@heybox/hb-sdk 0.7.2-alpha.0 → 0.7.3-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.7.2
+
+### SDK / Runtime
+
+- 移除 `user.getLocalIdentity()`；未开通网络权限的小程序改用 `user.getInfo()` 静默获取 `userInfo.app_user_id`，不再展示身份授权弹窗。
+- 未开通网络权限且用户已登录时，`user.getInfo()` 会静默建立或读取当前小程序隔离身份，并在每次成功调用后广播 `identity: granted`；撤销授权后再次调用会建立新的隔离身份。
+- Runtime 不再兼容缺少 canonical `miniProgramId` 的无参 `getUserInfo()` adapter 路径；身份缺失时 `user.getInfo()` 返回 `INVALID_STATE`。
+
 ## 0.7.1
 
 ### Docs / Agent Skill

package/README.md

@@ -23,20 +23,20 @@ npm run dev
 npm install @heybox/hb-sdk
 ```
 
-SDK 会在导入时启动握手，能力调用会自动等待 SDK 就绪。未开通网络权限的小程序可以读取当前小程序内的隔离身份：
+SDK 会在导入时启动握手，能力调用会自动等待 SDK 就绪。未开通网络权限的小程序通过 `user.getInfo()` 静默读取当前小程序内的隔离身份：
 
 需要可信用户手势的按钮不能在点击回调里等待握手。页面加载时先用 `getHandshakeState()` 读取当前状态，再用 `onHandshakeStateChange()` 订阅并立即接收当前状态；仅在 `status === 'ready'` 时启用按钮，并在组件或页面销毁时调用订阅返回的取消函数。`ready` 生命周期事件只是握手成功瞬间派发、不会重放的边沿通知，不能用来判断当前状态。
 
 ```ts
 import hbSDK from '@heybox/hb-sdk';
 
-async function getLocalIdentityFromUserAction() {
-  const { appUserId } = await hbSDK.user.getLocalIdentity();
-  return appUserId;
+async function getCurrentUser() {
+  const result = await hbSDK.user.getInfo();
+  return result.userInfo?.app_user_id;
 }
 ```
 
-把 `getLocalIdentityFromUserAction` 绑定到按钮点击等可信用户操作。首次登录或 identity consent 需要 UI 而缺少可信手势时返回 `USER_GESTURE_REQUIRED`；用户取消或关闭时返回 `AUTHORIZATION_CANCELLED`，不会确认或改变授权状态。
+`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回 `isHeyboxAppLoggedIn: false`；已登录时默认返回当前小程序隔离的 `app_user_id`。
 
 已开通网络权限的小程序在按钮点击等明确的用户操作中调用 `auth.login()`：
 
@@ -52,7 +52,7 @@ async function loginFromUserAction() {
 }
 ```
 
-`auth.login()` 返回 `{ code, expiresIn: 300, scopes }`，其中 `identity` 隐式强制包含；它不返回 user、profile、`appUserId` 或 token。页面只能把 code 交给开发者服务端，再由服务端按后端 OpenAPI 文档换取 token。未开通网络权限的小程序使用 `user.getLocalIdentity()`，无法获取 code 或调用 OpenAPI。完整边界见[用户身份与登录](https://docs.xiaoheihe.cn/hb_sdk/guide/auth)。
+`auth.login()` 返回 `{ code, expiresIn: 300, scopes }`，其中 `identity` 隐式强制包含；它不返回 user、profile、`app_user_id` 或 token。页面只能把 code 交给开发者服务端，再由服务端按后端 OpenAPI 文档换取 token。未开通网络权限的小程序使用 `user.getInfo()`，无法获取 code 或调用 OpenAPI。完整边界见[用户身份与登录](https://docs.xiaoheihe.cn/hb_sdk/guide/auth)。
 
 用户可以在明确的按钮点击和二次确认后撤销当前小程序的授权：
 
@@ -62,7 +62,7 @@ async function revokeAuthorizationFromUserAction() {
   if (!confirmed) return;
 
   await hbSDK.user.revokeAuthorization();
-  // 同步清理业务保存的 appUserId、用户资料和服务端会话。
+  // 同步清理业务保存的 app_user_id、用户资料和服务端会话。
 }
 ```
 
@@ -107,7 +107,7 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 | 模块         | 用途                                                         |
 | ------------ | ------------------------------------------------------------ |
 | `auth`       | 获取交给开发者服务端交换的短期授权码                         |
-| `user`       | 使用 Host current-user APIs 或读取无网络小程序的本地隔离身份 |
+| `user`       | 读取 Host 当前用户资料、隔离身份或撤销授权                   |
 | `share`      | 打开分享或截图分享流程                                       |
 | `ui`         | 展示 Toast 和 Loading                                        |
 | `device`     | 调用振动和剪贴板能力                                         |
@@ -127,8 +127,8 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 - `auth.login({ scopes? })` 只返回 `{ code, expiresIn: 300, scopes }`；identity 隐式强制包含，code 只能提交给开发者服务端。
 - 需要授权 UI 时，`auth.login()` 必须来自可信用户手势，否则返回 `USER_GESTURE_REQUIRED`；用户取消或关闭时返回 `AUTHORIZATION_CANCELLED`。已授权时可以静默返回新 code。
 - `user.getSteamGameList()` 仅供未开通网络权限的小程序通过 Host 读取；已开通网络权限时返回 `SERVER_API_REQUIRED`，且授权码与 OpenAPI 不提供 Steam 游戏库 scope 或资源接口。
-- 已开通网络权限时，公开的 `user.getInfo()` 和 `user.getLocalIdentity()` 返回 `SERVER_API_REQUIRED`；对应身份和资料数据应由开发者服务端通过 OpenAPI 获取。
-- 未开通网络权限时，只用 `user.getLocalIdentity()` 获取 `{ appUserId }`，不能获取 code 或调用 OpenAPI。
+- 已开通网络权限时，公开的 `user.getInfo()` 返回 `SERVER_API_REQUIRED`；对应身份和资料数据应由开发者服务端通过 OpenAPI 获取。
+- 未开通网络权限时，使用 `user.getInfo()` 静默读取 `userInfo.app_user_id`，不能获取 code 或调用 OpenAPI。
 - `user.revokeAuthorization()` 在两种网络模式下都要求可信用户手势；成功后必须停止使用并清理业务缓存的旧身份、资料和服务端会话。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
 - 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。

package/dist/cli-chunks/{build-DbQt0LIs.cjs → build-CIZIWLmV.cjs}

@@ -5,8 +5,8 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var runtimeGate = require('./runtime-gate-CtV7rWyX.cjs');
-var index = require('./index-BV8DdyEP.cjs');
-var projectVite = require('./project-vite-8IkVMyPu.cjs');
+var index = require('./index-DiGjTruv.cjs');
+var projectVite = require('./project-vite-BoMy-fAP.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-Cmrhge3Y.cjs → context-DdKKaf1o.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var session = require('./session-DnqyIY87.cjs');
+var session = require('./session-DyEpQQ67.cjs');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');

package/dist/cli-chunks/{create-5ZLxb2p_.cjs → create-C5CW72BF.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-BV8DdyEP.cjs');
+var index = require('./index-DiGjTruv.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CWSJ0YIw.cjs → dev-CH2yODBH.cjs}

@@ -6,15 +6,15 @@ var path = require('node:path');
 var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
-var context = require('./context-Cmrhge3Y.cjs');
+var context = require('./context-DdKKaf1o.cjs');
 var node_crypto = require('node:crypto');
 var undici = require('undici');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-BV8DdyEP.cjs');
-var projectVite = require('./project-vite-8IkVMyPu.cjs');
+var index = require('./index-DiGjTruv.cjs');
+var projectVite = require('./project-vite-BoMy-fAP.cjs');
 var fs$1 = require('node:fs/promises');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
-require('./session-DnqyIY87.cjs');
+require('./session-DyEpQQ67.cjs');
 require('fs');
 require('constants');
 require('stream');
@@ -1347,7 +1347,7 @@ function createHeyboxProtocol(payload) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.2-alpha.0';
+    : '0.7.3-alpha.0';
 
 class DevPermissionOverrideStoreError extends Error {
     code;

package/dist/cli-chunks/{doctor-CpFYiqK9.cjs → doctor-SHwm6xSx.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-BV8DdyEP.cjs');
+var index = require('./index-DiGjTruv.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-DomfJMuO.cjs → index-DIwi_FPa.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index$2 = require('./index-BV8DdyEP.cjs');
+var index$2 = require('./index-DiGjTruv.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');

package/dist/cli-chunks/{index-BV8DdyEP.cjs → index-DiGjTruv.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BV8DdyEP.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BV8DdyEP.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BV8DdyEP.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BV8DdyEP.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BV8DdyEP.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.7.2-alpha.0';
+const BUILT_CLI_VERSION = '0.7.3-alpha.0';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13681,35 +13681,35 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-DhD2o29N.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BrtCvOEN.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-DhD2o29N.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BrtCvOEN.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-DhD2o29N.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BrtCvOEN.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-DbQt0LIs.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CIZIWLmV.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-5ZLxb2p_.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-C5CW72BF.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CWSJ0YIw.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CH2yODBH.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-CpFYiqK9.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-SHwm6xSx.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BZ6rfyuZ.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BDj3TcU7.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{login-DhD2o29N.cjs → login-BrtCvOEN.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DnqyIY87.cjs');
+var session = require('./session-DyEpQQ67.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-BV8DdyEP.cjs');
+var index = require('./index-DiGjTruv.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-8IkVMyPu.cjs → project-vite-BoMy-fAP.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-BV8DdyEP.cjs');
+var index = require('./index-DiGjTruv.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-BZ6rfyuZ.cjs → remote-BDj3TcU7.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-BV8DdyEP.cjs');
-var session = require('./session-DnqyIY87.cjs');
+var index = require('./index-DiGjTruv.cjs');
+var session = require('./session-DyEpQQ67.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
@@ -10,7 +10,7 @@ var path = require('node:path');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var runtimeGate = require('./runtime-gate-CtV7rWyX.cjs');
 var node_crypto = require('node:crypto');
-var context = require('./context-Cmrhge3Y.cjs');
+var context = require('./context-DdKKaf1o.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -271,7 +271,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-DomfJMuO.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-DIwi_FPa.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {

package/dist/cli-chunks/{session-DnqyIY87.cjs → session-DyEpQQ67.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-BV8DdyEP.cjs');
+var index = require('./index-DiGjTruv.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-BV8DdyEP.cjs');
+var index = require('./cli-chunks/index-DiGjTruv.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/mock-host/main.js

@@ -163,8 +163,6 @@ function normalizeDecodedNetworkPathname(decoded) {
 const AUTH_LOGIN_METHOD = 'auth.login';
 /** 读取当前登录态、授权状态和已获准披露资料的 bridge method 标识。 */
 const USER_GET_INFO_METHOD = 'user.getInfo';
-/** 读取当前用户小程序隔离身份的 bridge method 标识。 */
-const USER_GET_LOCAL_IDENTITY_METHOD = 'user.getLocalIdentity';
 /** 撤销当前用户授予本小程序授权的 bridge method 标识。 */
 const USER_REVOKE_AUTHORIZATION_METHOD = 'user.revokeAuthorization';
 /** 读取当前已登录用户 Steam 游戏库的 bridge method 标识。 */
@@ -265,13 +263,6 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
         permission: 'user.getInfo',
         risk: 'medium',
     },
-    {
-        method: USER_GET_LOCAL_IDENTITY_METHOD,
-        module: 'user',
-        capability: USER_GET_LOCAL_IDENTITY_METHOD,
-        permission: 'user.getLocalIdentity',
-        risk: 'medium',
-    },
     {
         method: USER_REVOKE_AUTHORIZATION_METHOD,
         module: 'user',
@@ -5189,34 +5180,15 @@ function hashString(value) {
 }
 
 async function getMiniProgramRuntimeUserInfo(platformAdapter, identity) {
-    const miniProgramId = identity?.miniProgramId?.trim();
-    return miniProgramId
-        ? platformAdapter.user.getUserInfo({ miniProgramId })
-        : platformAdapter.user.getUserInfo();
-}
-
-async function getMiniProgramRuntimeLocalIdentity(payload, platformAdapter, identity, trustedUserGesture) {
-    if (payload !== undefined) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'user.getLocalIdentity 不接收入参');
-    }
     const miniProgramId = identity?.miniProgramId?.trim();
     if (!miniProgramId) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_STATE', 'user.getLocalIdentity 缺少可信小程序身份');
+        throw createMiniProgramRuntimeBridgeError('INVALID_STATE', 'user.getInfo 缺少可信小程序身份');
     }
-    const result = await platformAdapter.user.getLocalIdentity({
-        miniProgramId,
-        trustedUserGesture,
-    });
-    if (!isMiniProgramRuntimeRecord(result)
-        || typeof result.appUserId !== 'string'
-        || !result.appUserId.trim()) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_RESPONSE', 'Host user.getLocalIdentity 返回无效');
+    const result = await platformAdapter.user.getUserInfo({ miniProgramId });
+    if (result.isHeyboxAppLoggedIn) {
+        platformAdapter.auth.emitAuthEvent?.('user_info_authorization_change', result.authorization);
     }
-    platformAdapter.auth.emitAuthEvent?.('user_info_authorization_change', {
-        identity: 'granted',
-        profile: 'not_requested',
-    });
-    return { appUserId: result.appUserId };
+    return result;
 }
 
 async function revokeMiniProgramRuntimeAuthorization(payload, platformAdapter, identity, trustedUserGesture) {
@@ -5568,7 +5540,6 @@ const MINI_PROGRAM_MOCK_RUNTIME_METHODS = MINI_PROGRAM_PROTOCOL_CAPABILITIES.map
 const MINI_PROGRAM_MOCK_RUNTIME_METHOD_HANDLER_MAP = {
     [AUTH_LOGIN_METHOD]: (runtime, payload, context) => runtime.login(payload, context),
     [USER_GET_INFO_METHOD]: (runtime) => runtime.getUserInfo(),
-    [USER_GET_LOCAL_IDENTITY_METHOD]: (runtime, payload, context) => runtime.getLocalIdentity(payload, context),
     [USER_REVOKE_AUTHORIZATION_METHOD]: (runtime, payload, context) => runtime.revokeAuthorization(payload, context),
     [USER_GET_STEAM_GAME_LIST_METHOD]: (runtime, payload) => runtime.getSteamGameList(payload),
     [SHARE_SHOW_SHARE_MENU_METHOD]: (runtime, payload) => runtime.showShareMenu(payload),
@@ -5610,6 +5581,9 @@ function createBrowserMockRuntimePlatformAdapter(options) {
             },
         },
         auth: {
+            emitAuthEvent(name, payload) {
+                options.onAuthEvent?.(name, payload);
+            },
             async getCurrentUserId() {
                 const user = options.getCurrentUser();
                 return user?.app_user_id;
@@ -5629,27 +5603,21 @@ function createBrowserMockRuntimePlatformAdapter(options) {
             },
         },
         user: {
-            async getUserInfo() {
+            async getUserInfo(identity) {
                 const currentUser = options.getCurrentUser();
                 const appUserId = currentUser?.app_user_id;
-                return appUserId
+                const miniProgramId = identity?.miniProgramId;
+                return appUserId && miniProgramId
                     ? {
                         isHeyboxAppLoggedIn: true,
                         authorization: { identity: 'granted', profile: 'not_requested' },
                         userInfo: {
-                            app_user_id: appUserId,
+                            app_user_id: `${appUserId}:${miniProgramId}`,
                             profile: { nickname: currentUser?.nickname || '', avatar: currentUser?.avatar || '' },
                         },
                     }
                     : { isHeyboxAppLoggedIn: false, authorization: null, userInfo: null };
             },
-            async getLocalIdentity() {
-                const appUserId = options.getCurrentUser()?.app_user_id;
-                if (!appUserId) {
-                    throw createMockBridgeError('NOT_LOGGED_IN', '当前 Mock 用户未登录');
-                }
-                return { appUserId };
-            },
             async revokeAuthorization(request) {
                 if (!request.trustedUserGesture) {
                     throw createMockBridgeError('USER_GESTURE_REQUIRED', 'Mock 撤销授权需要可信用户手势');
@@ -5838,10 +5806,6 @@ class MiniProgramMockRuntime {
         this.assertMockHostUserApiEnabled();
         return getMiniProgramRuntimeUserInfo(this.adapter, this.options.identity);
     }
-    getLocalIdentity(payload, context) {
-        this.assertMockHostUserApiEnabled();
-        return getMiniProgramRuntimeLocalIdentity(payload, this.adapter, this.options.identity, context.trustedUserGesture);
-    }
     revokeAuthorization(payload, context) {
         if (!this.authorizationMutationEnabled) {
             throw createMockBridgeError('SERVER_API_REQUIRED', '当前模式缺少有效的小程序权限快照');
@@ -6852,9 +6816,13 @@ const storage = new Map();
 const logs = [];
 let handshaken = false;
 let navigationBarStyle = 'dark';
+let mockHostDisposed = false;
 let mobileQrGeneration = 0;
 let mobileQrRefreshTimer;
+let nativeLaunchConfigRefreshTimer;
 let mobileDevSessionCreation = Promise.resolve();
+let mobileQrSessionInFlight = false;
+let mobileQrSessionPending = false;
 let currentUser = {
     app_user_id: 'au_debug_user',
     nickname: 'PC Debug User',
@@ -6913,6 +6881,7 @@ const platformAdapter = createBrowserMockRuntimePlatformAdapter({
         currentUser = createUserFromForm();
         updateUserStatus();
     },
+    onAuthEvent: (name, payload) => postEvent(name, payload),
     requestNetwork,
     setDocumentTitle(title) {
         document.title = title;
@@ -6931,10 +6900,7 @@ updateUserStatus();
 updateStorageSnapshot();
 updatePermissionControls();
 window.addEventListener('message', handleMessage);
-window.addEventListener('beforeunload', () => {
-    clearMobileQrRefreshTimer();
-    postEvent('unload', { timestamp: Date.now() });
-});
+window.addEventListener('beforeunload', disposeMockHost);
 queryElement('#login-button').addEventListener('click', () => {
     void runtime.login();
 });
@@ -6967,13 +6933,14 @@ elements.resetPermissionsButton.addEventListener('click', () => {
 const mobileAppQrReady = setupMobileAppQr();
 if (bootstrap.devContext.source === 'remote') {
     void mobileAppQrReady.then(() => {
-        window.setInterval(() => void refreshNativeLaunchConfig(), NATIVE_LAUNCH_CONFIG_REFRESH_MS);
+        if (mockHostDisposed) {
+            return;
+        }
+        nativeLaunchConfigRefreshTimer = window.setInterval(() => void refreshNativeLaunchConfig(), NATIVE_LAUNCH_CONFIG_REFRESH_MS);
     });
 }
 function createRuntime() {
     return new MiniProgramMockRuntime(platformAdapter, {
-        onHeyboxAppLoginChange: payload => postEvent('heybox_app_login_change', payload),
-        onUserInfoAuthorizationChange: authorization => postEvent('user_info_authorization_change', authorization),
         runtimePermissions: createMiniProgramMockRuntimePermissions(permissionState),
     });
 }
@@ -7358,6 +7325,9 @@ async function copyDebugPageUrl() {
     }
 }
 async function setupMobileAppQr() {
+    if (mockHostDisposed) {
+        return;
+    }
     lanAddresses = bootstrap.lanAddresses;
     defaultLanAddressId = bootstrap.defaultLanAddressId;
     macAppProtocol = bootstrap.macAppProtocol;
@@ -7367,11 +7337,13 @@ async function setupMobileAppQr() {
     await updateMobileQrCode();
 }
 async function refreshNativeLaunchConfig() {
-    if (nativeLaunchConfigRefreshInFlight)
+    if (mockHostDisposed || nativeLaunchConfigRefreshInFlight)
         return;
     nativeLaunchConfigRefreshInFlight = true;
     try {
         const latest = await loadMockHostBootstrap();
+        if (mockHostDisposed)
+            return;
         const signature = readNativeLaunchConfigSignature(latest);
         if (signature === nativeLaunchConfigSignature)
             return;
@@ -7475,9 +7447,35 @@ function setupMobileLanSelect() {
     elements.mobileLanSelect.disabled = !hasLanAddress;
 }
 async function updateMobileQrCode() {
+    if (mockHostDisposed) {
+        return;
+    }
     const generation = ++mobileQrGeneration;
     clearMobileQrRefreshTimer();
+    if (mobileQrSessionInFlight) {
+        mobileQrSessionPending = true;
+        return;
+    }
+    mobileQrSessionInFlight = true;
+    await generateMobileQrCode(generation);
+}
+function releaseMobileQrSession() {
+    if (!mobileQrSessionInFlight) {
+        return;
+    }
+    mobileQrSessionInFlight = false;
+    if (mockHostDisposed) {
+        mobileQrSessionPending = false;
+        return;
+    }
+    if (mobileQrSessionPending) {
+        mobileQrSessionPending = false;
+        void updateMobileQrCode();
+    }
+}
+async function generateMobileQrCode(generation) {
     if (nativeAppLaunchUnavailableReason) {
+        releaseMobileQrSession();
         elements.mobileQrImage.removeAttribute('src');
         elements.mobileQrImage.hidden = true;
         elements.mobileQrStatus.textContent = nativeAppLaunchUnavailableReason;
@@ -7485,6 +7483,7 @@ async function updateMobileQrCode() {
     }
     const selected = readSelectedLanAddress();
     if (!selected) {
+        releaseMobileQrSession();
         elements.mobileQrImage.removeAttribute('src');
         elements.mobileQrImage.hidden = true;
         elements.mobileQrStatus.textContent = '';
@@ -7492,6 +7491,7 @@ async function updateMobileQrCode() {
     }
     const basePayload = selected.mobileAppQrPayload;
     if (!basePayload) {
+        releaseMobileQrSession();
         elements.mobileQrImage.removeAttribute('src');
         elements.mobileQrImage.hidden = true;
         elements.mobileQrStatus.textContent = '真机调试配置不可用，请重启 hb-sdk dev 后重试。';
@@ -7500,7 +7500,9 @@ async function updateMobileQrCode() {
     elements.mobileQrStatus.textContent = '正在生成二维码...';
     try {
         const devSession = await createMobileDevSession(selected);
-        if (generation !== mobileQrGeneration) {
+        // 会话请求完成后立即放行下一轮刷新；旧二维码编码可能仍在异步进行，不能阻塞新会话。
+        releaseMobileQrSession();
+        if (mockHostDisposed || generation !== mobileQrGeneration) {
             return;
         }
         // 测试端扫一扫暂不支持打开网页，二维码必须直接编码 heybox:// 协议（不能走 HTTP 短链）。
@@ -7511,7 +7513,7 @@ async function updateMobileQrCode() {
             margin: 2,
             width: MOBILE_QR_IMAGE_SIZE,
         });
-        if (generation !== mobileQrGeneration) {
+        if (mockHostDisposed || generation !== mobileQrGeneration) {
             return;
         }
         elements.mobileQrImage.src = imageUrl;
@@ -7520,7 +7522,8 @@ async function updateMobileQrCode() {
         scheduleMobileQrRefresh(devSession.expiresAt, generation);
     }
     catch (error) {
-        if (generation !== mobileQrGeneration) {
+        releaseMobileQrSession();
+        if (mockHostDisposed || generation !== mobileQrGeneration) {
             return;
         }
         elements.mobileQrImage.removeAttribute('src');
@@ -7570,7 +7573,7 @@ async function requestMobileDevSession(selected) {
 }
 function scheduleMobileQrRefresh(expiresAt, generation) {
     mobileQrRefreshTimer = window.setTimeout(() => {
-        if (generation !== mobileQrGeneration) {
+        if (mockHostDisposed || generation !== mobileQrGeneration) {
             return;
         }
         elements.mobileQrImage.removeAttribute('src');
@@ -7586,6 +7589,21 @@ function clearMobileQrRefreshTimer() {
     window.clearTimeout(mobileQrRefreshTimer);
     mobileQrRefreshTimer = undefined;
 }
+function disposeMockHost() {
+    if (mockHostDisposed) {
+        return;
+    }
+    mockHostDisposed = true;
+    mobileQrGeneration += 1;
+    mobileQrSessionPending = false;
+    clearMobileQrRefreshTimer();
+    if (nativeLaunchConfigRefreshTimer !== undefined) {
+        window.clearInterval(nativeLaunchConfigRefreshTimer);
+        nativeLaunchConfigRefreshTimer = undefined;
+    }
+    window.removeEventListener('message', handleMessage);
+    postEvent('unload', { timestamp: Date.now() });
+}
 function applyDevContextToMobileQrPayload(payload, devContextUrl) {
     const protocolMarker = payload.includes('#heybox://') ? '#heybox://' : 'heybox://';
     const protocolIndex = payload.indexOf(protocolMarker);