@heybox/hb-sdk 0.8.0-alpha → 0.8.0-alpha.10

package/dist/templates/vanilla-vite-js/src/styles.css

@@ -0,0 +1,155 @@
+:root {
+  --page-background: #f7f8f9;
+  --text-primary: #14191e;
+  --text-secondary: #64696e;
+  --button-background: #14191e;
+  --button-foreground: #ffffff;
+  --button-hover: #393d40;
+  --button-pressed: #000000;
+  --button-disabled: #c8cdd2;
+  --focus-ring: #009015;
+  --error: #c92228;
+  color-scheme: light dark;
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC', 'Microsoft YaHei', sans-serif;
+  color: var(--text-primary);
+  background: var(--page-background);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body {
+  margin: 0;
+  min-width: 0;
+  min-height: 100%;
+  background: var(--page-background);
+}
+
+body {
+  min-height: 100vh;
+  min-height: 100dvh;
+}
+
+.page {
+  display: grid;
+  min-height: 100vh;
+  min-height: 100dvh;
+  place-items: center;
+  padding: max(32px, env(safe-area-inset-top)) max(24px, env(safe-area-inset-right)) max(32px, env(safe-area-inset-bottom))
+    max(24px, env(safe-area-inset-left));
+}
+
+.content {
+  width: min(100%, 360px);
+  text-align: center;
+}
+
+.logo {
+  display: block;
+  width: 36px;
+  height: 36px;
+  margin: 0 auto 32px;
+  object-fit: contain;
+}
+
+h1 {
+  margin: 0;
+  color: var(--text-primary);
+  font-size: 32px;
+  line-height: 1.25;
+  letter-spacing: 0;
+}
+
+.welcome {
+  margin: 12px 0 32px;
+  color: var(--text-secondary);
+  font-size: 16px;
+  line-height: 1.5;
+}
+
+button {
+  width: 160px;
+  min-height: 48px;
+  border: 0;
+  border-radius: 6px;
+  color: var(--button-foreground);
+  background: var(--button-background);
+  font: inherit;
+  font-weight: 600;
+  cursor: pointer;
+  transition:
+    background-color 160ms ease,
+    transform 160ms ease;
+}
+
+button:active:not(:disabled) {
+  background: var(--button-pressed);
+  transform: scale(0.98);
+}
+
+button:focus-visible {
+  outline: 3px solid var(--focus-ring);
+  outline-offset: 3px;
+}
+
+button:disabled {
+  background: var(--button-disabled);
+  cursor: wait;
+}
+
+.error {
+  min-height: 24px;
+  margin: 12px 0 0;
+  color: var(--error);
+  font-size: 14px;
+  line-height: 24px;
+}
+
+@media (hover: hover) {
+  button:hover:not(:disabled) {
+    background: var(--button-hover);
+  }
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --page-background: #14191e;
+    --text-primary: #f7f8f9;
+    --text-secondary: #91959a;
+    --button-background: #f7f8f9;
+    --button-foreground: #14191e;
+    --button-hover: #ffffff;
+    --button-pressed: #c4c8cc;
+    --button-disabled: #696e72;
+    --focus-ring: #32b846;
+    --error: #fa3c4b;
+  }
+
+  .logo {
+    filter: invert(1);
+  }
+}
+
+@media (max-height: 420px) and (orientation: landscape) {
+  .page {
+    place-items: start center;
+    padding-top: max(20px, env(safe-area-inset-top));
+    padding-bottom: max(20px, env(safe-area-inset-bottom));
+  }
+
+  .logo {
+    margin-bottom: 16px;
+  }
+
+  .welcome {
+    margin-bottom: 20px;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  button {
+    transition: none;
+  }
+}

package/dist/templates/{vue3-vite-ts/vite.config.ts → vanilla-vite-js/vite.config.js}

@@ -1,8 +1,7 @@
-import vue from '@vitejs/plugin-vue';
 import { miniappManifest } from '@heybox/hb-sdk/vite';
 import { defineConfig } from 'vite';
 
 export default defineConfig({
   base: './',
-  plugins: [vue(), miniappManifest({ platforms: ['android', 'ios', 'ohos'] })],
+  plugins: [miniappManifest({ platforms: ['android', 'ios', 'ohos'] })],
 });

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.0-alpha';
+    : '0.8.0-alpha.10';
 
 var re = {exports: {}};
 
@@ -2795,6 +2795,197 @@ function requireSemver () {
 
 var semverExports = requireSemver();
 
+const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
+const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
+
+const MINI_PROGRAM_PERMISSION_KEYS = [
+    'userInfo',
+    'steamLibrary',
+    'share',
+    'storage',
+    'filesystem',
+    'clipboard',
+    'leaderboard',
+    'network',
+];
+const MINI_PROGRAM_PERMISSION_CATALOG = [
+    {
+        key: 'userInfo',
+        name: '用户信息',
+        description: '登录小程序并读取当前用户的授权信息。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['auth.login', 'user.getInfo'],
+        conditions: ['继续执行黑盒登录、用户授权和可信手势规则。'],
+    },
+    {
+        key: 'steamLibrary',
+        name: 'Steam 游戏库',
+        description: '读取当前用户授权的 Steam 游戏库。',
+        access: 'declaration',
+        risk: 'high',
+        config: {},
+        methods: ['user.getSteamGameList'],
+        conditions: ['继续执行账号绑定和数据可用性规则。'],
+    },
+    {
+        key: 'share',
+        name: '分享',
+        description: '使用小程序分享、分享菜单和截图能力。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['share.copyLink', 'share.showShareMenu', 'share.screenshot'],
+        conditions: ['继续执行分享参数校验和 Host 支持检查。'],
+    },
+    {
+        key: 'storage',
+        name: '键值存储',
+        description: '读写按小程序隔离的简单键值数据。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['storage.getStorage', 'storage.setStorage'],
+        conditions: ['仅用于简单键值存储，不包含文件系统。'],
+    },
+    {
+        key: 'filesystem',
+        name: '文件系统',
+        description: '访问小程序沙盒文件和用户选择的外部文件。',
+        access: 'declaration',
+        risk: 'high',
+        config: {},
+        methods: [
+            'network.download',
+            'files.pickFiles',
+            'files.pickDirectory',
+            'files.saveFile',
+            'file.create',
+            'file.remove',
+            'file.exists',
+            'file.readText',
+            'file.writeText',
+            'file.readBytes',
+            'file.writeBytes',
+            'file.stat',
+            'directory.create',
+            'directory.remove',
+            'directory.exists',
+            'directory.list',
+        ],
+        conditions: ['外部文件继续要求有效的用户选择、会话句柄和匹配的读写模式。'],
+    },
+    {
+        key: 'clipboard',
+        name: '剪贴板',
+        description: '向系统剪贴板写入文本。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['device.setClipboard'],
+        conditions: ['继续执行文本长度和 Host 支持限制。'],
+    },
+    {
+        key: 'leaderboard',
+        name: '排行榜',
+        description: '读写小程序云排行榜。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: [
+            'cloud.leaderboard.submit',
+            'cloud.leaderboard.getList',
+            'cloud.leaderboard.getCurrentUserEntry',
+            'cloud.leaderboard.deleteCurrentUserEntry',
+            'cloud.leaderboard.getInfo',
+        ],
+        conditions: ['排行榜必须已创建，用户和资源规则保持不变。'],
+    },
+    {
+        key: 'network',
+        name: '网络',
+        description: '通过 network 模块请求或下载外部资源。',
+        access: 'platform-approval',
+        risk: 'high',
+        config: {
+            useOfficialDomain: {
+                type: 'boolean',
+                required: false,
+                default: false,
+                description: '是否申请访问小黑盒官方域名。',
+            },
+        },
+        methods: ['network.request', 'network.download'],
+        conditions: ['声明后仍需平台批准，并继续执行网络安全策略。'],
+    },
+];
+new Set(MINI_PROGRAM_PERMISSION_KEYS);
+
+new Set(MINI_PROGRAM_PERMISSION_KEYS);
+
+const MINIAPP_PERMISSION_KEYS = MINI_PROGRAM_PERMISSION_KEYS;
+function parseMiniappPermissions(value, options) {
+    const sourceLabel = options.sourceLabel ?? 'package.json#heybox.permissions';
+    if (!options.present) {
+        if (requiresExplicitPermissions(options.sdkVersion)) {
+            throw new Error(`${sourceLabel} 在 @heybox/hb-sdk ${options.sdkVersion} 中必须声明；无权限需求时请配置空对象 {}`);
+        }
+        return { declared: false };
+    }
+    if (!isRecord$1(value)) {
+        throw new Error(`${sourceLabel} 必须是 JSON 对象`);
+    }
+    const knownKeys = new Set(MINIAPP_PERMISSION_KEYS);
+    for (const key of Object.keys(value)) {
+        if (!knownKeys.has(key))
+            throw new Error(`${sourceLabel} 包含未知权限：${key}`);
+    }
+    const permissions = {};
+    for (const key of MINIAPP_PERMISSION_KEYS) {
+        if (!Object.prototype.hasOwnProperty.call(value, key))
+            continue;
+        const declaration = value[key];
+        const itemLabel = `${sourceLabel}.${key}`;
+        if (!isRecord$1(declaration))
+            throw new Error(`${itemLabel} 必须是 JSON 对象`);
+        const definition = MINI_PROGRAM_PERMISSION_CATALOG.find((item) => item.key === key);
+        if (!definition)
+            throw new Error(`权限目录缺少定义：${key}`);
+        const allowedFields = new Set(['enabled', ...Object.keys(definition.config)]);
+        for (const field of Object.keys(declaration)) {
+            if (!allowedFields.has(field))
+                throw new Error(`${itemLabel} 包含未知字段：${field}`);
+        }
+        if (typeof declaration.enabled !== 'boolean')
+            throw new Error(`${itemLabel}.enabled 必须是 boolean`);
+        let useOfficialDomain = false;
+        if (key === 'network') {
+            if (declaration.useOfficialDomain !== undefined && typeof declaration.useOfficialDomain !== 'boolean') {
+                throw new Error(`${itemLabel}.useOfficialDomain 必须是 boolean`);
+            }
+            useOfficialDomain = declaration.useOfficialDomain === true;
+        }
+        if (!declaration.enabled)
+            continue;
+        permissions[key] = key === 'network' ? { enabled: true, useOfficialDomain } : { enabled: true };
+    }
+    return { declared: true, permissions: permissions };
+}
+function requiresExplicitPermissions(sdkVersion) {
+    const parsed = semverExports.parse(sdkVersion);
+    if (!parsed)
+        throw new Error(`sdkVersion 必须是合法 SemVer：${sdkVersion}`);
+    return parsed.major > 0 || parsed.minor >= 9;
+}
+function getMissingPermissionsWarning(sourceLabel = 'package.json#heybox.permissions') {
+    return `${sourceLabel} 尚未声明。当前按 0.8 兼容行为构建；0.9.0 起将拒绝构建，请尽快补充权限声明（无权限需求时配置 {}）。`;
+}
+function isRecord$1(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
 const MINIAPP_PLATFORM_VALUES = ['android', 'ios', 'ohos', 'windows', 'macos', 'linux'];
 function validateMiniappPackageVersionForBuild(version) {
     return validateMiniappManifestVersion(version, 'package.json.version');
@@ -2808,7 +2999,13 @@ function validateMiniappManifestVersion(version, sourceLabel = 'manifest.version
 }
 function renderMiniappManifest(manifest) {
     const platforms = validateMiniappPlatforms(manifest.platforms, 'manifest.platforms');
-    return `${JSON.stringify({ version: manifest.version, sdkVersion: manifest.sdkVersion, platforms }, null, 2)}\n`;
+    const output = {
+        version: manifest.version,
+        sdkVersion: manifest.sdkVersion,
+        platforms,
+        ...(manifest.permissions === undefined ? {} : { permissions: manifest.permissions }),
+    };
+    return `${JSON.stringify(output, null, 2)}\n`;
 }
 function validateMiniappPlatforms(platforms, sourceLabel = 'platforms') {
     if (!Array.isArray(platforms) || platforms.length === 0) {
@@ -2863,6 +3060,21 @@ function findNearestPackageJsonPath(startDir) {
     }
 }
 function readMiniappVersionFromPackageJson(root) {
+    return readMiniappPackageJson(root, true).version;
+}
+function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
+    const { packageJson } = readMiniappPackageJson(root, false);
+    const heybox = packageJson.heybox;
+    if (heybox !== undefined && !isRecord(heybox)) {
+        throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
+    }
+    const present = isRecord(heybox) && Object.prototype.hasOwnProperty.call(heybox, 'permissions');
+    return parseMiniappPermissions(isRecord(heybox) ? heybox.permissions : undefined, {
+        present,
+        sdkVersion,
+    });
+}
+function readMiniappPackageJson(root, requireVersion) {
     const packageJsonPath = findNearestPackageJsonPath(root);
     let content;
     try {
@@ -2878,10 +3090,13 @@ function readMiniappVersionFromPackageJson(root) {
     catch (error) {
         throw new Error(`@heybox/hb-sdk 解析 package.json 失败：${formatReason(error)}`);
     }
-    if (typeof packageJson.version !== 'string' || packageJson.version.trim() === '') {
+    if (requireVersion && (typeof packageJson.version !== 'string' || packageJson.version.trim() === '')) {
         throw new Error('@heybox/hb-sdk 提示：package.json.version 必须是非空字符串');
     }
-    return packageJson.version.trim();
+    return { packageJson, version: typeof packageJson.version === 'string' ? packageJson.version.trim() : '' };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 function formatReason(error) {
     if (error instanceof Error && error.message) {
@@ -11320,10 +11535,6 @@ function parse(html, options) {
     return Parser.parse(html, options);
 }
 
-const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
-const MINI_PROGRAM_MESSAGE_VERSION = 2;
-const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
-
 const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
 const RUNTIME_GATE_MARKER = 'data-heybox-runtime-gate';
 const RUNTIME_GATE_STYLE_MARKER = 'data-heybox-runtime-gate-style';
@@ -11699,6 +11910,9 @@ function miniappManifest(options) {
             }
             const version = validateMiniappPackageVersionForBuild(readMiniappVersionFromPackageJson(root));
             const sdkVersion = resolveSdkVersion();
+            const parsedPermissions = readMiniappPermissionsFromPackageJson(root, sdkVersion);
+            if (!parsedPermissions.declared)
+                this.warn(getMissingPermissionsWarning());
             const outputRoot = path.resolve(root, outDir);
             const htmlFiles = collectHtmlFiles(outputRoot);
             const unexpectedHtmlFiles = htmlFiles.filter((file) => path.relative(outputRoot, file) !== 'index.html');
@@ -11714,7 +11928,12 @@ function miniappManifest(options) {
             node_fs.writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(node_fs.readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
             const manifestPath = path.join(outputRoot, 'manifest.json');
             node_fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
-            node_fs.writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion, platforms }));
+            node_fs.writeFileSync(manifestPath, renderMiniappManifest({
+                version,
+                sdkVersion,
+                platforms,
+                ...(parsedPermissions.permissions === undefined ? {} : { permissions: parsedPermissions.permissions }),
+            }));
         },
     };
 }