@heybox/hb-sdk 0.9.1-alpha.8 → 0.9.1

package/dist/cli-chunks/{dev-KJAFHEg_.cjs → dev-CFjwhG3q.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var index = require('./index-9trmrUtW.cjs');
-var context = require('./context-CqJDNtEi.cjs');
+var index = require('./index-B_KKGIBN.cjs');
+var context = require('./context-Bg6C5ow7.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-Gy2dH17F.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BNQ2fx4w.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -15,9 +15,9 @@ var undici = require('undici');
 var fs$1 = require('node:fs/promises');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var browser = require('./browser-YVckob3g.cjs');
-var projectVite = require('./project-vite-CXWFwbEz.cjs');
-var version = require('./version-BMp9qmtC.cjs');
+var browser = require('./browser-RAy8e8cV.cjs');
+var projectVite = require('./project-vite-By8cnIwP.cjs');
+var version = require('./version-CG_VNZGM.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1238,6 +1238,8 @@ function createDevSessionRoutes(options) {
 }
 function createContextFields(context) {
     return {
+        development_snapshot: context.developmentSnapshot,
+        development_snapshot_digest: context.developmentSnapshotDigest,
         local_dev_grant: context.localDevGrant,
         context_revision: context.contextRevision,
         declared_permissions: context.declaredPermissions,
@@ -1992,8 +1994,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-KJAFHEg_.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-KJAFHEg_.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CFjwhG3q.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CFjwhG3q.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -2022,6 +2024,7 @@ async function startBrowserDevHostServer(options) {
         csrfToken: sessionController.csrfToken,
         defaultLanAddressId: options.defaultLanAddressId,
         devContext: options.devContext,
+        browserDevContext: options.browserDevContext,
         devSessionId: options.devSessionId,
         lanAddresses: options.lanAddresses ?? [],
         loginAvailable: options.loginService !== undefined,
@@ -2053,6 +2056,7 @@ async function startBrowserDevHostServer(options) {
         loginAvailable: options.loginService !== undefined,
         cliAuth: options.cliAuth,
         readDevContext: () => bootstrap.devContext ?? { source: 'anonymous', runtimePermissions: bootstrap.runtimePermissions },
+        readBrowserDevContext: () => bootstrap.browserDevContext ?? bootstrap.devContext ?? { source: 'anonymous', runtimePermissions: bootstrap.runtimePermissions },
         readMobileDevSessionContext: options.readMobileDevSessionContext ??
             (() => Promise.resolve(bootstrap.devContext ?? { source: 'anonymous', runtimePermissions: bootstrap.runtimePermissions })),
         readLanAddresses: () => bootstrap.lanAddresses,
@@ -2103,6 +2107,8 @@ async function startBrowserDevHostServer(options) {
                 bootstrap.devReadiness = next.devReadiness;
             if (next.devContext !== undefined)
                 bootstrap.devContext = next.devContext;
+            if (next.browserDevContext !== undefined)
+                bootstrap.browserDevContext = next.browserDevContext;
             if (next.lanAddresses !== undefined) {
                 bootstrap.lanAddresses = next.lanAddresses;
                 const launch = readDefaultMobileLaunch(next.lanAddresses, bootstrap.defaultLanAddressId);
@@ -2838,7 +2844,7 @@ function createBrowserDevHostChannelServer(server, options) {
 }
 async function readBrowserDevHostChannelSnapshot(runtime, cookieHeader) {
     const status = await readAccountStatus(runtime, cookieHeader);
-    const permissions = context.createBrowserDevPermissionState(context.resolveBrowserFakeContext(runtime.readDevContext()));
+    const permissions = context.createBrowserDevPermissionState(context.resolveBrowserFakeContext(runtime.readBrowserDevContext()));
     return {
         account: {
             revision: status.revision,
@@ -11093,7 +11099,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-Cv9FlhXy.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-CgZPnqEA.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15141,7 +15147,12 @@ function createLaunchSnapshot(source, requestOrigin) {
     if (source.expiresAt)
         snapshot.expires_at = source.expiresAt;
     const context = source.devContext;
+    // await 续票后 source 可能已切换快照；禁止把旧票据与新描述拼成一个响应。
+    if (context?.developmentSnapshot && localDevLaunchToken !== context.localDevLaunchToken)
+        throw new Error('开发票据与快照已变化，请重试');
     if (context) {
+        snapshot.development_snapshot = context.developmentSnapshot;
+        snapshot.development_snapshot_digest = context.developmentSnapshotDigest;
         snapshot.context_revision = context.contextRevision;
         snapshot.local_dev_grant = context.localDevGrant;
         snapshot.declared_permissions = context.declaredPermissions;
@@ -15498,7 +15509,14 @@ function createDevContextCache(options) {
             entries.delete(key);
             inflight.delete(key);
         },
-        peek: (key) => entries.get(key)?.value,
+        peek: (key) => {
+            const cached = entries.get(key);
+            if (!cached || cached.expiresAt <= now()) {
+                entries.delete(key);
+                return undefined;
+            }
+            return cached.value;
+        },
         read: (key) => {
             if (cacheEnabled) {
                 const cached = entries.get(key);
@@ -15608,12 +15626,9 @@ async function runDevCommand(options, runtime = {}) {
      * 立即重新请求远端，而不是等缓存过期后才发现换了小程序。
      * 读绑定是本地文件读取，不打远端，符合「只读本地快照」的高频读范式。
      */
-    const readDevLaunchContext = async (reuseSnapshot = false) => {
+    const readDevLaunchContext = async () => {
         const boundMiniProgramId = await context.readBoundMiniProgramId(projectRoot).catch(() => undefined);
         const key = `${projectRoot}\0${boundMiniProgramId ?? ''}`;
-        const snapshot = reuseSnapshot ? devContextCache.peek(key) : undefined;
-        if (snapshot?.context.source === 'remote' && !snapshot.context.rateLimit?.limited)
-            return snapshot;
         return devContextCache.read(key);
     };
     let { context: devLaunchContext, miniProgram } = await readDevLaunchContext();
@@ -15650,29 +15665,48 @@ async function runDevCommand(options, runtime = {}) {
         }
     }
     let currentDevContext = devLaunchContext;
+    // 候选输入不对真机公开；签票成功后才替换整份运行上下文。
+    let candidateDevContext = devLaunchContext;
     let devContextGeneration = 0;
+    let preparedDevContext;
     let contextRevision = 1;
     let launchRuntimePermissions = context.createMobileDevSessionRuntimePermissions(devLaunchContext);
     const mobileDevContextUrlsByOrigin = new Map();
     let currentCompanionManifestSha256;
+    let snapshotCompanionManifestSha256;
     let currentLocalDevLaunchToken = devLaunchContext.localDevLaunchToken;
     let currentExpiresAt;
     let refreshDevCsp;
     let lastTemporaryWarning = '';
     let hasReportedBindingChange = false;
     let tokenSession;
-    const updateLocalContext = (allowedTemporaryKeys) => {
+    // Browser Mock 即时消费本地输入，不等待真机签票，也不持有真实凭据。
+    const readBrowserDevContext = () => ({
+        source: candidateDevContext.source,
+        miniProgramId: candidateDevContext.miniProgramId,
+        declaredPermissions: candidateDevContext.declaredPermissions,
+        platforms: candidateDevContext.platforms,
+        runtimePermissions: candidateDevContext.runtimePermissions,
+        publishedRuntimePermissions: candidateDevContext.publishedRuntimePermissions,
+        warning: candidateDevContext.warning,
+        contextRevision, devSessionId, expiresAt: Date.now() + 24 * 60 * 60 * 1000,
+        localDevGrant: runtimePermissionEnv.createMiniProgramLocalDevGrant({
+            declaredPermissions: candidateDevContext.declaredPermissions ?? {},
+            runtimePermissions: candidateDevContext.runtimePermissions, revision: contextRevision,
+            eligiblePermissionKeys: runtimePermissionEnv.hasMiniappDesktopPlatform(candidateDevContext.platforms)
+                ? ['network', 'companion', 'appProtocol'] : ['network', 'appProtocol'],
+        }),
+    });
+    const updateLocalContext = () => {
         const grant = runtimePermissionEnv.createMiniProgramLocalDevGrant({ declaredPermissions: currentDevContext.declaredPermissions ?? {},
-            runtimePermissions: currentDevContext.runtimePermissions, revision: contextRevision,
+            runtimePermissions: currentDevContext.runtimePermissions, revision: currentDevContext.contextRevision ?? contextRevision,
             eligiblePermissionKeys: currentCompanionManifestSha256 && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms)
                 ? ['network', 'companion', 'appProtocol'] : ['network', 'appProtocol'] });
-        if (allowedTemporaryKeys)
-            grant.entries = grant.entries.filter(entry => allowedTemporaryKeys.has(entry.key));
         const temporaryWarning = grant.entries.map(entry => entry.key).join('、');
         if (temporaryWarning && temporaryWarning !== lastTemporaryWarning)
             logger.warn(`本地临时权限：${temporaryWarning}；线上未批准，发布后不可用。`);
         lastTemporaryWarning = temporaryWarning;
-        currentDevContext = { ...currentDevContext, localDevGrant: grant, contextRevision, devSessionId,
+        currentDevContext = { ...currentDevContext, localDevGrant: grant, contextRevision: grant.revision, devSessionId,
             companionManifestSha256: currentCompanionManifestSha256,
             expiresAt: currentExpiresAt ?? Date.now() + 24 * 60 * 60 * 1000 };
         launchRuntimePermissions = context.createMobileDevSessionRuntimePermissions(currentDevContext);
@@ -15782,7 +15816,8 @@ async function runDevCommand(options, runtime = {}) {
     await runDevStartupTask(logger, '正在启动 Vite 开发服务器', () => appServer.listen(appPort), 'Vite 开发服务器已启动');
     let skipDevCsp = context.shouldSkipMiniappPlatformCsp(currentDevContext.runtimePermissions) || currentDevContext.localDevGrant?.entries.some(entry => entry.key === 'network') === true;
     refreshDevCsp = () => {
-        const next = context.shouldSkipMiniappPlatformCsp(currentDevContext.runtimePermissions) || currentDevContext.localDevGrant?.entries.some(entry => entry.key === 'network') === true;
+        const browser = readBrowserDevContext();
+        const next = context.shouldSkipMiniappPlatformCsp(browser.runtimePermissions) || browser.localDevGrant?.entries.some(entry => entry.key === 'network') === true;
         if (next === skipDevCsp || !appServer.restart)
             return;
         skipDevCsp = next;
@@ -15813,6 +15848,7 @@ async function runDevCommand(options, runtime = {}) {
             appUrl,
             devSessionId,
             devContext: currentDevContext,
+            browserDevContext: readBrowserDevContext(),
             fetchImpl,
             getPort: getPortImpl,
             defaultLanAddressId: lanAddresses[0]?.id,
@@ -15834,7 +15870,7 @@ async function runDevCommand(options, runtime = {}) {
             readMobileDevSessionContext: async () => {
                 if (currentDevContext.source === 'remote') {
                     const generation = devContextGeneration;
-                    const refreshed = await readDevLaunchContext(true);
+                    const refreshed = await readDevLaunchContext();
                     if (generation !== devContextGeneration)
                         return currentDevContext;
                     if (refreshed.context.rateLimit?.limited) {
@@ -15842,11 +15878,17 @@ async function runDevCommand(options, runtime = {}) {
                         applyRateLimitState(refreshed.context.rateLimit);
                     }
                     else if (refreshed.context.source === 'remote' && refreshed.context.miniProgramId === currentDevContext.miniProgramId) {
-                        if (JSON.stringify(currentDevContext.runtimePermissions) !== JSON.stringify(refreshed.context.runtimePermissions))
-                            contextRevision++;
-                        currentDevContext = withCurrentLocalDevLaunchToken(refreshed.context, currentLocalDevLaunchToken);
-                        updateLocalContext();
-                        browserDevHost.updateBootstrap({ devContext: currentDevContext });
+                        if (developmentInputsDiffer(currentDevContext, refreshed.context)) {
+                            preparedDevContext = { generation, result: refreshed };
+                            tokenSession?.refresh({ invalidateContext: false });
+                            await tokenSession?.waitForCurrent();
+                        }
+                        else {
+                            // 线上发布状态仅供诊断，不改变本次运行授权。
+                            currentDevContext = { ...currentDevContext, publishedRuntimePermissions: refreshed.context.publishedRuntimePermissions };
+                            candidateDevContext = { ...candidateDevContext, publishedRuntimePermissions: refreshed.context.publishedRuntimePermissions };
+                            browserDevHost.updateBootstrap({ devContext: currentDevContext, browserDevContext: readBrowserDevContext() });
+                        }
                         hasReportedBindingChange = false;
                     }
                     else if (refreshed.context.source === 'remote' && refreshed.context.miniProgramId !== currentDevContext.miniProgramId) {
@@ -15881,7 +15923,9 @@ async function runDevCommand(options, runtime = {}) {
             miniProgramId: devLaunchContext.miniProgramId,
             refreshPermissions: async () => {
                 const generation = devContextGeneration;
-                const refreshed = await readDevLaunchContext();
+                const prepared = preparedDevContext;
+                preparedDevContext = undefined;
+                const refreshed = prepared?.generation === generation ? prepared.result : await readDevLaunchContext();
                 if (generation !== devContextGeneration)
                     throw new DevContextSupersededError();
                 // 限流必须原样抛出，才能走 30s 起、上限 300s 的退避与「请勿反复重启」提示。
@@ -15892,23 +15936,32 @@ async function runDevCommand(options, runtime = {}) {
                     throw new Error('项目绑定已变更，请重新启动调试');
                 if (refreshed.context.source !== 'remote')
                     throw new Error('远端权限刷新暂不可用');
-                if (JSON.stringify(currentDevContext.runtimePermissions) !== JSON.stringify(refreshed.context.runtimePermissions))
+                if (developmentInputsDiffer(candidateDevContext, refreshed.context))
                     contextRevision++;
-                currentDevContext = withCurrentLocalDevLaunchToken(refreshed.context, currentLocalDevLaunchToken);
-                updateLocalContext();
-                browserDevHost.updateBootstrap({ devContext: currentDevContext });
-                return currentDevContext.declaredPermissions?.companion?.enabled === true && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms);
+                candidateDevContext = refreshed.context;
+                return candidateDevContext.declaredPermissions?.companion?.enabled === true && runtimePermissionEnv.hasMiniappDesktopPlatform(candidateDevContext.platforms);
             },
-            onToken: (localDevLaunchToken, companionManifestSha256, expiresAt) => {
-                if (currentCompanionManifestSha256 !== companionManifestSha256 || Boolean(currentLocalDevLaunchToken) !== Boolean(localDevLaunchToken))
+            readDevelopmentSnapshot: companionManifestSha256 => {
+                if (snapshotCompanionManifestSha256 !== companionManifestSha256)
                     contextRevision++;
+                snapshotCompanionManifestSha256 = companionManifestSha256;
+                return runtimePermissionEnv.serializeMiniProgramDevelopmentSnapshot({ schema_version: 1, session_id: devSessionId,
+                    revision: contextRevision, sdk_version: version.HB_SDK_VERSION, declared_permissions: candidateDevContext.declaredPermissions ?? {},
+                    platforms: candidateDevContext.platforms ?? [], ...(companionManifestSha256 ? { companion_manifest_sha256: companionManifestSha256 } : {}) });
+            },
+            onToken: (localDevLaunchToken, companionManifestSha256, expiresAt, developmentSnapshot) => {
+                // 单一发布出口：候选声明/批准、描述、票据、revision 同步切换。
+                currentDevContext = { ...(localDevLaunchToken ? candidateDevContext : currentDevContext), localDevLaunchToken,
+                    contextRevision: developmentSnapshot ? JSON.parse(developmentSnapshot).revision : currentDevContext.contextRevision ?? contextRevision,
+                    developmentSnapshot,
+                    developmentSnapshotDigest: developmentSnapshot ? node_crypto.createHash('sha256').update(developmentSnapshot).digest('hex') : undefined };
                 currentExpiresAt = expiresAt ?? (currentLocalDevLaunchToken ? Date.now() : undefined);
                 currentCompanionManifestSha256 = companionManifestSha256;
                 currentLocalDevLaunchToken = localDevLaunchToken;
-                currentDevContext = withCurrentLocalDevLaunchToken(currentDevContext, localDevLaunchToken);
                 updateLocalContext();
                 browserDevHost.updateBootstrap({
                     devContext: currentDevContext,
+                    browserDevContext: readBrowserDevContext(),
                     lanAddresses: buildLanAddresses(),
                 });
             },
@@ -15916,6 +15969,7 @@ async function runDevCommand(options, runtime = {}) {
             // 主动失效：项目绑定变更或开发者点重试后立即重新请求（key 会带上新绑定，这里清空全部）。
             onInvalidate: () => {
                 devContextGeneration += 1;
+                preparedDevContext = undefined;
                 devContextCache.invalidate();
             },
             // 限流状态与恢复都要透出给调试页与宿主页。
@@ -15962,7 +16016,6 @@ async function runDevCommand(options, runtime = {}) {
     }
     const onDeclarationChange = () => {
         try {
-            const previouslyTemporary = new Set(currentDevContext.localDevGrant?.entries.map(entry => entry.key));
             const local = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
             const platforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
             // 与调试声明无关的写入（版本号、依赖等）不触发远端刷新。
@@ -15971,19 +16024,27 @@ async function runDevCommand(options, runtime = {}) {
                 return;
             lastDeclarationFingerprint = fingerprint;
             contextRevision++;
-            currentDevContext = { ...currentDevContext, declaredPermissions: local.permissions ?? {}, platforms,
-                runtimePermissions: runtimePermissionEnv.composeMiniappRuntimePermissions(local, currentDevContext.runtimePermissions).runtimePermissions };
-            // 新声明必须重新取得远端基线；已有票据期间只允许删除，不因刷新失败扩权。
-            currentCompanionManifestSha256 = undefined;
-            updateLocalContext(currentDevContext.source === 'remote' ? previouslyTemporary : undefined);
-            tokenSession?.refresh();
-            browserDevHost.updateBootstrap({ devContext: currentDevContext, miniProgramSupportsDesktop: runtimePermissionEnv.hasMiniappDesktopPlatform(platforms) });
+            candidateDevContext = { ...candidateDevContext, declaredPermissions: local.permissions ?? {}, platforms,
+                runtimePermissions: runtimePermissionEnv.composeMiniappRuntimePermissions(local, candidateDevContext.runtimePermissions).runtimePermissions };
+            if (tokenSession) {
+                tokenSession.refresh();
+            }
+            else {
+                // 无真实客户端凭据的 Browser Mock 不依赖远端签票。
+                currentDevContext = { ...candidateDevContext, contextRevision };
+                updateLocalContext();
+                browserDevHost.updateBootstrap({ devContext: currentDevContext });
+            }
+            browserDevHost.updateBootstrap({ browserDevContext: readBrowserDevContext(), miniProgramSupportsDesktop: runtimePermissionEnv.hasMiniappDesktopPlatform(platforms) });
+            refreshDevCsp?.();
         }
         catch {
             contextRevision++;
             currentDevContext = { ...currentDevContext, declaredPermissions: {}, localDevGrant: undefined,
                 contextRevision, platforms: [], localDevLaunchToken: undefined, expiresAt: undefined,
+                developmentSnapshot: undefined, developmentSnapshotDigest: undefined,
                 runtimePermissions: { schema_version: 1, entries: [] }, warning: '本地权限声明无效，调试权限已撤销' };
+            candidateDevContext = currentDevContext;
             launchRuntimePermissions = { schema_version: 1, entries: [] };
             currentCompanionManifestSha256 = undefined;
             currentLocalDevLaunchToken = undefined;
@@ -15992,6 +16053,7 @@ async function runDevCommand(options, runtime = {}) {
             tokenSession?.refresh();
             browserDevHost.updateBootstrap({
                 devContext: currentDevContext,
+                browserDevContext: readBrowserDevContext(),
                 devReadiness: {
                     browser: { state: 'ready' },
                     mobile: { state: 'blocked', reason: '本地权限声明无效，已撤销真实客户端调试' },
@@ -16012,14 +16074,8 @@ async function runDevCommand(options, runtime = {}) {
     }
     installShutdownHandlers(closers, runtime.process ?? process);
 }
-function withCurrentLocalDevLaunchToken(context, localDevLaunchToken) {
-    return {
-        ...context,
-        ...(context.miniProgramId ? { miniProgramId: context.miniProgramId } : {}),
-        localDevLaunchToken,
-        ...(context.runtimePermissions !== undefined ? { runtimePermissions: context.runtimePermissions } : {}),
-        ...(context.warning ? { warning: context.warning } : {}),
-    };
+function developmentInputsDiffer(left, right) {
+    return ['miniProgramId', 'declaredPermissions', 'platforms', 'runtimePermissions'].some(key => JSON.stringify(left[key]) !== JSON.stringify(right[key]));
 }
 function runDevStartupTask(logger, text, action, successText) {
     if (!logger.verbose) {
@@ -16063,6 +16119,7 @@ async function loadDevLaunchContext(options) {
                 source: 'remote',
                 miniProgramId: verifiedMiniProgramId,
                 runtimePermissions: effectivePermissions,
+                ...(runtimePermissionEnv.parseMiniProgramRuntimePermissions(detail.effective_runtime_permissions).valid ? { publishedRuntimePermissions: detail.effective_runtime_permissions } : {}),
                 declaredPermissions: localPermissions.permissions ?? {},
                 platforms,
             },
@@ -16369,7 +16426,11 @@ function startLocalDevLaunchTokenSession(options) {
     let permissionsRefreshFailure;
     let permissionsGeneration = 0;
     let validatedPermissionsGeneration = 0;
+    let publishedPermissionsGeneration = -1;
+    let refreshFailure;
     let publishedToken;
+    let publishedTicket;
+    let refreshPromise;
     let publishedDigest;
     let ticket;
     let pending;
@@ -16378,16 +16439,18 @@ function startLocalDevLaunchTokenSession(options) {
     const acquireTicket = async (companionManifestSha256) => {
         if (closed)
             return undefined;
-        if (ticket && (companionManifestSha256 === undefined || ticket.companionManifestSha256 === companionManifestSha256) && ticket.refreshAt > Date.now())
+        const snapshot = options.readDevelopmentSnapshot?.(companionManifestSha256);
+        if (ticket && ticket.developmentSnapshot === snapshot && (companionManifestSha256 === undefined || ticket.companionManifestSha256 === companionManifestSha256) && ticket.refreshAt > Date.now())
             return ticket;
-        return issueTicket(companionManifestSha256);
+        return issueTicket(companionManifestSha256, snapshot);
     };
-    const issueTicket = (companionManifestSha256) => {
-        if (pending && pending.digest === companionManifestSha256)
+    const issueTicket = (companionManifestSha256, developmentSnapshot) => {
+        if (pending && pending.digest === companionManifestSha256 && pending.snapshot === developmentSnapshot)
             return pending.promise;
         const generation = permissionsGeneration;
         const promise = issueLocalDevLaunchToken({
             ...options,
+            developmentSnapshot,
             ...(companionManifestSha256 ? { companionManifestSha256 } : {}),
         })
             .then(issued => {
@@ -16397,26 +16460,61 @@ function startLocalDevLaunchTokenSession(options) {
             return issued;
         }).finally(() => { if (pending?.promise === promise)
             pending = undefined; });
-        pending = { digest: companionManifestSha256, promise };
+        pending = { digest: companionManifestSha256, snapshot: developmentSnapshot, promise };
         return promise;
     };
+    // 票据与它绑定的描述通过同一出口原子发布；主动读取和后台续票不能发布不同快照。
+    const publishTicket = (issued) => {
+        if (publishedToken === issued.token && publishedDigest === issued.companionManifestSha256 && publishedPermissionsGeneration === permissionsGeneration)
+            return;
+        publishedPermissionsGeneration = permissionsGeneration;
+        publishedToken = issued.token;
+        publishedTicket = issued;
+        publishedDigest = issued.companionManifestSha256;
+        if (issued.developmentSnapshot)
+            options.onToken(issued.token, publishedDigest, issued.expiresAt, issued.developmentSnapshot);
+        else
+            options.onToken(issued.token, publishedDigest, issued.expiresAt);
+        scheduleExpiration(Math.max(0, issued.expiresAt - Date.now()));
+    };
+    const waitForCurrent = async () => {
+        const generation = permissionsGeneration;
+        if (publishedPermissionsGeneration === generation)
+            return;
+        if (refreshFailure && !refreshPromise)
+            throw refreshFailure;
+        await ensureRefresh();
+        if (closed)
+            return;
+        if (generation !== permissionsGeneration)
+            throw new DevContextSupersededError();
+        // 输入变化可能发生在上一代请求期间；等上一代退出后处理当前候选。
+        if (validatedPermissionsGeneration !== generation && !refreshFailure)
+            await ensureRefresh();
+        if (generation !== permissionsGeneration)
+            throw new DevContextSupersededError();
+        if (publishedPermissionsGeneration !== generation)
+            throw refreshFailure ?? new Error('开发快照尚未就绪，请稍后重试');
+    };
     const getTicket = async (companionManifestSha256) => {
         if (closed)
             return undefined;
         const generation = permissionsGeneration;
-        const assertPermissionsReady = () => {
-            if (generation !== permissionsGeneration)
-                throw new DevContextSupersededError();
-            if (permissionsRefreshFailure)
-                throw permissionsRefreshFailure.error;
-            if (validatedPermissionsGeneration !== permissionsGeneration)
-                throw new Error('远端上下文正在刷新，请稍后再试');
-        };
-        assertPermissionsReady();
-        const issued = await acquireTicket(companionManifestSha256);
+        await waitForCurrent();
         if (closed)
             return undefined;
-        assertPermissionsReady();
+        if ((!publishedTicket || publishedTicket.refreshAt <= Date.now() ||
+            (companionManifestSha256 !== undefined && publishedTicket.companionManifestSha256 !== companionManifestSha256)) && (!refreshFailure || refreshPromise))
+            await ensureRefresh();
+        if (closed)
+            return undefined;
+        if (generation !== permissionsGeneration || publishedPermissionsGeneration !== generation)
+            throw new DevContextSupersededError();
+        const issued = publishedTicket;
+        if (!issued || issued.expiresAt <= Date.now())
+            throw refreshFailure ?? new Error('开发票据暂不可用，请稍后重试');
+        if (companionManifestSha256 !== undefined && issued.companionManifestSha256 !== companionManifestSha256)
+            throw new Error('开发产物已变化，请重新打开调试');
         return issued;
     };
     const refresh = async () => {
@@ -16425,7 +16523,7 @@ function startLocalDevLaunchTokenSession(options) {
         refreshing = true;
         const generation = permissionsGeneration;
         try {
-            if (options.refreshPermissions && permissionsRefreshPending) {
+            if (options.refreshPermissions && (permissionsRefreshPending || permissionsRefreshFailure)) {
                 permissionsRefreshPending = false;
                 try {
                     const nextCompanionDeclared = await options.refreshPermissions();
@@ -16464,11 +16562,9 @@ function startLocalDevLaunchTokenSession(options) {
                 return;
             if (closed || generation !== permissionsGeneration)
                 return;
-            if (!permissionsRefreshFailure && (publishedToken !== issued.token || publishedDigest !== digest)) {
-                publishedToken = issued.token;
-                publishedDigest = digest;
-                options.onToken(issued.token, digest, issued.expiresAt);
-            }
+            if (!permissionsRefreshFailure)
+                publishTicket(issued);
+            refreshFailure = undefined;
             options.onReadiness({
                 browser: { state: 'ready' },
                 mobile: permissionsRefreshFailure
@@ -16487,8 +16583,6 @@ function startLocalDevLaunchTokenSession(options) {
             if (snapshotError)
                 options.logger.debug(`PC Companion 快照校验失败：${index.readRedactedErrorMessage(snapshotError, { verbose: true })}`);
             const ttl = Math.max(0, issued.expiresAt - Date.now());
-            if (!permissionsRefreshFailure)
-                scheduleExpiration(ttl);
             schedule(Math.min(2_000, Math.max(1_000, Math.floor(ttl * 0.8))));
             if (hasReportedTokenFailure && !permissionsRefreshFailure) {
                 hasReportedTokenFailure = false;
@@ -16502,6 +16596,7 @@ function startLocalDevLaunchTokenSession(options) {
         catch (error) {
             if (closed || generation !== permissionsGeneration || error instanceof DevContextSupersededError)
                 return;
+            refreshFailure = error;
             // A2 + A3：限流类错误走 30s 起、上限 300s 的退避，并明确提示不要反复重启。
             const rateLimitState = index.readCliRateLimitState(error);
             consecutiveFailures += 1;
@@ -16534,9 +16629,20 @@ function startLocalDevLaunchTokenSession(options) {
             }
         }
     };
+    // 包括主动读取在内的所有续票都复用同一轮刷新，不能并行签发相互覆盖的描述。
+    const ensureRefresh = () => {
+        if (refreshPromise)
+            return refreshPromise;
+        const promise = refresh().finally(() => { if (refreshPromise === promise)
+            refreshPromise = undefined; });
+        refreshPromise = promise;
+        return promise;
+    };
     const schedule = (delayMs) => {
+        if (refreshTimer)
+            clearTimeout(refreshTimer);
         refreshTimer = setTimeout(() => {
-            void refresh();
+            void ensureRefresh();
         }, Math.max(1, delayMs));
         refreshTimer.unref?.();
     };
@@ -16547,6 +16653,8 @@ function startLocalDevLaunchTokenSession(options) {
             if (!closed) {
                 options.onToken(undefined, undefined);
                 publishedToken = undefined;
+                publishedTicket = undefined;
+                publishedPermissionsGeneration = -1;
                 options.onReadiness({ browser: { state: 'ready' }, mobile: { state: 'blocked', reason: '调试凭证已过期' },
                     companion: { state: 'blocked', reason: '调试凭证已过期' } });
             }
@@ -16554,20 +16662,24 @@ function startLocalDevLaunchTokenSession(options) {
         expirationTimer.unref?.();
     };
     options.onReadiness({ browser: { state: 'ready' }, mobile: { state: 'pending' }, companion: { state: 'pending' } });
-    const ready = refresh();
+    const ready = ensureRefresh();
     return {
         getTicket,
-        refresh: () => {
+        waitForCurrent,
+        refresh: (request = {}) => {
             // 项目绑定变更或开发者主动重试：主动失效 Dev Context 缓存后立即重新请求。
-            options.onInvalidate?.();
+            if (request.invalidateContext !== false)
+                options.onInvalidate?.();
             permissionsGeneration += 1;
             permissionsRefreshPending = true;
+            refreshFailure = undefined;
             ticket = undefined;
             pending = undefined;
             publishedDigest = undefined;
             if (refreshTimer)
                 clearTimeout(refreshTimer);
-            void refresh();
+            options.onReadiness({ browser: { state: 'ready' }, mobile: { state: 'pending' }, companion: { state: 'pending' } });
+            void ensureRefresh();
         },
         ready,
         close: () => {
@@ -16589,6 +16701,7 @@ async function issueLocalDevLaunchToken(options) {
                 env: options.env,
                 fetchImpl,
                 miniProgramId: options.miniProgramId,
+                developmentSnapshot: options.developmentSnapshot,
                 ...(options.companionManifestSha256
                     ? { companionManifestSha256: options.companionManifestSha256 }
                     : {}),
@@ -16604,7 +16717,7 @@ async function issueLocalDevLaunchToken(options) {
     if (!expiresAt || expiresAt <= Date.now()) {
         throw new Error('响应缺少有效 expires_at');
     }
-    return { ...(options.companionManifestSha256 ? { companionManifestSha256: options.companionManifestSha256 } : {}), expiresAt, token,
+    return { developmentSnapshot: options.developmentSnapshot, ...(options.companionManifestSha256 ? { companionManifestSha256: options.companionManifestSha256 } : {}), expiresAt, token,
         refreshAt: Date.now() + Math.max(1, (expiresAt - Date.now()) * 0.8) };
 }
 function safeCompanionFailureReason(error) {

package/dist/cli-chunks/{doctor-DhiUViwk.cjs → doctor-CMz_Kf7-.cjs}

@@ -3,26 +3,22 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-9trmrUtW.cjs');
+var index = require('./index-B_KKGIBN.cjs');
 require('node:module');
-require('path');
-require('os');
-require('fs');
-require('constants');
-require('stream');
-require('util');
-require('assert');
 require('readline');
+require('os');
 require('tty');
+require('assert');
 require('events');
+require('stream');
 require('buffer');
+require('util');
 require('node:crypto');
-require('node:process');
-require('node:buffer');
-require('node:url');
-require('node:util');
-require('node:child_process');
+require('path');
+require('fs');
+require('constants');
 require('node:fs');
+require('node:zlib');
 
 const CANDIDATES = [
     path.resolve(__dirname, '..', 'package.json'),