@heybox/hb-sdk 0.8.1-alpha.6 → 0.8.1-alpha.7

package/dist/devtools/browser-dev-host/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#f4f5f7" />
     <title>小程序工坊调试台</title>
-    <script type="module" crossorigin src="/assets/index-Dh5wRj5c.js"></script>
+    <script type="module" crossorigin src="/assets/index-DocojUxT.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-DnPRjCa3.js">
     <link rel="stylesheet" crossorigin href="/assets/index-D-aNERAr.css">
   </head>

package/dist/index.cjs.js

@@ -835,7 +835,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.7';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);
@@ -3364,9 +3364,6 @@ function createNetworkRequestFailureLog(config, error, extras) {
     if (config.timeout !== undefined) {
         detail.timeout = config.timeout;
     }
-    if (config.withCredentials !== undefined) {
-        detail.withCredentials = config.withCredentials;
-    }
     const headers = sanitizeNetworkHeaders(extras.headers || config.headers);
     if (Object.keys(headers).length > 0) {
         detail.headers = headers;
@@ -3404,7 +3401,6 @@ function snapshotRequestConfig(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
         ...(config.validateStatus === undefined ? {} : { validateStatus: config.validateStatus }),
     };
 }
@@ -3416,7 +3412,6 @@ function toRequestPayload(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
     };
 }
 function normalizeHeaders(headers) {
@@ -3585,9 +3580,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
     if (options.maxBytes !== undefined && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes <= 0)) {
         throw createSDKError('INVALID_PARAMS', 'maxBytes 必须是正的 safe integer');
     }
-    if (options.withCredentials !== undefined && typeof options.withCredentials !== 'boolean') {
-        throw createSDKError('INVALID_PARAMS', 'withCredentials 必须是 boolean');
-    }
     if (options.onProgress !== undefined && typeof options.onProgress !== 'function') {
         throw createSDKError('INVALID_PARAMS', 'onProgress 必须是函数');
     }
@@ -3607,7 +3599,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
         ...(options.params === undefined ? {} : { params: clonePublicValue(options.params) }),
         ...(options.headers === undefined ? {} : { headers: clonePublicValue(options.headers) }),
         ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
-        ...(options.withCredentials === undefined ? {} : { withCredentials: options.withCredentials }),
         ...(options.maxBytes === undefined ? {} : { maxBytes: options.maxBytes }),
     };
     if (isFileTarget) {

package/dist/index.esm.js

@@ -831,7 +831,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.7';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);
@@ -3360,9 +3360,6 @@ function createNetworkRequestFailureLog(config, error, extras) {
     if (config.timeout !== undefined) {
         detail.timeout = config.timeout;
     }
-    if (config.withCredentials !== undefined) {
-        detail.withCredentials = config.withCredentials;
-    }
     const headers = sanitizeNetworkHeaders(extras.headers || config.headers);
     if (Object.keys(headers).length > 0) {
         detail.headers = headers;
@@ -3400,7 +3397,6 @@ function snapshotRequestConfig(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
         ...(config.validateStatus === undefined ? {} : { validateStatus: config.validateStatus }),
     };
 }
@@ -3412,7 +3408,6 @@ function toRequestPayload(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
     };
 }
 function normalizeHeaders(headers) {
@@ -3581,9 +3576,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
     if (options.maxBytes !== undefined && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes <= 0)) {
         throw createSDKError('INVALID_PARAMS', 'maxBytes 必须是正的 safe integer');
     }
-    if (options.withCredentials !== undefined && typeof options.withCredentials !== 'boolean') {
-        throw createSDKError('INVALID_PARAMS', 'withCredentials 必须是 boolean');
-    }
     if (options.onProgress !== undefined && typeof options.onProgress !== 'function') {
         throw createSDKError('INVALID_PARAMS', 'onProgress 必须是函数');
     }
@@ -3603,7 +3595,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
         ...(options.params === undefined ? {} : { params: clonePublicValue(options.params) }),
         ...(options.headers === undefined ? {} : { headers: clonePublicValue(options.headers) }),
         ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
-        ...(options.withCredentials === undefined ? {} : { withCredentials: options.withCredentials }),
         ...(options.maxBytes === undefined ? {} : { maxBytes: options.maxBytes }),
     };
     if (isFileTarget) {

package/dist/vite.cjs.js

@@ -11,7 +11,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.7';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/dist/vite.esm.js

@@ -8,7 +8,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.7';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.8.1-alpha.6",
+  "version": "0.8.1-alpha.7",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -62,7 +62,7 @@
     "skills": "1.5.23",
     "undici": "^7.28.0",
     "ws": "^8.18.0",
-    "@heybox/hb-sdk-protocol": "0.8.1-alpha.6"
+    "@heybox/hb-sdk-protocol": "0.8.1-alpha.7"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -113,13 +113,13 @@
     "vue-tsc": "^3.3.7",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox-domain/heybox-theme": "~0.1.0",
     "@heybox/hb-api": "~1.28.3",
+    "@heybox-domain/heybox-theme": "~0.1.0",
+    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.7",
+    "@heybox/runtime-policy": "~0.2.0",
     "@heybox-domain/heybox-vue3-ui": "~0.1.0",
-    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.6",
-    "@heybox/runtime": "~0.2.0",
     "@heybox/runtime-transport-fetch": "~0.2.0",
-    "@heybox/runtime-policy": "~0.2.0"
+    "@heybox/runtime": "~0.2.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/references/api-root.md

@@ -27,7 +27,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.8.1-alpha.6`
+- Version at generation time: `0.8.1-alpha.7`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`

package/skill/references/safety-boundaries.md

@@ -18,12 +18,12 @@
 - `auth.login()`、`user.getInfo()` 和 `user.getSteamGameList()` 的可用性不由 `network` 决定；它们分别要求 `userInfo` 或 `steamLibrary`，并继续遵循各自的用户授权和数据规则。
 - `user.revokeAuthorization()` 在两种网络模式下都要求可信用户手势；成功后必须停止使用并清理业务缓存的旧身份、资料和服务端会话。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
-- 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。
+- 现有业务网络请求仍使用 `network.request()`；该 API 已标记废弃，但目前没有替代调用入口，不要依赖浏览器原生网络出口。
 - 公开 `network.request()` 与 `network.download()` 均使用 no-follow redirect policy；3xx 不会在 Host 内静默跳转。
 - `network.request()` 不能访问平台保留的 runtime auth 与 OpenAPI 内部路径；页面不得持有或交换服务端应用凭据。
 - `network.request` 不支持 `multipart/form-data`；App Host 仅支持 form（`application/x-www-form-urlencoded`）与 JSON。表单请用 `URLSearchParams#toString()` 作为 `data`，文件上传请走专用上传能力。
 - 新 PC 开放持久 sandbox、单文件/目录 picker、精确 File 保存与公网 `network.download()`；多选和小黑盒域名流式下载暂不支持。Mobile、Web 与 Browser Dev Host 仍未开放这些 primitive。
-- 新 PC 支持 `network.request`，但会忽略 `withCredentials`；它不改变请求路由或凭据行为。其他平台继续遵循各自的 Host 语义。
+- `withCredentials` 不再是支持的配置字段，也不会进入新 SDK、协议或 Host contract；旧 SDK 构建产物的 wire 字段仅由 Runtime 兼容忽略。Mobile 对官方 HTTPS 默认端口目标自动启用 Native Cookie，第三方关闭；应用可显式提供 `Cookie`、`Authorization` 等请求头。`Origin`、`Referer`、`User-Agent` 由 Host 接管；`Host`、分帧及逐跳请求头由传输层管理，不能由小程序设置。Web Host 使用浏览器 Fetch，无法发送显式 `Cookie` 等浏览器禁止的头，会返回 `REQUEST_UNSUPPORTED`；需要第三方 Cookie 会话时请在支持原始请求头的 Mobile/PC Host 验收。
 - 新 PC 不支持振动、分享菜单和截图分享；`navigation.openAppPage` 仅支持 `game_detail`，用户/帖子详情会明确失败。调用平台相关能力时应处理 `METHOD_FORBIDDEN` 或 `REQUEST_UNSUPPORTED`。
 - picker 必须来自可信用户手势；取消选择返回 `FILE_PICKER_CANCELLED`。`saveFile()` 只接受 `suggestedName`，不接受 `accept`。
 - `pickFiles()` / `pickDirectory()` 默认只读；`pickFiles()` 仅在显式传入 `multiple: true` 时允许 Host 返回多个文件。要写入或作为下载目标时显式请求 `mode: 'readwrite'`。

package/skill/skill.json

@@ -1,16 +1,16 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.8.1-alpha.6+skill.079dd19d1630",
+  "skillVersion": "0.8.1-alpha.7+skill.cc51aa429a00",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.6",
-    "compatibility": "0.8.1-alpha.6"
+    "version": "0.8.1-alpha.7",
+    "compatibility": "0.8.1-alpha.7"
   },
   "distribution": {
     "type": "npm",
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.6",
+    "version": "0.8.1-alpha.7",
     "path": "skill"
   },
-  "integrity": "sha256-079dd19d16302a5e71519d30312ad45aa1e0c05546e52f71dac6d7bf2fac238f"
+  "integrity": "sha256-cc51aa429a00b117c134cff1c71b42c6e72fcb9e169533428eaa8d9f54b6a853"
 }

package/types/modules/network/index.d.ts

@@ -38,8 +38,6 @@ export interface MiniProgramNetworkRequestConfig {
     headers?: MiniProgramNetworkHeaders;
     /** 超时时间，单位毫秒。 */
     timeout?: number;
-    /** 是否携带凭据意图；具体策略由宿主运行时决定。 */
-    withCredentials?: boolean;
     /** SDK 侧状态校验；不会跨 bridge 传输函数值。 */
     validateStatus?: MiniProgramNetworkValidateStatus;
 }
@@ -54,7 +52,6 @@ export interface DownloadBaseOptions {
     params?: MiniProgramNetworkParams;
     headers?: MiniProgramNetworkHeaders;
     timeout?: number;
-    withCredentials?: boolean;
     maxBytes?: number;
     signal?: AbortSignal;
     onProgress?: (progress: DownloadProgress) => void;
@@ -82,7 +79,6 @@ export interface NetworkRequestPayload {
     data?: unknown;
     headers?: MiniProgramNetworkHeaders;
     timeout?: number;
-    withCredentials?: boolean;
 }
 /**
  * bridge / runtime 返回的标准化 HTTP 响应。
@@ -114,6 +110,7 @@ export interface MiniProgramNetworkModule {
      * @returns 标准化网络响应；HTTP 2xx 默认返回 resolve。
      * @throws 当请求已完成但 HTTP 状态不满足 `validateStatus` 时抛出 `HbMiniProgramNetworkError`。
      * @throws 当 bridge、运行时或宿主能力调用失败时抛出 `HbMiniProgramSDKError`。
+     * @deprecated Since 0.8.1-alpha.7. 暂无替代接口；现有调用仍可使用，请移除 withCredentials 配置。Native Cookie 由 Host 按目标域名决定。
      * @since 0.2.0-alpha.0
      * @hbPlatform android
      * @hbPlatform ios

package/types/modules/network/observability.d.ts

@@ -12,7 +12,6 @@ export interface NetworkRequestFailureLog {
     headers?: MiniProgramNetworkHeaders;
     dataPreview?: unknown;
     timeout?: number;
-    withCredentials?: boolean;
 }
 /**
  * 记录 `network.request` 失败，保证异常路径在开发者控制台可观测。