@heybox/hb-sdk 0.9.1-alpha.3 → 0.9.1-alpha.5

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.1-alpha.5
+
+- 工作区卡片 Controller v2 支持在本地开发入口调试，并校验控制器依赖、权限及卡片参数。
+- 旧 Host 不支持工作区卡片时，能力错误保留原始错误数据和原因，便于诊断。
+
+## 0.9.1-alpha.4 - 2026-10-14
+
+### 新增能力
+
+- 预留 `hbSDK.device.executeProtocol()`（暂不对外开放）：在获得平台批准的 `appProtocol` 权限后执行任意小黑盒协议，支持完整协议字符串与 JSON 协议对象；返回 `Promise<void>`，成功只表示已投递，不转发协议业务返回值或回调。
+- 预留最高危险等级权限 `appProtocol`（暂不对外开放，不提供开发者申请入口）：批准后该入口可执行任意协议，并绕过其他 SDK 能力权限及其专用授权流程；该总授权只作用于 `device.executeProtocol()`，其他 SDK 方法仍执行各自权限与授权规则。
+- `hb-sdk dev` 支持为已声明但未获线上批准的 `appProtocol` 生成当前 Dev Session 的本地临时授权；浏览器调试台记录协议类型并以 Mock 投递成功，不模拟真实协议效果。
+
+### 问题修复
+
+- 协议执行收到取消后停止尚未投递的后续动作；调用超时或 SDK 销毁时通知 Host 取消，已投递的系统动作不会撤销。
+- 协议对象中的函数、Symbol 等无法发送的参数统一返回 `INVALID_PARAMS`，保留原始原因供排查。
+
+### 文档与工具
+
+- 权限指南、API Reference、CLI 调试说明与 `hb-sdk remote permission apply` 同步 `appProtocol` 与 `device.executeProtocol`。
+
 ## 0.9.1-alpha.3 - 2026-10-14
 
 ### 问题修复
@@ -135,7 +157,7 @@
 
 > 影响级别：常规
 > 开发者动作：升级至 `0.9.0-alpha.0` 并重新运行 `hb-sdk dev`；运行期间在后台调整权限后，请重启 CLI 同步。
-> 兼容范围：公开 SDK API 不变；调整本地真实客户端调试的详情读取与启动票可用条件。
+> 兼容范围：既有公开 SDK API 保持兼容；新增工作区卡片入口，并调整本地真实客户端调试的详情读取与启动票可用条件。
 
 ### 行为调整
 
@@ -148,6 +170,9 @@
 - 修复声明连续变化时，旧详情、产物摘要或启动票覆盖最新调试状态的问题。
 - 修复详情校验失败后仍能通过本地启动入口获取续签票据的问题。
 
+- 新增 `@heybox/hb-sdk/card-controller` 公开入口，用于声明工作区卡片 Controller 和卡片视图。
+- 新增 `workspaceCards.requestRefresh()`、`getLaunchContext()` 和 `onLaunchContextChange()`，用于在支持工作区卡片的桌面 Host 中刷新卡片和读取启动上下文。
+
 ## 0.8.5 - 2026-10-02
 
 > 影响级别：必须操作
@@ -332,7 +357,6 @@
 
 - 补充游戏详情页资源位申请规则、图标制作规范和申请流程说明。
 
-
 ## 0.8.2 - 2026-09-21
 
 > 摘要：版本名称与图片改由项目维护，新增 Steam 账号授权，并调整部署与用户数据边界。
@@ -551,6 +575,7 @@
 
 - 目标平台声明统一迁移到 `package.json#heybox.platforms`；`miniappManifest()` 恢复无参调用，并在构建时将该声明写入 `dist/manifest.json`。
 - `hb-sdk dev`、`hb-sdk build` 和普通 `hb-sdk remote deploy` 会拒绝缺失或非法的平台声明；build/deploy 也会拒绝与项目配置不一致的 Manifest。已有项目升级时需把原 Vite 参数中的 `platforms` 移入 `package.json#heybox`。
+
 ## 0.8.1-alpha.2
 
 - 新增 `environment.getInfo()` 与 `environment.getInfoSync()`，用于读取运行模式、小黑盒 App 版本、canonical 小程序 ID/版本、操作系统和 SDK 版本的冻结快照。

package/README.md

@@ -501,3 +501,14 @@ Host/Runtime 集成维护者请先阅读 [`@heybox/hb-sdk-runtime` README](../hb
 ### 终端权限申请
 
 绑定小程序后，可用 `hb-sdk remote permission list` 查看平台状态和最近申请；使用 `hb-sdk remote permission apply network --reason "访问业务接口" --domains "api.example.com"` 或 `hb-sdk remote permission apply companion --reason "运行桌面辅助应用"` 提交申请。两种命令均支持 `--json`，无需上传版本；获批后仍需声明 Manifest 权限。
+
+### 工作区卡片（开发中）
+
+在支持该能力的 PC 游戏工作区展示小程序概览和操作。项目声明指定一个 Controller 文件；
+Controller 使用 `@heybox/hb-sdk/card-controller` 编写，普通页面使用根 SDK 的 `workspaceCards` 模块。
+浏览器调试页只提供登录、绑定、启动和状态，不渲染卡片，须在真实 PC 验收。
+
+完整配置、三个示例、页面协作、调试发布与排障见 [工作区卡片指南](https://docs.xiaoheihe.cn/hb_sdk/guide/workspace-cards)。
+
+卡片合同只在开发构建时依赖私有 `@ai-desktop/view-contract`，发布 JS 与声明已封装所需代码和类型。
+用户安装 hb-sdk 不需要该私有包；`check:bundled-contract` 阻止未内联引用进入发布制品。

package/dist/card-controller.cjs.js

@@ -0,0 +1,194 @@
+'use strict';
+
+/** 小程序固定受管动作入口。 */
+const WORKSPACE_CARD_COMMANDS = {
+    invoke: 'ai-desktop.heybox-user-miniprogram.workspace-cards.invoke',
+    openMiniProgram: 'ai-desktop.heybox-user-miniprogram.workspace-cards.open-mini-program',
+};
+
+const VIEW_SCHEMA_VERSION = 1;
+function compact(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0));
+}
+function vstack(children, options = {}) {
+  return compact({ type: "vstack", children, ...options });
+}
+function hstack(children, options = {}) {
+  return compact({ type: "hstack", children, ...options });
+}
+function zstack(children, options = {}) {
+  return compact({ type: "zstack", children, ...options });
+}
+function grid(columns, children, options = {}) {
+  return compact({ type: "grid", columns, children, ...options });
+}
+function carousel(id, label, children, options = {}) {
+  return compact({ type: "carousel", id, label, children, ...options });
+}
+function group(children, options = {}) {
+  return compact({ type: "group", children, ...options });
+}
+function spacer(options = {}) {
+  return compact({ type: "spacer", ...options });
+}
+function text(value, options = {}) {
+  return compact({ type: "text", value, ...options });
+}
+function image(src, options = {}) {
+  return compact({ type: "image", src, ...options });
+}
+function icon(name, options = {}) {
+  return compact({ type: "icon", name, ...options });
+}
+function fields(items, options = {}) {
+  return compact({ type: "fields", items, ...options });
+}
+function list(items, options = {}) {
+  return compact({ type: "list", items, ...options });
+}
+function badge(value, options = {}) {
+  return compact({ type: "badge", text: value, ...options });
+}
+function divider(options = {}) {
+  return compact({ type: "divider", ...options });
+}
+function button(value, options = {}) {
+  return compact({ type: "button", text: value, ...options });
+}
+function tabs(id, items, options = {}) {
+  return compact({ type: "tabs", id, items, ...options });
+}
+function textField(id, label, options = {}) {
+  return compact({ type: "textField", id, label, ...options });
+}
+function toggle(id, label, checked, options = {}) {
+  return compact({ type: "switch", id, label, checked, ...options });
+}
+function expandable(id, children, options) {
+  return { type: "expandable", id, children, ...options };
+}
+function renderer(id, rendererViewId, options = {}) {
+  return compact({ type: "renderer", id, rendererViewId, ...options });
+}
+function frame(id, frameId, options = {}) {
+  return compact({ type: "frame", id, frameId, ...options });
+}
+function meter(value, options = {}) {
+  return compact({ type: "meter", value, ...options });
+}
+function radialProgress(value, label, options = {}) {
+  return compact({ type: "radialProgress", value, label, ...options });
+}
+function barChart(label, items, options = {}) {
+  return compact({ type: "barChart", label, items, ...options });
+}
+function region(id, status, nodes = [], options = {}) {
+  return compact({ id, status, nodes, ...options });
+}
+function viewDocument(regions, options = {}) {
+  return compact({ schema: VIEW_SCHEMA_VERSION, regions: [...regions], ...options });
+}
+
+function defineCard(definition) { return definition; }
+const actionInput = {
+    string: (options = {}) => ({ type: 'string', ...options }),
+    number: () => ({ type: 'number' }),
+    boolean: () => ({ type: 'boolean' }),
+    array: (items, options = {}) => ({ type: 'array', items, ...options }),
+    object: (properties) => ({
+        type: 'object', properties, required: Object.keys(properties), additionalProperties: false,
+    }),
+};
+function defineAction(definition) {
+    let actionId;
+    const pending = [];
+    const handle = ((input) => {
+        const value = invoke(actionId ?? '__unbound__', input);
+        if (!actionId)
+            pending.push(value);
+        return value;
+    });
+    handle.kind = 'invoke';
+    handle.input = definition.input;
+    handle.run = definition.run;
+    Object.defineProperty(handle, 'bindActionId', { value: (id) => {
+            if (actionId && actionId !== id)
+                throw new Error('Workspace Card action handle 不能绑定多个 ID');
+            actionId = id;
+            for (const value of pending)
+                value.input.actionId = id;
+            pending.length = 0;
+        } });
+    return handle;
+}
+function defineOpenMiniProgramAction(options = {}) {
+    let actionId;
+    const pending = [];
+    const handle = ((input) => {
+        const value = openMiniProgram(actionId ?? '__unbound__', input);
+        if (!actionId)
+            pending.push(value);
+        return value;
+    });
+    handle.kind = 'openMiniProgram';
+    handle.input = options.input;
+    Object.defineProperty(handle, 'bindActionId', { value: (id) => {
+            if (actionId && actionId !== id)
+                throw new Error('Workspace Card action handle 不能绑定多个 ID');
+            actionId = id;
+            for (const value of pending)
+                value.input.actionId = id;
+            pending.length = 0;
+        } });
+    return handle;
+}
+function defineWorkspaceCardsController(controller) {
+    for (const [id, action] of Object.entries(controller.actions ?? {}))
+        action.bindActionId?.(id);
+    return controller;
+}
+/** 定义控制器；构建器和 Host 分别验证静态 action 表。 */
+function defineWorkspaceCardController(controller) { return controller; }
+/** 生成固定受管 invoke 入口；身份由 Host 根据真实卡片绑定。 */
+function invoke(actionId, params) {
+    return { commandId: WORKSPACE_CARD_COMMANDS.invoke, input: { actionId, ...(params === undefined ? {} : { params }) } };
+}
+/** 只允许打开当前小程序。 */
+function openMiniProgram(actionId, params) {
+    return { commandId: WORKSPACE_CARD_COMMANDS.openMiniProgram, input: { actionId, ...(params === undefined ? {} : { params }) } };
+}
+
+exports.actionInput = actionInput;
+exports.badge = badge;
+exports.barChart = barChart;
+exports.button = button;
+exports.carousel = carousel;
+exports.defineAction = defineAction;
+exports.defineCard = defineCard;
+exports.defineOpenMiniProgramAction = defineOpenMiniProgramAction;
+exports.defineWorkspaceCardController = defineWorkspaceCardController;
+exports.defineWorkspaceCardsController = defineWorkspaceCardsController;
+exports.divider = divider;
+exports.expandable = expandable;
+exports.fields = fields;
+exports.frame = frame;
+exports.grid = grid;
+exports.group = group;
+exports.hstack = hstack;
+exports.icon = icon;
+exports.image = image;
+exports.invoke = invoke;
+exports.list = list;
+exports.meter = meter;
+exports.openMiniProgram = openMiniProgram;
+exports.radialProgress = radialProgress;
+exports.region = region;
+exports.renderer = renderer;
+exports.spacer = spacer;
+exports.tabs = tabs;
+exports.text = text;
+exports.textField = textField;
+exports.toggle = toggle;
+exports.viewDocument = viewDocument;
+exports.vstack = vstack;
+exports.zstack = zstack;

package/dist/card-controller.esm.js

@@ -0,0 +1,159 @@
+/** 小程序固定受管动作入口。 */
+const WORKSPACE_CARD_COMMANDS = {
+    invoke: 'ai-desktop.heybox-user-miniprogram.workspace-cards.invoke',
+    openMiniProgram: 'ai-desktop.heybox-user-miniprogram.workspace-cards.open-mini-program',
+};
+
+const VIEW_SCHEMA_VERSION = 1;
+function compact(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0));
+}
+function vstack(children, options = {}) {
+  return compact({ type: "vstack", children, ...options });
+}
+function hstack(children, options = {}) {
+  return compact({ type: "hstack", children, ...options });
+}
+function zstack(children, options = {}) {
+  return compact({ type: "zstack", children, ...options });
+}
+function grid(columns, children, options = {}) {
+  return compact({ type: "grid", columns, children, ...options });
+}
+function carousel(id, label, children, options = {}) {
+  return compact({ type: "carousel", id, label, children, ...options });
+}
+function group(children, options = {}) {
+  return compact({ type: "group", children, ...options });
+}
+function spacer(options = {}) {
+  return compact({ type: "spacer", ...options });
+}
+function text(value, options = {}) {
+  return compact({ type: "text", value, ...options });
+}
+function image(src, options = {}) {
+  return compact({ type: "image", src, ...options });
+}
+function icon(name, options = {}) {
+  return compact({ type: "icon", name, ...options });
+}
+function fields(items, options = {}) {
+  return compact({ type: "fields", items, ...options });
+}
+function list(items, options = {}) {
+  return compact({ type: "list", items, ...options });
+}
+function badge(value, options = {}) {
+  return compact({ type: "badge", text: value, ...options });
+}
+function divider(options = {}) {
+  return compact({ type: "divider", ...options });
+}
+function button(value, options = {}) {
+  return compact({ type: "button", text: value, ...options });
+}
+function tabs(id, items, options = {}) {
+  return compact({ type: "tabs", id, items, ...options });
+}
+function textField(id, label, options = {}) {
+  return compact({ type: "textField", id, label, ...options });
+}
+function toggle(id, label, checked, options = {}) {
+  return compact({ type: "switch", id, label, checked, ...options });
+}
+function expandable(id, children, options) {
+  return { type: "expandable", id, children, ...options };
+}
+function renderer(id, rendererViewId, options = {}) {
+  return compact({ type: "renderer", id, rendererViewId, ...options });
+}
+function frame(id, frameId, options = {}) {
+  return compact({ type: "frame", id, frameId, ...options });
+}
+function meter(value, options = {}) {
+  return compact({ type: "meter", value, ...options });
+}
+function radialProgress(value, label, options = {}) {
+  return compact({ type: "radialProgress", value, label, ...options });
+}
+function barChart(label, items, options = {}) {
+  return compact({ type: "barChart", label, items, ...options });
+}
+function region(id, status, nodes = [], options = {}) {
+  return compact({ id, status, nodes, ...options });
+}
+function viewDocument(regions, options = {}) {
+  return compact({ schema: VIEW_SCHEMA_VERSION, regions: [...regions], ...options });
+}
+
+function defineCard(definition) { return definition; }
+const actionInput = {
+    string: (options = {}) => ({ type: 'string', ...options }),
+    number: () => ({ type: 'number' }),
+    boolean: () => ({ type: 'boolean' }),
+    array: (items, options = {}) => ({ type: 'array', items, ...options }),
+    object: (properties) => ({
+        type: 'object', properties, required: Object.keys(properties), additionalProperties: false,
+    }),
+};
+function defineAction(definition) {
+    let actionId;
+    const pending = [];
+    const handle = ((input) => {
+        const value = invoke(actionId ?? '__unbound__', input);
+        if (!actionId)
+            pending.push(value);
+        return value;
+    });
+    handle.kind = 'invoke';
+    handle.input = definition.input;
+    handle.run = definition.run;
+    Object.defineProperty(handle, 'bindActionId', { value: (id) => {
+            if (actionId && actionId !== id)
+                throw new Error('Workspace Card action handle 不能绑定多个 ID');
+            actionId = id;
+            for (const value of pending)
+                value.input.actionId = id;
+            pending.length = 0;
+        } });
+    return handle;
+}
+function defineOpenMiniProgramAction(options = {}) {
+    let actionId;
+    const pending = [];
+    const handle = ((input) => {
+        const value = openMiniProgram(actionId ?? '__unbound__', input);
+        if (!actionId)
+            pending.push(value);
+        return value;
+    });
+    handle.kind = 'openMiniProgram';
+    handle.input = options.input;
+    Object.defineProperty(handle, 'bindActionId', { value: (id) => {
+            if (actionId && actionId !== id)
+                throw new Error('Workspace Card action handle 不能绑定多个 ID');
+            actionId = id;
+            for (const value of pending)
+                value.input.actionId = id;
+            pending.length = 0;
+        } });
+    return handle;
+}
+function defineWorkspaceCardsController(controller) {
+    for (const [id, action] of Object.entries(controller.actions ?? {}))
+        action.bindActionId?.(id);
+    return controller;
+}
+/** 定义控制器；构建器和 Host 分别验证静态 action 表。 */
+function defineWorkspaceCardController(controller) { return controller; }
+/** 生成固定受管 invoke 入口；身份由 Host 根据真实卡片绑定。 */
+function invoke(actionId, params) {
+    return { commandId: WORKSPACE_CARD_COMMANDS.invoke, input: { actionId, ...(params === undefined ? {} : { params }) } };
+}
+/** 只允许打开当前小程序。 */
+function openMiniProgram(actionId, params) {
+    return { commandId: WORKSPACE_CARD_COMMANDS.openMiniProgram, input: { actionId, ...(params === undefined ? {} : { params }) } };
+}
+
+export { actionInput, badge, barChart, button, carousel, defineAction, defineCard, defineOpenMiniProgramAction, defineWorkspaceCardController, defineWorkspaceCardsController, divider, expandable, fields, frame, grid, group, hstack, icon, image, invoke, list, meter, openMiniProgram, radialProgress, region, renderer, spacer, tabs, text, textField, toggle, viewDocument, vstack, zstack };

package/dist/cli-chunks/{build-CXfLIArV.cjs → build-D91J_GAa.cjs}

@@ -1,19 +1,22 @@
 'use strict';
 
+var runtimeGate = require('./runtime-gate-CfAkz0p-.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-CHeBjX3l.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-L7OfyRcl.cjs');
 require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-C__ySQYU.cjs');
-var index = require('./index-Dexro5MZ.cjs');
-var projectVite = require('./project-vite-7ns71VB6.cjs');
-require('./version-BnnLp_km.cjs');
-require('node:async_hooks');
+var index = require('./index-TQwjvNjL.cjs');
+var projectVite = require('./project-vite-CN6mMjzX.cjs');
 require('node:module');
+require('node:url');
+require('fs');
 require('path');
 require('os');
+require('inspector');
+require('./version-C_NaCZ8O.cjs');
+require('node:async_hooks');
 require('readline');
 require('tty');
 require('assert');
@@ -21,7 +24,6 @@ require('events');
 require('stream');
 require('buffer');
 require('util');
-require('node:url');
 
 function areStringArraysEqual(left, right) {
     return left.length === right.length && left.every((value, index) => value === right[index]);
@@ -103,6 +105,10 @@ async function validateBuildOutput(projectRoot, logger, declaredPlatforms, decla
         logger.warn('dist/manifest.json 包含 BOM，已自动剥离');
     }
     const validated = runtimePermissionEnv.validateMiniappManifestForDeploy(manifest);
+    if (validated.workspaceCards) {
+        runtimeGate.verifyWorkspaceCardsSnapshot({ ...validated, bindAppIds: validated.bindAppIds ?? [], workspaceCards: validated.workspaceCards });
+        runtimeGate.verifyWorkspaceCardArtifacts(distDir, validated.workspaceCards);
+    }
     const { platforms, sdkVersion, version, permissions, window } = validated;
     const bindAppIds = validated.bindAppIds ?? [];
     if (validated.category !== declaredCategory) {

package/dist/cli-chunks/{context-28ngGR4F.cjs → context-Xdd45FFd.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-CHeBjX3l.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-L7OfyRcl.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var session = require('./session-B3q86WA5.cjs');
+var session = require('./session-DZrr6RYK.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);
@@ -345,8 +345,8 @@ function resolveBrowserFakeContext(context, now = Date.now()) {
             runtimePermissions: context.runtimePermissions,
             revision: parsed.grant.revision,
             eligiblePermissionKeys: context.platforms?.some((platform) => ['windows', 'macos', 'linux'].includes(platform))
-                ? ['network', 'companion']
-                : ['network'],
+                ? ['network', 'companion', 'appProtocol']
+                : ['network', 'appProtocol'],
         }),
     };
 }

package/dist/cli-chunks/{create-5YcojPd6.cjs → create-BzpdRC5r.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-Dexro5MZ.cjs');
+var index = require('./index-TQwjvNjL.cjs');
 require('node:module');
 require('os');
 require('node:crypto');

package/dist/cli-chunks/{dev-BeFMlbOR.cjs → dev-C7acO3Kt.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var session = require('./session-B3q86WA5.cjs');
-var context = require('./context-28ngGR4F.cjs');
+var session = require('./session-DZrr6RYK.cjs');
+var context = require('./context-Xdd45FFd.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-CHeBjX3l.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-L7OfyRcl.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -13,12 +13,12 @@ var node_http = require('node:http');
 var node_module = require('node:module');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-Dexro5MZ.cjs');
+var index = require('./index-TQwjvNjL.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-7ns71VB6.cjs');
-var version = require('./version-BnnLp_km.cjs');
+var projectVite = require('./project-vite-CN6mMjzX.cjs');
+var version = require('./version-C_NaCZ8O.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1993,8 +1993,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BeFMlbOR.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BeFMlbOR.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-C7acO3Kt.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-C7acO3Kt.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -2023,10 +2023,12 @@ async function startBrowserDevHostServer(options) {
         csrfToken: sessionController.csrfToken,
         defaultLanAddressId: options.defaultLanAddressId,
         devContext: options.devContext,
+        devSessionId: options.devSessionId,
         lanAddresses: options.lanAddresses ?? [],
         loginAvailable: options.loginService !== undefined,
         miniProgram: options.miniProgram,
         miniProgramSupportsDesktop: options.miniProgramSupportsDesktop,
+        workspaceCardsEnabled: options.workspaceCardsEnabled === true,
         mobileLaunchRedirect: initialMobileLaunchRedirect,
         nativeAppLaunchUnavailableReason: options.nativeAppLaunchUnavailableReason,
         miniProgramManifestAccessToken: options.miniProgramManifestAccessToken,
@@ -2118,6 +2120,8 @@ async function startBrowserDevHostServer(options) {
                 bootstrap.miniProgram = next.miniProgram;
             if (next.miniProgramSupportsDesktop !== undefined)
                 bootstrap.miniProgramSupportsDesktop = next.miniProgramSupportsDesktop;
+            if (next.workspaceCardsEnabled !== undefined)
+                bootstrap.workspaceCardsEnabled = next.workspaceCardsEnabled;
             bootstrapJson = serializeBrowserDevHostBootstrap(bootstrap);
         },
         networkUrls: createBrowserDevHostNetworkUrls({
@@ -11090,7 +11094,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-BjCGi12Z.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-dgqkvowo.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15402,6 +15406,9 @@ function writeResponse(response, status, body) {
     response.end(body === undefined ? '' : JSON.stringify(body));
 }
 
+const WORKSPACE_CARD_LOCAL_DEV_DESCRIPTOR_PATH = '/__hb_sdk__/mini-program/workspace-cards.json';
+const WORKSPACE_CARD_LOCAL_DEV_MANIFEST_TOKEN_HEADER = 'x-hb-sdk-mini-program-manifest-token';
+
 const DEFAULT_APP_PORT = 5173;
 const DEFAULT_BROWSER_DEV_HOST_PORT = 5174;
 const DEFAULT_DEV_CONTEXT_TIMEOUT_MS = 3000;
@@ -15575,6 +15582,7 @@ async function runDevCommand(options, runtime = {}) {
         port: appPort,
     };
     const projectRoot = projectVite.findProjectRoot(runtime.cwd ?? process.cwd());
+    const workspaceCardsDeclared = runtimePermissionEnv.readMiniappWorkspaceCardsFromPackageJson(projectRoot).declaration !== undefined;
     const companionArtifactAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
     const miniProgramManifestAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
     const devSessionId = node_crypto.randomBytes(16).toString('hex');
@@ -15658,7 +15666,7 @@ async function runDevCommand(options, runtime = {}) {
         const grant = runtimePermissionEnv.createMiniProgramLocalDevGrant({ declaredPermissions: currentDevContext.declaredPermissions ?? {},
             runtimePermissions: currentDevContext.runtimePermissions, revision: contextRevision,
             eligiblePermissionKeys: currentCompanionManifestSha256 && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms)
-                ? ['network', 'companion'] : ['network'] });
+                ? ['network', 'companion', 'appProtocol'] : ['network', 'appProtocol'] });
         if (allowedTemporaryKeys)
             grant.entries = grant.entries.filter(entry => allowedTemporaryKeys.has(entry.key));
         const temporaryWarning = grant.entries.map(entry => entry.key).join('、');
@@ -15700,6 +15708,42 @@ async function runDevCommand(options, runtime = {}) {
         readContextPath: () => devContextPath,
     });
     const launchPlugin = createMiniProgramDevLaunchVitePlugin(readLaunchSource, async (request, response) => {
+        if (request.url === WORKSPACE_CARD_LOCAL_DEV_DESCRIPTOR_PATH) {
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            if (request.method !== 'GET' && request.method !== 'HEAD') {
+                response.writeHead(405, { Allow: 'GET, HEAD' }).end();
+                return true;
+            }
+            const remote = request.socket.remoteAddress;
+            const host = request.headers.host ?? '';
+            const token = request.headers[WORKSPACE_CARD_LOCAL_DEV_MANIFEST_TOKEN_HEADER];
+            const candidate = Buffer.alloc(43);
+            if (typeof token === 'string')
+                Buffer.from(token).copy(candidate, 0, 0, candidate.length);
+            const tokenMatches = node_crypto.timingSafeEqual(candidate, Buffer.from(miniProgramManifestAccessToken));
+            if (!tokenMatches || typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token) ||
+                !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(remote ?? '') ||
+                !/^127\.0\.0\.1:\d{1,5}$/.test(host)) {
+                response.writeHead(403).end();
+                return true;
+            }
+            const source = readLaunchSource();
+            if (!source.miniProgramId || !source.localDevLaunchToken || !source.devSessionId || !source.expiresAt) {
+                response.writeHead(503).end();
+                return true;
+            }
+            const body = JSON.stringify({
+                schema_version: 1,
+                mini_program_id: source.miniProgramId,
+                local_dev_launch_token: source.localDevLaunchToken,
+                dev_session_id: source.devSessionId,
+                expires_at_ms: source.expiresAt,
+            });
+            response.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
+            response.end(request.method === 'HEAD' ? undefined : body);
+            return true;
+        }
         if (await networkProxy.handle(request, response))
             return true;
         if (request.url !== MINI_PROGRAM_DEV_LAUNCH_PATH || request.headers[COMPANION_ARTIFACT_ACCESS_TOKEN_HEADER] === undefined)
@@ -15768,6 +15812,7 @@ async function runDevCommand(options, runtime = {}) {
         browserDevHost = await runDevStartupTask(logger, '正在启动浏览器调试页服务', () => startBrowserDevHostServer({
             openPlatformBaseUrl: session.resolveHeyboxOpenPlatformBaseUrl(runtime.env),
             appUrl,
+            devSessionId,
             devContext: currentDevContext,
             fetchImpl,
             getPort: getPortImpl,
@@ -15779,6 +15824,7 @@ async function runDevCommand(options, runtime = {}) {
             miniProgram,
             // 只在项目声明了桌面平台时向调试台暴露「在桌面端打开」入口。
             miniProgramSupportsDesktop: runtimePermissionEnv.hasMiniappDesktopPlatform(miniProgramPlatforms),
+            workspaceCardsEnabled: workspaceCardsDeclared,
             cliAuth: runtime.cliAuth ?? createBrowserDevHostCliAuth({ env: runtime.env, fetchImpl }),
             onMobileDevSessionCreated: ({ devContextUrl, miniUrlOrigin }) => {
                 mobileDevContextUrlsByOrigin.set(miniUrlOrigin, devContextUrl);