@heybox/hb-sdk 0.7.4-alpha.5 → 0.7.4

package/dist/cli-chunks/dev-MpESCaMm.cjs

@@ -1,2769 +0,0 @@
-'use strict';
-
-var fs = require('node:fs');
-var os = require('node:os');
-var path = require('node:path');
-var net = require('node:net');
-var promises = require('node:dns/promises');
-var node_http = require('node:http');
-var context = require('./context-C839--TH.cjs');
-var node_crypto = require('node:crypto');
-var undici = require('undici');
-var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CT94XzyO.cjs');
-var projectVite = require('./project-vite-zaw68V1G.cjs');
-var fs$1 = require('node:fs/promises');
-var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
-require('./session-D692TU5N.cjs');
-require('fs');
-require('constants');
-require('stream');
-require('util');
-require('assert');
-require('path');
-require('node:process');
-require('node:buffer');
-require('node:url');
-require('node:util');
-require('node:child_process');
-require('node:module');
-require('os');
-require('readline');
-require('tty');
-require('events');
-require('buffer');
-require('node:async_hooks');
-
-class Locked extends Error {
-	constructor(port) {
-		super(`${port} is locked`);
-	}
-}
-
-const lockedPorts = {
-	old: new Set(),
-	young: new Set(),
-};
-
-// On this interval, the old locked ports are discarded,
-// the young locked ports are moved to old locked ports,
-// and a new young set for locked ports are created.
-const releaseOldLockedPortsIntervalMs = 1000 * 15;
-
-// Keep `reserve` deliberately process-wide by port number.
-// It is meant to avoid in-process races, not to model every possible
-// IPv4/IPv6 or host-specific bind combination.
-const reservedPorts = new Set();
-
-// Lazily create timeout on first use
-let timeout;
-
-const getLocalHosts = () => {
-	const interfaces = os.networkInterfaces();
-
-	// Add undefined value for createServer function to use default host,
-	// and default IPv4 host in case createServer defaults to IPv6.
-	const results = new Set([undefined, '0.0.0.0']);
-
-	for (const _interface of Object.values(interfaces)) {
-		for (const config of _interface) {
-			results.add(config.address);
-		}
-	}
-
-	return results;
-};
-
-const checkAvailablePort = options =>
-	new Promise((resolve, reject) => {
-		const server = net.createServer();
-		server.unref();
-		server.on('error', reject);
-
-		server.listen(options, () => {
-			const {port} = server.address();
-			server.close(() => {
-				resolve(port);
-			});
-		});
-	});
-
-const getAvailablePort = async (options, hosts) => {
-	if (options.host || options.port === 0) {
-		return checkAvailablePort(options);
-	}
-
-	for (const host of hosts) {
-		try {
-			await checkAvailablePort({port: options.port, host}); // eslint-disable-line no-await-in-loop
-		} catch (error) {
-			if (!['EADDRNOTAVAIL', 'EINVAL'].includes(error.code)) {
-				throw error;
-			}
-		}
-	}
-
-	return options.port;
-};
-
-const isLockedPort = port => lockedPorts.old.has(port) || lockedPorts.young.has(port) || reservedPorts.has(port);
-
-const portCheckSequence = function * (ports) {
-	if (ports) {
-		yield * ports;
-	}
-
-	yield 0; // Fall back to 0 if anything else failed
-};
-
-async function getPorts(options) {
-	let ports;
-	let exclude = new Set();
-
-	if (options) {
-		if (options.port) {
-			ports = typeof options.port === 'number' ? [options.port] : options.port;
-		}
-
-		if (options.exclude) {
-			const excludeIterable = options.exclude;
-
-			if (typeof excludeIterable[Symbol.iterator] !== 'function') {
-				throw new TypeError('The `exclude` option must be an iterable.');
-			}
-
-			for (const element of excludeIterable) {
-				if (typeof element !== 'number') {
-					throw new TypeError('Each item in the `exclude` option must be a number corresponding to the port you want excluded.');
-				}
-
-				if (!Number.isSafeInteger(element)) {
-					throw new TypeError(`Number ${element} in the exclude option is not a safe integer and can't be used`);
-				}
-			}
-
-			exclude = new Set(excludeIterable);
-		}
-	}
-
-	const {reserve, ...netOptions} = options ?? {};
-
-	if (timeout === undefined) {
-		timeout = setTimeout(() => {
-			timeout = undefined;
-
-			lockedPorts.old = lockedPorts.young;
-			lockedPorts.young = new Set();
-		}, releaseOldLockedPortsIntervalMs);
-
-		// Does not exist in some environments (Electron, Jest jsdom env, browser, etc).
-		if (timeout.unref) {
-			timeout.unref();
-		}
-	}
-
-	const hosts = getLocalHosts();
-
-	for (const port of portCheckSequence(ports)) {
-		try {
-			if (exclude.has(port)) {
-				continue;
-			}
-
-			let availablePort = await getAvailablePort({...netOptions, port}, hosts); // eslint-disable-line no-await-in-loop
-			while (isLockedPort(availablePort)) {
-				if (port !== 0) {
-					throw new Locked(port);
-				}
-
-				availablePort = await getAvailablePort({...netOptions, port}, hosts); // eslint-disable-line no-await-in-loop
-			}
-
-			if (reserve) {
-				reservedPorts.add(availablePort);
-			} else {
-				lockedPorts.young.add(availablePort);
-			}
-
-			return availablePort;
-		} catch (error) {
-			if (!['EADDRINUSE', 'EACCES'].includes(error.code) && !(error instanceof Locked)) {
-				throw error;
-			}
-		}
-	}
-
-	throw new Error('No available ports found');
-}
-
-/** Dev Shell 读取局域网 Dev Session endpoint 的 query 参数。 */
-/** Browser Dev Host 创建和读取 Dev Session 的固定路径。 */
-const MINI_PROGRAM_DEV_CONTEXT_PATH = '/__hb_sdk__/dev-context';
-/** Dev Session 当前使用的 schema 版本。 */
-const MINI_PROGRAM_DEV_SESSION_SCHEMA_VERSION = 1;
-
-const BROWSER_DEV_HOST_JSON_BODY_LIMIT = 1024 * 1024;
-function readJsonRequestBody(request) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let size = 0;
-        request.on('data', (chunk) => {
-            const buffer = Buffer.from(chunk);
-            size += buffer.byteLength;
-            if (size > BROWSER_DEV_HOST_JSON_BODY_LIMIT) {
-                reject(createBrowserDevHostError(413, 'REQUEST_ENTITY_TOO_LARGE', 'Browser Dev Host network proxy request body too large'));
-                request.destroy();
-                return;
-            }
-            chunks.push(buffer);
-        });
-        request.on('error', reject);
-        request.on('aborted', () => {
-            reject('Browser Dev Host network proxy request aborted');
-        });
-        request.on('end', () => {
-            const rawBody = Buffer.concat(chunks).toString('utf8');
-            if (!rawBody.trim()) {
-                resolve({});
-                return;
-            }
-            try {
-                resolve(JSON.parse(rawBody));
-            }
-            catch {
-                reject(createBrowserDevHostError(400, 'INVALID_JSON', 'Browser Dev Host network proxy received invalid JSON'));
-            }
-        });
-    });
-}
-function writeJsonResponse(response, status, body) {
-    response.writeHead(status, {
-        'content-type': 'application/json; charset=utf-8',
-        'cache-control': 'no-store',
-    });
-    response.end(body === undefined ? '' : JSON.stringify(body));
-}
-function writeTokenNetworkJsonResponse(response, status, body) {
-    response.writeHead(status, {
-        'access-control-allow-headers': 'content-type',
-        'access-control-allow-methods': 'POST, OPTIONS',
-        'access-control-allow-origin': '*',
-        'access-control-allow-private-network': 'true',
-        'cache-control': 'no-store',
-        'content-type': 'application/json; charset=utf-8',
-    });
-    response.end(body === undefined ? '' : JSON.stringify(body));
-}
-function writeSerializedJsonResponse(response, status, body) {
-    response.writeHead(status, {
-        'content-type': 'application/json; charset=utf-8',
-        'cache-control': 'no-store',
-    });
-    response.end(body);
-}
-function isRecord$1(value) {
-    return Object.prototype.toString.call(value) === '[object Object]';
-}
-function isObjectLike(value) {
-    return (typeof value === 'object' || typeof value === 'function') && value !== null;
-}
-function createBrowserDevHostError(status, code, message) {
-    const error = new Error(message);
-    error.code = code;
-    error.status = status;
-    return error;
-}
-function readBrowserDevHostErrorStatus(error) {
-    return isObjectLike(error) && typeof error.status === 'number' ? error.status : 500;
-}
-function toBrowserDevHostErrorPayload(error) {
-    if (isObjectLike(error) && typeof error.code === 'string' && typeof error.message === 'string') {
-        return {
-            code: error.code,
-            message: error.message,
-        };
-    }
-    return {
-        code: 'BROWSER_DEV_HOST_NETWORK_ERROR',
-        message: readErrorMessage(error),
-    };
-}
-function readErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-
-/**
- * network.request 诊断日志的纯脱敏工具。
- *
- * @remarks
- * 放在 `core` 而非 `modules/network`：无错误类型依赖，供 SDK 错误文案、
- * modules observability、devtools Browser Dev Host / proxy 共用，并满足 boundary
- *（devtools 不得直接 import runtime capability modules）。
- */
-/** 敏感字段名：header / query / body key 共用。 */
-const SENSITIVE_KEY_PATTERN = /(authorization|cookie|password|passwd|secret|token|pkey|private[_-]?key|access[_-]?key|client[_-]?secret|api[_-]?key|apikey|session|jwt|refresh[_-]?token|csrf)/i;
-/**
- * 脱敏请求 URL：去掉 userinfo，并将 query / fragment 中的敏感参数值替换为 `[redacted]`。
- */
-function sanitizeNetworkRequestUrl(url) {
-    if (!url) {
-        return url;
-    }
-    try {
-        const parsed = new URL(url);
-        parsed.username = '';
-        parsed.password = '';
-        redactUrlSearchParams(parsed.searchParams);
-        if (parsed.hash && parsed.hash.length > 1) {
-            const hashBody = parsed.hash.slice(1);
-            if (hashBody.includes('=')) {
-                const hashParams = new URLSearchParams(hashBody);
-                if (redactUrlSearchParams(hashParams)) {
-                    parsed.hash = hashParams.toString();
-                }
-            }
-        }
-        return parsed.toString();
-    }
-    catch {
-        return redactSensitivePairsInRawText(url);
-    }
-}
-/**
- * 诊断 message 中的 URL 片段做脱敏，避免 error.message 二次泄漏 query secrets。
- */
-function sanitizeDiagnosticMessage(message) {
-    if (!message) {
-        return message;
-    }
-    return message.replace(/https?:\/\/[^\s]+/gi, matched => sanitizeNetworkRequestUrl(matched.replace(/[),.;]+$/g, '')));
-}
-function isSensitiveNetworkKey(key) {
-    return SENSITIVE_KEY_PATTERN.test(key.trim());
-}
-function redactUrlSearchParams(params) {
-    let changed = false;
-    for (const key of [...params.keys()]) {
-        if (isSensitiveNetworkKey(key)) {
-            params.set(key, '[redacted]');
-            changed = true;
-        }
-    }
-    return changed;
-}
-function redactSensitivePairsInRawText(text) {
-    return text.replace(/([?&#]|^|[?&])([^=&#\s]+)=([^&#\s]*)/g, (full, prefix, key, value) => {
-        if (!isSensitiveNetworkKey(key)) {
-            return full;
-        }
-        return `${prefix}${key}=[redacted]`;
-    });
-}
-
-const MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS = 5;
-const MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY = 2 * 1024 * 1024;
-const MAX_BROWSER_DEV_HOST_NETWORK_RESPONSE_BODY = 5 * 1024 * 1024;
-const DENIED_NETWORK_TARGETS = createDeniedNetworkTargets();
-const CREDENTIAL_HEADER_RE = /^(?:authentication-info|authorization|cookie|cookie2|proxy-authenticate|proxy-authentication-info|proxy-authorization|set-cookie|set-cookie2|www-authenticate|pkey|x-pkey|x-access-token|x-auth-token|x-api-key)$/i;
-async function handleBrowserDevHostNetworkProxy(request, response, fetchImpl, lookupHostname, options) {
-    const cors = options.cors === true;
-    if (request.method === 'OPTIONS') {
-        writeNetworkJsonResponse(response, 204, undefined, cors);
-        return;
-    }
-    if (request.method !== 'POST') {
-        writeNetworkJsonResponse(response, 405, {
-            code: 'METHOD_NOT_ALLOWED',
-            message: 'Browser Dev Host network proxy only supports POST',
-        }, cors);
-        return;
-    }
-    try {
-        const payload = await readJsonRequestBody(request);
-        const requestAbort = new AbortController();
-        if (request.aborted)
-            requestAbort.abort();
-        else
-            request.once('aborted', () => requestAbort.abort());
-        const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal);
-        if (typeof result.status === 'number' && (result.status < 200 || result.status >= 300)) {
-            logBrowserDevHostNetworkProxyDiagnostic('http_status', payload, result);
-        }
-        writeNetworkJsonResponse(response, 200, result, cors);
-    }
-    catch (error) {
-        logBrowserDevHostNetworkProxyDiagnostic('proxy_error', undefined, undefined, error);
-        writeNetworkJsonResponse(response, readBrowserDevHostErrorStatus(error), toBrowserDevHostErrorPayload(error), cors);
-    }
-}
-function logBrowserDevHostNetworkProxyDiagnostic(phase, payload, result, error) {
-    try {
-        const consoleRef = typeof console === 'undefined' ? undefined : console;
-        const logger = consoleRef?.warn || consoleRef?.error || consoleRef?.log;
-        if (!logger) {
-            return;
-        }
-        const detail = { phase };
-        if (isRecord$1(payload) && typeof payload.url === 'string') {
-            detail.url = sanitizeNetworkRequestUrl(payload.url);
-        }
-        if (isRecord$1(payload) && typeof payload.method === 'string') {
-            detail.method = payload.method;
-        }
-        if (typeof result?.status === 'number') {
-            detail.status = result.status;
-        }
-        if (result?.statusText) {
-            detail.statusText = result.statusText;
-        }
-        if (error instanceof Error) {
-            detail.message = sanitizeDiagnosticMessage(error.message);
-        }
-        else if (error !== undefined) {
-            detail.message = sanitizeDiagnosticMessage(readErrorMessage(error));
-        }
-        const summaryUrl = typeof detail.url === 'string' ? detail.url : '';
-        logger.call(consoleRef, '[hb-sdk][browser-dev-host][network]', `${phase}${summaryUrl ? ` ${summaryUrl}` : ''}`, detail);
-    }
-    catch {
-        // ignore diagnostic failures
-    }
-}
-function writeNetworkJsonResponse(response, status, body, cors) {
-    if (cors) {
-        writeTokenNetworkJsonResponse(response, status, body);
-        return;
-    }
-    writeJsonResponse(response, status, body);
-}
-const BROWSER_DEV_HOST_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE = 'network.request 不支持 multipart/form-data。App Host 客户端代发仅支持 application/x-www-form-urlencoded（form）与 application/json；请将 data 编码为 form 字符串（例如 new URLSearchParams({...}).toString()）并设置 Content-Type: application/x-www-form-urlencoded。文件上传请使用专用上传能力，勿手写 multipart boundary。';
-async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, allowedHttpOrigins, requestSignal) {
-    if (!isRecord$1(payload) || typeof payload.url !== 'string' || !payload.url.trim()) {
-        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是非空字符串');
-    }
-    const url = createBrowserDevHostNetworkUrl(payload.url, payload.params);
-    const method = typeof payload.method === 'string' && payload.method.trim() ? payload.method.trim().toUpperCase() : 'GET';
-    const headers = normalizeBrowserDevHostNetworkHeaders(payload.headers);
-    assertSupportedBrowserDevHostNetworkRequestShape(headers, payload.data);
-    const body = createBrowserDevHostNetworkBody(method, payload.data, headers);
-    const controller = new AbortController();
-    const onRequestAbort = () => controller.abort(requestSignal.reason);
-    requestSignal.addEventListener('abort', onRequestAbort, { once: true });
-    if (requestSignal.aborted)
-        onRequestAbort();
-    const timeout = Number(payload.timeout) > 0 ? Number(payload.timeout) : 10000;
-    const timer = setTimeout(() => controller.abort(), timeout);
-    const pinnedTargets = new Map();
-    const dispatcher = createPinnedNetworkDispatcher(pinnedTargets);
-    try {
-        const response = await fetchBrowserDevHostNetworkWithRedirects({
-            body,
-            dispatcher,
-            fetchImpl,
-            headers,
-            lookupHostname,
-            allowedHttpOrigins,
-            method,
-            pinnedTargets,
-            signal: controller.signal,
-            url,
-        });
-        const contentType = response.headers.get('content-type') || '';
-        const text = await readLimitedBrowserDevHostNetworkResponse(response);
-        return {
-            data: contentType.includes('application/json') ? safeJsonParse(text) : text,
-            status: response.status,
-            statusText: response.statusText,
-            headers: Object.fromEntries([...response.headers.entries()].filter(([name]) => !isCredentialHeader(name))),
-        };
-    }
-    catch (error) {
-        if (isObjectLike(error) && typeof error.status === 'number') {
-            throw error;
-        }
-        throw createBrowserDevHostError(502, 'BROWSER_DEV_HOST_NETWORK_REQUEST_FAILED', error instanceof Error && error.name === 'AbortError' ? `network.request timeout after ${timeout}ms` : readErrorMessage(error));
-    }
-    finally {
-        requestSignal.removeEventListener('abort', onRequestAbort);
-        clearTimeout(timer);
-        await dispatcher.close();
-    }
-}
-async function fetchBrowserDevHostNetworkWithRedirects(options) {
-    let url = options.url;
-    let method = options.method;
-    let body = options.body;
-    for (let redirectCount = 0; redirectCount <= MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS; redirectCount += 1) {
-        const pinnedTarget = await resolveBrowserDevHostNetworkTarget(url, options.lookupHostname, options.allowedHttpOrigins);
-        options.pinnedTargets.set(createPinnedNetworkTargetKey(url), pinnedTarget);
-        const response = await options.fetchImpl(url.toString(), {
-            body,
-            dispatcher: options.dispatcher,
-            headers: options.headers,
-            method,
-            redirect: 'manual',
-            signal: options.signal,
-        });
-        if (![301, 302, 303, 307, 308].includes(response.status)) {
-            return response;
-        }
-        const location = response.headers.get('location');
-        if (!location) {
-            return response;
-        }
-        if (redirectCount === MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS) {
-            throw createBrowserDevHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
-        }
-        await response.body?.cancel();
-        const redirectedUrl = new URL(location, url);
-        if (redirectedUrl.origin !== url.origin) {
-            throw createBrowserDevHostError(403, 'NETWORK_REDIRECT_DENIED', 'network.request 不允许跨 origin redirect');
-        }
-        url = redirectedUrl;
-        if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === 'POST')) {
-            method = 'GET';
-            body = undefined;
-        }
-    }
-    throw createBrowserDevHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
-}
-async function resolveBrowserDevHostNetworkTarget(url, lookupHostname, allowedHttpOrigins) {
-    if (!['http:', 'https:'].includes(url.protocol)) {
-        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request redirect 仅支持 HTTP(S) URL');
-    }
-    if (url.username || url.password) {
-        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request URL 不允许包含凭据');
-    }
-    if (url.protocol === 'http:' && !allowedHttpOrigins.has(url.origin)) {
-        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request HTTP 仅允许已声明的本地开发 origin');
-    }
-    const hostname = normalizeNetworkHostname(url.hostname);
-    const addressFamily = net.isIP(hostname);
-    const addresses = addressFamily ? [{ address: hostname, family: addressFamily }] : await lookupHostname(hostname);
-    if (!addresses.length) {
-        throw new Error('network.request target DNS lookup returned no addresses');
-    }
-    if (url.protocol === 'https:' && addresses.some(({ address, family }) => isDeniedNetworkAddress(address, family))) {
-        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request 目标地址不允许访问');
-    }
-    return addresses[0];
-}
-function createDeniedNetworkTargets() {
-    const list = new net.BlockList();
-    for (const [network, prefix] of [
-        ['0.0.0.0', 8],
-        ['10.0.0.0', 8],
-        ['100.64.0.0', 10],
-        ['127.0.0.0', 8],
-        ['169.254.0.0', 16],
-        ['172.16.0.0', 12],
-        ['192.0.0.0', 24],
-        ['192.0.2.0', 24],
-        ['192.168.0.0', 16],
-        ['198.18.0.0', 15],
-        ['198.51.100.0', 24],
-        ['203.0.113.0', 24],
-        ['224.0.0.0', 4],
-        ['240.0.0.0', 4],
-    ]) {
-        list.addSubnet(network, prefix, 'ipv4');
-    }
-    for (const [network, prefix] of [
-        ['::', 128],
-        ['::1', 128],
-        ['64:ff9b::', 96],
-        ['64:ff9b:1::', 48],
-        ['2001::', 32],
-        ['2001:10::', 28],
-        ['2001:20::', 28],
-        ['2001:db8::', 32],
-        ['2002::', 16],
-        ['fc00::', 7],
-        ['fe80::', 10],
-        ['ff00::', 8],
-    ]) {
-        list.addSubnet(network, prefix, 'ipv6');
-    }
-    return list;
-}
-function isDeniedNetworkAddress(address, family) {
-    const normalized = normalizeNetworkHostname(address);
-    if (family === 4 || net.isIP(normalized) === 4)
-        return DENIED_NETWORK_TARGETS.check(normalized, 'ipv4');
-    if (family === 6 || net.isIP(normalized) === 6) {
-        if (normalized.toLowerCase().startsWith('::ffff:'))
-            return true;
-        return DENIED_NETWORK_TARGETS.check(normalized, 'ipv6');
-    }
-    return true;
-}
-function isCredentialHeader(name) {
-    const normalized = name.trim().toLowerCase();
-    return CREDENTIAL_HEADER_RE.test(normalized) || normalized.startsWith('x-heybox-') || normalized.startsWith('x-xhh-');
-}
-function createPinnedNetworkDispatcher(pinnedTargets) {
-    const connect = undici.buildConnector({});
-    return new undici.Agent({
-        connect(options, callback) {
-            const hostname = normalizeNetworkHostname(options.hostname);
-            const target = pinnedTargets.get(`${options.protocol}//${hostname}:${options.port || (options.protocol === 'https:' ? '443' : '80')}`);
-            if (!target) {
-                callback(new Error('network.request target was not DNS-pinned'), null);
-                return;
-            }
-            connect({
-                ...options,
-                hostname: target.address,
-                servername: options.servername || hostname,
-            }, callback);
-        },
-    });
-}
-function createPinnedNetworkTargetKey(url) {
-    return `${url.protocol}//${normalizeNetworkHostname(url.hostname)}:${url.port || (url.protocol === 'https:' ? '443' : '80')}`;
-}
-function normalizeNetworkHostname(hostname) {
-    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
-}
-async function readLimitedBrowserDevHostNetworkResponse(response) {
-    if (!response.body) {
-        return '';
-    }
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done) {
-            break;
-        }
-        size += value.byteLength;
-        if (size > MAX_BROWSER_DEV_HOST_NETWORK_RESPONSE_BODY) {
-            await reader.cancel();
-            throw createBrowserDevHostError(502, 'NETWORK_RESPONSE_TOO_LARGE', 'network.request response body too large');
-        }
-        chunks.push(value);
-    }
-    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString('utf8');
-}
-function createBrowserDevHostNetworkUrl(input, params) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch {
-        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是合法 URL');
-    }
-    if (!['http:', 'https:'].includes(url.protocol)) {
-        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request 仅支持 HTTP(S) URL');
-    }
-    if (isRecord$1(params)) {
-        Object.entries(params).forEach(([key, value]) => {
-            if (value !== undefined && value !== null) {
-                url.searchParams.set(key, String(value));
-            }
-        });
-    }
-    return url;
-}
-function normalizeBrowserDevHostNetworkHeaders(headers) {
-    const normalized = new Headers();
-    if (!isRecord$1(headers)) {
-        return normalized;
-    }
-    Object.entries(headers).forEach(([key, value]) => {
-        if (isSensitiveBrowserDevHostNetworkHeader(key)) {
-            throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', `network.request 不允许设置敏感请求头: ${key}`);
-        }
-        if (typeof value === 'string' && !isBlockedBrowserDevHostNetworkHeader(key)) {
-            normalized.set(key, value);
-        }
-    });
-    return normalized;
-}
-function isSensitiveBrowserDevHostNetworkHeader(key) {
-    return ['authorization', 'cookie', 'proxy-authorization'].includes(key.toLowerCase());
-}
-function isBlockedBrowserDevHostNetworkHeader(key) {
-    return [
-        'connection',
-        'content-length',
-        'host',
-        'keep-alive',
-        'proxy-authenticate',
-        'proxy-authorization',
-        'te',
-        'trailer',
-        'transfer-encoding',
-        'upgrade',
-    ].includes(key.toLowerCase());
-}
-/**
- * 与 App Host 对齐：Mock 不再放行 multipart，避免“本地成功、上线失败”。
- */
-function assertSupportedBrowserDevHostNetworkRequestShape(headers, data) {
-    const contentType = headers.get('content-type') || '';
-    if (contentType.toLowerCase().includes('multipart/form-data') || looksLikeMultipartBody(data)) {
-        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', BROWSER_DEV_HOST_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE);
-    }
-}
-function looksLikeMultipartBody(data) {
-    if (typeof data !== 'string') {
-        return false;
-    }
-    const trimmed = data.trimStart();
-    return trimmed.startsWith('--') && /content-disposition\s*:\s*form-data/i.test(data);
-}
-function createBrowserDevHostNetworkBody(method, data, headers) {
-    if (data === undefined || method === 'GET' || method === 'HEAD') {
-        return undefined;
-    }
-    const body = typeof data === 'string' ? data : JSON.stringify(data);
-    if (Buffer.byteLength(body) > MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY) {
-        throw createBrowserDevHostError(413, 'REQUEST_ENTITY_TOO_LARGE', 'network.request data exceeds 2097152 bytes');
-    }
-    if (typeof data === 'string') {
-        return body;
-    }
-    if (!headers.has('content-type')) {
-        headers.set('content-type', 'application/json');
-    }
-    return body;
-}
-function safeJsonParse(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return text;
-    }
-}
-
-const DEV_SESSION_TTL_MS = 5 * 60 * 1000;
-const MAX_ACTIVE_DEV_SESSIONS = 64;
-const MAX_EXPIRED_DEV_SESSION_TOMBSTONES = 128;
-function createDevSessionRoutes(options) {
-    const devSessions = new Map();
-    const expiredDevSessions = new Set();
-    let revision = 0;
-    return {
-        match(pathname) {
-            const match = pathname.match(/^\/__hb_sdk__\/dev-context\/([a-f0-9]{64})(\/network)?$/);
-            if (!match) {
-                return undefined;
-            }
-            return {
-                kind: match[2] ? 'network' : 'context',
-                token: match[1],
-            };
-        },
-        async create(request, response) {
-            if (!request.headers['content-type']?.toLowerCase().startsWith('application/json')) {
-                writeJsonResponse(response, 400, { code: 'INVALID_DEV_SESSION', message: 'Dev Session body must be JSON' });
-                return;
-            }
-            try {
-                const payload = await readJsonRequestBody(request);
-                const validated = validateDevSessionCreatePayload(payload, options.allowedMiniUrlOrigins);
-                reapExpiredDevSessions(devSessions, expiredDevSessions, options.now());
-                revokeDevSessionForOrigin(devSessions, validated.miniUrlOrigin);
-                if (devSessions.size >= MAX_ACTIVE_DEV_SESSIONS) {
-                    throw createBrowserDevHostError(429, 'DEV_SESSION_LIMIT_REACHED', 'active Dev Session limit reached');
-                }
-                const expiresAt = options.now() + DEV_SESSION_TTL_MS;
-                const token = createDevSessionToken(devSessions);
-                const snapshot = {
-                    schema_version: MINI_PROGRAM_DEV_SESSION_SCHEMA_VERSION,
-                    revision: ++revision,
-                    expires_at: expiresAt,
-                    mini_url_origin: validated.miniUrlOrigin,
-                    runtime_permissions: validated.runtimePermissions,
-                };
-                devSessions.set(token, {
-                    expiresAt,
-                    miniUrlOrigin: validated.miniUrlOrigin,
-                    networkRequestEnabled: validated.networkRequestEnabled,
-                    serialized: JSON.stringify(snapshot),
-                });
-                const result = { expires_at: expiresAt, token };
-                writeJsonResponse(response, 201, result);
-            }
-            catch (error) {
-                const status = readBrowserDevHostErrorStatus(error);
-                writeJsonResponse(response, status === 500 ? 400 : status, {
-                    code: 'INVALID_DEV_SESSION',
-                    message: readErrorMessage(error),
-                });
-            }
-        },
-        async handle(route, request, response) {
-            if (route.kind === 'network') {
-                await handleTokenNetworkProxy(request, response, route.token, {
-                    devSessions,
-                    expiredDevSessions,
-                    fetchImpl: options.fetchImpl,
-                    lookupHostname: options.lookupHostname,
-                    now: options.now,
-                });
-                return;
-            }
-            if (request.method !== 'OPTIONS' && request.method !== 'GET') {
-                response.writeHead(405, { allow: 'GET', 'cache-control': 'no-store' });
-                response.end();
-                return;
-            }
-            const resolved = resolveDevSession(route.token, devSessions, expiredDevSessions, options.now());
-            if (resolved.status !== 200) {
-                writeDevSessionCorsResponse(response, resolved.status);
-                return;
-            }
-            writeDevSessionCorsResponse(response, request.method === 'OPTIONS' ? 204 : 200, request.method === 'GET' ? resolved.session.serialized : undefined);
-        },
-    };
-}
-function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
-    if (!isRecord$1(payload) || Object.keys(payload).some((key) => !['mini_url_origin', 'runtime_permissions'].includes(key))) {
-        throw new TypeError('Dev Session body is invalid');
-    }
-    if (typeof payload.mini_url_origin !== 'string') {
-        throw new TypeError('mini_url_origin is invalid');
-    }
-    let miniUrlOrigin;
-    try {
-        miniUrlOrigin = new URL(payload.mini_url_origin);
-    }
-    catch {
-        throw new TypeError('mini_url_origin is invalid');
-    }
-    if (miniUrlOrigin.protocol !== 'http:' ||
-        payload.mini_url_origin !== miniUrlOrigin.origin ||
-        !isPrivateLanIpv4(miniUrlOrigin.hostname) ||
-        !allowedMiniUrlOrigins.has(miniUrlOrigin.origin)) {
-        throw new TypeError('mini_url_origin must be an allowed LAN origin');
-    }
-    const parsedPermissions = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
-    if (!parsedPermissions.valid) {
-        throw new TypeError('runtime_permissions is invalid');
-    }
-    const networkPermission = parsedPermissions.permissions['network.request'];
-    if (networkPermission?.config.useOfficialDomain !== false) {
-        throw new TypeError('Dev Session does not allow official domains');
-    }
-    return {
-        miniUrlOrigin: miniUrlOrigin.origin,
-        networkRequestEnabled: networkPermission.status === 'enabled',
-        runtimePermissions: JSON.parse(JSON.stringify(payload.runtime_permissions)),
-    };
-}
-async function handleTokenNetworkProxy(request, response, token, runtime) {
-    const resolved = resolveDevSession(token, runtime.devSessions, runtime.expiredDevSessions, runtime.now());
-    if (resolved.status !== 200) {
-        writeTokenNetworkJsonResponse(response, resolved.status, undefined);
-        return;
-    }
-    if (!resolved.session.networkRequestEnabled) {
-        writeTokenNetworkJsonResponse(response, 403, {
-            code: 'PERMISSION_DENIED',
-            message: 'network.request is disabled for this Dev Session',
-        });
-        return;
-    }
-    if (request.method === 'OPTIONS') {
-        writeTokenNetworkJsonResponse(response, 204, undefined);
-        return;
-    }
-    if (request.method !== 'POST') {
-        writeTokenNetworkJsonResponse(response, 405, {
-            code: 'METHOD_NOT_ALLOWED',
-            message: 'Dev Session network proxy only supports POST',
-        });
-        return;
-    }
-    await handleBrowserDevHostNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname, {
-        allowedHttpOrigins: new Set([resolved.session.miniUrlOrigin]),
-        cors: true,
-    });
-}
-function resolveDevSession(token, devSessions, expiredDevSessions, now) {
-    const session = devSessions.get(token);
-    if (!session) {
-        return { status: expiredDevSessions.has(token) ? 410 : 404 };
-    }
-    if (now >= session.expiresAt) {
-        devSessions.delete(token);
-        addExpiredDevSessionTombstone(expiredDevSessions, token);
-        return { status: 410 };
-    }
-    return { session, status: 200 };
-}
-function reapExpiredDevSessions(devSessions, expiredDevSessions, now) {
-    for (const [token, session] of devSessions) {
-        if (now >= session.expiresAt) {
-            devSessions.delete(token);
-            addExpiredDevSessionTombstone(expiredDevSessions, token);
-        }
-    }
-}
-function addExpiredDevSessionTombstone(expiredDevSessions, token) {
-    expiredDevSessions.add(token);
-    while (expiredDevSessions.size > MAX_EXPIRED_DEV_SESSION_TOMBSTONES) {
-        const oldest = expiredDevSessions.values().next().value;
-        if (!oldest) {
-            break;
-        }
-        expiredDevSessions.delete(oldest);
-    }
-}
-function revokeDevSessionForOrigin(devSessions, miniUrlOrigin) {
-    for (const [token, session] of devSessions) {
-        if (session.miniUrlOrigin === miniUrlOrigin) {
-            devSessions.delete(token);
-        }
-    }
-}
-function createDevSessionToken(devSessions) {
-    let token;
-    do {
-        token = node_crypto.randomBytes(32).toString('hex');
-    } while (devSessions.has(token));
-    return token;
-}
-function isPrivateLanIpv4(hostname) {
-    const octets = hostname.split('.').map(Number);
-    if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-        return false;
-    }
-    return octets[0] === 10 || (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) || (octets[0] === 192 && octets[1] === 168);
-}
-function writeDevSessionCorsResponse(response, status, serializedBody) {
-    response.writeHead(status, {
-        'access-control-allow-methods': 'GET',
-        'access-control-allow-origin': '*',
-        'access-control-allow-private-network': 'true',
-        'cache-control': 'no-store',
-        ...(serializedBody === undefined ? {} : { 'content-type': 'application/json; charset=utf-8' }),
-    });
-    response.end(serializedBody ?? '');
-}
-
-const LOGIN_CLIENT = 'hb-sdk-browser-dev-host';
-const LOGIN_ENVIRONMENT = 'development';
-const LOGIN_CALLBACK_PATH = '/session/callback';
-const SESSION_COOKIE_NAME = 'hb_sdk_browser_dev_session';
-const LOGIN_INTENT_TTL_MS = 5 * 60 * 1000;
-const SESSION_TTL_MS = 8 * 60 * 60 * 1000;
-class BrowserDevSessionInvalidatedError extends Error {
-    code = 'BROWSER_DEV_SESSION_INVALIDATED';
-    constructor() {
-        super('Browser Dev Host session is no longer valid');
-        this.name = 'BrowserDevSessionInvalidatedError';
-    }
-}
-class BrowserDevSessionError extends Error {
-    status;
-    code;
-    constructor(status, code, message) {
-        super(message);
-        this.status = status;
-        this.code = code;
-        this.name = 'BrowserDevSessionError';
-    }
-}
-function createBrowserDevHostSessionController(options = {}) {
-    const now = options.now ?? Date.now;
-    const randomBytes = options.randomBytes ?? node_crypto.randomBytes;
-    const loginIntents = new Map();
-    const sessions = new Map();
-    const revisionListeners = new Set();
-    let revision = 0;
-    return {
-        csrfToken: createOpaqueValue(randomBytes, 32),
-        async createLoginIntent(input) {
-            const service = options.loginService;
-            if (!service) {
-                throw new BrowserDevSessionError(503, 'LOGIN_SERVICE_UNAVAILABLE', 'Browser Dev Host login service is unavailable');
-            }
-            reapExpiredState();
-            const state = createUniqueValue(loginIntents, randomBytes);
-            const verifier = createOpaqueValue(randomBytes, 32);
-            const redirectUri = `${normalizeOrigin(input.origin)}${LOGIN_CALLBACK_PATH}`;
-            const returnPath = normalizeReturnPath(input.returnPath);
-            const codeChallenge = node_crypto.createHash('sha256').update(verifier).digest('base64url');
-            loginIntents.set(state, {
-                expiresAt: now() + LOGIN_INTENT_TTL_MS,
-                redirectUri,
-                returnPath,
-                verifier,
-            });
-            try {
-                const result = await service.createAuthorizationUrl({
-                    client: LOGIN_CLIENT,
-                    codeChallenge,
-                    codeChallengeMethod: 'S256',
-                    environment: LOGIN_ENVIRONMENT,
-                    redirectUri,
-                    state,
-                });
-                const authorizationUrl = normalizeAuthorizationUrl(result.authorizationUrl, {
-                    codeChallenge,
-                    redirectUri,
-                    state,
-                });
-                return { authorizationUrl, state };
-            }
-            catch (error) {
-                loginIntents.delete(state);
-                if (error instanceof BrowserDevSessionError)
-                    throw error;
-                throw new BrowserDevSessionError(502, 'LOGIN_SERVICE_ERROR', 'Browser Dev Host login service failed');
-            }
-        },
-        async completeLogin(input) {
-            const service = options.loginService;
-            if (!service) {
-                throw new BrowserDevSessionError(503, 'LOGIN_SERVICE_UNAVAILABLE', 'Browser Dev Host login service is unavailable');
-            }
-            reapExpiredState();
-            const intent = loginIntents.get(input.state);
-            if (!intent || intent.redirectUri !== `${normalizeOrigin(input.origin)}${LOGIN_CALLBACK_PATH}`) {
-                throw new BrowserDevSessionError(400, 'INVALID_LOGIN_STATE', 'Browser Dev Host login state is invalid');
-            }
-            loginIntents.delete(input.state);
-            if (!input.code || input.code.length > 4096) {
-                throw new BrowserDevSessionError(400, 'INVALID_LOGIN_CODE', 'Browser Dev Host login code is invalid');
-            }
-            let exchanged;
-            try {
-                exchanged = await service.exchangeCode({
-                    client: LOGIN_CLIENT,
-                    code: input.code,
-                    codeVerifier: intent.verifier,
-                    environment: LOGIN_ENVIRONMENT,
-                    redirectUri: intent.redirectUri,
-                });
-            }
-            catch {
-                throw new BrowserDevSessionError(502, 'LOGIN_EXCHANGE_FAILED', 'Browser Dev Host login exchange failed');
-            }
-            const userId = normalizeUserId(exchanged.userId);
-            const credential = normalizeCredential(exchanged.credential);
-            const sessionId = createUniqueValue(sessions, randomBytes);
-            const expiresAt = now() + SESSION_TTL_MS;
-            const expiryTimer = setTimeout(() => {
-                if (sessions.delete(sessionId))
-                    broadcastRevision(revisionListeners, ++revision);
-            }, Math.max(0, expiresAt - now()));
-            expiryTimer.unref?.();
-            sessions.set(sessionId, {
-                credential,
-                expiresAt,
-                expiryTimer,
-                userId,
-            });
-            broadcastRevision(revisionListeners, ++revision);
-            return {
-                redirectPath: intent.returnPath,
-                setCookie: createSessionCookie(sessionId),
-            };
-        },
-        readStatus(cookieHeader) {
-            reapExpiredState();
-            const session = readSession(cookieHeader, sessions);
-            return session ? { authenticated: true, revision, userId: session.userId } : { authenticated: false, revision };
-        },
-        logout(cookieHeader) {
-            const sessionId = readSessionId(cookieHeader);
-            const session = sessionId ? sessions.get(sessionId) : undefined;
-            if (sessionId && session) {
-                clearTimeout(session.expiryTimer);
-                sessions.delete(sessionId);
-                broadcastRevision(revisionListeners, ++revision);
-            }
-            return { clearCookie: clearSessionCookie(), revision };
-        },
-        async request(cookieHeader, request, signal) {
-            const service = options.loginService;
-            const sessionId = readSessionId(cookieHeader);
-            const session = sessionId ? sessions.get(sessionId) : undefined;
-            if (!service || !session || now() >= session.expiresAt) {
-                if (sessionId && sessions.delete(sessionId))
-                    broadcastRevision(revisionListeners, ++revision);
-                throw new BrowserDevSessionError(401, 'SESSION_UNAUTHENTICATED', 'Browser Dev Host session is unauthenticated');
-            }
-            assertAuthenticatedRequest(request);
-            try {
-                const result = await service.request({ credential: session.credential, request, signal: signal ?? new AbortController().signal });
-                if (containsCredentialOrSensitiveResponse(result, session.credential)) {
-                    clearTimeout(session.expiryTimer);
-                    sessions.delete(sessionId);
-                    broadcastRevision(revisionListeners, ++revision);
-                    throw new BrowserDevSessionError(502, 'CREDENTIAL_EGRESS_BLOCKED', 'Browser Dev Host blocked a sensitive response');
-                }
-                return result;
-            }
-            catch (error) {
-                if (error instanceof BrowserDevSessionError)
-                    throw error;
-                if (error instanceof BrowserDevSessionInvalidatedError || readErrorCode(error) === 'BROWSER_DEV_SESSION_INVALIDATED') {
-                    clearTimeout(session.expiryTimer);
-                    sessions.delete(sessionId);
-                    broadcastRevision(revisionListeners, ++revision);
-                    throw new BrowserDevSessionError(401, 'SESSION_INVALIDATED', 'Browser Dev Host session was invalidated');
-                }
-                throw new BrowserDevSessionError(502, 'AUTHENTICATED_REQUEST_FAILED', 'Browser Dev Host authenticated request failed');
-            }
-        },
-        onAccountRevision(listener) {
-            revisionListeners.add(listener);
-            return () => revisionListeners.delete(listener);
-        },
-        dispose() {
-            loginIntents.clear();
-            for (const session of sessions.values())
-                clearTimeout(session.expiryTimer);
-            sessions.clear();
-            revisionListeners.clear();
-        },
-    };
-    function reapExpiredState() {
-        const removedSession = reapExpired(loginIntents, sessions, now());
-        if (removedSession)
-            broadcastRevision(revisionListeners, ++revision);
-    }
-}
-function createOpaqueValue(randomBytes, size) {
-    return randomBytes(size).toString('base64url');
-}
-function createUniqueValue(map, randomBytes) {
-    for (let attempt = 0; attempt < 8; attempt += 1) {
-        const value = createOpaqueValue(randomBytes, 32);
-        if (!map.has(value))
-            return value;
-    }
-    throw new BrowserDevSessionError(500, 'RANDOM_VALUE_COLLISION', 'Browser Dev Host could not allocate a random value');
-}
-function normalizeOrigin(value) {
-    const url = new URL(value);
-    if (url.origin !== value || url.protocol !== 'http:') {
-        throw new BrowserDevSessionError(400, 'INVALID_LOGIN_ORIGIN', 'Browser Dev Host login origin is invalid');
-    }
-    return url.origin;
-}
-function normalizeReturnPath(value) {
-    if (!value.startsWith('/') || value.startsWith('//') || value.includes('#') || /[\r\n]/.test(value)) {
-        throw new BrowserDevSessionError(400, 'INVALID_RETURN_PATH', 'Browser Dev Host login return path is invalid');
-    }
-    const url = new URL(value, 'http://127.0.0.1');
-    if (url.origin !== 'http://127.0.0.1' || url.pathname === LOGIN_CALLBACK_PATH) {
-        throw new BrowserDevSessionError(400, 'INVALID_RETURN_PATH', 'Browser Dev Host login return path is invalid');
-    }
-    return `${url.pathname}${url.search}`;
-}
-function normalizeAuthorizationUrl(value, expected) {
-    const url = new URL(value);
-    if (url.protocol !== 'https:' ||
-        [...url.searchParams.keys()].some(isSensitiveQueryKey) ||
-        url.searchParams.get('state') !== expected.state ||
-        url.searchParams.get('code_challenge') !== expected.codeChallenge ||
-        url.searchParams.get('code_challenge_method') !== 'S256' ||
-        url.searchParams.get('redirect_uri') !== expected.redirectUri ||
-        url.searchParams.get('client_id') !== LOGIN_CLIENT ||
-        url.searchParams.get('environment') !== LOGIN_ENVIRONMENT) {
-        throw new BrowserDevSessionError(502, 'INVALID_AUTHORIZATION_URL', 'Browser Dev Host authorization URL is invalid');
-    }
-    return url.toString();
-}
-function isSensitiveQueryKey(key) {
-    const normalized = key.toLowerCase().replaceAll('_', '-');
-    return (normalized === 'credential' ||
-        normalized === 'cookie' ||
-        normalized === 'pkey' ||
-        normalized === 'token' ||
-        normalized.endsWith('-token') ||
-        normalized === 'authorization');
-}
-function normalizeUserId(value) {
-    const userId = typeof value === 'string' ? value.trim() : '';
-    if (!userId || userId.length > 256) {
-        throw new BrowserDevSessionError(502, 'INVALID_LOGIN_USER', 'Browser Dev Host login user is invalid');
-    }
-    return userId;
-}
-function createSessionCookie(sessionId) {
-    return `${SESSION_COOKIE_NAME}=${sessionId}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${Math.floor(SESSION_TTL_MS / 1000)}`;
-}
-function clearSessionCookie() {
-    return `${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`;
-}
-function readSessionId(cookieHeader) {
-    if (!cookieHeader)
-        return undefined;
-    for (const item of cookieHeader.split(';')) {
-        const separator = item.indexOf('=');
-        if (separator < 0 || item.slice(0, separator).trim() !== SESSION_COOKIE_NAME)
-            continue;
-        const value = item.slice(separator + 1).trim();
-        return /^[A-Za-z0-9_-]{43}$/.test(value) ? value : undefined;
-    }
-    return undefined;
-}
-function readSession(cookieHeader, sessions) {
-    const sessionId = readSessionId(cookieHeader);
-    return sessionId ? sessions.get(sessionId) : undefined;
-}
-function reapExpired(loginIntents, sessions, now) {
-    let removedSession = false;
-    for (const [state, intent] of loginIntents)
-        if (now >= intent.expiresAt)
-            loginIntents.delete(state);
-    for (const [sessionId, session] of sessions) {
-        if (now >= session.expiresAt) {
-            clearTimeout(session.expiryTimer);
-            sessions.delete(sessionId);
-            removedSession = true;
-        }
-    }
-    return removedSession;
-}
-function assertAuthenticatedRequest(request) {
-    if (!request || typeof request !== 'object' || !request.target || typeof request.target !== 'object') {
-        throw new BrowserDevSessionError(400, 'INVALID_AUTHENTICATED_REQUEST', 'Browser Dev Host authenticated request is invalid');
-    }
-    const serialized = JSON.stringify(request);
-    if (serialized === undefined || serialized.length > 2 * 1024 * 1024) {
-        throw new BrowserDevSessionError(413, 'AUTHENTICATED_REQUEST_TOO_LARGE', 'Browser Dev Host authenticated request is too large');
-    }
-    if (containsSensitiveKey(request, new Set(), 0)) {
-        throw new BrowserDevSessionError(400, 'INVALID_AUTHENTICATED_REQUEST', 'Browser Dev Host authenticated request is invalid');
-    }
-}
-function containsCredentialOrSensitiveResponse(value, credential) {
-    if (value === credential)
-        return true;
-    if (typeof credential === 'string' && credential.length >= 8) {
-        try {
-            if (JSON.stringify(value)?.includes(credential))
-                return true;
-        }
-        catch {
-            return true;
-        }
-    }
-    return containsSensitiveKey(value, new Set(), 0);
-}
-function normalizeCredential(value) {
-    if (typeof value !== 'string' || value.length < 16 || value.length > 16 * 1024) {
-        throw new BrowserDevSessionError(502, 'INVALID_LOGIN_CREDENTIAL', 'Browser Dev Host login credential is invalid');
-    }
-    return value;
-}
-function containsSensitiveKey(value, seen, depth) {
-    if (depth > 16 || value === null || typeof value !== 'object')
-        return false;
-    if (seen.has(value))
-        return false;
-    seen.add(value);
-    if (Array.isArray(value))
-        return value.some((item) => containsSensitiveKey(item, seen, depth + 1));
-    for (const [key, child] of Object.entries(value)) {
-        const normalized = key.toLowerCase().replaceAll('_', '-');
-        if (normalized === 'credential' ||
-            normalized === 'cookie' ||
-            normalized === 'set-cookie' ||
-            normalized === 'pkey' ||
-            normalized === 'token' ||
-            normalized.endsWith('-token') ||
-            normalized === 'authorization') {
-            return true;
-        }
-        if (containsSensitiveKey(child, seen, depth + 1))
-            return true;
-    }
-    return false;
-}
-function readErrorCode(error) {
-    return typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
-}
-function broadcastRevision(listeners, revision) {
-    for (const listener of listeners) {
-        try {
-            listener(revision);
-        }
-        catch {
-            // 观察者失败不能阻断 vault 失效。
-        }
-    }
-}
-
-async function selectAvailablePort(options) {
-    const maxAttempts = options.maxAttempts ?? 20;
-    const port = await options.getPort({
-        host: options.host,
-        port: createPortCandidates(options.startPort, maxAttempts),
-    });
-    if (port < options.startPort || port >= options.startPort + maxAttempts) {
-        throw new Error(`无法找到可用 ${options.label} 端口，起始端口: ${options.startPort}`);
-    }
-    return port;
-}
-function createPortCandidates(startPort, count) {
-    return Array.from({ length: count }, (_, index) => startPort + index);
-}
-
-const MINI_PROGRAM_URL_QUERY_PARAM$1 = 'mini_url';
-const BROWSER_DEV_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
-const BROWSER_DEV_HOST_NETWORK_PATH = '/__hb_sdk__/network';
-const DEV_PERMISSIONS_PATH = '/__hb_sdk__/dev-permissions';
-const DEV_LISTEN_HOST$1 = '0.0.0.0';
-const LOCAL_DEV_URL_HOST$1 = '127.0.0.1';
-const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
-    path.resolve(__dirname, 'devtools/browser-dev-host'),
-    path.resolve(__dirname, '../devtools/browser-dev-host'),
-    path.resolve(__dirname, '../../devtools/browser-dev-host'),
-    path.resolve(__dirname, '../../../devtools/browser-dev-host'),
-];
-async function startBrowserDevHostServer(options) {
-    const root = options.root ?? resolveBrowserDevHostRoot(options.rootCandidates);
-    assertCompleteMiniProgramBrowserDevHostRoot(root);
-    const sessionController = createBrowserDevHostSessionController({
-        loginService: options.loginService,
-        now: options.now,
-    });
-    const bootstrap = {
-        csrfToken: sessionController.csrfToken,
-        defaultLanAddressId: options.defaultLanAddressId,
-        devContext: options.devContext,
-        lanAddresses: options.lanAddresses ?? [],
-        loginAvailable: options.loginService !== undefined,
-        macAppProtocol: options.macAppProtocol,
-        nativeAppLaunchUnavailableReason: options.nativeAppLaunchUnavailableReason,
-        runtimePermissions: options.runtimePermissions,
-    };
-    let bootstrapJson = serializeBrowserDevHostBootstrap(bootstrap);
-    const serverRuntime = createBrowserDevHostServer(root, {
-        appUrl: options.appUrl,
-        allowedMiniUrlOrigins: new Set((options.lanAddresses ?? []).map(({ appUrl }) => new URL(appUrl).origin)),
-        readBootstrapJson: () => bootstrapJson,
-        fetchImpl: options.fetchImpl ?? fetch,
-        isLoopbackPeer: options.isLoopbackPeer ?? isLoopbackAddress,
-        lookupHostname: options.lookupHostname ?? (async (hostname) => promises.lookup(hostname, { all: true, verbatim: true })),
-        now: options.now ?? Date.now,
-        permissionController: options.permissionController,
-        sessionController,
-    });
-    const server = serverRuntime.server;
-    const port = await listenHttpServer(server, {
-        port: options.port,
-    }, options.getPort ?? getPorts);
-    return {
-        close: () => new Promise((resolve) => {
-            serverRuntime.dispose();
-            server.close(() => resolve());
-        }),
-        updateBootstrap: (next) => {
-            if (next.devContext !== undefined)
-                bootstrap.devContext = next.devContext;
-            if (next.lanAddresses !== undefined)
-                bootstrap.lanAddresses = next.lanAddresses;
-            if (next.macAppProtocol === null)
-                delete bootstrap.macAppProtocol;
-            else if (next.macAppProtocol !== undefined)
-                bootstrap.macAppProtocol = next.macAppProtocol;
-            bootstrapJson = serializeBrowserDevHostBootstrap(bootstrap);
-        },
-        networkUrls: createBrowserDevHostNetworkUrls({
-            appUrl: options.appUrl,
-            lanAddresses: options.lanAddresses,
-            port,
-        }),
-        port,
-        root,
-        server,
-        url: createBrowserDevHostUrlWithHost({
-            appUrl: options.appUrl,
-            host: LOCAL_DEV_URL_HOST$1,
-            port,
-        }),
-    };
-}
-function resolveBrowserDevHostRoot(candidates = BROWSER_DEV_HOST_ROOT_CANDIDATES) {
-    const found = candidates.find(isCompleteMiniProgramBrowserDevHostRoot);
-    if (!found) {
-        throw createMissingBrowserDevHostError();
-    }
-    return found;
-}
-function assertCompleteMiniProgramBrowserDevHostRoot(root) {
-    if (!isCompleteMiniProgramBrowserDevHostRoot(root)) {
-        throw createMissingBrowserDevHostError();
-    }
-}
-function isCompleteMiniProgramBrowserDevHostRoot(root) {
-    return fs.existsSync(path.join(root, 'index.html')) && fs.existsSync(path.join(root, 'main.js'));
-}
-function createMissingBrowserDevHostError() {
-    return new Error('未找到完整的 hb-sdk browser dev host 静态产物。请先执行 @heybox/hb-sdk 的 build:browser-dev-host。');
-}
-function createBrowserDevHostNetworkUrls(options) {
-    return (options.lanAddresses ?? []).map((address) => createBrowserDevHostUrlWithHost({
-        appUrl: address.appUrl,
-        host: address.address,
-        port: options.port,
-    }));
-}
-function createBrowserDevHostUrlWithHost(options) {
-    const url = new URL(`http://${options.host}:${options.port}/`);
-    url.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM$1, options.appUrl);
-    return url.toString();
-}
-function serializeBrowserDevHostBootstrap(bootstrap) {
-    const serialized = JSON.stringify(bootstrap);
-    if (serialized === undefined) {
-        throw new TypeError('Browser Dev Host bootstrap must be JSON serializable');
-    }
-    const serializedBootstrap = JSON.parse(serialized);
-    if (bootstrap.runtimePermissions !== undefined && !Object.prototype.hasOwnProperty.call(serializedBootstrap, 'runtimePermissions')) {
-        throw new TypeError('Runtime permission snapshot must be JSON serializable');
-    }
-    return serialized;
-}
-function createBrowserDevHostServer(root, runtime) {
-    const devSessionRoutes = createDevSessionRoutes({
-        allowedMiniUrlOrigins: runtime.allowedMiniUrlOrigins,
-        fetchImpl: runtime.fetchImpl,
-        lookupHostname: runtime.lookupHostname,
-        now: runtime.now,
-    });
-    const eventStreams = new Set();
-    const unsubscribeRevision = runtime.sessionController.onAccountRevision((revision) => {
-        const data = JSON.stringify({ revision });
-        for (const stream of eventStreams)
-            stream.write(`event: account-invalidated\ndata: ${data}\n\n`);
-    });
-    const server = node_http.createServer(async (request, response) => {
-        const loopbackPeer = runtime.isLoopbackPeer(request.socket.remoteAddress);
-        let requestUrl;
-        try {
-            requestUrl = new URL(request.url, 'http://localhost');
-        }
-        catch {
-            writeBadRequest(response);
-            return;
-        }
-        // LAN 只允许固定 token 路由；在任何 URI decode 前先完成窄匹配。
-        if (!loopbackPeer && !devSessionRoutes.match(requestUrl.pathname)) {
-            writeForbidden(response);
-            return;
-        }
-        let pathname;
-        try {
-            pathname = decodeURIComponent(requestUrl.pathname);
-        }
-        catch {
-            writeBadRequest(response);
-            return;
-        }
-        const devSessionRoute = devSessionRoutes.match(pathname);
-        // Dev Session 需要允许手机局域网访问；其余 Browser Dev Host 页面仍限制本机。
-        if (!loopbackPeer && !devSessionRoute) {
-            writeForbidden(response);
-            return;
-        }
-        if (isBrowserDevHostDocumentPath(pathname) && !requestUrl.searchParams.has(MINI_PROGRAM_URL_QUERY_PARAM$1)) {
-            const targetUrl = new URL(requestUrl);
-            targetUrl.pathname = '/';
-            targetUrl.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM$1, runtime.appUrl);
-            response.writeHead(302, {
-                location: `${targetUrl.pathname}${targetUrl.search}`,
-                'cache-control': 'no-store',
-            });
-            response.end();
-            return;
-        }
-        if (pathname === BROWSER_DEV_HOST_BOOTSTRAP_PATH) {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
-                writeForbidden(response);
-                return;
-            }
-            if (request.method !== 'GET') {
-                writeMethodNotAllowed(response, 'GET');
-                return;
-            }
-            writeSerializedJsonResponse(response, 200, runtime.readBootstrapJson());
-            return;
-        }
-        if (pathname === '/session/status') {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
-                writeForbidden(response);
-                return;
-            }
-            if (request.method !== 'GET') {
-                writeMethodNotAllowed(response, 'GET');
-                return;
-            }
-            const status = runtime.sessionController.readStatus(request.headers.cookie);
-            writeJsonResponse(response, 200, {
-                authenticated: status.authenticated,
-                revision: status.revision,
-                ...(status.authenticated ? { user_id: status.userId } : {}),
-            });
-            return;
-        }
-        if (pathname === '/session/login-intent') {
-            if (!isValidSensitiveRequest(request, loopbackPeer, runtime.sessionController.csrfToken) || request.method !== 'POST') {
-                if (request.method !== 'POST')
-                    writeMethodNotAllowed(response, 'POST');
-                else
-                    writeForbidden(response);
-                return;
-            }
-            await handleLoginIntent(request, response, runtime.sessionController);
-            return;
-        }
-        if (pathname === '/session/callback') {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
-                writeForbidden(response);
-                return;
-            }
-            if (request.method !== 'GET') {
-                writeMethodNotAllowed(response, 'GET');
-                return;
-            }
-            await handleLoginCallback(request, response, requestUrl, runtime.sessionController);
-            return;
-        }
-        if (pathname === '/session/logout') {
-            if (!isValidSensitiveRequest(request, loopbackPeer, runtime.sessionController.csrfToken) || request.method !== 'POST') {
-                if (request.method !== 'POST')
-                    writeMethodNotAllowed(response, 'POST');
-                else
-                    writeForbidden(response);
-                return;
-            }
-            const result = runtime.sessionController.logout(request.headers.cookie);
-            response.setHeader('set-cookie', result.clearCookie);
-            writeJsonResponse(response, 200, { revision: result.revision });
-            return;
-        }
-        if (pathname === '/session/request') {
-            if (!isValidSensitiveRequest(request, loopbackPeer, runtime.sessionController.csrfToken) || request.method !== 'POST') {
-                if (request.method !== 'POST')
-                    writeMethodNotAllowed(response, 'POST');
-                else
-                    writeForbidden(response);
-                return;
-            }
-            await handleAuthenticatedRequest(request, response, runtime.sessionController);
-            return;
-        }
-        if (pathname === '/session/events') {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
-                writeForbidden(response);
-                return;
-            }
-            if (request.method !== 'GET') {
-                writeMethodNotAllowed(response, 'GET');
-                return;
-            }
-            const status = runtime.sessionController.readStatus(request.headers.cookie);
-            if (!status.authenticated) {
-                writeJsonResponse(response, 401, { code: 'SESSION_UNAUTHENTICATED' });
-                return;
-            }
-            response.writeHead(200, {
-                'cache-control': 'no-store',
-                connection: 'keep-alive',
-                'content-type': 'text/event-stream; charset=utf-8',
-                'x-accel-buffering': 'no',
-            });
-            response.write(`event: account-revision\ndata: ${JSON.stringify({ revision: status.revision })}\n\n`);
-            eventStreams.add(response);
-            request.once('close', () => eventStreams.delete(response));
-            return;
-        }
-        if (pathname === DEV_PERMISSIONS_PATH && runtime.permissionController) {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
-                writeForbidden(response);
-                return;
-            }
-            if (request.method === 'GET') {
-                writeJsonResponse(response, 200, await runtime.permissionController.get());
-                return;
-            }
-            if ((request.method !== 'PUT' && request.method !== 'DELETE') ||
-                !hasValidMutationOrigin(request) ||
-                !hasValidCsrf(request, runtime.sessionController.csrfToken)) {
-                if (request.method !== 'PUT' && request.method !== 'DELETE') {
-                    writeMethodNotAllowed(response, 'GET, PUT, DELETE');
-                }
-                else {
-                    writeForbidden(response);
-                }
-                return;
-            }
-            await handleDevPermissionMutation(request, response, runtime.permissionController);
-            return;
-        }
-        if (pathname === MINI_PROGRAM_DEV_CONTEXT_PATH) {
-            if (request.method !== 'POST') {
-                writeMethodNotAllowed(response, 'POST');
-                return;
-            }
-            if (!loopbackPeer ||
-                !hasNumericLoopbackHost(request) ||
-                !hasValidMutationOrigin(request) ||
-                !hasValidCsrf(request, runtime.sessionController.csrfToken)) {
-                writeForbidden(response);
-                return;
-            }
-            await devSessionRoutes.create(request, response);
-            return;
-        }
-        if (devSessionRoute) {
-            await devSessionRoutes.handle(devSessionRoute, request, response);
-            return;
-        }
-        if (pathname === BROWSER_DEV_HOST_NETWORK_PATH) {
-            const csrfValid = request.method !== 'POST' || hasValidCsrf(request, runtime.sessionController.csrfToken);
-            if (!loopbackPeer || !hasNumericLoopbackHost(request) || !hasValidMutationOrigin(request) || !csrfValid) {
-                writeForbidden(response);
-                return;
-            }
-            await handleBrowserDevHostNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname, {
-                allowedHttpOrigins: new Set([runtime.appUrl, ...runtime.allowedMiniUrlOrigins].map((value) => new URL(value).origin)),
-            });
-            return;
-        }
-        const targetPath = resolveStaticPath(root, pathname);
-        if (!targetPath) {
-            response.writeHead(404);
-            response.end('Not found');
-            return;
-        }
-        try {
-            const stat = fs.statSync(targetPath);
-            if (stat.isDirectory()) {
-                response.writeHead(404);
-                response.end('Not found');
-                return;
-            }
-            response.writeHead(200, {
-                'content-type': readContentType(targetPath),
-                'cache-control': 'no-store',
-            });
-            fs.createReadStream(targetPath).pipe(response);
-        }
-        catch {
-            response.writeHead(404);
-            response.end('Not found');
-        }
-    });
-    return {
-        server,
-        dispose() {
-            unsubscribeRevision();
-            for (const stream of eventStreams)
-                stream.end();
-            eventStreams.clear();
-            runtime.sessionController.dispose();
-        },
-    };
-}
-async function handleLoginIntent(request, response, controller) {
-    try {
-        const payload = await readJsonRequestBody(request);
-        if (!isRecord$1(payload) || Object.keys(payload).some((key) => key !== 'return_path') || typeof payload.return_path !== 'string') {
-            throw new BrowserDevSessionError(400, 'INVALID_LOGIN_INTENT', 'Browser Dev Host login intent is invalid');
-        }
-        const result = await controller.createLoginIntent({
-            origin: readRequestOrigin(request),
-            returnPath: payload.return_path,
-        });
-        writeJsonResponse(response, 201, { authorization_url: result.authorizationUrl });
-    }
-    catch (error) {
-        writeSessionError(response, error);
-    }
-}
-async function handleLoginCallback(request, response, requestUrl, controller) {
-    try {
-        const keys = [...requestUrl.searchParams.keys()];
-        if (keys.some((key) => key !== 'code' && key !== 'state')) {
-            throw new BrowserDevSessionError(400, 'INVALID_LOGIN_CALLBACK', 'Browser Dev Host login callback is invalid');
-        }
-        const code = requestUrl.searchParams.get('code');
-        const state = requestUrl.searchParams.get('state');
-        if (!code || !state) {
-            throw new BrowserDevSessionError(400, 'INVALID_LOGIN_CALLBACK', 'Browser Dev Host login callback is invalid');
-        }
-        const result = await controller.completeLogin({
-            code,
-            origin: readRequestOrigin(request),
-            state,
-        });
-        response.writeHead(302, {
-            'cache-control': 'no-store',
-            location: result.redirectPath,
-            'referrer-policy': 'no-referrer',
-            'set-cookie': result.setCookie,
-        });
-        response.end();
-    }
-    catch (error) {
-        response.writeHead(302, {
-            'cache-control': 'no-store',
-            location: '/',
-            'referrer-policy': 'no-referrer',
-        });
-        response.end();
-    }
-}
-async function handleAuthenticatedRequest(request, response, controller) {
-    const abort = new AbortController();
-    request.once('aborted', () => abort.abort());
-    try {
-        const payload = await readJsonRequestBody(request);
-        const result = await controller.request(request.headers.cookie, payload, abort.signal);
-        writeJsonResponse(response, 200, result);
-    }
-    catch (error) {
-        writeSessionError(response, error);
-    }
-}
-function writeSessionError(response, error) {
-    const sessionError = error instanceof BrowserDevSessionError
-        ? error
-        : new BrowserDevSessionError(500, 'BROWSER_DEV_SESSION_ERROR', 'Browser Dev Host session request failed');
-    writeJsonResponse(response, sessionError.status, {
-        code: sessionError.code,
-        message: sessionError.message,
-    });
-}
-function readRequestOrigin(request) {
-    const host = request.headers.host;
-    if (!host)
-        throw new BrowserDevSessionError(400, 'INVALID_LOGIN_ORIGIN', 'Browser Dev Host login origin is invalid');
-    return `http://${host}`;
-}
-function isValidSensitiveRequest(request, loopbackPeer, csrfToken) {
-    return loopbackPeer && hasNumericLoopbackHost(request) && hasValidMutationOrigin(request) && hasValidCsrf(request, csrfToken);
-}
-function hasValidCsrf(request, csrfToken) {
-    const value = request.headers['x-hb-sdk-csrf'];
-    return typeof value === 'string' && value === csrfToken;
-}
-async function handleDevPermissionMutation(request, response, controller) {
-    try {
-        if (request.method === 'DELETE') {
-            if (hasRequestBody(request)) {
-                if (!request.headers['content-type']?.toLowerCase().startsWith('application/json')) {
-                    throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
-                }
-                const payload = await readJsonRequestBody(request);
-                if (!isRecord$1(payload) || Object.keys(payload).length > 0) {
-                    throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions reset body is invalid');
-                }
-            }
-            writeJsonResponse(response, 200, await controller.reset());
-            return;
-        }
-        if (!request.headers['content-type']?.toLowerCase().startsWith('application/json')) {
-            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
-        }
-        const payload = await readJsonRequestBody(request);
-        if (!isRecord$1(payload) || Object.keys(payload).length !== 1 || !Object.hasOwn(payload, 'runtime_permissions')) {
-            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions update body is invalid');
-        }
-        const parsed = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
-        if (!parsed.valid) {
-            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'runtime_permissions is invalid');
-        }
-        const runtimePermissions = JSON.parse(JSON.stringify(payload.runtime_permissions));
-        writeJsonResponse(response, 200, await controller.save(runtimePermissions));
-    }
-    catch (error) {
-        const errorStatus = readBrowserDevHostErrorStatus(error);
-        const status = request.method === 'DELETE' && errorStatus === 500 ? 502 : errorStatus;
-        writeJsonResponse(response, status, {
-            code: request.method === 'DELETE' ? 'DEV_PERMISSIONS_RESET_FAILED' : 'DEV_PERMISSIONS_UPDATE_FAILED',
-            message: readErrorMessage(error),
-        });
-    }
-}
-function hasRequestBody(request) {
-    return request.headers['transfer-encoding'] !== undefined || Number(request.headers['content-length'] ?? 0) > 0;
-}
-function writeMethodNotAllowed(response, allowedMethod) {
-    response.writeHead(405, {
-        allow: allowedMethod,
-        'cache-control': 'no-store',
-    });
-    response.end();
-}
-function writeForbidden(response) {
-    response.writeHead(403, { 'cache-control': 'no-store' });
-    response.end();
-}
-function writeBadRequest(response) {
-    response.writeHead(400, { 'cache-control': 'no-store' });
-    response.end();
-}
-function hasValidMutationOrigin(request) {
-    const origin = request.headers.origin;
-    const host = request.headers.host;
-    if (!host || !origin || origin === 'null') {
-        return false;
-    }
-    try {
-        return new URL(origin).origin === `http://${host}`;
-    }
-    catch {
-        return false;
-    }
-}
-function hasNumericLoopbackHost(request) {
-    const host = request.headers.host;
-    if (!host) {
-        return false;
-    }
-    try {
-        const hostname = new URL(`http://${host}`).hostname;
-        const normalized = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
-        return net.isIP(normalized) !== 0 && isLoopbackAddress(normalized);
-    }
-    catch {
-        return false;
-    }
-}
-function isLoopbackAddress(address) {
-    return address === '::1' || address === '127.0.0.1' || address?.startsWith('127.') === true || address?.startsWith('::ffff:127.') === true;
-}
-function isBrowserDevHostDocumentPath(pathname) {
-    return pathname === '/' || pathname === '/index.html';
-}
-function resolveStaticPath(root, pathname) {
-    const safePathname = pathname === '/' ? '/index.html' : pathname;
-    const normalizedRoot = path.normalize(root);
-    const targetPath = path.normalize(path.join(normalizedRoot, safePathname));
-    if (targetPath !== normalizedRoot && !targetPath.startsWith(`${normalizedRoot}${path.sep}`)) {
-        return undefined;
-    }
-    return targetPath;
-}
-function readContentType(filePath) {
-    if (filePath.endsWith('.html')) {
-        return 'text/html; charset=utf-8';
-    }
-    if (filePath.endsWith('.js')) {
-        return 'text/javascript; charset=utf-8';
-    }
-    if (filePath.endsWith('.css')) {
-        return 'text/css; charset=utf-8';
-    }
-    if (filePath.endsWith('.json')) {
-        return 'application/json; charset=utf-8';
-    }
-    if (filePath.endsWith('.svg')) {
-        return 'image/svg+xml';
-    }
-    return 'application/octet-stream';
-}
-async function listenHttpServer(server, options, getPortImpl) {
-    const port = await selectAvailablePort({
-        getPort: getPortImpl,
-        host: DEV_LISTEN_HOST$1,
-        label: 'browser dev host',
-        startPort: options.port,
-    });
-    await new Promise((resolve, reject) => {
-        const onError = (error) => {
-            server.off('listening', onListening);
-            reject(error);
-        };
-        const onListening = () => {
-            server.off('error', onError);
-            resolve();
-        };
-        server.once('error', onError);
-        server.once('listening', onListening);
-        server.listen(port, DEV_LISTEN_HOST$1);
-    });
-    const address = server.address();
-    return address.port;
-}
-
-const MINI_PROGRAM_URL_QUERY_PARAM = 'mini_url';
-const MINI_PROGRAM_RUNTIME_URL_QUERY_PARAM = 'runtime_url';
-const MINI_PROGRAM_SDK_VERSION_QUERY_PARAM = 'sdk_version';
-const MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM = 'local_dev_launch_token';
-const MINI_PROGRAM_DEV_SHELL_URL = 'heybox-mini-dev://sandbox';
-const OPEN_IN_APP_URL = 'https://api.xiaoheihe.cn/open_inapp/';
-function createMacAppProtocol(appUrl, options = {}) {
-    return createHeyboxProtocol(createMiniProgramDevShellOpenWindowPayload(appUrl, options));
-}
-function createMobileAppQrPayload(appUrl, options = {}) {
-    const protocol = createHeyboxProtocol(createMiniProgramDevShellOpenWindowPayload(appUrl, { ...options, encodeMiniUrl: false }));
-    return options.bareProtocol ? protocol : `${OPEN_IN_APP_URL}#${protocol}`;
-}
-function createMiniProgramDevShellOpenWindowPayload(appUrl, options = {}) {
-    const devShellUrl = options.encodeMiniUrl === false
-        ? createPartiallyEncodedMiniProgramDevShellUrl(appUrl, options)
-        : createEncodedMiniProgramDevShellUrl(appUrl, options);
-    const miniProgramId = options.miniProgramId?.trim();
-    return {
-        protocol_type: 'openWindow',
-        full_screen: true,
-        mini_program: '1',
-        ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
-        navigation_bar: {
-            title: '',
-        },
-        webview: {
-            url: devShellUrl,
-            pull: false,
-            refresh: false,
-        },
-    };
-}
-function createPartiallyEncodedMiniProgramDevShellUrl(appUrl, options) {
-    let devShellUrl = `${MINI_PROGRAM_DEV_SHELL_URL}?${MINI_PROGRAM_URL_QUERY_PARAM}=${appUrl}`;
-    const miniProgramId = options.miniProgramId?.trim();
-    if (miniProgramId) {
-        devShellUrl += `&mini_program_id=${encodeURIComponent(miniProgramId)}`;
-    }
-    const localDevLaunchToken = options.localDevLaunchToken?.trim();
-    if (localDevLaunchToken) {
-        devShellUrl += `&${MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM}=${encodeURIComponent(localDevLaunchToken)}`;
-    }
-    if (hasRuntimeUrl(options.runtimeUrl)) {
-        const runtimeUrl = buildRuntimeUrlWithLaunchParams(options.runtimeUrl, appUrl, options);
-        devShellUrl += `&${MINI_PROGRAM_RUNTIME_URL_QUERY_PARAM}=${encodeURIComponent(runtimeUrl)}`;
-    }
-    const sdkVersion = options.sdkVersion?.trim();
-    if (sdkVersion) {
-        devShellUrl += `&${MINI_PROGRAM_SDK_VERSION_QUERY_PARAM}=${encodeURIComponent(sdkVersion)}`;
-    }
-    return devShellUrl;
-}
-function createEncodedMiniProgramDevShellUrl(appUrl, options) {
-    const devShellUrl = new URL(MINI_PROGRAM_DEV_SHELL_URL);
-    devShellUrl.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM, appUrl);
-    const miniProgramId = options.miniProgramId?.trim();
-    if (miniProgramId) {
-        devShellUrl.searchParams.set('mini_program_id', miniProgramId);
-    }
-    const localDevLaunchToken = options.localDevLaunchToken?.trim();
-    if (localDevLaunchToken) {
-        devShellUrl.searchParams.set(MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM, localDevLaunchToken);
-    }
-    if (hasRuntimeUrl(options.runtimeUrl)) {
-        devShellUrl.searchParams.set(MINI_PROGRAM_RUNTIME_URL_QUERY_PARAM, buildRuntimeUrlWithLaunchParams(options.runtimeUrl, appUrl, options));
-    }
-    const sdkVersion = options.sdkVersion?.trim();
-    if (sdkVersion) {
-        devShellUrl.searchParams.set(MINI_PROGRAM_SDK_VERSION_QUERY_PARAM, sdkVersion);
-    }
-    return devShellUrl.toString();
-}
-function hasRuntimeUrl(runtimeUrl) {
-    return runtimeUrl !== undefined && runtimeUrl !== '';
-}
-/**
- * 客户端加载 runtime_url 时，常只打开该 URL 本身，不会把 sandbox 上的 mini_url 再拼进去。
- * 电脑浏览器手开 detail 能成功，是因为 URL 上已经带了 mini_url。
- * 因此 HTTP(S) runtime host 需要在 runtime_url 内预置启动参数。
- */
-function buildRuntimeUrlWithLaunchParams(runtimeUrl, appUrl, options) {
-    try {
-        const url = new URL(runtimeUrl);
-        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-            return runtimeUrl;
-        }
-        url.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM, appUrl);
-        const miniProgramId = options.miniProgramId?.trim();
-        if (miniProgramId) {
-            url.searchParams.set('mini_program_id', miniProgramId);
-        }
-        const localDevLaunchToken = options.localDevLaunchToken?.trim();
-        if (localDevLaunchToken) {
-            url.searchParams.set(MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM, localDevLaunchToken);
-        }
-        const sdkVersion = options.sdkVersion?.trim();
-        if (sdkVersion) {
-            url.searchParams.set(MINI_PROGRAM_SDK_VERSION_QUERY_PARAM, sdkVersion);
-        }
-        return url.toString();
-    }
-    catch {
-        return runtimeUrl;
-    }
-}
-function createHeyboxProtocol(payload) {
-    return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
-}
-
-/** 构建时替换为当前发布包的实际版本。 */
-const HB_SDK_VERSION = typeof undefined === 'string'
-    ? undefined
-    : '0.7.4-alpha.5';
-
-class DevPermissionOverrideStoreError extends Error {
-    code;
-    constructor(message, code, options = {}) {
-        super(message, { cause: options.cause });
-        this.code = code;
-        this.name = 'DevPermissionOverrideStoreError';
-    }
-}
-const CACHE_VERSION = 1;
-const CACHE_DIRECTORY_NAME = 'dev-permission-overrides';
-const defaultPaths = index.envPaths('hb-sdk', { suffix: '' });
-function createDevPermissionOverrideStore(options = {}) {
-    const cacheDirectory = path.join(options.cacheRoot ?? defaultPaths.cache, CACHE_DIRECTORY_NAME);
-    return {
-        async read(scope) {
-            return readScopeFile(await getScopeFile(cacheDirectory, scope));
-        },
-        async remove(scope) {
-            const scopeFile = await getScopeFile(cacheDirectory, scope);
-            try {
-                await fs$1.unlink(scopeFile);
-            }
-            catch (error) {
-                if (isNodeError(error) && error.code === 'ENOENT') {
-                    return;
-                }
-                throw createWriteError(error);
-            }
-        },
-        async set(scope, overrides) {
-            const scopeFile = await getScopeFile(cacheDirectory, scope);
-            try {
-                await fs$1.mkdir(cacheDirectory, { recursive: true, mode: 0o700 });
-                await fs$1.chmod(cacheDirectory, 0o700);
-                await readScopeFile(scopeFile);
-                await writeScopeFileAtomically(scopeFile, {
-                    version: CACHE_VERSION,
-                    overrides: cloneOverrides(overrides),
-                });
-            }
-            catch (error) {
-                if (error instanceof DevPermissionOverrideStoreError) {
-                    throw error;
-                }
-                throw createWriteError(error);
-            }
-        },
-    };
-}
-async function getScopeFile(cacheDirectory, scope) {
-    const projectRoot = await fs$1.realpath(scope.projectRoot);
-    const miniProgramId = scope.miniProgramId ?? 'anonymous';
-    const scopeHash = node_crypto.createHash('sha256').update(`${projectRoot}\0${miniProgramId}`).digest('hex');
-    return path.join(cacheDirectory, `${scopeHash}.json`);
-}
-async function readScopeFile(scopeFile) {
-    let contents;
-    try {
-        contents = await fs$1.readFile(scopeFile, 'utf8');
-    }
-    catch (error) {
-        if (isNodeError(error) && error.code === 'ENOENT') {
-            return undefined;
-        }
-        throw error;
-    }
-    try {
-        const parsed = JSON.parse(contents);
-        if (!isPersistedOverride(parsed)) {
-            throw new TypeError('invalid cache schema');
-        }
-        return cloneOverrides(parsed.overrides);
-    }
-    catch (error) {
-        throw new DevPermissionOverrideStoreError('hb-sdk 本地权限覆盖缓存已损坏', 'DEV_PERMISSION_OVERRIDE_CACHE_CORRUPT', {
-            cause: error,
-        });
-    }
-}
-async function writeScopeFileAtomically(scopeFile, value) {
-    const tempFile = `${scopeFile}.${process.pid}.${node_crypto.randomBytes(8).toString('hex')}.tmp`;
-    let handle;
-    try {
-        handle = await fs$1.open(tempFile, 'wx', 0o600);
-        await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
-        await handle.sync();
-        await handle.close();
-        handle = undefined;
-        await fs$1.rename(tempFile, scopeFile);
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-        await fs$1.unlink(tempFile).catch(() => undefined);
-    }
-}
-function createWriteError(cause) {
-    return new DevPermissionOverrideStoreError('无法写入 hb-sdk 本地权限覆盖缓存', 'DEV_PERMISSION_OVERRIDE_WRITE_FAILED', { cause });
-}
-function cloneOverrides(overrides) {
-    return {
-        networkRequest: { ...overrides.networkRequest },
-    };
-}
-function isPersistedOverride(value) {
-    return isRecord(value) && value.version === CACHE_VERSION && Object.keys(value).length === 2 && isPermissionState(value.overrides);
-}
-function isPermissionState(value) {
-    return (isRecord(value) &&
-        Object.keys(value).length === 1 &&
-        isRecord(value.networkRequest) &&
-        (value.networkRequest.status === 'enabled' || value.networkRequest.status === 'disabled') &&
-        typeof value.networkRequest.useOfficialDomain === 'boolean');
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function isNodeError(error) {
-    return error instanceof Error && 'code' in error;
-}
-
-const DEFAULT_APP_PORT = 5173;
-const DEFAULT_BROWSER_DEV_HOST_PORT = 5174;
-const DEFAULT_DEV_CONTEXT_TIMEOUT_MS = 3000;
-const DEV_LISTEN_HOST = '0.0.0.0';
-const LOCAL_DEV_URL_HOST = '127.0.0.1';
-const DEV_CONTEXT_UNAVAILABLE_WARNING = '远端 dev context 不可用，已继续匿名调试。';
-// Shared with Heybox H5 Vite plugins so hb-sdk can own the launch output.
-const MANAGED_DEV_OUTPUT_ENV = 'HEYBOX_DEV_SERVER_MANAGED_OUTPUT';
-const VITE_LOG_LEVEL = 'warn';
-async function runDevCommand(options, runtime = {}) {
-    const logger = runtime.logger ?? index.createCliLogger();
-    const fetchImpl = runtime.fetchImpl ?? fetch;
-    const openUrl = runtime.openExternalUrl ?? browser.openExternalUrl;
-    const networkInterfaceSnapshot = (runtime.networkInterfaces ?? os.networkInterfaces)();
-    const getPortImpl = runtime.getPort ?? getPorts;
-    const appPort = await selectAvailablePort({
-        getPort: getPortImpl,
-        host: DEV_LISTEN_HOST,
-        label: 'Vite dev server',
-        startPort: options.port ?? DEFAULT_APP_PORT,
-    });
-    const resolvedOptions = {
-        ...options,
-        hmrHost: createLanInterfaceCandidates(networkInterfaceSnapshot)[0]?.address,
-        port: appPort,
-    };
-    const projectRoot = projectVite.findProjectRoot(runtime.cwd ?? process.cwd());
-    const devLaunchContext = await loadDevLaunchContext({
-        env: runtime.env,
-        fetchImpl,
-        logger,
-        projectRoot,
-        timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
-    });
-    const permissionController = createDevPermissionController({
-        boundMiniProgramId: await context.readBoundMiniProgramId(projectRoot),
-        cacheRoot: runtime.devPermissionCacheRoot,
-        devContext: devLaunchContext,
-        loadRemoteContext: () => loadDevLaunchContext({
-            env: runtime.env,
-            fetchImpl,
-            logger,
-            projectRoot,
-            requireRemote: true,
-            timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
-        }),
-        projectRoot,
-    });
-    const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), { successText: '已加载项目 Vite' });
-    const appServer = await logger.task('正在创建 Vite dev server', () => runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(devLaunchContext.runtimePermissions), () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions)), runtime.env), runtime.env), { successText: '已创建 Vite dev server' });
-    await logger.task('正在启动 Vite dev server', () => appServer.listen(appPort), {
-        successText: 'Vite dev server 已启动',
-    });
-    const appUrl = await logger.task('正在探测小程序入口', () => resolveViteAppUrl(appServer, resolvedOptions, fetchImpl), {
-        successText: '已确定小程序入口',
-    });
-    const lanAddresses = createLanAddressCandidates({
-        appUrl,
-        hmrHost: resolvedOptions.hmrHost,
-        interfaces: networkInterfaceSnapshot,
-        miniProgramId: devLaunchContext.miniProgramId,
-        localDevLaunchToken: devLaunchContext.localDevLaunchToken,
-        rawProtocol: options.rawProtocol,
-        runtimeUrl: options.runtimeUrl,
-        sdkVersion: HB_SDK_VERSION,
-        viteNetworkUrls: appServer.resolvedUrls?.network ?? [],
-    });
-    const closers = [() => appServer.close()];
-    let browserDevHost;
-    try {
-        browserDevHost = await logger.task('正在启动 Browser Dev Host', () => startBrowserDevHostServer({
-            appUrl,
-            devContext: devLaunchContext,
-            fetchImpl,
-            getPort: getPortImpl,
-            defaultLanAddressId: lanAddresses[0]?.id,
-            lanAddresses,
-            lookupHostname: runtime.lookupHostname,
-            loginService: runtime.loginService,
-            macAppProtocol: createMacAppProtocol(appUrl, {
-                miniProgramId: devLaunchContext.miniProgramId,
-                localDevLaunchToken: devLaunchContext.localDevLaunchToken,
-                runtimeUrl: options.runtimeUrl,
-                sdkVersion: HB_SDK_VERSION,
-            }),
-            permissionController,
-            port: options.browserDevHostPort ?? DEFAULT_BROWSER_DEV_HOST_PORT,
-            root: runtime.browserDevHostRoot,
-            rootCandidates: runtime.browserDevHostRootCandidates,
-            runtimePermissions: devLaunchContext.runtimePermissions,
-        }), { successText: 'Browser Dev Host 已启动' });
-    }
-    catch (error) {
-        await closeAll(closers);
-        throw error;
-    }
-    closers.push(() => browserDevHost.close());
-    if (devLaunchContext.source === 'remote' && devLaunchContext.miniProgramId) {
-        const tokenSession = startLocalDevLaunchTokenSession({
-            env: runtime.env,
-            fetchImpl,
-            logger,
-            miniProgramId: devLaunchContext.miniProgramId,
-            onToken: (localDevLaunchToken) => {
-                const tokenContext = {
-                    source: 'remote',
-                    miniProgramId: devLaunchContext.miniProgramId,
-                    ...(localDevLaunchToken ? { localDevLaunchToken } : {}),
-                    runtimePermissions: devLaunchContext.runtimePermissions,
-                };
-                browserDevHost.updateBootstrap({
-                    devContext: tokenContext,
-                    lanAddresses: createLanAddressCandidates({
-                        appUrl,
-                        hmrHost: resolvedOptions.hmrHost,
-                        interfaces: networkInterfaceSnapshot,
-                        miniProgramId: devLaunchContext.miniProgramId,
-                        localDevLaunchToken,
-                        rawProtocol: options.rawProtocol,
-                        runtimeUrl: options.runtimeUrl,
-                        sdkVersion: HB_SDK_VERSION,
-                        viteNetworkUrls: appServer.resolvedUrls?.network ?? [],
-                    }),
-                    macAppProtocol: createMacAppProtocol(appUrl, {
-                        miniProgramId: devLaunchContext.miniProgramId,
-                        localDevLaunchToken,
-                        runtimeUrl: options.runtimeUrl,
-                        sdkVersion: HB_SDK_VERSION,
-                    }),
-                });
-            },
-            projectRoot,
-            timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
-        });
-        closers.push(tokenSession.close);
-    }
-    logger.success('Browser Dev Host 已就绪');
-    logger.info(`Browser Dev Host: ${browserDevHost.url}`);
-    logger.info(`Mini program URL: ${appUrl}`);
-    logger.info('Mac APP: use the button in Browser Dev Host');
-    logger.info('Mobile APP: scan the QR code in Browser Dev Host');
-    if (devLaunchContext.source === 'anonymous') {
-        logger.warn('当前使用匿名本地沙箱；真机调试可用，但不会携带远端小程序身份或权限。');
-    }
-    if (options.open !== false) {
-        logger.debug('正在打开浏览器调试页');
-        void openUrl(browserDevHost.url);
-    }
-    installShutdownHandlers(closers, runtime.process ?? process);
-}
-async function loadDevLaunchContext(options) {
-    const miniProgramId = await context.readBoundMiniProgramId(options.projectRoot);
-    if (!miniProgramId) {
-        const anonymousReason = '当前项目未绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。';
-        if (options.requireRemote) {
-            throw new Error(anonymousReason);
-        }
-        options.logger.warn(`未读取到远端 Runtime 权限，Browser Dev Host 将默认拒绝受管能力：${anonymousReason}`);
-        return {
-            source: 'anonymous',
-            warning: anonymousReason,
-        };
-    }
-    try {
-        const { detail, miniProgramId: verifiedMiniProgramId } = await options.logger.task('正在读取远端小程序权限', () => loadRemoteDevContextWithTimeout({
-            fetchImpl: options.fetchImpl,
-            load: (fetchImpl) => context.getBoundMiniProgram({
-                cwd: options.projectRoot,
-                env: options.env,
-                fetchImpl,
-            }),
-            timeoutMs: options.timeoutMs,
-        }), { successText: '已读取远端小程序权限' });
-        return {
-            source: 'remote',
-            miniProgramId: verifiedMiniProgramId,
-            runtimePermissions: detail.runtime_permissions,
-        };
-    }
-    catch (error) {
-        if (error instanceof context.MiniProgramProjectBindingError && error.code !== 'MINI_PROGRAM_UNBOUND') {
-            throw error;
-        }
-        if (options.requireRemote) {
-            throw error;
-        }
-        options.logger.debug(`远端 dev context 失败详情：${index.readRedactedErrorMessage(error, { verbose: true })}`);
-        options.logger.warn(`未读取到远端 Runtime 权限，Browser Dev Host 将默认拒绝受管能力：${DEV_CONTEXT_UNAVAILABLE_WARNING}`);
-        return {
-            source: 'anonymous',
-            warning: DEV_CONTEXT_UNAVAILABLE_WARNING,
-        };
-    }
-}
-function createDevPermissionController(options) {
-    const store = createDevPermissionOverrideStore({ cacheRoot: options.cacheRoot });
-    let devContext = options.devContext;
-    let ephemeralOverride;
-    let persistenceError;
-    const readScope = () => ({
-        projectRoot: options.projectRoot,
-        ...(options.boundMiniProgramId ? { miniProgramId: options.boundMiniProgramId } : {}),
-    });
-    const createConfiguration = (overrides, error = persistenceError) => {
-        const miniProgramId = options.boundMiniProgramId ?? devContext.miniProgramId;
-        return {
-            source: devContext.source,
-            ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
-            ...(isRuntimePermissionsSnapshot(devContext.runtimePermissions) ? { remote_permissions: devContext.runtimePermissions } : {}),
-            ...(overrides ? { override_permissions: context.createBrowserDevRuntimePermissions(overrides) } : {}),
-            ...(error ? { persistence_error: error } : {}),
-        };
-    };
-    const get = async () => {
-        try {
-            const persistedOverride = await store.read(readScope());
-            return createConfiguration(ephemeralOverride ?? persistedOverride);
-        }
-        catch (error) {
-            persistenceError = index.readErrorMessage(error);
-            return createConfiguration(ephemeralOverride, persistenceError);
-        }
-    };
-    return {
-        get,
-        async reset() {
-            if (devContext.source === 'anonymous' && !options.boundMiniProgramId) {
-                await store.remove(readScope());
-                ephemeralOverride = undefined;
-                persistenceError = undefined;
-                return createConfiguration(undefined);
-            }
-            let refreshedContext;
-            try {
-                refreshedContext = await options.loadRemoteContext();
-            }
-            catch (error) {
-                throw new Error('远端权限读取失败，请检查 CLI 登录状态和网络后重试。', { cause: error });
-            }
-            await store.remove(readScope());
-            devContext = refreshedContext;
-            ephemeralOverride = undefined;
-            persistenceError = undefined;
-            return createConfiguration(undefined);
-        },
-        async save(runtimePermissions) {
-            const overrides = context.createBrowserDevPermissionState({
-                runtimePermissions,
-            });
-            try {
-                await store.set(readScope(), overrides);
-                ephemeralOverride = undefined;
-                persistenceError = undefined;
-                return createConfiguration(overrides);
-            }
-            catch {
-                ephemeralOverride = overrides;
-                persistenceError = '保存失败，当前页面仍会应用该权限，但刷新或重启后会丢失。';
-                return createConfiguration(overrides, persistenceError);
-            }
-        },
-    };
-}
-function isRuntimePermissionsSnapshot(value) {
-    return context.parseMiniProgramRuntimePermissions(value).valid;
-}
-async function loadRemoteDevContextWithTimeout(options) {
-    const controller = new AbortController();
-    const fetchImpl = ((input, init) => options.fetchImpl(input, { ...init, signal: controller.signal }));
-    let timeout;
-    try {
-        return await Promise.race([
-            options.load(fetchImpl),
-            new Promise((_resolve, reject) => {
-                timeout = setTimeout(() => {
-                    controller.abort();
-                    reject(new Error('dev context timeout'));
-                }, Math.max(1, options.timeoutMs));
-            }),
-        ]);
-    }
-    finally {
-        if (timeout) {
-            clearTimeout(timeout);
-        }
-    }
-}
-function createViteServerOptions(projectRoot, options) {
-    const configFile = resolveProjectViteConfig(projectRoot);
-    const server = {
-        cors: true,
-        hmr: {
-            clientPort: options.port ?? DEFAULT_APP_PORT,
-            ...(options.hmrHost ? { host: options.hmrHost } : {}),
-        },
-        host: DEV_LISTEN_HOST,
-        port: options.port ?? DEFAULT_APP_PORT,
-        strictPort: true,
-    };
-    if (configFile) {
-        return {
-            configFile,
-            logLevel: VITE_LOG_LEVEL,
-            server,
-        };
-    }
-    return {
-        logLevel: VITE_LOG_LEVEL,
-        root: projectRoot,
-        server,
-    };
-}
-function resolveProjectViteConfig(projectRoot) {
-    const candidates = ['vite.config.ts', 'vite.config.mts', 'vite.config.js', 'vite.config.mjs'];
-    return candidates.map((file) => path.join(projectRoot, file)).find((file) => fs.existsSync(file));
-}
-async function resolveViteAppUrl(server, options, fetchImpl) {
-    const candidates = createViteAppUrlCandidates(server, options);
-    for (const candidate of candidates) {
-        if (await canReachDocumentUrl(candidate, fetchImpl)) {
-            return candidate;
-        }
-    }
-    return candidates[0];
-}
-function createViteAppUrlCandidates(server, options) {
-    const localUrl = rewriteLocalhostUrl(server.resolvedUrls?.local[0]);
-    const origin = readViteOrigin(localUrl, options);
-    const candidates = [localUrl, createH5EntryUrl(origin, readViteBase(server, localUrl))].filter((url) => Boolean(url));
-    return Array.from(new Set(candidates));
-}
-function readViteOrigin(localUrl, options) {
-    if (localUrl) {
-        try {
-            return new URL(localUrl).origin;
-        }
-        catch {
-            /* fall through */
-        }
-    }
-    const port = options.port ?? DEFAULT_APP_PORT;
-    return `http://${LOCAL_DEV_URL_HOST}:${port}`;
-}
-function readViteBase(server, localUrl) {
-    const base = server.config?.base;
-    if (base && base !== '/') {
-        return base;
-    }
-    if (localUrl) {
-        try {
-            return new URL(localUrl).pathname;
-        }
-        catch {
-            /* fall through */
-        }
-    }
-    return '/';
-}
-function createH5EntryUrl(origin, base) {
-    const pathname = `${ensureTrailingSlash(base)}src/index.html`;
-    return new URL(pathname, `${origin}/`).toString();
-}
-async function canReachDocumentUrl(url, fetchImpl) {
-    try {
-        const headResponse = await fetchImpl(url, {
-            method: 'HEAD',
-            redirect: 'follow',
-        });
-        if (headResponse.ok) {
-            return true;
-        }
-        if (headResponse.status !== 404 && headResponse.status !== 405) {
-            return false;
-        }
-        const getResponse = await fetchImpl(url, {
-            method: 'GET',
-            redirect: 'follow',
-        });
-        return getResponse.ok;
-    }
-    catch {
-        return false;
-    }
-}
-function ensureTrailingSlash(value) {
-    return value.endsWith('/') ? value : `${value}/`;
-}
-function rewriteLocalhostUrl(input) {
-    if (!input) {
-        return undefined;
-    }
-    try {
-        const url = new URL(input);
-        if (isLocalhostHost(url.hostname)) {
-            url.hostname = LOCAL_DEV_URL_HOST;
-            return url.toString();
-        }
-    }
-    catch {
-        return input;
-    }
-    return input;
-}
-function isLocalhostHost(hostname) {
-    return hostname === 'localhost' || hostname === '::1' || hostname === '[::1]';
-}
-async function withManagedDevOutputEnv(action, env = process.env) {
-    const previousManagedOutput = env[MANAGED_DEV_OUTPUT_ENV];
-    env[MANAGED_DEV_OUTPUT_ENV] = '1';
-    try {
-        return await action();
-    }
-    finally {
-        if (previousManagedOutput === undefined) {
-            delete env[MANAGED_DEV_OUTPUT_ENV];
-        }
-        else {
-            env[MANAGED_DEV_OUTPUT_ENV] = previousManagedOutput;
-        }
-    }
-}
-function installShutdownHandlers(closers, processLike) {
-    const shutdown = async () => {
-        await closeAll(closers);
-        processLike.exit(0);
-    };
-    processLike.once('SIGINT', () => {
-        void shutdown();
-    });
-    processLike.once('SIGTERM', () => {
-        void shutdown();
-    });
-}
-async function closeAll(closers) {
-    await Promise.allSettled(closers.map((close) => close()));
-}
-function startLocalDevLaunchTokenSession(options) {
-    let closed = false;
-    let expirationTimer;
-    let refreshTimer;
-    const refresh = async () => {
-        try {
-            const issued = await issueLocalDevLaunchToken(options);
-            if (closed)
-                return;
-            if (!issued) {
-                schedule(options.timeoutMs);
-                return;
-            }
-            options.onToken(issued.token);
-            const ttl = Math.max(0, issued.expiresAt - Date.now());
-            scheduleExpiration(ttl);
-            schedule(Math.max(1_000, Math.floor(ttl * 0.8)));
-        }
-        catch (error) {
-            if (closed)
-                return;
-            options.logger.warn(`刷新本地调试启动票失败，将自动重试：${index.readRedactedErrorMessage(error)}`);
-            schedule(options.timeoutMs);
-        }
-    };
-    const schedule = (delayMs) => {
-        refreshTimer = setTimeout(() => {
-            void refresh();
-        }, Math.max(1, delayMs));
-        refreshTimer.unref?.();
-    };
-    const scheduleExpiration = (ttl) => {
-        if (expirationTimer)
-            clearTimeout(expirationTimer);
-        expirationTimer = setTimeout(() => {
-            if (!closed)
-                options.onToken(undefined);
-        }, Math.max(1, ttl));
-        expirationTimer.unref?.();
-    };
-    void refresh();
-    return {
-        close: () => {
-            closed = true;
-            if (expirationTimer)
-                clearTimeout(expirationTimer);
-            if (refreshTimer)
-                clearTimeout(refreshTimer);
-        },
-    };
-}
-async function issueLocalDevLaunchToken(options) {
-    try {
-        const issued = await loadRemoteDevContextWithTimeout({
-            fetchImpl: options.fetchImpl,
-            timeoutMs: options.timeoutMs,
-            load: (fetchImpl) => context.createLocalDevLaunchToken({
-                cwd: options.projectRoot,
-                env: options.env,
-                fetchImpl,
-                miniProgramId: options.miniProgramId,
-            }),
-        });
-        const token = typeof issued.token === 'string' ? issued.token.trim() : '';
-        if (!token) {
-            throw new Error('响应缺少 token');
-        }
-        const expiresAt = normalizeExpiresAt(issued.expires_at);
-        if (!expiresAt || expiresAt <= Date.now()) {
-            throw new Error('响应缺少有效 expires_at');
-        }
-        return { expiresAt, token };
-    }
-    catch (error) {
-        options.logger.warn(`未能签发本地调试启动票，扫码后公开详情可能仍拿不到未发布小程序身份：${index.readRedactedErrorMessage(error)}`);
-        return undefined;
-    }
-}
-function normalizeExpiresAt(value) {
-    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)
-        return undefined;
-    return value < 1_000_000_000_000 ? value * 1000 : value;
-}
-function createLanAddressCandidates(options) {
-    const viteNetworkUrlByHost = new Map(options.viteNetworkUrls.map((url) => [readUrlHost(url), url]).filter((entry) => Boolean(entry[0])));
-    const candidates = createLanInterfaceCandidates(options.interfaces)
-        .filter(({ address }) => address === options.hmrHost)
-        .map(({ address, id, name }) => {
-        const appUrl = viteNetworkUrlByHost.get(address) ?? replaceUrlHost(options.appUrl, address);
-        if (!appUrl) {
-            return undefined;
-        }
-        const candidate = {
-            address,
-            appUrl,
-            id,
-            name,
-        };
-        const runtimeUrl = rewriteLoopbackUrlHost(options.runtimeUrl, address);
-        if (runtimeUrl !== undefined) {
-            candidate.mobileAppQrPayload = createMobileAppQrPayload(appUrl, {
-                bareProtocol: options.rawProtocol,
-                miniProgramId: options.miniProgramId,
-                localDevLaunchToken: options.localDevLaunchToken,
-                runtimeUrl,
-                sdkVersion: options.sdkVersion,
-            });
-        }
-        else {
-            candidate.mobileAppQrPayload = createMobileAppQrPayload(appUrl, {
-                bareProtocol: options.rawProtocol,
-                miniProgramId: options.miniProgramId,
-                localDevLaunchToken: options.localDevLaunchToken,
-                sdkVersion: options.sdkVersion,
-            });
-        }
-        return candidate;
-    })
-        .filter((candidate) => Boolean(candidate));
-    return candidates.sort((left, right) => {
-        const leftNetworkMatch = viteNetworkUrlByHost.has(left.address) ? 0 : 1;
-        const rightNetworkMatch = viteNetworkUrlByHost.has(right.address) ? 0 : 1;
-        if (leftNetworkMatch !== rightNetworkMatch) {
-            return leftNetworkMatch - rightNetworkMatch;
-        }
-        return readInterfacePriority(left.name) - readInterfacePriority(right.name) || left.name.localeCompare(right.name);
-    });
-}
-function createLanInterfaceCandidates(interfaces) {
-    return Object.entries(interfaces)
-        .flatMap(([name, infos]) => (infos ?? []).map((info) => ({
-        info,
-        name,
-    })))
-        .filter(({ info }) => info.family === 'IPv4' && !info.internal && isPrivateIPv4(info.address))
-        .map(({ info, name }) => ({
-        address: info.address,
-        id: `${name}-${info.address}`,
-        name,
-    }))
-        .sort((left, right) => {
-        return readInterfacePriority(left.name) - readInterfacePriority(right.name) || left.name.localeCompare(right.name);
-    });
-}
-function rewriteLoopbackUrlHost(input, host) {
-    if (input === undefined || input === '') {
-        return undefined;
-    }
-    try {
-        const url = new URL(input);
-        if (isLoopbackHost(url.hostname)) {
-            url.hostname = host;
-            return url.toString();
-        }
-    }
-    catch {
-        return input;
-    }
-    return input;
-}
-function isLoopbackHost(hostname) {
-    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '[::1]';
-}
-function readUrlHost(input) {
-    try {
-        return new URL(input).hostname;
-    }
-    catch {
-        return undefined;
-    }
-}
-function replaceUrlHost(input, host) {
-    try {
-        const url = new URL(input);
-        url.hostname = host;
-        return url.toString();
-    }
-    catch {
-        return undefined;
-    }
-}
-function readInterfacePriority(name) {
-    const normalized = name.toLowerCase();
-    if (normalized.includes('wi-fi') || normalized.includes('wifi') || normalized.includes('wlan')) {
-        return 0;
-    }
-    if (normalized === 'en0') {
-        return 1;
-    }
-    if (normalized.startsWith('en') || normalized.includes('ethernet')) {
-        return 2;
-    }
-    return 3;
-}
-function isPrivateIPv4(address) {
-    const parts = address.split('.').map((part) => Number(part));
-    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-        return false;
-    }
-    return parts[0] === 10 || (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) || (parts[0] === 192 && parts[1] === 168);
-}
-
-exports.normalizeExpiresAt = normalizeExpiresAt;
-exports.runDevCommand = runDevCommand;