@heybox/hb-sdk 0.8.1-alpha.6 → 0.8.1-alpha.8

package/dist/devtools/browser-dev-host/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#f4f5f7" />
     <title>小程序工坊调试台</title>
-    <script type="module" crossorigin src="/assets/index-Dh5wRj5c.js"></script>
+    <script type="module" crossorigin src="/assets/index-8LTH05np.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-DnPRjCa3.js">
     <link rel="stylesheet" crossorigin href="/assets/index-D-aNERAr.css">
   </head>

package/dist/index.cjs.js

@@ -835,7 +835,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.8';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);
@@ -3364,9 +3364,6 @@ function createNetworkRequestFailureLog(config, error, extras) {
     if (config.timeout !== undefined) {
         detail.timeout = config.timeout;
     }
-    if (config.withCredentials !== undefined) {
-        detail.withCredentials = config.withCredentials;
-    }
     const headers = sanitizeNetworkHeaders(extras.headers || config.headers);
     if (Object.keys(headers).length > 0) {
         detail.headers = headers;
@@ -3404,7 +3401,6 @@ function snapshotRequestConfig(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
         ...(config.validateStatus === undefined ? {} : { validateStatus: config.validateStatus }),
     };
 }
@@ -3416,7 +3412,6 @@ function toRequestPayload(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
     };
 }
 function normalizeHeaders(headers) {
@@ -3585,9 +3580,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
     if (options.maxBytes !== undefined && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes <= 0)) {
         throw createSDKError('INVALID_PARAMS', 'maxBytes 必须是正的 safe integer');
     }
-    if (options.withCredentials !== undefined && typeof options.withCredentials !== 'boolean') {
-        throw createSDKError('INVALID_PARAMS', 'withCredentials 必须是 boolean');
-    }
     if (options.onProgress !== undefined && typeof options.onProgress !== 'function') {
         throw createSDKError('INVALID_PARAMS', 'onProgress 必须是函数');
     }
@@ -3607,7 +3599,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
         ...(options.params === undefined ? {} : { params: clonePublicValue(options.params) }),
         ...(options.headers === undefined ? {} : { headers: clonePublicValue(options.headers) }),
         ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
-        ...(options.withCredentials === undefined ? {} : { withCredentials: options.withCredentials }),
         ...(options.maxBytes === undefined ? {} : { maxBytes: options.maxBytes }),
     };
     if (isFileTarget) {

package/dist/index.esm.js

@@ -831,7 +831,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.8';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);
@@ -3360,9 +3360,6 @@ function createNetworkRequestFailureLog(config, error, extras) {
     if (config.timeout !== undefined) {
         detail.timeout = config.timeout;
     }
-    if (config.withCredentials !== undefined) {
-        detail.withCredentials = config.withCredentials;
-    }
     const headers = sanitizeNetworkHeaders(extras.headers || config.headers);
     if (Object.keys(headers).length > 0) {
         detail.headers = headers;
@@ -3400,7 +3397,6 @@ function snapshotRequestConfig(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
         ...(config.validateStatus === undefined ? {} : { validateStatus: config.validateStatus }),
     };
 }
@@ -3412,7 +3408,6 @@ function toRequestPayload(config) {
         ...(config.data === undefined ? {} : { data: clonePublicValue(config.data) }),
         ...(config.headers === undefined ? {} : { headers: clonePublicValue(config.headers) }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
-        ...(config.withCredentials === undefined ? {} : { withCredentials: config.withCredentials }),
     };
 }
 function normalizeHeaders(headers) {
@@ -3581,9 +3576,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
     if (options.maxBytes !== undefined && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes <= 0)) {
         throw createSDKError('INVALID_PARAMS', 'maxBytes 必须是正的 safe integer');
     }
-    if (options.withCredentials !== undefined && typeof options.withCredentials !== 'boolean') {
-        throw createSDKError('INVALID_PARAMS', 'withCredentials 必须是 boolean');
-    }
     if (options.onProgress !== undefined && typeof options.onProgress !== 'function') {
         throw createSDKError('INVALID_PARAMS', 'onProgress 必须是函数');
     }
@@ -3603,7 +3595,6 @@ function normalizeDownloadPayload(options, to, isFileTarget) {
         ...(options.params === undefined ? {} : { params: clonePublicValue(options.params) }),
         ...(options.headers === undefined ? {} : { headers: clonePublicValue(options.headers) }),
         ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
-        ...(options.withCredentials === undefined ? {} : { withCredentials: options.withCredentials }),
         ...(options.maxBytes === undefined ? {} : { maxBytes: options.maxBytes }),
     };
     if (isFileTarget) {

package/dist/vite.cjs.js

@@ -11,7 +11,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.8';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/dist/vite.esm.js

@@ -8,7 +8,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.6';
+    : '0.8.1-alpha.8';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.8.1-alpha.6",
+  "version": "0.8.1-alpha.8",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -62,7 +62,7 @@
     "skills": "1.5.23",
     "undici": "^7.28.0",
     "ws": "^8.18.0",
-    "@heybox/hb-sdk-protocol": "0.8.1-alpha.6"
+    "@heybox/hb-sdk-protocol": "0.8.1-alpha.8"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -113,12 +113,12 @@
     "vue-tsc": "^3.3.7",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox-domain/heybox-theme": "~0.1.0",
-    "@heybox/hb-api": "~1.28.3",
     "@heybox-domain/heybox-vue3-ui": "~0.1.0",
-    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.6",
-    "@heybox/runtime": "~0.2.0",
+    "@heybox/hb-api": "~1.28.3",
+    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.8",
+    "@heybox-domain/heybox-theme": "~0.1.0",
     "@heybox/runtime-transport-fetch": "~0.2.0",
+    "@heybox/runtime": "~0.2.0",
     "@heybox/runtime-policy": "~0.2.0"
   },
   "publishConfig": {
@@ -171,7 +171,7 @@
     "check:compatibility-evidence": "node scripts/validate-compatibility-evidence.mjs",
     "check:api-semver": "node ../../ops/jobs/hb-sdk-docs-contract/semantic-diff.cjs",
     "clean": "rimraf ./dist && rimraf ./types",
-    "test:unit": "NODE_OPTIONS='--conditions=heybox' vitest run",
+    "test:unit": "vitest run",
     "test:types:characterization": "tsc -p tsconfig.characterization.json --noEmit --pretty false",
     "test:types:browser-dev-host": "vue-tsc -p tsconfig.browser-dev-host.json --noEmit --pretty false",
     "test:types": "pnpm run test:types:characterization && pnpm run test:types:browser-dev-host",

package/skill/SKILL.md

@@ -61,7 +61,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 
 1. Use `hb-sdk create <project-name>` to scaffold a workshop mini-program.
 2. Use `hb-sdk dev` for Browser Mock and Mobile App debugging. Browser debugging can start without CLI login, project binding, or a remote Dev Context; capabilities that need those inputs fail explicitly. Mobile uses the single QR entry with the `open_inapp` and `heybox://` `openWindow` wrapper around a LAN short URL, then opens `heybox-mini-dev://sandbox` with the complete launch context.
-3. The debugging page does not edit permissions. Treat the validated remote permission snapshot as canonical Runtime input. Use `--port`, `--browser-dev-host-port`, and `--no-open` to control local endpoints and browser opening. Select a Mobile network interface the device can reach. `launch.json` is a LAN discovery document, not authentication, encryption, signing, or HMAC protection.
+3. The debugging page does not edit permissions. Treat the effective intersection of the current project declaration and validated remote approval as canonical Runtime input. Mobile debugging preserves `useOfficialDomain: true` only when both inputs allow it, refreshes the effective permissions before opening on a phone, and never accepts a browser-side permission override. Use `--port`, `--browser-dev-host-port`, and `--no-open` to control local endpoints and browser opening. Select a Mobile network interface the device can reach. `launch.json` is a LAN discovery document, not authentication, encryption, signing, or HMAC protection.
    For real PC Companion debugging, configure local artifacts in `package.json#heybox.companions`, keep `miniappManifest()` enabled, bind the project, and ensure COA has approved `companion`. `hb-sdk dev` validates immutable snapshots without requiring an upload; config or artifact changes rotate the snapshot while existing Sessions retain their original artifact. Prepare and launch the new artifact explicitly. Check separate Browser, Mobile and PC Companion readiness in the debugging workbench. Without a local declaration, use Browser Fake only for state/UI integration.
 4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
 5. Declare the actual supported platforms in `package.json#heybox.platforms` and keep the no-argument `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the declaration, Manifest, or Runtime gate output is missing or inconsistent.

package/skill/references/api-root.md

@@ -27,7 +27,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.8.1-alpha.6`
+- Version at generation time: `0.8.1-alpha.8`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`

package/skill/references/cli.md

@@ -121,6 +121,8 @@ CLI 会启动页面服务并自动打开 Vue 3 本地调试台。左侧集中放
 
 本地真 PC 调试 Companion 不要求先上传版本，但必须在 `package.json#heybox.companions` 中配置本地 ZIP、绑定项目，并由 COA 批准 `companion`；`miniappManifest()` 只保留构建配置。dev server 只向 loopback 提供 canonical Manifest 与固定 ZIP 路由；CLI 在签发或刷新本地启动票时绑定 Manifest 摘要。配置或 ZIP 变化后会校验并切换到新快照，已有 Session 保持原有产物，新产物须重新准备与启动。调试台分别展示浏览器、手机与 PC Companion 的就绪状态，以及本地 alias、target 和摘要短前缀；产物缺失、校验失败或授权不可用时显示明确阻塞原因，不影响浏览器联调。没有本地 Companion 配置时仍可使用 Browser Fake 做状态联调，但真实 PC Companion 会 fail closed。
 
+手机 Dev Session 仅使用当前版本声明与平台批准结果求交后的有效权限，不接受调试页本地覆盖。两者均允许 `useOfficialDomain: true` 时，真机扫码调试会保留该配置；未批准、未声明或非法快照继续 fail closed。
+
 Browser Mock 会自动在实时与兼容链路间切换。手机调试使用 `open_inapp`/`openWindow` 包裹的 LAN 短链接二维码（先开普通 H5 跳转页，再进入小程序并关闭中间页）。
 
 ### 2. 先用浏览器 Mock 验收

package/skill/references/safety-boundaries.md

@@ -18,12 +18,12 @@
 - `auth.login()`、`user.getInfo()` 和 `user.getSteamGameList()` 的可用性不由 `network` 决定；它们分别要求 `userInfo` 或 `steamLibrary`，并继续遵循各自的用户授权和数据规则。
 - `user.revokeAuthorization()` 在两种网络模式下都要求可信用户手势；成功后必须停止使用并清理业务缓存的旧身份、资料和服务端会话。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
-- 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。
+- 现有业务网络请求仍使用 `network.request()`；该 API 已标记废弃，但目前没有替代调用入口，不要依赖浏览器原生网络出口。
 - 公开 `network.request()` 与 `network.download()` 均使用 no-follow redirect policy；3xx 不会在 Host 内静默跳转。
 - `network.request()` 不能访问平台保留的 runtime auth 与 OpenAPI 内部路径；页面不得持有或交换服务端应用凭据。
 - `network.request` 不支持 `multipart/form-data`；App Host 仅支持 form（`application/x-www-form-urlencoded`）与 JSON。表单请用 `URLSearchParams#toString()` 作为 `data`，文件上传请走专用上传能力。
 - 新 PC 开放持久 sandbox、单文件/目录 picker、精确 File 保存与公网 `network.download()`；多选和小黑盒域名流式下载暂不支持。Mobile、Web 与 Browser Dev Host 仍未开放这些 primitive。
-- 新 PC 支持 `network.request`，但会忽略 `withCredentials`；它不改变请求路由或凭据行为。其他平台继续遵循各自的 Host 语义。
+- `withCredentials` 不再是支持的配置字段，也不会进入新 SDK、协议或 Host contract；旧 SDK 构建产物的 wire 字段仅由 Runtime 兼容忽略。Mobile 对官方 HTTPS 默认端口目标自动启用 Native Cookie，第三方关闭；应用可显式提供 `Cookie`、`Authorization` 等请求头。`Origin`、`Referer`、`User-Agent` 由 Host 接管；`Host`、分帧及逐跳请求头由传输层管理，不能由小程序设置。Web Host 使用浏览器 Fetch，无法发送显式 `Cookie` 等浏览器禁止的头，会返回 `REQUEST_UNSUPPORTED`；需要第三方 Cookie 会话时请在支持原始请求头的 Mobile/PC Host 验收。
 - 新 PC 不支持振动、分享菜单和截图分享；`navigation.openAppPage` 仅支持 `game_detail`，用户/帖子详情会明确失败。调用平台相关能力时应处理 `METHOD_FORBIDDEN` 或 `REQUEST_UNSUPPORTED`。
 - picker 必须来自可信用户手势；取消选择返回 `FILE_PICKER_CANCELLED`。`saveFile()` 只接受 `suggestedName`，不接受 `accept`。
 - `pickFiles()` / `pickDirectory()` 默认只读；`pickFiles()` 仅在显式传入 `multiple: true` 时允许 Host 返回多个文件。要写入或作为下载目标时显式请求 `mode: 'readwrite'`。

package/skill/skill.json

@@ -1,16 +1,16 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.8.1-alpha.6+skill.079dd19d1630",
+  "skillVersion": "0.8.1-alpha.8+skill.8df6196da06d",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.6",
-    "compatibility": "0.8.1-alpha.6"
+    "version": "0.8.1-alpha.8",
+    "compatibility": "0.8.1-alpha.8"
   },
   "distribution": {
     "type": "npm",
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.6",
+    "version": "0.8.1-alpha.8",
     "path": "skill"
   },
-  "integrity": "sha256-079dd19d16302a5e71519d30312ad45aa1e0c05546e52f71dac6d7bf2fac238f"
+  "integrity": "sha256-8df6196da06d2647adf2fcc5c715f24e27824577c944fb6854d4986bd12d31ca"
 }

package/types/modules/network/index.d.ts

@@ -38,8 +38,6 @@ export interface MiniProgramNetworkRequestConfig {
     headers?: MiniProgramNetworkHeaders;
     /** 超时时间，单位毫秒。 */
     timeout?: number;
-    /** 是否携带凭据意图；具体策略由宿主运行时决定。 */
-    withCredentials?: boolean;
     /** SDK 侧状态校验；不会跨 bridge 传输函数值。 */
     validateStatus?: MiniProgramNetworkValidateStatus;
 }
@@ -54,7 +52,6 @@ export interface DownloadBaseOptions {
     params?: MiniProgramNetworkParams;
     headers?: MiniProgramNetworkHeaders;
     timeout?: number;
-    withCredentials?: boolean;
     maxBytes?: number;
     signal?: AbortSignal;
     onProgress?: (progress: DownloadProgress) => void;
@@ -82,7 +79,6 @@ export interface NetworkRequestPayload {
     data?: unknown;
     headers?: MiniProgramNetworkHeaders;
     timeout?: number;
-    withCredentials?: boolean;
 }
 /**
  * bridge / runtime 返回的标准化 HTTP 响应。
@@ -114,6 +110,7 @@ export interface MiniProgramNetworkModule {
      * @returns 标准化网络响应；HTTP 2xx 默认返回 resolve。
      * @throws 当请求已完成但 HTTP 状态不满足 `validateStatus` 时抛出 `HbMiniProgramNetworkError`。
      * @throws 当 bridge、运行时或宿主能力调用失败时抛出 `HbMiniProgramSDKError`。
+     * @deprecated Since 0.8.1-alpha.7. 暂无替代接口；现有调用仍可使用，请移除 withCredentials 配置。Native Cookie 由 Host 按目标域名决定。
      * @since 0.2.0-alpha.0
      * @hbPlatform android
      * @hbPlatform ios

package/types/modules/network/observability.d.ts

@@ -12,7 +12,6 @@ export interface NetworkRequestFailureLog {
     headers?: MiniProgramNetworkHeaders;
     dataPreview?: unknown;
     timeout?: number;
-    withCredentials?: boolean;
 }
 /**
  * 记录 `network.request` 失败，保证异常路径在开发者控制台可观测。

package/types/protocol/dev-session.d.ts

@@ -12,7 +12,8 @@ export declare const MINI_PROGRAM_DEV_LAUNCH_SCHEMA_VERSION: 1;
 /** Browser Dev Host 创建 Dev Session 时接收的请求。 */
 export interface MiniProgramDevSessionCreatePayload {
     mini_url_origin: string;
-    runtime_permissions: MiniProgramRuntimePermissionsSnapshot;
+    /** 仅用于兼容旧 Node 服务；当前服务端忽略该字段并自行读取远端权限。 */
+    runtime_permissions?: MiniProgramRuntimePermissionsSnapshot;
 }
 /** Browser Dev Host 创建 Dev Session 后返回的短期引用。 */
 export interface MiniProgramDevSessionCreateResult {