@heybox/hb-sdk 0.6.8-alpha.2 → 0.6.8

package/dist/devtools/mock-host/main.js

@@ -24,7 +24,7 @@ function isManagedMiniProgramRuntimePermissionKey(key) {
  * @returns 解析状态和通过校验的受管权限。
  */
 function parseMiniProgramRuntimePermissions(snapshot) {
-    if (!isRecord$2(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
+    if (!isRecord$3(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
         return { valid: false, permissions: {} };
     }
     if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
@@ -33,11 +33,11 @@ function parseMiniProgramRuntimePermissions(snapshot) {
     const seenKeys = new Set();
     const permissions = {};
     for (const rawEntry of snapshot.entries) {
-        if (!isRecord$2(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
+        if (!isRecord$3(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
             return { valid: false, permissions: {} };
         }
         const key = rawEntry.key.trim();
-        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord$2(rawEntry.config)) {
+        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord$3(rawEntry.config)) {
             return { valid: false, permissions: {} };
         }
         seenKeys.add(key);
@@ -55,7 +55,7 @@ function parseMiniProgramRuntimePermissions(snapshot) {
     }
     return { valid: true, permissions };
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
@@ -4194,6 +4194,293 @@ function readStringEnum(value, allowedValues, message) {
     return value;
 }
 
+const LOG_PREFIX = '[hb-sdk-runtime][network.request]';
+const DATA_PREVIEW_MAX_CHARS$1 = 500;
+const SENSITIVE_HEADER_NAMES$1 = new Set([
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+    'set-cookie',
+    'token',
+    'x-pkey',
+    'api-key',
+    'apikey',
+    'x-api-key',
+    'x-auth-token',
+    'x-access-token',
+    'session',
+    'session-id',
+    'jwt',
+    'refresh-token',
+    'x-csrf-token',
+]);
+/** 与 SDK sanitize 保持同一敏感 key 规则，避免双轨漂移。 */
+const SENSITIVE_KEY_PATTERN$1 = /(authorization|cookie|password|passwd|secret|token|pkey|private[_-]?key|access[_-]?key|client[_-]?secret|api[_-]?key|apikey|session|jwt|refresh[_-]?token|csrf)/i;
+/**
+ * 记录 Runtime 侧 `network.request` 异常或非 2xx 结果，便于 Host / 调试面板观测。
+ *
+ * @remarks
+ * 不改变 bridge 语义：非 2xx 仍作为 success payload 返回；仅输出诊断日志。
+ * detail 构造与 logger 调用均包在 try 内，日志失败不得影响 bridge 请求路径。
+ *
+ * 日志阶段与 SDK 侧关系：
+ * - Runtime 固定按 HTTP 2xx 判定 `http_status`；
+ * - SDK 以业务 `validateStatus` 为准，自定义校验可能导致两端日志不对称。
+ */
+function logRuntimeNetworkFailure(options) {
+    try {
+        const consoleRef = typeof console === 'undefined' ? undefined : console;
+        const logger = consoleRef?.warn || consoleRef?.error || consoleRef?.log;
+        if (!logger) {
+            return;
+        }
+        const detail = createRuntimeNetworkFailureDetail(options);
+        logger.call(consoleRef, LOG_PREFIX, formatRuntimeNetworkFailureMessage(detail), detail);
+    }
+    catch {
+        // 日志失败不得影响 bridge 请求路径。
+    }
+}
+function createRuntimeNetworkFailureDetail(options) {
+    const method = (options.request?.method || readPayloadMethod(options.payload) || 'GET').toUpperCase();
+    const url = sanitizeRuntimeNetworkUrl(options.request?.url || readPayloadUrl(options.payload) || '');
+    const detail = {
+        phase: options.phase,
+        method,
+        url,
+    };
+    if (options.response && typeof options.response.status === 'number') {
+        detail.status = options.response.status;
+    }
+    if (options.response?.statusText) {
+        detail.statusText = options.response.statusText;
+    }
+    const errorInfo = readRuntimeNetworkErrorInfo(options.error);
+    if (errorInfo.message) {
+        detail.message = sanitizeRuntimeDiagnosticMessage(errorInfo.message);
+    }
+    if (errorInfo.code) {
+        detail.code = errorInfo.code;
+    }
+    // http_status：响应头写入 headers，请求头写入 requestHeaders；其余阶段优先请求头。
+    const requestHeaders = sanitizeRuntimeNetworkHeaders(options.request?.headers);
+    const responseHeaders = sanitizeRuntimeNetworkHeaders(options.response?.headers);
+    if (options.phase === 'http_status') {
+        if (responseHeaders && Object.keys(responseHeaders).length > 0) {
+            detail.headers = responseHeaders;
+        }
+        if (requestHeaders && Object.keys(requestHeaders).length > 0) {
+            detail.requestHeaders = requestHeaders;
+        }
+    }
+    else if (requestHeaders && Object.keys(requestHeaders).length > 0) {
+        detail.headers = requestHeaders;
+    }
+    else if (responseHeaders && Object.keys(responseHeaders).length > 0) {
+        detail.headers = responseHeaders;
+    }
+    const dataPreview = previewRuntimeNetworkData(options.response?.data !== undefined ? options.response.data : options.request?.data);
+    if (dataPreview !== undefined) {
+        detail.dataPreview = dataPreview;
+    }
+    if (options.request?.timeout !== undefined) {
+        detail.timeout = options.request.timeout;
+    }
+    if (options.request?.withCredentials !== undefined) {
+        detail.withCredentials = options.request.withCredentials;
+    }
+    return detail;
+}
+function formatRuntimeNetworkFailureMessage(detail) {
+    const phase = String(detail.phase || 'unknown');
+    const method = String(detail.method || 'GET');
+    const url = String(detail.url || '');
+    const statusPart = typeof detail.status === 'number' ? ` status=${detail.status}` : '';
+    const codePart = detail.code ? ` code=${detail.code}` : '';
+    return `${phase} ${method} ${url}${statusPart}${codePart}`;
+}
+function readPayloadUrl(payload) {
+    if (!isRecord$2(payload) || typeof payload.url !== 'string') {
+        return undefined;
+    }
+    return payload.url;
+}
+function readPayloadMethod(payload) {
+    if (!isRecord$2(payload) || typeof payload.method !== 'string') {
+        return undefined;
+    }
+    return payload.method;
+}
+function readRuntimeNetworkErrorInfo(error) {
+    if (error instanceof Error) {
+        const code = isRecord$2(error) && typeof error.code === 'string' ? error.code : undefined;
+        return {
+            message: error.message,
+            ...(code ? { code } : {}),
+        };
+    }
+    if (isRecord$2(error)) {
+        const code = typeof error.code === 'string' ? error.code : undefined;
+        const message = typeof error.message === 'string' ? error.message : undefined;
+        if (code || message) {
+            return {
+                ...(code ? { code } : {}),
+                ...(message ? { message } : {}),
+            };
+        }
+    }
+    if (error !== undefined) {
+        return { message: String(error) };
+    }
+    return {};
+}
+function sanitizeRuntimeNetworkUrl(url) {
+    if (!url) {
+        return url;
+    }
+    try {
+        const parsed = new URL(url);
+        parsed.username = '';
+        parsed.password = '';
+        redactRuntimeUrlSearchParams(parsed.searchParams);
+        if (parsed.hash && parsed.hash.length > 1) {
+            const hashBody = parsed.hash.slice(1);
+            if (hashBody.includes('=')) {
+                const hashParams = new URLSearchParams(hashBody);
+                if (redactRuntimeUrlSearchParams(hashParams)) {
+                    parsed.hash = hashParams.toString();
+                }
+            }
+        }
+        return parsed.toString();
+    }
+    catch {
+        return redactRuntimeSensitivePairsInRawText(url);
+    }
+}
+function sanitizeRuntimeDiagnosticMessage(message) {
+    if (!message) {
+        return message;
+    }
+    return message.replace(/https?:\/\/[^\s]+/gi, matched => sanitizeRuntimeNetworkUrl(matched.replace(/[),.;]+$/g, '')));
+}
+function sanitizeRuntimeNetworkHeaders(headers) {
+    if (!headers) {
+        return undefined;
+    }
+    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [
+        key,
+        isSensitiveRuntimeNetworkHeaderName(key) ? '[redacted]' : value,
+    ]));
+}
+function previewRuntimeNetworkData(data) {
+    if (data === undefined) {
+        return undefined;
+    }
+    if (typeof data === 'string') {
+        return previewRuntimeNetworkStringData(data);
+    }
+    if (typeof data === 'number' || typeof data === 'boolean' || data === null) {
+        return data;
+    }
+    try {
+        const sanitized = sanitizeRuntimeNetworkDataValue(data);
+        const serialized = JSON.stringify(sanitized);
+        if (serialized === undefined) {
+            return '[unserializable]';
+        }
+        if (serialized.length <= DATA_PREVIEW_MAX_CHARS$1) {
+            return sanitized;
+        }
+        return truncateText$1(serialized, DATA_PREVIEW_MAX_CHARS$1);
+    }
+    catch {
+        return '[unserializable]';
+    }
+}
+function previewRuntimeNetworkStringData(data) {
+    const trimmed = data.trim();
+    if ((trimmed.startsWith('{') && trimmed.endsWith('}')) || (trimmed.startsWith('[') && trimmed.endsWith(']'))) {
+        try {
+            return previewRuntimeNetworkData(JSON.parse(trimmed));
+        }
+        catch {
+            // fall through
+        }
+    }
+    if (trimmed.includes('=') && !trimmed.includes('\n') && trimmed.length <= DATA_PREVIEW_MAX_CHARS$1 * 2) {
+        try {
+            const params = new URLSearchParams(trimmed);
+            if ([...params.keys()].length > 0) {
+                return previewRuntimeNetworkData(Object.fromEntries([...params.entries()].map(([key, value]) => [
+                    key,
+                    isSensitiveRuntimeNetworkKey(key) ? '[redacted]' : value,
+                ])));
+            }
+        }
+        catch {
+            // fall through
+        }
+    }
+    return truncateText$1(redactRuntimeSensitivePairsInRawText(data), DATA_PREVIEW_MAX_CHARS$1);
+}
+function sanitizeRuntimeNetworkDataValue(value) {
+    if (Array.isArray(value)) {
+        return value.slice(0, 20).map(item => sanitizeRuntimeNetworkDataValue(item));
+    }
+    // 与 SDK 对齐：仅递归 plain object，避免 Date / Error 等特殊对象行为不一致。
+    if (!isPlainObject$1(value)) {
+        if (typeof value === 'string') {
+            return truncateText$1(value, DATA_PREVIEW_MAX_CHARS$1);
+        }
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        isSensitiveRuntimeNetworkKey(key) ? '[redacted]' : sanitizeRuntimeNetworkDataValue(item),
+    ]));
+}
+function isSensitiveRuntimeNetworkHeaderName(headerName) {
+    const normalized = headerName.trim().toLowerCase();
+    return (SENSITIVE_HEADER_NAMES$1.has(normalized) ||
+        isSensitiveRuntimeNetworkKey(normalized) ||
+        normalized.startsWith('x-heybox-') ||
+        normalized.startsWith('x-xhh-'));
+}
+function isSensitiveRuntimeNetworkKey(key) {
+    return SENSITIVE_KEY_PATTERN$1.test(key.trim());
+}
+function redactRuntimeUrlSearchParams(params) {
+    let changed = false;
+    for (const key of [...params.keys()]) {
+        if (isSensitiveRuntimeNetworkKey(key)) {
+            params.set(key, '[redacted]');
+            changed = true;
+        }
+    }
+    return changed;
+}
+function redactRuntimeSensitivePairsInRawText(text) {
+    return text.replace(/([?&#]|^|[?&])([^=&#\s]+)=([^&#\s]*)/g, (full, prefix, key) => {
+        if (!isSensitiveRuntimeNetworkKey(key)) {
+            return full;
+        }
+        return `${prefix}${key}=[redacted]`;
+    });
+}
+function truncateText$1(value, maxChars) {
+    if (value.length <= maxChars) {
+        return value;
+    }
+    return `${value.slice(0, maxChars)}…(truncated, total=${value.length})`;
+}
+function isPlainObject$1(value) {
+    return Object.prototype.toString.call(value) === '[object Object]';
+}
+function isRecord$2(value) {
+    return typeof value === 'object' && value !== null;
+}
+
 const NETWORK_REQUEST_ALLOWED_KEYS = new Set([
     'url',
     'method',
@@ -4227,9 +4514,42 @@ const NETWORK_HTTP_METHODS = new Set([
     'HEAD',
     'OPTIONS',
 ]);
+/** 与 App Host heybox transport 能力对齐：不支持 multipart。 */
+const NETWORK_REQUEST_MULTIPART_UNSUPPORTED_MESSAGE = 'network.request 不支持 multipart/form-data。App Host 客户端代发仅支持 application/x-www-form-urlencoded（form）与 application/json；请将 data 编码为 form 字符串（例如 new URLSearchParams({...}).toString()）并设置 Content-Type: application/x-www-form-urlencoded。文件上传请使用专用上传能力，勿手写 multipart boundary。';
 /** network.request：校验桥接参数并委托平台适配层完成真实 HTTP 交换。 */
 async function requestMiniProgramRuntimeNetwork(payload, platformAdapter) {
-    return platformAdapter.network.request(readMiniProgramRuntimeNetworkRequest(payload));
+    let request;
+    try {
+        request = readMiniProgramRuntimeNetworkRequest(payload);
+    }
+    catch (error) {
+        logRuntimeNetworkFailure({
+            phase: 'validate',
+            payload,
+            error,
+        });
+        throw error;
+    }
+    try {
+        const response = await platformAdapter.network.request(request);
+        if (typeof response?.status === 'number' && (response.status < 200 || response.status >= 300)) {
+            // 非 2xx 仍走 bridge success payload；此处只补诊断日志，方便对照抓包与 SDK 侧异常。
+            logRuntimeNetworkFailure({
+                phase: 'http_status',
+                request,
+                response,
+            });
+        }
+        return response;
+    }
+    catch (error) {
+        logRuntimeNetworkFailure({
+            phase: 'adapter',
+            request,
+            error,
+        });
+        throw error;
+    }
 }
 function readMiniProgramRuntimeNetworkRequest(payload) {
     assertMiniProgramRuntimeRecord(payload, 'network.request 参数必须是对象');
@@ -4259,8 +4579,30 @@ function readMiniProgramRuntimeNetworkRequest(payload) {
     if (payload.withCredentials !== undefined) {
         request.withCredentials = readMiniProgramRuntimeBoolean(payload.withCredentials, 'network.request withCredentials 必须是布尔值');
     }
+    assertSupportedNetworkRequestShape(request);
     return request;
 }
+/**
+ * 拒绝 Host 客户端代发不支持的请求体形态，避免伪装成目标站 HTTP 500。
+ */
+function assertSupportedNetworkRequestShape(request) {
+    if (hasMultipartContentType(request.headers) || looksLikeMultipartBody(request.data)) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', NETWORK_REQUEST_MULTIPART_UNSUPPORTED_MESSAGE);
+    }
+}
+function hasMultipartContentType(headers) {
+    if (!headers) {
+        return false;
+    }
+    return Object.entries(headers).some(([key, value]) => key.trim().toLowerCase() === 'content-type' && value.toLowerCase().includes('multipart/form-data'));
+}
+function looksLikeMultipartBody(data) {
+    if (typeof data !== 'string') {
+        return false;
+    }
+    const trimmed = data.trimStart();
+    return trimmed.startsWith('--') && /content-disposition\s*:\s*form-data/i.test(data);
+}
 function assertNetworkAllowedKeys(payload) {
     const invalidKeys = Object.keys(payload).filter(key => !NETWORK_REQUEST_ALLOWED_KEYS.has(key));
     if (invalidKeys.length > 0) {
@@ -6683,6 +7025,221 @@ function isPlainRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
+/**
+ * network.request 诊断日志的纯脱敏工具。
+ *
+ * @remarks
+ * 放在 `core` 而非 `modules/network`：无错误类型依赖，供 SDK 错误文案、
+ * modules observability、devtools Mock Host / proxy 共用，并满足 boundary
+ *（devtools 不得直接 import runtime capability modules）。
+ */
+const DATA_PREVIEW_MAX_CHARS = 500;
+const SENSITIVE_HEADER_NAMES = new Set([
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+    'set-cookie',
+    'token',
+    'x-pkey',
+    'api-key',
+    'apikey',
+    'x-api-key',
+    'x-auth-token',
+    'x-access-token',
+    'session',
+    'session-id',
+    'jwt',
+    'refresh-token',
+    'x-csrf-token',
+]);
+/** 敏感字段名：header / query / body key 共用。 */
+const SENSITIVE_KEY_PATTERN = /(authorization|cookie|password|passwd|secret|token|pkey|private[_-]?key|access[_-]?key|client[_-]?secret|api[_-]?key|apikey|session|jwt|refresh[_-]?token|csrf)/i;
+/**
+ * 脱敏请求 URL：去掉 userinfo，并将 query / fragment 中的敏感参数值替换为 `[redacted]`。
+ */
+function sanitizeNetworkRequestUrl(url) {
+    if (!url) {
+        return url;
+    }
+    try {
+        const parsed = new URL(url);
+        parsed.username = '';
+        parsed.password = '';
+        redactUrlSearchParams(parsed.searchParams);
+        if (parsed.hash && parsed.hash.length > 1) {
+            const hashBody = parsed.hash.slice(1);
+            if (hashBody.includes('=')) {
+                const hashParams = new URLSearchParams(hashBody);
+                if (redactUrlSearchParams(hashParams)) {
+                    parsed.hash = hashParams.toString();
+                }
+            }
+        }
+        return parsed.toString();
+    }
+    catch {
+        return redactSensitivePairsInRawText(url);
+    }
+}
+/**
+ * 脱敏请求/响应头；敏感名（含 heybox 前缀）替换为 `[redacted]`。
+ */
+function sanitizeNetworkHeaders(headers) {
+    if (!headers) {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [
+        key,
+        isSensitiveNetworkHeaderName(key) ? '[redacted]' : value,
+    ]));
+}
+/**
+ * 预览请求/响应 data：递归脱敏敏感字段，截断长文本与大数组。
+ */
+function previewNetworkData(data) {
+    if (data === undefined) {
+        return undefined;
+    }
+    if (typeof data === 'string') {
+        return previewNetworkStringData(data);
+    }
+    if (typeof data === 'number' || typeof data === 'boolean' || data === null) {
+        return data;
+    }
+    try {
+        const sanitized = sanitizeNetworkDataValue(data);
+        const serialized = JSON.stringify(sanitized);
+        if (serialized === undefined) {
+            return '[unserializable]';
+        }
+        if (serialized.length <= DATA_PREVIEW_MAX_CHARS) {
+            return sanitized;
+        }
+        return truncateText(serialized, DATA_PREVIEW_MAX_CHARS);
+    }
+    catch {
+        return '[unserializable]';
+    }
+}
+/**
+ * 递归脱敏日志对象（payload / result）：敏感 key、headers、url 字段统一处理。
+ */
+function redactNetworkLogValue(value) {
+    if (Array.isArray(value)) {
+        return value.slice(0, 20).map(item => redactNetworkLogValue(item));
+    }
+    if (typeof value === 'string') {
+        if (looksLikeUrl(value)) {
+            return sanitizeNetworkRequestUrl(value);
+        }
+        return previewNetworkStringData(value);
+    }
+    if (typeof value === 'number' || typeof value === 'boolean' || value === null || value === undefined) {
+        return value;
+    }
+    if (!isPlainObject(value)) {
+        return previewNetworkData(value);
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => {
+        const normalized = key.trim().toLowerCase();
+        if (isSensitiveNetworkKey(key)) {
+            return [key, '[redacted]'];
+        }
+        if (normalized === 'headers' && isPlainObject(item)) {
+            return [
+                key,
+                sanitizeNetworkHeaders(Object.fromEntries(Object.entries(item).flatMap(([headerKey, headerValue]) => typeof headerValue === 'string' ? [[headerKey, headerValue]] : []))),
+            ];
+        }
+        if ((normalized === 'url' || normalized.endsWith('_url') || normalized.endsWith('url')) && typeof item === 'string') {
+            return [key, sanitizeNetworkRequestUrl(item)];
+        }
+        return [key, redactNetworkLogValue(item)];
+    }));
+}
+function isSensitiveNetworkHeaderName(headerName) {
+    const normalized = headerName.trim().toLowerCase();
+    return (SENSITIVE_HEADER_NAMES.has(normalized) ||
+        isSensitiveNetworkKey(normalized) ||
+        normalized.startsWith('x-heybox-') ||
+        normalized.startsWith('x-xhh-'));
+}
+function isSensitiveNetworkKey(key) {
+    return SENSITIVE_KEY_PATTERN.test(key.trim());
+}
+function previewNetworkStringData(data) {
+    const trimmed = data.trim();
+    if ((trimmed.startsWith('{') && trimmed.endsWith('}')) || (trimmed.startsWith('[') && trimmed.endsWith(']'))) {
+        try {
+            return previewNetworkData(JSON.parse(trimmed));
+        }
+        catch {
+            // fall through
+        }
+    }
+    if (trimmed.includes('=') && !trimmed.includes('\n') && trimmed.length <= DATA_PREVIEW_MAX_CHARS * 2) {
+        try {
+            const params = new URLSearchParams(trimmed);
+            if ([...params.keys()].length > 0) {
+                const redacted = Object.fromEntries([...params.entries()].map(([key, value]) => [
+                    key,
+                    isSensitiveNetworkKey(key) ? '[redacted]' : value,
+                ]));
+                return previewNetworkData(redacted);
+            }
+        }
+        catch {
+            // fall through
+        }
+    }
+    return truncateText(redactSensitivePairsInRawText(data), DATA_PREVIEW_MAX_CHARS);
+}
+function sanitizeNetworkDataValue(value) {
+    if (Array.isArray(value)) {
+        return value.slice(0, 20).map(item => sanitizeNetworkDataValue(item));
+    }
+    if (!isPlainObject(value)) {
+        if (typeof value === 'string') {
+            return truncateText(value, DATA_PREVIEW_MAX_CHARS);
+        }
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        isSensitiveNetworkKey(key) ? '[redacted]' : sanitizeNetworkDataValue(item),
+    ]));
+}
+function redactUrlSearchParams(params) {
+    let changed = false;
+    for (const key of [...params.keys()]) {
+        if (isSensitiveNetworkKey(key)) {
+            params.set(key, '[redacted]');
+            changed = true;
+        }
+    }
+    return changed;
+}
+function redactSensitivePairsInRawText(text) {
+    return text.replace(/([?&#]|^|[?&])([^=&#\s]+)=([^&#\s]*)/g, (full, prefix, key, value) => {
+        if (!isSensitiveNetworkKey(key)) {
+            return full;
+        }
+        return `${prefix}${key}=[redacted]`;
+    });
+}
+function looksLikeUrl(value) {
+    return /^https?:\/\//i.test(value.trim()) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value.trim());
+}
+function truncateText(value, maxChars) {
+    if (value.length <= maxChars) {
+        return value;
+    }
+    return `${value.slice(0, maxChars)}…(truncated, total=${value.length})`;
+}
+function isPlainObject(value) {
+    return Object.prototype.toString.call(value) === '[object Object]';
+}
+
 const NETWORK_PROXY_PATH = '/__hb_sdk_mock_network__';
 const MOCK_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
 const DEV_PERMISSIONS_PATH = '/__hb_sdk__/dev-permissions';
@@ -7021,7 +7578,23 @@ async function handleRequest(message) {
         const bridgeError = toMockBridgeError(error);
         postResponse(message, undefined, bridgeError);
         postEvent('error', bridgeError);
-        pushLog(message.method, { payload: message.payload, error: bridgeError });
+        if (message.method === NETWORK_REQUEST_METHOD) {
+            console.warn('[hb-sdk][mock-host][network.request]', 'bridge_error', {
+                payload: redactNetworkLogValue(message.payload),
+                error: bridgeError,
+            });
+        }
+        pushLog(message.method, {
+            ...(message.method === NETWORK_REQUEST_METHOD
+                ? {
+                    summary: 'bridge_error',
+                    payload: redactNetworkLogValue(message.payload),
+                }
+                : {
+                    payload: message.payload,
+                }),
+            error: bridgeError,
+        });
     }
 }
 function createRequestLogDetail(method, payload, result) {
@@ -7033,11 +7606,41 @@ function createRequestLogDetail(method, payload, result) {
             protocol: latestOpenAppPage?.options.protocol,
         };
     }
+    if (method === NETWORK_REQUEST_METHOD) {
+        return createNetworkRequestLogDetail(payload, result);
+    }
     return {
         payload,
         result,
     };
 }
+function createNetworkRequestLogDetail(payload, result) {
+    const requestUrl = isRecord(payload) && typeof payload.url === 'string' ? payload.url : '';
+    const sanitizedUrl = requestUrl ? sanitizeNetworkRequestUrl(requestUrl) : '';
+    const requestMethod = isRecord(payload) && typeof payload.method === 'string' ? payload.method.toUpperCase() : 'GET';
+    const status = isRecord(result) && typeof result.status === 'number' ? result.status : undefined;
+    const statusText = isRecord(result) && typeof result.statusText === 'string' ? result.statusText : undefined;
+    const ok = typeof status === 'number' ? status >= 200 && status < 300 : undefined;
+    const summary = [
+        `${requestMethod} ${sanitizedUrl || '(missing url)'}`,
+        status === undefined ? 'status=?' : `status=${status}`,
+        ok === false ? 'FAILED' : ok === true ? 'OK' : 'UNKNOWN',
+    ].join(' · ');
+    if (ok === false) {
+        console.warn('[hb-sdk][mock-host][network.request]', summary, {
+            payload: redactNetworkLogValue(payload),
+            result: redactNetworkLogValue(result),
+        });
+    }
+    return {
+        summary,
+        ok,
+        status,
+        statusText,
+        payload: redactNetworkLogValue(payload),
+        result: redactNetworkLogValue(result),
+    };
+}
 async function requestNetwork(config) {
     const response = await fetch(NETWORK_PROXY_PATH, {
         method: 'POST',