentScopeTail = Promise.resolve();
-function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
-    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
-}
-function createMiniappPlatformCspEnv(env, skipPlatformCsp) {
-    return {
-        ...env,
-        [HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV]: VERIFIED_RUNTIME_PERMISSION_CONTEXT,
-        [HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV]: skipPlatformCsp ? '1' : '0',
-    };
-}
-async function withMiniappPlatformCspEnv(skipPlatformCsp, action, env = process.env) {
-    if (environmentScopeStorage.getStore()?.active) {
-        return runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env);
-    }
-    let releaseScope = () => undefined;
-    const previousScope = environmentScopeTail;
-    environmentScopeTail = new Promise((resolve) => {
-        releaseScope = resolve;
-    });
-    await previousScope;
-    const scope = { active: true };
-    try {
-        return await environmentScopeStorage.run(scope, () => runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env));
-    }
-    finally {
-        scope.active = false;
-        releaseScope();
-    }
-}
-async function runMiniappPlatformCspEnvScope(skipPlatformCsp, action, env) {
-    const targets = env === process.env ? [env] : [env, process.env];
-    const previousValues = targets.map((target) => ({
-        context: target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV],
-        officialDomain: target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV],
-    }));
-    for (const target of targets) {
-        target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] = VERIFIED_RUNTIME_PERMISSION_CONTEXT;
-        target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] = skipPlatformCsp ? '1' : '0';
-    }
-    try {
-        return await action();
-    }
-    finally {
-        targets.forEach((target, index) => {
-            const previousValue = previousValues[index];
-            if (previousValue?.context === undefined) {
-                delete target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV];
-            }
-            else {
-                target[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] = previousValue.context;
-            }
-            if (previousValue?.officialDomain === undefined) {
-                delete target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV];
-            }
-            else {
-                target[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] = previousValue.officialDomain;
-            }
-        });
-    }
-}
-
 exports.ACTIVITY_UPLOAD_KEY_MAX_LENGTH = ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
 exports.CREATE_USER_MINIPROGRAM_API_PATH = CREATE_USER_MINIPROGRAM_API_PATH;
 exports.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH = CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH;
@@ -2971,14 +2903,11 @@ exports.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = USER_MINIPROGRAM_ACCESS_STATUS
 exports.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;
 exports.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH = USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH;
 exports.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH;
-exports.createMiniappPlatformCspEnv = createMiniappPlatformCspEnv;
 exports.getMiniappUploadKey = getMiniappUploadKey;
 exports.normalizeRelativePath = normalizeRelativePath;
 exports.relativePathContainsNodeModulesSegment = relativePathContainsNodeModulesSegment;
 exports.requireSemver = requireSemver;
 exports.semverExports = semverExports;
-exports.shouldSkipMiniappPlatformCspFromEnv = shouldSkipMiniappPlatformCspFromEnv;
 exports.shouldUploadDistFile = shouldUploadDistFile;
 exports.validateUploadPaths = validateUploadPaths;
 exports.validateUploadTotalSize = validateUploadTotalSize;
-exports.withMiniappPlatformCspEnv = withMiniappPlatformCspEnv;

package/dist/cli-chunks/{index-CZ1l6xci.cjs → index-CQnkS0Z8.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CZ1l6xci.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CZ1l6xci.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CZ1l6xci.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CZ1l6xci.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CZ1l6xci.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.6.7-alpha.1';
+const BUILT_CLI_VERSION = '0.6.7-alpha.2';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13680,35 +13680,35 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-B2kXjmcM.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BmisXAdp.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-B2kXjmcM.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BmisXAdp.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-B2kXjmcM.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BmisXAdp.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-cBQK_qq-.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CQmYxfxm.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-mp5nBLFJ.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CC5r_8bL.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CSuSpwJC.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CD-38TgO.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-nEv6ikeF.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-43yEfVr0.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-B5byhdC7.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BXtT6M2f.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{login-B2kXjmcM.cjs → login-BmisXAdp.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-BbDd1r6M.cjs');
+var session = require('./session-BjtjhtPg.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CZ1l6xci.cjs');
+var index = require('./index-CQnkS0Z8.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-BGAleOVW.cjs → project-vite-D9_v57vp.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-CZ1l6xci.cjs');
+var index = require('./index-CQnkS0Z8.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-B5byhdC7.cjs → remote-BXtT6M2f.cjs}

@@ -1,15 +1,15 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-CZ1l6xci.cjs');
-var session = require('./session-BbDd1r6M.cjs');
+var index = require('./index-CQnkS0Z8.cjs');
+var session = require('./session-BjtjhtPg.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
-var runtimeGate = require('./runtime-gate--rPXjiG6.cjs');
-var context = require('./context-CfrdSQSg.cjs');
+var index$1 = require('./index-BQm5XmMC.cjs');
+var runtimeGate = require('./runtime-gate-B2MQf1vc.cjs');
+var context = require('./context-ChkYWwH_.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -23,7 +23,6 @@ require('util');
 require('node:crypto');
 require('fs');
 require('constants');
-require('node:async_hooks');
 
 async function getCDNUploadInfo(options, runtime = {}) {
     const body = new URLSearchParams();
@@ -70,7 +69,7 @@ async function runUpload(options, runtime = {}) {
     const postCDNUploadCallback$1 = runtime.postCDNUploadCallback ?? postCDNUploadCallback;
     const createReadStream = runtime.createReadStream ?? fs.createReadStream;
     const orderedFiles = [...options.files].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-    const batches = chunkUploadFiles(orderedFiles, runtimePermissionEnv.MINIAPP_UPLOAD_BATCH_SIZE);
+    const batches = chunkUploadFiles(orderedFiles, index$1.MINIAPP_UPLOAD_BATCH_SIZE);
     await logger.task(`正在上传 ${orderedFiles.length} 个文件`, async (taskContext) => {
         logger.debug(`上传并发数: ${concurrency}`);
         logger.debug(`上传批次数: ${batches.length}`);
@@ -80,7 +79,7 @@ async function runUpload(options, runtime = {}) {
             logger.debug(`正在处理上传批次 ${batchIndex + 1}/${batches.length}，文件数: ${batch.length}`);
             logger.debug('正在获取 CDN 上传信息');
             const fileInfos = createUploadFileInfos(batch, options);
-            const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: runtimePermissionEnv.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
+            const uploadInfo = await getCDNUploadInfo$1({ session: options.session, scope: index$1.MINIAPP_UPLOAD_SCOPE, fileInfos, needCache: false }, { baseUrl: runtime.baseUrl, fetchImpl });
             logger.debug(`CDN bucket: ${uploadInfo.bucket}`);
             logger.debug(`CDN region: ${uploadInfo.region}`);
             validateUploadInfoKeys(batch, uploadInfo.keys, options);
@@ -141,7 +140,7 @@ function createUploadFileInfos(files, options) {
         name: file.relativePath.split('/').pop() ?? file.relativePath,
         mimetype: file.mimeType,
         fsize: file.size,
-        path: runtimePermissionEnv.getMiniappUploadKey({
+        path: index$1.getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
             relativePath: file.relativePath,
@@ -152,15 +151,15 @@ function validateUploadInfoKeys(files, keys, options) {
     if (keys.length !== files.length) {
         throw new index.CliError(`CDN 上传接口返回 key 数量异常：期望 ${files.length}，实际 ${keys.length}`);
     }
-    for (let index$1 = 0; index$1 < files.length; index$1 += 1) {
-        const expectedKey = runtimePermissionEnv.getMiniappUploadKey({
+    for (let index$2 = 0; index$2 < files.length; index$2 += 1) {
+        const expectedKey = index$1.getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
-            relativePath: files[index$1].relativePath,
+            relativePath: files[index$2].relativePath,
         });
-        const actualKey = keys[index$1];
+        const actualKey = keys[index$2];
         if (actualKey !== expectedKey) {
-            throw new index.CliError(`CDN 上传接口返回 key 异常：${files[index$1].relativePath}`, [`CDN 上传接口返回 key 异常：${files[index$1].relativePath}`, `expected: ${expectedKey}`, `actual: ${actualKey}`].join('\n'));
+            throw new index.CliError(`CDN 上传接口返回 key 异常：${files[index$2].relativePath}`, [`CDN 上传接口返回 key 异常：${files[index$2].relativePath}`, `expected: ${expectedKey}`, `actual: ${actualKey}`].join('\n'));
         }
     }
 }
@@ -192,7 +191,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-CgUdrl3g.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-BM6oH2Hs.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -236,7 +235,7 @@ function isRecord(value) {
 }
 
 async function precheckUserMiniprogramVersion(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
+    return postUserMiniprogramVersionForm(index$1.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, {
         // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
         ...(options.version ? { version: options.version } : {}),
         ...(options.source_version ? { source_version: options.source_version } : {}),
@@ -245,7 +244,7 @@ async function precheckUserMiniprogramVersion(options, runtime = {}) {
     }, runtime);
 }
 async function submitUserMiniprogramAudit(options, runtime = {}) {
-    return postUserMiniprogramVersionForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
+    return postUserMiniprogramVersionForm(index$1.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, options, {
         // 展示资料由服务端沿用 last approved 或注入默认名/默认图；CLI 不传 name/icon/cover。
         ...(options.manifest ? { manifest: JSON.stringify(options.manifest) } : {}),
         ...(options.source_version ? { source_version: options.source_version } : {}),
@@ -342,28 +341,11 @@ async function runDeployCommand(options, runtime = {}) {
             releaseNote,
             autoPublish,
         }, runtime, apiBaseUrl, projectRoot, logger);
-        let skipPlatformCsp = false;
-        try {
-            const { detail } = await logger.task('正在读取远端小程序权限', () => (runtime.getBoundMiniProgram ?? context.getBoundMiniProgram)({
-                allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl,
-                apiBaseUrl,
-                cwd: projectRoot,
-                env,
-                fetchImpl: runtime.fetchImpl,
-                loginBaseUrl,
-                session: session$1,
-            }), { successText: '已读取远端小程序权限' });
-            skipPlatformCsp = context.shouldSkipMiniappPlatformCsp(detail.runtime_permissions);
-        }
-        catch (error) {
-            logger.warn('未读取到远端 Runtime 权限，构建将继续注入平台 CSP。');
-            logger.debug(`远端 Runtime 权限读取失败详情：${index.readRedactedErrorMessage(error, { verbose: true })}`);
-        }
         const pm = detectPackageManager(projectRoot);
         const buildMode = env.HB_SDK_ENV?.trim();
         logger.info(`开始构建: ${pm} ${createBuildArgs(pm, buildMode).join(' ')}`);
         await runBuildScript(pm, projectRoot, runtime.spawn ?? childProcess.spawn, {
-            env: runtimePermissionEnv.createMiniappPlatformCspEnv(env, skipPlatformCsp),
+            env,
             mode: buildMode,
             outputMode: options.buildOutputMode ?? 'inherit',
             stderr: runtime.stderr,
@@ -382,16 +364,16 @@ async function runDeployCommand(options, runtime = {}) {
         }
         const uploadFiles = await logger.task('正在校验 dist 上传文件', async () => {
             const allFiles = await walkDistFiles(distDir);
-            const blocked = allFiles.find((entry) => runtimePermissionEnv.relativePathContainsNodeModulesSegment(entry.relativePath));
+            const blocked = allFiles.find((entry) => index$1.relativePathContainsNodeModulesSegment(entry.relativePath));
             if (blocked) {
                 throw new Error(`dist 目录含 node_modules：${blocked.relativePath}`);
             }
-            const files = allFiles.filter((entry) => runtimePermissionEnv.shouldUploadDistFile(entry.relativePath));
-            const pathError = runtimePermissionEnv.validateUploadPaths(files, { miniProgramId, version, maxLength: runtimePermissionEnv.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
+            const files = allFiles.filter((entry) => index$1.shouldUploadDistFile(entry.relativePath));
+            const pathError = index$1.validateUploadPaths(files, { miniProgramId, version, maxLength: index$1.ACTIVITY_UPLOAD_KEY_MAX_LENGTH });
             if (pathError) {
                 throw new Error(pathError);
             }
-            const sizeError = runtimePermissionEnv.validateUploadTotalSize(files);
+            const sizeError = index$1.validateUploadTotalSize(files);
             if (sizeError) {
                 throw new Error(sizeError);
             }
@@ -600,7 +582,7 @@ async function walkDistFiles(distDir) {
             }
             const fileStat = await fs$1.stat(absPath);
             results.push({
-                relativePath: runtimePermissionEnv.normalizeRelativePath(relPath),
+                relativePath: index$1.normalizeRelativePath(relPath),
                 absolutePath: absPath,
                 size: fileStat.size,
                 mimeType: inferMimeType(entry.name),

package/dist/cli-chunks/{runtime-gate--rPXjiG6.cjs → runtime-gate-B2MQf1vc.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-BSs4uCNa.cjs');
+var index = require('./index-BQm5XmMC.cjs');
 
 function isValidMiniappManifestVersion(version) {
     return getMiniappManifestVersionError(version) === undefined;
@@ -41,7 +41,7 @@ function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
         throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
     }
     const normalized = version.trim();
-    const parsed = runtimePermissionEnv.semverExports.parse(normalized);
+    const parsed = index.semverExports.parse(normalized);
     if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
         throw new Error(`${sourceLabel} 必须是合法 SemVer：${normalized}`);
     }
@@ -55,7 +55,7 @@ function getMiniappManifestVersionError(version) {
         return `必须是合法 SemVer：${String(version)}`;
     }
     const normalized = version.trim();
-    const parsed = runtimePermissionEnv.semverExports.parse(normalized);
+    const parsed = index.semverExports.parse(normalized);
     if (!parsed) {
         return `必须是合法 SemVer：${normalized}`;
     }

package/dist/cli-chunks/{session-BbDd1r6M.cjs → session-BjtjhtPg.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-CZ1l6xci.cjs');
+var index = require('./index-CQnkS0Z8.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-CZ1l6xci.cjs');
+var index = require('./cli-chunks/index-CQnkS0Z8.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/index.cjs.js

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.1';
+    : '0.6.7-alpha.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.1';
+    : '0.6.7-alpha.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/vite.cjs.js

@@ -2,13 +2,12 @@
 
 var node_fs = require('node:fs');
 var path = require('node:path');
-var node_async_hooks = require('node:async_hooks');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.1';
+    : '0.6.7-alpha.2';
 
 var re = {exports: {}};
 
@@ -11433,13 +11432,17 @@ function walk$1(node, visit) {
 
 const FORBIDDEN_RESOURCE_HINTS = new Set(['dns-prefetch', 'preconnect', 'prerender']);
 const RELATIVE_URL_BASE = new URL('https://heybox-relative.invalid/');
+const OFFICIAL_RESOURCE_ROOT_DOMAINS = ['xiaoheihe.cn', 'max-c.com', 'debugmode.cn', 'maxjia.com'];
+const OFFICIAL_RESOURCE_SOURCES = OFFICIAL_RESOURCE_ROOT_DOMAINS.flatMap(rootDomain => [
+    `https://${rootDomain}`,
+    `https://*.${rootDomain}`,
+]);
 const URL_ATTRIBUTES = {
     audio: ['src'],
     embed: ['src'],
     iframe: ['src'],
     img: ['src'],
     input: ['src'],
-    link: ['href'],
     object: ['data'],
     script: ['src'],
     source: ['src', 'srcset'],
@@ -11449,11 +11452,11 @@ const URL_ATTRIBUTES = {
 const PRODUCTION_CSP = [
     "default-src 'none'",
     "connect-src 'none'",
-    "script-src 'self' 'unsafe-inline'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: blob:",
-    "font-src 'self' data:",
-    "media-src 'self' blob:",
+    `script-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `style-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `img-src 'self' data: blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `font-src 'self' data: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `media-src 'self' blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
     "manifest-src 'self'",
     "frame-src 'none'",
     "child-src 'none'",
@@ -11472,9 +11475,6 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
-    if (options.skipPlatformCsp) {
-        return serialize(document);
-    }
     const content = options.hmrWebSocketUrl
         ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
         : PRODUCTION_CSP;
@@ -11511,19 +11511,25 @@ function validateElement(element) {
         if (forbidden) {
             throw new Error(`index.html 不允许 rel="${forbidden}"`);
         }
-        if (rels.includes('preload') || rels.includes('modulepreload')) {
+        if (rels.includes('stylesheet')) {
+            validateResourceUrl(attrs.get('href'), '<link rel="stylesheet" href>', false, true);
+        }
+        else if (rels.includes('preload') || rels.includes('modulepreload')) {
             validateRelativeUrl(attrs.get('href'), `<link rel="${rels.includes('modulepreload') ? 'modulepreload' : 'preload'}" href>`, false);
         }
+        else {
+            validateRelativeUrl(attrs.get('href'), '<link href>', false);
+        }
     }
     for (const attribute of URL_ATTRIBUTES[tagName] ?? []) {
         const value = attrs.get(attribute);
         if (attribute === 'srcset') {
             for (const candidate of (value ?? '').split(',').map(item => item.trim().split(/\s+/)[0]).filter(Boolean)) {
-                validateRelativeUrl(candidate, `<${tagName} ${attribute}>`, true);
+                validateResourceUrl(candidate, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
             }
         }
         else {
-            validateRelativeUrl(value, `<${tagName} ${attribute}>`, true);
+            validateResourceUrl(value, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
         }
     }
 }
@@ -11538,16 +11544,43 @@ function removePlatformCspMarkers(node) {
     for (const child of node.childNodes)
         removePlatformCspMarkers(child);
 }
-function validateRelativeUrl(value, label, allowDataBlob) {
+function supportsOfficialResourceUrl(tagName, attribute) {
+    return ((tagName === 'script' && attribute === 'src') ||
+        (tagName === 'img' && attribute === 'src') ||
+        (tagName === 'source' && (attribute === 'src' || attribute === 'srcset')) ||
+        (tagName === 'audio' && attribute === 'src') ||
+        (tagName === 'track' && attribute === 'src') ||
+        (tagName === 'video' && (attribute === 'src' || attribute === 'poster')));
+}
+function validateResourceUrl(value, label, allowDataBlob, allowOfficialResourceUrl) {
     if (!value || value.startsWith('#'))
         return;
     const normalized = value.trim().toLowerCase();
     if (allowDataBlob && (normalized.startsWith('data:') || normalized.startsWith('blob:')))
         return;
+    if (allowOfficialResourceUrl && isOfficialResourceUrl(value))
+        return;
     if (!isRelativeUrl(value, normalized)) {
         throw new Error(`${label} 必须使用相对路径${allowDataBlob ? '或明确的 data:/blob: URL' : ''}：${value}`);
     }
 }
+function validateRelativeUrl(value, label, allowDataBlob) {
+    validateResourceUrl(value, label, allowDataBlob, false);
+}
+function isOfficialResourceUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password)
+            return false;
+        const hostname = url.hostname.toLowerCase();
+        if (hostname.endsWith('.'))
+            return false;
+        return OFFICIAL_RESOURCE_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+    }
+    catch {
+        return false;
+    }
+}
 function isRelativeUrl(value, normalized) {
     const browserNormalized = normalized.replace(/[\t\n\r]/g, '');
     if (browserNormalized.includes('\\') || browserNormalized.startsWith('//'))
@@ -11584,19 +11617,9 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
-const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
-const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
-const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
-new node_async_hooks.AsyncLocalStorage();
-Promise.resolve();
-function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
-    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
-    const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
@@ -11628,7 +11651,6 @@ function miniappManifest() {
         transformIndexHtml(html) {
             return enforceMiniappHtmlPolicy(html, {
                 ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
-                skipPlatformCsp,
             });
         },
         async closeBundle() {
@@ -11651,7 +11673,7 @@ function miniappManifest() {
             if (!htmlFiles.includes(indexHtmlPath)) {
                 throw new Error('构建产物必须包含入口 dist/index.html');
             }
-            node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
+            node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8')));
             const manifestPath = path.join(outputRoot, 'manifest.json');
             node_fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
             node_fs.writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
@@ -11693,7 +11715,7 @@ function resolveHmrWebSocketUrl(resolved) {
     if (hmr === false)
         return undefined;
     const options = typeof hmr === 'object' ? hmr : {};
-    const protocol = options.protocol ?? 'ws';
+    const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
     const configuredHost = options.host ?? resolved.server.host;
     const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
     const port = options.clientPort ?? options.port ?? resolved.server.port;