@heybox/hb-sdk 0.9.2-alpha.0 → 0.9.2-alpha.2

package/dist/devtools/browser-dev-host/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#f4f5f7" />
     <title>小程序工坊调试台</title>
-    <script type="module" crossorigin src="/assets/index-8RmhA6dc.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-BsIjbmXH.js">
+    <script type="module" crossorigin src="/assets/index-BnkA-gEX.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-zP3CDynX.js">
     <link rel="stylesheet" crossorigin href="/assets/index-7Cq8iNcD.css">
   </head>
   <body>

package/dist/index.cjs.js

@@ -457,6 +457,10 @@ const CLOUD_LEADERBOARD_GET_LIST_METHOD = 'cloud.leaderboard.getList';
 const CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.getCurrentUserEntry';
 const CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.deleteCurrentUserEntry';
 const CLOUD_LEADERBOARD_GET_INFO_METHOD = 'cloud.leaderboard.getInfo';
+const CLOUD_STORAGE_GET_STORAGE_METHOD = 'cloud.storage.getStorage';
+const CLOUD_STORAGE_SET_STORAGE_METHOD = 'cloud.storage.setStorage';
+const CLOUD_STORAGE_REMOVE_ITEM_METHOD = 'cloud.storage.removeItem';
+const CLOUD_STORAGE_GET_KEYS_METHOD = 'cloud.storage.getKeys';
 const COMPANION_GET_INFO_METHOD = 'companion.getInfo';
 const COMPANION_GET_PREPARATION_STATUS_METHOD = 'companion.getPreparationStatus';
 const COMPANION_PREPARE_METHOD = 'companion.prepare';
@@ -1145,6 +1149,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -6266,6 +6272,10 @@ function json(params) {
     });
     return jsonSchema;
 }
+
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
 var VIEW_BUDGET = {
   /** 节点树最大深度。 */
   maxDepth: 16,
@@ -7280,7 +7290,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.2-alpha.0';
+    : '0.9.2-alpha.2';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);
@@ -7873,6 +7883,12 @@ function createCloudModule(requester) {
             deleteCurrentUserEntry: (options) => requester.request(CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, options),
             getInfo: (options) => requester.request(CLOUD_LEADERBOARD_GET_INFO_METHOD, options),
         },
+        storage: {
+            getStorage: (key) => requester.request(CLOUD_STORAGE_GET_STORAGE_METHOD, { key }),
+            setStorage: (key, value) => requester.request(CLOUD_STORAGE_SET_STORAGE_METHOD, { key, value }),
+            removeItem: (key) => requester.request(CLOUD_STORAGE_REMOVE_ITEM_METHOD, { key }),
+            getKeys: () => requester.request(CLOUD_STORAGE_GET_KEYS_METHOD),
+        },
     };
 }
 
@@ -11483,7 +11499,7 @@ function installMiniDevConsoleForwarding(consoleRef = console) {
 
 let defaultSDK = createMiniProgramSDK();
 if (typeof false !== 'undefined' && false && typeof window !== 'undefined') {
-    window.__hbSdkSandboxList = async (path) => (await getDefaultSDK().files.sandbox.directory(path).list({ limit: 200 })).map(entry => ({ name: entry.name, kind: entry.kind }));
+    window.__hbSdkSandboxList = async (path) => (await getDefaultSDK().files.sandbox.directory(path).list({ limit: 200 })).map((entry) => ({ name: entry.name, kind: entry.kind }));
 }
 // 开发期调试台 console 捕获：双条件门控（vite serve 注入 define + 调试 iframe 标记），
 // 生产构建被死代码消除，正式环境无副作用。失败静默，绝不影响 SDK 初始化。
@@ -11906,6 +11922,12 @@ const cloud = {
         deleteCurrentUserEntry: (options) => getDefaultSDK().cloud.leaderboard.deleteCurrentUserEntry(options),
         getInfo: (options) => getDefaultSDK().cloud.leaderboard.getInfo(options),
     },
+    storage: {
+        getStorage: (key) => getDefaultSDK().cloud.storage.getStorage(key),
+        setStorage: (key, value) => getDefaultSDK().cloud.storage.setStorage(key, value),
+        removeItem: (key) => getDefaultSDK().cloud.storage.removeItem(key),
+        getKeys: () => getDefaultSDK().cloud.storage.getKeys(),
+    },
 };
 /** 默认 SDK 实例的受管桌面程序模块。 */
 const companion = {

package/dist/index.esm.js

@@ -453,6 +453,10 @@ const CLOUD_LEADERBOARD_GET_LIST_METHOD = 'cloud.leaderboard.getList';
 const CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.getCurrentUserEntry';
 const CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.deleteCurrentUserEntry';
 const CLOUD_LEADERBOARD_GET_INFO_METHOD = 'cloud.leaderboard.getInfo';
+const CLOUD_STORAGE_GET_STORAGE_METHOD = 'cloud.storage.getStorage';
+const CLOUD_STORAGE_SET_STORAGE_METHOD = 'cloud.storage.setStorage';
+const CLOUD_STORAGE_REMOVE_ITEM_METHOD = 'cloud.storage.removeItem';
+const CLOUD_STORAGE_GET_KEYS_METHOD = 'cloud.storage.getKeys';
 const COMPANION_GET_INFO_METHOD = 'companion.getInfo';
 const COMPANION_GET_PREPARATION_STATUS_METHOD = 'companion.getPreparationStatus';
 const COMPANION_PREPARE_METHOD = 'companion.prepare';
@@ -1141,6 +1145,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -6262,6 +6268,10 @@ function json(params) {
     });
     return jsonSchema;
 }
+
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
 var VIEW_BUDGET = {
   /** 节点树最大深度。 */
   maxDepth: 16,
@@ -7276,7 +7286,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.2-alpha.0';
+    : '0.9.2-alpha.2';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);
@@ -7869,6 +7879,12 @@ function createCloudModule(requester) {
             deleteCurrentUserEntry: (options) => requester.request(CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, options),
             getInfo: (options) => requester.request(CLOUD_LEADERBOARD_GET_INFO_METHOD, options),
         },
+        storage: {
+            getStorage: (key) => requester.request(CLOUD_STORAGE_GET_STORAGE_METHOD, { key }),
+            setStorage: (key, value) => requester.request(CLOUD_STORAGE_SET_STORAGE_METHOD, { key, value }),
+            removeItem: (key) => requester.request(CLOUD_STORAGE_REMOVE_ITEM_METHOD, { key }),
+            getKeys: () => requester.request(CLOUD_STORAGE_GET_KEYS_METHOD),
+        },
     };
 }
 
@@ -11479,7 +11495,7 @@ function installMiniDevConsoleForwarding(consoleRef = console) {
 
 let defaultSDK = createMiniProgramSDK();
 if (typeof false !== 'undefined' && false && typeof window !== 'undefined') {
-    window.__hbSdkSandboxList = async (path) => (await getDefaultSDK().files.sandbox.directory(path).list({ limit: 200 })).map(entry => ({ name: entry.name, kind: entry.kind }));
+    window.__hbSdkSandboxList = async (path) => (await getDefaultSDK().files.sandbox.directory(path).list({ limit: 200 })).map((entry) => ({ name: entry.name, kind: entry.kind }));
 }
 // 开发期调试台 console 捕获：双条件门控（vite serve 注入 define + 调试 iframe 标记），
 // 生产构建被死代码消除，正式环境无副作用。失败静默，绝不影响 SDK 初始化。
@@ -11902,6 +11918,12 @@ const cloud = {
         deleteCurrentUserEntry: (options) => getDefaultSDK().cloud.leaderboard.deleteCurrentUserEntry(options),
         getInfo: (options) => getDefaultSDK().cloud.leaderboard.getInfo(options),
     },
+    storage: {
+        getStorage: (key) => getDefaultSDK().cloud.storage.getStorage(key),
+        setStorage: (key, value) => getDefaultSDK().cloud.storage.setStorage(key, value),
+        removeItem: (key) => getDefaultSDK().cloud.storage.removeItem(key),
+        getKeys: () => getDefaultSDK().cloud.storage.getKeys(),
+    },
 };
 /** 默认 SDK 实例的受管桌面程序模块。 */
 const companion = {

package/dist/miniapp-publish.cjs.js

@@ -62,6 +62,16 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         methods: ['storage.getStorage', 'storage.setStorage'],
         conditions: ['仅用于简单键值存储，不包含文件系统。'],
     },
+    {
+        key: 'cloud_storage',
+        name: '云端存储',
+        description: '读写按小程序和当前登录用户隔离的云端键值数据。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['cloud.storage.getStorage', 'cloud.storage.setStorage', 'cloud.storage.removeItem', 'cloud.storage.getKeys'],
+        conditions: ['云端存储按登录用户隔离并受容量配额限制。'],
+    },
     {
         key: 'filesystem',
         name: '文件系统',
@@ -156,23 +166,6 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         ],
         conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
     },
-    {
-        "key": "cloud_storage",
-        "name": "云端存储",
-        "description": "读写按小程序和当前登录用户隔离的云端键值数据。",
-        "access": "declaration",
-        "risk": "medium",
-        "config": {},
-        "methods": [
-            "cloud.storage.getItem",
-            "cloud.storage.setItem",
-            "cloud.storage.removeItem",
-            "cloud.storage.getKeys"
-        ],
-        "conditions": [
-            "云端存储按登录用户隔离并受容量配额限制。"
-        ]
-    },
     {
         key: 'appProtocol',
         name: '应用协议执行',
@@ -263,6 +256,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -5385,6 +5380,10 @@ function json(params) {
     return jsonSchema;
 }
 
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
+
 // ../view-contract/src/schema.ts
 var VIEW_SCHEMA_VERSION = 1;
 var VIEW_BUDGET = {

package/dist/miniapp-publish.esm.js

@@ -60,6 +60,16 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         methods: ['storage.getStorage', 'storage.setStorage'],
         conditions: ['仅用于简单键值存储，不包含文件系统。'],
     },
+    {
+        key: 'cloud_storage',
+        name: '云端存储',
+        description: '读写按小程序和当前登录用户隔离的云端键值数据。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['cloud.storage.getStorage', 'cloud.storage.setStorage', 'cloud.storage.removeItem', 'cloud.storage.getKeys'],
+        conditions: ['云端存储按登录用户隔离并受容量配额限制。'],
+    },
     {
         key: 'filesystem',
         name: '文件系统',
@@ -154,23 +164,6 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         ],
         conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
     },
-    {
-        "key": "cloud_storage",
-        "name": "云端存储",
-        "description": "读写按小程序和当前登录用户隔离的云端键值数据。",
-        "access": "declaration",
-        "risk": "medium",
-        "config": {},
-        "methods": [
-            "cloud.storage.getItem",
-            "cloud.storage.setItem",
-            "cloud.storage.removeItem",
-            "cloud.storage.getKeys"
-        ],
-        "conditions": [
-            "云端存储按登录用户隔离并受容量配额限制。"
-        ]
-    },
     {
         key: 'appProtocol',
         name: '应用协议执行',
@@ -261,6 +254,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -5383,6 +5378,10 @@ function json(params) {
     return jsonSchema;
 }
 
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
+
 // ../view-contract/src/schema.ts
 var VIEW_SCHEMA_VERSION = 1;
 var VIEW_BUDGET = {

package/dist/protocol.cjs.js

@@ -76,6 +76,10 @@ const CLOUD_LEADERBOARD_GET_LIST_METHOD = 'cloud.leaderboard.getList';
 const CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.getCurrentUserEntry';
 const CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.deleteCurrentUserEntry';
 const CLOUD_LEADERBOARD_GET_INFO_METHOD = 'cloud.leaderboard.getInfo';
+const CLOUD_STORAGE_GET_STORAGE_METHOD = 'cloud.storage.getStorage';
+const CLOUD_STORAGE_SET_STORAGE_METHOD = 'cloud.storage.setStorage';
+const CLOUD_STORAGE_REMOVE_ITEM_METHOD = 'cloud.storage.removeItem';
+const CLOUD_STORAGE_GET_KEYS_METHOD = 'cloud.storage.getKeys';
 const COMPANION_GET_INFO_METHOD = 'companion.getInfo';
 const COMPANION_GET_PREPARATION_STATUS_METHOD = 'companion.getPreparationStatus';
 const COMPANION_PREPARE_METHOD = 'companion.prepare';
@@ -373,6 +377,34 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         requirement: { kind: 'all', permissions: ['leaderboard'] },
         risk: 'low',
     },
+    {
+        method: CLOUD_STORAGE_GET_STORAGE_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_GET_STORAGE_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'low',
+    },
+    {
+        method: CLOUD_STORAGE_SET_STORAGE_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_SET_STORAGE_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'medium',
+    },
+    {
+        method: CLOUD_STORAGE_REMOVE_ITEM_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_REMOVE_ITEM_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'medium',
+    },
+    {
+        method: CLOUD_STORAGE_GET_KEYS_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_GET_KEYS_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'low',
+    },
     ...[
         COMPANION_GET_INFO_METHOD,
         COMPANION_GET_PREPARATION_STATUS_METHOD,
@@ -1217,6 +1249,7 @@ const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(MINI_PROGRAM_PERMISSION_KEYS);
  * - `steamLibrary`
  * - `share`
  * - `storage`
+ * - `cloud_storage`
  * - `filesystem`
  * - `clipboard`
  * - `leaderboard`
@@ -1453,6 +1486,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -6574,6 +6609,10 @@ function json(params) {
     });
     return jsonSchema;
 }
+
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
 var VIEW_BUDGET = {
   /** 节点树最大深度。 */
   maxDepth: 16,
@@ -7188,6 +7227,10 @@ exports.CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = CLOUD_LEADERBOARD_GET_
 exports.CLOUD_LEADERBOARD_GET_INFO_METHOD = CLOUD_LEADERBOARD_GET_INFO_METHOD;
 exports.CLOUD_LEADERBOARD_GET_LIST_METHOD = CLOUD_LEADERBOARD_GET_LIST_METHOD;
 exports.CLOUD_LEADERBOARD_SUBMIT_METHOD = CLOUD_LEADERBOARD_SUBMIT_METHOD;
+exports.CLOUD_STORAGE_GET_KEYS_METHOD = CLOUD_STORAGE_GET_KEYS_METHOD;
+exports.CLOUD_STORAGE_GET_STORAGE_METHOD = CLOUD_STORAGE_GET_STORAGE_METHOD;
+exports.CLOUD_STORAGE_REMOVE_ITEM_METHOD = CLOUD_STORAGE_REMOVE_ITEM_METHOD;
+exports.CLOUD_STORAGE_SET_STORAGE_METHOD = CLOUD_STORAGE_SET_STORAGE_METHOD;
 exports.DEVICE_EXECUTE_PROTOCOL_METHOD = DEVICE_EXECUTE_PROTOCOL_METHOD;
 exports.DEVICE_SET_CLIPBOARD_METHOD = DEVICE_SET_CLIPBOARD_METHOD;
 exports.DEVICE_VIBRATE_METHOD = DEVICE_VIBRATE_METHOD;

package/dist/protocol.esm.js

@@ -74,6 +74,10 @@ const CLOUD_LEADERBOARD_GET_LIST_METHOD = 'cloud.leaderboard.getList';
 const CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.getCurrentUserEntry';
 const CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.deleteCurrentUserEntry';
 const CLOUD_LEADERBOARD_GET_INFO_METHOD = 'cloud.leaderboard.getInfo';
+const CLOUD_STORAGE_GET_STORAGE_METHOD = 'cloud.storage.getStorage';
+const CLOUD_STORAGE_SET_STORAGE_METHOD = 'cloud.storage.setStorage';
+const CLOUD_STORAGE_REMOVE_ITEM_METHOD = 'cloud.storage.removeItem';
+const CLOUD_STORAGE_GET_KEYS_METHOD = 'cloud.storage.getKeys';
 const COMPANION_GET_INFO_METHOD = 'companion.getInfo';
 const COMPANION_GET_PREPARATION_STATUS_METHOD = 'companion.getPreparationStatus';
 const COMPANION_PREPARE_METHOD = 'companion.prepare';
@@ -371,6 +375,34 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         requirement: { kind: 'all', permissions: ['leaderboard'] },
         risk: 'low',
     },
+    {
+        method: CLOUD_STORAGE_GET_STORAGE_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_GET_STORAGE_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'low',
+    },
+    {
+        method: CLOUD_STORAGE_SET_STORAGE_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_SET_STORAGE_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'medium',
+    },
+    {
+        method: CLOUD_STORAGE_REMOVE_ITEM_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_REMOVE_ITEM_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'medium',
+    },
+    {
+        method: CLOUD_STORAGE_GET_KEYS_METHOD,
+        module: 'cloud',
+        capability: CLOUD_STORAGE_GET_KEYS_METHOD,
+        requirement: { kind: 'all', permissions: ['cloud_storage'] },
+        risk: 'low',
+    },
     ...[
         COMPANION_GET_INFO_METHOD,
         COMPANION_GET_PREPARATION_STATUS_METHOD,
@@ -1215,6 +1247,7 @@ const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(MINI_PROGRAM_PERMISSION_KEYS);
  * - `steamLibrary`
  * - `share`
  * - `storage`
+ * - `cloud_storage`
  * - `filesystem`
  * - `clipboard`
  * - `leaderboard`
@@ -1451,6 +1484,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -6572,6 +6607,10 @@ function json(params) {
     });
     return jsonSchema;
 }
+
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
 var VIEW_BUDGET = {
   /** 节点树最大深度。 */
   maxDepth: 16,
@@ -7180,4 +7219,4 @@ object({
   regions: array(viewRegionSchema).max(VIEW_BUDGET.maxRegions)
 });
 
-export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_EXECUTE_PROTOCOL_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, DIRECTORY_CREATE_METHOD, DIRECTORY_EXISTS_METHOD, DIRECTORY_LIST_METHOD, DIRECTORY_REMOVE_METHOD, FILES_PICK_DIRECTORY_METHOD, FILES_PICK_FILES_METHOD, FILES_SAVE_FILE_METHOD, FILE_CREATE_METHOD, FILE_EXISTS_METHOD, FILE_READ_BYTES_METHOD, FILE_READ_TEXT_METHOD, FILE_REMOVE_METHOD, FILE_STAT_METHOD, FILE_WRITE_BYTES_METHOD, FILE_WRITE_TEXT_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_OPERATION_PROGRESS_METHOD, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_DOWNLOAD_METHOD, NETWORK_REQUEST_METHOD, NETWORK_UPLOAD_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_COPY_LINK_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_INFO_AUTHORIZATION_SCOPES, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_DISPLAY_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isMiniProgramByteArray, isMiniProgramDirectoryDescriptor, isMiniProgramDirectoryRef, isMiniProgramDownloadProgressPayload, isMiniProgramFileDescriptor, isMiniProgramFileRef, isMiniProgramFileStat, isMiniProgramFileSystemEntityDescriptor, isMiniProgramPathRootRef, isMiniProgramRelativePath, parseMiniProgramRuntimePermissions };
+export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, CLOUD_STORAGE_GET_KEYS_METHOD, CLOUD_STORAGE_GET_STORAGE_METHOD, CLOUD_STORAGE_REMOVE_ITEM_METHOD, CLOUD_STORAGE_SET_STORAGE_METHOD, DEVICE_EXECUTE_PROTOCOL_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, DIRECTORY_CREATE_METHOD, DIRECTORY_EXISTS_METHOD, DIRECTORY_LIST_METHOD, DIRECTORY_REMOVE_METHOD, FILES_PICK_DIRECTORY_METHOD, FILES_PICK_FILES_METHOD, FILES_SAVE_FILE_METHOD, FILE_CREATE_METHOD, FILE_EXISTS_METHOD, FILE_READ_BYTES_METHOD, FILE_READ_TEXT_METHOD, FILE_REMOVE_METHOD, FILE_STAT_METHOD, FILE_WRITE_BYTES_METHOD, FILE_WRITE_TEXT_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_OPERATION_PROGRESS_METHOD, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_DOWNLOAD_METHOD, NETWORK_REQUEST_METHOD, NETWORK_UPLOAD_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_COPY_LINK_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_INFO_AUTHORIZATION_SCOPES, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_DISPLAY_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isMiniProgramByteArray, isMiniProgramDirectoryDescriptor, isMiniProgramDirectoryRef, isMiniProgramDownloadProgressPayload, isMiniProgramFileDescriptor, isMiniProgramFileRef, isMiniProgramFileStat, isMiniProgramFileSystemEntityDescriptor, isMiniProgramPathRootRef, isMiniProgramRelativePath, parseMiniProgramRuntimePermissions };

package/dist/vite.cjs.js

@@ -91,6 +91,16 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         methods: ['storage.getStorage', 'storage.setStorage'],
         conditions: ['仅用于简单键值存储，不包含文件系统。'],
     },
+    {
+        key: 'cloud_storage',
+        name: '云端存储',
+        description: '读写按小程序和当前登录用户隔离的云端键值数据。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['cloud.storage.getStorage', 'cloud.storage.setStorage', 'cloud.storage.removeItem', 'cloud.storage.getKeys'],
+        conditions: ['云端存储按登录用户隔离并受容量配额限制。'],
+    },
     {
         key: 'filesystem',
         name: '文件系统',
@@ -185,23 +195,6 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         ],
         conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
     },
-    {
-        "key": "cloud_storage",
-        "name": "云端存储",
-        "description": "读写按小程序和当前登录用户隔离的云端键值数据。",
-        "access": "declaration",
-        "risk": "medium",
-        "config": {},
-        "methods": [
-            "cloud.storage.getItem",
-            "cloud.storage.setItem",
-            "cloud.storage.removeItem",
-            "cloud.storage.getKeys"
-        ],
-        "conditions": [
-            "云端存储按登录用户隔离并受容量配额限制。"
-        ]
-    },
     {
         key: 'appProtocol',
         name: '应用协议执行',
@@ -294,6 +287,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -5416,6 +5411,10 @@ function json(params) {
     return jsonSchema;
 }
 
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
+
 // ../view-contract/src/schema.ts
 var VIEW_SCHEMA_VERSION = 1;
 var VIEW_BUDGET = {
@@ -10282,7 +10281,7 @@ async function ensureBasicInfoDirectory(rootPath, relative) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.2-alpha.0';
+    : '0.9.2-alpha.2';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/dist/vite.esm.js

@@ -88,6 +88,16 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         methods: ['storage.getStorage', 'storage.setStorage'],
         conditions: ['仅用于简单键值存储，不包含文件系统。'],
     },
+    {
+        key: 'cloud_storage',
+        name: '云端存储',
+        description: '读写按小程序和当前登录用户隔离的云端键值数据。',
+        access: 'declaration',
+        risk: 'medium',
+        config: {},
+        methods: ['cloud.storage.getStorage', 'cloud.storage.setStorage', 'cloud.storage.removeItem', 'cloud.storage.getKeys'],
+        conditions: ['云端存储按登录用户隔离并受容量配额限制。'],
+    },
     {
         key: 'filesystem',
         name: '文件系统',
@@ -182,23 +192,6 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         ],
         conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
     },
-    {
-        "key": "cloud_storage",
-        "name": "云端存储",
-        "description": "读写按小程序和当前登录用户隔离的云端键值数据。",
-        "access": "declaration",
-        "risk": "medium",
-        "config": {},
-        "methods": [
-            "cloud.storage.getItem",
-            "cloud.storage.setItem",
-            "cloud.storage.removeItem",
-            "cloud.storage.getKeys"
-        ],
-        "conditions": [
-            "云端存储按登录用户隔离并受容量配额限制。"
-        ]
-    },
     {
         key: 'appProtocol',
         name: '应用协议执行',
@@ -291,6 +284,8 @@ class $ZodEncodeError extends Error {
 (_a$1 = globalThis).__zod_globalConfig ?? (_a$1.__zod_globalConfig = {});
 const globalConfig = globalThis.__zod_globalConfig;
 function config(newConfig) {
+    if (newConfig)
+        Object.assign(globalConfig, newConfig);
     return globalConfig;
 }
 
@@ -5413,6 +5408,10 @@ function json(params) {
     return jsonSchema;
 }
 
+// 必须先于 view-contract 的 schema 创建执行，避免能力试探本身触发 CSP 违规。
+// 合同包面向禁止动态执行的运行环境，始终使用解释式校验，不依赖宿主探测。
+config({ jitless: true });
+
 // ../view-contract/src/schema.ts
 var VIEW_SCHEMA_VERSION = 1;
 var VIEW_BUDGET = {
@@ -10279,7 +10278,7 @@ async function ensureBasicInfoDirectory(rootPath, relative) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.2-alpha.0';
+    : '0.9.2-alpha.2';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.9.2-alpha.0",
+  "version": "0.9.2-alpha.2",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -76,7 +76,7 @@
     "undici": "^7.28.0",
     "ws": "^8.18.0",
     "sharp": "^0.34.5",
-    "@heybox/hb-sdk-protocol": "0.9.2-alpha.0"
+    "@heybox/hb-sdk-protocol": "0.9.2-alpha.2"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -128,10 +128,10 @@
     "vitest": "^3.2.4",
     "@ai-desktop/view-contract": "file:../hb-sdk-protocol/vendor/view-contract-2.2.2-6ac49bbf6410.tgz",
     "rollup-plugin-dts": "6.4.0",
-    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
     "@heybox-domain/heybox-theme": "~0.1.0",
-    "@heybox/hb-sdk-runtime": "~0.9.2-alpha.0",
     "@heybox/hb-api": "~1.28.14",
+    "@heybox/hb-sdk-runtime": "~0.9.2-alpha.2",
+    "@heybox-domain/heybox-vue3-ui": "~0.1.0",
     "@heybox/runtime": "~0.2.1",
     "@heybox/runtime-policy": "~0.2.1",
     "@heybox/runtime-transport-fetch": "~0.2.1"
@@ -152,6 +152,7 @@
           "{projectRoot}/licenses/**/*",
           "{projectRoot}/THIRD_PARTY_NOTICES.md",
           "{projectRoot}/rollup.config.ts",
+          "{projectRoot}/scripts/check-csp-startup.mjs",
           "{projectRoot}/tsconfig*.json",
           "{workspaceRoot}/packages/hb-sdk-runtime/src/**/*",
           "{workspaceRoot}/packages/hb-sdk-runtime/package.json",
@@ -175,13 +176,14 @@
     "build:hb-api-contract": "pnpm --dir ../hb-api run build:lib",
     "build:hb-sdk-protocol": "pnpm --filter @heybox/hb-sdk-protocol run build:package",
     "build:lib": "pnpm run build:lib:bundle",
-    "build:lib:bundle": "node scripts/check-workspace-builds.cjs && rollup -c rollup.config.ts  --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}'",
+    "build:lib:bundle": "node scripts/check-workspace-builds.cjs && rollup -c rollup.config.ts  --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}' && pnpm run check:csp-startup",
     "build:cli": "pnpm run build:cli:bundle",
     "build:cli:bundle": "node scripts/check-workspace-builds.cjs && rollup -c rollup.config.ts --environment HB_SDK_BUILD:cli --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}' && pnpm run build:browser-dev-host",
     "build:browser-dev-host": "vite build --config vite.browser-dev-host.config.ts && node scripts/check-browser-dev-host-assets.cjs && node scripts/generate-browser-dev-host-notices.cjs",
     "build:templates": "node scripts/copy-cli-templates.cjs",
     "build:types": "tsc -p tsconfig.dts.json && node ../hb-sdk-protocol/scripts/bundle-declarations.mjs",
     "check:boundary": "node scripts/check-boundary.cjs",
+    "check:csp-startup": "node scripts/check-csp-startup.mjs",
     "check:docs-sync": "pnpm --filter @heybox-docs/docs-hb_sdk run check:reference && node scripts/skill/generate-manifest.mjs --check && node scripts/skill/validate-skill.mjs",
     "check:compatibility-evidence": "node scripts/validate-compatibility-evidence.mjs",
     "check:api-semver": "node ../../ops/jobs/hb-sdk-docs-contract/semantic-diff.cjs",

package/skill/skill.json

@@ -1,15 +1,15 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.9.2-alpha.0+skill.c3a240ca503a",
+  "skillVersion": "0.9.2-alpha.2+skill.c3a240ca503a",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.9.2-alpha.0",
-    "compatibility": "0.9.2-alpha.0"
+    "version": "0.9.2-alpha.2",
+    "compatibility": "0.9.2-alpha.2"
   },
   "distribution": {
     "type": "npm",
     "package": "@heybox/hb-sdk",
-    "version": "0.9.2-alpha.0",
+    "version": "0.9.2-alpha.2",
     "path": "skill"
   },
   "integrity": "sha256-c3a240ca503a1e5f3b15033e091f1fa79a8b70585aa0d8d8fa0b332daec60ac5"