@skillbuilder/miniapp-simulator 0.0.0-beta-20261023084421 → 0.2.0

package/lib/remote-client.js

@@ -1,6 +1,6 @@
-import { R as r, a as O, c as e } from "./client-BZtD2VtP.mjs";
+import { R as r, a as O, c as e } from "./client-CO-UjIY3.mjs";
 import { B as s, M as _ } from "./business-line-CMb3ehRn.mjs";
-import { M } from "./index-BW85h7kT.mjs";
+import { M } from "./index-B5oixYXr.mjs";
 export {
   s as BusinessLine,
   _ as MINIAPP_SCREENSHOT_ERROR_CODE,

package/lib/types/capabilities/constants.d.ts

@@ -4,6 +4,7 @@ import type { CspDirective } from "../types";
  *
  * - 资源类（script/style/img/font/media）：按资源类型配置 `'self'`、`data:`、`blob:`。
  * - 请求类（connect-src）：仅 `'self'`，消费方按需增加接口域名。
+ * - worker-src：默认关闭，Worker 开关启用时允许同源资源。
  * - `base-uri`：仅 `'self'`（跨域远程入口的 `<base href>` 由构建时内部补入口 origin）。
  * - `'none'` 四项：禁插件 / 禁表单外发 / 禁子 frame，锁死。
  */

package/lib/types/capabilities/csp-snippet.d.ts

@@ -1,5 +1,7 @@
 import type { CspDirective } from "../types";
 export interface BuildContentSecurityPolicyOptions {
+    /** 当前包会话是否开放 Worker；资源响应层负责下发 Worker CSP。 */
+    workerEnabled?: boolean;
     /**
      * 合并后的逐指令 token 表（来自 normalized `security.cspDirectives`）。
      * 缺省时用内部默认表。

package/lib/types/capabilities/security-head-snippet.d.ts

@@ -1,5 +1,6 @@
 import { type MiniAppCapability } from "../seal-config";
 import type { CspDirective } from "../types";
+import type { WorkerGuardConfig } from "../worker/adapters/protocol";
 export interface BuildSecurityMetaSnippetOptions {
     /** 已解析的 Permissions-Policy meta 内容串（来自 normalized security.permissionsPolicy）。 */
     permissionsPolicy?: string;
@@ -16,5 +17,5 @@ export interface BuildSecurityMetaSnippetOptions {
 }
 /** 安全 meta：Permissions-Policy → CSP（`csp:false` 时不出，改走响应头）。 */
 export declare function buildSecurityMetaSnippet(options?: BuildSecurityMetaSnippetOptions): string;
-/** seal 裸源：seal config（可选，早于 IIFE）+ seal IIFE。 */
-export declare function buildSealScriptSource(sealAllow?: ReadonlyArray<MiniAppCapability>): string;
+/** seal 裸源：宿主配置（早于 IIFE）+ 静态 seal 文件 + Worker 生命周期接线。 */
+export declare function buildSealScriptSource(sealAllow?: ReadonlyArray<MiniAppCapability>, workerContext?: WorkerGuardConfig): string;

package/lib/types/index.d.ts

@@ -2,10 +2,16 @@ export { createMiniAppSimulator } from "./core/simulator";
 export { BusinessLine } from "./business-line";
 export { MiniAppSimulatorError } from "./errors";
 export { MiniAppJsApiErrorCode } from "./types";
+export { WORKER_CONTENT_SECURITY_POLICY } from "./worker/adapters/protocol";
+export type { WorkerGuardConfig } from "./worker/adapters/protocol";
+export declare const WORKER_RUNTIME_METADATA: Readonly<import("./worker/adapters/protocol").WorkerRuntimeMetadata>;
+export { WORKER_RUNTIME_PROTOCOL_VERSION } from "./worker/adapters/protocol";
+export type { MiniAppWorkerOptions } from "./worker/adapters/package-policy";
+export type { WorkerCspPolicy } from "./worker/adapters/csp-policy";
 export { detectEnvironment, getSimulatorContext, type SimulatorEnvironment, type SimulatorRuntimeContext, } from "./runtime/context";
 /**
  * 设备能力白名单枚举与元数据，供 `security.sealAllow` 配置 / UI 枚举渲染 / 校验。
- * 由本包自维护（`./seal-config`），此处转出方便消费方一处引入。
+ * 由模拟器维护，供消费方一处引入。
  */
 export { ALL_MINI_APP_CAPABILITIES, HOST_CONTROLLED_CAPABILITIES, MINI_APP_CAPABILITIES, MiniAppCapability, type MiniAppCapabilityControlledBy, type MiniAppCapabilityDescriptor, SEAL_CONTROLLED_CAPABILITIES, isMiniAppCapability, sanitizeCapabilityList, } from "./seal-config";
 export type { 
@@ -47,3 +53,4 @@ MiniAppTrackerInput, MiniAppTrackerOptions, MiniAppDefaultTrackerOptions, MiniAp
 export { buildElementSelection, computeSelector } from "./inspector";
 /** `screenShot` 失败码常量（notLoaded / renderFailed / timeout / unsupported） */
 export { MINIAPP_SCREENSHOT_ERROR_CODE } from "./types";
+export type { WorkerTerminateFlag, WorkerTerminateCallback, WorkerRuntimeState, } from "./worker/adapters/protocol";

package/lib/types/injection/types.d.ts

@@ -12,6 +12,8 @@
  */
 import type { NormalizedMiniAppSimulatorOptions } from "../types";
 export interface InjectionContext {
+    /** 资源宿主已按当前包校验的 Worker 准入配置。 */
+    workerGuard?: import("../worker/adapters/protocol").WorkerGuardConfig;
     /** 当前渲染介质 */
     rendererType: "iframe" | "webview";
     /** 归一化后的 simulator options（供模块按需读取 jsapi/security 等配置） */

package/lib/types/remote/protocol.d.ts

@@ -1,6 +1,6 @@
 import type { BusinessLine } from "../business-line";
 import type { ManagedRequestChunk, ManagedRequestHeaders, ManagedRequestOptions, ManagedRequestResult } from "../runtime/request/request-types";
-import type { MiniAppContentMode, MiniAppFileMap, MiniAppHostApiRequest, MiniAppInspectorSelectionMode, MiniAppLoadFilesOptions, MiniAppLoadZipOptions, MiniAppRedirectOptions, MiniAppSimulatorOptions, MiniAppSimulatorRoute, MiniAppViewport } from "../types";
+import type { MiniAppContentMode, MiniAppFileMap, MiniAppHostApiRequest, MiniAppInspectorSelectionMode, MiniAppLoadFilesOptions, MiniAppLoadZipOptions, MiniAppRedirectOptions, MiniAppSecurityOptions, MiniAppSimulatorOptions, MiniAppSimulatorRoute, MiniAppViewport } from "../types";
 /**
  * 远程模拟器通信协议版本。单一来源是同目录的 protocol-version.json，
  * 发布脚本（scripts/publish-assets.mjs）、server dev 接口与压测脚本都从该文件读取。
@@ -12,6 +12,8 @@ export declare const REMOTE_INSPECTOR_PAUSE_RUNTIME_CAPABILITY = "inspectorPause
 export declare const REMOTE_SIMULATOR_CAPABILITIES: string[];
 export type RemoteSimulatorSerializableOptions = Omit<MiniAppSimulatorOptions, "mount" | "appId" | "renderer" | "serviceWorker" | "security" | "jsapi" | "hostApi" | "tracker" | "runtimeLimits" | "onEvent" | "onReady" | "onBeforeLoad" | "onLoad" | "onRenderDone" | "onError" | "onNavigation" | "onConsole" | "onNetwork" | "onDestroy" | "onRouterChange" | "onScreenShot"> & {
     appUrl?: string;
+    /** 包会话 Worker 开关；Worker CSP 由 Runtime 服务配置。 */
+    security?: Pick<MiniAppSecurityOptions, "worker">;
 };
 export interface RemoteSimulatorGatewayOptions {
     edith: string;
@@ -107,7 +109,10 @@ export interface RemoteHostRequestEventMessage {
     event: "headers" | "chunk";
     payload: ManagedRequestHeaders | ManagedRequestChunk;
 }
-export type RemoteSimulatorPortMessage = RemoteSimulatorReadyMessage | RemoteSimulatorRequestMessage | RemoteSimulatorResponseMessage | RemoteSimulatorEventMessage | RemoteHostApiRequestMessage | RemoteHostApiResponseMessage | RemoteHostRequestMessage | RemoteHostRequestResponseMessage | RemoteHostRequestAbortMessage | RemoteHostRequestEventMessage;
+export type RemoteSimulatorPortMessage = {
+    type: "worker-visibility";
+    visible: boolean;
+} | RemoteSimulatorReadyMessage | RemoteSimulatorRequestMessage | RemoteSimulatorResponseMessage | RemoteSimulatorEventMessage | RemoteHostApiRequestMessage | RemoteHostApiResponseMessage | RemoteHostRequestMessage | RemoteHostRequestResponseMessage | RemoteHostRequestAbortMessage | RemoteHostRequestEventMessage;
 export type RemoteSimulatorMethod = "load" | "loadZip" | "loadFiles" | "loadApp" | "unload" | "reload" | "setViewport" | "switchContentMode" | "switchPhoneFrame" | "switchDevice" | "setTouchEmulation" | "permissionSheet.show" | "permissionSheet.hide" | "notePreview.update" | "notePreview.updateUser" | "notePreview.updateAppCard" | "widgetCover.update" | "router.redirectTo" | "router.getRoute" | "inspector.enable" | "inspector.disable" | "inspector.toggle" | "inspector.clear" | "inspector.setSelectionMode" | "inspector.getSelectionMode" | "inspector.getSceneTree" | "inspector.selectByRef" | "capture" | "screenShot" | "setAutoScreenShot" | "hostApi.sync" | "hostApi.emit" | "destroy";
 export interface RemoteLoadZipArgs {
     buffer: ArrayBuffer;

package/lib/types/renderer/content-host/iframe-content-host.d.ts

@@ -12,6 +12,7 @@ export declare class IframeContentHost implements ContentHost {
     private iframe;
     protected readonly ctx: ContentHostContext;
     private currentUrl;
+    private detachWorkerLifecycle?;
     private loadStartedAt;
     private renderDoneEmitted;
     private gestureBus;

package/lib/types/sw/protocol.d.ts

@@ -1,5 +1,7 @@
 /** Runtime 与 Service Worker 随同一 release 发布，协议版本必须精确一致。 */
-export declare const SERVICE_WORKER_PROTOCOL_VERSION = 3;
+export declare const SERVICE_WORKER_PROTOCOL_VERSION = 5;
+/** 资源 SW 重启后，向持有包快照的可信宿主请求恢复 Worker 挂载。 */
+export declare const SW_WORKER_MOUNT_RECOVERY = "miniapp:restore-worker-mount";
 /** 当前 Service Worker 提供的文件系统操作。 */
 export declare const SW_FS_OPS: readonly ["fsWriteTempFile", "fsSaveFile", "fsWriteFile", "fsAppendFile", "fsReadFile", "fsReadDir", "fsStatFile", "fsUnlink", "fsMkdir", "fsGetStorageInfo"];
 export type ServiceWorkerFileSystemOperation = (typeof SW_FS_OPS)[number];

package/lib/types/sw/served-entry.d.ts

@@ -6,4 +6,4 @@ export interface SwInjectionPayload {
     /** SW 响应头下发的 CSP。 */
     csp: string;
 }
-export declare function buildSwInjectionPayload(options: NormalizedMiniAppSimulatorOptions, injection: InjectionRegistry, appUrl: string, rawHtml: string, extraOrigins?: string[], frameAncestors?: string[], userDataPath?: string, gateways?: Record<string, string>, businessLine?: string): Promise<SwInjectionPayload>;
+export declare function buildSwInjectionPayload(options: NormalizedMiniAppSimulatorOptions, injection: InjectionRegistry, appUrl: string, rawHtml: string, extraOrigins?: string[], frameAncestors?: string[], userDataPath?: string, gateways?: Record<string, string>, businessLine?: string, workerGuard?: import("../worker/adapters/protocol").WorkerGuardConfig): Promise<SwInjectionPayload>;

package/lib/types/sw/service-worker-host.d.ts

@@ -8,6 +8,7 @@ import { type ServiceWorkerFileSystemArgs, type ServiceWorkerFileSystemOperation
 /** 是否具备启用 SW 模式的运行环境（API 可用 + 安全上下文）。 */
 export declare function isServiceWorkerHostSupported(): boolean;
 export interface ServiceWorkerMountInput {
+    worker?: import("../worker/adapters/package-policy").WorkerMountPolicy;
     id: string;
     /** 入口文件包内路径（如 `index.html`），用于生成虚拟 URL。 */
     entryPath: string;

package/lib/types/sw/worker/globals.d.ts

@@ -25,6 +25,7 @@ export interface SwFetchEvent {
 export interface SwClient {
     id: string;
     url: string;
+    postMessage(message: unknown, transfer: Transferable[]): void;
 }
 export interface SwClients {
     claim(): Promise<void>;

package/lib/types/sw/worker/mount-store.d.ts

@@ -2,11 +2,15 @@
  * 挂载表 —— id → 已挂载小工具实例。多预览实例 / 多 iframe 共用一个 SW，按 id 前缀隔离。
  * 负责 MOUNT/UNMOUNT 的存储，以及请求路径 → 实例的两级归属查找（`/<id>/` 标记 + clientId 反查）。
  */
+import type { WorkerMountPolicy } from "../../worker/adapters/package-policy";
 export interface MountedFile {
     bytes: ArrayBuffer;
     mime: string;
 }
 export interface MountedApp {
+    worker?: WorkerMountPolicy;
+    /** 以包内文件路径为键缓存原始字节及独立 CSP 响应。 */
+    workerResponses: Map<string, Response>;
     files: Map<string, MountedFile>;
     /** 注入到 HTML `<head>` 的片段（seal/jsapi/render-done 等）。 */
     injectHead: string;
@@ -21,6 +25,7 @@ export interface MountedApp {
 }
 export declare const STORE: Map<string, MountedApp>;
 export interface MountInput {
+    worker?: WorkerMountPolicy;
     id: string;
     files: Record<string, ArrayBuffer>;
     injectHead: string;

package/lib/types/types/options.d.ts

@@ -160,6 +160,10 @@ export type CspDirective = 'default-src' | 'script-src' | 'style-src' | 'img-src
  * 增一项 / 删默认项（详见各字段）。取值有效的键按各自分隔符拼接成最终串。
  */
 export interface MiniAppSecurityOptions {
+    /** Worker 入口响应 CSP 覆盖，独立于页面 CSP；未配置的指令沿用内置值。 */
+    workerCsp?: import("../worker/adapters/csp-policy").WorkerCspPolicy;
+    /** 包会话 Worker 开关；网络由 Worker 脚本响应 CSP 控制。 */
+    worker?: import("../worker/adapters/package-policy").MiniAppWorkerOptions;
     /**
      * iframe `sandbox` 标志表（`token → boolean`）。
      * 默认 `allow-scripts/allow-forms/allow-modals/allow-downloads/allow-same-origin`。
@@ -179,7 +183,8 @@ export interface MiniAppSecurityOptions {
     permissionsPolicy?: Record<string, boolean | string | string[]>;
     /**
      * CSP 逐指令 token 表覆盖：`{ 'connect-src': { 'https://cdn.jsdelivr.net': true }, 'img-src': { 'data:': false } }`。
-     * `true` 加一个源/关键字，`false` 删掉某个默认 token。`'none'` 那几个指令锁死，忽略此处输入。
+     * `true` 加一个源/关键字，`false` 删掉某个默认 token。锁定指令忽略此处输入；
+     * worker-src 由 security.worker 开关控制，开放时允许同源资源。
      */
     cspDirectives?: Partial<Record<CspDirective, Record<string, boolean>>>;
     /**
@@ -193,6 +198,8 @@ export interface MiniAppSecurityOptions {
  * 最终串（sandbox 属性 / iframe allow / permissions-policy / CSP）在消费处按需序列化。
  */
 export interface NormalizedMiniAppSecurityOptions {
+    workerCsp?: import("../worker/adapters/csp-policy").WorkerCspPolicy;
+    worker?: import("../worker/adapters/package-policy").MiniAppWorkerOptions;
     /** 合并后的 iframe `sandbox` 标志表（取值 `true` 的 flag 序列化为 sandbox 属性） */
     sandbox: Record<string, boolean>;
     /** 合并后的 iframe `allow` 表（feature → allowlist） */

package/lib/types/workbench/server/index.d.ts

@@ -3,7 +3,7 @@ export { BusinessLine } from "../../business-line";
 export interface StartWorkbenchServerOptions {
     /** 包含可运行 HTML 及静态资源的调试根目录。 */
     rootDir: string;
-    /** 接入方可提供真实运行上下文；省略时连接 Beta Simulator 服务。 */
+    /** 接入方可提供真实运行上下文；省略时连接正式 Simulator 服务。 */
     remote?: {
         serviceUrl?: string;
         appId?: string;

package/lib/types/worker/adapters/csp-policy.d.ts

@@ -0,0 +1,7 @@
+declare const DIRECTIVES: readonly ["default-src", "script-src", "connect-src", "worker-src", "child-src"];
+export type WorkerCspPolicy = Partial<Record<(typeof DIRECTIVES)[number], string>>;
+/** Apollo 与本地配置共用；非法配置整体回退，不产生部分放开的策略。 */
+export declare function parseWorkerCspPolicy(input: unknown): WorkerCspPolicy | undefined;
+/** 缺失字段沿用内置值；每个 directive 的配置值完整替换该项。 */
+export declare function resolveWorkerContentSecurityPolicy(input: unknown): string;
+export {};

package/lib/types/worker/adapters/host-lifecycle.d.ts

@@ -0,0 +1,5 @@
+/** 仅由 Runtime 已建立的私有 MessagePort 更新外层宿主可见性。 */
+export declare function updateWorkerHostVisibility(visible: boolean): void;
+export declare function observeWorkerHostVisibility(element: HTMLElement, notify: (visible: boolean) => void): () => void;
+/** 宿主文档与容器 CSS 可见性接线；会话握手避免消息早于页面封印安装而丢失。 */
+export declare function attachWorkerHostLifecycle(iframe: HTMLIFrameElement, getUrl: () => string): () => void;

package/lib/types/worker/adapters/mount-recovery.d.ts

@@ -0,0 +1,2 @@
+/** 资源 SW 内存丢失时恢复宿主包快照；恢复后仍需校验请求所属会话。 */
+export declare function recoverWorkerMount(request: Request, clientId: string): Promise<void>;

package/lib/types/worker/adapters/package-policy.d.ts

@@ -0,0 +1,12 @@
+import type { WorkerCspPolicy } from "./csp-policy";
+import type { WorkerGuardConfig } from "./protocol";
+export interface MiniAppWorkerOptions {
+    /** 仅 loadZip/loadFiles 的包内 classic Worker 可启用，默认 false。 */
+    enabled?: boolean;
+}
+/** 随 MOUNT 发送给资源 Service Worker 的会话策略。 */
+export interface WorkerMountPolicy {
+    sessionId: string;
+    csp?: WorkerCspPolicy;
+}
+export declare function createPackageWorkerConfig(options: MiniAppWorkerOptions | undefined, sessionId: string): WorkerGuardConfig | undefined;

package/lib/types/worker/adapters/page-lifecycle.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/worker/adapters/protocol.d.ts

@@ -0,0 +1,49 @@
+/** 宿主在业务代码前提供本次页面会话的 Worker 配置。 */
+export interface WorkerGuardConfig {
+    protocolVersion: number;
+    sessionId: string;
+    enabled: boolean;
+    /** 宿主初始可见性；默认 visible，与 document.hidden 共同判断。 */
+    initialState?: "visible" | "hidden";
+}
+export interface WorkerRuntimeMetadata {
+    readonly name: string;
+    readonly version: string;
+    readonly protocolVersion: number;
+    readonly workerCsp: string;
+}
+/** 模拟器维护的安全脚本接入协议；与资源 Service Worker 协议独立。 */
+export declare const WORKER_RUNTIME_METADATA: WorkerRuntimeMetadata;
+export declare const WORKER_RUNTIME_PROTOCOL_VERSION: number;
+export declare const WORKER_CONTENT_SECURITY_POLICY: string;
+export declare const WORKER_BACKGROUND_TIMEOUT_MS = 30000;
+export type WorkerTerminateFlag = "主动" | "system";
+export type WorkerTerminateCallback = (flag: WorkerTerminateFlag) => void;
+export interface WorkerRuntimeState {
+    readonly protocolVersion: number;
+    readonly sessionId: string;
+    readonly enabled: boolean;
+    readonly maxWorkers: number;
+    readonly state: "visible" | "hidden" | "destroyed";
+    readonly recycled: boolean;
+}
+export interface WorkerGuardController {
+    readonly supported: boolean;
+    readonly context: WorkerRuntimeState;
+    updateVisibility(visible: boolean): void;
+    reclaim(): void;
+    destroy(): void;
+}
+declare global {
+    interface Worker {
+        /** 平台终止通知；浏览器/系统直接结束进程及 self.close 不保证可观测。 */
+        onTerminate(callback: WorkerTerminateCallback): void;
+        offTerminate(callback?: WorkerTerminateCallback): void;
+    }
+    interface Window {
+        /** 宿主在安全脚本前注入的 Worker 配置，只读、同一页面会话固定。 */
+        readonly __MINITOOL_WORKER_CONTEXT__?: Readonly<WorkerGuardConfig>;
+        /** 运行时输出；业务只读，不能作为控制入口。 */
+        readonly __MINITOOL_WORKER_STATE__: WorkerRuntimeState;
+    }
+}

package/lib/types/worker/adapters/scripts.d.ts

@@ -0,0 +1,2 @@
+/** 在私有闭包中连接安全脚本返回的 Worker 控制器与模拟器宿主消息通道。 */
+export declare function buildWorkerLifecycleScript(sealSource: string): string;

package/lib/types/worker/adapters/service-worker.d.ts

@@ -0,0 +1,2 @@
+/** 为当前包页面的 Worker 请求返回原始文件与 CSP，保持实例间资源隔离。 */
+export declare function serveWorkerRequest(request: Request, clientId: string): Promise<Response>;

package/lib/workbench-server.mjs

@@ -8,7 +8,7 @@ import { send as S } from "@koa/send";
 import F from "koa";
 import { PassThrough as _ } from "node:stream";
 import { watch as L } from "chokidar";
-const O = "https://miniapp-sandbox.beta.xiaohongshu.com/simulator/";
+const O = "https://miniapp-sandbox.xiaohongshu.com/simulator/";
 var b = /* @__PURE__ */ ((e) => (e.skillDesignable = "skill-designable", e.creator = "creator", e.mars = "mars", e.dev = "dev", e))(b || {});
 function C(e, t) {
   const s = e.filter(

package/lib/workbench.js

@@ -1,4 +1,4 @@
-import { c as Mn } from "./client-BZtD2VtP.mjs";
+import { c as Mn } from "./client-CO-UjIY3.mjs";
 function Sn(a, i) {
   const e = /* @__PURE__ */ new Map();
   let v = 0, l = !1, w, b, L, m, u;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillbuilder/miniapp-simulator",
-  "version": "0.0.0-beta-20261023084421",
+  "version": "0.2.0",
   "description": "Designable Miniapp Simulator - 技术栈无关的小应用 PC 预览与审核模拟器 SDK",
   "main": "lib/index.js",
   "module": "lib/index.js",