@heybox/hb-sdk 0.9.1-alpha.1 → 0.9.1-alpha.10

package/dist/cli-chunks/{context-BkvtRlQM.cjs → context-D7AFyc_9.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-Bg7f-uj8.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DBra_0-U.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var session = require('./session-XP1Y_N72.cjs');
+var index = require('./index-BWRDIX1T.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);
@@ -345,8 +345,8 @@ function resolveBrowserFakeContext(context, now = Date.now()) {
             runtimePermissions: context.runtimePermissions,
             revision: parsed.grant.revision,
             eligiblePermissionKeys: context.platforms?.some((platform) => ['windows', 'macos', 'linux'].includes(platform))
-                ? ['network', 'companion']
-                : ['network'],
+                ? ['network', 'companion', 'appProtocol']
+                : ['network', 'appProtocol'],
         }),
     };
 }
@@ -525,20 +525,20 @@ async function listUserMiniprogramVersions(options, runtime) {
 }
 async function remoteGet(path, query, runtime) {
     const pathWithQuery = createPathWithQuery(path, query);
-    const context = session.createHeyboxOpenPlatformRequestContext(runtime.session, pathWithQuery);
+    const context = index.createHeyboxOpenPlatformRequestContext(runtime.session, pathWithQuery);
     const fetchImpl = runtime.fetchImpl ?? fetch;
-    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, pathWithQuery, context.platformParams), {
+    const response = await fetchImpl(index.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, pathWithQuery, context.platformParams), {
         method: 'GET',
         headers: context.headers,
     });
     return readRequiredResult(response, pathWithQuery);
 }
 async function remotePostForm(path, fields, runtime, options = {}) {
-    const context = session.createHeyboxOpenPlatformRequestContext(runtime.session, path, {
+    const context = index.createHeyboxOpenPlatformRequestContext(runtime.session, path, {
         contentType: 'application/x-www-form-urlencoded',
     });
     const fetchImpl = runtime.fetchImpl ?? fetch;
-    const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
+    const response = await fetchImpl(index.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, path, context.platformParams), {
         method: 'POST',
         headers: context.headers,
         body: createFormBody(fields),
@@ -549,11 +549,11 @@ async function remotePostForm(path, fields, runtime, options = {}) {
     return readRequiredResult(response, path);
 }
 async function readRequiredResult(response, pathWithQuery) {
-    const result = await session.readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: true });
+    const result = await index.readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: true });
     return result;
 }
 async function readOptionalResult(response, pathWithQuery) {
-    return session.readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: false });
+    return index.readHeyboxApiEnvelope(response, { pathWithQuery, requireResult: false });
 }
 function createPathWithQuery(path, query) {
     const params = new URLSearchParams();
@@ -586,16 +586,16 @@ function createFormBody(fields) {
 
 async function resolveRemoteEnvironment(options = {}, runtime = {}) {
     const env = options.env ?? process.env;
-    const apiBaseUrl = session.resolveHeyboxApiBaseUrl({ ...options, env });
-    const loginBaseUrl = session.resolveHeyboxLoginBaseUrl({ ...options, env });
-    const session$1 = options.session ?? (await (runtime.requireAuthSession ?? session.requireHeyboxAuthSession)({ loginBaseUrl }));
+    const apiBaseUrl = index.resolveHeyboxApiBaseUrl({ ...options, env });
+    const loginBaseUrl = index.resolveHeyboxLoginBaseUrl({ ...options, env });
+    const session = options.session ?? (await (runtime.requireAuthSession ?? index.requireHeyboxAuthSession)({ loginBaseUrl }));
     return {
         apiBaseUrl,
         loginBaseUrl,
         allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl === true || isTruthyEnvFlag(env.HB_SDK_ALLOW_UNSAFE_API_BASE_URL),
         env,
         fetchImpl: runtime.fetchImpl ?? options.fetchImpl ?? fetch,
-        session: session$1,
+        session,
     };
 }
 function createRemoteApiClientForEnvironment(environment) {

package/dist/cli-chunks/{create-uHfLV3qo.cjs → create-C-pAXZR_.cjs}

@@ -5,17 +5,19 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-B0eNYO7I.cjs');
+var index = require('./index-BWRDIX1T.cjs');
 require('node:module');
-require('os');
-require('node:crypto');
 require('readline');
+require('os');
 require('tty');
 require('assert');
 require('events');
 require('stream');
 require('buffer');
 require('util');
+require('node:crypto');
+require('constants');
+require('node:zlib');
 
 var ejs = {};
 

package/dist/cli-chunks/{dev-BGgykbLg.cjs → dev-CONKtd6c.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var session = require('./session-XP1Y_N72.cjs');
-var context = require('./context-BkvtRlQM.cjs');
+var index = require('./index-BWRDIX1T.cjs');
+var context = require('./context-D7AFyc_9.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-Bg7f-uj8.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-DBra_0-U.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -13,12 +13,11 @@ var node_http = require('node:http');
 var node_module = require('node:module');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-B0eNYO7I.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-BA_CFVq_.cjs');
-var version = require('./version-rxh3jOOI.cjs');
+var projectVite = require('./project-vite-DD3bmbqm.cjs');
+var version = require('./version-BF4JQQCU.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1993,8 +1992,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BGgykbLg.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BGgykbLg.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CONKtd6c.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CONKtd6c.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -2023,10 +2022,12 @@ async function startBrowserDevHostServer(options) {
         csrfToken: sessionController.csrfToken,
         defaultLanAddressId: options.defaultLanAddressId,
         devContext: options.devContext,
+        devSessionId: options.devSessionId,
         lanAddresses: options.lanAddresses ?? [],
         loginAvailable: options.loginService !== undefined,
         miniProgram: options.miniProgram,
         miniProgramSupportsDesktop: options.miniProgramSupportsDesktop,
+        workspaceCardsEnabled: options.workspaceCardsEnabled === true,
         mobileLaunchRedirect: initialMobileLaunchRedirect,
         nativeAppLaunchUnavailableReason: options.nativeAppLaunchUnavailableReason,
         miniProgramManifestAccessToken: options.miniProgramManifestAccessToken,
@@ -2118,6 +2119,8 @@ async function startBrowserDevHostServer(options) {
                 bootstrap.miniProgram = next.miniProgram;
             if (next.miniProgramSupportsDesktop !== undefined)
                 bootstrap.miniProgramSupportsDesktop = next.miniProgramSupportsDesktop;
+            if (next.workspaceCardsEnabled !== undefined)
+                bootstrap.workspaceCardsEnabled = next.workspaceCardsEnabled;
             bootstrapJson = serializeBrowserDevHostBootstrap(bootstrap);
         },
         networkUrls: createBrowserDevHostNetworkUrls({
@@ -11090,7 +11093,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-I50IudW7.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-CtAKePcf.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -14901,7 +14904,7 @@ function createBrowserDevHostCliAuth(options = {}) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const noRedirectFetch = (input, init) => fetchImpl(input, { ...init, redirect: 'manual' });
     const store = options.store ?? { env: options.env };
-    const readSession = options.readSession ?? (() => session.readHeyboxAuthSession(store));
+    const readSession = options.readSession ?? (() => index.readHeyboxAuthSession(store));
     let lastKey = '';
     let revision = 0;
     let profileKey = '';
@@ -15402,6 +15405,9 @@ function writeResponse(response, status, body) {
     response.end(body === undefined ? '' : JSON.stringify(body));
 }
 
+const WORKSPACE_CARD_LOCAL_DEV_DESCRIPTOR_PATH = '/__hb_sdk__/mini-program/workspace-cards.json';
+const WORKSPACE_CARD_LOCAL_DEV_MANIFEST_TOKEN_HEADER = 'x-hb-sdk-mini-program-manifest-token';
+
 const DEFAULT_APP_PORT = 5173;
 const DEFAULT_BROWSER_DEV_HOST_PORT = 5174;
 const DEFAULT_DEV_CONTEXT_TIMEOUT_MS = 3000;
@@ -15575,6 +15581,7 @@ async function runDevCommand(options, runtime = {}) {
         port: appPort,
     };
     const projectRoot = projectVite.findProjectRoot(runtime.cwd ?? process.cwd());
+    const workspaceCardsDeclared = runtimePermissionEnv.readMiniappWorkspaceCardsFromPackageJson(projectRoot).declaration !== undefined;
     const companionArtifactAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
     const miniProgramManifestAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
     const devSessionId = node_crypto.randomBytes(16).toString('hex');
@@ -15658,7 +15665,7 @@ async function runDevCommand(options, runtime = {}) {
         const grant = runtimePermissionEnv.createMiniProgramLocalDevGrant({ declaredPermissions: currentDevContext.declaredPermissions ?? {},
             runtimePermissions: currentDevContext.runtimePermissions, revision: contextRevision,
             eligiblePermissionKeys: currentCompanionManifestSha256 && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms)
-                ? ['network', 'companion'] : ['network'] });
+                ? ['network', 'companion', 'appProtocol'] : ['network', 'appProtocol'] });
         if (allowedTemporaryKeys)
             grant.entries = grant.entries.filter(entry => allowedTemporaryKeys.has(entry.key));
         const temporaryWarning = grant.entries.map(entry => entry.key).join('、');
@@ -15700,6 +15707,42 @@ async function runDevCommand(options, runtime = {}) {
         readContextPath: () => devContextPath,
     });
     const launchPlugin = createMiniProgramDevLaunchVitePlugin(readLaunchSource, async (request, response) => {
+        if (request.url === WORKSPACE_CARD_LOCAL_DEV_DESCRIPTOR_PATH) {
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            if (request.method !== 'GET' && request.method !== 'HEAD') {
+                response.writeHead(405, { Allow: 'GET, HEAD' }).end();
+                return true;
+            }
+            const remote = request.socket.remoteAddress;
+            const host = request.headers.host ?? '';
+            const token = request.headers[WORKSPACE_CARD_LOCAL_DEV_MANIFEST_TOKEN_HEADER];
+            const candidate = Buffer.alloc(43);
+            if (typeof token === 'string')
+                Buffer.from(token).copy(candidate, 0, 0, candidate.length);
+            const tokenMatches = node_crypto.timingSafeEqual(candidate, Buffer.from(miniProgramManifestAccessToken));
+            if (!tokenMatches || typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token) ||
+                !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(remote ?? '') ||
+                !/^127\.0\.0\.1:\d{1,5}$/.test(host)) {
+                response.writeHead(403).end();
+                return true;
+            }
+            const source = readLaunchSource();
+            if (!source.miniProgramId || !source.localDevLaunchToken || !source.devSessionId || !source.expiresAt) {
+                response.writeHead(503).end();
+                return true;
+            }
+            const body = JSON.stringify({
+                schema_version: 1,
+                mini_program_id: source.miniProgramId,
+                local_dev_launch_token: source.localDevLaunchToken,
+                dev_session_id: source.devSessionId,
+                expires_at_ms: source.expiresAt,
+            });
+            response.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
+            response.end(request.method === 'HEAD' ? undefined : body);
+            return true;
+        }
         if (await networkProxy.handle(request, response))
             return true;
         if (request.url !== MINI_PROGRAM_DEV_LAUNCH_PATH || request.headers[COMPANION_ARTIFACT_ACCESS_TOKEN_HEADER] === undefined)
@@ -15766,8 +15809,9 @@ async function runDevCommand(options, runtime = {}) {
     let browserDevHost;
     try {
         browserDevHost = await runDevStartupTask(logger, '正在启动浏览器调试页服务', () => startBrowserDevHostServer({
-            openPlatformBaseUrl: session.resolveHeyboxOpenPlatformBaseUrl(runtime.env),
+            openPlatformBaseUrl: index.resolveHeyboxOpenPlatformBaseUrl(runtime.env),
             appUrl,
+            devSessionId,
             devContext: currentDevContext,
             fetchImpl,
             getPort: getPortImpl,
@@ -15779,6 +15823,7 @@ async function runDevCommand(options, runtime = {}) {
             miniProgram,
             // 只在项目声明了桌面平台时向调试台暴露「在桌面端打开」入口。
             miniProgramSupportsDesktop: runtimePermissionEnv.hasMiniappDesktopPlatform(miniProgramPlatforms),
+            workspaceCardsEnabled: workspaceCardsDeclared,
             cliAuth: runtime.cliAuth ?? createBrowserDevHostCliAuth({ env: runtime.env, fetchImpl }),
             onMobileDevSessionCreated: ({ devContextUrl, miniUrlOrigin }) => {
                 mobileDevContextUrlsByOrigin.set(miniUrlOrigin, devContextUrl);
@@ -15989,7 +16034,7 @@ async function loadDevLaunchContext(options) {
     const anonymous = (warning) => ({ context: { source: 'anonymous', warning,
             declaredPermissions: localPermissions.permissions ?? {}, platforms,
             runtimePermissions: runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, undefined).runtimePermissions }, miniProgram: null });
-    if (!(await session.readHeyboxAuthSession({ env: options.env })))
+    if (!(await index.readHeyboxAuthSession({ env: options.env })))
         return anonymous('尚未登录 CLI，真实手机和 PC 调试不可用');
     const miniProgramId = await context.readBoundMiniProgramId(options.projectRoot);
     if (!miniProgramId)
@@ -16012,7 +16057,7 @@ async function loadDevLaunchContext(options) {
             options.logger.info('已迁移当前正式发布名称与图片，继续启动开发环境');
         if (!runtimePermissionEnv.parseMiniProgramRuntimePermissions(detail.runtime_permissions).valid)
             return anonymous('线上权限快照无效，真实手机和 PC 调试不可用');
-        const effectivePermissions = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions).runtimePermissions;
+        const effectivePermissions = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions, detail.party_type).runtimePermissions;
         return {
             context: {
                 source: 'remote',

package/dist/cli-chunks/{doctor-Cfn2luVo.cjs → doctor-D18leeH7.cjs}

@@ -3,19 +3,22 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-B0eNYO7I.cjs');
+var index = require('./index-BWRDIX1T.cjs');
 require('node:module');
-require('node:fs');
-require('path');
-require('os');
-require('node:crypto');
 require('readline');
+require('os');
 require('tty');
 require('assert');
 require('events');
 require('stream');
 require('buffer');
 require('util');
+require('node:crypto');
+require('path');
+require('fs');
+require('constants');
+require('node:fs');
+require('node:zlib');
 
 const CANDIDATES = [
     path.resolve(__dirname, '..', 'package.json'),