@heybox/hb-sdk 0.8.1-alpha.7 → 0.8.1-alpha.8

package/dist/devtools/browser-dev-host/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#f4f5f7" />
     <title>小程序工坊调试台</title>
-    <script type="module" crossorigin src="/assets/index-DocojUxT.js"></script>
+    <script type="module" crossorigin src="/assets/index-8LTH05np.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-DnPRjCa3.js">
     <link rel="stylesheet" crossorigin href="/assets/index-D-aNERAr.css">
   </head>

package/dist/index.cjs.js

@@ -835,7 +835,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.7';
+    : '0.8.1-alpha.8';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/index.esm.js

@@ -831,7 +831,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.7';
+    : '0.8.1-alpha.8';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/vite.cjs.js

@@ -11,7 +11,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.7';
+    : '0.8.1-alpha.8';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/dist/vite.esm.js

@@ -8,7 +8,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.7';
+    : '0.8.1-alpha.8';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.8.1-alpha.7",
+  "version": "0.8.1-alpha.8",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -62,7 +62,7 @@
     "skills": "1.5.23",
     "undici": "^7.28.0",
     "ws": "^8.18.0",
-    "@heybox/hb-sdk-protocol": "0.8.1-alpha.7"
+    "@heybox/hb-sdk-protocol": "0.8.1-alpha.8"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -113,13 +113,13 @@
     "vue-tsc": "^3.3.7",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
+    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
     "@heybox/hb-api": "~1.28.3",
+    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.8",
     "@heybox-domain/heybox-theme": "~0.1.0",
-    "@heybox/hb-sdk-runtime": "~0.8.1-alpha.7",
-    "@heybox/runtime-policy": "~0.2.0",
-    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
     "@heybox/runtime-transport-fetch": "~0.2.0",
-    "@heybox/runtime": "~0.2.0"
+    "@heybox/runtime": "~0.2.0",
+    "@heybox/runtime-policy": "~0.2.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -171,7 +171,7 @@
     "check:compatibility-evidence": "node scripts/validate-compatibility-evidence.mjs",
     "check:api-semver": "node ../../ops/jobs/hb-sdk-docs-contract/semantic-diff.cjs",
     "clean": "rimraf ./dist && rimraf ./types",
-    "test:unit": "NODE_OPTIONS='--conditions=heybox' vitest run",
+    "test:unit": "vitest run",
     "test:types:characterization": "tsc -p tsconfig.characterization.json --noEmit --pretty false",
     "test:types:browser-dev-host": "vue-tsc -p tsconfig.browser-dev-host.json --noEmit --pretty false",
     "test:types": "pnpm run test:types:characterization && pnpm run test:types:browser-dev-host",

package/skill/SKILL.md

@@ -61,7 +61,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 
 1. Use `hb-sdk create <project-name>` to scaffold a workshop mini-program.
 2. Use `hb-sdk dev` for Browser Mock and Mobile App debugging. Browser debugging can start without CLI login, project binding, or a remote Dev Context; capabilities that need those inputs fail explicitly. Mobile uses the single QR entry with the `open_inapp` and `heybox://` `openWindow` wrapper around a LAN short URL, then opens `heybox-mini-dev://sandbox` with the complete launch context.
-3. The debugging page does not edit permissions. Treat the validated remote permission snapshot as canonical Runtime input. Use `--port`, `--browser-dev-host-port`, and `--no-open` to control local endpoints and browser opening. Select a Mobile network interface the device can reach. `launch.json` is a LAN discovery document, not authentication, encryption, signing, or HMAC protection.
+3. The debugging page does not edit permissions. Treat the effective intersection of the current project declaration and validated remote approval as canonical Runtime input. Mobile debugging preserves `useOfficialDomain: true` only when both inputs allow it, refreshes the effective permissions before opening on a phone, and never accepts a browser-side permission override. Use `--port`, `--browser-dev-host-port`, and `--no-open` to control local endpoints and browser opening. Select a Mobile network interface the device can reach. `launch.json` is a LAN discovery document, not authentication, encryption, signing, or HMAC protection.
    For real PC Companion debugging, configure local artifacts in `package.json#heybox.companions`, keep `miniappManifest()` enabled, bind the project, and ensure COA has approved `companion`. `hb-sdk dev` validates immutable snapshots without requiring an upload; config or artifact changes rotate the snapshot while existing Sessions retain their original artifact. Prepare and launch the new artifact explicitly. Check separate Browser, Mobile and PC Companion readiness in the debugging workbench. Without a local declaration, use Browser Fake only for state/UI integration.
 4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
 5. Declare the actual supported platforms in `package.json#heybox.platforms` and keep the no-argument `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the declaration, Manifest, or Runtime gate output is missing or inconsistent.

package/skill/references/api-root.md

@@ -27,7 +27,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.8.1-alpha.7`
+- Version at generation time: `0.8.1-alpha.8`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`

package/skill/references/cli.md

@@ -121,6 +121,8 @@ CLI 会启动页面服务并自动打开 Vue 3 本地调试台。左侧集中放
 
 本地真 PC 调试 Companion 不要求先上传版本，但必须在 `package.json#heybox.companions` 中配置本地 ZIP、绑定项目，并由 COA 批准 `companion`；`miniappManifest()` 只保留构建配置。dev server 只向 loopback 提供 canonical Manifest 与固定 ZIP 路由；CLI 在签发或刷新本地启动票时绑定 Manifest 摘要。配置或 ZIP 变化后会校验并切换到新快照，已有 Session 保持原有产物，新产物须重新准备与启动。调试台分别展示浏览器、手机与 PC Companion 的就绪状态，以及本地 alias、target 和摘要短前缀；产物缺失、校验失败或授权不可用时显示明确阻塞原因，不影响浏览器联调。没有本地 Companion 配置时仍可使用 Browser Fake 做状态联调，但真实 PC Companion 会 fail closed。
 
+手机 Dev Session 仅使用当前版本声明与平台批准结果求交后的有效权限，不接受调试页本地覆盖。两者均允许 `useOfficialDomain: true` 时，真机扫码调试会保留该配置；未批准、未声明或非法快照继续 fail closed。
+
 Browser Mock 会自动在实时与兼容链路间切换。手机调试使用 `open_inapp`/`openWindow` 包裹的 LAN 短链接二维码（先开普通 H5 跳转页，再进入小程序并关闭中间页）。
 
 ### 2. 先用浏览器 Mock 验收

package/skill/skill.json

@@ -1,16 +1,16 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.8.1-alpha.7+skill.cc51aa429a00",
+  "skillVersion": "0.8.1-alpha.8+skill.8df6196da06d",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.7",
-    "compatibility": "0.8.1-alpha.7"
+    "version": "0.8.1-alpha.8",
+    "compatibility": "0.8.1-alpha.8"
   },
   "distribution": {
     "type": "npm",
     "package": "@heybox/hb-sdk",
-    "version": "0.8.1-alpha.7",
+    "version": "0.8.1-alpha.8",
     "path": "skill"
   },
-  "integrity": "sha256-cc51aa429a00b117c134cff1c71b42c6e72fcb9e169533428eaa8d9f54b6a853"
+  "integrity": "sha256-8df6196da06d2647adf2fcc5c715f24e27824577c944fb6854d4986bd12d31ca"
 }

package/types/protocol/dev-session.d.ts

@@ -12,7 +12,8 @@ export declare const MINI_PROGRAM_DEV_LAUNCH_SCHEMA_VERSION: 1;
 /** Browser Dev Host 创建 Dev Session 时接收的请求。 */
 export interface MiniProgramDevSessionCreatePayload {
     mini_url_origin: string;
-    runtime_permissions: MiniProgramRuntimePermissionsSnapshot;
+    /** 仅用于兼容旧 Node 服务；当前服务端忽略该字段并自行读取远端权限。 */
+    runtime_permissions?: MiniProgramRuntimePermissionsSnapshot;
 }
 /** Browser Dev Host 创建 Dev Session 后返回的短期引用。 */
 export interface MiniProgramDevSessionCreateResult {