@heybox/hb-sdk 0.7.3 → 0.7.4-alpha.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. package/CHANGELOG.md +48 -1
  2. package/README.md +5 -0
  3. package/dist/cli-chunks/{build-0sZ873iU.cjs → build-BqGFRLe-.cjs} +2 -2
  4. package/dist/cli-chunks/{context-DNQEI7m7.cjs → context-DTr3hRTv.cjs} +6 -19
  5. package/dist/cli-chunks/{create-BkE71M2U.cjs → create-OkiiiH4I.cjs} +1 -1
  6. package/dist/cli-chunks/{dev-_tBlQ2WO.cjs → dev-j7W9R7ew.cjs} +798 -139
  7. package/dist/cli-chunks/{doctor-B1wk8IpC.cjs → doctor-BO0vkDny.cjs} +1 -1
  8. package/dist/cli-chunks/{index-BbDsxI94.cjs → index-CZuvk1Rg.cjs} +1 -1
  9. package/dist/cli-chunks/{index-CIucOD2H.cjs → index-CyEqCbeu.cjs} +24 -21
  10. package/dist/cli-chunks/{login-CnjEKlFT.cjs → login-CuAGltGs.cjs} +2 -2
  11. package/dist/cli-chunks/{project-vite-ESaxoAE1.cjs → project-vite-BUY9DgYo.cjs} +1 -1
  12. package/dist/cli-chunks/{remote-BaGzge7R.cjs → remote-tPMcxgpi.cjs} +4 -4
  13. package/dist/cli-chunks/{session-C9KHqijL.cjs → session-BUjFX2U2.cjs} +1 -1
  14. package/dist/cli.cjs +1 -1
  15. package/dist/devtools/{mock-host → browser-dev-host}/index.html +3 -7
  16. package/dist/devtools/browser-dev-host/main.js +9835 -0
  17. package/dist/index.cjs.js +40 -118
  18. package/dist/index.esm.js +40 -118
  19. package/dist/protocol.cjs.js +71 -346
  20. package/dist/protocol.esm.js +72 -342
  21. package/dist/vite.cjs.js +1 -4
  22. package/dist/vite.esm.js +1 -4
  23. package/package.json +26 -9
  24. package/skill/SKILL.md +5 -5
  25. package/skill/references/api-protocol.md +102 -114
  26. package/skill/references/api-root.md +1 -1
  27. package/skill/references/cli.md +4 -2
  28. package/skill/references/recipes.md +2 -0
  29. package/skill/references/safety-boundaries.md +1 -0
  30. package/skill/scripts/sync-references.mjs +5 -1
  31. package/skill/skill.json +4 -4
  32. package/types/core/network-sanitize.d.ts +1 -1
  33. package/types/modules/auth/index.d.ts +3 -1
  34. package/types/modules/user/types.d.ts +2 -53
  35. package/types/protocol/capabilities.d.ts +2 -352
  36. package/types/protocol/constants.d.ts +1 -14
  37. package/types/protocol/dev-session.d.ts +3 -3
  38. package/types/protocol/guards.d.ts +1 -8
  39. package/types/protocol/runtime-permissions.d.ts +2 -41
  40. package/types/protocol/types.d.ts +3 -150
  41. package/types/protocol.d.ts +8 -23
  42. package/dist/devtools/mock-host/main.js +0 -7751
  43. package/types/protocol/network-policy.d.ts +0 -10
  44. package/types/protocol/trusted-user-gesture.d.ts +0 -6
@@ -19,39 +19,6 @@ Use `@heybox/hb-sdk/protocol` only for parent-container runtime, bridge-server,
19
19
  ## Public protocol entrypoint
20
20
 
21
21
  ```ts
22
- export {
23
- MINI_PROGRAM_BRIDGE_NONCE_PARAM,
24
- MINI_PROGRAM_MESSAGE_NAMESPACE,
25
- MINI_PROGRAM_MESSAGE_VERSION,
26
- SDK_HANDSHAKE_METHOD,
27
- } from './protocol/constants';
28
- export { isMiniProgramBridgeMessage } from './protocol/guards';
29
- export {
30
- computeTrustedIframeUserGesture,
31
- type TrustedIframeUserGestureEnvironment,
32
- } from './protocol/trusted-user-gesture';
33
- export { isManagedMiniProgramRuntimePermissionKey, parseMiniProgramRuntimePermissions } from './protocol/runtime-permissions';
34
- export {
35
- isOfficialMiniProgramNetworkUrl,
36
- isProtectedMiniProgramNetworkPath,
37
- MINI_PROGRAM_NETWORK_PROTECTED_PATHS,
38
- normalizeMiniProgramNetworkPathname,
39
- } from './protocol/network-policy';
40
- export type {
41
- MiniProgramRuntimePermissionEntry,
42
- MiniProgramRuntimePermissionStatus,
43
- MiniProgramRuntimePermissionsSnapshot,
44
- ParsedMiniProgramRuntimePermissions,
45
- } from './protocol/runtime-permissions';
46
- export type {
47
- MiniProgramBridgeError,
48
- MiniProgramBridgeMessage,
49
- MiniProgramBridgeMessageType,
50
- MiniProgramEventHandler,
51
- MiniProgramEventName,
52
- MiniProgramEventPayloadMap,
53
- SDKHandshakePayload,
54
- } from './protocol/types';
55
22
  export {
56
23
  AUTH_LOGIN_METHOD,
57
24
  CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD,
@@ -61,11 +28,15 @@ export {
61
28
  CLOUD_LEADERBOARD_SUBMIT_METHOD,
62
29
  DEVICE_SET_CLIPBOARD_METHOD,
63
30
  DEVICE_VIBRATE_METHOD,
31
+ MINI_PROGRAM_BRIDGE_NONCE_PARAM,
32
+ MINI_PROGRAM_MESSAGE_NAMESPACE,
33
+ MINI_PROGRAM_MESSAGE_VERSION,
64
34
  MINI_PROGRAM_PROTOCOL_CAPABILITIES,
65
35
  NAVIGATION_CLOSE_METHOD,
66
36
  NAVIGATION_OPEN_APP_PAGE_METHOD,
67
37
  NAVIGATION_RELOAD_METHOD,
68
38
  NETWORK_REQUEST_METHOD,
39
+ SDK_HANDSHAKE_METHOD,
69
40
  SHARE_SCREENSHOT_METHOD,
70
41
  SHARE_SHOW_SHARE_MENU_METHOD,
71
42
  STORAGE_GET_STORAGE_METHOD,
@@ -73,15 +44,48 @@ export {
73
44
  UI_HIDE_LOADING_METHOD,
74
45
  UI_SHOW_LOADING_METHOD,
75
46
  UI_SHOW_TOAST_METHOD,
76
- USER_REVOKE_AUTHORIZATION_METHOD,
77
- USER_GET_STEAM_GAME_LIST_METHOD,
47
+ USER_INFO_AUTHORIZATION_SCOPES,
78
48
  USER_GET_INFO_METHOD,
49
+ USER_GET_STEAM_GAME_LIST_METHOD,
50
+ USER_REVOKE_AUTHORIZATION_METHOD,
79
51
  VIEWPORT_GET_WINDOW_INFO_METHOD,
80
52
  VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD,
81
- } from './protocol/capabilities';
53
+ isManagedMiniProgramRuntimePermissionKey,
54
+ isMiniProgramBridgeMessage,
55
+ parseMiniProgramRuntimePermissions,
56
+ } from '@heybox/hb-sdk-protocol';
57
+
82
58
  export type {
83
- MiniProgramDeviceMethod,
59
+ AuthorizedUserInfo,
60
+ ClosePayload,
61
+ CloseResult,
62
+ DeleteCurrentUserLeaderboardEntryPayload,
63
+ DeleteCurrentUserLeaderboardEntryResult,
64
+ GetCurrentUserLeaderboardEntryPayload,
65
+ GetCurrentUserLeaderboardEntryResult,
66
+ GetLeaderboardInfoPayload,
67
+ GetLeaderboardInfoResult,
68
+ GetLeaderboardListPayload,
69
+ GetLeaderboardListResult,
70
+ GetSteamGameListPayload,
71
+ GetSteamGameListResult,
72
+ GetStoragePayload,
73
+ GetStorageResult,
74
+ GetUserInfoPayload,
75
+ GetUserInfoResult,
76
+ GetWindowInfoPayload,
77
+ GetWindowInfoResult,
78
+ HideLoadingPayload,
79
+ HideLoadingResult,
80
+ LeaderboardEntry,
81
+ LeaderboardOrder,
82
+ LoginPayload,
83
+ LoginResult,
84
+ LoginScope,
84
85
  MiniProgramAuthMethod,
86
+ MiniProgramBridgeError,
87
+ MiniProgramBridgeMessage,
88
+ MiniProgramBridgeMessageType,
85
89
  MiniProgramBridgeMethod,
86
90
  MiniProgramCapabilityDefinition,
87
91
  MiniProgramCapabilityModule,
@@ -91,99 +95,81 @@ export type {
91
95
  MiniProgramCapabilityResultMap,
92
96
  MiniProgramCapabilityRisk,
93
97
  MiniProgramCloudMethod,
98
+ MiniProgramDeviceMethod,
99
+ MiniProgramEventName,
100
+ MiniProgramEventPayloadMap,
101
+ MiniProgramNavigationBarForegroundStyle,
94
102
  MiniProgramNavigationMethod,
103
+ MiniProgramNetworkHeaders,
95
104
  MiniProgramNetworkMethod,
105
+ MiniProgramNetworkParams,
106
+ MiniProgramNetworkRequestMethod,
107
+ MiniProgramRuntimePermissionEntry,
108
+ MiniProgramRuntimePermissionsSnapshot,
109
+ MiniProgramRuntimePermissionStatus,
110
+ MiniProgramSafeArea,
111
+ MiniProgramScreenshotRect,
112
+ MiniProgramShareChannel,
96
113
  MiniProgramShareMethod,
114
+ MiniProgramSharePostOptions,
97
115
  MiniProgramStorageMethod,
116
+ MiniProgramToastStatus,
98
117
  MiniProgramUiMethod,
118
+ MiniProgramUserInfoResult,
99
119
  MiniProgramUserMethod,
120
+ MiniProgramVibrateIntensity,
100
121
  MiniProgramViewportMethod,
101
- } from './protocol/capabilities';
102
- export type { LoginOptions, LoginPayload, LoginResult, LoginScope } from './modules/auth';
103
- export type {
104
- DeleteCurrentUserLeaderboardEntryPayload,
105
- DeleteCurrentUserLeaderboardEntryResult,
106
- GetCurrentUserLeaderboardEntryPayload,
107
- GetCurrentUserLeaderboardEntryResult,
108
- GetLeaderboardInfoPayload,
109
- GetLeaderboardInfoResult,
110
- GetLeaderboardListPayload,
111
- GetLeaderboardListResult,
112
- LeaderboardEntry,
113
- LeaderboardOrder,
114
- SubmitLeaderboardEntryPayload,
115
- SubmitLeaderboardEntryResult,
116
- } from './modules/cloud';
117
- export type {
118
- AuthorizedUserInfo,
119
- GetUserInfoPayload,
120
- GetUserInfoResult,
121
- RevokeAuthorizationPayload,
122
- RevokeAuthorizationResult,
123
- GetSteamGameListOptions,
124
- GetSteamGameListPayload,
125
- GetSteamGameListResult,
126
- MiniProgramUserInfoResult,
127
- UserInfoAuthorization,
128
- UserInfoAuthorizationStatus,
129
- SteamGameListData,
130
- SteamGameListItem,
131
- SteamGamePrice,
132
- SteamGameListSort,
133
- } from './modules/user';
134
- export { USER_INFO_AUTHORIZATION_SCOPES } from './modules/user';
135
- export type { UserInfoAuthorizationScope } from './modules/user';
136
- export type { ScreenshotPayload, ScreenshotResult } from './modules/share/screenshot';
137
- export type { ShowShareMenuPayload, ShowShareMenuResult } from './modules/share/show-share-menu';
138
- export type {
139
- MiniProgramScreenshotOptions,
140
- MiniProgramScreenshotRect,
141
- MiniProgramShareChannel,
142
- MiniProgramSharePostOptions,
143
- MiniProgramShowShareMenuOptions,
144
- } from './modules/share';
145
- export type { GetStoragePayload, GetStorageResult, SetStoragePayload } from './modules/storage';
146
- export type {
147
- GetWindowInfoPayload,
148
- GetWindowInfoResult,
149
- MiniProgramNavigationBarForegroundStyle,
150
- MiniProgramSafeArea,
151
- MiniProgramSetNavigationBarStyleOptions,
152
122
  MiniProgramWindowInfoResult,
153
- SetNavigationBarStylePayload,
154
- SetNavigationBarStyleResult,
155
- } from './modules/viewport';
156
- export type {
157
- MiniProgramNetworkHeaders,
158
- MiniProgramNetworkParams,
159
- MiniProgramNetworkRequestConfig,
160
- MiniProgramNetworkRequestMethod,
161
- MiniProgramNetworkResponse,
162
- MiniProgramNetworkValidateStatus,
163
123
  NetworkRequestPayload,
164
124
  NetworkResponsePayload,
165
- } from './modules/network';
166
- export type {
167
- HideLoadingPayload,
168
- HideLoadingResult,
169
- MiniProgramToastStatus,
170
- ShowLoadingPayload,
171
- ShowLoadingResult,
172
- ShowToastPayload,
173
- ShowToastResult,
174
- } from './modules/ui';
175
- export type { MiniProgramVibrateIntensity, SetClipboardPayload, SetClipboardResult, VibratePayload, VibrateResult } from './modules/device';
176
- export type {
177
- ClosePayload,
178
- CloseResult,
179
125
  OpenAppPagePayload,
180
126
  OpenAppPageResult,
181
127
  OpenGameDetailAppPagePayload,
182
128
  OpenPostDetailAppPagePayload,
183
129
  OpenUserDetailAppPagePayload,
130
+ ParsedMiniProgramRuntimePermissions,
184
131
  ReloadPayload,
185
132
  ReloadResult,
186
- } from './modules/navigation';
133
+ RevokeAuthorizationPayload,
134
+ RevokeAuthorizationResult,
135
+ ScreenshotPayload,
136
+ ScreenshotResult,
137
+ SDKHandshakePayload,
138
+ SetClipboardPayload,
139
+ SetClipboardResult,
140
+ SetNavigationBarStylePayload,
141
+ SetNavigationBarStyleResult,
142
+ SetStoragePayload,
143
+ ShowLoadingPayload,
144
+ ShowLoadingResult,
145
+ ShowShareMenuPayload,
146
+ ShowShareMenuResult,
147
+ ShowToastPayload,
148
+ ShowToastResult,
149
+ SteamGameListData,
150
+ SteamGameListItem,
151
+ SteamGameListSort,
152
+ SteamGamePrice,
153
+ SubmitLeaderboardEntryPayload,
154
+ SubmitLeaderboardEntryResult,
155
+ UserInfoAuthorization,
156
+ UserInfoAuthorizationScope,
157
+ UserInfoAuthorizationStatus,
158
+ VibratePayload,
159
+ VibrateResult,
160
+ } from '@heybox/hb-sdk-protocol';
161
+
162
+ // 这些类型属于 iframe Client facade,不进入共享 wire package;保留在兼容入口避免类型面静默收窄。
163
+ export type { LoginOptions } from './modules/auth';
164
+ export type { GetSteamGameListOptions } from './modules/user';
165
+ export type { MiniProgramEventHandler } from './protocol/types';
166
+ export type {
167
+ MiniProgramNetworkRequestConfig,
168
+ MiniProgramNetworkResponse,
169
+ MiniProgramNetworkValidateStatus,
170
+ } from './modules/network';
171
+ export type { MiniProgramScreenshotOptions, MiniProgramShowShareMenuOptions } from './modules/share';
172
+ export type { MiniProgramSetNavigationBarStyleOptions } from './modules/viewport';
187
173
  ```
188
174
 
189
175
  ## Generated reference index
@@ -199,11 +185,13 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成,不
199
185
  | [Protocol API](#public-protocol-entrypoint) | `@heybox/hb-sdk/protocol` 的协议常量、消息类型与 method 契约。 |
200
186
  | [Miniapp Publish API](https://open.xiaoheihe.cn/docs/hb_sdk/reference/miniapp-publish/) | `@heybox/hb-sdk/miniapp-publish` 的构建产物发布前的公开校验工具。 |
201
187
  | [Vite API](https://open.xiaoheihe.cn/docs/hb_sdk/reference/vite/) | `@heybox/hb-sdk/vite` 的Vite 工坊小程序插件。 |
188
+ | [Host Runtime 集成](https://docs.xiaoheihe.cn/hb_sdk/reference/runtime/) | `@heybox/hb-sdk-runtime` 的 Host Port、Web Host 与 Runtime 集成入口;声明 Reference 在 Runtime package 内生成。 |
202
189
 
203
190
  ## 查询建议
204
191
 
205
192
  - 想查业务接入路径:先看 [Guide](recipes.md)。
206
193
  - 想查导出符号:从上方对应公开入口进入分类页。
194
+ - 想接入详情页或 Browser Dev Host:先看 [Host Runtime 集成](https://docs.xiaoheihe.cn/hb_sdk/reference/runtime/),再查 Runtime package 的声明 Reference。
207
195
  - 想看场景化用法:优先看 Guide / Recipes 页面中的“进一步阅读”。
208
196
 
209
197
  ## 统计
@@ -211,6 +199,6 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成,不
211
199
  | 导出面 | Classes | Functions | Interfaces | Types | Constants |
212
200
  | --- | ---: | ---: | ---: | ---: | ---: |
213
201
  | Root API | 2 | 4 | 50 | 54 | 1 |
214
- | Protocol API | 0 | 7 | 46 | 65 | 31 |
202
+ | Protocol API | 0 | 3 | 44 | 66 | 30 |
215
203
  | Miniapp Publish API | 0 | 5 | 2 | 0 | 0 |
216
204
  | Vite API | 0 | 1 | 0 | 0 | 0 |
@@ -24,7 +24,7 @@
24
24
  ## Package metadata
25
25
 
26
26
  - Package: `@heybox/hb-sdk`
27
- - Version at generation time: `0.7.3`
27
+ - Version at generation time: `0.7.4-alpha.4`
28
28
  - Public root export: `@heybox/hb-sdk`
29
29
  - Protocol export: `@heybox/hb-sdk/protocol`
30
30
  - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -35,7 +35,7 @@ Use the bundled `hb-sdk` CLI to create a workshop mini-program, open the local d
35
35
 
36
36
  ```text
37
37
  hb-sdk create <project-name>
38
- hb-sdk dev [--port <port>] [--mock-port <port>] [--no-open]
38
+ hb-sdk dev [--port <port>] [--browser-dev-host-port <port>] [--no-open]
39
39
  hb-sdk build [--env <name>] [--verbose]
40
40
  hb-sdk login
41
41
  hb-sdk login status
@@ -138,13 +138,15 @@ Dev Context 中调整的权限只影响当前本地调试,不会修改线上
138
138
  | 参数 | 用途 |
139
139
  | -------------------- | ----------------------------------------- |
140
140
  | `--port <port>` | 指定页面开发服务端口。 |
141
- | `--mock-port <port>` | 指定本地调试端口。 |
141
+ | `--browser-dev-host-port <port>` | 指定 Browser Dev Host 端口。 |
142
142
  | `--raw-protocol` | 让手机二维码直接编码裸 `heybox://` 协议。 |
143
143
  | `--no-open` | 启动后不自动打开浏览器。 |
144
144
  | `--verbose` | 出现问题时输出更详细的诊断信息。 |
145
145
 
146
146
  Use `hb-sdk dev` to open the local debugging page. The "在 Mac 版 APP 中启动" button opens the page in the Mac App; the "Mobile App" QR code opens it in the phone App after a LAN interface is selected. These entries remain available without CLI login or project binding, but managed capabilities are denied by default. The phone and computer must be on the same LAN. If an embedded browser cannot open the App, use the system browser.
147
147
 
148
+ The default CLI does not configure the external one-time-code/PKCE service required for Browser Dev Host user login. In that state the page disables login and reports the missing prerequisite while other local debugging entries remain available. Never substitute CLI login state, cross-site cookies, mock identity, or credential-bearing URLs for this service.
149
+
148
150
  ## Production build
149
151
 
150
152
  ## 生产构建
@@ -163,6 +163,8 @@ async function loginFromUserAction() {
163
163
 
164
164
  需要展示登录或授权 UI 时,调用必须来自按钮点击等可信用户手势,否则返回 `USER_GESTURE_REQUIRED`。用户取消、拒绝或关闭授权页面时返回 `AUTHORIZATION_CANCELLED`,业务应停留在当前页面并允许稍后重试。
165
165
 
166
+ 首次授权时,Host 授权页会展示当前小程序的名称和图标;申请 `profile` scope 时,还会预览当前小黑盒账号的昵称和头像,帮助用户确认资料披露对象。Runtime 优先复用 Host 启动阶段已经解析的资料,读取补充资料失败或超时时使用中性占位,不影响用户继续授权。账号切换、授权撤销或 Runtime 终止会关闭当前确认界面;这些 Host 展示字段不会加入 `auth.login()` 返回值。
167
+
166
168
  用户已授权所需 scope 时,`auth.login()` 可以不展示 UI,静默返回新的短期授权码。业务仍应把可能出现的授权 UI 设计在明确的用户操作之后,不要在页面初始化阶段自动调用。
167
169
 
168
170
  ## 撤销当前小程序授权
@@ -36,3 +36,4 @@
36
36
  - Do not build raw `postMessage` bridge flows in iframe business code.
37
37
  - Do not fetch deployed `dist/manifest.json` from business code; it is a build artifact for the release pipeline, not a CDN runtime asset.
38
38
  - Do not import from internal hb-sdk implementation paths; only use documented package entrypoints.
39
+ - Browser Dev Host user login must stay fail-closed when its external one-time-code/PKCE service is unavailable. Never reuse CLI login state or expose credentials to browser JavaScript, URLs, logs, or serializable errors.
@@ -80,6 +80,7 @@ function rewriteBundledProtocolIndexLinks(markdown) {
80
80
  .replaceAll('(./protocol/)', '(#public-protocol-entrypoint)')
81
81
  .replaceAll('(./miniapp-publish/)', '(https://open.xiaoheihe.cn/docs/hb_sdk/reference/miniapp-publish/)')
82
82
  .replaceAll('(./vite/)', '(https://open.xiaoheihe.cn/docs/hb_sdk/reference/vite/)')
83
+ .replaceAll('(./runtime/)', '(https://docs.xiaoheihe.cn/hb_sdk/reference/runtime/)')
83
84
  .replaceAll('(../guide/)', '(recipes.md)');
84
85
  }
85
86
 
@@ -237,7 +238,7 @@ const cliLoginSection = extractSection(cliGuide, '## CLI 登录态');
237
238
  const cliDoctorSection = extractSection(cliGuide, '## Agent Skill doctor');
238
239
  const cliUpdateSection = extractSection(cliGuide, '## 版本提醒');
239
240
  const cliCommandSurface = `hb-sdk create <project-name>
240
- hb-sdk dev [--port <port>] [--mock-port <port>] [--no-open]
241
+ hb-sdk dev [--port <port>] [--browser-dev-host-port <port>] [--no-open]
241
242
  hb-sdk build [--env <name>] [--verbose]
242
243
  hb-sdk login
243
244
  hb-sdk login status
@@ -407,6 +408,8 @@ ${cliDevSection}
407
408
 
408
409
  Use \`hb-sdk dev\` to open the local debugging page. The "在 Mac 版 APP 中启动" button opens the page in the Mac App; the "Mobile App" QR code opens it in the phone App after a LAN interface is selected. These entries remain available without CLI login or project binding, but managed capabilities are denied by default. The phone and computer must be on the same LAN. If an embedded browser cannot open the App, use the system browser.
409
410
 
411
+ The default CLI does not configure the external one-time-code/PKCE service required for Browser Dev Host user login. In that state the page disables login and reports the missing prerequisite while other local debugging entries remain available. Never substitute CLI login state, cross-site cookies, mock identity, or credential-bearing URLs for this service.
412
+
410
413
  ## Production build
411
414
 
412
415
  ${cliBuildSection}
@@ -553,6 +556,7 @@ ${capabilityBoundaries}
553
556
  - Do not build raw \`postMessage\` bridge flows in iframe business code.
554
557
  - Do not fetch deployed \`dist/manifest.json\` from business code; it is a build artifact for the release pipeline, not a CDN runtime asset.
555
558
  - Do not import from internal hb-sdk implementation paths; only use documented package entrypoints.
559
+ - Browser Dev Host user login must stay fail-closed when its external one-time-code/PKCE service is unavailable. Never reuse CLI login state or expose credentials to browser JavaScript, URLs, logs, or serializable errors.
556
560
  `,
557
561
  );
558
562
 
package/skill/skill.json CHANGED
@@ -1,11 +1,11 @@
1
1
  {
2
2
  "name": "hb-sdk",
3
- "skillVersion": "0.7.3+skill.8bd4775c12e3",
3
+ "skillVersion": "0.7.4-alpha.4+skill.248b8d6d06cb",
4
4
  "sdk": {
5
5
  "package": "@heybox/hb-sdk",
6
- "version": "0.7.3",
7
- "compatibility": "0.7.3"
6
+ "version": "0.7.4-alpha.4",
7
+ "compatibility": "0.7.4-alpha.4"
8
8
  },
9
9
  "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
10
- "integrity": "sha256-8bd4775c12e3fa0efa4a8b14cb4ed4a730dbc3f325b1ebcf479e7a0026fcae30"
10
+ "integrity": "sha256-248b8d6d06cb00817bfadca1bc5fd0d15112088f6548c11cb6d715453e2a6d4d"
11
11
  }
@@ -3,7 +3,7 @@
3
3
  *
4
4
  * @remarks
5
5
  * 放在 `core` 而非 `modules/network`:无错误类型依赖,供 SDK 错误文案、
6
- * modules observability、devtools Mock Host / proxy 共用,并满足 boundary
6
+ * modules observability、devtools Browser Dev Host / proxy 共用,并满足 boundary
7
7
  *(devtools 不得直接 import runtime capability modules)。
8
8
  */
9
9
  export type MiniProgramNetworkHeadersLike = Record<string, string>;
@@ -1,6 +1,8 @@
1
+ import type { LoginScope as ProtocolLoginScope } from '@heybox/hb-sdk-protocol';
1
2
  import type { MiniProgramRequester } from '../../core/client';
2
3
  export { AUTH_LOGIN_METHOD } from '../../protocol/capabilities';
3
- export type LoginScope = 'identity' | 'profile';
4
+ /** 登录 scope Protocol canonical 用户信息 scope 保持同源。 */
5
+ export type LoginScope = ProtocolLoginScope;
4
6
  export interface LoginOptions {
5
7
  scopes?: LoginScope[];
6
8
  }
@@ -1,53 +1,2 @@
1
- /** 用户资料授权状态。 */
2
- export type UserInfoAuthorizationStatus = 'not_required' | 'not_requested' | 'granted' | 'denied';
3
- /** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
4
- export declare const USER_INFO_AUTHORIZATION_SCOPES: readonly ["identity", "profile"];
5
- export type UserInfoAuthorizationScope = (typeof USER_INFO_AUTHORIZATION_SCOPES)[number];
6
- type CanonicalUserInfoAuthorization = Record<UserInfoAuthorizationScope, UserInfoAuthorizationStatus>;
7
- /** 当前小程序对 canonical 用户信息 scope 的授权状态。 */
8
- export interface UserInfoAuthorization extends CanonicalUserInfoAuthorization {
9
- }
10
- /**
11
- * 已获准向当前小程序披露的用户资料。
12
- *
13
- * @remarks
14
- * 未开通网络权限且当前黑盒 APP 用户已登录时,Runtime 会隐式授予 `identity` 与
15
- * `profile`,静默建立或读取隔离身份,并由 `user.getInfo()` 返回该对象。撤销授权后旧身份失效,调用方应停止使用并清理
16
- * 本地缓存;再次调用 `user.getInfo()` 会静默建立新的隔离身份。
17
- */
18
- export interface AuthorizedUserInfo {
19
- /**
20
- * 当前黑盒用户在当前小程序内稳定且不可逆的关联标识。
21
- *
22
- * @remarks
23
- * 同一用户在不同小程序中的值不同。它不是黑盒用户 ID、登录凭据或主站私有接口凭据,
24
- * 只应作为当前小程序自己的业务关联键使用。示例:
25
- * `au_1_x7K9mQ2pL4vN8cR3tY6wB1zD5fH`。调用方必须把完整值视为不透明字符串,
26
- * 不应解析格式或依赖固定长度。
27
- */
28
- app_user_id: string;
29
- /** `profile` 已授权时返回昵称与头像;当前 Heybox Runtime 在无网络模式下隐式授予该 scope。 */
30
- profile: {
31
- nickname: string;
32
- avatar: string;
33
- } | null;
34
- }
35
- /**
36
- * 当前黑盒 APP 登录态、授权状态和已获准披露的用户资料。
37
- *
38
- * @remarks
39
- * 未登录时 `isHeyboxAppLoggedIn` 为 `false`,授权状态和用户资料均为 `null`。
40
- * 当前 Heybox Runtime 在无网络模式且已登录时会隐式授予 `identity` 与 `profile`,
41
- * 静默建立身份并返回 `userInfo`;
42
- * Host 在已登录但身份暂不可用时仍可返回 `null`,调用方必须进行空值判断。
43
- */
44
- export type MiniProgramUserInfoResult = {
45
- isHeyboxAppLoggedIn: false;
46
- authorization: null;
47
- userInfo: null;
48
- } | {
49
- isHeyboxAppLoggedIn: true;
50
- authorization: UserInfoAuthorization;
51
- userInfo: AuthorizedUserInfo | null;
52
- };
53
- export {};
1
+ export { USER_INFO_AUTHORIZATION_SCOPES } from '@heybox/hb-sdk-protocol';
2
+ export type { AuthorizedUserInfo, MiniProgramUserInfoResult, UserInfoAuthorization, UserInfoAuthorizationScope, UserInfoAuthorizationStatus, } from '@heybox/hb-sdk-protocol';