@heybox/hb-sdk 0.6.9 → 0.7.0-alpha.1

package/dist/devtools/mock-host/main.js

@@ -1,7 +1,7 @@
 /** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 /** 小程序沙盒通信协议版本。 */
-const MINI_PROGRAM_MESSAGE_VERSION = 1;
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
 /** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 /** SDK 向 Runtime 报告 CSP 违规的内部方法名。 */
@@ -59,29 +59,97 @@ function isRecord$3(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
+const OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS = [
+    'xiaoheihe.cn',
+    'max-c.com',
+    'debugmode.cn',
+    'maxjia.com',
+];
+/** Runtime / Host 在 `network.request` 分发前拒绝的小程序服务端私有路径前缀。 */
+const MINI_PROGRAM_NETWORK_PROTECTED_PATHS = [
+    '/user_miniprogram/runtime/auth',
+    '/user_miniprogram/openapi/v1',
+];
+const NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS = 4;
+/** 使用 URL 解析后的 hostname 判断黑盒官方根域及其子域。 */
+function isOfficialMiniProgramNetworkUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            return false;
+        }
+        const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+        return OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+    }
+    catch {
+        return false;
+    }
+}
 /**
- * 登录授权能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
+ * 规范化并判断 pathname 是否命中 Runtime Auth / OpenAPI 保护前缀。
+ * 解码失败或仍可继续解码时视为不安全路径。
  */
-const AUTH_LOGIN_METHOD = 'auth.login';
+function isProtectedMiniProgramNetworkPath(pathname) {
+    const normalized = normalizeMiniProgramNetworkPathname(pathname);
+    if (normalized === null) {
+        return true;
+    }
+    return MINI_PROGRAM_NETWORK_PROTECTED_PATHS.some(prefix => normalized === prefix || normalized.startsWith(`${prefix}/`));
+}
+function normalizeMiniProgramNetworkPathname(pathname) {
+    let decoded = pathname;
+    for (let round = 0; round < NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS; round += 1) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return null;
+        }
+        if (next === decoded) {
+            return normalizeDecodedNetworkPathname(decoded);
+        }
+        decoded = next;
+    }
+    try {
+        if (decodeURIComponent(decoded) !== decoded) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return normalizeDecodedNetworkPathname(decoded);
+}
+function normalizeDecodedNetworkPathname(decoded) {
+    const segments = [];
+    for (const segment of decoded.replace(/\\/g, '/').split('/')) {
+        if (!segment || segment === '.') {
+            continue;
+        }
+        if (segment === '..') {
+            segments.pop();
+            continue;
+        }
+        segments.push(segment);
+    }
+    return `/${segments.join('/')}`;
+}
+
 /**
- * 用户信息能力方法名。
+ * 登录授权能力方法名。
  *
  * @remarks
  * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
  */
+const AUTH_LOGIN_METHOD = 'auth.login';
+/** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 当前用户展示详情能力方法名。 */
-const USER_GET_CURRENT_USER_DETAIL_METHOD = 'user.getCurrentUserDetail';
-/** 当前用户敏感资料详情能力方法名。 */
-const USER_GET_CURRENT_USER_PROFILE_METHOD = 'user.getCurrentUserProfile';
-/** 当前用户平台账号概览能力方法名。 */
-const USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD = 'user.getPlatformAccountOverview';
-/** 当前用户指定平台账号详情能力方法名。 */
-const USER_GET_PLATFORM_ACCOUNT_INFO_METHOD = 'user.getPlatformAccountInfo';
-/** 当前用户 Steam 游戏库能力方法名。 */
+/** 读取当前用户小程序隔离身份的 bridge method 标识。 */
+const USER_GET_LOCAL_IDENTITY_METHOD = 'user.getLocalIdentity';
+/** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
+const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
+/** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
 const USER_GET_STEAM_GAME_LIST_METHOD = 'user.getSteamGameList';
 /**
  * 展示分享面板能力方法名。
@@ -180,38 +248,24 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         risk: 'medium',
     },
     {
-        method: USER_GET_CURRENT_USER_DETAIL_METHOD,
+        method: USER_GET_LOCAL_IDENTITY_METHOD,
         module: 'user',
-        capability: USER_GET_CURRENT_USER_DETAIL_METHOD,
-        permission: 'user.currentUserDetail',
-        risk: 'high',
-    },
-    {
-        method: USER_GET_CURRENT_USER_PROFILE_METHOD,
-        module: 'user',
-        capability: USER_GET_CURRENT_USER_PROFILE_METHOD,
-        permission: 'user.currentUserProfile',
-        risk: 'high',
-    },
-    {
-        method: USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD,
-        module: 'user',
-        capability: USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD,
-        permission: 'user.platformAccount.overview',
+        capability: USER_GET_LOCAL_IDENTITY_METHOD,
+        permission: 'user.getLocalIdentity',
         risk: 'medium',
     },
     {
-        method: USER_GET_PLATFORM_ACCOUNT_INFO_METHOD,
+        method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
-        capability: USER_GET_PLATFORM_ACCOUNT_INFO_METHOD,
-        permission: 'user.platformAccount.info',
+        capability: USER_REVOKE_AUTHORIZATION_METHOD,
+        permission: 'user.revokeAuthorization',
         risk: 'high',
     },
     {
         method: USER_GET_STEAM_GAME_LIST_METHOD,
         module: 'user',
         capability: USER_GET_STEAM_GAME_LIST_METHOD,
-        permission: 'user.steamGameList',
+        permission: 'user.platformAccount.steam',
         risk: 'high',
     },
     {
@@ -3587,35 +3641,6 @@ function cloneDefaultPermissionState() {
     };
 }
 
-async function getMiniProgramRuntimeUserInfo(platformAdapter) {
-    const userId = await resolveCurrentUserId(platformAdapter);
-    if (!userId) {
-        return {
-            isLogin: false,
-            userInfo: null,
-        };
-    }
-    const result = await platformAdapter.user.getUserBasicInfo(userId);
-    return {
-        isLogin: true,
-        userInfo: {
-            heybox_id: userId,
-            nickname: result?.nickname || '',
-            avatar: result?.avatar || '',
-        },
-    };
-}
-function resolveCurrentUserId(platformAdapter) {
-    return platformAdapter.auth.getCurrentUserId()
-        .then(userId => (userId ? String(userId) : ''))
-        .catch(() => '');
-}
-
-async function loginAndGetMiniProgramRuntimeUserInfo(platformAdapter) {
-    await platformAdapter.auth.login();
-    return getMiniProgramRuntimeUserInfo(platformAdapter);
-}
-
 const DEFAULT_STORAGE_KEY_MAX_LENGTH = 128;
 const STORAGE_KEY_CHAR_RE = /^[A-Za-z0-9_-]+$/;
 function createMiniProgramRuntimeBridgeError(code, message, data) {
@@ -3929,7 +3954,7 @@ function createLeaderboardReadStore() {
         });
     }
     function isBucketEmpty(bucketKey, bucket) {
-        return !hasInflight(bucketKey) && Object.values(bucket.caches).every(cache => cache.size === 0);
+        return !hasInflight(bucketKey) && Object.values(bucket.caches).every((cache) => cache.size === 0);
     }
     function hasInflight(bucketKey) {
         for (const entry of inflight.values()) {
@@ -3983,7 +4008,7 @@ function readLeaderboardPayload(payload, methodName, shape) {
 }
 function assertLeaderboardEntry(value, methodName) {
     assertMiniProgramRuntimeRecord(value, `${methodName} 返回的 entry 必须是对象`);
-    const { rank, ranked, userId, score, extra, createdAt, updatedAt } = value;
+    const { rank, ranked, appUserId, score, extra, createdAt, updatedAt } = value;
     if (typeof ranked !== 'boolean') {
         throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', `${methodName} 返回的 ranked 必须是布尔值`);
     }
@@ -3991,8 +4016,8 @@ function assertLeaderboardEntry(value, methodName) {
     if (!validRank) {
         throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', `${methodName} 返回的 rank/ranked 不合法`);
     }
-    if (typeof userId !== 'string' || !userId) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', `${methodName} 返回的 userId 必须是非空字符串`);
+    if (typeof appUserId !== 'string' || !appUserId) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', `${methodName} 返回的 appUserId 必须是非空字符串`);
     }
     if (typeof score !== 'number' || !Number.isFinite(score)) {
         throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', `${methodName} 返回的 score 必须是有限数字`);
@@ -4058,6 +4083,57 @@ function readLeaderboardCursor(value) {
     return value;
 }
 
+const VALID_LOGIN_SCOPES = new Set(['identity', 'profile']);
+async function loginMiniProgramRuntime(payload, platformAdapter, identity) {
+    const scopes = readLoginScopes(payload);
+    const miniProgramId = identity?.miniProgramId?.trim();
+    if (!miniProgramId) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_STATE', 'auth.login 缺少可信小程序身份');
+    }
+    const result = await platformAdapter.auth.login({
+        miniProgramId,
+        scopes,
+        trustedUserGesture: Boolean(await platformAdapter.auth.hasTrustedUserGesture?.()),
+    });
+    assertAuthLoginResult(result);
+    return { code: result.code, expiresIn: result.expiresIn, scopes: [...result.scopes] };
+}
+function readLoginScopes(payload) {
+    if (payload === undefined) {
+        return ['identity'];
+    }
+    if (!isMiniProgramRuntimeRecord(payload) || Object.keys(payload).some((key) => key !== 'scopes')) {
+        throw createInvalidLoginPayloadError();
+    }
+    if (payload.scopes === undefined) {
+        return ['identity'];
+    }
+    if (!Array.isArray(payload.scopes) ||
+        payload.scopes.some((scope) => typeof scope !== 'string' || !VALID_LOGIN_SCOPES.has(scope)) ||
+        new Set(payload.scopes).size !== payload.scopes.length) {
+        throw createInvalidLoginPayloadError();
+    }
+    return [...payload.scopes];
+}
+function assertAuthLoginResult(result) {
+    if (!isMiniProgramRuntimeRecord(result) ||
+        typeof result.code !== 'string' ||
+        !result.code ||
+        typeof result.expiresIn !== 'number' ||
+        !Number.isInteger(result.expiresIn) ||
+        result.expiresIn <= 0 ||
+        !Array.isArray(result.scopes) ||
+        !result.scopes.includes('identity') ||
+        result.scopes.some((scope) => typeof scope !== 'string') ||
+        result.scopes.some((scope) => !VALID_LOGIN_SCOPES.has(scope)) ||
+        new Set(result.scopes).size !== result.scopes.length) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', 'Host auth.login 返回无效');
+    }
+}
+function createInvalidLoginPayloadError() {
+    return createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'auth.login 参数不合法');
+}
+
 const GAME_DETAIL_GAME_TYPES = ['pc', 'console', 'mobile'];
 const GAME_DETAIL_PAGES = ['game', 'wiki'];
 function toOpenAppPagePlatformOptions(payload) {
@@ -4619,6 +4695,9 @@ function assertNetworkRequestUrl(requestUrl) {
     if (url.username || url.password) {
         throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'network.request url 不允许包含用户信息');
     }
+    if (isProtectedMiniProgramNetworkPath(url.pathname)) {
+        throw createMiniProgramRuntimeBridgeError('PERMISSION_DENIED', 'network.request 不允许访问 Runtime 后端接口');
+    }
 }
 function readNetworkRequestHeaders(value) {
     const headers = readStringRecord(value, 'network.request headers 必须是 Record<string, string>');
@@ -5091,31 +5170,45 @@ function hashString(value) {
     return (hash >>> 0).toString(36);
 }
 
-const SUPPORTED_PLATFORM_ACCOUNT_TYPES = [
-    'steam',
-    'epic',
-    'xbox',
-    'psn',
-    'switch',
-    'pc_hardware',
-    'mobile',
-];
-const SUPPORTED_PLATFORM_ACCOUNT_TYPE_SET = new Set(SUPPORTED_PLATFORM_ACCOUNT_TYPES);
-function isPlatformAccountType(value) {
-    return typeof value === 'string' && SUPPORTED_PLATFORM_ACCOUNT_TYPE_SET.has(value);
+async function getMiniProgramRuntimeUserInfo(platformAdapter, identity) {
+    const miniProgramId = identity?.miniProgramId?.trim();
+    return miniProgramId
+        ? platformAdapter.user.getUserInfo({ miniProgramId })
+        : platformAdapter.user.getUserInfo();
 }
-function readPlatformAccountType(payload) {
-    if (!isMiniProgramRuntimeRecord(payload)) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.getPlatformAccountInfo 参数必须是对象');
+
+async function getMiniProgramRuntimeLocalIdentity(payload, platformAdapter, identity) {
+    if (payload !== undefined) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.getLocalIdentity 不接收入参');
     }
-    const invalidKeys = Object.keys(payload).filter(key => key !== 'platform');
-    if (invalidKeys.length > 0) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', `user.getPlatformAccountInfo 不支持字段: ${invalidKeys.join(', ')}`);
+    const miniProgramId = identity?.miniProgramId?.trim();
+    if (!miniProgramId) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_STATE', 'user.getLocalIdentity 缺少可信小程序身份');
     }
-    if (!isPlatformAccountType(payload.platform)) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.getPlatformAccountInfo platform 不支持');
+    const result = await platformAdapter.user.getLocalIdentity({
+        miniProgramId,
+        trustedUserGesture: Boolean(await platformAdapter.auth.hasTrustedUserGesture?.()),
+    });
+    if (!isMiniProgramRuntimeRecord(result)
+        || typeof result.appUserId !== 'string'
+        || !result.appUserId.trim()) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', 'Host user.getLocalIdentity 返回无效');
     }
-    return payload.platform;
+    return { appUserId: result.appUserId };
+}
+
+async function revokeMiniProgramRuntimeAuthorization(payload, platformAdapter, identity) {
+    if (payload !== undefined) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.revokeAuthorization 不接收入参');
+    }
+    const miniProgramId = identity?.miniProgramId?.trim();
+    if (!miniProgramId) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_STATE', 'user.revokeAuthorization 缺少可信小程序身份');
+    }
+    await platformAdapter.user.revokeAuthorization({
+        miniProgramId,
+        trustedUserGesture: Boolean(await platformAdapter.auth.hasTrustedUserGesture?.()),
+    });
 }
 
 const DEFAULT_LIMIT = 20;
@@ -5136,14 +5229,7 @@ function readSteamGameListRequest(payload) {
     if (!isMiniProgramRuntimeRecord(payload)) {
         throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.getSteamGameList 参数必须是对象');
     }
-    const invalidKeys = Object.keys(payload).filter(key => ![
-        'steamId',
-        'limit',
-        'offset',
-        'sort',
-        'q',
-        'includeHidden',
-    ].includes(key));
+    const invalidKeys = Object.keys(payload).filter((key) => !['steamId', 'limit', 'offset', 'sort', 'q', 'includeHidden'].includes(key));
     if (invalidKeys.length > 0) {
         throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', `user.getSteamGameList 不支持字段: ${invalidKeys.join(', ')}`);
     }
@@ -5153,7 +5239,7 @@ function readSteamGameListRequest(payload) {
         offset: readOffset(payload.offset),
         sort: readSort(payload.sort),
         ...readOptionalQuery(payload.q),
-        includeHidden: readBoolean(payload.includeHidden, false),
+        includeHidden: readIncludeHidden(payload.includeHidden),
     };
 }
 async function getMiniProgramRuntimeSteamGameList(payload, platformAdapter, home) {
@@ -5165,7 +5251,7 @@ async function getMiniProgramRuntimeSteamGameList(payload, platformAdapter, home
             data: null,
         };
     }
-    const steamInfo = readRecord$1(home.steam_id_info);
+    const steamInfo = readRecord(home.steam_id_info);
     if (Object.keys(steamInfo).length === 0) {
         return {
             isLogin: true,
@@ -5187,8 +5273,7 @@ function requestSteamGameListEnvelope(platformAdapter, request) {
     if (!platformAdapter.user.getCurrentUserSteamGameListEnvelope) {
         throw createMiniProgramRuntimeBridgeError('UNSUPPORTED', '当前平台不支持读取 Steam 游戏库');
     }
-    return platformAdapter.user.getCurrentUserSteamGameListEnvelope(request)
-        .catch((error) => {
+    return platformAdapter.user.getCurrentUserSteamGameListEnvelope(request).catch((error) => {
         throw createMiniProgramRuntimeBridgeError('REQUEST_FAILED', error instanceof Error ? error.message : 'Steam 游戏库请求失败', error);
     });
 }
@@ -5198,13 +5283,13 @@ function mapSteamGameListData(envelope, request) {
     }
     const data = envelope;
     if (data.status !== 'ok') {
-        throw createMiniProgramRuntimeBridgeError('REQUEST_FAILED', readString$1(data.msg) || 'Steam 游戏库请求失败', data);
+        throw createMiniProgramRuntimeBridgeError('REQUEST_FAILED', readString(data.msg) || 'Steam 游戏库请求失败', data);
     }
     if (!isMiniProgramRuntimeRecord(data.result)) {
         throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', 'Steam 游戏库 result 必须是对象');
     }
     const result = data.result;
-    const gameList = readArray$1(result.game_list)
+    const gameList = readArray(result.game_list)
         .map(mapSteamGameListItem)
         .filter((item) => Boolean(item));
     const total = readOptionalNumber(result.total);
@@ -5225,10 +5310,10 @@ function mapSteamGameListData(envelope, request) {
     return response;
 }
 function mapSteamGameListItem(value) {
-    const source = readRecord$1(value);
+    const source = readRecord(value);
     const appid = readOptionalNumber(source.appid);
     const steamAppid = readOptionalNumber(source.steam_appid) ?? appid;
-    const name = readString$1(source.name);
+    const name = readString(source.name);
     if (appid === undefined || steamAppid === undefined || !name) {
         return undefined;
     }
@@ -5237,21 +5322,21 @@ function mapSteamGameListItem(value) {
         steamAppid,
         name,
     };
-    copyStringField$1(result, 'image', source.image);
-    copyStringField$1(result, 'icon', source.appicon ?? source.icon);
-    copyStringField$1(result, 'background', source.background);
-    copyStringField$1(result, 'verticalImage', source.vertical_head_image);
+    copyStringField(result, 'image', source.image);
+    copyStringField(result, 'icon', source.appicon ?? source.icon);
+    copyStringField(result, 'background', source.background);
+    copyStringField(result, 'verticalImage', source.vertical_head_image);
     copyNumberField(result, 'playtimeForever', source.playtime_forever);
     copyNumberField(result, 'playtime2Weeks', source.playtime_2weeks);
     copyNumberField(result, 'playtimePercent', source.playtime_percent);
     copyNumberField(result, 'achievedCount', source.achieved_count);
     copyNumberField(result, 'achievementCount', source.achivement_count ?? source.achievement_count);
     copyBooleanField(result, 'isCleared', source.is_cleared);
-    copyStringField$1(result, 'score', source.score);
+    copyStringField(result, 'score', source.score);
     copyBooleanField(result, 'isFree', source.is_free);
     copyBooleanField(result, 'notOwned', source.not_owned);
     copyBooleanField(result, 'hidden', source.hidden ?? source.is_hidden);
-    copyStringField$1(result, 'onlinePlayer', source.online_player);
+    copyStringField(result, 'onlinePlayer', source.online_player);
     copyStringArray(result, 'tags', source.external_tags ?? source.tags);
     copyStringArray(result, 'genres', source.genres);
     const price = mapSteamGamePrice(source.price);
@@ -5261,22 +5346,27 @@ function mapSteamGameListItem(value) {
     return result;
 }
 function mapSteamGamePrice(value) {
-    const source = readRecord$1(value);
+    const source = readRecord(value);
     const result = {};
-    copyStringField$1(result, 'current', source.current);
-    copyStringField$1(result, 'initial', source.initial);
+    copyStringField(result, 'current', source.current);
+    copyStringField(result, 'initial', source.initial);
     copyNumberField(result, 'discount', source.discount);
     copyNumberField(result, 'lowestPrice', source.lowest_price);
-    copyStringField$1(result, 'deadlineDate', source.deadline_date);
+    copyStringField(result, 'deadlineDate', source.deadline_date);
     copyNumberField(result, 'deadlineTimestamp', source.deadline_timestamp);
     return Object.keys(result).length > 0 ? result : undefined;
 }
 function readOptionalSteamId(value) {
-    const steamId = readString$1(value);
-    return steamId ? { steamId } : {};
+    if (value === undefined) {
+        return {};
+    }
+    if (typeof value !== 'string' || !value.trim()) {
+        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.getSteamGameList steamId 必须是非空字符串');
+    }
+    return { steamId: value.trim() };
 }
 function readOptionalQuery(value) {
-    const q = readString$1(value);
+    const q = readString(value);
     return q ? { q: q.slice(0, MAX_QUERY_LENGTH) } : {};
 }
 function readLimit(value) {
@@ -5314,8 +5404,8 @@ function readInteger(value) {
     }
     return undefined;
 }
-function copyStringField$1(target, key, value) {
-    const stringValue = readString$1(value);
+function copyStringField(target, key, value) {
+    const stringValue = readString(value);
     if (stringValue) {
         Object.assign(target, { [key]: stringValue });
     }
@@ -5333,20 +5423,18 @@ function copyBooleanField(target, key, value) {
     }
 }
 function copyStringArray(target, key, value) {
-    const items = readArray$1(value)
-        .map(readString$1)
-        .filter(Boolean);
+    const items = readArray(value).map(readString).filter(Boolean);
     if (items.length > 0) {
         Object.assign(target, { [key]: items });
     }
 }
-function readRecord$1(value) {
+function readRecord(value) {
     return isMiniProgramRuntimeRecord(value) ? value : {};
 }
-function readArray$1(value) {
+function readArray(value) {
     return Array.isArray(value) ? value : [];
 }
-function readString$1(value) {
+function readString(value) {
     if (typeof value === 'string') {
         return value.trim() ? value.trim() : '';
     }
@@ -5365,376 +5453,16 @@ function readOptionalNumber(value) {
     }
     return undefined;
 }
-function readBoolean(value, fallback) {
-    return readOptionalBoolean(value) ?? fallback;
-}
-function readOptionalBoolean(value) {
-    if (value === undefined || value === null || value === '') {
-        return undefined;
-    }
-    if (value === true || value === 1 || value === '1') {
-        return true;
-    }
-    if (value === false || value === 0 || value === '0') {
+function readIncludeHidden(value) {
+    if (value === undefined) {
         return false;
     }
-    return undefined;
-}
-
-const PLATFORM_SOURCE_KEY_BY_TYPE = {
-    steam: 'steam_id_info',
-    epic: 'epic_account_info',
-    xbox: 'xbox_account_info',
-    psn: 'psn_account_info',
-    switch: 'switch_account_info',
-    pc_hardware: 'hardware_info',
-    mobile: 'mobile_account_info',
-};
-const PLATFORM_HIDDEN_KEY_BY_TYPE = {
-    steam: ['steam_is_hidden', 'is_steam_hidden'],
-    epic: ['epic_is_hidden', 'is_epic_hidden'],
-    xbox: ['xbox_is_hidden', 'is_xbox_hidden'],
-    psn: ['psn_is_hidden', 'is_psn_hidden'],
-    switch: ['switch_is_hidden', 'is_switch_hidden'],
-    pc_hardware: ['hardware_is_hidden', 'pc_hardware_is_hidden', 'is_hardware_hidden'],
-    mobile: ['mobile_is_hidden', 'is_mobile_hidden'],
-};
-function mapCurrentUserDetail(home) {
-    const accountDetail = readRecord(home.account_detail);
-    const result = {
-        heybox_id: readString(accountDetail.userid) || '',
-        nickname: readString(accountDetail.username) || '',
-        avatar: readString(accountDetail.avartar) || readString(accountDetail.avatar) || '',
-    };
-    copyStringFields(result, accountDetail, [
-        'sex',
-        'signature',
-        'ip_location',
-        'friends_count',
-    ]);
-    copyRecord(result, 'level_info', mapCurrentUserLevelInfo(accountDetail.level_info));
-    copyArray(result, 'medals', mapCurrentUserMedals(accountDetail.bbs_medal ?? accountDetail.medal ?? accountDetail.medals));
-    copyRecord(result, 'avatar_decoration', mapCurrentUserAvatarDecoration(accountDetail.avatar_decoration));
-    copyRecord(result, 'avatar_config', mapCurrentUserAvatarConfig(accountDetail.avatar_config));
-    copyRecord(result, 'bbs_info', mapCurrentUserBbsInfo(accountDetail.bbs_info));
-    return result;
-}
-function mapCurrentUserProfile(home) {
-    const profile = readRecord(home.profile);
-    const result = {
-        heybox_id: readString(profile.heybox_id) || readString(profile.userid) || '',
-    };
-    copyStringFields(result, profile, [
-        'nickname',
-        'avatar',
-        'gender',
-        'birthday',
-        'email',
-        'education',
-        'career',
-        'signature',
-    ]);
-    return result;
-}
-function mapPlatformAccountOverview(home) {
-    return {
-        platforms: SUPPORTED_PLATFORM_ACCOUNT_TYPES.map(platform => ({
-            platform,
-            is_bound: isPlatformBound(home, platform),
-            is_hidden: readPlatformHidden(home, platform),
-        })),
-        display_order: readPlatformDisplayOrder(home.platform_list),
-    };
-}
-function mapPlatformAccountResult(home, platform) {
-    const isLogin = true;
-    const isHidden = readPlatformHidden(home, platform);
-    const accountInfo = mapPlatformAccountInfo(home, platform);
-    const isBound = isPlatformInfoBound(accountInfo);
-    return {
-        isLogin,
-        platform,
-        is_bound: isBound,
-        is_hidden: isHidden,
-        account_info: isBound ? accountInfo : null,
-    };
-}
-function createUnauthenticatedPlatformAccountResult(platform) {
-    return {
-        isLogin: false,
-        platform,
-        is_bound: false,
-        is_hidden: false,
-        account_info: null,
-    };
-}
-function mapPlatformAccountInfo(home, platform) {
-    const source = readRecord(home[PLATFORM_SOURCE_KEY_BY_TYPE[platform]]);
-    switch (platform) {
-        case 'steam':
-            return mapSteamPlatformAccount(source);
-        case 'epic':
-            return mapEpicPlatformAccount(source);
-        case 'xbox':
-            return mapXboxPlatformAccount(source);
-        case 'psn':
-            return mapPsnPlatformAccount(source);
-        case 'switch':
-            return mapSwitchPlatformAccount(source);
-        case 'pc_hardware':
-            return mapPcHardwareAccount(source);
-        case 'mobile':
-            return mapMobilePlatformAccount(source);
-        default:
-            return {};
-    }
-}
-function mapSteamPlatformAccount(source) {
-    const result = mapBasePlatformAccountInfo(source);
-    const steamid = readString(source.steamid);
-    if (steamid) {
-        result.steamid = steamid;
-    }
-    copyStringFields(result, source, [
-        'short_id',
-        'level',
-        'city',
-        'province',
-        'country',
-        'country_code',
-        'country_flag',
-        'avatar_frame',
-        'head_image',
-        'head_video',
-        'update_time',
-        'account_year',
-        'individuality_signature',
-        'level_icon',
-        'total_badge_count',
-        'total_dlcs_count',
-        'total_game_count',
-        'total_game_price',
-        'total_player_time',
-    ]);
-    copyOptionalBoolean(result, 'friend_code_show', source.friend_code_show);
-    copyOptionalBoolean(result, 'inventory_open', source.inventory_open);
-    copyOptionalBoolean(result, 'personal_information_open', source.personal_infomation_open ?? source.personal_information_open);
-    copyOptionalBoolean(result, 'has_history', source.has_history);
-    if (result.friend_code_show === true) {
-        copyStringField(result, 'friend_code', source.friend_code);
-    }
-    return result;
-}
-function mapEpicPlatformAccount(source) {
-    const result = mapBasePlatformAccountInfo(source);
-    copyStringFields(result, source, ['xuid', 'head_color', 'desc']);
-    return result;
-}
-function mapXboxPlatformAccount(source) {
-    const result = mapBasePlatformAccountInfo(source);
-    copyStringFields(result, source, ['xuid', 'desc']);
-    return result;
-}
-function mapPsnPlatformAccount(source) {
-    const result = mapBasePlatformAccountInfo(source);
-    copyStringField(result, 'background_url', source.bg_img ?? source.background_url);
-    copyStringFields(result, source, ['name', 'level', 'description']);
-    copyOptionalBoolean(result, 'is_open', source.is_open);
-    const pairStats = mapPsnPairStats(source);
-    if (pairStats.length > 0) {
-        result.stats = [...readArray(result.stats), ...pairStats];
-    }
-    return result;
-}
-function mapSwitchPlatformAccount(source) {
-    const result = mapBasePlatformAccountInfo(source);
-    copyStringFields(result, source, [
-        'heybox_id',
-        'friend_code',
-        'friends_total',
-        'games_total',
-        'server_name',
-        'type',
-        'desc',
-    ]);
-    return result;
-}
-function mapPcHardwareAccount(source) {
-    const result = {};
-    copyStringFields(result, source, ['cpu', 'gpu', 'board', 'perf_level']);
-    return result;
-}
-function mapMobilePlatformAccount(source) {
-    const currentDevice = mapMobileCurrentDevice(readRecord(source.current_device));
-    return Object.keys(currentDevice).length > 0
-        ? {
-            current_device: currentDevice,
-        }
-        : {};
-}
-function mapBasePlatformAccountInfo(source) {
-    const result = {};
-    copyStringFields(result, source, ['nickname', 'avatar']);
-    copyStringField(result, 'background_url', source.background_url ?? source.bg_img);
-    const stats = mapPlatformStats(source.stats ?? source.stat ?? source.cards ?? source.card_list);
-    if (stats.length > 0) {
-        result.stats = stats;
-    }
-    return result;
-}
-function mapMobileCurrentDevice(source) {
-    const result = {};
-    copyStringFields(result, source, ['id', 'name', 'desc', 'model', 'img_url', 'update_time']);
-    const stats = mapPlatformStats(source.stats ?? source.stat ?? source.cards ?? source.card_list);
-    if (stats.length > 0) {
-        result.stats = stats;
-    }
-    return result;
-}
-function mapCurrentUserLevelInfo(value) {
-    const source = readRecord(value);
-    const result = {};
-    copyStringFields(result, source, ['level', 'level_name', 'exp', 'next_exp', 'icon']);
-    return result;
-}
-function mapCurrentUserMedals(value) {
-    return readArray(value)
-        .map(item => {
-        const source = readRecord(item);
-        const result = {};
-        copyStringFields(result, source, ['id', 'name', 'desc', 'icon', 'image']);
-        copyOptionalBoolean(result, 'is_wearing', source.is_wearing);
-        return result;
-    })
-        .filter(item => Object.keys(item).length > 0);
-}
-function mapCurrentUserAvatarDecoration(value) {
-    const source = readRecord(value);
-    const result = {};
-    copyStringFields(result, source, ['id', 'name', 'image', 'frame_url']);
-    copyOptionalBoolean(result, 'is_using', source.is_using);
-    return result;
-}
-function mapCurrentUserAvatarConfig(value) {
-    const source = readRecord(value);
-    const result = {};
-    copyStringFields(result, source, ['avatar', 'frame_url', 'pendant_url']);
-    return result;
-}
-function mapCurrentUserBbsInfo(value) {
-    const source = readRecord(value);
-    const result = {};
-    copyStringFields(result, source, ['uid', 'nickname', 'avatar', 'level']);
-    return result;
-}
-function mapPlatformStats(value) {
-    return readArray(value)
-        .map(item => {
-        const source = readRecord(item);
-        const result = {};
-        copyStringField(result, 'key', source.key ?? source.k);
-        copyStringField(result, 'name', source.name);
-        copyStringField(result, 'desc', source.desc ?? source.description);
-        copyStringField(result, 'value', source.value ?? source.timestamp);
-        copyStringField(result, 'num', source.num);
-        copyStringField(result, 'icon', source.icon);
-        copyStringField(result, 'img', source.img ?? source.img_url ?? source.right_img);
-        copyStringField(result, 'color', source.color);
-        return result;
-    })
-        .filter(item => Object.keys(item).length > 0);
-}
-function mapPsnPairStats(source) {
-    const stats = [];
-    for (let index = 1; index <= 4; index += 1) {
-        const name = readString(source[`key${index}`]);
-        const value = readString(source[`value${index}`]);
-        if (name || value) {
-            stats.push({
-                ...(name ? { name } : {}),
-                ...(value ? { value } : {}),
-            });
-        }
-    }
-    return stats;
-}
-function isPlatformBound(home, platform) {
-    return isPlatformInfoBound(mapPlatformAccountInfo(home, platform));
-}
-function isPlatformInfoBound(accountInfo) {
-    return Object.keys(accountInfo).length > 0;
-}
-function readPlatformHidden(home, platform) {
-    for (const key of PLATFORM_HIDDEN_KEY_BY_TYPE[platform]) {
-        const value = readOptionalRuntimeBoolean(home[key]);
-        if (value !== undefined) {
-            return value;
-        }
-    }
-    const hidden = readRecord(home.hidden);
-    const hiddenAccounts = readRecord(home.hidden_accounts);
-    return readOptionalRuntimeBoolean(hidden[platform]) ?? readOptionalRuntimeBoolean(hiddenAccounts[platform]) ?? false;
-}
-function readPlatformDisplayOrder(value) {
-    return readArray(value)
-        .map(item => {
-        if (isPlatformAccountType(item)) {
-            return item;
-        }
-        if (!isMiniProgramRuntimeRecord(item)) {
-            return undefined;
-        }
-        return readPlatformFromRecord(item);
-    })
-        .filter((platform) => Boolean(platform));
-}
-function readPlatformFromRecord(value) {
-    const platform = value.platform ?? value.type ?? value.key ?? value.name;
-    return isPlatformAccountType(platform) ? platform : undefined;
-}
-function readRecord(value) {
-    return isMiniProgramRuntimeRecord(value) ? value : {};
-}
-function readArray(value) {
-    return Array.isArray(value) ? value : [];
-}
-function copyRecord(target, key, value) {
-    if (Object.keys(value).length > 0) {
-        target[key] = value;
-    }
-}
-function copyArray(target, key, value) {
-    if (value.length > 0) {
-        target[key] = value;
-    }
-}
-function copyStringFields(target, source, keys) {
-    for (const key of keys) {
-        copyStringField(target, key, source[key]);
-    }
-}
-function copyStringField(target, key, value) {
-    const stringValue = readString(value);
-    if (stringValue) {
-        target[key] = stringValue;
-    }
-}
-function copyOptionalBoolean(target, key, value) {
-    const booleanValue = readOptionalRuntimeBoolean(value);
-    if (booleanValue !== undefined) {
-        target[key] = booleanValue;
-    }
-}
-function readString(value) {
-    if (typeof value === 'string') {
-        return value.trim() ? value : '';
-    }
-    if (typeof value === 'number' || typeof value === 'boolean') {
-        return String(value);
+    if (typeof value !== 'boolean') {
+        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.getSteamGameList includeHidden 必须是 boolean');
     }
-    return '';
+    return value;
 }
-function readOptionalRuntimeBoolean(value) {
+function readOptionalBoolean(value) {
     if (value === undefined || value === null || value === '') {
         return undefined;
     }
@@ -5765,27 +5493,14 @@ function isNavigationBarForegroundStyle(value) {
     return value === 'light' || value === 'dark';
 }
 
-const OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS = [
-    'xiaoheihe.cn',
-    'max-c.com',
-    'debugmode.cn',
-    'maxjia.com',
-];
-/** 使用 URL 解析后的 hostname 判断黑盒官方根域及其子域。 */
-function isOfficialMiniProgramNetworkUrl(value) {
-    try {
-        const url = new URL(value);
-        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-            return false;
-        }
-        const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
-        return OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
-    }
-    catch {
-        return false;
-    }
+/**
+ * 当前小程序是否开通了 `network.request`。
+ * 公开详情关网时只下发合法空 `entries`，没有 enabled 条目视为未开通。
+ */
+function hasMiniProgramNetworkRequestPermission(snapshot) {
+    const parsed = parseMiniProgramRuntimePermissions(snapshot);
+    return parsed.valid && parsed.permissions['network.request']?.status === 'enabled';
 }
-
 /** 创建只依赖启动快照的纯权限 evaluator，供正式 Runtime 与 Mock Host 共用。 */
 function createMiniProgramRuntimePermissionEvaluator(snapshot) {
     const parsed = parseMiniProgramRuntimePermissions(snapshot);
@@ -5823,13 +5538,11 @@ const MOCK_DEFAULT_LEADERBOARD_KEY = 'default';
 const MOCK_LEADERBOARD_CACHE_MAX_ENTRIES = 500;
 const MOCK_LEADERBOARD_CURRENT_ENTRY_RANK_COUNT_LIMIT = 5000;
 const MINI_PROGRAM_MOCK_RUNTIME_METHODS = MINI_PROGRAM_PROTOCOL_CAPABILITIES.map((capability) => capability.method);
-const MINI_PROGRAM_MOCK_RUNTIME_METHOD_HANDLERS = {
-    [AUTH_LOGIN_METHOD]: (runtime) => runtime.login(),
+const MINI_PROGRAM_MOCK_RUNTIME_METHOD_HANDLER_MAP = {
+    [AUTH_LOGIN_METHOD]: (runtime, payload) => runtime.login(payload),
     [USER_GET_INFO_METHOD]: (runtime) => runtime.getUserInfo(),
-    [USER_GET_CURRENT_USER_DETAIL_METHOD]: (runtime) => runtime.getCurrentUserDetail(),
-    [USER_GET_CURRENT_USER_PROFILE_METHOD]: (runtime) => runtime.getCurrentUserProfile(),
-    [USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD]: (runtime) => runtime.getPlatformAccountOverview(),
-    [USER_GET_PLATFORM_ACCOUNT_INFO_METHOD]: (runtime, payload) => runtime.getPlatformAccountInfo(payload),
+    [USER_GET_LOCAL_IDENTITY_METHOD]: (runtime, payload) => runtime.getLocalIdentity(payload),
+    [USER_REVOKE_AUTHORIZATION_METHOD]: (runtime, payload) => runtime.revokeAuthorization(payload),
     [USER_GET_STEAM_GAME_LIST_METHOD]: (runtime, payload) => runtime.getSteamGameList(payload),
     [SHARE_SHOW_SHARE_MENU_METHOD]: (runtime, payload) => runtime.showShareMenu(payload),
     [SHARE_SCREENSHOT_METHOD]: (runtime, payload) => runtime.shareScreenshot(payload),
@@ -5852,6 +5565,7 @@ const MINI_PROGRAM_MOCK_RUNTIME_METHOD_HANDLERS = {
     [NAVIGATION_RELOAD_METHOD]: (runtime, payload) => runtime.reload(payload),
     [NAVIGATION_OPEN_APP_PAGE_METHOD]: (runtime, payload) => runtime.openAppPage(payload),
 };
+const MINI_PROGRAM_MOCK_RUNTIME_METHOD_HANDLERS = Object.fromEntries(MINI_PROGRAM_MOCK_RUNTIME_METHODS.map((method) => [method, MINI_PROGRAM_MOCK_RUNTIME_METHOD_HANDLER_MAP[method]]));
 function createBrowserMockRuntimePlatformAdapter(options) {
     const leaderboards = createMockLeaderboardBoards(options.leaderboards);
     return {
@@ -5870,16 +5584,56 @@ function createBrowserMockRuntimePlatformAdapter(options) {
         },
         auth: {
             async getCurrentUserId() {
-                return options.getCurrentUser()?.heybox_id;
+                const user = options.getCurrentUser();
+                return user?.app_user_id;
             },
-            async login() {
-                await options.login();
+            hasTrustedUserGesture: options.hasTrustedUserGesture,
+            async login(request) {
+                if (!options.getCurrentUser()) {
+                    if (!request.trustedUserGesture) {
+                        throw createMockBridgeError('USER_GESTURE_REQUIRED', 'Mock 登录需要可信用户手势');
+                    }
+                    await options.login();
+                }
+                return {
+                    code: options.authorizationCode || `mock-code-${request.miniProgramId || 'local'}`,
+                    expiresIn: 300,
+                    scopes: Array.from(new Set(['identity', ...request.scopes])),
+                };
             },
         },
         user: {
+            async getUserInfo() {
+                const currentUser = options.getCurrentUser();
+                const appUserId = currentUser?.app_user_id;
+                return appUserId
+                    ? {
+                        isHeyboxAppLoggedIn: true,
+                        authorization: { identity: 'granted', profile: 'not_requested' },
+                        userInfo: {
+                            app_user_id: appUserId,
+                            profile: { nickname: currentUser?.nickname || '', avatar: currentUser?.avatar || '' },
+                        },
+                    }
+                    : { isHeyboxAppLoggedIn: false, authorization: null, userInfo: null };
+            },
+            async getLocalIdentity() {
+                const appUserId = options.getCurrentUser()?.app_user_id;
+                if (!appUserId) {
+                    throw createMockBridgeError('NOT_LOGGED_IN', '当前 Mock 用户未登录');
+                }
+                return { appUserId };
+            },
+            async revokeAuthorization(request) {
+                if (!request.trustedUserGesture) {
+                    throw createMockBridgeError('USER_GESTURE_REQUIRED', 'Mock 撤销授权需要可信用户手势');
+                }
+                await options.revokeAuthorization?.();
+            },
             async getUserBasicInfo(userId) {
                 const currentUser = options.getCurrentUser();
-                if (!currentUser || currentUser.heybox_id !== userId) {
+                const appUserId = currentUser?.app_user_id || currentUser?.heybox_id;
+                if (!currentUser || appUserId !== userId) {
                     return undefined;
                 }
                 return {
@@ -5887,9 +5641,6 @@ function createBrowserMockRuntimePlatformAdapter(options) {
                     avatar: currentUser.avatar,
                 };
             },
-            async getCurrentUserSteamGameListEnvelope(request) {
-                return createMockSteamGameListEnvelope(request.limit, request.offset);
-            },
         },
         share: {
             async showShareMenu(params) {
@@ -6013,7 +5764,11 @@ class MiniProgramMockRuntime {
         this.toasts = [];
         this.vibrates = [];
         this.openAppPages = [];
-        this.evaluateRuntimePermission = createMiniProgramRuntimePermissionEvaluator(options.runtimePermissions);
+        const runtimePermissions = resolveMockRuntimePermissions(options);
+        this.evaluateRuntimePermission = createMiniProgramRuntimePermissionEvaluator(runtimePermissions);
+        this.authLoginEnabled = isMockAuthLoginEnabled(runtimePermissions);
+        this.hostUserApiEnabled = isMockHostUserApiEnabled(runtimePermissions);
+        this.authorizationMutationEnabled = isMockAuthorizationMutationEnabled(runtimePermissions);
         this.leaderboardHandlers = createMiniProgramRuntimeLeaderboardHandlers({
             identity: options.identity,
             platformAdapter: adapter,
@@ -6026,7 +5781,7 @@ class MiniProgramMockRuntime {
         if (this.closed && method !== NAVIGATION_CLOSE_METHOD) {
             throw createMockBridgeError('INVALID_STATE', '当前小程序容器已关闭');
         }
-        const capability = MINI_PROGRAM_PROTOCOL_CAPABILITIES.find(item => item.method === method);
+        const capability = MINI_PROGRAM_PROTOCOL_CAPABILITIES.find((item) => item.method === method);
         if (capability) {
             const policyResult = this.evaluateRuntimePermission(capability.permission, payload);
             if (!policyResult.allowed) {
@@ -6047,72 +5802,38 @@ class MiniProgramMockRuntime {
             vibrates: [...this.vibrates],
         };
     }
-    async login() {
-        const result = await loginAndGetMiniProgramRuntimeUserInfo(this.adapter);
-        this.options.onAuthChange?.(result);
-        return result;
-    }
-    async getUserInfo() {
-        return getMiniProgramRuntimeUserInfo(this.adapter);
-    }
-    async getCurrentUserDetail() {
-        const home = await this.getMockUserHomeV2Result();
-        return home
-            ? {
-                isLogin: true,
-                data: mapCurrentUserDetail(home),
-            }
-            : {
-                isLogin: false,
-                data: null,
-            };
+    login(payload) {
+        if (!this.authLoginEnabled) {
+            throw createMockBridgeError('SERVER_API_REQUIRED', '当前模式要求由小程序服务端完成 auth.login');
+        }
+        return loginMiniProgramRuntime(payload, this.adapter, this.options.identity);
     }
-    async getCurrentUserProfile() {
-        const home = await this.getMockUserHomeV2Result();
-        return home
-            ? {
-                isLogin: true,
-                data: mapCurrentUserProfile(home),
-            }
-            : {
-                isLogin: false,
-                data: null,
-            };
+    getUserInfo() {
+        this.assertMockHostUserApiEnabled();
+        return getMiniProgramRuntimeUserInfo(this.adapter, this.options.identity);
     }
-    async getPlatformAccountOverview() {
-        const home = await this.getMockUserHomeV2Result();
-        return home
-            ? {
-                isLogin: true,
-                data: mapPlatformAccountOverview(home),
-            }
-            : {
-                isLogin: false,
-                data: null,
-            };
+    getLocalIdentity(payload) {
+        this.assertMockHostUserApiEnabled();
+        return getMiniProgramRuntimeLocalIdentity(payload, this.adapter, this.options.identity);
     }
-    async getPlatformAccountInfo(payload) {
-        const platform = readPlatformAccountType(payload);
-        const home = await this.getMockUserHomeV2Result();
-        return home
-            ? mapPlatformAccountResult(home, platform)
-            : createUnauthenticatedPlatformAccountResult(platform);
+    revokeAuthorization(payload) {
+        if (!this.authorizationMutationEnabled) {
+            throw createMockBridgeError('SERVER_API_REQUIRED', '当前模式缺少有效的小程序权限快照');
+        }
+        return revokeMiniProgramRuntimeAuthorization(payload, this.adapter, this.options.identity);
     }
     async getSteamGameList(payload) {
-        const home = await this.getMockUserHomeV2Result();
-        return getMiniProgramRuntimeSteamGameList(payload, {
-            ...this.adapter,
-            user: {
-                ...this.adapter.user,
-                getCurrentUserSteamGameListEnvelope: request => Promise.resolve(createMockSteamGameListEnvelope(request.limit, request.offset)),
-            },
-        }, home);
+        this.assertMockHostUserApiEnabled();
+        const info = await getMiniProgramRuntimeUserInfo(this.adapter, this.options.identity);
+        return getMiniProgramRuntimeSteamGameList(payload, this.adapter, info.isHeyboxAppLoggedIn ? { steam_id_info: { steamid: '76561198000000000' } } : undefined);
     }
-    async getMockUserHomeV2Result() {
-        const result = await this.getUserInfo();
-        return result.isLogin && result.userInfo
-            ? createMockRuntimeUserHomeV2Result(result.userInfo)
-            : undefined;
+    assertMockHostUserApiEnabled() {
+        if (!this.hostUserApiEnabled) {
+            throw createMockBridgeError('SERVER_API_REQUIRED', '当前模式要求由小程序服务端调用用户 API');
+        }
+    }
+    invoke(method, payload) {
+        return this.runMethod(method, payload);
     }
     showShareMenu(payload) {
         return showMiniProgramRuntimeShareMenu(payload, this.adapter, this.getShareContext());
@@ -6252,6 +5973,31 @@ class MiniProgramMockRuntime {
         this.records.splice(30);
     }
 }
+function resolveMockRuntimePermissions(options) {
+    if (options.networkMode === 'disabled') {
+        return {
+            schema_version: 1,
+            entries: [{ key: 'network.request', status: 'disabled', config: { useOfficialDomain: false } }],
+        };
+    }
+    if (options.networkMode === 'enabled') {
+        return {
+            schema_version: 1,
+            entries: [{ key: 'network.request', status: 'enabled', config: { useOfficialDomain: true } }],
+        };
+    }
+    return options.runtimePermissions;
+}
+function isMockHostUserApiEnabled(runtimePermissions) {
+    const parsed = parseMiniProgramRuntimePermissions(runtimePermissions);
+    return parsed.valid && !hasMiniProgramNetworkRequestPermission(runtimePermissions);
+}
+function isMockAuthLoginEnabled(runtimePermissions) {
+    return hasMiniProgramNetworkRequestPermission(runtimePermissions);
+}
+function isMockAuthorizationMutationEnabled(runtimePermissions) {
+    return parseMiniProgramRuntimePermissions(runtimePermissions).valid;
+}
 /**
  * 读取 mock host 自身 URL 上的启动参数作为可信分享上下文。
  * 与生产 runtime 不同：生产只信任启动详情回填的 canonical ID；
@@ -6270,58 +6016,6 @@ function readMockHostShareContext(href) {
         return {};
     }
 }
-function createMockSteamGameListEnvelope(limit, offset) {
-    const gameList = [
-        {
-            appid: 814380,
-            steam_appid: 814380,
-            name: 'Sekiro: Shadows Die Twice',
-            image: 'https://imgheybox.max-c.com/heybox/game/header/814380_lliLB.jpg',
-            appicon: 'https://imgheybox.max-c.com/web/2024/02/14/f072e95b0026fa2efba35f737dbc2aab.webp',
-            background: 'https://cdn.max-c.com/heybox/game/background/814380_cHOHF.jpg',
-            playtime_forever: 2940,
-            playtime_2weeks: 120,
-            playtime_percent: '0.12',
-            achieved_count: 3,
-            achivement_count: 34,
-            score: '9.8',
-            is_free: false,
-            not_owned: false,
-            online_player: '4314',
-            external_tags: ['Action', 'Adventure'],
-            genres: ['Action'],
-            price: {
-                initial: '268',
-                current: '134',
-                discount: 50,
-                lowest_price: 134,
-            },
-        },
-        {
-            appid: 230410,
-            steam_appid: 230410,
-            name: 'Warframe',
-            image: 'https://imgheybox.max-c.com/heybox/game/header/230410_tamuE.jpg',
-            playtime_forever: 1024140,
-            playtime_2weeks: 1500,
-            achieved_count: 142,
-            achivement_count: 193,
-            is_free: true,
-            not_owned: false,
-            online_player: '5万',
-            external_tags: ['MMO', 'Sci-Fi'],
-            genres: ['Action', 'Free To Play'],
-        },
-    ].slice(offset, offset + limit);
-    return {
-        status: 'ok',
-        result: {
-            game_list: gameList,
-            total: 2,
-            is_me: true,
-        },
-    };
-}
 function isMiniProgramMockRuntimeMethod(method) {
     return MINI_PROGRAM_MOCK_RUNTIME_METHODS.includes(method);
 }
@@ -6489,10 +6183,10 @@ class MockLeaderboardBoard {
         this.key = config.key;
         this.order = readMockLeaderboardOrder(config.order);
         this.rankLimit = readMockLeaderboardRankLimit(config.rankLimit);
-        config.entries?.forEach(entry => {
+        config.entries?.forEach((entry) => {
             const now = Date.now();
-            this.entries.set(entry.userId, {
-                userId: readMockLeaderboardUserId(entry.userId),
+            this.entries.set(entry.appUserId, {
+                appUserId: readMockLeaderboardAppUserId(entry.appUserId),
                 score: readMockLeaderboardScore(entry.score),
                 extra: cloneMockRecord(entry.extra || {}),
                 createdAt: entry.createdAt ?? now,
@@ -6507,7 +6201,7 @@ class MockLeaderboardBoard {
             return this.getCurrentUserEntry(userId);
         }
         this.entries.set(userId, {
-            userId,
+            appUserId: userId,
             score,
             extra: extra === undefined ? cloneMockRecord(existing?.extra || {}) : cloneMockRecord(extra),
             createdAt: existing?.createdAt ?? now,
@@ -6536,15 +6230,14 @@ class MockLeaderboardBoard {
                 return freshCachedResponse;
             }
         }
-        const entriesAfterCursor = this.getListEntries()
-            .filter(entry => listCursor ? this.isAfterCursor(entry, listCursor) : true);
+        const entriesAfterCursor = this.getListEntries().filter((entry) => (listCursor ? this.isAfterCursor(entry, listCursor) : true));
         const entries = entriesAfterCursor.slice(0, limit);
         const hasMore = entries.length < entriesAfterCursor.length;
         return this.createListResponse(entries, startRank, hasMore);
     }
     getCurrentUserEntry(userId) {
         const orderedEntries = this.getOrderedEntries();
-        const index = orderedEntries.findIndex(entry => entry.userId === userId);
+        const index = orderedEntries.findIndex((entry) => entry.appUserId === userId);
         if (index < 0) {
             return undefined;
         }
@@ -6574,9 +6267,7 @@ class MockLeaderboardBoard {
         let start = 0;
         let startRank = 1;
         if (cursor) {
-            const cursorIndex = this.cachedList.entries.findIndex(entry => (entry.score === cursor.score &&
-                entry.updatedAt === cursor.update_time &&
-                entry.userId === cursor.user_id));
+            const cursorIndex = this.cachedList.entries.findIndex((entry) => entry.score === cursor.score && entry.updatedAt === cursor.update_time && entry.appUserId === cursor.user_id);
             if (cursorIndex < 0) {
                 return undefined;
             }
@@ -6596,12 +6287,10 @@ class MockLeaderboardBoard {
         return this.createListResponse(this.cachedList.entries.slice(start, end), startRank, hasMore);
     }
     refreshListCache() {
-        const cacheLimit = this.rankLimit > 0 && this.rankLimit < MOCK_LEADERBOARD_CACHE_MAX_ENTRIES
-            ? this.rankLimit
-            : MOCK_LEADERBOARD_CACHE_MAX_ENTRIES;
+        const cacheLimit = this.rankLimit > 0 && this.rankLimit < MOCK_LEADERBOARD_CACHE_MAX_ENTRIES ? this.rankLimit : MOCK_LEADERBOARD_CACHE_MAX_ENTRIES;
         const rankedEntries = this.getListEntries();
         this.cachedList = {
-            entries: rankedEntries.slice(0, cacheLimit).map(entry => ({
+            entries: rankedEntries.slice(0, cacheLimit).map((entry) => ({
                 ...entry,
                 extra: cloneMockRecord(entry.extra),
             })),
@@ -6633,9 +6322,9 @@ class MockLeaderboardBoard {
             if (left.updatedAt !== right.updatedAt) {
                 return left.updatedAt - right.updatedAt;
             }
-            return left.userId.localeCompare(right.userId);
+            return left.appUserId.localeCompare(right.appUserId);
         })
-            .map(entry => ({
+            .map((entry) => ({
             ...entry,
             extra: cloneMockRecord(entry.extra),
         }));
@@ -6682,7 +6371,7 @@ class MockLeaderboardBoard {
             rank: entry.rank,
             score: entry.score,
             update_time: entry.updatedAt,
-            user_id: entry.userId,
+            user_id: entry.appUserId,
         }));
     }
     isAfterCursor(entry, cursor) {
@@ -6692,7 +6381,7 @@ class MockLeaderboardBoard {
         if (entry.updatedAt !== cursor.update_time) {
             return entry.updatedAt > cursor.update_time;
         }
-        return entry.userId.localeCompare(cursor.user_id) > 0;
+        return entry.appUserId.localeCompare(cursor.user_id) > 0;
     }
     isWithinRankLimit(rank) {
         return this.rankLimit <= 0 || rank <= this.rankLimit;
@@ -6724,9 +6413,9 @@ function readMockLeaderboardRankLimit(value) {
     }
     return value;
 }
-function readMockLeaderboardUserId(value) {
+function readMockLeaderboardAppUserId(value) {
     if (typeof value !== 'string' || !value) {
-        throw createMockBridgeError('INVALID_PARAMS', 'mock leaderboard entry userId 必须是非空字符串');
+        throw createMockBridgeError('INVALID_PARAMS', 'mock leaderboard entry appUserId 必须是非空字符串');
     }
     return value;
 }
@@ -6763,125 +6452,9 @@ function decodeMockLeaderboardCursor(value) {
         throw createMockBridgeError('INVALID_PARAMS', 'cloud.leaderboard.getList cursor 不合法');
     }
     const binary = atob(padded);
-    const bytes = Uint8Array.from(binary, char => char.charCodeAt(0));
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
     return new TextDecoder().decode(bytes);
 }
-function createMockRuntimeUserHomeV2Result(userInfo) {
-    const heyboxId = userInfo.heybox_id || 'debug_user';
-    const nickname = userInfo.nickname || 'PC Debug User';
-    const avatar = userInfo.avatar || '';
-    return {
-        account_detail: {
-            userid: heyboxId,
-            username: nickname,
-            avartar: avatar,
-            signature: '来自 hb-sdk mock runtime 的用户资料',
-            ip_location: 'Mock',
-            friends_count: '128',
-            level_info: {
-                level: '12',
-                level_name: 'Mock Lv.12',
-                exp: '2400',
-                next_exp: '3000',
-            },
-            bbs_medal: [
-                {
-                    id: 'mock-medal',
-                    name: 'Mock Medal',
-                    desc: '本地 mock 勋章',
-                    is_wearing: true,
-                },
-            ],
-        },
-        profile: {
-            heybox_id: heyboxId,
-            nickname,
-            avatar,
-            gender: 'unknown',
-            signature: '来自 hb-sdk mock runtime 的个人档案',
-            email: 'mock-user@example.com',
-        },
-        platform_list: ['steam', 'epic', 'xbox', 'psn', 'switch', 'pc_hardware', 'mobile'],
-        steam_is_hidden: false,
-        steam_id_info: {
-            steamid: '76561198000000000',
-            short_id: 'mock-steam',
-            nickname: `${nickname} Steam`,
-            avatar,
-            level: '12',
-            friend_code_show: true,
-            friend_code: '123456789',
-            inventory_open: true,
-            personal_information_open: true,
-            has_history: true,
-            stats: [
-                {
-                    key: 'total_game_count',
-                    name: '游戏数',
-                    value: '42',
-                },
-                {
-                    key: 'total_player_time',
-                    name: '总时长',
-                    value: '128h',
-                },
-            ],
-        },
-        epic_account_info: {
-            nickname: `${nickname} Epic`,
-            avatar,
-            xuid: 'mock-epic-xuid',
-            desc: 'Mock Epic account',
-        },
-        xbox_account_info: {
-            nickname: `${nickname} Xbox`,
-            avatar,
-            xuid: 'mock-xbox-xuid',
-            desc: 'Mock Xbox account',
-        },
-        psn_account_info: {
-            name: `${nickname} PSN`,
-            avatar,
-            level: '8',
-            description: 'Mock PSN account',
-            is_open: true,
-            key1: '白金',
-            value1: '3',
-        },
-        switch_account_info: {
-            heybox_id: heyboxId,
-            nickname: `${nickname} Switch`,
-            avatar,
-            friend_code: 'SW-1234-5678-9012',
-            friends_total: '16',
-            games_total: '9',
-            server_name: 'Mock Server',
-            type: 'switch',
-        },
-        hardware_info: {
-            cpu: 'Mock CPU',
-            gpu: 'Mock GPU',
-            board: 'Mock Board',
-            perf_level: 'A',
-        },
-        mobile_account_info: {
-            current_device: {
-                id: 'mock-device',
-                name: 'Mock Phone',
-                desc: 'hb-sdk mock runtime device',
-                model: 'MockPhone 1',
-                update_time: '2026-06-04',
-                stats: [
-                    {
-                        key: 'score',
-                        name: '跑分',
-                        value: '999999',
-                    },
-                ],
-            },
-        },
-    };
-}
 function renderMockToast(toast) {
     const document = readDocument();
     if (!document) {
@@ -7014,12 +6587,7 @@ function readWindow() {
     return typeof window === 'undefined' ? undefined : window;
 }
 function escapeMockHtml(value) {
-    return String(value)
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#039;');
+    return String(value).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#039;');
 }
 function isPlainRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -7244,6 +6812,8 @@ const NETWORK_PROXY_PATH = '/__hb_sdk_mock_network__';
 const MOCK_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
 const DEV_PERMISSIONS_PATH = '/__hb_sdk__/dev-permissions';
 const RUNTIME_GATE_PROBE_METHOD = 'runtime.gate.probe';
+/** 长 heybox:// 协议需要更大展示面，便于测试端扫码。 */
+const MOBILE_QR_IMAGE_SIZE = 320;
 const params = new URL(location.href).searchParams;
 const miniUrl = params.get('mini_url');
 let lanAddresses = [];
@@ -7259,7 +6829,7 @@ let mobileQrGeneration = 0;
 let mobileQrRefreshTimer;
 let mobileDevSessionCreation = Promise.resolve();
 let currentUser = {
-    heybox_id: 'debug_user',
+    app_user_id: 'au_debug_user',
     nickname: 'PC Debug User',
     avatar: '',
 };
@@ -7342,7 +6912,7 @@ queryElement('#login-button').addEventListener('click', () => {
 queryElement('#logout-button').addEventListener('click', () => {
     currentUser = null;
     updateUserStatus();
-    postEvent('authChange', createUserInfoResult());
+    postEvent('heybox_app_login_change', { isHeyboxAppLoggedIn: false });
 });
 queryElement('#show-button').addEventListener('click', () => {
     postEvent('show', { timestamp: Date.now(), source: 'mock-host' });
@@ -7368,7 +6938,8 @@ elements.resetPermissionsButton.addEventListener('click', () => {
 const mobileAppQrReady = setupMobileAppQr();
 function createRuntime() {
     return new MiniProgramMockRuntime(platformAdapter, {
-        onAuthChange: (result) => postEvent('authChange', result),
+        onHeyboxAppLoginChange: payload => postEvent('heybox_app_login_change', payload),
+        onUserInfoAuthorizationChange: authorization => postEvent('user_info_authorization_change', authorization),
         runtimePermissions: createMiniProgramMockRuntimePermissions(permissionState),
     });
 }
@@ -7723,15 +7294,9 @@ function isBridgeMessage(message) {
         message.version === MINI_PROGRAM_MESSAGE_VERSION &&
         message.nonce === nonce);
 }
-function createUserInfoResult() {
-    return {
-        isLogin: Boolean(currentUser),
-        userInfo: currentUser ? { ...currentUser } : null,
-    };
-}
 function createUserFromForm() {
     return {
-        heybox_id: 'debug_user',
+        app_user_id: 'au_debug_user',
         nickname: elements.nicknameInput.value.trim() || 'PC Debug User',
         avatar: '',
     };
@@ -7875,27 +7440,29 @@ async function updateMobileQrCode() {
         if (generation !== mobileQrGeneration) {
             return;
         }
+        // 测试端扫一扫暂不支持打开网页，二维码必须直接编码 heybox:// 协议（不能走 HTTP 短链）。
         const payload = applyDevContextToMobileQrPayload(basePayload, devSession.url);
         const imageUrl = await browserExports.toDataURL(payload, {
-            errorCorrectionLevel: 'M',
-            margin: 1,
-            width: 176,
+            // 内容很长时用 L 可降低模块密度，配合更大尺寸更容易扫上。
+            errorCorrectionLevel: 'L',
+            margin: 2,
+            width: MOBILE_QR_IMAGE_SIZE,
         });
         if (generation !== mobileQrGeneration) {
             return;
         }
         elements.mobileQrImage.src = imageUrl;
         elements.mobileQrImage.hidden = false;
-        elements.mobileQrStatus.textContent = '';
+        elements.mobileQrStatus.textContent = `协议约 ${payload.length} 字符 · 请用测试端扫一扫`;
         scheduleMobileQrRefresh(devSession.expiresAt, generation);
     }
-    catch {
+    catch (error) {
         if (generation !== mobileQrGeneration) {
             return;
         }
         elements.mobileQrImage.removeAttribute('src');
         elements.mobileQrImage.hidden = true;
-        elements.mobileQrStatus.textContent = '二维码生成失败';
+        elements.mobileQrStatus.textContent = `二维码生成失败：${readErrorMessage(error)}`;
     }
 }
 async function createMobileDevSession(selected) {
@@ -7957,7 +7524,7 @@ function clearMobileQrRefreshTimer() {
     mobileQrRefreshTimer = undefined;
 }
 function applyDevContextToMobileQrPayload(payload, devContextUrl) {
-    const protocolMarker = '#heybox://';
+    const protocolMarker = payload.includes('#heybox://') ? '#heybox://' : 'heybox://';
     const protocolIndex = payload.indexOf(protocolMarker);
     if (protocolIndex < 0) {
         throw new Error('Invalid mobile App QR payload');
@@ -7974,9 +7541,31 @@ function applyDevContextToMobileQrPayload(payload, devContextUrl) {
     const devShellUrl = new URL(devShellUrlValue);
     devShellUrl.searchParams.delete('dev_network_request');
     devShellUrl.searchParams.set(MINI_PROGRAM_DEV_CONTEXT_QUERY_PARAM, devContextUrl);
+    // 与 mini_url 相同：客户端打开 runtime_url 时往往不会合并 sandbox query，
+    // 需要把 dev_context_url 写进 runtime_url 本身。
+    const runtimeUrl = devShellUrl.searchParams.get('runtime_url');
+    if (runtimeUrl) {
+        try {
+            const hostUrl = new URL(runtimeUrl);
+            if (hostUrl.protocol === 'http:' || hostUrl.protocol === 'https:') {
+                hostUrl.searchParams.set(MINI_PROGRAM_DEV_CONTEXT_QUERY_PARAM, devContextUrl);
+                const miniUrl = devShellUrl.searchParams.get('mini_url');
+                if (miniUrl && !hostUrl.searchParams.get('mini_url')) {
+                    hostUrl.searchParams.set('mini_url', miniUrl);
+                }
+                devShellUrl.searchParams.set('runtime_url', hostUrl.toString());
+            }
+        }
+        catch {
+            // runtime_url 非法时保留原值，避免阻断二维码生成。
+        }
+    }
     openWindowPayload.webview.url = devShellUrl.toString();
     return `${payload.slice(0, protocolIndex)}${protocolMarker}${encodeURIComponent(JSON.stringify(openWindowPayload))}`;
 }
+function readErrorMessage(error) {
+    return error instanceof Error && error.message ? error.message : '未知错误';
+}
 function updateNativeAppLaunchAvailability() {
     const isUnavailable = Boolean(nativeAppLaunchUnavailableReason);
     elements.macAppButton.disabled = isUnavailable;