@heybox/hb-sdk 0.7.1 → 0.7.2

package/dist/protocol.cjs.js

@@ -188,8 +188,6 @@ function normalizeDecodedNetworkPathname(decoded) {
 const AUTH_LOGIN_METHOD = 'auth.login';
 /** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 读取当前用户小程序隔离身份的 bridge method 标识。 */
-const USER_GET_LOCAL_IDENTITY_METHOD = 'user.getLocalIdentity';
 /** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
 const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
 /** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
@@ -290,13 +288,6 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'user.getInfo',
         risk: 'medium',
     },
-    {
-        method: USER_GET_LOCAL_IDENTITY_METHOD,
-        module: 'user',
-        capability: USER_GET_LOCAL_IDENTITY_METHOD,
-        permission: 'user.getLocalIdentity',
-        risk: 'medium',
-    },
     {
         method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
@@ -482,7 +473,6 @@ exports.UI_HIDE_LOADING_METHOD = UI_HIDE_LOADING_METHOD;
 exports.UI_SHOW_LOADING_METHOD = UI_SHOW_LOADING_METHOD;
 exports.UI_SHOW_TOAST_METHOD = UI_SHOW_TOAST_METHOD;
 exports.USER_GET_INFO_METHOD = USER_GET_INFO_METHOD;
-exports.USER_GET_LOCAL_IDENTITY_METHOD = USER_GET_LOCAL_IDENTITY_METHOD;
 exports.USER_GET_STEAM_GAME_LIST_METHOD = USER_GET_STEAM_GAME_LIST_METHOD;
 exports.USER_REVOKE_AUTHORIZATION_METHOD = USER_REVOKE_AUTHORIZATION_METHOD;
 exports.VIEWPORT_GET_WINDOW_INFO_METHOD = VIEWPORT_GET_WINDOW_INFO_METHOD;

package/dist/protocol.esm.js

@@ -186,8 +186,6 @@ function normalizeDecodedNetworkPathname(decoded) {
 const AUTH_LOGIN_METHOD = 'auth.login';
 /** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 读取当前用户小程序隔离身份的 bridge method 标识。 */
-const USER_GET_LOCAL_IDENTITY_METHOD = 'user.getLocalIdentity';
 /** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
 const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
 /** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
@@ -288,13 +286,6 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'user.getInfo',
         risk: 'medium',
     },
-    {
-        method: USER_GET_LOCAL_IDENTITY_METHOD,
-        module: 'user',
-        capability: USER_GET_LOCAL_IDENTITY_METHOD,
-        permission: 'user.getLocalIdentity',
-        risk: 'medium',
-    },
     {
         method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
@@ -451,4 +442,4 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
     },
 ];
 
-export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_NETWORK_PROTECTED_PATHS, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_LOCAL_IDENTITY_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, computeTrustedIframeUserGesture, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isOfficialMiniProgramNetworkUrl, isProtectedMiniProgramNetworkPath, normalizeMiniProgramNetworkPathname, parseMiniProgramRuntimePermissions };
+export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_NETWORK_PROTECTED_PATHS, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, computeTrustedIframeUserGesture, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isOfficialMiniProgramNetworkUrl, isProtectedMiniProgramNetworkPath, normalizeMiniProgramNetworkPathname, parseMiniProgramRuntimePermissions };

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.1';
+    : '0.7.2';
 
 var re = {exports: {}};
 

package/dist/vite.esm.js

@@ -5,7 +5,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.1';
+    : '0.7.2';
 
 var re = {exports: {}};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",

package/skill/SKILL.md

@@ -41,14 +41,14 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 1. Import the root package eagerly; the SDK starts its handshake automatically and capability calls wait for it internally.
 2. For a network-enabled mini-program, use `auth.login({ scopes? })` to obtain `{ code, expiresIn: 300, scopes }`. Identity is always implicit; request only optional scopes the business actually needs.
 3. Send the code only to the developer's backend. That backend follows the backend OpenAPI documentation to exchange it for a token; mini-program code must never exchange application credentials itself.
-4. For a network-disabled mini-program, call `user.getLocalIdentity()` from a trusted user action to obtain `{ appUserId }`, because first login or identity consent may require UI. It cannot obtain a code or call OpenAPI.
+4. For a network-disabled mini-program, call `user.getInfo()` to read the current login state and `userInfo.app_user_id`. This read is silent and does not require a trusted user action. It cannot obtain a code or call OpenAPI.
 5. Handle `HbMiniProgramSDKError` for SDK initialization and capability failures.
 6. Handle `HbMiniProgramNetworkError` separately when HTTP completed but `validateStatus` rejected the status.
 7. Use `getHandshakeState()` for the current persistent handshake state and `onHandshakeStateChange()` for an immediate replay plus future changes. Cancel the returned subscription when the page or component unmounts.
 8. Treat the non-replayed `ready` lifecycle event only as an edge notification. After a duplicate handshake it may repeat, so never use it as state or as the source for enabling a late-mounted control.
 9. Use the default SDK instance exposed by the root package. For gesture-gated controls, initialize from the current handshake state, subscribe to changes, and enable the control only when `status === 'ready'`. Keep calls such as `auth.login()` in the original user-action callback; do not wait for handshake inside that callback.
-10. When authorization UI is required, call `auth.login()` or `user.getLocalIdentity()` from a trusted user action. Missing gesture returns `USER_GESTURE_REQUIRED`; cancelling, rejecting, or closing returns `AUTHORIZATION_CANCELLED` and does not confirm or change authorization. An already-authorized `auth.login()` request may return a new code silently.
-11. `user.getSteamGameList()` is available only to network-disabled mini-programs. In a network-enabled mini-program it returns `SERVER_API_REQUIRED`, and there is no Steam library authorization scope or OpenAPI resource. Treat `user.getInfo()` and `user.getLocalIdentity()` returning `SERVER_API_REQUIRED` as a server-boundary signal, not as logged-out state.
+10. When authorization UI is required, call `auth.login()` from a trusted user action. Missing gesture returns `USER_GESTURE_REQUIRED`; cancelling, rejecting, or closing returns `AUTHORIZATION_CANCELLED` and does not confirm or change authorization. An already-authorized `auth.login()` request may return a new code silently.
+11. `user.getSteamGameList()` is available only to network-disabled mini-programs. In a network-enabled mini-program it returns `SERVER_API_REQUIRED`, and there is no Steam library authorization scope or OpenAPI resource. Treat `user.getInfo()` returning `SERVER_API_REQUIRED` as a server-boundary signal, not as logged-out state.
 12. Use `share.showShareMenu({ post })` or `share.screenshot({ post })` to preset editable community destinations and topics. Pass partition IDs through `topicIds` and topic text without surrounding `#` through `topics`; do not construct the underlying client post protocol.
 
 ## Step 5: Use CLI workflows
@@ -60,12 +60,12 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 5. Keep `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the required Manifest or Runtime gate output is missing.
 6. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
 7. Existing projects may continue to use `vite build`; do not auto-migrate them. Do not invent `--mode`, `--json`, config, or output-directory flags for `hb-sdk build`.
-8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for development and publishing commands. This login does not change `auth.login()`, `user.getLocalIdentity()`, or the mini-program user's authorization state.
+8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for development and publishing commands. This login does not change `auth.login()`, `user.getInfo()`, or the mini-program user's authorization state.
 9. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
 10. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
 11. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management.
 12. Use `hb-sdk remote deploy --release-note <text>` to run the project's `scripts.build`, upload, and submit the current project for audit. Do not recommend the removed top-level `hb-sdk deploy` alias.
-13. `hb-sdk dev` and `hb-sdk remote deploy` skip the platform CSP only when the validated remote permission snapshot has `network.request.status=enabled` and `useOfficialDomain=true`. Direct `hb-sdk build`, direct Vite build, anonymous or invalid snapshots, and local Dev Context overrides must keep the platform CSP. Runtime Gate, Manifest, and HTML validation always remain active.
+13. `hb-sdk dev` and `hb-sdk remote deploy` skip the platform CSP only when the validated remote permission snapshot has `network.request.status=enabled`. `useOfficialDomain` does not participate in CSP skip decisions. Direct `hb-sdk build`, direct Vite build, anonymous or invalid snapshots, and local Dev Context overrides must keep the platform CSP. Runtime Gate, Manifest, and HTML validation always remain active.
 14. After approval, use `hb-sdk remote release <version>` for manual release or `--auto-publish` when an eligible low-risk version should release automatically.
 15. Treat approval, release, and public display as separate states. Do not promise square, search, or recommendation visibility after release.
 16. Use `hb-sdk remote withdraw`, `hb-sdk remote take-down`, `hb-sdk remote reopen`, and square visibility commands only after showing the target and obtaining required confirmation.

package/skill/references/api-protocol.md

@@ -73,7 +73,6 @@ export {
   UI_HIDE_LOADING_METHOD,
   UI_SHOW_LOADING_METHOD,
   UI_SHOW_TOAST_METHOD,
-  USER_GET_LOCAL_IDENTITY_METHOD,
   USER_REVOKE_AUTHORIZATION_METHOD,
   USER_GET_STEAM_GAME_LIST_METHOD,
   USER_GET_INFO_METHOD,
@@ -117,8 +116,6 @@ export type {
 } from './modules/cloud';
 export type {
   AuthorizedUserInfo,
-  GetLocalIdentityPayload,
-  GetLocalIdentityResult,
   GetUserInfoPayload,
   GetUserInfoResult,
   RevokeAuthorizationPayload,
@@ -211,7 +208,7 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成，不
 
 | 导出面 | Classes | Functions | Interfaces | Types | Constants |
 | --- | ---: | ---: | ---: | ---: | ---: |
-| Root API | 2 | 4 | 51 | 54 | 0 |
-| Protocol API | 0 | 7 | 47 | 65 | 31 |
+| Root API | 2 | 4 | 50 | 53 | 0 |
+| Protocol API | 0 | 7 | 46 | 64 | 30 |
 | Miniapp Publish API | 0 | 5 | 2 | 0 | 0 |
 | Vite API | 0 | 1 | 0 | 0 | 0 |

package/skill/references/api-root.md

@@ -24,7 +24,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.7.0`
+- Version at generation time: `0.7.2`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -70,8 +70,6 @@ export type {
 } from './modules/cloud';
 export type {
   AuthorizedUserInfo,
-  GetLocalIdentityPayload,
-  GetLocalIdentityResult,
   GetUserInfoPayload,
   GetUserInfoResult,
   RevokeAuthorizationPayload,
@@ -373,7 +371,7 @@ hb-sdk build [--env <name>] [--verbose]
 
 `hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `vite.config.ts` 中显式注册 `miniappManifest()`。
 
-直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端权限；仅当 `network.request.status=enabled` 且 `useOfficialDomain=true` 时向子构建传递已验证上下文并跳过平台 CSP。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
+直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端权限；仅当 `network.request.status=enabled` 时向子构建传递已验证上下文并跳过平台 CSP，`useOfficialDomain` 不参与该判定。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
 
 推荐由项目的 `scripts.build` 保留类型检查：
 
@@ -396,7 +394,7 @@ hb-sdk build [--env <name>] [--verbose]
 
 ## 交互控件与握手状态
 
-`auth.login()`、`user.getLocalIdentity()` 等可能展示授权 UI 的能力必须保留原始可信用户手势。不要在点击回调中等待握手；页面加载时读取并订阅持久握手状态，只在 `status === 'ready'` 时启用按钮：
+`auth.login()` 等可能展示授权 UI 的能力必须保留原始可信用户手势。不要在点击回调中等待握手；页面加载时读取并订阅持久握手状态，只在 `status === 'ready'` 时启用按钮：
 
 ```ts
 import hbSDK, { type MiniProgramSDKHandshakeState } from '@heybox/hb-sdk'
@@ -415,25 +413,18 @@ onUnmounted(stopHandshakeState)
 
 ## 未开通网络权限
 
-无网络小程序可以在本地能力中使用按小程序隔离的 `appUserId`：
+无网络小程序可以在本地能力中使用按小程序隔离的 `app_user_id`：
 
 ```ts
-import hbSDK, { HbMiniProgramSDKError } from '@heybox/hb-sdk'
+import hbSDK from '@heybox/hb-sdk'
 
-async function getLocalIdentityFromUserAction() {
-  try {
-    const { appUserId } = await hbSDK.user.getLocalIdentity()
-    return appUserId
-  } catch (error) {
-    if (error instanceof HbMiniProgramSDKError && error.code === 'AUTHORIZATION_CANCELLED') {
-      return undefined
-    }
-    throw error
-  }
+async function getCurrentUser() {
+  const result = await hbSDK.user.getInfo()
+  return result.userInfo?.app_user_id
 }
 ```
 
-把 `getLocalIdentityFromUserAction` 绑定到按钮点击等可信用户操作。首次登录或 identity consent 需要 UI 而缺少可信手势时返回 `USER_GESTURE_REQUIRED`；取消或关闭时返回 `AUTHORIZATION_CANCELLED`，不会确认或改变授权状态。这条路径不能获取授权码或调用 OpenAPI，也不要把 `appUserId` 发送到外部服务。
+`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回未登录状态；已登录时静默返回 `userInfo.app_user_id`。这条路径不能获取授权码或调用 OpenAPI，也不要把 `app_user_id` 发送到外部服务。
 
 ## 已开通网络权限
 
@@ -562,7 +553,7 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 | 模块         | 用途                                                         |
 | ------------ | ------------------------------------------------------------ |
 | `auth`       | 获取交给开发者服务端交换的短期授权码                         |
-| `user`       | 使用 Host current-user APIs 或读取无网络小程序的本地隔离身份 |
+| `user`       | 读取 Host 当前用户资料、隔离身份或撤销授权                   |
 | `share`      | 打开分享或截图分享流程                                       |
 | `ui`         | 展示 Toast 和 Loading                                        |
 | `device`     | 调用振动和剪贴板能力                                         |

package/skill/references/cli.md

@@ -29,7 +29,7 @@
 
 Use the bundled `hb-sdk` CLI to create a workshop mini-program, open the local debugging page, test in the Heybox Mac or mobile App, or manage and publish a remote mini-program.
 
-`hb-sdk login` is for development and publishing commands only. It does not authorize mini-program users and does not change `auth.login()`, `user.getLocalIdentity()`, or `network.request()` inside a mini-program.
+`hb-sdk login` is for development and publishing commands only. It does not authorize mini-program users and does not change `auth.login()`, `user.getInfo()`, or `network.request()` inside a mini-program.
 
 ## Command surface
 
@@ -106,7 +106,7 @@ CLI 会启动页面服务并自动打开本地调试页。调试页会展示小
 
 未登录或未绑定小程序时，浏览器、Mac 和手机调试入口仍然可用，但受管能力会默认拒绝。登录并绑定后，调试页才能根据当前小程序的线上配置提示差异。
 
-`hb-sdk dev` 会在启动 Vite 前读取远端权限。只有远端权限快照有效、`network.request.status=enabled` 且 `useOfficialDomain=true` 时才跳过平台 CSP；未登录、未绑定、读取失败、非法快照或仅在 Dev Context 中开启本地权限覆盖时都继续注入 CSP。
+`hb-sdk dev` 会在启动 Vite 前读取远端权限。只有远端权限快照有效且 `network.request.status=enabled` 时才跳过平台 CSP；`useOfficialDomain` 不参与该判定。未登录、未绑定、读取失败、非法快照或仅在 Dev Context 中开启本地权限覆盖时都继续注入 CSP。
 
 ### 2. 先用浏览器 Mock 验收
 
@@ -155,7 +155,7 @@ hb-sdk build [--env <name>] [--verbose]
 
 `hb-sdk build` 直接使用项目安装的 Vite，先清理再生成固定的 `dist/`，并校验小程序入口、Manifest 和可上传产物。它不执行类型检查，不要求 CLI 登录或绑定小程序，也不访问远端服务。项目必须在 `vite.config.ts` 中显式注册 `miniappManifest()`。
 
-直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端权限；仅当 `network.request.status=enabled` 且 `useOfficialDomain=true` 时向子构建传递已验证上下文并跳过平台 CSP。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
+直接运行 `hb-sdk build` 或 `vite build` 时默认注入平台 CSP。`hb-sdk remote deploy` 会在构建前读取绑定小程序的远端权限；仅当 `network.request.status=enabled` 时向子构建传递已验证上下文并跳过平台 CSP，`useOfficialDomain` 不参与该判定。权限缺失、非法或读取失败时继续注入，Runtime Gate、Manifest 与 HTML 构建检查始终保留。
 
 推荐由项目的 `scripts.build` 保留类型检查：
 
@@ -250,7 +250,7 @@ Agent rules:
 
 ## CLI 登录态
 
-CLI 登录态只用于开发工具和远端管理，不等同于小程序内的用户登录态，也不会改变 `auth.login()`、`user.getLocalIdentity()` 或开发者服务端会话。
+CLI 登录态只用于开发工具和远端管理，不等同于小程序内的用户登录态，也不会改变 `auth.login()`、`user.getInfo()` 或开发者服务端会话。
 
 ```bash
 hb-sdk login status

package/skill/references/examples.md

@@ -34,20 +34,14 @@ function setLoginButtonDisabled(disabled: boolean) {
 }
 ```
 
-### Local identity for a network-disabled mini-program
+### Current user for a network-disabled mini-program
 
 ```ts
-import { user, HbMiniProgramSDKError } from '@heybox/hb-sdk';
+import { user } from '@heybox/hb-sdk';
 
-export async function getLocalIdentityFromUserAction() {
-  try {
-    return await user.getLocalIdentity();
-  } catch (error) {
-    if (error instanceof HbMiniProgramSDKError && error.code === 'AUTHORIZATION_CANCELLED') {
-      return undefined;
-    }
-    throw error;
-  }
+export async function getCurrentUser() {
+  const result = await user.getInfo();
+  return result.userInfo?.app_user_id;
 }
 ```
 

package/skill/references/recipes.md

@@ -30,7 +30,7 @@
 
 ## 交互控件与握手状态
 
-`auth.login()`、`user.getLocalIdentity()` 等可能展示授权 UI 的能力必须保留原始可信用户手势。不要在点击回调中等待握手；页面加载时读取并订阅持久握手状态，只在 `status === 'ready'` 时启用按钮：
+`auth.login()` 等可能展示授权 UI 的能力必须保留原始可信用户手势。不要在点击回调中等待握手；页面加载时读取并订阅持久握手状态，只在 `status === 'ready'` 时启用按钮：
 
 ```ts
 import hbSDK, { type MiniProgramSDKHandshakeState } from '@heybox/hb-sdk'
@@ -49,25 +49,18 @@ onUnmounted(stopHandshakeState)
 
 ## 未开通网络权限
 
-无网络小程序可以在本地能力中使用按小程序隔离的 `appUserId`：
+无网络小程序可以在本地能力中使用按小程序隔离的 `app_user_id`：
 
 ```ts
-import hbSDK, { HbMiniProgramSDKError } from '@heybox/hb-sdk'
+import hbSDK from '@heybox/hb-sdk'
 
-async function getLocalIdentityFromUserAction() {
-  try {
-    const { appUserId } = await hbSDK.user.getLocalIdentity()
-    return appUserId
-  } catch (error) {
-    if (error instanceof HbMiniProgramSDKError && error.code === 'AUTHORIZATION_CANCELLED') {
-      return undefined
-    }
-    throw error
-  }
+async function getCurrentUser() {
+  const result = await hbSDK.user.getInfo()
+  return result.userInfo?.app_user_id
 }
 ```
 
-把 `getLocalIdentityFromUserAction` 绑定到按钮点击等可信用户操作。首次登录或 identity consent 需要 UI 而缺少可信手势时返回 `USER_GESTURE_REQUIRED`；取消或关闭时返回 `AUTHORIZATION_CANCELLED`，不会确认或改变授权状态。这条路径不能获取授权码或调用 OpenAPI，也不要把 `appUserId` 发送到外部服务。
+`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回未登录状态；已登录时静默返回 `userInfo.app_user_id`。这条路径不能获取授权码或调用 OpenAPI，也不要把 `app_user_id` 发送到外部服务。
 
 ## 已开通网络权限
 
@@ -116,7 +109,7 @@ async function loginFromUserAction() {
 | 小程序类型     | 身份入口                  | 结果用途                                               |
 | -------------- | ------------------------- | ------------------------------------------------------ |
 | 已开通网络权限 | `auth.login({ scopes? })` | 获取短期授权码，由开发者服务端换取 OpenAPI token       |
-| 未开通网络权限 | `user.getLocalIdentity()` | 在当前小程序页面和平台代管能力中使用隔离的 `appUserId` |
+| 未开通网络权限 | `user.getInfo()`          | 静默读取当前小程序隔离的 `userInfo.app_user_id`        |
 
 不要混用两条路径。SDK 不向小程序页面提供 token、cookie、黑盒用户 ID 或平台私有凭据。
 
@@ -160,7 +153,7 @@ async function loginFromUserAction() {
 
 `identity` 始终隐式包含，不需要也不能通过省略它来申请匿名授权。`scopes` 只填写业务确实需要的可选资料，例如 `profile`；不需要额外资料时直接调用 `auth.login()`。
 
-小程序页面只把 `code` 发送到自己的服务端。开发者服务端再按后端 OpenAPI 文档，用服务端保存的应用凭据交换 token；页面不得自行交换，也不得持有应用私密凭据。`auth.login()` 不返回 user、profile、`appUserId` 或 token。
+小程序页面只把 `code` 发送到自己的服务端。开发者服务端再按后端 OpenAPI 文档，用服务端保存的应用凭据交换 token；页面不得自行交换，也不得持有应用私密凭据。`auth.login()` 不返回 user、profile、`app_user_id` 或 token。
 
 开发者服务端用 access token 调用 `GET /user_miniprogram/openapi/v1/user` 读取当前用户。响应始终包含 `app_user_id`；token 含 `profile` 时还会返回 `nickname` 和 `avatar`。不要再请求已下线的 `/user/identity` 或 `/user/profile`。
 
@@ -188,7 +181,7 @@ async function revokeAuthorizationFromUserAction() {
 
 `user.revokeAuthorization()` 不接收参数。小程序页面不能提交小程序 ID、黑盒用户 ID 或手势标记；Runtime 从 Host 启动上下文和用户操作状态注入可信值。调用缺少可信用户手势时返回 `USER_GESTURE_REQUIRED`。
 
-撤销成功后，后续 `auth.login()` 或 `user.getLocalIdentity()` 会重新进入授权流程。业务必须立即停止使用并清理此前保存的 `appUserId`、用户资料和开发者服务端会话；SDK 不会删除业务自己的 localStorage、数据库或 cookie。
+撤销成功后，后续 `auth.login()` 会重新进入授权流程；无网络小程序再次调用 `user.getInfo()` 时会重新建立隔离身份。业务必须立即停止使用并清理此前保存的 `app_user_id`、用户资料和开发者服务端会话；SDK 不会删除业务自己的 localStorage、数据库或 cookie。
 
 ## 当前用户资料由服务端读取
 
@@ -196,7 +189,6 @@ async function revokeAuthorizationFromUserAction() {
 
 - `user.getInfo()`
 - `user.getSteamGameList(options)`
-- `user.getLocalIdentity()`
 
 其他 Host current-user capabilities 属于 Host/runtime 集成边界，不是小程序可从 SDK 根包调用的方法。需要对应数据时，先取得授权码，再由开发者服务端按后端 OpenAPI 文档换取 token 并调用对应接口。不要把 `SERVER_API_REQUIRED` 当作未登录或权限弹窗失败。
 
@@ -207,24 +199,15 @@ async function revokeAuthorizationFromUserAction() {
 未开通网络权限的小程序不走授权码流程。需要当前用户在本小程序内的稳定隔离身份时调用：
 
 ```ts
-import hbSDK, { HbMiniProgramSDKError } from '@heybox/hb-sdk'
+import hbSDK from '@heybox/hb-sdk'
 
-async function getLocalIdentityFromUserAction() {
-  try {
-    const { appUserId } = await hbSDK.user.getLocalIdentity()
-    return appUserId
-  } catch (error) {
-    if (error instanceof HbMiniProgramSDKError && error.code === 'AUTHORIZATION_CANCELLED') {
-      return undefined
-    }
-    throw error
-  }
+async function getCurrentUser() {
+  const result = await hbSDK.user.getInfo()
+  return result.userInfo?.app_user_id
 }
 ```
 
-`user.getLocalIdentity()` 返回 `{ appUserId }`，其中的 `appUserId` 就是上面介绍的当前小程序隔离身份。
-
-首次登录或尚未授予 identity 时，该调用可能展示 UI，因此 `getLocalIdentityFromUserAction` 必须绑定到按钮点击等可信用户操作；缺少可信手势时返回 `USER_GESTURE_REQUIRED`。用户取消、拒绝或关闭时返回 `AUTHORIZATION_CANCELLED`，不会确认或改变授权状态；业务应正常结束当前操作并允许稍后重试。
+`user.getInfo()` 是静默身份接口，不展示授权弹窗，也不要求可信用户手势。未登录时返回 `isHeyboxAppLoggedIn: false`；已登录时默认建立并返回当前小程序隔离的 `app_user_id`。调用该接口即表示允许平台为当前小程序建立隔离身份；每次成功调用都会广播一次 `user_info_authorization_change`，其中 `identity` 为 `granted`，即使授权状态没有发生变化。撤销授权后再次调用仍会静默建立新的隔离身份。
 
 这类小程序无法获取授权码，也无法调用 OpenAPI；在未开通网络权限时调用 `auth.login()` 同样返回 `SERVER_API_REQUIRED`。Host 提供的 current-user APIs 与平台代管能力继续按各自权限工作，但页面不能把其中的身份或资料发送到外部服务。
 
@@ -234,7 +217,7 @@ async function getLocalIdentityFromUserAction() {
 
 ## CLI 登录与用户登录
 
-`hb-sdk login` 只给本地开发和远端管理命令建立 CLI 登录态，与小程序页面的 `auth.login()`、`user.getLocalIdentity()` 和用户授权完全无关。
+`hb-sdk login` 只给本地开发和远端管理命令建立 CLI 登录态，与小程序页面的 `auth.login()`、`user.getInfo()` 和用户授权完全无关。
 
 ## Lifecycle events
 

package/skill/references/safety-boundaries.md

@@ -16,14 +16,14 @@
 - `auth.login({ scopes? })` 只返回 `{ code, expiresIn: 300, scopes }`；identity 隐式强制包含，code 只能提交给开发者服务端。
 - 需要授权 UI 时，`auth.login()` 必须来自可信用户手势，否则返回 `USER_GESTURE_REQUIRED`；用户取消或关闭时返回 `AUTHORIZATION_CANCELLED`。已授权时可以静默返回新 code。
 - `user.getSteamGameList()` 仅供未开通网络权限的小程序通过 Host 读取；已开通网络权限时返回 `SERVER_API_REQUIRED`，且授权码与 OpenAPI 不提供 Steam 游戏库 scope 或资源接口。
-- 已开通网络权限时，公开的 `user.getInfo()` 和 `user.getLocalIdentity()` 返回 `SERVER_API_REQUIRED`；对应身份和资料数据应由开发者服务端通过 OpenAPI 获取。
-- 未开通网络权限时，只用 `user.getLocalIdentity()` 获取 `{ appUserId }`，不能获取 code 或调用 OpenAPI。
+- 已开通网络权限时，公开的 `user.getInfo()` 返回 `SERVER_API_REQUIRED`；对应身份和资料数据应由开发者服务端通过 OpenAPI 获取。
+- 未开通网络权限时，使用 `user.getInfo()` 静默读取 `userInfo.app_user_id`，不能获取 code 或调用 OpenAPI。
 - `user.revokeAuthorization()` 在两种网络模式下都要求可信用户手势；成功后必须停止使用并清理业务缓存的旧身份、资料和服务端会话。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
 - 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。
 - `network.request()` 不能访问平台保留的 runtime auth 与 OpenAPI 内部路径；页面不得持有或交换服务端应用凭据。
 - `network.request` 不支持 `multipart/form-data`；App Host 仅支持 form（`application/x-www-form-urlencoded`）与 JSON。表单请用 `URLSearchParams#toString()` 作为 `data`，文件上传请走专用上传能力。
-- 仅当远端已启用 `network.request` 且 `useOfficialDomain=true` 时，`hb-sdk dev` 与 `hb-sdk remote deploy` 构建才会跳过平台 CSP；其他构建继续注入平台 CSP。
+- 仅当远端已启用 `network.request` 时，`hb-sdk dev` 与 `hb-sdk remote deploy` 构建才会跳过平台 CSP；其他构建继续注入平台 CSP。`useOfficialDomain` 不参与 CSP 跳过判定。
 - 构建必须启用 `miniappManifest()`，推荐统一使用 `hb-sdk build`。
 
 ## Agent rules

package/skill/scripts/sync-references.mjs

@@ -404,7 +404,7 @@ files.set(
 
 Use the bundled \`hb-sdk\` CLI to create a workshop mini-program, open the local debugging page, test in the Heybox Mac or mobile App, or manage and publish a remote mini-program.
 
-\`hb-sdk login\` is for development and publishing commands only. It does not authorize mini-program users and does not change \`auth.login()\`, \`user.getLocalIdentity()\`, or \`network.request()\` inside a mini-program.
+\`hb-sdk login\` is for development and publishing commands only. It does not authorize mini-program users and does not change \`auth.login()\`, \`user.getInfo()\`, or \`network.request()\` inside a mini-program.
 
 ## Command surface
 
@@ -636,21 +636,15 @@ function setLoginButtonDisabled(disabled: boolean) {
 }`,
 )}
 
-### Local identity for a network-disabled mini-program
+### Current user for a network-disabled mini-program
 
 ${fenced(
   'ts',
-  `import { user, HbMiniProgramSDKError } from '@heybox/hb-sdk';
+  `import { user } from '@heybox/hb-sdk';
 
-export async function getLocalIdentityFromUserAction() {
-  try {
-    return await user.getLocalIdentity();
-  } catch (error) {
-    if (error instanceof HbMiniProgramSDKError && error.code === 'AUTHORIZATION_CANCELLED') {
-      return undefined;
-    }
-    throw error;
-  }
+export async function getCurrentUser() {
+  const result = await user.getInfo();
+  return result.userInfo?.app_user_id;
 }`,
 )}
 

package/skill/scripts/validate-skill.mjs

@@ -191,6 +191,7 @@ const positiveCredentialPattern =
 const unsupportedStoragePattern = /\b(removeStorage|clearStorage|getStorageInfo|getStorageV2|delete storage|clear storage)\b/i;
 const rawProtocolPattern = /\b(raw postMessage|construct bridge|bridge envelope|nonce handling|mutate bridge|sdk\.handshake)\b/i;
 const removedUserLoginPattern = /\b(?:hbSDK\.)?user\.login\s*\(/;
+const removedLocalIdentityPattern = /\b(?:hbSDK\.)?user\.getLocalIdentity\s*\(/;
 
 for (const file of textFiles) {
   const relative = skillRel(file);
@@ -198,7 +199,12 @@ for (const file of textFiles) {
   if (file.endsWith('.md')) validateLocalMarkdownLinks(file, content);
   if (removedUserLoginPattern.test(content)) {
     fail(
-      `Removed API guidance found in ${relative}: use auth.login() for network-enabled server authentication or user.getLocalIdentity() for network-disabled local identity instead of user.login().`,
+      `Removed API guidance found in ${relative}: use auth.login() for network-enabled server authentication or user.getInfo() for network-disabled local identity instead of user.login().`,
+    );
+  }
+  if (removedLocalIdentityPattern.test(content)) {
+    fail(
+      `Removed API guidance found in ${relative}: use user.getInfo() and read userInfo.app_user_id for network-disabled local identity.`,
     );
   }
 

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.7.0+skill.f24de3cc4cc5",
+  "skillVersion": "0.7.2+skill.4dbf3cd47129",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.7.0",
-    "compatibility": "0.7.0"
+    "version": "0.7.2",
+    "compatibility": "0.7.2"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-f24de3cc4cc514f50dc45258570840a7f998be70f625afcf3ce8f8b41e197ff5"
+  "integrity": "sha256-4dbf3cd471293ade5b4b2cfe0f156d1365adffee4e7da36c6a30cb7dbb37319a"
 }

package/types/index.d.ts

@@ -4,7 +4,7 @@ export type { MiniProgramSDKHandshakeState, MiniProgramSDKHandshakeStateHandler
 export type { MiniProgramEventHandler, MiniProgramEventName, MiniProgramEventPayloadMap } from './protocol/types';
 export type { LoginOptions, LoginPayload, LoginResult, LoginScope, MiniProgramAuthModule } from './modules/auth';
 export type { DeleteCurrentUserLeaderboardEntryPayload, DeleteCurrentUserLeaderboardEntryResult, GetCurrentUserLeaderboardEntryPayload, GetCurrentUserLeaderboardEntryResult, GetLeaderboardInfoPayload, GetLeaderboardInfoResult, GetLeaderboardListPayload, GetLeaderboardListResult, LeaderboardEntry, LeaderboardOrder, MiniProgramCloudLeaderboardModule, MiniProgramCloudModule, SubmitLeaderboardEntryPayload, SubmitLeaderboardEntryResult, } from './modules/cloud';
-export type { AuthorizedUserInfo, GetLocalIdentityPayload, GetLocalIdentityResult, GetUserInfoPayload, GetUserInfoResult, RevokeAuthorizationPayload, RevokeAuthorizationResult, GetSteamGameListOptions, GetSteamGameListPayload, GetSteamGameListResult, MiniProgramUserInfoResult, MiniProgramUserModule, UserInfoAuthorization, UserInfoAuthorizationStatus, SteamGameListData, SteamGameListItem, SteamGamePrice, SteamGameListSort, } from './modules/user';
+export type { AuthorizedUserInfo, GetUserInfoPayload, GetUserInfoResult, RevokeAuthorizationPayload, RevokeAuthorizationResult, GetSteamGameListOptions, GetSteamGameListPayload, GetSteamGameListResult, MiniProgramUserInfoResult, MiniProgramUserModule, UserInfoAuthorization, UserInfoAuthorizationStatus, SteamGameListData, SteamGameListItem, SteamGamePrice, SteamGameListSort, } from './modules/user';
 export type { MiniProgramScreenshotOptions, MiniProgramScreenshotRect, MiniProgramShareChannel, MiniProgramShareModule, MiniProgramSharePostOptions, MiniProgramShowShareMenuOptions, ScreenshotPayload, ScreenshotResult, ShowShareMenuPayload, ShowShareMenuResult, } from './modules/share';
 export type { GetWindowInfoPayload, GetWindowInfoResult, MiniProgramNavigationBarForegroundStyle, MiniProgramSafeArea, MiniProgramSetNavigationBarStyleOptions, MiniProgramViewportModule, MiniProgramWindowInfoResult, SetNavigationBarStylePayload, SetNavigationBarStyleResult, } from './modules/viewport';
 export type { GetStoragePayload, GetStorageResult, MiniProgramStorageModule, SetStoragePayload } from './modules/storage';

package/types/modules/user/get-info.d.ts

@@ -14,8 +14,8 @@ export type GetUserInfoResult = MiniProgramUserInfoResult;
  *
  * @returns 当前用户的登录态与公开基础资料。
  *
- * 该能力仅在身份授权后返回按小程序隔离的 `app_user_id`，仅在 profile
- * 授权后返回昵称与头像。未登录时返回
+ * 未开通网络权限且当前黑盒 APP 用户已登录时，该能力会静默建立或读取按小程序隔离的
+ * `app_user_id`，不展示授权 UI；仅在 profile 授权后返回昵称与头像。未登录时返回
  * `{ isHeyboxAppLoggedIn: false, authorization: null, userInfo: null }`。
  *
  * @throws {HbMiniProgramSDKError} 当 SDK 调用失败时抛出。

package/types/modules/user/index.d.ts

@@ -1,10 +1,8 @@
 import type { MiniProgramRequester } from '../../core/client';
 import { USER_GET_INFO_METHOD, type GetUserInfoResult } from './get-info';
-import { USER_GET_LOCAL_IDENTITY_METHOD, type GetLocalIdentityResult } from './get-local-identity';
 import { USER_REVOKE_AUTHORIZATION_METHOD, type RevokeAuthorizationResult } from './revoke-authorization';
 import { USER_GET_STEAM_GAME_LIST_METHOD, type GetSteamGameListOptions, type GetSteamGameListResult } from './steam-game-list';
 export * from './get-info';
-export * from './get-local-identity';
 export * from './revoke-authorization';
 export * from './steam-game-list';
 export * from './types';
@@ -12,12 +10,10 @@ export * from './types';
 export interface MiniProgramUserModule {
     /** 获取当前黑盒 APP 登录态、授权状态和已获准披露的资料。 */
     getInfo(): Promise<GetUserInfoResult>;
-    /** 获取当前用户在本小程序内稳定且隔离的身份。 */
-    getLocalIdentity(): Promise<GetLocalIdentityResult>;
     /** 撤销当前用户授予本小程序的授权；必须由可信用户操作触发。 */
     revokeAuthorization(): Promise<RevokeAuthorizationResult>;
     /** 获取当前用户的 Steam 游戏库。 */
     getSteamGameList(options?: GetSteamGameListOptions): Promise<GetSteamGameListResult>;
 }
 export declare function createUserModule(requester: MiniProgramRequester): MiniProgramUserModule;
-export { USER_GET_INFO_METHOD, USER_GET_LOCAL_IDENTITY_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_REVOKE_AUTHORIZATION_METHOD, };
+export { USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_REVOKE_AUTHORIZATION_METHOD, };

package/types/modules/user/types.d.ts

@@ -9,8 +9,9 @@ export interface UserInfoAuthorization {
  * 已获准向当前小程序披露的用户资料。
  *
  * @remarks
- * 只有 `identity` 已授权时，`user.getInfo()` 才会返回该对象。撤销 `identity`
- * 后 `userInfo` 变为 `null`，调用方应停止使用并清理本地缓存的旧身份。
+ * 未开通网络权限且当前黑盒 APP 用户已登录时，Runtime 会静默建立或读取隔离身份，
+ * `user.getInfo()` 随即返回该对象。撤销授权后旧身份失效，调用方应停止使用并清理
+ * 本地缓存；再次调用 `user.getInfo()` 会静默建立新的隔离身份。
  */
 export interface AuthorizedUserInfo {
     /**
@@ -34,7 +35,8 @@ export interface AuthorizedUserInfo {
  *
  * @remarks
  * 未登录时 `isHeyboxAppLoggedIn` 为 `false`，授权状态和用户资料均为 `null`。
- * 已登录但 identity 未授权时，`userInfo` 仍为 `null`。
+ * 当前 Heybox Runtime 在无网络模式且已登录时会静默建立身份并返回 `userInfo`；
+ * Host 在已登录但身份暂不可用时仍可返回 `null`，调用方必须进行空值判断。
  */
 export type MiniProgramUserInfoResult = {
     isHeyboxAppLoggedIn: false;