@heybox/hb-sdk 0.8.3-alpha.2 → 0.8.3-alpha.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. package/CHANGELOG.md +32 -0
  2. package/README.md +45 -7
  3. package/dist/cli-chunks/{build-lnIkF-rf.cjs → build-CkPA6jAR.cjs} +5 -5
  4. package/dist/cli-chunks/{context-DAdousk7.cjs → context-DoVGwJek.cjs} +35 -8
  5. package/dist/cli-chunks/{create-BrH3TKd9.cjs → create-vFF2Au_f.cjs} +1 -1
  6. package/dist/cli-chunks/{dev-Dazm6mjQ.cjs → dev-5lkHU1uv.cjs} +194 -73
  7. package/dist/cli-chunks/{doctor-Dqju9vZQ.cjs → doctor-DFt0LWou.cjs} +1 -1
  8. package/dist/cli-chunks/{index-ZxzVU017.cjs → index-CguXMrgP.cjs} +2 -2
  9. package/dist/cli-chunks/{index-Cscd6hCr.cjs → index-Ol4wxcob.cjs} +15 -15
  10. package/dist/cli-chunks/{index.esm-BPF3ML9J.cjs → index.esm-DUvvFi-Z.cjs} +7 -7
  11. package/dist/cli-chunks/{login-CR8vCqdL.cjs → login-CA5BhdXd.cjs} +2 -2
  12. package/dist/cli-chunks/{project-vite-C0fvgvWp.cjs → project-vite-P09pYZoU.cjs} +1 -1
  13. package/dist/cli-chunks/{remote-CZBw05sT.cjs → remote-DU0f2mlK.cjs} +36 -9
  14. package/dist/cli-chunks/{runtime-gate-CCyvzllG.cjs → runtime-gate-Ay8_t7m0.cjs} +1 -1
  15. package/dist/cli-chunks/{runtime-permission-env-v9THnMre.cjs → runtime-permission-env-C0clU7_f.cjs} +119 -6
  16. package/dist/cli-chunks/{session-UhAizNH0.cjs → session-2vOGqgeA.cjs} +1 -1
  17. package/dist/cli-chunks/{skill-BxL6KOYN.cjs → skill-D5Pf0dxT.cjs} +2 -2
  18. package/dist/cli-chunks/{version-B-iUWMkU.cjs → version-CF6ilsAH.cjs} +1 -1
  19. package/dist/cli.cjs +1 -1
  20. package/dist/devtools/browser-dev-host/assets/browser-dev-host-D6g0uewc.js +101 -0
  21. package/dist/devtools/browser-dev-host/assets/{desktop-app-launch-B1QBmFTk.js → desktop-app-launch-Cku9Fxud.js} +3 -3
  22. package/dist/devtools/browser-dev-host/assets/index-BrXEMo2-.css +1 -0
  23. package/dist/devtools/browser-dev-host/assets/{index-DWFHHorU.js → index-CVARuXxw.js} +4 -4
  24. package/dist/devtools/browser-dev-host/index.html +3 -3
  25. package/dist/index.cjs.js +32 -16
  26. package/dist/index.esm.js +32 -16
  27. package/dist/protocol.cjs.js +29 -20
  28. package/dist/protocol.esm.js +29 -21
  29. package/dist/vite.cjs.js +3 -3
  30. package/dist/vite.esm.js +3 -3
  31. package/docs/runtime-host-migration.md +5 -3
  32. package/package.json +6 -6
  33. package/skill/skill.json +4 -4
  34. package/types/index.d.ts +2 -2
  35. package/types/modules/viewport/index.d.ts +33 -2
  36. package/types/protocol/capabilities.d.ts +1 -1
  37. package/types/protocol/dev-session.d.ts +13 -2
  38. package/types/protocol.d.ts +2 -2
  39. package/dist/devtools/browser-dev-host/assets/browser-dev-host-BKVURp-m.js +0 -101
  40. package/dist/devtools/browser-dev-host/assets/index-D-cRoNV5.css +0 -1
@@ -235,19 +235,19 @@ function requireArgument () {
235
235
 
236
236
  var command = {};
237
237
 
238
- const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Cscd6hCr.cjs', document.baseURI).href)));
238
+ const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ol4wxcob.cjs', document.baseURI).href)));
239
239
  function __require$4() { return require$5("node:events"); }
240
240
 
241
- const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Cscd6hCr.cjs', document.baseURI).href)));
241
+ const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ol4wxcob.cjs', document.baseURI).href)));
242
242
  function __require$3() { return require$4("node:child_process"); }
243
243
 
244
- const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Cscd6hCr.cjs', document.baseURI).href)));
244
+ const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ol4wxcob.cjs', document.baseURI).href)));
245
245
  function __require$2() { return require$3("node:path"); }
246
246
 
247
- const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Cscd6hCr.cjs', document.baseURI).href)));
247
+ const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ol4wxcob.cjs', document.baseURI).href)));
248
248
  function __require$1() { return require$2("node:fs"); }
249
249
 
250
- const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Cscd6hCr.cjs', document.baseURI).href)));
250
+ const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ol4wxcob.cjs', document.baseURI).href)));
251
251
  function __require() { return require$1("node:process"); }
252
252
 
253
253
  var help = {};
@@ -13467,7 +13467,7 @@ function getPathname(pathWithQuery) {
13467
13467
  }
13468
13468
 
13469
13469
  const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
13470
- const BUILT_CLI_VERSION = '0.8.3-alpha.2';
13470
+ const BUILT_CLI_VERSION = '0.8.3-alpha.4';
13471
13471
  const PACKAGE_JSON_CANDIDATES = [
13472
13472
  path.resolve(__dirname, '..', '..', 'package.json'),
13473
13473
  path.resolve(__dirname, '..', 'package.json'),
@@ -13826,39 +13826,39 @@ function createCommandLoggerResolver(options) {
13826
13826
  };
13827
13827
  }
13828
13828
  const defaultClearLoginStatus = async (...args) => {
13829
- const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CR8vCqdL.cjs'); });
13829
+ const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CA5BhdXd.cjs'); });
13830
13830
  return clearLoginStatus(...args);
13831
13831
  };
13832
13832
  const defaultLoginToHeybox = async (...args) => {
13833
- const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CR8vCqdL.cjs'); });
13833
+ const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CA5BhdXd.cjs'); });
13834
13834
  return loginToHeybox(...args);
13835
13835
  };
13836
13836
  const defaultPrintLoginStatus = async (...args) => {
13837
- const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CR8vCqdL.cjs'); });
13837
+ const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CA5BhdXd.cjs'); });
13838
13838
  return printLoginStatus(...args);
13839
13839
  };
13840
13840
  const defaultRunBuildCommand = async (...args) => {
13841
- const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-lnIkF-rf.cjs'); });
13841
+ const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CkPA6jAR.cjs'); });
13842
13842
  return runBuildCommand(...args);
13843
13843
  };
13844
13844
  const defaultRunCreateCommand = async (...args) => {
13845
- const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BrH3TKd9.cjs'); });
13845
+ const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-vFF2Au_f.cjs'); });
13846
13846
  return runCreateCommand(...args);
13847
13847
  };
13848
13848
  const defaultRunDevCommand = async (...args) => {
13849
- const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-Dazm6mjQ.cjs'); }).then(function (n) { return n.dev; });
13849
+ const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-5lkHU1uv.cjs'); }).then(function (n) { return n.dev; });
13850
13850
  return runDevCommand(...args);
13851
13851
  };
13852
13852
  const defaultRunDoctorCommand = async (...args) => {
13853
- const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-Dqju9vZQ.cjs'); });
13853
+ const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DFt0LWou.cjs'); });
13854
13854
  return runDoctorCommand(...args);
13855
13855
  };
13856
13856
  const defaultRunSkillInstallCommand = async (...args) => {
13857
- const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-BxL6KOYN.cjs'); });
13857
+ const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-D5Pf0dxT.cjs'); });
13858
13858
  return runSkillInstallCommand(...args);
13859
13859
  };
13860
13860
  const defaultRunRemoteCommand = async (...args) => {
13861
- const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-CZBw05sT.cjs'); });
13861
+ const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DU0f2mlK.cjs'); });
13862
13862
  return runRemoteCommand(...args);
13863
13863
  };
13864
13864
  function resolveStandaloneLogger(options, verbose) {
@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
11
11
  var require$$0 = require('zlib');
12
12
  var require$$0$1 = require('buffer');
13
13
  var require$$1 = require('util');
14
- var index = require('./index-Cscd6hCr.cjs');
15
- var dev = require('./dev-Dazm6mjQ.cjs');
14
+ var index = require('./index-Ol4wxcob.cjs');
15
+ var dev = require('./dev-5lkHU1uv.cjs');
16
16
  require('node:module');
17
17
  require('node:fs');
18
18
  require('node:fs/promises');
@@ -23,12 +23,12 @@ require('node:crypto');
23
23
  require('readline');
24
24
  require('tty');
25
25
  require('assert');
26
- require('./context-DAdousk7.cjs');
27
- require('./runtime-permission-env-v9THnMre.cjs');
28
- require('./version-B-iUWMkU.cjs');
26
+ require('./context-DoVGwJek.cjs');
27
+ require('./runtime-permission-env-C0clU7_f.cjs');
28
+ require('./version-CF6ilsAH.cjs');
29
29
  require('node:async_hooks');
30
30
  require('sharp');
31
- require('./session-UhAizNH0.cjs');
31
+ require('./session-2vOGqgeA.cjs');
32
32
  require('fs');
33
33
  require('constants');
34
34
  require('node:os');
@@ -42,7 +42,7 @@ require('node:buffer');
42
42
  require('node:url');
43
43
  require('node:util');
44
44
  require('node:child_process');
45
- require('./project-vite-C0fvgvWp.cjs');
45
+ require('./project-vite-P09pYZoU.cjs');
46
46
  require('node:zlib');
47
47
 
48
48
  var bufferUtil = {exports: {}};
@@ -3,9 +3,9 @@
3
3
  var promises = require('node:readline/promises');
4
4
  var node_crypto = require('node:crypto');
5
5
  var node_http = require('node:http');
6
- var session = require('./session-UhAizNH0.cjs');
6
+ var session = require('./session-2vOGqgeA.cjs');
7
7
  var browser = require('./browser-RAy8e8cV.cjs');
8
- var index = require('./index-Cscd6hCr.cjs');
8
+ var index = require('./index-Ol4wxcob.cjs');
9
9
  require('node:path');
10
10
  require('fs');
11
11
  require('constants');
@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
5
5
  var node_module = require('node:module');
6
6
  var path = require('node:path');
7
7
  var node_url = require('node:url');
8
- var index = require('./index-Cscd6hCr.cjs');
8
+ var index = require('./index-Ol4wxcob.cjs');
9
9
 
10
10
  function findProjectRoot(startDir) {
11
11
  let current = path.resolve(startDir);
@@ -1,18 +1,18 @@
1
1
  'use strict';
2
2
 
3
- var runtimePermissionEnv = require('./runtime-permission-env-v9THnMre.cjs');
4
- var context = require('./context-DAdousk7.cjs');
3
+ var runtimePermissionEnv = require('./runtime-permission-env-C0clU7_f.cjs');
4
+ var context = require('./context-DoVGwJek.cjs');
5
5
  var promises = require('node:readline/promises');
6
- var index = require('./index-Cscd6hCr.cjs');
7
- var session = require('./session-UhAizNH0.cjs');
6
+ var index = require('./index-Ol4wxcob.cjs');
7
+ var session = require('./session-2vOGqgeA.cjs');
8
8
  var childProcess = require('node:child_process');
9
9
  var fs = require('node:fs');
10
10
  var fs$1 = require('node:fs/promises');
11
11
  var path = require('node:path');
12
12
  var node_crypto = require('node:crypto');
13
13
  require('node:zlib');
14
- var runtimeGate = require('./runtime-gate-CCyvzllG.cjs');
15
- require('./version-B-iUWMkU.cjs');
14
+ var runtimeGate = require('./runtime-gate-Ay8_t7m0.cjs');
15
+ require('./version-CF6ilsAH.cjs');
16
16
  require('node:async_hooks');
17
17
  require('sharp');
18
18
  require('node:module');
@@ -274,7 +274,7 @@ function createDefaultCosClient(uploadToken, COS) {
274
274
  };
275
275
  }
276
276
  async function loadCosConstructor() {
277
- const cosModule = await Promise.resolve().then(function () { return require('./index-ZxzVU017.cjs'); }).then(function (n) { return n.index; });
277
+ const cosModule = await Promise.resolve().then(function () { return require('./index-CguXMrgP.cjs'); }).then(function (n) { return n.index; });
278
278
  return cosModule.default;
279
279
  }
280
280
  function formatSize(bytes) {
@@ -479,6 +479,24 @@ function isNodeError(error) {
479
479
  return error instanceof Error && 'code' in error;
480
480
  }
481
481
 
482
+ /** 发布提示只比较显式声明与线上批准,不消费本地调试授权。 */
483
+ function getUnapprovedPermissionWarning(local, approvals) {
484
+ if (!local.declared)
485
+ return undefined;
486
+ const { views } = runtimePermissionEnv.composeMiniappRuntimePermissions(local, approvals);
487
+ const missing = [];
488
+ for (const view of views) {
489
+ if (!view.declared || view.access !== 'platform-approval')
490
+ continue;
491
+ if (!view.approved)
492
+ missing.push(view.key);
493
+ if (view.key === 'network' && view.requestedConfig?.useOfficialDomain && !view.approvedConfig?.useOfficialDomain) {
494
+ missing.push('network.useOfficialDomain');
495
+ }
496
+ }
497
+ return missing.length ? `以下本地声明权限线上未批准,发布后不可用:${missing.join('、')}。本地调试可用不代表线上已批准。` : undefined;
498
+ }
499
+
482
500
  const SUPPORTED_PACKAGE_MANAGERS = [
483
501
  { name: 'pnpm', lockfile: 'pnpm-lock.yaml' },
484
502
  { name: 'yarn', lockfile: 'yarn.lock' },
@@ -563,6 +581,9 @@ async function runDeployCommand(options, runtime = {}) {
563
581
  }), { successText: '已读取远端小程序权限' });
564
582
  const localNetworkEnabled = !localPermissions.declared || localPermissions.permissions?.network?.enabled === true;
565
583
  skipPlatformCsp = localNetworkEnabled && context.shouldSkipMiniappPlatformCsp(detail.runtime_permissions);
584
+ const permissionWarning = getUnapprovedPermissionWarning(localPermissions, detail.runtime_permissions);
585
+ if (permissionWarning)
586
+ logger.warn(permissionWarning);
566
587
  }
567
588
  catch (error) {
568
589
  logger.warn('未读取到远端 Runtime 权限,构建将继续注入平台 CSP。');
@@ -1459,6 +1480,9 @@ async function remoteDangerousWrite(options, context, runtime) {
1459
1480
  operation: options.command,
1460
1481
  status: detail.status,
1461
1482
  version,
1483
+ permissionWarning: options.command === 'release'
1484
+ ? getUnapprovedPermissionWarning(runtimePermissionEnv.readMiniappPermissionsFromPackageJson(context.packageJson.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion()), detail.runtime_permissions)
1485
+ : undefined,
1462
1486
  });
1463
1487
  if (options.command === 'release') {
1464
1488
  const result = await context.api.releaseVersion({ miniProgramId, version: version });
@@ -1786,6 +1810,8 @@ async function confirmDangerousRemoteChange(options, runtime, logger, context) {
1786
1810
  `当前状态:${context.status || '--'}`,
1787
1811
  ...(context.version ? [`目标版本:${context.version}`] : []),
1788
1812
  ];
1813
+ if (context.permissionWarning)
1814
+ logger.warn(context.permissionWarning);
1789
1815
  if (!options.json) {
1790
1816
  for (const line of lines) {
1791
1817
  logger.info(line);
@@ -1803,9 +1829,10 @@ async function confirmDangerousRemoteChange(options, runtime, logger, context) {
1803
1829
  if (!isTTY) {
1804
1830
  throw new Error(`非交互环境执行 hb-sdk remote ${context.operation} 必须传 --yes`);
1805
1831
  }
1832
+ const confirmation = `${context.permissionWarning ? `${context.permissionWarning}\n` : ''}确认执行 ${context.operation}?`;
1806
1833
  const accepted = runtime.promptConfirm
1807
- ? await runtime.promptConfirm(`确认执行 ${context.operation}?`)
1808
- : await promptConfirm(`确认执行 ${context.operation}?输入 yes 继续: `, runtime);
1834
+ ? await runtime.promptConfirm(confirmation)
1835
+ : await promptConfirm(`${confirmation}输入 yes 继续: `, runtime);
1809
1836
  if (!accepted) {
1810
1837
  throw new Error('已取消操作');
1811
1838
  }
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var runtimePermissionEnv = require('./runtime-permission-env-v9THnMre.cjs');
3
+ var runtimePermissionEnv = require('./runtime-permission-env-C0clU7_f.cjs');
4
4
 
5
5
  // Shorthands
6
6
  /**
@@ -2,7 +2,7 @@
2
2
 
3
3
  var fs = require('node:fs');
4
4
  var path = require('node:path');
5
- var version = require('./version-B-iUWMkU.cjs');
5
+ var version = require('./version-CF6ilsAH.cjs');
6
6
  require('node:crypto');
7
7
  var node_async_hooks = require('node:async_hooks');
8
8
 
@@ -3209,7 +3209,7 @@ function isManagedMiniProgramRuntimePermissionKey(key) {
3209
3209
  * @see {@link https://docs.xiaoheihe.cn/hb_sdk/guide/permissions | 权限声明}
3210
3210
  */
3211
3211
  function parseMiniProgramRuntimePermissions(snapshot) {
3212
- if (!isRecord$4(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
3212
+ if (!isRecord$2$1(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
3213
3213
  return { valid: false, permissions: {} };
3214
3214
  }
3215
3215
  if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
@@ -3218,7 +3218,7 @@ function parseMiniProgramRuntimePermissions(snapshot) {
3218
3218
  const seenKeys = new Set();
3219
3219
  const permissions = {};
3220
3220
  for (const rawEntry of snapshot.entries) {
3221
- if (!isRecord$4(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
3221
+ if (!isRecord$2$1(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
3222
3222
  return { valid: false, permissions: {} };
3223
3223
  }
3224
3224
  const inputKey = rawEntry.key.trim();
@@ -3234,7 +3234,7 @@ function parseMiniProgramRuntimePermissions(snapshot) {
3234
3234
  }
3235
3235
  if (key === 'network') {
3236
3236
  const config = rawEntry.config;
3237
- if (!isRecord$4(config) || typeof config.useOfficialDomain !== 'boolean') {
3237
+ if (!isRecord$2$1(config) || typeof config.useOfficialDomain !== 'boolean') {
3238
3238
  return { valid: false, permissions: {} };
3239
3239
  }
3240
3240
  permissions[key] = {
@@ -3244,7 +3244,7 @@ function parseMiniProgramRuntimePermissions(snapshot) {
3244
3244
  };
3245
3245
  continue;
3246
3246
  }
3247
- if (rawEntry.config !== null && rawEntry.config !== undefined && (!isRecord$4(rawEntry.config) || Object.keys(rawEntry.config).length > 0)) {
3247
+ if (rawEntry.config !== null && rawEntry.config !== undefined && (!isRecord$2$1(rawEntry.config) || Object.keys(rawEntry.config).length > 0)) {
3248
3248
  return { valid: false, permissions: {} };
3249
3249
  }
3250
3250
  permissions[key] = {
@@ -3255,10 +3255,120 @@ function parseMiniProgramRuntimePermissions(snapshot) {
3255
3255
  }
3256
3256
  return { valid: true, permissions };
3257
3257
  }
3258
- function isRecord$4(value) {
3258
+ function isRecord$2$1(value) {
3259
3259
  return typeof value === 'object' && value !== null && !Array.isArray(value);
3260
3260
  }
3261
3261
 
3262
+ /** 仅供开发工具和 Host 使用;新增权限必须单独评估,不能从平台审批目录自动推导。 */
3263
+ const LOCAL_DEV_GRANT_PERMISSION_KEYS = ['network', 'companion'];
3264
+ /**
3265
+ * 严格解析本地 grant。任何未知字段、重复权限或非法配置都拒绝整份输入。
3266
+ * 只校验数据合同;票据、身份、摘要、过期时间和 CLI lease 必须由 Host 另行验证。
3267
+ */
3268
+ function parseMiniProgramLocalDevGrant(value) {
3269
+ if (!hasExactFields(value, ['schema_version', 'revision', 'entries']) ||
3270
+ value.schema_version !== 1 ||
3271
+ typeof value.revision !== 'number' ||
3272
+ !Number.isSafeInteger(value.revision) ||
3273
+ value.revision < 0 ||
3274
+ !Array.isArray(value.entries) ||
3275
+ value.entries.length > LOCAL_DEV_GRANT_PERMISSION_KEYS.length)
3276
+ return { valid: false };
3277
+ const entries = [];
3278
+ const seen = new Set();
3279
+ for (const entry of value.entries) {
3280
+ if (!hasExactFields(entry, ['key', 'status', 'config']) || entry.status !== 'enabled')
3281
+ return { valid: false };
3282
+ if (typeof entry.key !== 'string' || seen.has(entry.key))
3283
+ return { valid: false };
3284
+ seen.add(entry.key);
3285
+ if (entry.key === 'network') {
3286
+ if (!hasExactFields(entry.config, ['useOfficialDomain']) || entry.config.useOfficialDomain !== false)
3287
+ return { valid: false };
3288
+ entries.push({ key: 'network', status: 'enabled', config: { useOfficialDomain: false } });
3289
+ }
3290
+ else if (entry.key === 'companion') {
3291
+ if (!hasExactFields(entry.config, []))
3292
+ return { valid: false };
3293
+ entries.push({ key: 'companion', status: 'enabled', config: {} });
3294
+ }
3295
+ else {
3296
+ return { valid: false };
3297
+ }
3298
+ }
3299
+ entries.sort((a, b) => LOCAL_DEV_GRANT_PERMISSION_KEYS.indexOf(a.key) - LOCAL_DEV_GRANT_PERMISSION_KEYS.indexOf(b.key));
3300
+ return { valid: true, grant: { schema_version: 1, revision: value.revision, entries } };
3301
+ }
3302
+ /**
3303
+ * 从已校验声明生成批准缺口。Companion 默认不符合资格,由 CLI 确认平台、产物与摘要后显式加入。
3304
+ * 空 entries 可保留 revision,不能作为存在临时权限的判断依据。
3305
+ */
3306
+ function createMiniProgramLocalDevGrant(options) {
3307
+ if (!Number.isSafeInteger(options.revision) || options.revision < 0)
3308
+ throw new Error('本地调试权限 revision 必须是非负安全整数');
3309
+ const approvals = parseMiniProgramRuntimePermissions(options.runtimePermissions);
3310
+ const eligible = new Set(options.eligiblePermissionKeys ?? ['network']);
3311
+ const entries = [];
3312
+ for (const key of LOCAL_DEV_GRANT_PERMISSION_KEYS) {
3313
+ if (!eligible.has(key) || options.declaredPermissions[key]?.enabled !== true)
3314
+ continue;
3315
+ if (approvals.valid && approvals.permissions[key]?.status === 'enabled')
3316
+ continue;
3317
+ entries.push(key === 'network'
3318
+ ? { key, status: 'enabled', config: { useOfficialDomain: false } }
3319
+ : { key, status: 'enabled', config: {} });
3320
+ }
3321
+ return { schema_version: 1, revision: options.revision, entries };
3322
+ }
3323
+ /**
3324
+ * 线上基线先与本地声明求交,再补齐临时权限,返回与输入脱离的普通 Runtime 快照。
3325
+ * 调用方只可在当前 Dev Session 已验证且用户接受后传入 grant;本函数不证明其可信来源。
3326
+ * 非法 grant 整体降权到基线,已批准配置不会被临时配置覆盖。
3327
+ */
3328
+ function composeLocalDevRuntimePermissions(options) {
3329
+ const baseline = parseMiniProgramRuntimePermissions(options.runtimePermissions);
3330
+ const parsed = parseMiniProgramLocalDevGrant(options.localDevGrant);
3331
+ const permissions = baseline.valid ? baseline.permissions : {};
3332
+ for (const key of MINI_PROGRAM_PERMISSION_KEYS) {
3333
+ if (options.declaredPermissions[key]?.enabled !== true) {
3334
+ delete permissions[key];
3335
+ }
3336
+ else if (key === 'network' && permissions.network) {
3337
+ permissions.network.config.useOfficialDomain = permissions.network.status === 'enabled'
3338
+ && permissions.network.config.useOfficialDomain === true
3339
+ && options.declaredPermissions.network?.useOfficialDomain === true;
3340
+ }
3341
+ }
3342
+ const temporaryPermissionKeys = [];
3343
+ if (parsed.valid) {
3344
+ for (const entry of parsed.grant.entries) {
3345
+ if (options.declaredPermissions[entry.key]?.enabled !== true || permissions[entry.key]?.status === 'enabled')
3346
+ continue;
3347
+ permissions[entry.key] = entry;
3348
+ temporaryPermissionKeys.push(entry.key);
3349
+ }
3350
+ }
3351
+ const revision = isRecord$1$1(options.runtimePermissions) && typeof options.runtimePermissions.revision === 'number'
3352
+ && Number.isSafeInteger(options.runtimePermissions.revision) && options.runtimePermissions.revision >= 0
3353
+ ? options.runtimePermissions.revision : undefined;
3354
+ return {
3355
+ runtimePermissions: {
3356
+ schema_version: 1,
3357
+ ...(revision === undefined ? {} : { revision }),
3358
+ entries: MINI_PROGRAM_PERMISSION_KEYS.flatMap((key) => permissions[key] ? [permissions[key]] : []),
3359
+ },
3360
+ temporaryPermissionKeys,
3361
+ grantValid: parsed.valid,
3362
+ };
3363
+ }
3364
+ function isRecord$1$1(value) {
3365
+ return typeof value === 'object' && value !== null && !Array.isArray(value);
3366
+ }
3367
+ function hasExactFields(value, fields) {
3368
+ return isRecord$1$1(value) && Object.keys(value).length === fields.length
3369
+ && fields.every((field) => Object.prototype.hasOwnProperty.call(value, field));
3370
+ }
3371
+
3262
3372
  const MINIAPP_PERMISSION_KEYS = MINI_PROGRAM_PERMISSION_KEYS;
3263
3373
  function parseMiniappPermissions(value, options) {
3264
3374
  const sourceLabel = options.sourceLabel ?? 'package.json#heybox.permissions';
@@ -12768,7 +12878,9 @@ exports.USER_MINIPROGRAM_VERSION_PREVIEW_INFO_API_PATH = USER_MINIPROGRAM_VERSIO
12768
12878
  exports.WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH = WITHDRAW_USER_MINIPROGRAM_VERSION_API_PATH;
12769
12879
  exports.areMiniappPlatformsEqual = areMiniappPlatformsEqual;
12770
12880
  exports.areMiniappWindowsEqual = areMiniappWindowsEqual;
12881
+ exports.composeLocalDevRuntimePermissions = composeLocalDevRuntimePermissions;
12771
12882
  exports.composeMiniappRuntimePermissions = composeMiniappRuntimePermissions;
12883
+ exports.createMiniProgramLocalDevGrant = createMiniProgramLocalDevGrant;
12772
12884
  exports.createMiniappArtifactFileHeader = createMiniappArtifactFileHeader;
12773
12885
  exports.createMiniappArtifactSignatureHeader = createMiniappArtifactSignatureHeader;
12774
12886
  exports.createMiniappPlatformCspEnv = createMiniappPlatformCspEnv;
@@ -12777,6 +12889,7 @@ exports.hasMiniappDesktopPlatform = hasMiniappDesktopPlatform;
12777
12889
  exports.isValidMiniappManifestVersion = isValidMiniappManifestVersion;
12778
12890
  exports.normalizeBasicInfoName = normalizeBasicInfoName;
12779
12891
  exports.normalizeRelativePath = normalizeRelativePath;
12892
+ exports.parseMiniProgramLocalDevGrant = parseMiniProgramLocalDevGrant;
12780
12893
  exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;
12781
12894
  exports.parseMiniappBasicInfo = parseMiniappBasicInfo;
12782
12895
  exports.parseMiniappManifestJson = parseMiniappManifestJson;
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var index = require('./index-Cscd6hCr.cjs');
3
+ var index = require('./index-Ol4wxcob.cjs');
4
4
  var node_crypto = require('node:crypto');
5
5
  var path = require('node:path');
6
6
  var require$$0$2 = require('fs');
@@ -1,10 +1,10 @@
1
1
  'use strict';
2
2
 
3
- var version = require('./version-B-iUWMkU.cjs');
3
+ var version = require('./version-CF6ilsAH.cjs');
4
4
  var fs = require('node:fs/promises');
5
5
  var path = require('node:path');
6
6
  var childProcess = require('node:child_process');
7
- var index = require('./index-Cscd6hCr.cjs');
7
+ var index = require('./index-Ol4wxcob.cjs');
8
8
  require('node:module');
9
9
  require('node:fs');
10
10
  require('path');
@@ -3,6 +3,6 @@
3
3
  /** 构建时替换为当前发布包的实际版本。 */
4
4
  const HB_SDK_VERSION = typeof undefined === 'string'
5
5
  ? undefined
6
- : '0.8.3-alpha.2';
6
+ : '0.8.3-alpha.4';
7
7
 
8
8
  exports.HB_SDK_VERSION = HB_SDK_VERSION;
package/dist/cli.cjs CHANGED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var index = require('./cli-chunks/index-Cscd6hCr.cjs');
3
+ var index = require('./cli-chunks/index-Ol4wxcob.cjs');
4
4
  require('node:module');
5
5
  require('node:fs');
6
6
  require('node:fs/promises');