@heybox/hb-sdk 0.8.1-alpha.12 → 0.8.1-alpha.14

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。内部集成、实现策略和审查证据不在此维护。
 
+## 0.8.1-alpha.14
+
+- 新增 `package.json#heybox.window` 开发者声明：`defaultWidth` / `defaultHeight` / `minWidth` / `minHeight` / `resizable`，构建时写入 `dist/manifest.json`，所有平台都会写入，由各宿主自行消费。
+- 声明严格校验：空对象、未知字段、`width` / `height` 写法、非正整数、超过 `16384`、`min` 未与对应默认值配对或 `min > default` 全部构建期失败；`x` / `y` 显式报错，**位置不开放**。
+- `resizable` 只约束用户手动拖拽；用户拖拽位置不受该字段限制，窗口位置始终不对开发者开放。
+- `hb-sdk build` 与 `hb-sdk remote deploy` 校验 `dist/manifest.json.window` 与 `package.json#heybox.window` 一致，不一致时要求重新构建。
+- Host/Runtime 集成维护者：页面通道合同升级到 `1.6.0`，新增 `window.getGeometry` 请求与 `window.geometryChanged` 上报，只有用户拖拽来源才允许写入本地记忆。detail 页面与工坊插件须成对发布和回滚。
+
+## 0.8.1-alpha.13
+
+- 审核前预览现在可以准备和启动当前候选版本声明的 Companion；旧版 PC Host 会返回 `COMPANION_PREVIEW_UNSUPPORTED`，需升级客户端后重试。
+- `CompanionInfo.source` 新增 `preview`，用于在可信授权界面区分尚未发布的预览产物。
+
 ## 0.8.1-alpha.12
 
 - 摘要：Android/iOS 移动端在 Native Host contract 下新增受控文件与流式下载能力，并修复 Files/Download 的释放、配额与访问边界。

package/README.md

@@ -138,6 +138,29 @@ console.log(info.sdk.version);
 
 环境信息无需权限，只用于界面适配、兼容降级、埋点和诊断，不能作为鉴权、权限控制或风控依据。完整字段和 Browser Mock 行为见[环境信息](https://docs.xiaoheihe.cn/hb_sdk/guide/environment)。
 
+## 窗口尺寸
+
+新 PC 工坊小程序支持在 `package.json#heybox.window` 声明开窗默认尺寸与可缩放性：
+
+```json
+{
+  "heybox": {
+    "platforms": ["android", "ios", "ohos", "windows", "macos"],
+    "window": {
+      "defaultWidth": 480,
+      "defaultHeight": 900,
+      "minWidth": 360,
+      "minHeight": 600,
+      "resizable": true
+    }
+  }
+}
+```
+
+`window` 整体可选，字段为 `defaultWidth` / `defaultHeight` / `minWidth` / `minHeight` / `resizable`；`{}`、未知字段、`width` / `height` 写法、非正整数、超过 `16384`、`min` 未与对应默认值配对或 `min > default` 都会在构建期明确失败。`minWidth` / `minHeight` 必须与 `defaultWidth` / `defaultHeight` 同时声明。
+
+`resizable` 只约束**用户手动拖拽**；**位置不开放**：开发者不能声明或设置窗口位置，位置由用户拖拽产生并由宿主按小程序身份本地记忆。完整语义见[窗口尺寸与可缩放性](https://docs.xiaoheihe.cn/hb_sdk/guide/window-size)。
+
 ## 文件与下载
 
 `files` 提供当前小程序私有 sandbox 和由用户选择授予的外部 File/Directory；
@@ -282,6 +305,8 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 - Companion stdio 是原始 `Uint8Array` 且输出为 at-least-once 投递；业务自行定义 framing、去重、重放与恢复。
 - Browser Dev Host 的 Companion Fake 只用于状态和 UI 开发，不能作为桌面程序可执行、签名、权限或进程监管的真机证据。
 - 本地真 PC Companion 需要 `package.json#heybox.companions`、本地产物、已绑定项目和 COA `companion` 批准；未配置本地产物时使用 Browser Fake。配置或产物更新后校验并切换不可变快照；已有进程保留原产物，新产物须重新准备与启动。
+- `package.json#heybox.window` 只声明开窗初值与可缩放性；`resizable` 只约束用户拖拽。
+- 窗口位置不开放：开发者不能声明、也不能设置位置；位置由用户拖拽并由宿主按小程序身份本地记忆。
 
 私有 Page Channel 适配没有修改 `@heybox/hb-sdk` 公开 API 或 iframe wire；本次 files/download
 Runtime 能力随 `0.8.0-alpha.11` release family 发布，部署 detail 前必须保证

package/dist/cli-chunks/{build-CZ5V15O8.cjs → build-D-VaxzAE.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-B03m_ABy.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-CVYOOxPB.cjs');
 require('node:crypto');
 require('node:zlib');
 var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
-var index = require('./index-Dbep6fgT.cjs');
-var projectVite = require('./project-vite-CSpSpfAR.cjs');
-require('./version-CNLhzVfO.cjs');
+var index = require('./index-VP8boR-7.cjs');
+var projectVite = require('./project-vite-BfJ5TGoA.cjs');
+require('./version-Df-F-uhW.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');
@@ -31,6 +31,7 @@ async function runBuildCommand(_options = {}, runtime = {}) {
     const mode = env.HB_SDK_ENV?.trim() || undefined;
     const skipPlatformCsp = runtimePermissionEnv.shouldSkipMiniappPlatformCspFromEnv(env);
     const declaredPlatforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
+    const declaredWindow = runtimePermissionEnv.readMiniappWindowFromPackageJson(projectRoot);
     runtimePermissionEnv.readMiniappPermissionsFromPackageJson(projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
     await fs.rm(distDir, { force: true, recursive: true });
     try {
@@ -49,7 +50,7 @@ async function runBuildCommand(_options = {}, runtime = {}) {
                     write: true,
                 },
             }), { successText: 'Vite 构建完成' });
-            const result = await validateBuildOutput(projectRoot, logger, declaredPlatforms);
+            const result = await validateBuildOutput(projectRoot, logger, declaredPlatforms, declaredWindow);
             logger.success(`构建完成: dist/ | manifest version ${result.version} | sdkVersion ${result.sdkVersion} | 待上传文件 ${result.fileCount} 个 | ${formatSize(result.totalBytes)}`);
             return result;
         }, env);
@@ -78,7 +79,7 @@ function createFixedBuildOutputPlugin(projectRoot) {
         },
     };
 }
-async function validateBuildOutput(projectRoot, logger, declaredPlatforms) {
+async function validateBuildOutput(projectRoot, logger, declaredPlatforms, declaredWindow) {
     const distDir = path.join(projectRoot, 'dist');
     const entryHtmlPath = path.join(distDir, 'index.html');
     const manifestPath = path.join(distDir, 'manifest.json');
@@ -96,10 +97,13 @@ async function validateBuildOutput(projectRoot, logger, declaredPlatforms) {
     if (hadBom) {
         logger.warn('dist/manifest.json 包含 BOM，已自动剥离');
     }
-    const { platforms, sdkVersion, version, permissions } = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
+    const { platforms, sdkVersion, version, permissions, window } = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
     if (!runtimePermissionEnv.areMiniappPlatformsEqual(platforms, declaredPlatforms)) {
         throw new Error('dist/manifest.json.platforms 与 package.json#heybox.platforms 不一致，请重新 build');
     }
+    if (!runtimePermissionEnv.areMiniappWindowsEqual(window, declaredWindow)) {
+        throw new Error('dist/manifest.json.window 与 package.json#heybox.window 不一致，请重新 build');
+    }
     const allFiles = await walkDistFiles(distDir);
     const uploadFiles = allFiles.filter((file) => runtimePermissionEnv.shouldUploadDistFile(file.relativePath));
     const sizeError = runtimePermissionEnv.validateMiniappUploadSizeBudgets(uploadFiles);

package/dist/cli-chunks/{context-Dtt13TVH.cjs → context-BH7BZPoY.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-B03m_ABy.cjs');
-var session = require('./session-B596v9X3.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-CVYOOxPB.cjs');
+var session = require('./session-BEpV8CZQ.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');

package/dist/cli-chunks/{create-BH8rUeVn.cjs → create-Bmp9E1n8.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-Dbep6fgT.cjs');
+var index = require('./index-VP8boR-7.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-DlwR0N4E.cjs → dev-BntAFyWR.cjs}

@@ -8,17 +8,17 @@ var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
 var node_module = require('node:module');
-var context = require('./context-Dtt13TVH.cjs');
-var runtimePermissionEnv = require('./runtime-permission-env-B03m_ABy.cjs');
+var context = require('./context-BH7BZPoY.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-CVYOOxPB.cjs');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-Dbep6fgT.cjs');
+var index = require('./index-VP8boR-7.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-B596v9X3.cjs');
+var session = require('./session-BEpV8CZQ.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-CSpSpfAR.cjs');
-var version = require('./version-CNLhzVfO.cjs');
+var projectVite = require('./project-vite-BfJ5TGoA.cjs');
+var version = require('./version-Df-F-uhW.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1950,8 +1950,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DlwR0N4E.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DlwR0N4E.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BntAFyWR.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BntAFyWR.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -1985,6 +1985,7 @@ async function startBrowserDevHostServer(options) {
         miniProgramSupportsDesktop: options.miniProgramSupportsDesktop,
         mobileLaunchRedirect: initialMobileLaunchRedirect,
         nativeAppLaunchUnavailableReason: options.nativeAppLaunchUnavailableReason,
+        miniProgramManifestAccessToken: options.miniProgramManifestAccessToken,
         runtimePermissions: options.runtimePermissions,
         devReadiness: options.devReadiness,
     };
@@ -11048,7 +11049,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-BRKWKNSB.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-B_5UnniK.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15146,6 +15147,8 @@ const VITE_LOG_LEVEL = 'warn';
 const COMPANION_DEV_MANIFEST_PATH = '/__hb_sdk__/companion/manifest.json';
 const COMPANION_DEV_MANIFEST_MAX_BYTES = 1024 * 1024;
 const COMPANION_ARTIFACT_ACCESS_TOKEN_ENV = 'HB_SDK_COMPANION_ARTIFACT_ACCESS_TOKEN';
+// 本地 PC 调试 manifest 的专用令牌：开窗时扩展还没拿到 LocalDevelopmentBinding，只能靠启动 URI 带来。
+const MINI_PROGRAM_MANIFEST_ACCESS_TOKEN_ENV = 'HB_SDK_MINI_PROGRAM_MANIFEST_ACCESS_TOKEN';
 const COMPANION_ARTIFACT_ACCESS_TOKEN_HEADER = 'x-hb-sdk-companion-dev-token';
 async function runDevCommand(options, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
@@ -15169,6 +15172,7 @@ async function runDevCommand(options, runtime = {}) {
     };
     const projectRoot = projectVite.findProjectRoot(runtime.cwd ?? process.cwd());
     const companionArtifactAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
+    const miniProgramManifestAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
     const devSessionId = node_crypto.randomBytes(16).toString('hex');
     const miniProgramPlatforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
     const { context: devLaunchContext, miniProgram } = await loadDevLaunchContext({
@@ -15230,7 +15234,7 @@ async function runDevCommand(options, runtime = {}) {
         return true;
     });
     const vite = await runDevStartupTask(logger, '正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), '已加载项目 Vite');
-    const appServer = await runDevStartupTask(logger, '正在创建 Vite 开发服务器', () => runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(devLaunchContext.runtimePermissions), () => withCompanionArtifactAccessTokenEnv(companionArtifactAccessToken, () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions, launchPlugin)), runtime.env), runtime.env), runtime.env), '已创建 Vite 开发服务器');
+    const appServer = await runDevStartupTask(logger, '正在创建 Vite 开发服务器', () => runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(devLaunchContext.runtimePermissions), () => withCompanionArtifactAccessTokenEnv(companionArtifactAccessToken, () => withMiniProgramManifestAccessTokenEnv(miniProgramManifestAccessToken, () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions, launchPlugin)), runtime.env), runtime.env), runtime.env), runtime.env), '已创建 Vite 开发服务器');
     await runDevStartupTask(logger, '正在启动 Vite 开发服务器', () => appServer.listen(appPort), 'Vite 开发服务器已启动');
     const appUrl = await runDevStartupTask(logger, '正在探测小程序入口', () => resolveViteAppUrl(appServer, resolvedOptions, fetchImpl), '已确定小程序入口');
     const buildLanAddresses = () => createLanAddressCandidates({
@@ -15254,6 +15258,7 @@ async function runDevCommand(options, runtime = {}) {
             getPort: getPortImpl,
             defaultLanAddressId: lanAddresses[0]?.id,
             lanAddresses,
+            miniProgramManifestAccessToken,
             lookupHostname: runtime.lookupHostname,
             loginService: runtime.loginService,
             miniProgram,
@@ -15603,6 +15608,19 @@ async function withCompanionArtifactAccessTokenEnv(token, action, env = process.
             env[COMPANION_ARTIFACT_ACCESS_TOKEN_ENV] = previous;
     }
 }
+async function withMiniProgramManifestAccessTokenEnv(token, action, env = process.env) {
+    const previous = env[MINI_PROGRAM_MANIFEST_ACCESS_TOKEN_ENV];
+    env[MINI_PROGRAM_MANIFEST_ACCESS_TOKEN_ENV] = token;
+    try {
+        return await action();
+    }
+    finally {
+        if (previous === undefined)
+            delete env[MINI_PROGRAM_MANIFEST_ACCESS_TOKEN_ENV];
+        else
+            env[MINI_PROGRAM_MANIFEST_ACCESS_TOKEN_ENV] = previous;
+    }
+}
 function installShutdownHandlers(closers, processLike) {
     const shutdown = async () => {
         await closeAll(closers);

package/dist/cli-chunks/{doctor-BYj8lz7p.cjs → doctor-t3YMD3qv.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-Dbep6fgT.cjs');
+var index = require('./index-VP8boR-7.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-vPfFOCOM.cjs → index-CjP8Qye_.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-Dbep6fgT.cjs');
+var index$2 = require('./index-VP8boR-7.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-B03m_ABy.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-CVYOOxPB.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index-Dbep6fgT.cjs → index-VP8boR-7.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dbep6fgT.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-VP8boR-7.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dbep6fgT.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-VP8boR-7.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dbep6fgT.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-VP8boR-7.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dbep6fgT.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-VP8boR-7.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dbep6fgT.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-VP8boR-7.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13424,7 +13424,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.8.1-alpha.12';
+const BUILT_CLI_VERSION = '0.8.1-alpha.14';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13773,39 +13773,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CLVmbKuy.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-p38-WSHx.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CLVmbKuy.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-p38-WSHx.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CLVmbKuy.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-p38-WSHx.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CZ5V15O8.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-D-VaxzAE.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BH8rUeVn.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-Bmp9E1n8.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-DlwR0N4E.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-BntAFyWR.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BYj8lz7p.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-t3YMD3qv.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-B-QW6Z7A.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DuVDTrA2.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BWAdpu4q.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-CBH04z6v.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index.esm-BRKWKNSB.cjs → index.esm-B_5UnniK.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-Dbep6fgT.cjs');
-var dev = require('./dev-DlwR0N4E.cjs');
+var index = require('./index-VP8boR-7.cjs');
+var dev = require('./dev-BntAFyWR.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -27,11 +27,11 @@ require('node:os');
 require('node:net');
 require('node:dns/promises');
 require('node:http');
-require('./context-Dtt13TVH.cjs');
-require('./runtime-permission-env-B03m_ABy.cjs');
-require('./version-CNLhzVfO.cjs');
+require('./context-BH7BZPoY.cjs');
+require('./runtime-permission-env-CVYOOxPB.cjs');
+require('./version-Df-F-uhW.cjs');
 require('node:async_hooks');
-require('./session-B596v9X3.cjs');
+require('./session-BEpV8CZQ.cjs');
 require('fs');
 require('constants');
 require('undici');
@@ -41,7 +41,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-CSpSpfAR.cjs');
+require('./project-vite-BfJ5TGoA.cjs');
 require('node:zlib');
 
 var bufferUtil = {exports: {}};

package/dist/cli-chunks/{login-CLVmbKuy.cjs → login-p38-WSHx.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-B596v9X3.cjs');
+var session = require('./session-BEpV8CZQ.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-Dbep6fgT.cjs');
+var index = require('./index-VP8boR-7.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-CSpSpfAR.cjs → project-vite-BfJ5TGoA.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-Dbep6fgT.cjs');
+var index = require('./index-VP8boR-7.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-BWAdpu4q.cjs → remote-CBH04z6v.cjs}

@@ -1,17 +1,17 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-Dbep6fgT.cjs');
-var session = require('./session-B596v9X3.cjs');
+var index = require('./index-VP8boR-7.cjs');
+var session = require('./session-BEpV8CZQ.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-B03m_ABy.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-CVYOOxPB.cjs');
 var node_crypto = require('node:crypto');
 require('node:zlib');
 var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
-var context = require('./context-Dtt13TVH.cjs');
+var context = require('./context-BH7BZPoY.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -24,7 +24,7 @@ require('buffer');
 require('util');
 require('fs');
 require('constants');
-require('./version-CNLhzVfO.cjs');
+require('./version-Df-F-uhW.cjs');
 require('node:async_hooks');
 
 async function getCDNUploadInfo(options, runtime = {}) {
@@ -274,7 +274,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-vPfFOCOM.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-CjP8Qye_.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -516,6 +516,7 @@ async function runDeployCommand(options, runtime = {}) {
     }
     const fromVersion = options.fromVersion?.trim();
     const declaredPlatforms = fromVersion ? undefined : runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
+    const declaredWindow = fromVersion ? undefined : runtimePermissionEnv.readMiniappWindowFromPackageJson(projectRoot);
     const releaseNote = await resolveDeployReleaseNote(options, runtime);
     const session$1 = await logger.task('正在校验 Heybox 登录态', () => (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }), { successText: 'Heybox 登录态有效' });
     logger.debug(`Heybox API: ${apiBaseUrl}`);
@@ -593,6 +594,9 @@ async function runDeployCommand(options, runtime = {}) {
             if (!declaredPlatforms || !runtimePermissionEnv.areMiniappPlatformsEqual(parsedManifest.platforms, declaredPlatforms)) {
                 throw new Error('dist/manifest.json.platforms 与 package.json#heybox.platforms 不一致，请重新 build 后再 deploy');
             }
+            if (!runtimePermissionEnv.areMiniappWindowsEqual(parsedManifest.window, declaredWindow)) {
+                throw new Error('dist/manifest.json.window 与 package.json#heybox.window 不一致，请重新 build 后再 deploy');
+            }
             if (version !== precheckVersion) {
                 throw new Error(`dist/manifest.json.version (${version}) 与预检版本 (${precheckVersion}) 不一致，请重新 build 后再 deploy`);
             }
@@ -757,6 +761,7 @@ async function readDeployManifest(projectRoot, logger) {
         sdkVersion: validated.sdkVersion,
         version: validated.version,
         platforms: validated.platforms,
+        ...(validated.window === undefined ? {} : { window: validated.window }),
     };
 }
 function validateVersionForDeploy(version, sourceLabel) {

package/dist/cli-chunks/{runtime-permission-env-B03m_ABy.cjs → runtime-permission-env-CVYOOxPB.cjs}

@@ -2,7 +2,7 @@
 
 var fs = require('node:fs');
 var path = require('node:path');
-var version = require('./version-CNLhzVfO.cjs');
+var version = require('./version-Df-F-uhW.cjs');
 require('node:crypto');
 var node_async_hooks = require('node:async_hooks');
 
@@ -3108,6 +3108,10 @@ function isRecord$3(value) {
 }
 
 const MINIAPP_PLATFORM_VALUES = ['android', 'ios', 'ohos', 'windows', 'macos', 'linux'];
+/** 窗口尺寸字段的脏值兜底上限；真正的上限是宿主侧显示器 workArea。 */
+const MINIAPP_WINDOW_SIZE_MAX = 16_384;
+const MINIAPP_WINDOW_NUMBER_FIELDS = ['defaultWidth', 'defaultHeight', 'minWidth', 'minHeight'];
+const MINIAPP_WINDOW_ALLOWED_FIELDS = [...MINIAPP_WINDOW_NUMBER_FIELDS, 'resizable'];
 /**
  * 桌面平台子集：从唯一平台词表 `MINIAPP_PLATFORM_VALUES` 派生，`satisfies` 阻止它漂移出词表。
  * 小程序声明其中任一平台，即视为该项目承诺适配 PC / 桌面端；调试台据此取舍桌面调试入口。
@@ -3158,12 +3162,14 @@ function validateMiniappManifestForDeploy(manifest) {
         sourceLabel: 'manifest.permissions',
     });
     const companions = validateGeneratedCompanions(manifest.companions);
+    const window = validateMiniappWindow(manifest.window, 'manifest.window');
     return {
         version,
         sdkVersion,
         platforms: validateMiniappPlatforms(manifest.platforms, 'manifest.platforms'),
         ...(permissions.permissions === undefined ? {} : { permissions: permissions.permissions }),
         ...(companions === undefined ? {} : { companions }),
+        ...(window === undefined ? {} : { window }),
     };
 }
 function validateGeneratedCompanions(value) {
@@ -3240,6 +3246,77 @@ function validateMiniappPlatforms(platforms, sourceLabel = 'platforms') {
 function areMiniappPlatformsEqual(left, right) {
     return left.length === right.length && left.every((platform, index) => platform === right[index]);
 }
+/**
+ * 校验并归一化 `package.json#heybox.window` / `manifest.window` 声明。
+ *
+ * @remarks
+ * 与 `heybox.permissions` 同样的严格风格：未知字段报错，不做静默忽略。
+ * `width` / `height` 显式给出改名提示；`x` / `y` 按未知字段显式报错（`INV-NO-DEV-POSITION`）。
+ * 未声明时返回 `undefined`，由调用方决定不写入产物。
+ * @param value - 待校验的原始声明（不可信输入）。
+ * @param sourceLabel - 报错前缀，默认指向开发者声明路径。
+ * @throws 当声明不是非空对象、含未知字段、数值/布尔类型不合法或 min/default 不配对时抛出。
+ */
+function validateMiniappWindow(value, sourceLabel = 'package.json#heybox.window') {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord$2(value) || Object.keys(value).length === 0) {
+        throw new Error(`${sourceLabel} 至少需要声明 defaultWidth/defaultHeight/minWidth/minHeight/resizable 之一`);
+    }
+    if (Object.prototype.hasOwnProperty.call(value, 'width') || Object.prototype.hasOwnProperty.call(value, 'height')) {
+        throw new Error(`${sourceLabel} 请使用 defaultWidth/defaultHeight，而不是 width/height`);
+    }
+    for (const key of Object.keys(value)) {
+        if (!MINIAPP_WINDOW_ALLOWED_FIELDS.includes(key)) {
+            throw new Error(`${sourceLabel} 包含未知字段：${key}`);
+        }
+    }
+    const window = {};
+    for (const field of MINIAPP_WINDOW_NUMBER_FIELDS) {
+        if (!Object.prototype.hasOwnProperty.call(value, field))
+            continue;
+        const size = value[field];
+        if (typeof size !== 'number' || !Number.isSafeInteger(size) || size <= 0) {
+            throw new Error(`${sourceLabel}.${field} 必须是正整数`);
+        }
+        if (size > MINIAPP_WINDOW_SIZE_MAX) {
+            throw new Error(`${sourceLabel}.${field} 不能大于 ${MINIAPP_WINDOW_SIZE_MAX}`);
+        }
+        window[field] = size;
+    }
+    if (Object.prototype.hasOwnProperty.call(value, 'resizable')) {
+        if (typeof value.resizable !== 'boolean') {
+            throw new Error(`${sourceLabel}.resizable 必须是 boolean`);
+        }
+        window.resizable = value.resizable;
+    }
+    for (const [minimum, fallback] of [
+        ['minWidth', 'defaultWidth'],
+        ['minHeight', 'defaultHeight'],
+    ]) {
+        const minimumValue = window[minimum];
+        if (minimumValue === undefined)
+            continue;
+        const fallbackValue = window[fallback];
+        if (fallbackValue === undefined) {
+            throw new Error(`${sourceLabel}.${minimum} 必须与 ${fallback} 同时声明`);
+        }
+        if (minimumValue > fallbackValue) {
+            throw new Error(`${sourceLabel}.${minimum} 必须小于等于 ${fallback}`);
+        }
+    }
+    return window;
+}
+/** 比较两份窗口声明是否逐字段一致；未声明视同 `undefined`。 */
+function areMiniappWindowsEqual(left, right) {
+    if (left === undefined || right === undefined)
+        return left === right;
+    return (left.defaultWidth === right.defaultWidth &&
+        left.defaultHeight === right.defaultHeight &&
+        left.minWidth === right.minWidth &&
+        left.minHeight === right.minHeight &&
+        left.resizable === right.resizable);
+}
 function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
     if (typeof version !== 'string' || version.trim() === '') {
         throw new Error(`${sourceLabel} 必须是合法 SemVer：${String(version)}`);
@@ -3637,6 +3714,17 @@ function readMiniappPlatformsFromPackageJson(root) {
     const heybox = readMiniappHeyboxConfig(packageJson);
     return validateMiniappPlatforms(heybox?.platforms, 'package.json#heybox.platforms');
 }
+/**
+ * 读取并校验 `package.json#heybox.window`。
+ *
+ * @returns 合法声明；未声明时返回 `undefined`，调用方不得向 manifest 写入空对象或 `null`。
+ * @throws 当声明违反 {@link validateMiniappWindow} 的规则时抛出，报错前缀为 `package.json#heybox.window`。
+ */
+function readMiniappWindowFromPackageJson(root) {
+    const { packageJson } = readMiniappPackageJson(root);
+    const heybox = readMiniappHeyboxConfig(packageJson);
+    return validateMiniappWindow(heybox?.window, 'package.json#heybox.window');
+}
 function readMiniappPermissionsFromPackageJson(root, sdkVersion) {
     const { packageJson } = readMiniappPackageJson(root);
     const heybox = readMiniappHeyboxConfig(packageJson);
@@ -3789,6 +3877,7 @@ exports.USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = USER_MINIPROGRAM_PREVIEW_A
 exports.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH = USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH;
 exports.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.areMiniappPlatformsEqual = areMiniappPlatformsEqual;
+exports.areMiniappWindowsEqual = areMiniappWindowsEqual;
 exports.composeMiniappRuntimePermissions = composeMiniappRuntimePermissions;
 exports.createMiniappArtifactFileHeader = createMiniappArtifactFileHeader;
 exports.createMiniappArtifactSignatureHeader = createMiniappArtifactSignatureHeader;
@@ -3802,6 +3891,7 @@ exports.parseMiniappManifestJson = parseMiniappManifestJson;
 exports.prepareMiniappArtifactFiles = prepareMiniappArtifactFiles;
 exports.readMiniappPermissionsFromPackageJson = readMiniappPermissionsFromPackageJson;
 exports.readMiniappPlatformsFromPackageJson = readMiniappPlatformsFromPackageJson;
+exports.readMiniappWindowFromPackageJson = readMiniappWindowFromPackageJson;
 exports.relativePathContainsNodeModulesSegment = relativePathContainsNodeModulesSegment;
 exports.requireSemver = requireSemver;
 exports.resolveMiniappSdkVersion = resolveMiniappSdkVersion;