@heybox/hb-sdk 0.9.0-alpha.9 → 0.9.1-alpha.0

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.1-alpha.0
+
+- No user-facing hb-sdk package changes were detected from Conventional Commits.
+
+## 0.9.0 - 2026-10-10
+
+> 影响级别：Breaking
+> 开发者动作：升级至 `0.9.0` 前补齐 `package.json#heybox.permissions` 与 `package.json#heybox.platforms` 并重新构建；手机真机调试重新运行 `hb-sdk dev`。
+> 兼容范围：公开 SDK API 形状不变；本版本起权限与平台声明全面强制，不再保留 0.8 系列的缺失声明兼容行为，也没有回滚开关。
+
+### 必须操作
+
+- 补齐 [`package.json#heybox.permissions`](https://docs.xiaoheihe.cn/hb_sdk/guide/permissions)：未声明会直接拒绝构建，无权限需求也要配置 `{}`。
+- 补齐 [`package.json#heybox.platforms`](https://docs.xiaoheihe.cn/hb_sdk/guide/project-configuration)：产物 SDK 版本达到 `0.9.0` 后，缺少平台声明不再按移动端兜底。
+- 按实际调用补齐最小声明；声明的新增、删除和配置变化会进入版本审核差异。
+
+### 行为调整
+
+- 手机真机调试的 `network.request()` 由开发机转发，请求中的 `localhost` 指向开发机。
+- `hb-sdk dev` 只在启动、绑定或权限声明变化时读取远端详情；手机重连复用快照，不再因票据续签反复请求。
+- `user.getSteamGameList()` 复用已有结果，文件能力不可用时回退内存缓存。
+- `navigation.openAppPage({ target: 'mini_program' })` 跳转前先恢复竖屏；恢复失败或跳转超时、SDK 销毁后不再打开目标。
+- Companion ZIP 复用已验证内容，服务端校验通过后再提交审核，中断的部署可续接。
+
+### 问题修复
+
+- 修复权限校验失败后仍能获取续签启动票，以及声明变化时旧状态覆盖最新调试状态的问题。
+- 修复扫码调试启动信息缺少当前用户小程序身份，导致部分 Android 调试容器无法使用原生桥接能力的问题。
+
+### 文档与工具
+
+- 浏览器调试台支持横竖屏与全屏模拟。
+- 补齐网络超时与重试、Steam 授权、生命周期事件、Android 文件读写与鸿蒙目录选择等能力说明。
+
+## 0.9.0-alpha.11 - 2026-10-10
+
+### 文档与工具
+
+- 更新 Android 外部文件读写及保存位置的支持说明，明确精确 SAF 授权的写入与原子替换限制。
+- 补充鸿蒙目录选择的系统能力要求与不支持时的错误处理说明。
+
+## 0.9.0-alpha.10 - 2026-10-10
+
+### 行为调整
+
+- 支持方向控制的宿主在 `navigation.openAppPage({ target: 'mini_program' })` 跳转前，先恢复竖屏、非全屏；恢复失败时不打开目标，并返回方向错误。返回后需要横屏的页面应在 `show` 事件中重新调用 `viewport.setDisplay()`。
+
+### 问题修复
+
+- 修复跨小程序跳转超时或 SDK 销毁后仍可能打开目标的问题；恢复竖屏阶段增加截止时间，并向宿主传播取消。旧宿主没有方向能力时继续允许跳转。
+
 ## 0.9.0-alpha.9 - 2026-10-10
 
 ### 问题修复
@@ -263,6 +314,7 @@
 
 - 补充游戏详情页资源位申请规则、图标制作规范和申请流程说明。
 
+
 ## 0.8.2 - 2026-09-21
 
 > 摘要：版本名称与图片改由项目维护，新增 Steam 账号授权，并调整部署与用户数据边界。

package/README.md

@@ -56,7 +56,7 @@ hb-sdk skill install --all-agents
 
 SDK 会在导入时启动握手，能力调用会自动等待 SDK 就绪。声明 `userInfo` 后，可通过 `user.getInfo()` 读取当前小程序内的隔离身份和已授权资料：
 
-使用受保护能力前，需要在项目根 `package.json#heybox.permissions` 中显式声明。`auth.login()` 和 `user.getInfo()` 都只需要 `userInfo`，不依赖公开 `network` 权限；`network` 仅约束 `network.request()` 与 `network.download()`，线上使用仍需平台批准。所有需要平台批准的权限当前均未开放，包括 `network` 和 `companion`；开发者申请入口将在近期开放。`hb-sdk dev` 可临时补齐普通网络和 Companion 的批准缺口，但不能补齐官方域名，调试台会持续提示发布后不可用。完整配置、本地调试边界和 0.8/0.9 迁移规则见[权限声明](https://docs.xiaoheihe.cn/hb_sdk/guide/permissions)。
+使用受保护能力前，需要在项目根 `package.json#heybox.permissions` 中显式声明。`auth.login()` 和 `user.getInfo()` 都只需要 `userInfo`，不依赖公开 `network` 权限；`network` 仅约束 `network.request()` 与 `network.download()`，线上使用仍需平台批准。`network` 和 `companion` 可在开放平台“小程序管理 → 权限申请”中提交申请，开发者不能申请访问官方域名。`hb-sdk dev` 可临时补齐普通网络和 Companion 的批准缺口，但不能补齐官方域名，调试台会持续提示发布后不可用。完整配置、本地调试边界和 0.8/0.9 迁移规则见[权限声明](https://docs.xiaoheihe.cn/hb_sdk/guide/permissions)。
 
 需要可信用户手势的按钮不能在点击回调里等待握手。页面加载时先用 `getHandshakeState()` 读取当前状态，再用 `onHandshakeStateChange()` 订阅并立即接收当前状态；仅在 `status === 'ready'` 时启用按钮，并在组件或页面销毁时调用订阅返回的取消函数。`ready` 生命周期事件只是握手成功瞬间派发、不会重放的边沿通知，不能用来判断当前状态。
 
@@ -226,7 +226,7 @@ console.log(await downloaded.readText());
 
 真实 PC 的本地临时 Companion 还要求 Host 支持私有 local-dev lease；该 lease 由 Host 原子记录 prepare、Session 与进程树 provenance，并在 H5/CLI 失联后自行清理。缺少该 capability 的旧 PC Host 会安全拒绝真实临时 Companion，Browser Fake 和普通 network 调试仍可用。
 
-`companion` 允许获平台批准的小程序携带固定的桌面程序 ZIP，并在新 PC Host 中显式准备和启动。该权限当前尚未开放，开发者申请入口将在近期开放；入口开放并取得批准前，线上与生产环境不可用。`hb-sdk dev` 的真实 PC 联调可使用 `package.json#heybox.companions` 声明的本地产物，无需先上传或获得线上平台批准，但仍须登录、绑定、校验启动票与产物摘要，并在每次启动确认临时权限。
+`companion` 允许获平台批准的小程序携带固定的桌面程序 ZIP，并在新 PC Host 中显式准备和启动。该权限需在开放平台提交申请，取得平台批准后才能在线上与生产环境使用。`hb-sdk dev` 的真实 PC 联调可使用 `package.json#heybox.companions` 声明的本地产物，无需先上传或获得线上平台批准，但仍须登录、绑定、校验启动票与产物摘要，并在每次启动确认临时权限。
 开发者只能使用 canonical Manifest 中的 alias、target、固定入口和固定参数；SDK 不提供真实下载 URL、本机路径、
 PID、动态 args、cwd、环境变量、shell 或任意命令执行。
 
@@ -393,6 +393,14 @@ const launchData = hbSDK.share.getExtra();
 
 该目标无需权限声明或可信用户手势，只接受目标 `miniProgramId` 和可选 `extra`；不能指定版本、URL、scheme 或窗口样式。生产 Host 只解析当前用户可访问的公开发布版本，预览与本地开发目标仅由 Dev Host 提供。`extra` 不会继承源小程序当前的启动数据，省略时目标读取到 `undefined`，显式传 `null` 时读取到 `null`。调用成功只表示 Host 已接受开窗请求，不等待目标加载或 SDK 握手。
 
+支持方向控制的 Host 会在打开目标前先把当前容器恢复为竖屏、非全屏，等待宿主确认后再开窗，避免当前容器仍锁定横屏时展示新容器出现方向冲突。恢复会发出 `display_change`（`source: 'api'`）；恢复失败时不会打开目标，`openAppPage` 返回方向设置的错误码（如 `ORIENTATION_TIMEOUT`）。返回当前小程序后不会自动回到原方向，需要横屏的页面应在 `show` 事件中重新设置：
+
+```ts
+hbSDK.on('show', () => {
+  void hbSDK.viewport.setDisplay({ orientation: 'landscape' });
+});
+```
+
 ## 分享扩展数据
 
 `share.showShareMenu()` 的落地页固定为当前小程序的 `common_share`，不接受自定义 `url`。分享和复制链接可以携带小程序自行定义的页面状态：
@@ -469,7 +477,7 @@ CLI 会复用已验证产物、跳过该 ZIP 的网络上传；Web 文件及发
 
 右上角的桌面图标与二维码按钮使用相同样式。桌面图标只在该项目于 `package.json#heybox.platforms` 声明了桌面平台（`windows`、`macos` 或 `linux`）时展示，未声明桌面平台的项目不显示该入口。点击桌面图标后选择小黑盒正式版或 Debug 版，选择会立即请求客户端打开当前本地页面并在本地记忆，不需要二次确认。桌面端只接受无凭据的 `http://127.0.0.1:<port>`，拒绝 `localhost`、IPv6 和 LAN 地址，不提供地址选择或手工 URL；手机二维码继续独立选择局域网地址。入口在项目已绑定且本地调试启动票有效时可用，统一 URI 只携带 `mini_program_id` 和 `mini_url`，启动票继续由 detail 从同源 `launch.json` 发现并交给后端验证。浏览器无法确认客户端是否真正打开，因此调试台只记录“已请求打开”，不会自动切换正式版或 Debug 版。
 
-`hb-sdk dev` 在未登录、未绑定或远端不可用时仍启动 Browser Mock；真实手机/PC 入口须有有效启动票。CLI 自动从本地声明生成普通 `network` / `companion` 的临时批准缺口，不提供第二套权限开关或申请按钮。真实 Host 每次打开会话确认临时权限，拒绝后仍可按线上批准基线打开；官方域名始终只认声明与线上批准的交集。真机 Dev Session 的公开 `network.request()` 通过开发机的 HTTP 代理转发，因此 HTTPS `localhost` 指向开发机；代理不管理独立租约，不判断黑盒域名或改写应用层凭据。正式版本和 Runtime 私有请求仍走 Host 网络。CLI 连续失联约 30 秒、期限或快照变化会销毁旧 Runtime，并清理临时 Companion 进程树；恢复后重新确认。手机验收统一从右上角二维码进入并选择可达的局域网网卡。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
+`hb-sdk dev` 在未登录、未绑定或远端不可用时仍启动 Browser Mock；真实手机/PC 入口须有有效启动票。CLI 自动从本地声明生成普通 `network` / `companion` 的临时批准缺口，不提供第二套权限开关。调试台顶部的“查看全部权限申请”在新标签页打开当前小程序的权限列表；尚未获批的 Network、Companion 单项提供“去申请”，直接打开对应申请表单。未获取到小程序 ID 时先选择小程序，再进入对应权限；已获批或审核中的权限不重复打开申请表单。真实 Host 每次打开会话确认临时权限，拒绝后仍可按线上批准基线打开；官方域名始终只认声明与线上批准的交集。真机 Dev Session 的公开 `network.request()` 通过开发机的 HTTP 代理转发，因此 HTTPS `localhost` 指向开发机；代理不管理独立租约，不判断黑盒域名或改写应用层凭据。正式版本和 Runtime 私有请求仍走 Host 网络。CLI 连续失联约 30 秒、期限或快照变化会销毁旧 Runtime，并清理临时 Companion 进程树；恢复后重新确认。手机验收统一从右上角二维码进入并选择可达的局域网网卡。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
 
 远端提交前需要完成 CLI 登录和小程序绑定。完整的登录、绑定、预览、版本与发布流程见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)。
 
@@ -489,3 +497,7 @@ Host/Runtime 集成维护者请先阅读 [`@heybox/hb-sdk-runtime` README](../hb
 ## 版本名称与图片（0.8.2）
 
 在 `package.json#heybox` 配置 `name`、`icon`、`coverImages`。图片为项目内文件，icon 200×200、封面 1–5 张，单张不超过 10 MiB 和 4000 万像素。构建原样复制到版本产物，发布时才更新线上资料。全缺失配置可通过 bind/dev/deploy 从当前正式发布快照自动迁移；离线 build 不迁移。详见[版本资料与迁移指南](https://docs.xiaoheihe.cn/hb_sdk/guide/version-profile)。
+
+### 终端权限申请
+
+绑定小程序后，可用 `hb-sdk remote permission list` 查看平台状态和最近申请；使用 `hb-sdk remote permission apply network --reason "访问业务接口" --domains "api.example.com"` 或 `hb-sdk remote permission apply companion --reason "运行桌面辅助应用"` 提交申请。两种命令均支持 `--json`，无需上传版本；获批后仍需声明 Manifest 权限。

package/dist/cli-chunks/{build-CSdIuQth.cjs → build-DqZ4DwUv.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-0o7PQmxU.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-B_poIoGP.cjs');
 require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-CYkuG3Yw.cjs');
-var index = require('./index-CrAaRBIJ.cjs');
-var projectVite = require('./project-vite-CreFoZsj.cjs');
-require('./version-CeVbqw15.cjs');
+var runtimeGate = require('./runtime-gate-uTsNPu3U.cjs');
+var index = require('./index-CUebAm7J.cjs');
+var projectVite = require('./project-vite-CzIodp6y.cjs');
+require('./version-CNYpJdS7.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-aw5O_ItL.cjs → context-D_VhP5QF.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-0o7PQmxU.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-B_poIoGP.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var session = require('./session-eQw7J8qc.cjs');
+var session = require('./session-DDNple9k.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);
@@ -426,6 +426,8 @@ function isPlainRecord(value) {
 
 function createRemoteApiClient(options) {
     return {
+        listPermissionApplications: (request) => remoteGet(runtimePermissionEnv.LIST_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH, request, options),
+        submitPermissionApplication: (request) => remotePostForm(runtimePermissionEnv.SUBMIT_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH, request, options),
         listDeveloperEntities: () => listDeveloperEntities(options),
         switchDeveloperEntity: (requestOptions) => switchDeveloperEntity(requestOptions, options),
         getDeveloperAccessStatus: () => getDeveloperAccessStatus(options),

package/dist/cli-chunks/{create-B-uOJ6jo.cjs → create-xNSgjouq.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CrAaRBIJ.cjs');
+var index = require('./index-CUebAm7J.cjs');
 require('node:module');
 require('os');
 require('node:crypto');

package/dist/cli-chunks/{dev-CdQFaqsM.cjs → dev-IsUsrbjC.cjs}

@@ -1,9 +1,10 @@
 'use strict';
 
-var context = require('./context-aw5O_ItL.cjs');
+var session = require('./session-DDNple9k.cjs');
+var context = require('./context-D_VhP5QF.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-0o7PQmxU.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-B_poIoGP.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -12,13 +13,12 @@ var node_http = require('node:http');
 var node_module = require('node:module');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-CrAaRBIJ.cjs');
+var index = require('./index-CUebAm7J.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-eQw7J8qc.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-CreFoZsj.cjs');
-var version = require('./version-CeVbqw15.cjs');
+var projectVite = require('./project-vite-CzIodp6y.cjs');
+var version = require('./version-CNYpJdS7.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1993,8 +1993,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CdQFaqsM.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CdQFaqsM.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-IsUsrbjC.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-IsUsrbjC.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -2019,6 +2019,7 @@ async function startBrowserDevHostServer(options) {
         ? mobileLaunchRedirectRegistry.register(initialMobileLaunch.payload, initialMobileLaunch.addressId)
         : undefined;
     const bootstrap = {
+        openPlatformBaseUrl: options.openPlatformBaseUrl,
         csrfToken: sessionController.csrfToken,
         defaultLanAddressId: options.defaultLanAddressId,
         devContext: options.devContext,
@@ -11089,7 +11090,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-CYmCravp.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-Bj9uKrhv.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15765,6 +15766,7 @@ async function runDevCommand(options, runtime = {}) {
     let browserDevHost;
     try {
         browserDevHost = await runDevStartupTask(logger, '正在启动浏览器调试页服务', () => startBrowserDevHostServer({
+            openPlatformBaseUrl: session.resolveHeyboxOpenPlatformBaseUrl(runtime.env),
             appUrl,
             devContext: currentDevContext,
             fetchImpl,
@@ -15984,8 +15986,6 @@ async function loadDevLaunchContext(options) {
     // 声明错误始终阻断；远端不可用只影响真实 Host。
     const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(options.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
     const platforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(options.projectRoot);
-    if (!localPermissions.declared)
-        options.logger.warn(runtimePermissionEnv.getMissingPermissionsWarning());
     const anonymous = (warning) => ({ context: { source: 'anonymous', warning,
             declaredPermissions: localPermissions.permissions ?? {}, platforms,
             runtimePermissions: runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, undefined).runtimePermissions }, miniProgram: null });

package/dist/cli-chunks/{doctor-D7wAhL_F.cjs → doctor-BD-IXRyP.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-CrAaRBIJ.cjs');
+var index = require('./index-CUebAm7J.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-CrAaRBIJ.cjs → index-CUebAm7J.cjs}

@@ -235,19 +235,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CrAaRBIJ.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CUebAm7J.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CrAaRBIJ.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CUebAm7J.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CrAaRBIJ.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CUebAm7J.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CrAaRBIJ.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CUebAm7J.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CrAaRBIJ.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CUebAm7J.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13554,7 +13554,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.9.0-alpha.9';
+const BUILT_CLI_VERSION = '0.9.1-alpha.0';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13750,6 +13750,15 @@ function installRemoteCommands(program, handlers, resolveLogger) {
         miniProgramId: readStringArgument(miniProgramId, 'mini-program-id'),
     })));
     addRemotePublicOptions(remote.command('info').description('查看当前绑定的远程工坊小程序详情')).action(createRemoteAction(handlers, resolveLogger, 'info'));
+    const permission = addRemotePublicOptions(remote.command('permission').description('申请平台权限并查看审核状态'));
+    addRemotePublicOptions(permission.command('list').description('查看平台权限及最近申请状态')).action(createRemoteAction(handlers, resolveLogger, 'permission:list'));
+    addRemotePublicOptions(permission.command('apply').description('提交平台权限申请')
+        .argument('<key>', 'network 或 companion')
+        .requiredOption('--reason <text>', '申请理由，不超过 500 字')
+        .option('--domains <domains>', 'network 访问域名，多个用逗号分隔')).action(createRemoteAction(handlers, resolveLogger, 'permission:apply', (command, key) => {
+        const options = readCommandOptionsWithAncestors(command);
+        return { key: readStringArgument(key, 'key'), reason: readStringOption(options.reason), domains: readStringOption(options.domains) };
+    }));
     const allowlist = addRemotePublicOptions(remote.command('allowlist').description('管理当前绑定小程序的预览白名单'));
     addRemotePublicOptions(allowlist.command('list').description('查看预览白名单')).action(createRemoteAction(handlers, resolveLogger, 'allowlist:list'));
     addRemotePublicOptions(allowlist.command('add').description('添加预览白名单 Heybox ID').argument('<heybox-id...>', 'Heybox ID')).action(createRemoteAction(handlers, resolveLogger, 'allowlist:add', (_command, heyboxIds) => ({
@@ -13913,39 +13922,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-D80S50rt.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-D8GoAMYG.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-D80S50rt.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-D8GoAMYG.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-D80S50rt.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-D8GoAMYG.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CSdIuQth.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-DqZ4DwUv.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-B-uOJ6jo.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-xNSgjouq.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CdQFaqsM.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-IsUsrbjC.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-D7wAhL_F.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BD-IXRyP.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-j4vNU7Hh.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DZK8UAXb.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-CgYQrPWf.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-nQq3nAUy.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-D-4qn-PG.cjs → index-HUjK7vn8.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-CrAaRBIJ.cjs');
+var index$2 = require('./index-CUebAm7J.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-0o7PQmxU.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-B_poIoGP.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index.esm-CYmCravp.cjs → index.esm-Bj9uKrhv.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-CrAaRBIJ.cjs');
-var dev = require('./dev-CdQFaqsM.cjs');
+var index = require('./index-CUebAm7J.cjs');
+var dev = require('./dev-IsUsrbjC.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -23,14 +23,14 @@ require('node:crypto');
 require('readline');
 require('tty');
 require('assert');
-require('./context-aw5O_ItL.cjs');
-require('./runtime-permission-env-0o7PQmxU.cjs');
-require('./version-CeVbqw15.cjs');
-require('node:async_hooks');
-require('sharp');
-require('./session-eQw7J8qc.cjs');
+require('./session-DDNple9k.cjs');
 require('fs');
 require('constants');
+require('./context-D_VhP5QF.cjs');
+require('./runtime-permission-env-B_poIoGP.cjs');
+require('./version-CNYpJdS7.cjs');
+require('node:async_hooks');
+require('sharp');
 require('node:os');
 require('node:net');
 require('node:dns/promises');
@@ -42,7 +42,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-CreFoZsj.cjs');
+require('./project-vite-CzIodp6y.cjs');
 require('node:zlib');
 
 var bufferUtil = {exports: {}};

package/dist/cli-chunks/{login-D80S50rt.cjs → login-D8GoAMYG.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-eQw7J8qc.cjs');
+var session = require('./session-DDNple9k.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CrAaRBIJ.cjs');
+var index = require('./index-CUebAm7J.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-CreFoZsj.cjs → project-vite-CzIodp6y.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-CrAaRBIJ.cjs');
+var index = require('./index-CUebAm7J.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-CgYQrPWf.cjs → remote-nQq3nAUy.cjs}

@@ -1,18 +1,18 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-0o7PQmxU.cjs');
-var context = require('./context-aw5O_ItL.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-B_poIoGP.cjs');
+var context = require('./context-D_VhP5QF.cjs');
 var promises = require('node:readline/promises');
-var index = require('./index-CrAaRBIJ.cjs');
-var session = require('./session-eQw7J8qc.cjs');
+var index = require('./index-CUebAm7J.cjs');
+var session = require('./session-DDNple9k.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
 var node_crypto = require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-CYkuG3Yw.cjs');
-require('./version-CeVbqw15.cjs');
+var runtimeGate = require('./runtime-gate-uTsNPu3U.cjs');
+require('./version-CNYpJdS7.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:module');
@@ -318,7 +318,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-D-4qn-PG.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-HUjK7vn8.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -1121,6 +1121,10 @@ async function runRemoteCommand(options, runtime = {}) {
     }
     const context = await createRemoteCommandContext(options, runtime);
     switch (options.command) {
+        case 'permission:list':
+            return remotePermissionList(options, context, runtime);
+        case 'permission:apply':
+            return remotePermissionApply(options, context, runtime);
         case 'access':
             return remoteAccess(options, context, runtime);
         case 'entity:list':
@@ -1227,6 +1231,8 @@ async function createRemoteCommandContext(options, runtime) {
 }
 function adaptRemoteApiClient(api) {
     return {
+        listPermissionApplications: (miniProgramId) => api.listPermissionApplications({ mini_program_id: miniProgramId }),
+        submitPermissionApplication: ({ miniProgramId, key, reason, domains }) => api.submitPermissionApplication({ mini_program_id: miniProgramId, permission_key: key, reason, domains }),
         accessStatus: () => api.getDeveloperAccessStatus(),
         listMiniPrograms: ({ keyword, limit = 200, offset = 0, status }) => api.listUserMiniprograms({ keyword, status, offset, limit }),
         createMiniProgram: () => api.createUserMiniprogram(),
@@ -1446,6 +1452,47 @@ async function remoteAllowlistWrite(options, context, runtime) {
     }
     return finishRemoteCommand(options, runtime, output);
 }
+async function remotePermissionList(options, context, runtime) {
+    const miniProgramId = requireBinding(context);
+    const result = await context.api.listPermissionApplications(miniProgramId);
+    if (!options.json) {
+        for (const item of result.items) {
+            const application = item.latest_application;
+            const approval = result.runtime_permissions?.entries?.find(entry => entry.key === item.permission_key);
+            context.logger.info(`${item.permission_key} (${item.permission_name})  平台状态=${approval?.status ?? 'disabled'}  最近申请=${application?.status ?? '未申请'}`);
+            if (application?.application_id)
+                context.logger.info(`申请 ID：${application.application_id}`);
+            if (application?.review_remark)
+                context.logger.info(`审核意见：${application.review_remark}`);
+        }
+    }
+    return finishRemoteCommand(options, runtime, { changed: false, miniProgramId, items: toCamelCaseDeep(result.items), runtimePermissions: toCamelCaseDeep(result.runtime_permissions) });
+}
+async function remotePermissionApply(options, context, runtime) {
+    const miniProgramId = requireBinding(context);
+    const key = requireNonEmpty(options.key, '请指定申请权限 network 或 companion');
+    if (key !== 'network' && key !== 'companion')
+        throw new Error('仅支持申请 network 或 companion 权限');
+    const reason = requireNonEmpty(options.reason, '权限申请必须传 --reason');
+    if (Array.from(reason).length > 500)
+        throw new Error('申请理由不能超过 500 字');
+    let domains;
+    if (key === 'network') {
+        const values = [...new Set(requireNonEmpty(options.domains, 'network 申请必须传 --domains，多个域名用逗号分隔').split(',').map(value => value.trim()).filter(Boolean))];
+        if (!values.length || values.length > 20)
+            throw new Error('请填写 1 至 20 个访问域名');
+        if (values.some(value => /[\s/:?#@*\\]/.test(value)))
+            throw new Error('请填写域名，不含协议、端口、路径或通配符');
+        domains = values.join(',');
+    }
+    await assertBoundMiniProgramEntityMatchesCurrent(context, miniProgramId);
+    const application = await context.api.submitPermissionApplication({ miniProgramId, key, reason, domains });
+    if (!options.json) {
+        context.logger.success(`权限申请已受理：${application.application_id}（${application.status}）`);
+        context.logger.info('使用 hb-sdk remote permission list 查看审核状态；平台批准后仍需在 Manifest 中声明权限。');
+    }
+    return finishRemoteCommand(options, runtime, { miniProgramId, application: toCamelCaseDeep(application) });
+}
 async function remoteLeaderboardCreate(options, context, runtime) {
     const miniProgramId = requireBinding(context);
     const order = requireNonEmpty(options.order, 'remote cloud leaderboard create 必须传 --order asc|desc');

package/dist/cli-chunks/{runtime-gate-CYkuG3Yw.cjs → runtime-gate-uTsNPu3U.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-0o7PQmxU.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-B_poIoGP.cjs');
 
 // Shorthands
 /**

package/dist/cli-chunks/{runtime-permission-env-0o7PQmxU.cjs → runtime-permission-env-B_poIoGP.cjs}

@@ -2,7 +2,7 @@
 
 var fs = require('node:fs');
 var path = require('node:path');
-var version = require('./version-CeVbqw15.cjs');
+var version = require('./version-CNYpJdS7.cjs');
 require('node:crypto');
 var node_async_hooks = require('node:async_hooks');
 
@@ -3447,9 +3447,6 @@ function requiresExplicitPermissions(sdkVersion) {
         throw new Error(`sdkVersion 必须是合法 SemVer：${sdkVersion}`);
     return parsed.major > 0 || parsed.minor >= 9;
 }
-function getMissingPermissionsWarning(sourceLabel = 'package.json#heybox.permissions') {
-    return `${sourceLabel} 尚未声明。当前按 0.8 兼容行为构建；0.9.0 起将拒绝构建，请尽快补充权限声明（无权限需求时配置 {}）。`;
-}
 function composeMiniappRuntimePermissions(local, approvals) {
     const parsedApprovals = parseMiniProgramRuntimePermissions(approvals);
     const approvalRevision = isRecord$3(approvals) && Number.isInteger(approvals.revision) ? approvals.revision : undefined;
@@ -12711,6 +12708,10 @@ function compareBytes(left, right) {
     }
     return left.length - right.length;
 }
+/** 查询平台权限目录和最近申请。 */
+const LIST_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH = '/mall/developer/user_miniprogram/runtime_permission/application_list';
+/** 提交不绑定版本的平台权限申请。 */
+const SUBMIT_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH = '/mall/developer/user_miniprogram/runtime_permission/application_submit';
 
 function findNearestPackageJsonPath(startDir) {
     let current = path.resolve(startDir);
@@ -12889,6 +12890,7 @@ exports.DEVELOPER_ENTITY_LIST_API_PATH = DEVELOPER_ENTITY_LIST_API_PATH;
 exports.DEVELOPER_ENTITY_SWITCH_API_PATH = DEVELOPER_ENTITY_SWITCH_API_PATH;
 exports.LIST_USER_MINIPROGRAM_API_PATH = LIST_USER_MINIPROGRAM_API_PATH;
 exports.LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH = LIST_USER_MINIPROGRAM_LEADERBOARD_API_PATH;
+exports.LIST_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH = LIST_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH;
 exports.LIST_USER_MINIPROGRAM_VERSION_API_PATH = LIST_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.MINIAPP_UPLOAD_BATCH_SIZE = MINIAPP_UPLOAD_BATCH_SIZE;
 exports.MINIAPP_UPLOAD_SCOPE = MINIAPP_UPLOAD_SCOPE;
@@ -12898,6 +12900,7 @@ exports.Parser = Parser;
 exports.RELEASE_USER_MINIPROGRAM_VERSION_API_PATH = RELEASE_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.REOPEN_USER_MINIPROGRAM_API_PATH = REOPEN_USER_MINIPROGRAM_API_PATH;
 exports.SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH = SUBMIT_USER_MINIPROGRAM_AUDIT_API_PATH;
+exports.SUBMIT_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH = SUBMIT_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH;
 exports.TAKE_DOWN_USER_MINIPROGRAM_API_PATH = TAKE_DOWN_USER_MINIPROGRAM_API_PATH;
 exports.UPDATE_SQUARE_DISPLAY_API_PATH = UPDATE_SQUARE_DISPLAY_API_PATH;
 exports.UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH = UPDATE_USER_MINIPROGRAM_PREVIEW_ALLOWLIST_API_PATH;
@@ -12913,7 +12916,6 @@ exports.createMiniProgramLocalDevGrant = createMiniProgramLocalDevGrant;
 exports.createMiniappArtifactFileHeader = createMiniappArtifactFileHeader;
 exports.createMiniappArtifactSignatureHeader = createMiniappArtifactSignatureHeader;
 exports.createMiniappPlatformCspEnv = createMiniappPlatformCspEnv;
-exports.getMissingPermissionsWarning = getMissingPermissionsWarning;
 exports.hasMiniappDesktopPlatform = hasMiniappDesktopPlatform;
 exports.isValidMiniappManifestVersion = isValidMiniappManifestVersion;
 exports.normalizeBasicInfoName = normalizeBasicInfoName;