@heybox/hb-sdk 0.9.2-alpha.0 → 0.9.2-alpha.2

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.2-alpha.2 - 2026-10-19
+
+### 新增能力
+
+- 新增云端字符串存储 `cloud.storage.getStorage()`、`setStorage()`、`getKeys()` 和 `removeItem()`；须声明 `cloud_storage` 权限并登录，数据按小程序与用户隔离。
+
+### 行为调整
+
+- 云存储 key 仅支持英文字母、数字、下划线和连字符，最长 128 字符；value 最大 16 KB，不存在的 key 返回 `undefined`。
+- 同 key 在固定 500ms 窗口内合并最终写入值，并发版本由 Runtime 自动维护，无需开发者传递。
+
+### 问题修复
+
+- 修复同账号登录态刷新导致云存储误报登录状态变化的问题；账号切换后仍清理旧账号缓存并拒绝过期请求。
+
+## 0.9.2-alpha.1 - 2026-10-19
+
+### 问题修复
+
+- 修复部分受限运行环境中，启动时产生额外安全告警、干扰调试台排查的问题。
+
 ## 0.9.2-alpha.0 - 2026-10-19
 
 ### 问题修复

package/README.md

@@ -328,7 +328,7 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 | `viewport`   | 读取窗口信息、设置方向/胶囊及导航栏样式         |
 | `storage`    | 读写当前小程序的隔离存储                        |
 | `files`      | 声明受控 sandbox 与用户选择授权的文件、目录操作 |
-| `cloud`      | 使用小程序云端排行榜                            |
+| `cloud`      | 使用小程序云端排行榜与用户私有云端存储          |
 | `network`    | 发起经过平台授权的网络请求及受控文件传输  |
 | `companion`  | 准备、启动并控制当前版本审核过的桌面辅助应用    |
 
@@ -451,6 +451,21 @@ async function deleteMyLeaderboardEntryFromUserAction() {
 hb-sdk remote cloud leaderboard delete <key> --confirm <key>
 ```
 
+## 云端存储
+
+`cloud.storage` 保存当前登录用户在当前小程序下的私有字符串数据，需要独立声明 `cloud_storage` 权限。key 仅支持 1–128 位英文字母、数字、下划线和连字符，value 最多 16KB，每个用户每个小程序最多 64 个 key。
+
+```ts
+await hbSDK.cloud.storage.setStorage('save', JSON.stringify(nextSave));
+const value = await hbSDK.cloud.storage.getStorage('save'); // string | undefined
+const keys = await hbSDK.cloud.storage.getKeys(); // string[]
+await hbSDK.cloud.storage.removeItem('save'); // 删除键和值
+```
+
+Runtime 自动管理内部版本凭证。同 key 的 set 在首笔调用起固定 500ms 窗口内合并，仅提交最终值，后续调用不延长窗口；不同 key 独立请求，同 key 串行且不跨删除合并。合并调用在最终值获远端确认后一起完成；冲突通过 `HbMiniProgramSDKError` 的 `VERSION_CONFLICT` 返回，不自动覆盖重试。
+
+详见[云端存储指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cloud-storage)。
+
 ## CLI 主流程
 
 ```bash

package/dist/cli-chunks/{build-D_WFX7k0.cjs → build-CyswVc4b.cjs}

@@ -1,14 +1,14 @@
 'use strict';
 
-var runtimeGate = require('./runtime-gate-DwBSYQOE.cjs');
+var runtimeGate = require('./runtime-gate-C3P-8VeT.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-Dx1msYpN.cjs');
-var index = require('./index-HprlZ2zE.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BBLrXaE_.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 require('node:crypto');
 require('node:zlib');
-var projectVite = require('./project-vite-B81ymoLT.cjs');
+var projectVite = require('./project-vite-BDpkwL6C.cjs');
 require('node:module');
 require('node:url');
 require('./_commonjs-dynamic-modules-DUamuDzp.cjs');
@@ -16,7 +16,7 @@ require('fs');
 require('path');
 require('os');
 require('inspector');
-require('./version-0WiS_IOu.cjs');
+require('./version-DgbarBxd.cjs');
 require('node:async_hooks');
 require('readline');
 require('tty');

package/dist/cli-chunks/{context-9AzsNffz.cjs → context-Dr_SFRYa.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-Dx1msYpN.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BBLrXaE_.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var index = require('./index-HprlZ2zE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);

package/dist/cli-chunks/{create-Crb_TIGw.cjs → create-DY4e3-ai.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-HprlZ2zE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 require('node:module');
 require('readline');
 require('os');

package/dist/cli-chunks/{dev-Bt7baZld.cjs → dev-DKuNXTMr.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var index = require('./index-HprlZ2zE.cjs');
-var context = require('./context-9AzsNffz.cjs');
+var index = require('./index-B8qBsp6f.cjs');
+var context = require('./context-Dr_SFRYa.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-Dx1msYpN.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BBLrXaE_.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -16,8 +16,8 @@ var fs$1 = require('node:fs/promises');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-B81ymoLT.cjs');
-var version = require('./version-0WiS_IOu.cjs');
+var projectVite = require('./project-vite-BDpkwL6C.cjs');
+var version = require('./version-DgbarBxd.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -634,6 +634,7 @@ const DENIED_REQUEST_HEADERS = new Set([
     'trailer',
     'transfer-encoding',
     'upgrade',
+    'x-heybox-runtime-auth-context-token',
 ]);
 /** 任意 origin 都不得通过公开 network.request 访问的 Runtime 私有路径。 */
 const PUBLIC_NETWORK_PROTECTED_PATH_PREFIXES = ['/user_miniprogram/runtime/auth', '/user_miniprogram/openapi/v1'];
@@ -1994,8 +1995,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-Bt7baZld.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-Bt7baZld.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DKuNXTMr.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DKuNXTMr.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -11099,7 +11100,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-BWs3tf3O.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-D7sYo7d4.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;

package/dist/cli-chunks/{doctor-BDvcQDhr.cjs → doctor-FC9aE_Ku.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-HprlZ2zE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 require('node:module');
 require('readline');
 require('os');

package/dist/cli-chunks/{index-HprlZ2zE.cjs → index-B8qBsp6f.cjs}

@@ -238,19 +238,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-HprlZ2zE.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B8qBsp6f.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-HprlZ2zE.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B8qBsp6f.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-HprlZ2zE.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B8qBsp6f.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-HprlZ2zE.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B8qBsp6f.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-HprlZ2zE.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B8qBsp6f.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -17249,7 +17249,7 @@ async function inspectFeedbackLog(file, size) {
     return { mimeType: 'text/plain', width: 0, height: 0 };
 }
 async function createFeedbackCosClient(getToken) {
-    const { default: COS } = await Promise.resolve().then(function () { return require('./index-COrp4A_r.cjs'); }).then(function (n) { return n.index; });
+    const { default: COS } = await Promise.resolve().then(function () { return require('./index-B9xW1kud.cjs'); }).then(function (n) { return n.index; });
     const cos = new COS({
         getAuthorization(_options, callback) {
             void getToken().then((token) => callback({
@@ -20900,7 +20900,7 @@ function readEnvNameArgFromArgv(argv) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.9.2-alpha.0';
+const BUILT_CLI_VERSION = '0.9.2-alpha.2';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -21269,39 +21269,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-Cx71xOGJ.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-D8w3N8jn.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-Cx71xOGJ.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-D8w3N8jn.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-Cx71xOGJ.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-D8w3N8jn.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-D_WFX7k0.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CyswVc4b.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-Crb_TIGw.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DY4e3-ai.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-Bt7baZld.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-DKuNXTMr.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BDvcQDhr.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-FC9aE_Ku.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DuW-YJCy.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-B4LVsoOx.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-1w_i96x-.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-kpeucBW7.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-COrp4A_r.cjs → index-B9xW1kud.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index$2 = require('./index-HprlZ2zE.cjs');
+var index$2 = require('./index-B8qBsp6f.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');

package/dist/cli-chunks/{index.esm-BWs3tf3O.cjs → index.esm-D7sYo7d4.cjs}

@@ -11,8 +11,8 @@ var require$$0$3 = require('url');
 var require$$5 = require('zlib');
 var require$$0 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-HprlZ2zE.cjs');
-var dev = require('./dev-Bt7baZld.cjs');
+var index = require('./index-B8qBsp6f.cjs');
+var dev = require('./dev-DKuNXTMr.cjs');
 require('node:module');
 require('readline');
 require('os');
@@ -26,9 +26,9 @@ require('constants');
 require('node:fs');
 require('node:fs/promises');
 require('node:zlib');
-require('./context-9AzsNffz.cjs');
-require('./runtime-permission-env-Dx1msYpN.cjs');
-require('./version-0WiS_IOu.cjs');
+require('./context-Dr_SFRYa.cjs');
+require('./runtime-permission-env-BBLrXaE_.cjs');
+require('./version-DgbarBxd.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:os');
@@ -42,7 +42,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-B81ymoLT.cjs');
+require('./project-vite-BDpkwL6C.cjs');
 
 var bufferUtil = {exports: {}};
 

package/dist/cli-chunks/{login-Cx71xOGJ.cjs → login-D8w3N8jn.cjs}

@@ -3,7 +3,7 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var index = require('./index-HprlZ2zE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
 require('node:module');
 require('readline');

package/dist/cli-chunks/{project-vite-B81ymoLT.cjs → project-vite-BDpkwL6C.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-HprlZ2zE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-1w_i96x-.cjs → remote-kpeucBW7.cjs}

@@ -1,17 +1,17 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-Dx1msYpN.cjs');
-var context = require('./context-9AzsNffz.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BBLrXaE_.cjs');
+var context = require('./context-Dr_SFRYa.cjs');
 var promises = require('node:readline/promises');
-var index = require('./index-HprlZ2zE.cjs');
-var runtimeGate = require('./runtime-gate-DwBSYQOE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
+var runtimeGate = require('./runtime-gate-C3P-8VeT.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
 var node_crypto = require('node:crypto');
 require('node:zlib');
-require('./version-0WiS_IOu.cjs');
+require('./version-DgbarBxd.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:module');
@@ -286,7 +286,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-COrp4A_r.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-B9xW1kud.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {

package/dist/cli-chunks/{runtime-gate-DwBSYQOE.cjs → runtime-gate-C3P-8VeT.cjs}

@@ -5,8 +5,8 @@ require('node:module');
 require('node:url');
 var fs = require('node:fs');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-Dx1msYpN.cjs');
-var index = require('./index-HprlZ2zE.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-BBLrXaE_.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 var _commonjsDynamicModules = require('./_commonjs-dynamic-modules-DUamuDzp.cjs');
 var require$$0$1 = require('fs');
 var require$$1 = require('path');

package/dist/cli-chunks/{runtime-permission-env-Dx1msYpN.cjs → runtime-permission-env-BBLrXaE_.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var index = require('./index-HprlZ2zE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 var fs = require('node:fs');
 var path = require('node:path');
-var version$1 = require('./version-0WiS_IOu.cjs');
+var version$1 = require('./version-DgbarBxd.cjs');
 require('node:crypto');
 var node_async_hooks = require('node:async_hooks');
 
@@ -69,6 +69,16 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         methods: ['storage.getStorage', 'storage.setStorage'],
         conditions: ['仅用于简单键值存储，不包含文件系统。'],
     },
+    {
+        key: 'cloud_storage',
+        name: '云端存储',
+        description: '读写按小程序和当前登录用户隔离的云端键值数据。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['cloud.storage.getStorage', 'cloud.storage.setStorage', 'cloud.storage.removeItem', 'cloud.storage.getKeys'],
+        conditions: ['云端存储按登录用户隔离并受容量配额限制。'],
+    },
     {
         key: 'filesystem',
         name: '文件系统',
@@ -163,23 +173,6 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         ],
         conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
     },
-    {
-        "key": "cloud_storage",
-        "name": "云端存储",
-        "description": "读写按小程序和当前登录用户隔离的云端键值数据。",
-        "access": "declaration",
-        "risk": "medium",
-        "config": {},
-        "methods": [
-            "cloud.storage.getItem",
-            "cloud.storage.setItem",
-            "cloud.storage.removeItem",
-            "cloud.storage.getKeys"
-        ],
-        "conditions": [
-            "云端存储按登录用户隔离并受容量配额限制。"
-        ]
-    },
     {
         key: 'appProtocol',
         name: '应用协议执行',
@@ -215,6 +208,7 @@ const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(MINI_PROGRAM_PERMISSION_KEYS);
  * - `steamLibrary`
  * - `share`
  * - `storage`
+ * - `cloud_storage`
  * - `filesystem`
  * - `clipboard`
  * - `leaderboard`
@@ -566,6 +560,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -5688,6 +5684,10 @@ function json(params) {
     return jsonSchema;
 }
 
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
+
 // ../view-contract/src/schema.ts
 var VIEW_SCHEMA_VERSION = 1;
 var VIEW_BUDGET = {

package/dist/cli-chunks/{skill-DuW-YJCy.cjs → skill-B4LVsoOx.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var version = require('./version-0WiS_IOu.cjs');
+var version = require('./version-DgbarBxd.cjs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
 var childProcess = require('node:child_process');
-var index = require('./index-HprlZ2zE.cjs');
+var index = require('./index-B8qBsp6f.cjs');
 require('node:module');
 require('readline');
 require('os');

package/dist/cli-chunks/{version-0WiS_IOu.cjs → version-DgbarBxd.cjs}

@@ -3,6 +3,6 @@
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.2-alpha.0';
+    : '0.9.2-alpha.2';
 
 exports.HB_SDK_VERSION = HB_SDK_VERSION;

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-HprlZ2zE.cjs');
+var index = require('./cli-chunks/index-B8qBsp6f.cjs');
 require('node:module');
 require('readline');
 require('os');