@heybox/hb-sdk 0.7.3-alpha.2 → 0.7.4-alpha.1

package/dist/protocol.esm.js

@@ -1,291 +1,30 @@
-/** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
-const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
-/** 小程序沙盒通信协议版本。 */
-const MINI_PROGRAM_MESSAGE_VERSION = 2;
-/** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
-const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
-/** SDK 初始化时发给父容器的握手方法名。 */
-const SDK_HANDSHAKE_METHOD = 'sdk.handshake';
-/** Runtime 主动探测 SDK 当前文档地址的内部方法名。 */
-const RUNTIME_LOCATION_PROBE_METHOD = 'runtime.location.probe';
-/** SDK 向 Runtime 报告当前文档地址的内部方法名。 */
-const SDK_LOCATION_REPORT_METHOD = 'sdk.location.report';
-/** SDK 向 Runtime 报告 CSP 违规的内部方法名。 */
-const SDK_CSP_VIOLATION_METHOD = 'sdk.csp.violation';
-
-/**
- * 判断未知数据是否符合小程序 bridge 消息信封。
- *
- * @param value 待判断的未知数据。
- * @returns 当数据满足小程序 bridge 消息基础结构时返回 `true`。
- */
-function isMiniProgramBridgeMessage(value) {
-    if (!value || typeof value !== 'object') {
-        return false;
-    }
-    const message = value;
-    return (message.namespace === MINI_PROGRAM_MESSAGE_NAMESPACE &&
-        (message.version === 1 || message.version === 2) &&
-        typeof message.nonce === 'string' &&
-        typeof message.type === 'string');
-}
-
-function readBrowserEnvironment() {
-    try {
-        return {
-            activeElement: globalThis.document?.activeElement ?? null,
-            userActivation: globalThis.navigator?.userActivation,
-        };
-    }
-    catch {
-        return { activeElement: null };
-    }
-}
-/** 按当前浏览器消息、用户激活和目标 iframe 焦点生成请求级可信手势快照。 */
-function computeTrustedIframeUserGesture(event, iframe, environment = readBrowserEnvironment()) {
-    return (event.isTrusted === true
-        && environment.userActivation?.isActive === true
-        && environment.activeElement === iframe);
-}
-
-const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
-/**
- * 判断 permission key 是否由 Runtime 权限快照管理。
- *
- * @param key 待判断的 permission key。
- * @returns 该 key 需要读取 Runtime 权限快照时返回 `true`。
- */
-function isManagedMiniProgramRuntimePermissionKey(key) {
-    return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
-}
-/**
- * 解析服务端权限快照；格式不完整时整份快照失效并 fail closed。
- *
- * @param snapshot 待校验的服务端权限快照。
- * @returns 解析状态和通过校验的受管权限。
- */
-function parseMiniProgramRuntimePermissions(snapshot) {
-    if (!isRecord(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
-        return { valid: false, permissions: {} };
-    }
-    if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
-        return { valid: false, permissions: {} };
-    }
-    const seenKeys = new Set();
-    const permissions = {};
-    for (const rawEntry of snapshot.entries) {
-        if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
-            return { valid: false, permissions: {} };
-        }
-        const key = rawEntry.key.trim();
-        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
-            return { valid: false, permissions: {} };
-        }
-        seenKeys.add(key);
-        if (!isManagedMiniProgramRuntimePermissionKey(key)) {
-            continue;
-        }
-        if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
-            return { valid: false, permissions: {} };
-        }
-        permissions[key] = {
-            key,
-            status: rawEntry.status,
-            config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
-        };
-    }
-    return { valid: true, permissions };
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-const OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS = [
-    'xiaoheihe.cn',
-    'max-c.com',
-    'debugmode.cn',
-    'maxjia.com',
-];
-/** Runtime / Host 在 `network.request` 分发前拒绝的小程序服务端私有路径前缀。 */
-const MINI_PROGRAM_NETWORK_PROTECTED_PATHS = [
-    '/user_miniprogram/runtime/auth',
-    '/user_miniprogram/openapi/v1',
-];
-const NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS = 4;
-/** 使用 URL 解析后的 hostname 判断黑盒官方根域及其子域。 */
-function isOfficialMiniProgramNetworkUrl(value) {
-    try {
-        const url = new URL(value);
-        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-            return false;
-        }
-        const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
-        return OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * 规范化并判断 pathname 是否命中 Runtime Auth / OpenAPI 保护前缀。
- * 解码失败或仍可继续解码时视为不安全路径。
- */
-function isProtectedMiniProgramNetworkPath(pathname) {
-    const normalized = normalizeMiniProgramNetworkPathname(pathname);
-    if (normalized === null) {
-        return true;
-    }
-    return MINI_PROGRAM_NETWORK_PROTECTED_PATHS.some(prefix => normalized === prefix || normalized.startsWith(`${prefix}/`));
-}
-function normalizeMiniProgramNetworkPathname(pathname) {
-    let decoded = pathname;
-    for (let round = 0; round < NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS; round += 1) {
-        let next;
-        try {
-            next = decodeURIComponent(decoded);
-        }
-        catch {
-            return null;
-        }
-        if (next === decoded) {
-            return normalizeDecodedNetworkPathname(decoded);
-        }
-        decoded = next;
-    }
-    try {
-        if (decodeURIComponent(decoded) !== decoded) {
-            return null;
-        }
-    }
-    catch {
-        return null;
-    }
-    return normalizeDecodedNetworkPathname(decoded);
-}
-function normalizeDecodedNetworkPathname(decoded) {
-    const segments = [];
-    for (const segment of decoded.replace(/\\/g, '/').split('/')) {
-        if (!segment || segment === '.') {
-            continue;
-        }
-        if (segment === '..') {
-            segments.pop();
-            continue;
-        }
-        segments.push(segment);
-    }
-    return `/${segments.join('/')}`;
-}
-
-/**
- * 登录授权能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const AUTH_LOGIN_METHOD = 'auth.login';
-/** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
 const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
-/** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
 const USER_GET_STEAM_GAME_LIST_METHOD = 'user.getSteamGameList';
-/**
- * 展示分享面板能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const SHARE_SHOW_SHARE_MENU_METHOD = 'share.showShareMenu';
-/**
- * 截图分享能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const SHARE_SCREENSHOT_METHOD = 'share.screenshot';
-/**
- * 视口窗口信息能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const VIEWPORT_GET_WINDOW_INFO_METHOD = 'viewport.getWindowInfo';
-/**
- * 设置导航栏样式能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD = 'viewport.setNavigationBarStyle';
-/**
- * 读取小程序隔离 storage 能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const STORAGE_GET_STORAGE_METHOD = 'storage.getStorage';
-/**
- * 写入小程序隔离 storage 能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const STORAGE_SET_STORAGE_METHOD = 'storage.setStorage';
-/**
- * 发起网络请求能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
- */
 const NETWORK_REQUEST_METHOD = 'network.request';
-/** 展示 toast 能力方法名。 */
 const UI_SHOW_TOAST_METHOD = 'ui.showToast';
-/** 展示全局 loading 能力方法名。 */
 const UI_SHOW_LOADING_METHOD = 'ui.showLoading';
-/** 隐藏全局 loading 能力方法名。 */
 const UI_HIDE_LOADING_METHOD = 'ui.hideLoading';
-/** 震动反馈能力方法名。 */
 const DEVICE_VIBRATE_METHOD = 'device.vibrate';
-/** 写入文本剪贴板能力方法名。 */
 const DEVICE_SET_CLIPBOARD_METHOD = 'device.setClipboard';
-/** 关闭当前小程序容器能力方法名。 */
 const NAVIGATION_CLOSE_METHOD = 'navigation.close';
-/** 重载当前小程序容器能力方法名。 */
 const NAVIGATION_RELOAD_METHOD = 'navigation.reload';
-/** 打开黑盒 App 页面能力方法名。 */
 const NAVIGATION_OPEN_APP_PAGE_METHOD = 'navigation.openAppPage';
-/** 提交当前用户排行榜分数能力方法名。 */
 const CLOUD_LEADERBOARD_SUBMIT_METHOD = 'cloud.leaderboard.submit';
-/** 读取排行榜列表能力方法名。 */
 const CLOUD_LEADERBOARD_GET_LIST_METHOD = 'cloud.leaderboard.getList';
-/** 读取当前用户排行榜记录能力方法名。 */
 const CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.getCurrentUserEntry';
-/** 删除当前用户排行榜记录能力方法名。 */
 const CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.deleteCurrentUserEntry';
-/** 读取排行榜基础信息能力方法名。 */
 const CLOUD_LEADERBOARD_GET_INFO_METHOD = 'cloud.leaderboard.getInfo';
-/**
- * 小程序开放能力目录。
- *
- * @remarks
- * 新增 bridge method 时应先更新这里，再分别补齐 SDK 模块、runtime handler 与测试。
- */
 const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
-    {
-        method: AUTH_LOGIN_METHOD,
-        module: 'auth',
-        capability: AUTH_LOGIN_METHOD,
-        permission: 'auth.login',
-        risk: 'medium',
-    },
-    {
-        method: USER_GET_INFO_METHOD,
-        module: 'user',
-        capability: USER_GET_INFO_METHOD,
-        permission: 'user.getInfo',
-        risk: 'medium',
-    },
+    { method: AUTH_LOGIN_METHOD, module: 'auth', capability: AUTH_LOGIN_METHOD, permission: 'auth.login', risk: 'medium' },
+    { method: USER_GET_INFO_METHOD, module: 'user', capability: USER_GET_INFO_METHOD, permission: 'user.getInfo', risk: 'medium' },
     {
         method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
@@ -300,20 +39,8 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'user.platformAccount.steam',
         risk: 'high',
     },
-    {
-        method: SHARE_SHOW_SHARE_MENU_METHOD,
-        module: 'share',
-        capability: SHARE_SHOW_SHARE_MENU_METHOD,
-        permission: 'share.basic',
-        risk: 'low',
-    },
-    {
-        method: SHARE_SCREENSHOT_METHOD,
-        module: 'share',
-        capability: SHARE_SCREENSHOT_METHOD,
-        permission: 'share.screenshot',
-        risk: 'medium',
-    },
+    { method: SHARE_SHOW_SHARE_MENU_METHOD, module: 'share', capability: SHARE_SHOW_SHARE_MENU_METHOD, permission: 'share.basic', risk: 'low' },
+    { method: SHARE_SCREENSHOT_METHOD, module: 'share', capability: SHARE_SCREENSHOT_METHOD, permission: 'share.screenshot', risk: 'medium' },
     {
         method: VIEWPORT_GET_WINDOW_INFO_METHOD,
         module: 'viewport',
@@ -328,55 +55,13 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'viewport.navigationBarStyle',
         risk: 'low',
     },
-    {
-        method: STORAGE_GET_STORAGE_METHOD,
-        module: 'storage',
-        capability: STORAGE_GET_STORAGE_METHOD,
-        permission: 'storage.read',
-        risk: 'low',
-    },
-    {
-        method: STORAGE_SET_STORAGE_METHOD,
-        module: 'storage',
-        capability: STORAGE_SET_STORAGE_METHOD,
-        permission: 'storage.write',
-        risk: 'medium',
-    },
-    {
-        method: NETWORK_REQUEST_METHOD,
-        module: 'network',
-        capability: NETWORK_REQUEST_METHOD,
-        permission: 'network.request',
-        risk: 'high',
-    },
-    {
-        method: UI_SHOW_TOAST_METHOD,
-        module: 'ui',
-        capability: UI_SHOW_TOAST_METHOD,
-        permission: 'ui.toast',
-        risk: 'low',
-    },
-    {
-        method: UI_SHOW_LOADING_METHOD,
-        module: 'ui',
-        capability: UI_SHOW_LOADING_METHOD,
-        permission: 'ui.loading',
-        risk: 'low',
-    },
-    {
-        method: UI_HIDE_LOADING_METHOD,
-        module: 'ui',
-        capability: UI_HIDE_LOADING_METHOD,
-        permission: 'ui.loading',
-        risk: 'low',
-    },
-    {
-        method: DEVICE_VIBRATE_METHOD,
-        module: 'device',
-        capability: DEVICE_VIBRATE_METHOD,
-        permission: 'device.vibrate',
-        risk: 'low',
-    },
+    { method: STORAGE_GET_STORAGE_METHOD, module: 'storage', capability: STORAGE_GET_STORAGE_METHOD, permission: 'storage.read', risk: 'low' },
+    { method: STORAGE_SET_STORAGE_METHOD, module: 'storage', capability: STORAGE_SET_STORAGE_METHOD, permission: 'storage.write', risk: 'medium' },
+    { method: NETWORK_REQUEST_METHOD, module: 'network', capability: NETWORK_REQUEST_METHOD, permission: 'network.request', risk: 'high' },
+    { method: UI_SHOW_TOAST_METHOD, module: 'ui', capability: UI_SHOW_TOAST_METHOD, permission: 'ui.toast', risk: 'low' },
+    { method: UI_SHOW_LOADING_METHOD, module: 'ui', capability: UI_SHOW_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
+    { method: UI_HIDE_LOADING_METHOD, module: 'ui', capability: UI_HIDE_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
+    { method: DEVICE_VIBRATE_METHOD, module: 'device', capability: DEVICE_VIBRATE_METHOD, permission: 'device.vibrate', risk: 'low' },
     {
         method: DEVICE_SET_CLIPBOARD_METHOD,
         module: 'device',
@@ -384,20 +69,8 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'device.clipboard.write',
         risk: 'medium',
     },
-    {
-        method: NAVIGATION_CLOSE_METHOD,
-        module: 'navigation',
-        capability: NAVIGATION_CLOSE_METHOD,
-        permission: 'navigation.close',
-        risk: 'medium',
-    },
-    {
-        method: NAVIGATION_RELOAD_METHOD,
-        module: 'navigation',
-        capability: NAVIGATION_RELOAD_METHOD,
-        permission: 'navigation.reload',
-        risk: 'medium',
-    },
+    { method: NAVIGATION_CLOSE_METHOD, module: 'navigation', capability: NAVIGATION_CLOSE_METHOD, permission: 'navigation.close', risk: 'medium' },
+    { method: NAVIGATION_RELOAD_METHOD, module: 'navigation', capability: NAVIGATION_RELOAD_METHOD, permission: 'navigation.reload', risk: 'medium' },
     {
         method: NAVIGATION_OPEN_APP_PAGE_METHOD,
         module: 'navigation',
@@ -442,7 +115,64 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
     },
 ];
 
-/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
+const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
+const SDK_HANDSHAKE_METHOD = 'sdk.handshake';
+const RUNTIME_LOCATION_PROBE_METHOD = 'runtime.location.probe';
+const SDK_LOCATION_REPORT_METHOD = 'sdk.location.report';
+const SDK_CSP_VIOLATION_METHOD = 'sdk.csp.violation';
+
+function isMiniProgramBridgeMessage(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const message = value;
+    return (message.namespace === MINI_PROGRAM_MESSAGE_NAMESPACE &&
+        (message.version === 1 || message.version === 2) &&
+        typeof message.nonce === 'string' &&
+        typeof message.type === 'string');
+}
+
+/** 当前用户信息与登录能力支持的完整 scope 目录。 */
 const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
 
-export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_NETWORK_PROTECTED_PATHS, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_INFO_AUTHORIZATION_SCOPES, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, computeTrustedIframeUserGesture, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isOfficialMiniProgramNetworkUrl, isProtectedMiniProgramNetworkPath, normalizeMiniProgramNetworkPathname, parseMiniProgramRuntimePermissions };
+const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
+function isManagedMiniProgramRuntimePermissionKey(key) {
+    return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
+}
+function parseMiniProgramRuntimePermissions(snapshot) {
+    if (!isRecord(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
+        return { valid: false, permissions: {} };
+    }
+    if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
+        return { valid: false, permissions: {} };
+    }
+    const seenKeys = new Set();
+    const permissions = {};
+    for (const rawEntry of snapshot.entries) {
+        if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
+            return { valid: false, permissions: {} };
+        }
+        const key = rawEntry.key.trim();
+        if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
+            return { valid: false, permissions: {} };
+        }
+        seenKeys.add(key);
+        if (!isManagedMiniProgramRuntimePermissionKey(key))
+            continue;
+        if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
+            return { valid: false, permissions: {} };
+        }
+        permissions[key] = {
+            key,
+            status: rawEntry.status,
+            config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
+        };
+    }
+    return { valid: true, permissions };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_INFO_AUTHORIZATION_SCOPES, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, parseMiniProgramRuntimePermissions };

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3-alpha.2';
+    : '0.7.4-alpha.1';
 
 var re = {exports: {}};
 
@@ -11301,11 +11301,8 @@ function parse(html, options) {
     return Parser.parse(html, options);
 }
 
-/** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
-/** 小程序沙盒通信协议版本。 */
 const MINI_PROGRAM_MESSAGE_VERSION = 2;
-/** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 
 const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';

package/dist/vite.esm.js

@@ -5,7 +5,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3-alpha.2';
+    : '0.7.4-alpha.1';
 
 var re = {exports: {}};
 
@@ -11298,11 +11298,8 @@ function parse(html, options) {
     return Parser.parse(html, options);
 }
 
-/** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
-/** 小程序沙盒通信协议版本。 */
 const MINI_PROGRAM_MESSAGE_VERSION = 2;
-/** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 
 const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.7.3-alpha.2",
+  "version": "0.7.4-alpha.1",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -54,7 +54,8 @@
   "license": "ISC",
   "dependencies": {
     "parse5": "^7.3.0",
-    "undici": "^7.28.0"
+    "undici": "^7.28.0",
+    "@heybox/hb-sdk-protocol": "0.7.4-alpha.1"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -95,7 +96,8 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.18"
+    "@heybox/hb-sdk-runtime": "~0.7.4-alpha.1",
+    "@heybox/hb-api": "~1.25.20"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -105,11 +107,18 @@
     "targets": {
       "build:package": {
         "inputs": [
-          "{projectRoot}/src/**/*"
+          "{projectRoot}/src/**/*",
+          "{projectRoot}/devtools/browser-dev-host/**/*",
+          "{projectRoot}/scripts/copy-browser-dev-host.cjs",
+          "{projectRoot}/rollup.config.ts",
+          "{projectRoot}/tsconfig*.json",
+          "{workspaceRoot}/packages/hb-sdk-runtime/src/**/*",
+          "{workspaceRoot}/packages/hb-sdk-runtime/package.json",
+          "{workspaceRoot}/packages/hb-sdk-runtime/rollup.config.ts"
         ],
         "outputs": [
-          "{workspaceRoot}/vue.config.js",
-          "{workspaceRoot}/vue2-plugin.js"
+          "{projectRoot}/dist",
+          "{projectRoot}/types"
         ],
         "cache": true
       }
@@ -126,20 +135,28 @@
     "build:lib": "pnpm run build:hb-api-contract && pnpm run build:lib:bundle",
     "build:lib:bundle": "rollup -c rollup.config.ts  --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}'",
     "build:cli": "pnpm run build:hb-api-contract && pnpm run build:cli:bundle",
-    "build:cli:bundle": "rollup -c rollup.config.ts --environment HB_SDK_BUILD:cli --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}' && pnpm run build:mock-host",
-    "build:mock-host": "node scripts/copy-mock-host.cjs",
+    "build:cli:bundle": "rollup -c rollup.config.ts --environment HB_SDK_BUILD:cli --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}' && pnpm run build:browser-dev-host",
+    "build:browser-dev-host": "node scripts/copy-browser-dev-host.cjs",
     "build:templates": "node scripts/copy-cli-templates.cjs",
     "build:types": "tsc -p tsconfig.dts.json",
     "check:boundary": "node scripts/check-boundary.cjs",
     "check:docs-sync": "pnpm -w exec hbexec hb-sdk check",
     "clean": "rimraf ./dist && rimraf ./types",
     "test:unit": "NODE_OPTIONS='--conditions=heybox' vitest run",
+    "test:types:characterization": "tsc -p tsconfig.characterization.json --noEmit --pretty false",
+    "test:types:browser-dev-host": "tsc -p tsconfig.browser-dev-host.json --noEmit --pretty false",
+    "test:types": "pnpm run test:types:characterization && pnpm run test:types:browser-dev-host",
+    "test:e2e:browser-dev-host": "pnpm run build:browser-dev-host && NODE_OPTIONS='--conditions=heybox' vitest run --config vitest.browser-dev-host-e2e.config.ts",
     "test:unit:coverage": "NODE_OPTIONS='--conditions=heybox' vitest run --coverage",
     "test:vite": "pnpm run build:hb-api-contract && vitest run --config vitest.vite.config.ts",
     "test:watch": "NODE_OPTIONS='--conditions=heybox' vitest",
     "changelog:draft": "node scripts/changelog-draft.cjs",
     "check:changelog": "node scripts/check-changelog.cjs",
+    "test:release": "node --test scripts/release-family.test.cjs ../../ops/jobs/publish-changed-packages/publish.test.cjs",
     "release:prepare": "node scripts/release-prepare.cjs",
-    "release:tag": "node scripts/release-tag.cjs"
+    "release:tag": "node scripts/release-tag.cjs",
+    "release:family:dry-run": "node ../../ops/jobs/publish-changed-packages/publish.cjs --dry-run",
+    "release:family:promote": "node ../../ops/jobs/publish-changed-packages/publish.cjs --family-action promote",
+    "release:family:rollback": "node ../../ops/jobs/publish-changed-packages/publish.cjs --family-action rollback"
   }
 }

package/skill/SKILL.md

@@ -10,7 +10,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 ## Step 1: Classify the task
 
 1. If the task is workshop mini-program business code, use the root package import path `@heybox/hb-sdk`.
-2. If the task is parent-container runtime, bridge-server, protocol contract, or `@heybox/hb-sdk-runtime` work, use `@heybox/hb-sdk/protocol` only for shared constants and types.
+2. If the task is new protocol or `@heybox/hb-sdk-runtime` graph maintenance, import wire contracts directly from `@heybox/hb-sdk-protocol`. Existing released Host consumers continue to use the compatibility entry `@heybox/hb-sdk/protocol` until the synchronized hard cut is published.
 3. If the task is project scaffolding, local startup, production build, browser Mock, device debugging, CLI login, Agent Skill diagnosis, or CLI troubleshooting, use the `hb-sdk` CLI workflow.
 4. If the task is reviewing a mini-program for submission, listing, audit, publishing, content compliance, data/privacy compliance, runtime quality, or icon/cover design requirements, use the online publishing rules workflow.
 5. If the task asks for direct login-state extraction, cookies, tokens, raw Heybox client protocols, or internal hb-sdk package paths, refuse that approach and use the public SDK or CLI boundary instead.
@@ -32,7 +32,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 ## Step 3: Follow import rules
 
 1. Import app-facing SDK APIs from `@heybox/hb-sdk`.
-2. Import protocol contracts from `@heybox/hb-sdk/protocol` only in host/runtime/protocol-maintenance code.
+2. Import protocol contracts from `@heybox/hb-sdk-protocol` in the new Runtime/protocol graph. Use `@heybox/hb-sdk/protocol` only when maintaining an existing released Host consumer that still targets the compatibility entry.
 3. Never import from internal hb-sdk implementation paths; only use the documented package entrypoints.
 4. Prefer named imports for focused code and the default `hbSDK` singleton for compact page-level examples.
 
@@ -55,7 +55,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 
 1. Use `hb-sdk create <project-name>` to scaffold a workshop mini-program.
 2. Use `hb-sdk dev` for browser, Mac App, or mobile App debugging. These entries remain available without CLI login or project binding, but managed capabilities are denied by default.
-3. Use `--port`, `--mock-port`, and `--no-open` when the default local ports or browser opening behavior need to be controlled.
+3. Use `--port`, `--browser-dev-host-port`, and `--no-open` when the default local ports or browser opening behavior need to be controlled.
 4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
 5. Keep `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the required Manifest or Runtime gate output is missing.
 6. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
@@ -97,7 +97,7 @@ For CLI and local development:
 
 For host/runtime/protocol-maintenance code:
 
-1. Use `@heybox/hb-sdk/protocol` for shared constants and type contracts.
+1. Treat `@heybox/hb-sdk-protocol` as the wire contract owner; existing consumers continue to use the public compatibility entry `@heybox/hb-sdk/protocol` until the synchronized hard cut is released.
 2. Keep raw protocol details inside the host/runtime boundary; do not leak them into app-facing SDK examples or workshop mini-program business code.
 3. Preserve compatibility with existing SDK clients.
 
@@ -107,7 +107,7 @@ For host/runtime/protocol-maintenance code:
 2. When modifying docs, skill instructions, CLI guidance, or public agent-skill sync points, start with:
    - `pnpm --filter @heybox/hb-sdk run check:docs-sync`
    - `cat packages/hb-sdk/DOC_SYNC_CHECKLIST.md`
-3. When preparing a package release, run `pnpm --filter @heybox/hb-sdk run release:prepare -- --bump patch` or `pnpm --filter @heybox/hb-sdk run release:prepare -- --version <x.y.z>`. The release assistant updates both package versions, inserts `packages/hb-sdk/CHANGELOG.md`, and runs `check:changelog`. Use `--ai-command "<command>"` or `HB_SDK_CHANGELOG_AI_COMMAND` when an AI writer should rewrite the Conventional Commit draft. Review the entry for Mini-program developers and Host/Runtime integration maintainers, and do not expose Runtime internal adapter, state-machine, or security-policy details.
+3. When preparing a package release, run `pnpm --filter @heybox/hb-sdk run release:prepare -- --bump patch` or `pnpm --filter @heybox/hb-sdk run release:prepare -- --version <x.y.z>`. The release assistant updates the Protocol/Runtime/SDK family versions, inserts `packages/hb-sdk/CHANGELOG.md`, and runs `check:changelog`. Use `--ai-command "<command>"` or `HB_SDK_CHANGELOG_AI_COMMAND` when an AI writer should rewrite the Conventional Commit draft. Review the entry for Mini-program developers and Host/Runtime integration maintainers, and do not expose Runtime internal adapter, state-machine, or security-policy details.
 4. When modifying this repo's source skill at `packages/hb-sdk/skill` and preparing distributable artifacts, also run:
    - `node packages/hb-sdk/skill/scripts/package-skill.mjs`
 5. When modifying CLI, local debugging, package exports, or package dependency direction, also run: