@heybox/hb-sdk 0.6.9 → 0.7.0-alpha.2

package/dist/protocol.cjs.js

@@ -3,7 +3,7 @@
 /** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 /** 小程序沙盒通信协议版本。 */
-const MINI_PROGRAM_MESSAGE_VERSION = 1;
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
 /** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 /** SDK 初始化时发给父容器的握手方法名。 */
@@ -27,7 +27,7 @@ function isMiniProgramBridgeMessage(value) {
     }
     const message = value;
     return (message.namespace === MINI_PROGRAM_MESSAGE_NAMESPACE &&
-        message.version === MINI_PROGRAM_MESSAGE_VERSION &&
+        (message.version === 1 || message.version === 2) &&
         typeof message.nonce === 'string' &&
         typeof message.type === 'string');
 }
@@ -84,29 +84,97 @@ function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
+const OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS = [
+    'xiaoheihe.cn',
+    'max-c.com',
+    'debugmode.cn',
+    'maxjia.com',
+];
+/** Runtime / Host 在 `network.request` 分发前拒绝的小程序服务端私有路径前缀。 */
+const MINI_PROGRAM_NETWORK_PROTECTED_PATHS = [
+    '/user_miniprogram/runtime/auth',
+    '/user_miniprogram/openapi/v1',
+];
+const NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS = 4;
+/** 使用 URL 解析后的 hostname 判断黑盒官方根域及其子域。 */
+function isOfficialMiniProgramNetworkUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            return false;
+        }
+        const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+        return OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+    }
+    catch {
+        return false;
+    }
+}
 /**
- * 登录授权能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
+ * 规范化并判断 pathname 是否命中 Runtime Auth / OpenAPI 保护前缀。
+ * 解码失败或仍可继续解码时视为不安全路径。
  */
-const AUTH_LOGIN_METHOD = 'auth.login';
+function isProtectedMiniProgramNetworkPath(pathname) {
+    const normalized = normalizeMiniProgramNetworkPathname(pathname);
+    if (normalized === null) {
+        return true;
+    }
+    return MINI_PROGRAM_NETWORK_PROTECTED_PATHS.some(prefix => normalized === prefix || normalized.startsWith(`${prefix}/`));
+}
+function normalizeMiniProgramNetworkPathname(pathname) {
+    let decoded = pathname;
+    for (let round = 0; round < NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS; round += 1) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return null;
+        }
+        if (next === decoded) {
+            return normalizeDecodedNetworkPathname(decoded);
+        }
+        decoded = next;
+    }
+    try {
+        if (decodeURIComponent(decoded) !== decoded) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return normalizeDecodedNetworkPathname(decoded);
+}
+function normalizeDecodedNetworkPathname(decoded) {
+    const segments = [];
+    for (const segment of decoded.replace(/\\/g, '/').split('/')) {
+        if (!segment || segment === '.') {
+            continue;
+        }
+        if (segment === '..') {
+            segments.pop();
+            continue;
+        }
+        segments.push(segment);
+    }
+    return `/${segments.join('/')}`;
+}
+
 /**
- * 用户信息能力方法名。
+ * 登录授权能力方法名。
  *
  * @remarks
  * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
  */
+const AUTH_LOGIN_METHOD = 'auth.login';
+/** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 当前用户展示详情能力方法名。 */
-const USER_GET_CURRENT_USER_DETAIL_METHOD = 'user.getCurrentUserDetail';
-/** 当前用户敏感资料详情能力方法名。 */
-const USER_GET_CURRENT_USER_PROFILE_METHOD = 'user.getCurrentUserProfile';
-/** 当前用户平台账号概览能力方法名。 */
-const USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD = 'user.getPlatformAccountOverview';
-/** 当前用户指定平台账号详情能力方法名。 */
-const USER_GET_PLATFORM_ACCOUNT_INFO_METHOD = 'user.getPlatformAccountInfo';
-/** 当前用户 Steam 游戏库能力方法名。 */
+/** 读取当前用户小程序隔离身份的 bridge method 标识。 */
+const USER_GET_LOCAL_IDENTITY_METHOD = 'user.getLocalIdentity';
+/** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
+const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
+/** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
 const USER_GET_STEAM_GAME_LIST_METHOD = 'user.getSteamGameList';
 /**
  * 展示分享面板能力方法名。
@@ -205,38 +273,24 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         risk: 'medium',
     },
     {
-        method: USER_GET_CURRENT_USER_DETAIL_METHOD,
-        module: 'user',
-        capability: USER_GET_CURRENT_USER_DETAIL_METHOD,
-        permission: 'user.currentUserDetail',
-        risk: 'high',
-    },
-    {
-        method: USER_GET_CURRENT_USER_PROFILE_METHOD,
-        module: 'user',
-        capability: USER_GET_CURRENT_USER_PROFILE_METHOD,
-        permission: 'user.currentUserProfile',
-        risk: 'high',
-    },
-    {
-        method: USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD,
+        method: USER_GET_LOCAL_IDENTITY_METHOD,
         module: 'user',
-        capability: USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD,
-        permission: 'user.platformAccount.overview',
+        capability: USER_GET_LOCAL_IDENTITY_METHOD,
+        permission: 'user.getLocalIdentity',
         risk: 'medium',
     },
     {
-        method: USER_GET_PLATFORM_ACCOUNT_INFO_METHOD,
+        method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
-        capability: USER_GET_PLATFORM_ACCOUNT_INFO_METHOD,
-        permission: 'user.platformAccount.info',
+        capability: USER_REVOKE_AUTHORIZATION_METHOD,
+        permission: 'user.revokeAuthorization',
         risk: 'high',
     },
     {
         method: USER_GET_STEAM_GAME_LIST_METHOD,
         module: 'user',
         capability: USER_GET_STEAM_GAME_LIST_METHOD,
-        permission: 'user.steamGameList',
+        permission: 'user.platformAccount.steam',
         risk: 'high',
     },
     {
@@ -392,6 +446,7 @@ exports.DEVICE_VIBRATE_METHOD = DEVICE_VIBRATE_METHOD;
 exports.MINI_PROGRAM_BRIDGE_NONCE_PARAM = MINI_PROGRAM_BRIDGE_NONCE_PARAM;
 exports.MINI_PROGRAM_MESSAGE_NAMESPACE = MINI_PROGRAM_MESSAGE_NAMESPACE;
 exports.MINI_PROGRAM_MESSAGE_VERSION = MINI_PROGRAM_MESSAGE_VERSION;
+exports.MINI_PROGRAM_NETWORK_PROTECTED_PATHS = MINI_PROGRAM_NETWORK_PROTECTED_PATHS;
 exports.MINI_PROGRAM_PROTOCOL_CAPABILITIES = MINI_PROGRAM_PROTOCOL_CAPABILITIES;
 exports.NAVIGATION_CLOSE_METHOD = NAVIGATION_CLOSE_METHOD;
 exports.NAVIGATION_OPEN_APP_PAGE_METHOD = NAVIGATION_OPEN_APP_PAGE_METHOD;
@@ -408,14 +463,15 @@ exports.STORAGE_SET_STORAGE_METHOD = STORAGE_SET_STORAGE_METHOD;
 exports.UI_HIDE_LOADING_METHOD = UI_HIDE_LOADING_METHOD;
 exports.UI_SHOW_LOADING_METHOD = UI_SHOW_LOADING_METHOD;
 exports.UI_SHOW_TOAST_METHOD = UI_SHOW_TOAST_METHOD;
-exports.USER_GET_CURRENT_USER_DETAIL_METHOD = USER_GET_CURRENT_USER_DETAIL_METHOD;
-exports.USER_GET_CURRENT_USER_PROFILE_METHOD = USER_GET_CURRENT_USER_PROFILE_METHOD;
 exports.USER_GET_INFO_METHOD = USER_GET_INFO_METHOD;
-exports.USER_GET_PLATFORM_ACCOUNT_INFO_METHOD = USER_GET_PLATFORM_ACCOUNT_INFO_METHOD;
-exports.USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD = USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD;
+exports.USER_GET_LOCAL_IDENTITY_METHOD = USER_GET_LOCAL_IDENTITY_METHOD;
 exports.USER_GET_STEAM_GAME_LIST_METHOD = USER_GET_STEAM_GAME_LIST_METHOD;
+exports.USER_REVOKE_AUTHORIZATION_METHOD = USER_REVOKE_AUTHORIZATION_METHOD;
 exports.VIEWPORT_GET_WINDOW_INFO_METHOD = VIEWPORT_GET_WINDOW_INFO_METHOD;
 exports.VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD = VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD;
 exports.isManagedMiniProgramRuntimePermissionKey = isManagedMiniProgramRuntimePermissionKey;
 exports.isMiniProgramBridgeMessage = isMiniProgramBridgeMessage;
+exports.isOfficialMiniProgramNetworkUrl = isOfficialMiniProgramNetworkUrl;
+exports.isProtectedMiniProgramNetworkPath = isProtectedMiniProgramNetworkPath;
+exports.normalizeMiniProgramNetworkPathname = normalizeMiniProgramNetworkPathname;
 exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;

package/dist/protocol.esm.js

@@ -1,7 +1,7 @@
 /** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 /** 小程序沙盒通信协议版本。 */
-const MINI_PROGRAM_MESSAGE_VERSION = 1;
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
 /** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 /** SDK 初始化时发给父容器的握手方法名。 */
@@ -25,7 +25,7 @@ function isMiniProgramBridgeMessage(value) {
     }
     const message = value;
     return (message.namespace === MINI_PROGRAM_MESSAGE_NAMESPACE &&
-        message.version === MINI_PROGRAM_MESSAGE_VERSION &&
+        (message.version === 1 || message.version === 2) &&
         typeof message.nonce === 'string' &&
         typeof message.type === 'string');
 }
@@ -82,29 +82,97 @@ function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
+const OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS = [
+    'xiaoheihe.cn',
+    'max-c.com',
+    'debugmode.cn',
+    'maxjia.com',
+];
+/** Runtime / Host 在 `network.request` 分发前拒绝的小程序服务端私有路径前缀。 */
+const MINI_PROGRAM_NETWORK_PROTECTED_PATHS = [
+    '/user_miniprogram/runtime/auth',
+    '/user_miniprogram/openapi/v1',
+];
+const NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS = 4;
+/** 使用 URL 解析后的 hostname 判断黑盒官方根域及其子域。 */
+function isOfficialMiniProgramNetworkUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            return false;
+        }
+        const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+        return OFFICIAL_MINI_PROGRAM_NETWORK_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+    }
+    catch {
+        return false;
+    }
+}
 /**
- * 登录授权能力方法名。
- *
- * @remarks
- * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
+ * 规范化并判断 pathname 是否命中 Runtime Auth / OpenAPI 保护前缀。
+ * 解码失败或仍可继续解码时视为不安全路径。
  */
-const AUTH_LOGIN_METHOD = 'auth.login';
+function isProtectedMiniProgramNetworkPath(pathname) {
+    const normalized = normalizeMiniProgramNetworkPathname(pathname);
+    if (normalized === null) {
+        return true;
+    }
+    return MINI_PROGRAM_NETWORK_PROTECTED_PATHS.some(prefix => normalized === prefix || normalized.startsWith(`${prefix}/`));
+}
+function normalizeMiniProgramNetworkPathname(pathname) {
+    let decoded = pathname;
+    for (let round = 0; round < NETWORK_REQUEST_PATHNAME_MAX_DECODE_ROUNDS; round += 1) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return null;
+        }
+        if (next === decoded) {
+            return normalizeDecodedNetworkPathname(decoded);
+        }
+        decoded = next;
+    }
+    try {
+        if (decodeURIComponent(decoded) !== decoded) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return normalizeDecodedNetworkPathname(decoded);
+}
+function normalizeDecodedNetworkPathname(decoded) {
+    const segments = [];
+    for (const segment of decoded.replace(/\\/g, '/').split('/')) {
+        if (!segment || segment === '.') {
+            continue;
+        }
+        if (segment === '..') {
+            segments.pop();
+            continue;
+        }
+        segments.push(segment);
+    }
+    return `/${segments.join('/')}`;
+}
+
 /**
- * 用户信息能力方法名。
+ * 登录授权能力方法名。
  *
  * @remarks
  * 供 SDK 与父容器 runtime 共享同一 bridge method 标识。
  */
+const AUTH_LOGIN_METHOD = 'auth.login';
+/** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 当前用户展示详情能力方法名。 */
-const USER_GET_CURRENT_USER_DETAIL_METHOD = 'user.getCurrentUserDetail';
-/** 当前用户敏感资料详情能力方法名。 */
-const USER_GET_CURRENT_USER_PROFILE_METHOD = 'user.getCurrentUserProfile';
-/** 当前用户平台账号概览能力方法名。 */
-const USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD = 'user.getPlatformAccountOverview';
-/** 当前用户指定平台账号详情能力方法名。 */
-const USER_GET_PLATFORM_ACCOUNT_INFO_METHOD = 'user.getPlatformAccountInfo';
-/** 当前用户 Steam 游戏库能力方法名。 */
+/** 读取当前用户小程序隔离身份的 bridge method 标识。 */
+const USER_GET_LOCAL_IDENTITY_METHOD = 'user.getLocalIdentity';
+/** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
+const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
+/** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
 const USER_GET_STEAM_GAME_LIST_METHOD = 'user.getSteamGameList';
 /**
  * 展示分享面板能力方法名。
@@ -203,38 +271,24 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         risk: 'medium',
     },
     {
-        method: USER_GET_CURRENT_USER_DETAIL_METHOD,
-        module: 'user',
-        capability: USER_GET_CURRENT_USER_DETAIL_METHOD,
-        permission: 'user.currentUserDetail',
-        risk: 'high',
-    },
-    {
-        method: USER_GET_CURRENT_USER_PROFILE_METHOD,
-        module: 'user',
-        capability: USER_GET_CURRENT_USER_PROFILE_METHOD,
-        permission: 'user.currentUserProfile',
-        risk: 'high',
-    },
-    {
-        method: USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD,
+        method: USER_GET_LOCAL_IDENTITY_METHOD,
         module: 'user',
-        capability: USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD,
-        permission: 'user.platformAccount.overview',
+        capability: USER_GET_LOCAL_IDENTITY_METHOD,
+        permission: 'user.getLocalIdentity',
         risk: 'medium',
     },
     {
-        method: USER_GET_PLATFORM_ACCOUNT_INFO_METHOD,
+        method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
-        capability: USER_GET_PLATFORM_ACCOUNT_INFO_METHOD,
-        permission: 'user.platformAccount.info',
+        capability: USER_REVOKE_AUTHORIZATION_METHOD,
+        permission: 'user.revokeAuthorization',
         risk: 'high',
     },
     {
         method: USER_GET_STEAM_GAME_LIST_METHOD,
         module: 'user',
         capability: USER_GET_STEAM_GAME_LIST_METHOD,
-        permission: 'user.steamGameList',
+        permission: 'user.platformAccount.steam',
         risk: 'high',
     },
     {
@@ -379,4 +433,4 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
     },
 ];
 
-export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_CURRENT_USER_DETAIL_METHOD, USER_GET_CURRENT_USER_PROFILE_METHOD, USER_GET_INFO_METHOD, USER_GET_PLATFORM_ACCOUNT_INFO_METHOD, USER_GET_PLATFORM_ACCOUNT_OVERVIEW_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, parseMiniProgramRuntimePermissions };
+export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_NETWORK_PROTECTED_PATHS, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_LOCAL_IDENTITY_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isOfficialMiniProgramNetworkUrl, isProtectedMiniProgramNetworkPath, normalizeMiniProgramNetworkPathname, parseMiniProgramRuntimePermissions };

package/dist/templates/vue3-vite-ts/README.md.ejs

@@ -42,4 +42,4 @@ await hbSDK.storage.setStorage({
 
 ```
 
-工坊小程序默认不能进行网络请求，网络权限暂未开放申请。
+工坊小程序默认不能进行网络请求。开通网络权限后，把 `VITE_HEYBOX_AUTH_EXCHANGE_URL` 配成开发者服务端的 HTTPS 交换地址（本地可用 localhost）。授权契约见文档站「用户身份与登录」。

package/dist/templates/vue3-vite-ts/src/App.vue

@@ -4,13 +4,13 @@
       <p class="eyebrow">Heybox Mini Program</p>
       <h1><%= projectName %></h1>
       <p class="intro">
-        这个模板只保留最小接入示例：等待 SDK ready、读取用户信息，并在需要时唤起登录。
+        这个模板只保留最小接入示例：等待 SDK ready，并由用户主动选择受支持的操作。
       </p>
 
       <p class="status" data-testid="status">{{ status }}</p>
 
       <button type="button" :disabled="loading" data-testid="login" @click="login">
-        登录并刷新用户信息
+        获取授权码
       </button>
 
       <pre data-testid="output">{{ output }}</pre>
@@ -21,36 +21,41 @@
 <script setup lang="ts">
 import hbSDK from '@heybox/hb-sdk';
 import { onMounted, ref } from 'vue';
+import { loginAndExchangeAuthorizationCode } from './auth-handoff';
 
 const loading = ref(false);
 const status = ref('正在连接 SDK...');
-const output = ref('等待 user.getInfo 返回结果。');
+const output = ref('连接后请选择操作。');
 
 onMounted(() => {
-  void loadUserInfo();
+  void connectSDK();
 });
 
-async function loadUserInfo() {
-  await runSdkAction('user.getInfo', async () => {
+async function connectSDK() {
+  try {
     await hbSDK.ready();
-    return hbSDK.user.getInfo();
-  });
+    status.value = 'SDK 已连接';
+    output.value = '请选择操作。';
+  } catch (error) {
+    status.value = 'SDK 连接失败';
+    output.value = readErrorMessage(error);
+  }
 }
 
 async function login() {
-  await runSdkAction('auth.login', () => hbSDK.auth.login());
-}
-
-async function runSdkAction(label: string, action: () => Promise<unknown>) {
   loading.value = true;
-  status.value = `${label} 调用中...`;
+  status.value = 'auth.login 调用中...';
 
   try {
-    const result = await action();
-    status.value = `${label} 调用成功`;
-    output.value = JSON.stringify(result, null, 2);
+    const { expiresIn, scopes } = await loginAndExchangeAuthorizationCode({
+      exchangeUrl: import.meta.env.VITE_HEYBOX_AUTH_EXCHANGE_URL,
+      login: () => hbSDK.auth.login(),
+      request: (config) => hbSDK.network.request(config),
+    });
+    status.value = 'auth.login 调用成功';
+    output.value = JSON.stringify({ expiresIn, scopes }, null, 2);
   } catch (error) {
-    status.value = `${label} 调用失败`;
+    status.value = 'auth.login 调用失败';
     output.value = readErrorMessage(error);
   } finally {
     loading.value = false;

package/dist/templates/vue3-vite-ts/src/__tests__/App.spec.ts

@@ -3,65 +3,73 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import App from '../App.vue';
 
 const sdkMock = vi.hoisted(() => ({
-  authLogin: vi.fn(),
+  login: vi.fn(),
+  networkRequest: vi.fn(),
   ready: vi.fn(),
-  userGetInfo: vi.fn(),
 }));
 
 vi.mock('@heybox/hb-sdk', () => ({
   default: {
     auth: {
-      login: sdkMock.authLogin,
+      login: sdkMock.login,
     },
-    ready: sdkMock.ready,
-    user: {
-      getInfo: sdkMock.userGetInfo,
+    network: {
+      request: sdkMock.networkRequest,
     },
+    ready: sdkMock.ready,
   },
 }));
 
 describe('App', () => {
   beforeEach(() => {
     vi.resetAllMocks();
+    vi.unstubAllEnvs();
 
     sdkMock.ready.mockResolvedValue(undefined);
-    sdkMock.userGetInfo.mockResolvedValue({
-      isLogin: true,
-      userInfo: {
-        avatar: '',
-        heybox_id: '10001',
-        nickname: '模板用户',
-      },
-    });
-    sdkMock.authLogin.mockResolvedValue({
-      isLogin: true,
-      userInfo: {
-        avatar: '',
-        heybox_id: '10002',
-        nickname: '登录用户',
-      },
-    });
+    sdkMock.login.mockResolvedValue({ code: 'authorization_code', expiresIn: 300, scopes: ['identity'] });
+    sdkMock.networkRequest.mockResolvedValue({ status: 200 });
   });
 
-  it('connects to hb-sdk and renders user info', async () => {
+  it('only waits for SDK readiness during startup', async () => {
     const wrapper = mount(App);
     await flushPromises();
 
     expect(sdkMock.ready).toHaveBeenCalledTimes(1);
-    expect(sdkMock.userGetInfo).toHaveBeenCalledTimes(1);
-    expect(wrapper.get('[data-testid="status"]').text()).toBe('user.getInfo 调用成功');
-    expect(wrapper.get('[data-testid="output"]').text()).toContain('模板用户');
+    expect(sdkMock.login).not.toHaveBeenCalled();
+    expect(wrapper.get('[data-testid="status"]').text()).toBe('SDK 已连接');
+    expect(wrapper.get('[data-testid="output"]').text()).toContain('请选择操作');
   });
 
-  it('logs in and refreshes the output', async () => {
+  it('hands the authorization code to the developer server without rendering it', async () => {
+    vi.stubEnv('VITE_HEYBOX_AUTH_EXCHANGE_URL', 'https://developer.example.com/api/heybox/exchange');
     const wrapper = mount(App);
     await flushPromises();
 
     await wrapper.get('[data-testid="login"]').trigger('click');
     await flushPromises();
 
-    expect(sdkMock.authLogin).toHaveBeenCalledTimes(1);
+    expect(sdkMock.login).toHaveBeenCalledTimes(1);
+    expect(sdkMock.networkRequest).toHaveBeenCalledWith({
+      method: 'POST',
+      url: 'https://developer.example.com/api/heybox/exchange',
+      data: { code: 'authorization_code' },
+    });
     expect(wrapper.get('[data-testid="status"]').text()).toBe('auth.login 调用成功');
-    expect(wrapper.get('[data-testid="output"]').text()).toContain('登录用户');
+    expect(wrapper.get('[data-testid="output"]').text()).toContain('300');
+    expect(wrapper.get('[data-testid="output"]').text()).toContain('identity');
+    expect(wrapper.text()).not.toContain('authorization_code');
+  });
+
+  it('does not request a code when the developer server is not configured', async () => {
+    const wrapper = mount(App);
+    await flushPromises();
+
+    await wrapper.get('[data-testid="login"]').trigger('click');
+    await flushPromises();
+
+    expect(sdkMock.login).not.toHaveBeenCalled();
+    expect(sdkMock.networkRequest).not.toHaveBeenCalled();
+    expect(wrapper.get('[data-testid="status"]').text()).toBe('auth.login 调用失败');
+    expect(wrapper.get('[data-testid="output"]').text()).toContain('VITE_HEYBOX_AUTH_EXCHANGE_URL');
   });
 });

package/dist/templates/vue3-vite-ts/src/auth-handoff.ts

@@ -0,0 +1,46 @@
+export interface AuthorizationCodeLoginResult {
+  code: string;
+  expiresIn: number;
+  scopes: string[];
+}
+
+export interface LoginAndExchangeAuthorizationCodeOptions {
+  exchangeUrl?: string;
+  login: () => Promise<AuthorizationCodeLoginResult>;
+  request: (config: {
+    method: 'POST';
+    url: string;
+    data: { code: string };
+  }) => Promise<unknown>;
+}
+
+export async function loginAndExchangeAuthorizationCode(options: LoginAndExchangeAuthorizationCodeOptions) {
+  const exchangeUrl = options.exchangeUrl?.trim();
+  if (!exchangeUrl) {
+    throw new Error('请先配置 VITE_HEYBOX_AUTH_EXCHANGE_URL');
+  }
+  if (!isAllowedExchangeUrl(exchangeUrl)) {
+    throw new Error('VITE_HEYBOX_AUTH_EXCHANGE_URL 必须使用 HTTPS，本地调试仅允许 localhost');
+  }
+
+  const { code, expiresIn, scopes } = await options.login();
+  await options.request({
+    method: 'POST',
+    url: exchangeUrl,
+    data: { code },
+  });
+
+  return { expiresIn, scopes };
+}
+
+function isAllowedExchangeUrl(value: string) {
+  try {
+    const url = new URL(value);
+    if (url.protocol === 'https:') {
+      return true;
+    }
+    return url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+  } catch {
+    return false;
+  }
+}

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.9';
+    : '0.7.0-alpha.2';
 
 var re = {exports: {}};
 
@@ -11304,7 +11304,7 @@ function parse(html, options) {
 /** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 /** 小程序沙盒通信协议版本。 */
-const MINI_PROGRAM_MESSAGE_VERSION = 1;
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
 /** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 

package/dist/vite.esm.js

@@ -5,7 +5,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.9';
+    : '0.7.0-alpha.2';
 
 var re = {exports: {}};
 
@@ -11301,7 +11301,7 @@ function parse(html, options) {
 /** 小程序沙盒通信命名空间，父容器与 iframe 内 SDK 必须保持一致。 */
 const MINI_PROGRAM_MESSAGE_NAMESPACE = 'heybox:miniprogram';
 /** 小程序沙盒通信协议版本。 */
-const MINI_PROGRAM_MESSAGE_VERSION = 1;
+const MINI_PROGRAM_MESSAGE_VERSION = 2;
 /** 父容器注入到小程序 URL 上的通信 nonce 参数名。 */
 const MINI_PROGRAM_BRIDGE_NONCE_PARAM = 'hb_mini_bridge_nonce';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.9",
+  "version": "0.7.0-alpha.2",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -95,7 +95,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.11"
+    "@heybox/hb-api": "~1.25.16"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",