@heybox/hb-sdk 0.6.8-alpha.2 → 0.6.9-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## 0.6.9-alpha.0
+
+### SDK
+
+- `@heybox/hb-sdk/miniapp-publish` 提供跨 CLI 和开放平台复用的整包 framing、严格路径校验与上传 session 文件映射工具。
+
+### Build and CLI
+
+- `hb-sdk remote deploy` 改为按整包签名创建或恢复服务端上传会话；同一构建仅上传服务端尚未确认的文件，不再维护本地上传会话缓存。
+- 上传产物使用 session 隔离目录，同 key 重传可安全覆盖；上传回调按批次确认，重新执行 deploy 可依据服务端回执恢复上传。
+- 同一设备的普通 deploy 按 API 环境、小程序和版本使用本地文件锁减少重复上传；锁目录不可用时降级为无锁执行，不影响服务端上传会话的正确性。
+- CLI 不再自行拼接版本目录 key，当前小程序产物上传只使用服务端上传 session 返回的文件映射。
+- 上传协议 hard cut 到 `0.6.8`；`0.6.7` 及更早 CLI 不再支持部署小程序构建产物，需升级后使用上传 session。
+
+## 0.6.8
+
+### SDK
+
+- `network.request` 增加脱敏诊断日志和更完整的错误上下文，覆盖 HTTP 非 2xx、无效响应及 bridge/runtime 错误；业务应继续通过错误类型与结构化字段判断失败。
+- `network.request` 在 SDK、Mock Host 和 Mock 网络代理中统一拒绝 `multipart/form-data`，并提示改用 form-urlencoded、JSON 或专用上传能力。
+
+### Build and CLI
+
+- `hb-sdk dev` 与 `hb-sdk remote deploy` 在远端已启用 `network.request` 且 `useOfficialDomain=true` 时跳过平台 CSP；普通 build、匿名或异常权限快照继续 fail closed 注入。
+
+### Runtime
+
+- Runtime 为 `network.request` 参数校验、adapter 失败与非 2xx 响应增加脱敏诊断，并同步拒绝 multipart 请求；非 2xx 响应继续保持 bridge success 语义。
+- Runtime 默认分享链接保留当前 Host `h_src`，并在小程序加载成功时上报 `h_src` 与 `h_src_parent`，不改变 SDK 公共 API。
+
+### Docs / Agent Skill
+
+- 精简外部开发者 README 并拆分详细参考内容；npm 包显式包含 README 与共同 Changelog。
+- 同步公开 Agent Skill references、SDK compatibility、版本元数据与 integrity 至 0.6.8。
+
+## 0.6.8-alpha.4
+
+### Build and CLI
+
+- 恢复远端官方域名网络权限项目的 CSP 兼容行为：`hb-sdk dev` 与 `hb-sdk remote deploy` 在 `network.request.status=enabled` 且 `useOfficialDomain=true` 时跳过平台 CSP，其他场景继续 fail closed 注入。
+
+## 0.6.8-alpha.3
+
+### SDK
+
+- `network.request` 失败时输出脱敏诊断日志，覆盖 HTTP 非 2xx、无效响应与 bridge/runtime 错误；`HbMiniProgramNetworkError` 文案补充 statusText/method/url（message 为诊断字符串，业务请用 `instanceof` + `status`/`data` 等字段，勿精确匹配全文） (@heybox/hb-sdk).
+- 诊断日志与错误文案统一脱敏：敏感 header/query/body 字段、URL userinfo；Mock Host / mock network proxy 复用同一套脱敏原语 (@heybox/hb-sdk).
+- 日志前缀：`[hb-sdk][network.request]` / `[hb-sdk][mock-host][network.request]` / `[hb-sdk][mock-network]` (@heybox/hb-sdk).
+- `network.request` 提前拒绝 `multipart/form-data`（含手写 boundary body），以 `INVALID_PARAMS` 给出可操作中文说明；Mock 网络代理同步拒绝，避免本地 fetch 能通、App Host heybox 代发失败 (@heybox/hb-sdk).
+- `HbMiniProgramNetworkError` 识别宿主伪装的 `network_error` / `unsupported-request-shape` 失败，在 message 中标明“非目标站 HTTP 状态”并补充 form/json 用法提示 (@heybox/hb-sdk).
+
+### Runtime
+
+- Runtime 侧记录 `network.request` 参数校验失败、adapter 失败与非 2xx 诊断日志（前缀 `[hb-sdk-runtime][network.request]`；非 2xx 仍保持 bridge success） (@heybox/hb-sdk-runtime).
+- Runtime 参数校验同步拒绝 multipart，避免落到 heybox transport 后变成含糊的 500 `network_error` (@heybox/hb-sdk-runtime).
+
 ## 0.6.8-alpha.2
 
 ### Docs / Agent Skill

package/README.md

@@ -97,6 +97,8 @@ try {
 - `auth.login()` 只能由明确的用户操作触发，不要在页面初始化时自动登录。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
 - 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。
+- `network.request` 不支持 `multipart/form-data`；App Host 仅支持 form（`application/x-www-form-urlencoded`）与 JSON。表单请用 `URLSearchParams#toString()` 作为 `data`，文件上传请走专用上传能力。
+- 仅当远端已启用 `network.request` 且 `useOfficialDomain=true` 时，`hb-sdk dev` 与 `hb-sdk remote deploy` 构建才会跳过平台 CSP；其他构建继续注入平台 CSP。
 - 构建必须启用 `miniappManifest()`，推荐统一使用 `hb-sdk build`。
 
 ## CLI 主流程

package/dist/cli-chunks/{build-CglqyB9Z.cjs → build-9hbhrRbU.cjs}

@@ -3,10 +3,11 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var index$1 = require('./index-v4-6fbXX.cjs');
-var runtimeGate = require('./runtime-gate-DfMJQGH9.cjs');
-var index = require('./index-paN77avR.cjs');
-var projectVite = require('./project-vite-vHezGsg7.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DKrhgVM3.cjs');
+var runtimeGate = require('./runtime-gate-BWlU-R4h.cjs');
+var index = require('./index-DofTxdoX.cjs');
+var projectVite = require('./project-vite-CfD8Bp1K.cjs');
+require('node:async_hooks');
 require('node:module');
 require('path');
 require('os');
@@ -25,25 +26,28 @@ async function runBuildCommand(_options = {}, runtime = {}) {
     const distDir = path.join(projectRoot, 'dist');
     const env = runtime.env ?? process.env;
     const mode = env.HB_SDK_ENV?.trim() || undefined;
+    const skipPlatformCsp = runtimePermissionEnv.shouldSkipMiniappPlatformCspFromEnv(env);
     await fs.rm(distDir, { force: true, recursive: true });
     try {
-        const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), {
-            successText: '已加载项目 Vite',
-        });
-        await logger.task('正在构建小程序', () => vite.build({
-            root: projectRoot,
-            ...(mode ? { mode } : {}),
-            plugins: [createFixedBuildOutputPlugin(projectRoot)],
-            build: {
-                outDir: 'dist',
-                emptyOutDir: true,
-                watch: null,
-                write: true,
-            },
-        }), { successText: 'Vite 构建完成' });
-        const result = await validateBuildOutput(projectRoot, logger);
-        logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
-        return result;
+        return await runtimePermissionEnv.withMiniappPlatformCspEnv(skipPlatformCsp, async () => {
+            const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), {
+                successText: '已加载项目 Vite',
+            });
+            await logger.task('正在构建小程序', () => vite.build({
+                root: projectRoot,
+                ...(mode ? { mode } : {}),
+                plugins: [createFixedBuildOutputPlugin(projectRoot)],
+                build: {
+                    outDir: 'dist',
+                    emptyOutDir: true,
+                    watch: null,
+                    write: true,
+                },
+            }), { successText: 'Vite 构建完成' });
+            const result = await validateBuildOutput(projectRoot, logger);
+            logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
+            return result;
+        }, env);
     }
     catch (error) {
         await fs.rm(distDir, { force: true, recursive: true });
@@ -89,8 +93,8 @@ async function validateBuildOutput(projectRoot, logger) {
     }
     const { sdkVersion, version } = runtimeGate.validateMiniappManifestForDeploy(manifest);
     const allFiles = await walkDistFiles(distDir);
-    const uploadFiles = allFiles.filter((file) => index$1.shouldUploadDistFile(file.relativePath));
-    const sizeError = index$1.validateUploadTotalSize(uploadFiles);
+    const uploadFiles = allFiles.filter((file) => runtimePermissionEnv.shouldUploadDistFile(file.relativePath));
+    const sizeError = runtimePermissionEnv.validateUploadTotalSize(uploadFiles);
     if (sizeError) {
         throw new Error(sizeError.replace('重新 deploy', '重新 build'));
     }
@@ -110,12 +114,12 @@ async function walkDistFiles(distDir) {
         const entries = await fs.readdir(absDir, { withFileTypes: true });
         for (const entry of entries) {
             const absPath = path.join(absDir, entry.name);
-            const relPath = index$1.normalizeRelativePath(relDir ? `${relDir}/${entry.name}` : entry.name);
+            const relPath = runtimePermissionEnv.normalizeRelativePath(relDir ? `${relDir}/${entry.name}` : entry.name);
             const link = await fs.lstat(absPath);
             if (link.isSymbolicLink()) {
                 throw new Error(`dist 目录包含 symlink，拒绝处理：${relPath}`);
             }
-            if (index$1.relativePathContainsNodeModulesSegment(relPath)) {
+            if (runtimePermissionEnv.relativePathContainsNodeModulesSegment(relPath)) {
                 throw new Error(`dist 目录含 node_modules：${relPath}`);
             }
             if (entry.isDirectory()) {

package/dist/cli-chunks/{context-CP7W_8aR.cjs → context-7rmakzS_.cjs}

@@ -1,11 +1,106 @@
 'use strict';
 
-var session = require('./session-CiQplems.cjs');
-var index = require('./index-v4-6fbXX.cjs');
+var session = require('./session-D5u3XzHN.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DKrhgVM3.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
 
+const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
+/**
+ * 判断 permission key 是否由 Runtime 权限快照管理。
+ *
+ * @param key 待判断的 permission key。
+ * @returns 该 key 需要读取 Runtime 权限快照时返回 `true`。
+ */
+function isManagedMiniProgramRuntimePermissionKey(key) {
+    return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
+}
+/**
+ * 解析服务端权限快照；格式不完整时整份快照失效并 fail closed。
+ *
+ * @param snapshot 待校验的服务端权限快照。
+ * @returns 解析状态和通过校验的受管权限。
+ */
+function parseMiniProgramRuntimePermissions(snapshot) {
+    if (!isRecord(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
+        return { valid: false, permissions: {} };
+    }
+    if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
+        return { valid: false, permissions: {} };
+    }
+    const seenKeys = new Set();
+    const permissions = {};
+    for (const rawEntry of snapshot.entries) {
+        if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
+            return { valid: false, permissions: {} };
+        }
+        const key = rawEntry.key.trim();
+        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
+            return { valid: false, permissions: {} };
+        }
+        seenKeys.add(key);
+        if (!isManagedMiniProgramRuntimePermissionKey(key)) {
+            continue;
+        }
+        if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
+            return { valid: false, permissions: {} };
+        }
+        permissions[key] = {
+            key,
+            status: rawEntry.status,
+            config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
+        };
+    }
+    return { valid: true, permissions };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function shouldSkipMiniappPlatformCsp(runtimePermissions) {
+    const parsed = parseMiniProgramRuntimePermissions(runtimePermissions);
+    const networkRequest = parsed.permissions['network.request'];
+    return parsed.valid && networkRequest?.status === 'enabled' && networkRequest.config.useOfficialDomain === true;
+}
+const DEFAULT_PERMISSION_STATE = {
+    networkRequest: {
+        status: 'disabled',
+        useOfficialDomain: false,
+    },
+};
+function createMiniProgramMockPermissionState(context) {
+    const parsed = parseMiniProgramRuntimePermissions(context.runtimePermissions);
+    const networkRequest = parsed.permissions['network.request'];
+    return parsed.valid && networkRequest
+        ? {
+            networkRequest: {
+                status: networkRequest.status,
+                useOfficialDomain: networkRequest.config.useOfficialDomain === true,
+            },
+        }
+        : cloneDefaultPermissionState();
+}
+function createMiniProgramMockRuntimePermissions(state) {
+    return {
+        schema_version: 1,
+        entries: [
+            {
+                key: 'network.request',
+                status: state.networkRequest.status,
+                config: {
+                    useOfficialDomain: state.networkRequest.useOfficialDomain,
+                },
+            },
+        ],
+    };
+}
+function cloneDefaultPermissionState() {
+    return {
+        networkRequest: { ...DEFAULT_PERMISSION_STATE.networkRequest },
+    };
+}
+
 function createRemoteApiClient(options) {
     return {
         listDeveloperEntities: () => listDeveloperEntities(options),
@@ -32,74 +127,74 @@ function createRemoteApiClient(options) {
     };
 }
 async function listDeveloperEntities(runtime) {
-    return remoteGet(index.DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
+    return remoteGet(runtimePermissionEnv.DEVELOPER_ENTITY_LIST_API_PATH, {}, runtime);
 }
 async function switchDeveloperEntity(options, runtime) {
-    return (await remotePostForm(index.DEVELOPER_ENTITY_SWITCH_API_PATH, options, runtime, { requireResult: false })) ?? {};
+    return (await remotePostForm(runtimePermissionEnv.DEVELOPER_ENTITY_SWITCH_API_PATH, options, runtime, { requireResult: false })) ?? {};
 }
 async function getDeveloperAccessStatus(runtime) {
-    return remoteGet(index.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, {}, runtime);
+    return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_ACCESS_STATUS_API_PATH, {}, runtime);
 }
 async function listUserMiniprograms(options, runtime) {
-    return remoteGet(index.LIST_USER_MINIPROGRAM_API_PATH, options, runtime);
+    return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_API_PATH, options, runtime);
 }
 async function createUserMiniprogram(runtime) {
-    return remotePostForm(index.CREATE_USER_MINIPROGRAM_API_PATH, {}, runtime);
+    return remotePostForm(runtimePermissionEnv.CREATE_USER_MINIPROGRAM_API_PATH, {}, runtime);
 }
 async function getUserMiniprogramDetail(options, runtime) {
-    return remoteGet(index.DETAIL_USER_MINIPROGRAM_API_PATH, options, runtime);
+    return remoteGet(runtimePermissionEnv.DETAIL_USER_MINIPROGRAM_API_PATH, options, runtime);
 }
 async function getPreviewAllowlist(options, runtime) {
-    return remoteGet(index.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
+    return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
 }
 async function updatePreviewAllowlist(options, runtime) {
-    return remotePostForm(index.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH, options, runtime);
 }
 async function createUserMiniprogramLeaderboard(options, runtime) {
-    return remotePostForm(index.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.CREATE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
 }
 async function getUserMiniprogramLeaderboard(options, runtime) {
-    return remoteGet(index.DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
+    return remoteGet(runtimePermissionEnv.DETAIL_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
 }
 async function listUserMiniprogramLeaderboards(options, runtime) {
-    return remoteGet(index.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
+    return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime);
 }
 async function deleteUserMiniprogramLeaderboard(options, runtime) {
-    return (await remotePostForm(index.DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime, { requireResult: false })) ?? {};
+    return ((await remotePostForm(runtimePermissionEnv.DELETE_USER_MINIPROGRAM_LEADERBOARD_API_PATH, options, runtime, { requireResult: false })) ?? {});
 }
 async function precheckUserMiniprogramVersion(options, runtime) {
-    return remotePostForm(index.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
 }
 async function submitUserMiniprogramAudit(options, runtime) {
     const form = { ...options };
     if (form.manifest && typeof form.manifest !== 'string') {
         form.manifest = JSON.stringify(form.manifest);
     }
-    return remotePostForm(index.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, form, runtime);
+    return remotePostForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH, form, runtime);
 }
 async function getVersionPreviewInfo(options, runtime) {
-    return remoteGet(index.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, {
+    return remoteGet(runtimePermissionEnv.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH, {
         mini_program_id: options.mini_program_id,
         preview_version: options.version,
     }, runtime);
 }
 async function withdrawUserMiniprogramVersion(options, runtime) {
-    return remotePostForm(index.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
 }
 async function releaseUserMiniprogramVersion(options, runtime) {
-    return remotePostForm(index.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
 }
 async function takeDownUserMiniprogram(options, runtime) {
-    return remotePostForm(index.TAKE_DOWN_USER_MINIPROGRAM_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.TAKE_DOWN_USER_MINIPROGRAM_API_PATH, options, runtime);
 }
 async function reopenUserMiniprogram(options, runtime) {
-    return remotePostForm(index.REOPEN_USER_MINIPROGRAM_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.REOPEN_USER_MINIPROGRAM_API_PATH, options, runtime);
 }
 async function updateSquareDisplay(options, runtime) {
-    return remotePostForm(index.UPDATE_SQUARE_DISPLAY_API_PATH, options, runtime);
+    return remotePostForm(runtimePermissionEnv.UPDATE_SQUARE_DISPLAY_API_PATH, options, runtime);
 }
 async function listUserMiniprogramVersions(options, runtime) {
-    return remoteGet(index.LIST_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
+    return remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_VERSION_API_PATH, options, runtime);
 }
 async function remoteGet(path, query, runtime) {
     const pathWithQuery = createPathWithQuery(path, query);
@@ -302,10 +397,14 @@ function isTruthyEnvFlag(value) {
 }
 
 exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
+exports.createMiniProgramMockPermissionState = createMiniProgramMockPermissionState;
+exports.createMiniProgramMockRuntimePermissions = createMiniProgramMockRuntimePermissions;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
 exports.getBoundMiniProgram = getBoundMiniProgram;
+exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;
 exports.readBoundMiniProgramId = readBoundMiniProgramId;
 exports.readBoundMiniProgramIdFromPackageJson = readBoundMiniProgramIdFromPackageJson;
 exports.readMiniProgramProjectPackage = readMiniProgramProjectPackage;
 exports.resolveRemoteEnvironment = resolveRemoteEnvironment;
+exports.shouldSkipMiniappPlatformCsp = shouldSkipMiniappPlatformCsp;
 exports.writeBoundMiniProgramId = writeBoundMiniProgramId;

package/dist/cli-chunks/{create-DldsTIVt.cjs → create-BkX4rtRP.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-paN77avR.cjs');
+var index = require('./index-DofTxdoX.cjs');
 require('node:module');
 require('os');
 require('readline');