@heybox/hb-sdk 0.9.1-alpha.6 → 0.9.1-alpha.8

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.1-alpha.8 - 2026-10-16
+
+### 问题修复
+
+- 修复第一方小程序已声明权限在 CLI 查询、本地调试和发布检查中被误判为不可用的问题。
+- 权限查询区分原始审批与有效权限，并展示第一方自动批准来源。
+
+## 0.9.1-alpha.7 - 2026-10-16
+
+### 新增能力
+
+- 新增 `network.upload()`，使用受控文件发送 raw PUT/POST 或 multipart 上传，支持查询参数、请求头、进度、取消与响应状态校验。
+
+### 问题修复
+
+- 文件和目录选择不再受普通请求超时限制，允许用户完成较长时间的系统选择操作。
+- 补充上传、文件系统与下载验收，并按实际平台能力处理大小边界和多选限制。
+
 ## 0.9.1-alpha.6 - 2026-10-15
 
 ### 新增能力

package/README.md

@@ -56,7 +56,7 @@ hb-sdk skill install --all-agents
 
 SDK 会在导入时启动握手，能力调用会自动等待 SDK 就绪。声明 `userInfo` 后，可通过 `user.getInfo()` 读取当前小程序内的隔离身份和已授权资料：
 
-使用受保护能力前，需要在项目根 `package.json#heybox.permissions` 中显式声明。`auth.login()` 和 `user.getInfo()` 都只需要 `userInfo`，不依赖公开 `network` 权限；`network` 仅约束 `network.request()` 与 `network.download()`，线上使用仍需平台批准。`network` 和 `companion` 可在开放平台“小程序管理 → 权限申请”中提交申请，开发者不能申请访问官方域名。`hb-sdk dev` 可临时补齐普通网络和 Companion 的批准缺口，但不能补齐官方域名，调试台会持续提示发布后不可用。完整配置、本地调试边界和 0.8/0.9 迁移规则见[权限声明](https://docs.xiaoheihe.cn/hb_sdk/guide/permissions)。
+使用受保护能力前，需要在项目根 `package.json#heybox.permissions` 中显式声明。`auth.login()` 和 `user.getInfo()` 都只需要 `userInfo`，不依赖公开 `network` 权限；`network` 约束 `network.request()`、`network.download()` 与 `network.upload()`，线上使用仍需平台批准。`network` 和 `companion` 可在开放平台“小程序管理 → 权限申请”中提交申请，开发者不能申请访问官方域名。`hb-sdk dev` 可临时补齐普通网络和 Companion 的批准缺口，但不能补齐官方域名，调试台会持续提示发布后不可用。完整配置、本地调试边界和 0.8/0.9 迁移规则见[权限声明](https://docs.xiaoheihe.cn/hb_sdk/guide/permissions)。
 
 需要可信用户手势的按钮不能在点击回调里等待握手。页面加载时先用 `getHandshakeState()` 读取当前状态，再用 `onHandshakeStateChange()` 订阅并立即接收当前状态；仅在 `status === 'ready'` 时启用按钮，并在组件或页面销毁时调用订阅返回的取消函数。`ready` 生命周期事件只是握手成功瞬间派发、不会重放的边沿通知，不能用来判断当前状态。
 
@@ -181,7 +181,9 @@ console.log(info.sdk.version);
 
 `resizable` 只约束**用户手动拖拽**；**位置不开放**：开发者不能声明或设置窗口位置，位置由用户拖拽产生并由宿主按小程序身份本地记忆。完整语义见[窗口尺寸与可缩放性](https://docs.xiaoheihe.cn/hb_sdk/guide/window-size)。
 
-## 文件与下载
+## 文件与传输
+
+`network.upload()` 接收一个可读 `FileHandle`，由 Host 直接流式上传到开发者指定 URL。raw 支持 PUT（默认）/POST，multipart 固定 POST 并可携带字符串字段；支持进度、取消、空闲超时、可选大小限制和标准 HTTP 响应。文件字节不经过 iframe，上传期间应保持源文件不变；首版不自动重试、分片、续传或复制快照。PC、Android、iOS、OHOS 按真实 Host primitive 启用，旧 Host 明确拒绝。完整示例见[文件能力与沙箱](https://docs.xiaoheihe.cn/hb_sdk/guide/files-and-sandbox)。
 
 `files` 提供当前小程序私有 sandbox 和由用户选择授予的外部 File/Directory；
 `network.download()` 将 GET 响应直接流式写入受控目标，下载字节不经过 iframe bridge。
@@ -215,7 +217,8 @@ console.log(await downloaded.readText());
 不认识新 method 时返回 `METHOD_NOT_FOUND`。
 新 PC 的下载字节留在插件 Node 并直接原子落盘，不提供 Blob 或内存假实现。
 
-外部 picker 必须从可信用户操作触发。`files.saveFile({ suggestedName })` 返回精确 File 授权，
+外部 picker 必须从可信用户操作触发。`files.pickFiles()`、`files.pickDirectory()` 和
+`files.saveFile()` 的选择等待不设固定超时，不受 SDK 普通请求超时配置影响；确认、取消或 SDK / Runtime 会话结束后才结束操作。`files.saveFile({ suggestedName })` 返回精确 File 授权，
 不会额外保留 Directory 授权；新 PC 当前先让用户选择保存目录，再以 `suggestedName` 独占创建空文件，
 同名文件返回 `FILE_ALREADY_EXISTS`。V1 不接受 `accept`，只有 `pickFiles()` 支持扩展名过滤。完整路径、
 创建、存在性和下载语义见[快速开始](https://docs.xiaoheihe.cn/hb_sdk/guide/quick-start#文件与下载)。
@@ -326,7 +329,7 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 | `storage`    | 读写当前小程序的隔离存储                        |
 | `files`      | 声明受控 sandbox 与用户选择授权的文件、目录操作 |
 | `cloud`      | 使用小程序云端排行榜                            |
-| `network`    | 发起经过平台授权的网络请求，并声明受控流式下载  |
+| `network`    | 发起经过平台授权的网络请求及受控文件传输  |
 | `companion`  | 准备、启动并控制当前版本审核过的桌面辅助应用    |
 
 具体方法、参数和返回值以 [API Reference](https://docs.xiaoheihe.cn/hb_sdk/reference/) 为准，常见组合写法见 [Recipes](https://docs.xiaoheihe.cn/hb_sdk/recipes/)。
@@ -500,7 +503,7 @@ Host/Runtime 集成维护者请先阅读 [`@heybox/hb-sdk-runtime` README](../hb
 
 ### 终端权限申请
 
-绑定小程序后，可用 `hb-sdk remote permission list` 查看平台状态和最近申请；使用 `hb-sdk remote permission apply network --reason "访问业务接口" --domains "api.example.com"` 或 `hb-sdk remote permission apply companion --reason "运行桌面辅助应用"` 提交申请。两种命令均支持 `--json`，无需上传版本；获批后仍需声明 Manifest 权限。
+绑定小程序后，可用 `hb-sdk remote permission list` 查看原始审批、本地声明下的有效状态和最近申请；使用 `hb-sdk remote permission apply network --reason "访问业务接口" --domains "api.example.com"` 或 `hb-sdk remote permission apply companion --reason "运行桌面辅助应用"` 提交申请。两种命令均支持 `--json`，无需上传版本；获批后仍需声明 Manifest 权限。第一方已声明的受审批权限自动批准，原始审批为 `disabled` 不表示有效权限被禁用；CLI 会单独标明批准来源。完整语义见[终端权限申请](https://docs.xiaoheihe.cn/hb_sdk/guide/permissions#终端权限申请)。
 
 ### 工作区卡片（开发中）
 

package/dist/cli-chunks/{browser-DUdEZCyq.cjs → browser-YVckob3g.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-J4uQvKT_.cjs');
+var index = require('./index-9trmrUtW.cjs');
 
 async function openExternalUrl(url) {
     try {

package/dist/cli-chunks/{build-DYYWRiaY.cjs → build-CQkpLf81.cjs}

@@ -1,21 +1,21 @@
 'use strict';
 
-var runtimeGate = require('./runtime-gate-DedD3ynE.cjs');
+var runtimeGate = require('./runtime-gate-DmJhPcNQ.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DWaPlchd.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Gy2dH17F.cjs');
 require('node:crypto');
 require('node:zlib');
-var index = require('./index-J4uQvKT_.cjs');
-var projectVite = require('./project-vite-Du1m7Y_3.cjs');
+var index = require('./index-9trmrUtW.cjs');
+var projectVite = require('./project-vite-CXWFwbEz.cjs');
 require('node:module');
 require('node:url');
 require('fs');
 require('path');
 require('os');
 require('inspector');
-require('./version-tzrFwpkl.cjs');
+require('./version-BMp9qmtC.cjs');
 require('node:async_hooks');
 require('constants');
 require('stream');

package/dist/cli-chunks/{context-Bo4L-Cx_.cjs → context-CqJDNtEi.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DWaPlchd.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Gy2dH17F.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var index = require('./index-J4uQvKT_.cjs');
+var index = require('./index-9trmrUtW.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);

package/dist/cli-chunks/{create-CKC4yp0J.cjs → create-BRuR2M7y.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-J4uQvKT_.cjs');
+var index = require('./index-9trmrUtW.cjs');
 require('node:module');
 require('os');
 require('constants');

package/dist/cli-chunks/{dev-BMX6UXUe.cjs → dev-KJAFHEg_.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var index = require('./index-J4uQvKT_.cjs');
-var context = require('./context-Bo4L-Cx_.cjs');
+var index = require('./index-9trmrUtW.cjs');
+var context = require('./context-CqJDNtEi.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-DWaPlchd.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Gy2dH17F.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -15,9 +15,9 @@ var undici = require('undici');
 var fs$1 = require('node:fs/promises');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var browser = require('./browser-DUdEZCyq.cjs');
-var projectVite = require('./project-vite-Du1m7Y_3.cjs');
-var version = require('./version-tzrFwpkl.cjs');
+var browser = require('./browser-YVckob3g.cjs');
+var projectVite = require('./project-vite-CXWFwbEz.cjs');
+var version = require('./version-BMp9qmtC.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1992,8 +1992,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BMX6UXUe.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-BMX6UXUe.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-KJAFHEg_.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-KJAFHEg_.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -11093,7 +11093,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-eNPTDv6W.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-Cv9FlhXy.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -16057,7 +16057,7 @@ async function loadDevLaunchContext(options) {
             options.logger.info('已迁移当前正式发布名称与图片，继续启动开发环境');
         if (!runtimePermissionEnv.parseMiniProgramRuntimePermissions(detail.runtime_permissions).valid)
             return anonymous('线上权限快照无效，真实手机和 PC 调试不可用');
-        const effectivePermissions = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions).runtimePermissions;
+        const effectivePermissions = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions, detail.party_type).runtimePermissions;
         return {
             context: {
                 source: 'remote',

package/dist/cli-chunks/{doctor-DqEYRo4I.cjs → doctor-DhiUViwk.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-J4uQvKT_.cjs');
+var index = require('./index-9trmrUtW.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-J4uQvKT_.cjs → index-9trmrUtW.cjs}

@@ -243,19 +243,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-J4uQvKT_.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-9trmrUtW.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-J4uQvKT_.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-9trmrUtW.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-J4uQvKT_.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-9trmrUtW.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-J4uQvKT_.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-9trmrUtW.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-J4uQvKT_.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-9trmrUtW.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -16872,7 +16872,7 @@ async function defaultBrowser() {
 const execFile = node_util.promisify(childProcess.execFile);
 
 // Path to included `xdg-open`.
-const __dirname$1 = path.dirname(node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-J4uQvKT_.cjs', document.baseURI).href))));
+const __dirname$1 = path.dirname(node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-9trmrUtW.cjs', document.baseURI).href))));
 const localXdgOpenPath = path.join(__dirname$1, 'xdg-open');
 
 const {platform, arch} = process$1;
@@ -17204,7 +17204,7 @@ defineLazyProperty(apps, 'browser', () => 'browser');
 defineLazyProperty(apps, 'browserPrivate', () => 'browserPrivate');
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.9.1-alpha.6';
+const BUILT_CLI_VERSION = '0.9.1-alpha.8';
 const PACKAGE_JSON_CANDIDATES$1 = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -18224,39 +18224,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BL2OE6r9.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-5DEcU9eL.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BL2OE6r9.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-5DEcU9eL.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BL2OE6r9.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-5DEcU9eL.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-DYYWRiaY.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CQkpLf81.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CKC4yp0J.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BRuR2M7y.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-BMX6UXUe.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-KJAFHEg_.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DqEYRo4I.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DhiUViwk.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-D4z_a_BH.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill--mZIZkyn.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-ZHJUtx6l.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-laUZaGpI.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-DmCWB_hF.cjs → index-rxAV5dza.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-J4uQvKT_.cjs');
+var index$2 = require('./index-9trmrUtW.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-DWaPlchd.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Gy2dH17F.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');
@@ -16,7 +16,7 @@ var require$$0$8 = require('stream');
 var require$$0$a = require('zlib');
 var require$$1$3 = require('querystring');
 var require$$0$9 = require('buffer');
-var runtimeGate = require('./runtime-gate-DedD3ynE.cjs');
+var runtimeGate = require('./runtime-gate-DmJhPcNQ.cjs');
 var require$$4$3 = require('tls');
 
 function _mergeNamespaces(n, m) {

package/dist/cli-chunks/{index.esm-eNPTDv6W.cjs → index.esm-Cv9FlhXy.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-J4uQvKT_.cjs');
-var dev = require('./dev-BMX6UXUe.cjs');
+var index = require('./index-9trmrUtW.cjs');
+var dev = require('./dev-KJAFHEg_.cjs');
 require('node:module');
 require('node:fs/promises');
 require('node:path');
@@ -31,17 +31,17 @@ require('node:util');
 require('node:child_process');
 require('node:os');
 require('node:fs');
-require('./context-Bo4L-Cx_.cjs');
-require('./runtime-permission-env-DWaPlchd.cjs');
-require('./version-tzrFwpkl.cjs');
+require('./context-CqJDNtEi.cjs');
+require('./runtime-permission-env-Gy2dH17F.cjs');
+require('./version-BMp9qmtC.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:net');
 require('node:dns/promises');
 require('node:http');
 require('undici');
-require('./browser-DUdEZCyq.cjs');
-require('./project-vite-Du1m7Y_3.cjs');
+require('./browser-YVckob3g.cjs');
+require('./project-vite-CXWFwbEz.cjs');
 require('node:zlib');
 
 var bufferUtil = {exports: {}};

package/dist/cli-chunks/{login-BL2OE6r9.cjs → login-5DEcU9eL.cjs}

@@ -3,8 +3,8 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var index = require('./index-J4uQvKT_.cjs');
-var browser = require('./browser-DUdEZCyq.cjs');
+var index = require('./index-9trmrUtW.cjs');
+var browser = require('./browser-YVckob3g.cjs');
 require('node:module');
 require('node:fs/promises');
 require('node:path');

package/dist/cli-chunks/{project-vite-Du1m7Y_3.cjs → project-vite-CXWFwbEz.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-J4uQvKT_.cjs');
+var index = require('./index-9trmrUtW.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-ZHJUtx6l.cjs → remote-laUZaGpI.cjs}

@@ -1,17 +1,17 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-DWaPlchd.cjs');
-var context = require('./context-Bo4L-Cx_.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Gy2dH17F.cjs');
+var context = require('./context-CqJDNtEi.cjs');
 var promises = require('node:readline/promises');
-var index = require('./index-J4uQvKT_.cjs');
-var runtimeGate = require('./runtime-gate-DedD3ynE.cjs');
+var index = require('./index-9trmrUtW.cjs');
+var runtimeGate = require('./runtime-gate-DmJhPcNQ.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
 var node_crypto = require('node:crypto');
 require('node:zlib');
-require('./version-tzrFwpkl.cjs');
+require('./version-BMp9qmtC.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:module');
@@ -327,7 +327,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-DmCWB_hF.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-rxAV5dza.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -532,18 +532,18 @@ function isNodeError(error) {
     return error instanceof Error && 'code' in error;
 }
 
-/** 发布提示只比较显式声明与线上批准，不消费本地调试授权。 */
-function getUnapprovedPermissionWarning(local, approvals) {
+/** 发布提示使用显式声明与远端主体批准策略，不消费本地调试授权。 */
+function getUnapprovedPermissionWarning(local, approvals, partyType) {
     if (!local.declared)
         return undefined;
-    const { views } = runtimePermissionEnv.composeMiniappRuntimePermissions(local, approvals);
+    const { views } = runtimePermissionEnv.composeMiniappRuntimePermissions(local, approvals, partyType);
     const missing = [];
     for (const view of views) {
         if (!view.declared || view.access !== 'platform-approval')
             continue;
-        if (!view.approved)
+        if (!view.effective)
             missing.push(view.key);
-        if (view.key === 'network' && view.requestedConfig?.useOfficialDomain && !view.approvedConfig?.useOfficialDomain) {
+        if (view.key === 'network' && view.requestedConfig?.useOfficialDomain && !view.effectiveConfig?.useOfficialDomain) {
             missing.push('network.useOfficialDomain');
         }
     }
@@ -635,9 +635,9 @@ async function runDeployCommand(options, runtime = {}) {
                     loginBaseUrl,
                     session,
                 }), { successText: '已读取远端小程序权限' });
-                const localNetworkEnabled = !localPermissions.declared || localPermissions.permissions?.network?.enabled === true;
-                skipPlatformCsp = localNetworkEnabled && context.shouldSkipMiniappPlatformCsp(detail.runtime_permissions);
-                const permissionWarning = getUnapprovedPermissionWarning(localPermissions, detail.runtime_permissions);
+                const effectivePermissions = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions, detail.party_type).runtimePermissions;
+                skipPlatformCsp = context.shouldSkipMiniappPlatformCsp(effectivePermissions);
+                const permissionWarning = getUnapprovedPermissionWarning(localPermissions, detail.runtime_permissions, detail.party_type);
                 if (permissionWarning)
                     logger.warn(permissionWarning);
             }
@@ -1415,7 +1415,7 @@ async function remoteInfo(options, context$1, runtime) {
     const miniProgramId = requireBinding(context$1);
     const detail = await context$1.api.getMiniProgramDetail(miniProgramId);
     const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(context$1.packageJson.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
-    const permissionViews = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions).views;
+    const permissionViews = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions, detail.party_type).views;
     const localBindAppIds = runtimePermissionEnv.readMiniappBindAppIdsFromPackageJson(context$1.packageJson.projectRoot);
     const currentBindApps = normalizeRemoteBoundApps(detail.bind_apps);
     const currentByID = new Map(currentBindApps.map((item) => [item.appid, item]));
@@ -1469,18 +1469,24 @@ async function remoteAllowlistWrite(options, context, runtime) {
 async function remotePermissionList(options, context, runtime) {
     const miniProgramId = requireBinding(context);
     const result = await context.api.listPermissionApplications(miniProgramId);
+    const detail = await context.api.getMiniProgramDetail(miniProgramId);
+    const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(context.packageJson.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
+    const { views } = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, result.runtime_permissions, detail.party_type);
     if (!options.json) {
-        for (const item of result.items) {
-            const application = item.latest_application;
-            const approval = result.runtime_permissions?.entries?.find(entry => entry.key === item.permission_key);
-            context.logger.info(`${item.permission_key} (${item.permission_name})  平台状态=${approval?.status ?? 'disabled'}  最近申请=${application?.status ?? '未申请'}`);
+        for (const view of views.filter(entry => entry.access === 'platform-approval')) {
+            const item = result.items.find(entry => entry.permission_key === view.key);
+            const application = item?.latest_application;
+            const name = item?.permission_name ?? runtimePermissionEnv.MINI_PROGRAM_PERMISSION_CATALOG.find(entry => entry.key === view.key)?.name ?? view.key;
+            const approval = result.runtime_permissions?.entries?.find(entry => entry.key === view.key);
+            const source = view.approvalSource === 'first-party' ? '  批准来源=第一方自动批准' : '';
+            context.logger.info(`${view.key} (${name})  原始审批=${approval?.status ?? 'disabled'}${source}  本地生效=${view.effective ? 'enabled' : 'disabled'}  最近申请=${application?.status ?? '未申请'}`);
             if (application?.application_id)
                 context.logger.info(`申请 ID：${application.application_id}`);
             if (application?.review_remark)
                 context.logger.info(`审核意见：${application.review_remark}`);
         }
     }
-    return finishRemoteCommand(options, runtime, { changed: false, miniProgramId, items: toCamelCaseDeep(result.items), runtimePermissions: toCamelCaseDeep(result.runtime_permissions) });
+    return finishRemoteCommand(options, runtime, { changed: false, miniProgramId, items: toCamelCaseDeep(result.items), runtimePermissions: toCamelCaseDeep(result.runtime_permissions), permissions: views });
 }
 async function remotePermissionApply(options, context, runtime) {
     const miniProgramId = requireBinding(context);
@@ -1608,7 +1614,7 @@ async function remoteDangerousWrite(options, context, runtime) {
         status: detail.status,
         version,
         permissionWarning: options.command === 'release'
-            ? getUnapprovedPermissionWarning(runtimePermissionEnv.readMiniappPermissionsFromPackageJson(context.packageJson.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion()), detail.runtime_permissions)
+            ? getUnapprovedPermissionWarning(runtimePermissionEnv.readMiniappPermissionsFromPackageJson(context.packageJson.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion()), detail.runtime_permissions, detail.party_type)
             : undefined,
     });
     if (options.command === 'release') {
@@ -1989,7 +1995,9 @@ function printMiniProgramDetail(logger, detail, permissionViews, bindings) {
     }
     logger.info('权限:');
     for (const view of permissionViews) {
-        const approval = view.access === 'platform-approval' ? ` 需申请=是 批准=${view.approved ? '是' : '否'}` : ' 需申请=否';
+        const approval = view.approvalSource === 'first-party'
+            ? ` 需申请=否 批准来源=第一方自动批准 原始批准=${view.approved ? '是' : '否'}`
+            : view.access === 'platform-approval' ? ` 需申请=是 批准=${view.approved ? '是' : '否'}` : ' 需申请=否';
         const configs = view.requestedConfig
             ? ` requested=${JSON.stringify(view.requestedConfig)} approved=${JSON.stringify(view.approvedConfig)} effective=${JSON.stringify(view.effectiveConfig)}`
             : '';

package/dist/cli-chunks/{runtime-gate-DedD3ynE.cjs → runtime-gate-DmJhPcNQ.cjs}

@@ -5,8 +5,8 @@ require('node:module');
 require('node:url');
 var fs = require('node:fs');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DWaPlchd.cjs');
-var index = require('./index-J4uQvKT_.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Gy2dH17F.cjs');
+var index = require('./index-9trmrUtW.cjs');
 var require$$0 = require('fs');
 var require$$1 = require('path');
 var require$$1$1 = require('os');

package/dist/cli-chunks/{runtime-permission-env-DWaPlchd.cjs → runtime-permission-env-Gy2dH17F.cjs}

@@ -2,7 +2,7 @@
 
 var fs = require('node:fs');
 var path = require('node:path');
-var version$1 = require('./version-tzrFwpkl.cjs');
+var version$1 = require('./version-BMp9qmtC.cjs');
 require('node:crypto');
 var node_async_hooks = require('node:async_hooks');
 
@@ -77,6 +77,7 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         config: {},
         methods: [
             'network.download',
+            'network.upload',
             'files.pickFiles',
             'files.pickDirectory',
             'files.saveFile',
@@ -135,7 +136,7 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
                 description: '是否申请访问小黑盒官方域名。',
             },
         },
-        methods: ['network.request', 'network.download'],
+        methods: ['network.request', 'network.download', 'network.upload'],
         conditions: ['声明后仍需平台批准，并继续执行网络安全策略。'],
     },
     {
@@ -9898,8 +9899,11 @@ function requiresExplicitPermissions(sdkVersion) {
         throw new Error(`sdkVersion 必须是合法 SemVer：${sdkVersion}`);
     return parsed.major > 0 || parsed.minor >= 9;
 }
-function composeMiniappRuntimePermissions(local, approvals) {
+function composeMiniappRuntimePermissions(local, approvals, 
+/** 仅传入已验证的远端小程序详情身份，不能来自本地调试覆盖。 */
+partyType) {
     const parsedApprovals = parseMiniProgramRuntimePermissions(approvals);
+    const firstParty = local.declared && parsedApprovals.valid && partyType === 'first_party';
     const approvalRevision = isRecord$3(approvals) && Number.isInteger(approvals.revision) ? approvals.revision : undefined;
     const views = [];
     const entries = [];
@@ -9914,13 +9918,16 @@ function composeMiniappRuntimePermissions(local, approvals) {
         }
         const approval = parsedApprovals.valid ? parsedApprovals.permissions[definition.key] : undefined;
         const approved = approval?.status === 'enabled';
-        const effective = declared && approved;
+        const autoApproved = firstParty && declared;
+        const approvalSource = autoApproved ? { approvalSource: 'first-party' } : {};
+        const effective = declared && (approved || autoApproved);
         if (definition.key !== 'network') {
             views.push({
                 key: definition.key,
                 access: definition.access,
                 declared,
                 approved,
+                ...approvalSource,
                 effective,
             });
             if (declared) {
@@ -9930,12 +9937,13 @@ function composeMiniappRuntimePermissions(local, approvals) {
         }
         const requestedOfficialDomain = declaration?.enabled === true && 'useOfficialDomain' in declaration && declaration.useOfficialDomain;
         const approvedOfficialDomain = approval?.config.useOfficialDomain === true;
-        const effectiveOfficialDomain = effective && (local.declared ? requestedOfficialDomain : true) && approvedOfficialDomain;
+        const effectiveOfficialDomain = effective && (local.declared ? requestedOfficialDomain : true) && (approvedOfficialDomain || autoApproved);
         views.push({
             key: definition.key,
             access: definition.access,
             declared,
             approved,
+            ...approvalSource,
             requestedConfig: { useOfficialDomain: requestedOfficialDomain },
             approvedConfig: { useOfficialDomain: approvedOfficialDomain },
             effective,
@@ -19373,6 +19381,7 @@ exports.LIST_USER_MINIPROGRAM_PERMISSION_APPLICATION_API_PATH = LIST_USER_MINIPR
 exports.LIST_USER_MINIPROGRAM_VERSION_API_PATH = LIST_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.MINIAPP_UPLOAD_BATCH_SIZE = MINIAPP_UPLOAD_BATCH_SIZE;
 exports.MINIAPP_UPLOAD_SCOPE = MINIAPP_UPLOAD_SCOPE;
+exports.MINI_PROGRAM_PERMISSION_CATALOG = MINI_PROGRAM_PERMISSION_CATALOG;
 exports.MINI_PROGRAM_PERMISSION_KEYS = MINI_PROGRAM_PERMISSION_KEYS;
 exports.PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH = PRECHECK_USER_MINIPROGRAM_VERSION_API_PATH;
 exports.Parser = Parser;

package/dist/cli-chunks/{skill-D4z_a_BH.cjs → skill--mZIZkyn.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var version = require('./version-tzrFwpkl.cjs');
+var version = require('./version-BMp9qmtC.cjs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
 var childProcess = require('node:child_process');
-var index = require('./index-J4uQvKT_.cjs');
+var index = require('./index-9trmrUtW.cjs');
 require('node:module');
 require('path');
 require('os');