@heybox/hb-sdk 0.7.5-alpha.0 → 0.8.0-alpha.2

package/dist/cli-chunks/{dev-XopYKLYZ.cjs → dev-CoSXtEYa.cjs}

@@ -8,16 +8,16 @@ var node_crypto = require('node:crypto');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
 var node_module = require('node:module');
-var context = require('./context-Ba1Je-wT.cjs');
+var context = require('./context-Brh56h56.cjs');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-C9mpajVG.cjs');
+var index = require('./index-BL5eEPap.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-CJS_SEp9.cjs');
+var session = require('./session-D-_N3WVL.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-CBb38HJ3.cjs');
-var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
+var projectVite = require('./project-vite-Qu6Xe9Dn.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-CjsCe5bp.cjs');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 class Locked extends Error {
@@ -429,6 +429,25 @@ class BrowserDevHostHttpError extends Error {
         this.name = 'BrowserDevHostHttpError';
     }
 }
+function createBrowserDevHostRequestAbortScope(request, response) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    const onResponseClose = () => {
+        if (!response.writableEnded)
+            abort();
+    };
+    request.once('aborted', abort);
+    response.once('close', onResponseClose);
+    if (request.aborted || (response.destroyed && !response.writableEnded))
+        abort();
+    return {
+        dispose() {
+            request.removeListener('aborted', abort);
+            response.removeListener('close', onResponseClose);
+        },
+        signal: controller.signal,
+    };
+}
 function readJsonRequestBody(request, options = {}) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -498,7 +517,7 @@ function writeSerializedJsonResponse(response, status, body) {
     });
     response.end(body);
 }
-function isRecord$3(value) {
+function isRecord$2(value) {
     return Object.prototype.toString.call(value) === '[object Object]';
 }
 function isObjectLike(value) {
@@ -594,7 +613,6 @@ function redactSensitivePairsInRawText(text) {
     });
 }
 
-const MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS = 5;
 const MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY = 2 * 1024 * 1024;
 const MAX_BROWSER_DEV_HOST_NETWORK_RESPONSE_BODY = 5 * 1024 * 1024;
 const DENIED_NETWORK_TARGETS = createDeniedNetworkTargets();
@@ -615,16 +633,17 @@ async function handleBrowserDevHostNetworkProxy(request, response, fetchImpl, lo
     let payload;
     try {
         payload = await readJsonRequestBody(request);
-        const requestAbort = new AbortController();
-        if (request.aborted)
-            requestAbort.abort();
-        else
-            request.once('aborted', () => requestAbort.abort());
-        const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal);
-        if (typeof result.status === 'number' && (result.status < 200 || result.status >= 300)) {
-            logBrowserDevHostNetworkProxyDiagnostic('http_status', payload, result);
+        const requestAbort = createBrowserDevHostRequestAbortScope(request, response);
+        try {
+            const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal);
+            if (typeof result.status === 'number' && (result.status < 200 || result.status >= 300)) {
+                logBrowserDevHostNetworkProxyDiagnostic('http_status', payload, result);
+            }
+            writeNetworkJsonResponse(response, 200, result, cors);
+        }
+        finally {
+            requestAbort.dispose();
         }
-        writeNetworkJsonResponse(response, 200, result, cors);
     }
     catch (error) {
         logBrowserDevHostNetworkProxyDiagnostic('proxy_error', payload, undefined, error);
@@ -639,10 +658,10 @@ function logBrowserDevHostNetworkProxyDiagnostic(phase, payload, result, error)
             return;
         }
         const detail = { phase };
-        if (isRecord$3(payload) && typeof payload.url === 'string') {
+        if (isRecord$2(payload) && typeof payload.url === 'string') {
             detail.url = sanitizeNetworkRequestUrl(payload.url);
         }
-        if (isRecord$3(payload) && typeof payload.method === 'string') {
+        if (isRecord$2(payload) && typeof payload.method === 'string') {
             detail.method = payload.method;
         }
         if (typeof result?.status === 'number') {
@@ -673,14 +692,14 @@ function writeNetworkJsonResponse(response, status, body, cors) {
 }
 const BROWSER_DEV_HOST_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE = 'network.request 不支持 multipart/form-data。App Host 客户端代发仅支持 application/x-www-form-urlencoded（form）与 application/json；请将 data 编码为 form 字符串（例如 new URLSearchParams({...}).toString()）并设置 Content-Type: application/x-www-form-urlencoded。文件上传请使用专用上传能力，勿手写 multipart boundary。';
 async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, allowedHttpOrigins, requestSignal) {
-    if (!isRecord$3(payload) || typeof payload.url !== 'string' || !payload.url.trim()) {
+    if (!isRecord$2(payload) || typeof payload.url !== 'string' || !payload.url.trim()) {
         throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是非空字符串');
     }
     const url = createBrowserDevHostNetworkUrl(payload.url, payload.params);
     const method = typeof payload.method === 'string' && payload.method.trim() ? payload.method.trim().toUpperCase() : 'GET';
     const headers = normalizeBrowserDevHostNetworkHeaders(payload.headers);
     assertSupportedBrowserDevHostNetworkRequestShape(headers, payload.data);
-    const body = createBrowserDevHostNetworkBody(method, payload.data, headers);
+    const body = createBrowserDevHostNetworkBody(method, payload.data, headers, readBodyEncoding(payload.bodyEncoding, payload.data));
     const controller = new AbortController();
     const onRequestAbort = () => controller.abort(requestSignal.reason);
     requestSignal.addEventListener('abort', onRequestAbort, { once: true });
@@ -691,7 +710,7 @@ async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname,
     const pinnedTargets = new Map();
     const dispatcher = createPinnedNetworkDispatcher(pinnedTargets);
     try {
-        const response = await fetchBrowserDevHostNetworkWithRedirects({
+        const response = await fetchBrowserDevHostNetworkNoRedirect({
             body,
             dispatcher,
             fetchImpl,
@@ -724,43 +743,17 @@ async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname,
         await dispatcher.close();
     }
 }
-async function fetchBrowserDevHostNetworkWithRedirects(options) {
-    let url = options.url;
-    let method = options.method;
-    let body = options.body;
-    for (let redirectCount = 0; redirectCount <= MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS; redirectCount += 1) {
-        const pinnedTarget = await resolveBrowserDevHostNetworkTarget(url, options.lookupHostname, options.allowedHttpOrigins);
-        options.pinnedTargets.set(createPinnedNetworkTargetKey(url), pinnedTarget);
-        const response = await options.fetchImpl(url.toString(), {
-            body,
-            dispatcher: options.dispatcher,
-            headers: options.headers,
-            method,
-            redirect: 'manual',
-            signal: options.signal,
-        });
-        if (![301, 302, 303, 307, 308].includes(response.status)) {
-            return response;
-        }
-        const location = response.headers.get('location');
-        if (!location) {
-            return response;
-        }
-        if (redirectCount === MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS) {
-            throw createBrowserDevHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
-        }
-        await response.body?.cancel();
-        const redirectedUrl = new URL(location, url);
-        if (redirectedUrl.origin !== url.origin) {
-            throw createBrowserDevHostError(403, 'NETWORK_REDIRECT_DENIED', 'network.request 不允许跨 origin redirect');
-        }
-        url = redirectedUrl;
-        if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === 'POST')) {
-            method = 'GET';
-            body = undefined;
-        }
-    }
-    throw createBrowserDevHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
+async function fetchBrowserDevHostNetworkNoRedirect(options) {
+    const pinnedTarget = await resolveBrowserDevHostNetworkTarget(options.url, options.lookupHostname, options.allowedHttpOrigins);
+    options.pinnedTargets.set(createPinnedNetworkTargetKey(options.url), pinnedTarget);
+    return options.fetchImpl(options.url.toString(), {
+        body: options.body,
+        dispatcher: options.dispatcher,
+        headers: options.headers,
+        method: options.method,
+        redirect: 'manual',
+        signal: options.signal,
+    });
 }
 async function resolveBrowserDevHostNetworkTarget(url, lookupHostname, allowedHttpOrigins) {
     if (!['http:', 'https:'].includes(url.protocol)) {
@@ -890,7 +883,7 @@ function createBrowserDevHostNetworkUrl(input, params) {
     if (!['http:', 'https:'].includes(url.protocol)) {
         throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request 仅支持 HTTP(S) URL');
     }
-    if (isRecord$3(params)) {
+    if (isRecord$2(params)) {
         Object.entries(params).forEach(([key, value]) => {
             if (value !== undefined && value !== null) {
                 url.searchParams.set(key, String(value));
@@ -901,7 +894,7 @@ function createBrowserDevHostNetworkUrl(input, params) {
 }
 function normalizeBrowserDevHostNetworkHeaders(headers) {
     const normalized = new Headers();
-    if (!isRecord$3(headers)) {
+    if (!isRecord$2(headers)) {
         return normalized;
     }
     Object.entries(headers).forEach(([key, value]) => {
@@ -947,22 +940,60 @@ function looksLikeMultipartBody(data) {
     const trimmed = data.trimStart();
     return trimmed.startsWith('--') && /content-disposition\s*:\s*form-data/i.test(data);
 }
-function createBrowserDevHostNetworkBody(method, data, headers) {
+function createBrowserDevHostNetworkBody(method, data, headers, bodyEncoding) {
     if (data === undefined || method === 'GET' || method === 'HEAD') {
         return undefined;
     }
-    const body = typeof data === 'string' ? data : JSON.stringify(data);
+    const body = typeof data === 'string'
+        ? data
+        : bodyEncoding === 'form'
+            ? createLegacyFormBody$1(data)
+            : JSON.stringify(data);
     if (Buffer.byteLength(body) > MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY) {
         throw createBrowserDevHostError(413, 'REQUEST_ENTITY_TOO_LARGE', 'network.request data exceeds 2097152 bytes');
     }
-    if (typeof data === 'string') {
-        return body;
+    if (bodyEncoding === 'form' && !headers.has('content-type')) {
+        headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');
     }
-    if (!headers.has('content-type')) {
+    else if (bodyEncoding === 'json' && typeof data !== 'string' && !headers.has('content-type')) {
         headers.set('content-type', 'application/json');
     }
     return body;
 }
+function readBodyEncoding(value, data) {
+    if (value === 'form' || value === 'json')
+        return value;
+    if (value === undefined && (data === undefined || typeof data === 'string'))
+        return undefined;
+    throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request bodyEncoding 必须明确为 form 或 json');
+}
+function encodeLegacyFormComponent$1(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function appendLegacyFormValue$1(pairs, key, value) {
+    if (value === undefined)
+        return;
+    if (value === null) {
+        pairs.push([key, '']);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item) => appendLegacyFormValue$1(pairs, key, item));
+        return;
+    }
+    if (typeof value === 'object' && !(value instanceof Date)) {
+        Object.entries(value).forEach(([childKey, childValue]) => appendLegacyFormValue$1(pairs, `${key}[${childKey}]`, childValue));
+        return;
+    }
+    pairs.push([key, value instanceof Date ? value.toISOString() : String(value)]);
+}
+function createLegacyFormBody$1(data) {
+    const pairs = [];
+    if (data && typeof data === 'object') {
+        Object.entries(data).forEach(([key, value]) => appendLegacyFormValue$1(pairs, key, value));
+    }
+    return pairs.map(([key, value]) => `${encodeLegacyFormComponent$1(key)}=${encodeLegacyFormComponent$1(value)}`).join('&');
+}
 function safeJsonParse(text) {
     try {
         return JSON.parse(text);
@@ -1098,7 +1129,7 @@ function createDevSessionRoutes(options) {
     };
 }
 function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
-    if (!isRecord$3(payload) || Object.keys(payload).some((key) => !['mini_url_origin', 'runtime_permissions'].includes(key))) {
+    if (!isRecord$2(payload) || Object.keys(payload).some((key) => !['mini_url_origin', 'runtime_permissions'].includes(key))) {
         throw new TypeError('Dev Session body is invalid');
     }
     if (typeof payload.mini_url_origin !== 'string') {
@@ -1589,6 +1620,22 @@ const TOKEN_PATTERN = /^[A-Za-z0-9_-]{22}$/;
 const MAX_TOKEN_GENERATION_ATTEMPTS = 8;
 const CLOSE_WINDOW_DELAY_MS = 500;
 const CLOSE_WINDOW_PROTOCOL = `heybox://${encodeURIComponent(JSON.stringify({ protocol_type: 'closeWindow' }))}`;
+const MINI_PROGRAM_URL_QUERY_PARAM$1 = 'mini_url';
+const MINI_PROGRAM_SDK_VERSION_QUERY_PARAM = 'sdk_version';
+const MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM = 'local_dev_launch_token';
+const MINI_PROGRAM_DEV_SHELL_URL = 'heybox-mini-dev://sandbox';
+const OPEN_IN_APP_URL = 'https://api.xiaoheihe.cn/open_inapp/';
+function createMobileAppQrPayload(appUrl, options = {}) {
+    const protocol = createHeyboxProtocol(createMiniProgramDevShellOpenWindowPayload(appUrl, options));
+    return `${OPEN_IN_APP_URL}#${protocol}`;
+}
+function projectMiniProgramDevContextUrlToPrivateHost(value, host) {
+    const url = parseDevContextUrl(value, 'loopback', 'devContextUrl must be a canonical loopback Dev Session URL');
+    if (!isCanonicalPrivateLanIpv4(host))
+        throw new TypeError('Mobile Dev Context host must be a canonical private IPv4 address');
+    url.hostname = host;
+    return url.href;
+}
 function createMobileLaunchRedirectRegistry(options = {}) {
     const capacity = options.capacity ?? DEFAULT_CAPACITY;
     const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
@@ -1673,6 +1720,69 @@ function createMobileLaunchRedirectDocument(payload) {
     const closeUrl = JSON.stringify(CLOSE_WINDOW_PROTOCOL).replaceAll('<', '\\u003c');
     return `<!DOCTYPE html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>打开调试小程序</title></head><body><p>正在打开本地调试小程序…</p><p><a href="${href}" id="launch">如果没有自动跳转，请点这里</a></p><script>(function(){var launchUrl=${launchUrl};var closeUrl=${closeUrl};function go(){location.href=launchUrl;setTimeout(function(){location.href=closeUrl;},${CLOSE_WINDOW_DELAY_MS});}document.getElementById("launch").addEventListener("click",function(event){event.preventDefault();go();});go();})();</script></body></html>`;
 }
+function createMiniProgramDevShellOpenWindowPayload(appUrl, options) {
+    const devShellUrl = `${MINI_PROGRAM_DEV_SHELL_URL}?${readDevShellQueryEntries(appUrl, options)
+        .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
+        .join('&')}`;
+    const miniProgramId = options.miniProgramId?.trim();
+    return {
+        protocol_type: 'openWindow',
+        full_screen: true,
+        mini_program: '1',
+        ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
+        navigation_bar: { title: '' },
+        webview: { url: devShellUrl, pull: false, refresh: false },
+    };
+}
+function readDevShellQueryEntries(appUrl, options) {
+    const entries = [[MINI_PROGRAM_URL_QUERY_PARAM$1, appUrl]];
+    const miniProgramId = options.miniProgramId?.trim();
+    if (miniProgramId)
+        entries.push(['mini_program_id', miniProgramId]);
+    const localDevLaunchToken = options.localDevLaunchToken?.trim();
+    if (localDevLaunchToken)
+        entries.push([MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM, localDevLaunchToken]);
+    const devContextUrl = readDevContextUrl(options.devContextUrl);
+    if (devContextUrl)
+        entries.push([MINI_PROGRAM_DEV_CONTEXT_QUERY_PARAM, devContextUrl]);
+    const sdkVersion = options.sdkVersion?.trim();
+    if (sdkVersion)
+        entries.push([MINI_PROGRAM_SDK_VERSION_QUERY_PARAM, sdkVersion]);
+    return entries;
+}
+function readDevContextUrl(value) {
+    if (value === undefined || value === '')
+        return undefined;
+    return parseDevContextUrl(value, 'loopback-or-private', 'devContextUrl must be a canonical Dev Session URL').href;
+}
+function parseDevContextUrl(value, hostPolicy, errorMessage) {
+    if (value !== value.trim())
+        throw new TypeError(errorMessage);
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new TypeError(errorMessage);
+    }
+    const tokenPath = `${MINI_PROGRAM_DEV_CONTEXT_PATH}/`;
+    const hostAllowed = isLoopbackHostname(url.hostname) || (hostPolicy === 'loopback-or-private' && isCanonicalPrivateLanIpv4(url.hostname));
+    if (url.protocol !== 'http:' ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.search !== '' ||
+        url.hash !== '' ||
+        !url.pathname.startsWith(tokenPath) ||
+        !/^[a-f0-9]{64}$/.test(url.pathname.slice(tokenPath.length)) ||
+        !hostAllowed ||
+        url.href !== value) {
+        throw new TypeError(errorMessage);
+    }
+    return url;
+}
+function createHeyboxProtocol(payload) {
+    return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
+}
 function escapeHtml(value) {
     return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
 }
@@ -1713,13 +1823,12 @@ function assertAddressId(addressId) {
     }
 }
 
-const MINI_PROGRAM_URL_QUERY_PARAM$1 = 'mini_url';
+const MINI_PROGRAM_URL_QUERY_PARAM = 'mini_url';
 const BROWSER_DEV_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
 const BROWSER_DEV_HOST_CHANNEL_PATH = '/__hb_sdk__/channel';
 const BROWSER_DEV_HOST_NETWORK_PATH = '/__hb_sdk__/network';
 const MOBILE_LAUNCH_REDIRECT_CONTROL_PATH = '/__hb_sdk__/mobile-launch-redirect';
 const MOBILE_LAUNCH_REDIRECT_CONTROL_BODY_LIMIT_BYTES = 66 * 1024;
-const DEV_PERMISSIONS_PATH = '/__hb_sdk__/dev-permissions';
 const DEV_LISTEN_HOST$1 = '::';
 const DEV_PORT_PROBE_HOST = '0.0.0.0';
 const LOCAL_DEV_URL_HOST$1 = '127.0.0.1';
@@ -1741,7 +1850,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-XopYKLYZ.cjs', document.baseURI).href)))('ws');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CoSXtEYa.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CoSXtEYa.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -1771,7 +1881,6 @@ async function startBrowserDevHostServer(options) {
         devContext: options.devContext,
         lanAddresses: options.lanAddresses ?? [],
         loginAvailable: options.loginService !== undefined,
-        macAppProtocol: options.macAppProtocol,
         miniProgram: options.miniProgram,
         mobileLaunchRedirect: initialMobileLaunchRedirect,
         nativeAppLaunchUnavailableReason: options.nativeAppLaunchUnavailableReason,
@@ -1787,7 +1896,6 @@ async function startBrowserDevHostServer(options) {
         isMobileLaunchRedirectPeerAllowed: options.isMobileLaunchRedirectPeerAllowed ?? isAllowedMobileLaunchRedirectPeer,
         lookupHostname: options.lookupHostname ?? (async (hostname) => promises.lookup(hostname, { all: true, verbatim: true })),
         now: options.now ?? Date.now,
-        permissionController: options.permissionController,
         channelHeartbeatIntervalMs: options.channelHeartbeatIntervalMs ?? DEFAULT_CHANNEL_HEARTBEAT_INTERVAL_MS,
         channelHelloTimeoutMs: options.channelHelloTimeoutMs ?? DEFAULT_CHANNEL_HELLO_TIMEOUT_MS,
         channelOutboundBufferLimitBytes: options.channelOutboundBufferLimitBytes ?? DEFAULT_CHANNEL_OUTBOUND_BUFFER_LIMIT_BYTES,
@@ -1855,10 +1963,6 @@ async function startBrowserDevHostServer(options) {
                     delete bootstrap.mobileLaunchRedirect;
                 }
             }
-            if (next.macAppProtocol === null)
-                delete bootstrap.macAppProtocol;
-            else if (next.macAppProtocol !== undefined)
-                bootstrap.macAppProtocol = next.macAppProtocol;
             if (next.miniProgram !== undefined)
                 bootstrap.miniProgram = next.miniProgram;
             bootstrapJson = serializeBrowserDevHostBootstrap(bootstrap);
@@ -1891,7 +1995,36 @@ function assertCompleteMiniProgramBrowserDevHostRoot(root) {
     }
 }
 function isCompleteMiniProgramBrowserDevHostRoot(root) {
-    return fs.existsSync(path.join(root, 'index.html')) && fs.existsSync(path.join(root, 'main.js'));
+    const entryPath = path.join(root, 'index.html');
+    if (!fs.existsSync(entryPath))
+        return false;
+    // 测试夹具与旧发布产物仍使用固定入口；Vue 3 构建使用 HTML 中的哈希资源。
+    if (fs.statSync(path.join(root, 'main.js'), { throwIfNoEntry: false })?.isFile())
+        return true;
+    try {
+        const references = collectBrowserDevHostLocalReferences(parseHtml(fs.readFileSync(entryPath, 'utf8')));
+        return (references.some((reference) => /\.m?js(?:$|\?)/.test(reference)) &&
+            references.every((reference) => {
+                const pathname = decodeURIComponent(reference.split(/[?#]/, 1)[0]);
+                const resolved = path.resolve(root, pathname.replace(/^\/+/, ''));
+                return resolved.startsWith(`${root}${path.sep}`) && fs.statSync(resolved, { throwIfNoEntry: false })?.isFile() === true;
+            }));
+    }
+    catch {
+        return false;
+    }
+}
+function collectBrowserDevHostLocalReferences(node, references = []) {
+    for (const attribute of node.attrs ?? []) {
+        if (!['href', 'src'].includes(attribute.name))
+            continue;
+        if (attribute.value && !/^(?:[a-z][a-z\d+.-]*:|\/\/|#)/i.test(attribute.value))
+            references.push(attribute.value);
+    }
+    for (const child of node.childNodes ?? []) {
+        collectBrowserDevHostLocalReferences(child, references);
+    }
+    return [...new Set(references)];
 }
 function createMissingBrowserDevHostError() {
     return new Error('未找到完整的 hb-sdk browser dev host 静态产物。请先执行 @heybox/hb-sdk 的 build:browser-dev-host。');
@@ -1905,7 +2038,7 @@ function createBrowserDevHostNetworkUrls(options) {
 }
 function createBrowserDevHostUrlWithHost(options) {
     const url = new URL(`http://${options.host}:${options.port}/`);
-    url.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM$1, options.appUrl);
+    url.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM, options.appUrl);
     return url.toString();
 }
 function serializeBrowserDevHostBootstrap(bootstrap) {
@@ -2015,10 +2148,10 @@ function createBrowserDevHostServer(root, runtime) {
             writeForbidden(response);
             return;
         }
-        if (isBrowserDevHostDocumentPath(pathname) && !requestUrl.searchParams.has(MINI_PROGRAM_URL_QUERY_PARAM$1)) {
+        if (isBrowserDevHostDocumentPath(pathname) && !requestUrl.searchParams.has(MINI_PROGRAM_URL_QUERY_PARAM)) {
             const targetUrl = new URL(requestUrl);
             targetUrl.pathname = '/';
-            targetUrl.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM$1, runtime.appUrl);
+            targetUrl.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM, runtime.appUrl);
             response.writeHead(302, {
                 location: `${targetUrl.pathname}${targetUrl.search}`,
                 'cache-control': 'no-store',
@@ -2129,28 +2262,6 @@ function createBrowserDevHostServer(root, runtime) {
             request.once('close', () => eventStreams.delete(response));
             return;
         }
-        if (pathname === DEV_PERMISSIONS_PATH && runtime.permissionController) {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
-                writeForbidden(response);
-                return;
-            }
-            if (request.method === 'GET') {
-                writeJsonResponse(response, 200, await runtime.permissionController.get());
-                return;
-            }
-            if (request.method !== 'PUT' && request.method !== 'DELETE') {
-                writeMethodNotAllowed(response, 'GET, PUT, DELETE');
-                return;
-            }
-            if (!isValidSensitiveRequest(request, loopbackPeer, runtime.sessionController.csrfToken)) {
-                writeForbidden(response);
-                return;
-            }
-            if (await handleDevPermissionMutation(request, response, runtime.permissionController)) {
-                channelServer.publish('status.changed');
-            }
-            return;
-        }
         if (pathname === MINI_PROGRAM_DEV_CONTEXT_PATH) {
             if (request.method !== 'POST') {
                 writeMethodNotAllowed(response, 'POST');
@@ -2531,7 +2642,7 @@ function createBrowserDevHostChannelServer(server, options) {
 }
 async function readBrowserDevHostChannelSnapshot(runtime, cookieHeader) {
     const status = await readAccountStatus(runtime, cookieHeader);
-    const permissions = await readBrowserDevPermissionState(runtime.permissionController, runtime.readDevContext());
+    const permissions = context.createBrowserDevPermissionState(runtime.readDevContext());
     return {
         account: {
             revision: status.revision,
@@ -2549,13 +2660,6 @@ async function readAccountStatus(runtime, cookieHeader) {
         ...(status.authenticated ? { userId: status.userId } : {}),
     };
 }
-async function readBrowserDevPermissionState(controller, fallbackContext) {
-    if (!controller)
-        return context.createBrowserDevPermissionState(fallbackContext);
-    const configuration = await controller.get();
-    const runtimePermissions = configuration.override_permissions ?? configuration.remote_permissions;
-    return context.createBrowserDevPermissionState(runtimePermissions === undefined ? { source: configuration.source } : { runtimePermissions });
-}
 function createConnectionEpoch(random) {
     const value = random(16).toString('base64url');
     if (!/^[A-Za-z0-9_-]{22}$/.test(value))
@@ -2607,7 +2711,7 @@ function rejectWebSocketUpgrade(socket) {
 async function handleLoginIntent(request, response, controller) {
     try {
         const payload = await readJsonRequestBody(request);
-        if (!isRecord$3(payload) || Object.keys(payload).some((key) => key !== 'return_path') || typeof payload.return_path !== 'string') {
+        if (!isRecord$2(payload) || Object.keys(payload).some((key) => key !== 'return_path') || typeof payload.return_path !== 'string') {
             throw new BrowserDevSessionError(400, 'INVALID_LOGIN_INTENT', 'Browser Dev Host login intent is invalid');
         }
         const result = await controller.createLoginIntent({
@@ -2654,8 +2758,7 @@ async function handleLoginCallback(request, response, requestUrl, controller) {
     }
 }
 async function handleAuthenticatedRequest(request, response, runtime) {
-    const abort = new AbortController();
-    request.once('aborted', () => abort.abort());
+    const abort = createBrowserDevHostRequestAbortScope(request, response);
     try {
         const payload = await readJsonRequestBody(request);
         const result = runtime.cliAuth
@@ -2666,6 +2769,9 @@ async function handleAuthenticatedRequest(request, response, runtime) {
     catch (error) {
         writeSessionError(response, error);
     }
+    finally {
+        abort.dispose();
+    }
 }
 async function handleMobileLaunchRedirectRotation(request, response, rotate) {
     try {
@@ -2676,7 +2782,7 @@ async function handleMobileLaunchRedirectRotation(request, response, rotate) {
             destroyOnLimit: false,
             maxBytes: MOBILE_LAUNCH_REDIRECT_CONTROL_BODY_LIMIT_BYTES,
         });
-        if (!isRecord$3(value) ||
+        if (!isRecord$2(value) ||
             Object.keys(value).length !== 3 ||
             typeof value.address_id !== 'string' ||
             typeof value.payload !== 'string' ||
@@ -2730,49 +2836,6 @@ function hasValidCsrf(request, csrfToken) {
     const value = request.headers['x-hb-sdk-csrf'];
     return typeof value === 'string' && value === csrfToken;
 }
-async function handleDevPermissionMutation(request, response, controller) {
-    try {
-        if (request.method === 'DELETE') {
-            if (hasRequestBody(request)) {
-                if (!request.headers['content-type']?.toLowerCase().startsWith('application/json')) {
-                    throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
-                }
-                const payload = await readJsonRequestBody(request);
-                if (!isRecord$3(payload) || Object.keys(payload).length > 0) {
-                    throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions reset body is invalid');
-                }
-            }
-            writeJsonResponse(response, 200, await controller.reset());
-            return true;
-        }
-        if (!request.headers['content-type']?.toLowerCase().startsWith('application/json')) {
-            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
-        }
-        const payload = await readJsonRequestBody(request);
-        if (!isRecord$3(payload) || Object.keys(payload).length !== 1 || !Object.hasOwn(payload, 'runtime_permissions')) {
-            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions update body is invalid');
-        }
-        const parsed = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
-        if (!parsed.valid) {
-            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'runtime_permissions is invalid');
-        }
-        const runtimePermissions = JSON.parse(JSON.stringify(payload.runtime_permissions));
-        writeJsonResponse(response, 200, await controller.save(runtimePermissions));
-        return true;
-    }
-    catch (error) {
-        const errorStatus = readBrowserDevHostErrorStatus(error);
-        const status = request.method === 'DELETE' && errorStatus === 500 ? 502 : errorStatus;
-        writeJsonResponse(response, status, {
-            code: request.method === 'DELETE' ? 'DEV_PERMISSIONS_RESET_FAILED' : 'DEV_PERMISSIONS_UPDATE_FAILED',
-            message: readErrorMessage(error),
-        });
-        return false;
-    }
-}
-function hasRequestBody(request) {
-    return request.headers['transfer-encoding'] !== undefined || Number(request.headers['content-length'] ?? 0) > 0;
-}
 function writeMethodNotAllowed(response, allowedMethod) {
     response.writeHead(405, {
         allow: allowedMethod,
@@ -4819,7 +4882,7 @@ const DEFAULT_RUNTIME_SANITIZE_MAX_STRING_LENGTH = 2000;
  *
  * @param value - 待判断的值。
  */
-function isRecord$2(value) {
+function isRecord$1(value) {
     return Boolean(value && typeof value === 'object');
 }
 /**
@@ -4939,14 +5002,14 @@ function normalizeRuntimeError(error, options = {}) {
     if (error instanceof RuntimeError) {
         return error;
     }
-    if (isRecord$2(error)) {
+    if (isRecord$1(error)) {
         const code = readString(error, 'code') ?? options.code ?? 'runtime.error.unknown';
         const message = readString(error, 'message') ?? options.message ?? 'Unknown runtime error';
         const domain = readString(error, 'domain') ?? options.domain ?? inferRuntimeErrorDomain(code);
         const severity = readString(error, 'severity') ?? options.severity;
         const details = sanitizeRuntimeRecord({
             ...options.details,
-            ...((isRecord$2(error.details) ? error.details : undefined) ?? {}),
+            ...((isRecord$1(error.details) ? error.details : undefined) ?? {}),
         });
         return createRuntimeError({
             cause: error instanceof Error ? error.cause : error.cause,
@@ -5016,7 +5079,7 @@ function serializeRuntimeError(error, options = {}, depth = 0) {
     const normalized = normalizeRuntimeError(error);
     const maxCauseDepth = options.maxCauseDepth ?? 4;
     const cause = depth < maxCauseDepth
-        ? (normalized.cause ?? (isRecord$2(error) && 'cause' in error ? error.cause : undefined))
+        ? (normalized.cause ?? (isRecord$1(error) && 'cause' in error ? error.cause : undefined))
         : undefined;
     const details = sanitizeRuntimeRecord(normalized.details, options);
     const serialized = {
@@ -5686,6 +5749,7 @@ function createEndpointObservationConfig(endpoint, options = {}) {
         errorMode: options.errorMode ?? endpoint.errorMode,
         failurePresentation: options.failurePresentation ?? endpoint.failurePresentation,
         jsonParseMode: options.jsonParseMode ?? endpoint.jsonParseMode,
+        maxResponseBytes: options.maxResponseBytes ?? endpoint.maxResponseBytes,
         metadata: {
             ...options.metadata,
             endpointId: endpoint.id,
@@ -5693,10 +5757,12 @@ function createEndpointObservationConfig(endpoint, options = {}) {
         method: endpoint.method,
         observability: options.observability ?? endpoint.observability,
         queryEncoding: options.queryEncoding ?? endpoint.queryEncoding,
+        redirectPolicy: options.redirectPolicy ?? endpoint.redirectPolicy,
         responseType: options.responseType ?? endpoint.responseType,
         security: options.security ?? endpoint.security,
         timeout: options.timeout ?? endpoint.timeout,
         url: typeof endpoint.path === 'string' ? endpoint.path : `endpoint:${endpoint.id}`,
+        withCredentials: options.withCredentials ?? endpoint.withCredentials,
     };
 }
 /**
@@ -5783,13 +5849,16 @@ async function createEndpointConfig(endpoint, input, options = {}) {
         },
         method: endpoint.method,
         jsonParseMode: options.jsonParseMode ?? endpoint.jsonParseMode,
+        maxResponseBytes: options.maxResponseBytes ?? endpoint.maxResponseBytes,
         observability: options.observability ?? endpoint.observability,
         query: mergeRecord(await endpoint.query?.(input), options.params, options.query),
         queryEncoding: options.queryEncoding ?? endpoint.queryEncoding,
+        redirectPolicy: options.redirectPolicy ?? endpoint.redirectPolicy,
         responseType: options.responseType ?? endpoint.responseType,
         security: options.security ?? endpoint.security,
         timeout: options.timeout ?? endpoint.timeout,
         url: getEndpointPath(endpoint, input),
+        withCredentials: options.withCredentials ?? endpoint.withCredentials,
     };
 }
 /**
@@ -5993,15 +6062,18 @@ function createRuntimeRequest(options) {
                     channel: transportConfig.channel,
                     headers: transportConfig.headers,
                     jsonParseMode: transportConfig.jsonParseMode,
+                    maxResponseBytes: transportConfig.maxResponseBytes,
                     metadata: transportConfig.metadata,
                     method: transportConfig.method,
                     query: transportConfig.query,
                     queryEncoding: transportConfig.queryEncoding,
+                    redirectPolicy: transportConfig.redirectPolicy,
                     responseType: transportConfig.responseType,
                     signal: transportConfig.signal,
                     timeout: transportConfig.timeout,
                     traceId: transportConfig.traceId,
                     url: transportConfig.url,
+                    withCredentials: transportConfig.withCredentials,
                 });
                 return {
                     fallbackUsed: transportIndex > 0,
@@ -7867,7 +7939,7 @@ const DEFAULT_NODE_RUNTIME_CONFIG_VALUE_PREFIX = 'RUNTIME_VALUE_';
  *
  * @param value - 待判断的值。
  */
-function isRecord$1(value) {
+function isRecord(value) {
     return Boolean(value && typeof value === 'object' && !Array.isArray(value));
 }
 /**
@@ -7987,7 +8059,7 @@ function parseEnvValue(value) {
  * @param value - 原始值。
  */
 function normalizeFlags(value) {
-    if (!isRecord$1(value)) {
+    if (!isRecord(value)) {
         return undefined;
     }
     const flags = {};
@@ -8004,11 +8076,11 @@ function normalizeFlags(value) {
  * @param value - 原始值。
  */
 function normalizeConfigInput(value) {
-    if (!isRecord$1(value)) {
+    if (!isRecord(value)) {
         return undefined;
     }
     const input = {};
-    if (isRecord$1(value.build)) {
+    if (isRecord(value.build)) {
         input.build = value.build;
     }
     if (typeof value.channel === 'string') {
@@ -8017,16 +8089,16 @@ function normalizeConfigInput(value) {
     if (typeof value.env === 'string') {
         input.env = value.env;
     }
-    if (isRecord$1(value.flags)) {
+    if (isRecord(value.flags)) {
         input.flags = normalizeFlags(value.flags);
     }
     if (typeof value.isProd === 'boolean') {
         input.isProd = value.isProd;
     }
-    if (isRecord$1(value.tenant)) {
+    if (isRecord(value.tenant)) {
         input.tenant = value.tenant;
     }
-    if (isRecord$1(value.values)) {
+    if (isRecord(value.values)) {
         input.values = value.values;
     }
     return hasConfigInput(input) ? input : undefined;
@@ -8570,23 +8642,47 @@ function createFetchRequestControl(signal, timeout) {
  * @param response - transport 响应对象。
  * @param responseType - responseType 参数。
  */
-async function parseFetchResponse(response, responseType, jsonParseMode) {
+async function parseFetchResponse(response, responseType, jsonParseMode, maxResponseBytes) {
+    const limit = normalizeMaxResponseBytes(maxResponseBytes);
     if (responseType === 'raw') {
+        if (limit !== undefined) {
+            throw createRuntimeError({
+                code: 'runtime.transport.raw_response_limit_unsupported',
+                domain: 'transport',
+                message: 'Raw fetch response cannot enforce maxResponseBytes',
+                recoverable: false,
+                severity: 'error',
+            });
+        }
         return response;
     }
     if (response.status === 204) {
         return undefined;
     }
-    if (responseType === 'text') {
+    if (limit === undefined && responseType === 'text') {
         return response.text();
     }
-    if (responseType === 'blob') {
+    if (limit === undefined && responseType === 'blob') {
         return response.blob();
     }
-    if (responseType === 'arrayBuffer') {
+    if (limit === undefined && responseType === 'arrayBuffer') {
         return response.arrayBuffer();
     }
-    const text = await response.text();
+    if (limit === undefined) {
+        return parseFetchText(await response.text(), responseType, jsonParseMode);
+    }
+    const bytes = await readBoundedResponse(response, limit);
+    if (responseType === 'arrayBuffer')
+        return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    if (responseType === 'blob') {
+        const blobBytes = bytes.slice().buffer;
+        return new Blob([blobBytes], { type: response.headers.get('content-type') ?? '' });
+    }
+    return parseFetchText(new TextDecoder().decode(bytes), responseType, jsonParseMode);
+}
+function parseFetchText(text, responseType, jsonParseMode) {
+    if (responseType === 'text')
+        return text;
     if (!text) {
         return undefined;
     }
@@ -8600,6 +8696,62 @@ async function parseFetchResponse(response, responseType, jsonParseMode) {
         throw error;
     }
 }
+function normalizeMaxResponseBytes(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new TypeError('maxResponseBytes must be a positive safe integer');
+    return value;
+}
+function responseTooLarge(maxResponseBytes, receivedBytes) {
+    return createRuntimeError({
+        code: 'runtime.transport.response_too_large',
+        details: {
+            maxResponseBytes,
+            ...(receivedBytes === undefined ? {} : { receivedBytes }),
+        },
+        domain: 'transport',
+        message: `Fetch response exceeds ${maxResponseBytes} bytes`,
+        recoverable: false,
+        severity: 'error',
+    });
+}
+async function readBoundedResponse(response, maxResponseBytes) {
+    const declared = response.headers.get('content-length');
+    if (declared && /^(?:0|[1-9]\d*)$/.test(declared)) {
+        const declaredBytes = Number(declared);
+        if (Number.isSafeInteger(declaredBytes) && declaredBytes > maxResponseBytes)
+            throw responseTooLarge(maxResponseBytes, declaredBytes);
+    }
+    const reader = response.body?.getReader();
+    if (!reader)
+        return new Uint8Array();
+    const chunks = [];
+    let receivedBytes = 0;
+    try {
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            receivedBytes += next.value.byteLength;
+            if (receivedBytes > maxResponseBytes) {
+                await reader.cancel().catch(() => undefined);
+                throw responseTooLarge(maxResponseBytes, receivedBytes);
+            }
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const result = new Uint8Array(receivedBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+}
 /**
  * 创建基于 fetch 的 runtime transport。
  *
@@ -8638,13 +8790,14 @@ function createFetchRuntimeTransport(options = {}) {
             try {
                 const response = await requestControl.wait(fetcher(url, {
                     body: createRequestBody(request.body, headers, request.bodyEncoding),
-                    credentials: options.credentials,
+                    credentials: request.withCredentials === undefined ? options.credentials : request.withCredentials ? 'include' : 'omit',
                     headers,
                     method: request.method ?? 'GET',
+                    ...(request.redirectPolicy === undefined ? {} : { redirect: request.redirectPolicy }),
                     ...(requestControl.signal ? { signal: requestControl.signal } : undefined),
                 }));
                 return {
-                    data: await parseFetchResponse(response, request.responseType ?? 'json', request.jsonParseMode ?? 'strict'),
+                    data: await parseFetchResponse(response, request.responseType ?? 'json', request.jsonParseMode ?? 'strict', request.maxResponseBytes),
                     headers: Object.fromEntries(response.headers.entries()),
                     raw: response,
                     request: {
@@ -10741,7 +10894,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-SXAQ3WVR.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-BoBHPfpq.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -14527,6 +14680,7 @@ const websitePolicy = {
 const CREDENTIAL_HEADER_RE = /^(?:authentication-info|authorization|cookie|cookie2|proxy-authenticate|proxy-authentication-info|proxy-authorization|set-cookie|set-cookie2|www-authenticate|pkey|x-pkey|x-access-token|x-auth-token|x-api-key)$/i;
 function createBrowserDevHostCliAuth(options = {}) {
     const fetchImpl = options.fetchImpl ?? fetch;
+    const noRedirectFetch = (input, init) => fetchImpl(input, { ...init, redirect: 'manual' });
     const store = options.store ?? { env: options.env };
     const readSession = options.readSession ?? (() => session.readHeyboxAuthSession(store));
     let lastKey = '';
@@ -14538,7 +14692,7 @@ function createBrowserDevHostCliAuth(options = {}) {
         runtimePromise ??= createNodeProcessRuntime({
             appId: 'hb-sdk-browser-dev-host',
             environment: createNodeProcessRuntimeEnvironment({
-                transport: createFetchRuntimeTransport({ fetch: fetchImpl }),
+                transport: createFetchRuntimeTransport({ fetch: noRedirectFetch }),
             }),
             identity: {
                 container: 'browser',
@@ -14609,10 +14763,10 @@ async function readCliUserProfile(runtime, session) {
     }
 }
 function readCliUserProfileFields(value) {
-    if (!isRecord$3(value))
+    if (!isRecord$2(value))
         return undefined;
-    const data = isRecord$3(value.data) ? value.data : value;
-    const result = isRecord$3(data.result) ? data.result : data;
+    const data = isRecord$2(value.data) ? value.data : value;
+    const result = isRecord$2(data.result) ? data.result : data;
     const nickname = typeof result.display_username === 'string' ? result.display_username.trim() : '';
     const avatar = typeof result.display_avatar === 'string' ? result.display_avatar.trim() : '';
     if (!nickname && !avatar)
@@ -14673,7 +14827,7 @@ async function executeCliHeyboxAuthenticatedRequest(runtime, session, request, s
 }
 function readQueryParams(params) {
     const query = {};
-    if (!isRecord$3(params))
+    if (!isRecord$2(params))
         return query;
     for (const [key, value] of Object.entries(params)) {
         if (value === undefined || value === null || key === 'heybox_id')
@@ -14698,111 +14852,6 @@ function containsSecret(value, secret) {
     }
 }
 
-const MINI_PROGRAM_URL_QUERY_PARAM = 'mini_url';
-const MINI_PROGRAM_SDK_VERSION_QUERY_PARAM = 'sdk_version';
-const MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM = 'local_dev_launch_token';
-const MINI_PROGRAM_DEV_SHELL_URL = 'heybox-mini-dev://sandbox';
-const OPEN_IN_APP_URL = 'https://api.xiaoheihe.cn/open_inapp/';
-function createMacAppProtocol(appUrl, options = {}) {
-    return createHeyboxProtocol(createMiniProgramDevShellOpenWindowPayload(appUrl, options));
-}
-function createMobileAppQrPayload(appUrl, options = {}) {
-    const protocol = createHeyboxProtocol(createMiniProgramDevShellOpenWindowPayload(appUrl, { ...options, encodeMiniUrl: false }));
-    return `${OPEN_IN_APP_URL}#${protocol}`;
-}
-function createMiniProgramDevShellOpenWindowPayload(appUrl, options = {}) {
-    const devShellUrl = options.encodeMiniUrl === false
-        ? createPartiallyEncodedMiniProgramDevShellUrl(appUrl, options)
-        : createEncodedMiniProgramDevShellUrl(appUrl, options);
-    return createOpenWindowPayload(devShellUrl, options.miniProgramId);
-}
-function createOpenWindowPayload(webviewUrl, miniProgramIdValue) {
-    const miniProgramId = miniProgramIdValue?.trim();
-    return {
-        protocol_type: 'openWindow',
-        full_screen: true,
-        mini_program: '1',
-        ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
-        navigation_bar: {
-            title: '',
-        },
-        webview: {
-            url: webviewUrl,
-            pull: false,
-            refresh: false,
-        },
-    };
-}
-function readDevShellQueryEntries(appUrl, options) {
-    const entries = [[MINI_PROGRAM_URL_QUERY_PARAM, appUrl]];
-    const miniProgramId = options.miniProgramId?.trim();
-    if (miniProgramId)
-        entries.push(['mini_program_id', miniProgramId]);
-    const localDevLaunchToken = options.localDevLaunchToken?.trim();
-    if (localDevLaunchToken)
-        entries.push([MINI_PROGRAM_LOCAL_DEV_LAUNCH_TOKEN_QUERY_PARAM, localDevLaunchToken]);
-    const devContextUrl = readDevContextUrl(options.devContextUrl);
-    if (devContextUrl)
-        entries.push([MINI_PROGRAM_DEV_CONTEXT_QUERY_PARAM, devContextUrl]);
-    const sdkVersion = options.sdkVersion?.trim();
-    if (sdkVersion)
-        entries.push([MINI_PROGRAM_SDK_VERSION_QUERY_PARAM, sdkVersion]);
-    return entries;
-}
-function createPartiallyEncodedMiniProgramDevShellUrl(appUrl, options) {
-    return `${MINI_PROGRAM_DEV_SHELL_URL}?${readDevShellQueryEntries(appUrl, options)
-        .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
-        .join('&')}`;
-}
-function createEncodedMiniProgramDevShellUrl(appUrl, options) {
-    const devShellUrl = new URL(MINI_PROGRAM_DEV_SHELL_URL);
-    for (const [key, value] of readDevShellQueryEntries(appUrl, options)) {
-        devShellUrl.searchParams.set(key, value);
-    }
-    return devShellUrl.toString();
-}
-function readDevContextUrl(value) {
-    if (value === undefined || value === '')
-        return undefined;
-    return parseDevContextUrl(value, 'loopback-or-private', 'devContextUrl must be a canonical Dev Session URL').href;
-}
-function projectMiniProgramDevContextUrlToPrivateHost(value, host) {
-    const url = parseDevContextUrl(value, 'loopback', 'devContextUrl must be a canonical loopback Dev Session URL');
-    if (!isCanonicalPrivateLanIpv4(host)) {
-        throw new TypeError('Mobile Dev Context host must be a canonical private IPv4 address');
-    }
-    url.hostname = host;
-    return url.href;
-}
-function parseDevContextUrl(value, hostPolicy, errorMessage) {
-    if (value !== value.trim())
-        throw new TypeError(errorMessage);
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new TypeError(errorMessage);
-    }
-    const tokenPath = `${MINI_PROGRAM_DEV_CONTEXT_PATH}/`;
-    const hostAllowed = isLoopbackHostname(url.hostname) || (hostPolicy === 'loopback-or-private' && isCanonicalPrivateLanIpv4(url.hostname));
-    if (url.protocol !== 'http:' ||
-        url.username !== '' ||
-        url.password !== '' ||
-        url.search !== '' ||
-        url.hash !== '' ||
-        !url.pathname.startsWith(tokenPath) ||
-        !/^[a-f0-9]{64}$/.test(url.pathname.slice(tokenPath.length)) ||
-        !hostAllowed ||
-        url.href !== value) {
-        throw new TypeError(errorMessage);
-    }
-    return url;
-}
-function createHeyboxProtocol(payload) {
-    return `heybox://${encodeURIComponent(JSON.stringify(payload))}`;
-}
-
 const LAUNCH_CORS_HEADERS = {
     'access-control-allow-methods': 'GET',
     'access-control-allow-origin': '*',
@@ -14908,123 +14957,7 @@ function writeLaunchResponse(response, status, body) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.5-alpha.0';
-
-class DevPermissionOverrideStoreError extends Error {
-    code;
-    constructor(message, code, options = {}) {
-        super(message, { cause: options.cause });
-        this.code = code;
-        this.name = 'DevPermissionOverrideStoreError';
-    }
-}
-const CACHE_VERSION = 1;
-const CACHE_DIRECTORY_NAME = 'dev-permission-overrides';
-const defaultPaths = index.envPaths('hb-sdk', { suffix: '' });
-function createDevPermissionOverrideStore(options = {}) {
-    const cacheDirectory = path.join(options.cacheRoot ?? defaultPaths.cache, CACHE_DIRECTORY_NAME);
-    return {
-        async read(scope) {
-            return readScopeFile(await getScopeFile(cacheDirectory, scope));
-        },
-        async remove(scope) {
-            const scopeFile = await getScopeFile(cacheDirectory, scope);
-            try {
-                await fs$1.unlink(scopeFile);
-            }
-            catch (error) {
-                if (isNodeError(error) && error.code === 'ENOENT') {
-                    return;
-                }
-                throw createWriteError(error);
-            }
-        },
-        async set(scope, overrides) {
-            const scopeFile = await getScopeFile(cacheDirectory, scope);
-            try {
-                await fs$1.mkdir(cacheDirectory, { recursive: true, mode: 0o700 });
-                await fs$1.chmod(cacheDirectory, 0o700);
-                await readScopeFile(scopeFile);
-                await writeScopeFileAtomically(scopeFile, {
-                    version: CACHE_VERSION,
-                    overrides: cloneOverrides(overrides),
-                });
-            }
-            catch (error) {
-                if (error instanceof DevPermissionOverrideStoreError) {
-                    throw error;
-                }
-                throw createWriteError(error);
-            }
-        },
-    };
-}
-async function getScopeFile(cacheDirectory, scope) {
-    const projectRoot = await fs$1.realpath(scope.projectRoot);
-    const miniProgramId = scope.miniProgramId ?? 'anonymous';
-    const scopeHash = node_crypto.createHash('sha256').update(`${projectRoot}\0${miniProgramId}`).digest('hex');
-    return path.join(cacheDirectory, `${scopeHash}.json`);
-}
-async function readScopeFile(scopeFile) {
-    let contents;
-    try {
-        contents = await fs$1.readFile(scopeFile, 'utf8');
-    }
-    catch (error) {
-        if (isNodeError(error) && error.code === 'ENOENT') {
-            return undefined;
-        }
-        throw error;
-    }
-    try {
-        const parsed = JSON.parse(contents);
-        const overrides = parsePersistedOverride(parsed);
-        if (!overrides) {
-            throw new TypeError('invalid cache schema');
-        }
-        return overrides;
-    }
-    catch (error) {
-        throw new DevPermissionOverrideStoreError('hb-sdk 本地权限覆盖缓存已损坏', 'DEV_PERMISSION_OVERRIDE_CACHE_CORRUPT', {
-            cause: error,
-        });
-    }
-}
-async function writeScopeFileAtomically(scopeFile, value) {
-    const tempFile = `${scopeFile}.${process.pid}.${node_crypto.randomBytes(8).toString('hex')}.tmp`;
-    let handle;
-    try {
-        handle = await fs$1.open(tempFile, 'wx', 0o600);
-        await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
-        await handle.sync();
-        await handle.close();
-        handle = undefined;
-        await fs$1.rename(tempFile, scopeFile);
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-        await fs$1.unlink(tempFile).catch(() => undefined);
-    }
-}
-function createWriteError(cause) {
-    return new DevPermissionOverrideStoreError('无法写入 hb-sdk 本地权限覆盖缓存', 'DEV_PERMISSION_OVERRIDE_WRITE_FAILED', { cause });
-}
-function cloneOverrides(overrides) {
-    return {
-        networkRequest: { ...overrides.networkRequest },
-    };
-}
-function parsePersistedOverride(value) {
-    if (!isRecord(value) || value.version !== CACHE_VERSION || Object.keys(value).length !== 2)
-        return undefined;
-    return context.parseBrowserDevPermissionState(value.overrides);
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function isNodeError(error) {
-    return error instanceof Error && 'code' in error;
-}
+    : '0.8.0-alpha.2';
 
 const DEFAULT_APP_PORT = 5173;
 const DEFAULT_BROWSER_DEV_HOST_PORT = 5174;
@@ -15062,44 +14995,7 @@ async function runDevCommand(options, runtime = {}) {
         projectRoot,
         timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
     });
-    const innerPermissionController = createDevPermissionController({
-        boundMiniProgramId: await context.readBoundMiniProgramId(projectRoot),
-        cacheRoot: runtime.devPermissionCacheRoot,
-        devContext: devLaunchContext,
-        loadRemoteContext: async () => (await loadDevLaunchContext({
-            env: runtime.env,
-            fetchImpl,
-            logger,
-            projectRoot,
-            timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
-        })).context,
-        projectRoot,
-    });
-    let launchRuntimePermissions = context.createBrowserDevRuntimePermissions(context.createBrowserDevPermissionState(devLaunchContext));
-    const rememberLaunchRuntimePermissions = (configuration) => {
-        const snapshot = configuration.override_permissions ?? configuration.remote_permissions;
-        launchRuntimePermissions = context.parseMiniProgramRuntimePermissions(snapshot).valid
-            ? JSON.parse(JSON.stringify(snapshot))
-            : context.createBrowserDevRuntimePermissions({ networkRequest: { status: 'disabled', useOfficialDomain: false } });
-    };
-    rememberLaunchRuntimePermissions(await innerPermissionController.get());
-    const permissionController = {
-        get: async () => {
-            const configuration = await innerPermissionController.get();
-            rememberLaunchRuntimePermissions(configuration);
-            return configuration;
-        },
-        reset: async () => {
-            const configuration = await innerPermissionController.reset();
-            rememberLaunchRuntimePermissions(configuration);
-            return configuration;
-        },
-        save: async (runtimePermissions) => {
-            const configuration = await innerPermissionController.save(runtimePermissions);
-            rememberLaunchRuntimePermissions(configuration);
-            return configuration;
-        },
-    };
+    const launchRuntimePermissions = context.createBrowserDevRuntimePermissions(context.createBrowserDevPermissionState(devLaunchContext));
     const vite = await logger.task('正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), { successText: '已加载项目 Vite' });
     const appServer = await logger.task('正在创建 Vite dev server', () => runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(devLaunchContext.runtimePermissions), () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions)), runtime.env), runtime.env), { successText: '已创建 Vite dev server' });
     const mobileDevContextUrlsByOrigin = new Map();
@@ -15146,18 +15042,12 @@ async function runDevCommand(options, runtime = {}) {
             loginService: runtime.loginService,
             miniProgram,
             cliAuth: runtime.cliAuth ?? createBrowserDevHostCliAuth({ env: runtime.env, fetchImpl }),
-            macAppProtocol: createMacAppProtocol(appUrl, {
-                miniProgramId: devLaunchContext.miniProgramId,
-                localDevLaunchToken: devLaunchContext.localDevLaunchToken,
-                sdkVersion: HB_SDK_VERSION,
-            }),
             onMobileDevSessionCreated: ({ devContextUrl, miniUrlOrigin }) => {
                 mobileDevContextUrlsByOrigin.set(miniUrlOrigin, devContextUrl);
                 browserDevHost.updateBootstrap({
                     lanAddresses: buildLanAddresses(),
                 });
             },
-            permissionController,
             port: options.browserDevHostPort ?? DEFAULT_BROWSER_DEV_HOST_PORT,
             root: runtime.browserDevHostRoot,
             rootCandidates: runtime.browserDevHostRootCandidates,
@@ -15186,11 +15076,6 @@ async function runDevCommand(options, runtime = {}) {
                 browserDevHost.updateBootstrap({
                     devContext: tokenContext,
                     lanAddresses: buildLanAddresses(),
-                    macAppProtocol: createMacAppProtocol(appUrl, {
-                        miniProgramId: devLaunchContext.miniProgramId,
-                        localDevLaunchToken,
-                        sdkVersion: HB_SDK_VERSION,
-                    }),
                 });
             },
             projectRoot,
@@ -15250,72 +15135,6 @@ function createMiniProgramSummary(miniProgramId, detail) {
         ...(typeof detail.developer_name === 'string' && detail.developer_name.trim() ? { developerName: detail.developer_name.trim() } : {}),
     };
 }
-function createDevPermissionController(options) {
-    const store = createDevPermissionOverrideStore({ cacheRoot: options.cacheRoot });
-    let devContext = options.devContext;
-    let ephemeralOverride;
-    let persistenceError;
-    const readScope = () => ({
-        projectRoot: options.projectRoot,
-        ...(options.boundMiniProgramId ? { miniProgramId: options.boundMiniProgramId } : {}),
-    });
-    const createConfiguration = (overrides, error = persistenceError) => {
-        const miniProgramId = options.boundMiniProgramId ?? devContext.miniProgramId;
-        return {
-            source: devContext.source,
-            ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
-            ...(isRuntimePermissionsSnapshot(devContext.runtimePermissions) ? { remote_permissions: devContext.runtimePermissions } : {}),
-            ...(overrides ? { override_permissions: context.createBrowserDevRuntimePermissions(overrides) } : {}),
-            ...(error ? { persistence_error: error } : {}),
-        };
-    };
-    const get = async () => {
-        try {
-            const persistedOverride = await store.read(readScope());
-            return createConfiguration(ephemeralOverride ?? persistedOverride);
-        }
-        catch (error) {
-            persistenceError = index.readErrorMessage(error);
-            return createConfiguration(ephemeralOverride, persistenceError);
-        }
-    };
-    return {
-        get,
-        async reset() {
-            let refreshedContext;
-            try {
-                refreshedContext = await options.loadRemoteContext();
-            }
-            catch (error) {
-                throw new Error('远端权限读取失败，请检查 CLI 登录状态和网络后重试。', { cause: error });
-            }
-            await store.remove(readScope());
-            devContext = refreshedContext;
-            ephemeralOverride = undefined;
-            persistenceError = undefined;
-            return createConfiguration(undefined);
-        },
-        async save(runtimePermissions) {
-            const overrides = context.createBrowserDevPermissionState({
-                runtimePermissions,
-            });
-            try {
-                await store.set(readScope(), overrides);
-                ephemeralOverride = undefined;
-                persistenceError = undefined;
-                return createConfiguration(overrides);
-            }
-            catch {
-                ephemeralOverride = overrides;
-                persistenceError = '保存失败，当前页面仍会应用该权限，但刷新或重启后会丢失。';
-                return createConfiguration(overrides, persistenceError);
-            }
-        },
-    };
-}
-function isRuntimePermissionsSnapshot(value) {
-    return context.parseMiniProgramRuntimePermissions(value).valid;
-}
 async function loadRemoteDevContextWithTimeout(options) {
     const controller = new AbortController();
     const fetchImpl = ((input, init) => options.fetchImpl(input, { ...init, signal: controller.signal }));