@heybox/hb-sdk 0.7.3-alpha.0 → 0.7.3-alpha.2

package/CHANGELOG.md

@@ -1,11 +1,30 @@
 # Changelog
 
+## 0.7.4-alpha.0
+
+### SDK / Runtime
+
+- 修复无网络模式用户 scope 退化：`user.getInfo()` 重新隐式授予 `identity` 与 `profile`，静默返回隔离 `app_user_id`、昵称和头像；资料读取失败时保留身份结果，并拒绝账号切换或撤销后的旧上下文结果。
+- 公开 canonical 用户信息 scope 目录，并让协议类型、Runtime、Browser Mock 与 Host presentation 共享同一 scope owner。
+
+## 0.7.3-alpha.2
+
+### SDK
+
+- 对齐无网络用户全量 scope 契约，并公开 canonical 用户信息 scope 目录。
+
+## 0.7.3-alpha.1
+
+### Runtime
+
+- 允许 `@heybox/hb-sdk-runtime` 与 `@heybox/hb-sdk` 独立演进版本。
+
 ## 0.7.2
 
 ### SDK / Runtime
 
-- 移除 `user.getLocalIdentity()`；未开通网络权限的小程序改用 `user.getInfo()` 静默获取 `userInfo.app_user_id`，不再展示身份授权弹窗。
-- 未开通网络权限且用户已登录时，`user.getInfo()` 会静默建立或读取当前小程序隔离身份，并在每次成功调用后广播 `identity: granted`；撤销授权后再次调用会建立新的隔离身份。
+- 移除 `user.getLocalIdentity()`；未开通网络权限的小程序改用 `user.getInfo()` 静默获取隔离身份和公开资料，不再展示身份授权弹窗。
+- 未开通网络权限且用户已登录时，`user.getInfo()` 会静默建立或读取当前小程序隔离身份，并在每次成功调用后广播 `identity: granted` 与 `profile: granted`；撤销授权后再次调用会建立新的隔离身份并恢复隐式授权。
 - Runtime 不再兼容缺少 canonical `miniProgramId` 的无参 `getUserInfo()` adapter 路径；身份缺失时 `user.getInfo()` 返回 `INVALID_STATE`。
 
 ## 0.7.1

package/README.md

@@ -23,7 +23,7 @@ npm run dev
 npm install @heybox/hb-sdk
 ```
 
-SDK 会在导入时启动握手，能力调用会自动等待 SDK 就绪。未开通网络权限的小程序通过 `user.getInfo()` 静默读取当前小程序内的隔离身份：
+SDK 会在导入时启动握手，能力调用会自动等待 SDK 就绪。未开通网络权限的小程序通过 `user.getInfo()` 静默读取当前小程序内的隔离身份和公开资料：
 
 需要可信用户手势的按钮不能在点击回调里等待握手。页面加载时先用 `getHandshakeState()` 读取当前状态，再用 `onHandshakeStateChange()` 订阅并立即接收当前状态；仅在 `status === 'ready'` 时启用按钮，并在组件或页面销毁时调用订阅返回的取消函数。`ready` 生命周期事件只是握手成功瞬间派发、不会重放的边沿通知，不能用来判断当前状态。
 
@@ -32,11 +32,11 @@ import hbSDK from '@heybox/hb-sdk';
 
 async function getCurrentUser() {
   const result = await hbSDK.user.getInfo();
-  return result.userInfo?.app_user_id;
+  return result.userInfo;
 }
 ```
 
-`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回 `isHeyboxAppLoggedIn: false`；已登录时默认返回当前小程序隔离的 `app_user_id`。
+`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回 `isHeyboxAppLoggedIn: false`；已登录时隐式授予当前本地用户 scopes（`identity`、`profile`），返回当前小程序隔离的 `app_user_id` 以及 `profile.nickname`、`profile.avatar`。
 
 已开通网络权限的小程序在按钮点击等明确的用户操作中调用 `auth.login()`：
 
@@ -128,7 +128,7 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 - 需要授权 UI 时，`auth.login()` 必须来自可信用户手势，否则返回 `USER_GESTURE_REQUIRED`；用户取消或关闭时返回 `AUTHORIZATION_CANCELLED`。已授权时可以静默返回新 code。
 - `user.getSteamGameList()` 仅供未开通网络权限的小程序通过 Host 读取；已开通网络权限时返回 `SERVER_API_REQUIRED`，且授权码与 OpenAPI 不提供 Steam 游戏库 scope 或资源接口。
 - 已开通网络权限时，公开的 `user.getInfo()` 返回 `SERVER_API_REQUIRED`；对应身份和资料数据应由开发者服务端通过 OpenAPI 获取。
-- 未开通网络权限时，使用 `user.getInfo()` 静默读取 `userInfo.app_user_id`，不能获取 code 或调用 OpenAPI。
+- 未开通网络权限时，`user.getInfo()` 隐式授予 `identity` 与 `profile`，静默返回 `userInfo.app_user_id`、昵称和头像；这条路径仍不能获取 code 或调用 OpenAPI。
 - `user.revokeAuthorization()` 在两种网络模式下都要求可信用户手势；成功后必须停止使用并清理业务缓存的旧身份、资料和服务端会话。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
 - 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。

package/dist/cli-chunks/{build-CIZIWLmV.cjs → build-SCCCDtC6.cjs}

@@ -5,8 +5,8 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var runtimeGate = require('./runtime-gate-CtV7rWyX.cjs');
-var index = require('./index-DiGjTruv.cjs');
-var projectVite = require('./project-vite-BoMy-fAP.cjs');
+var index = require('./index-CXeFMwHy.cjs');
+var projectVite = require('./project-vite-BxuI2_2-.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-DdKKaf1o.cjs → context-dika4R3J.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var session = require('./session-DyEpQQ67.cjs');
+var session = require('./session-DZsk79k0.cjs');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');

package/dist/cli-chunks/{create-C5CW72BF.cjs → create-DK9-wP6G.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-DiGjTruv.cjs');
+var index = require('./index-CXeFMwHy.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CH2yODBH.cjs → dev-B0vo5N0U.cjs}

@@ -6,15 +6,15 @@ var path = require('node:path');
 var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
-var context = require('./context-DdKKaf1o.cjs');
+var context = require('./context-dika4R3J.cjs');
 var node_crypto = require('node:crypto');
 var undici = require('undici');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-DiGjTruv.cjs');
-var projectVite = require('./project-vite-BoMy-fAP.cjs');
+var index = require('./index-CXeFMwHy.cjs');
+var projectVite = require('./project-vite-BxuI2_2-.cjs');
 var fs$1 = require('node:fs/promises');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
-require('./session-DyEpQQ67.cjs');
+require('./session-DZsk79k0.cjs');
 require('fs');
 require('constants');
 require('stream');
@@ -1347,7 +1347,7 @@ function createHeyboxProtocol(payload) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3-alpha.0';
+    : '0.7.3-alpha.2';
 
 class DevPermissionOverrideStoreError extends Error {
     code;

package/dist/cli-chunks/{doctor-SHwm6xSx.cjs → doctor-BfVm18BY.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-DiGjTruv.cjs');
+var index = require('./index-CXeFMwHy.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-DIwi_FPa.cjs → index-BxnwvZsl.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index$2 = require('./index-DiGjTruv.cjs');
+var index$2 = require('./index-CXeFMwHy.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');

package/dist/cli-chunks/{index-DiGjTruv.cjs → index-CXeFMwHy.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CXeFMwHy.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CXeFMwHy.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CXeFMwHy.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CXeFMwHy.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-DiGjTruv.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CXeFMwHy.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.7.3-alpha.0';
+const BUILT_CLI_VERSION = '0.7.3-alpha.2';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13681,35 +13681,35 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BrtCvOEN.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-DRgv4TGG.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BrtCvOEN.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-DRgv4TGG.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BrtCvOEN.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-DRgv4TGG.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CIZIWLmV.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-SCCCDtC6.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-C5CW72BF.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DK9-wP6G.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CH2yODBH.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-B0vo5N0U.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-SHwm6xSx.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BfVm18BY.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BDj3TcU7.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BqHHAon9.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{login-BrtCvOEN.cjs → login-DRgv4TGG.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DyEpQQ67.cjs');
+var session = require('./session-DZsk79k0.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-DiGjTruv.cjs');
+var index = require('./index-CXeFMwHy.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-BoMy-fAP.cjs → project-vite-BxuI2_2-.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-DiGjTruv.cjs');
+var index = require('./index-CXeFMwHy.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-BDj3TcU7.cjs → remote-BqHHAon9.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-DiGjTruv.cjs');
-var session = require('./session-DyEpQQ67.cjs');
+var index = require('./index-CXeFMwHy.cjs');
+var session = require('./session-DZsk79k0.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
@@ -10,7 +10,7 @@ var path = require('node:path');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var runtimeGate = require('./runtime-gate-CtV7rWyX.cjs');
 var node_crypto = require('node:crypto');
-var context = require('./context-DdKKaf1o.cjs');
+var context = require('./context-dika4R3J.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -271,7 +271,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-DIwi_FPa.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-BxnwvZsl.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {

package/dist/cli-chunks/{session-DyEpQQ67.cjs → session-DZsk79k0.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-DiGjTruv.cjs');
+var index = require('./index-CXeFMwHy.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-DiGjTruv.cjs');
+var index = require('./cli-chunks/index-CXeFMwHy.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/mock-host/main.js

@@ -419,6 +419,9 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
     },
 ];
 
+/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
+
 var browser = {};
 
 var canPromise;
@@ -5491,6 +5494,14 @@ function isNavigationBarForegroundStyle(value) {
     return value === 'light' || value === 'dark';
 }
 
+function authorizationFromGrantedScopes(scopes) {
+    const grantedScopes = new Set(scopes);
+    return {
+        identity: grantedScopes.has('identity') ? 'granted' : 'not_requested',
+        profile: grantedScopes.has('profile') ? 'granted' : 'not_requested',
+    };
+}
+
 /**
  * 当前小程序是否开通了 `network.request`。
  * 公开详情关网时只下发合法空 `entries`，没有 enabled 条目视为未开通。
@@ -5610,7 +5621,7 @@ function createBrowserMockRuntimePlatformAdapter(options) {
                 return appUserId && miniProgramId
                     ? {
                         isHeyboxAppLoggedIn: true,
-                        authorization: { identity: 'granted', profile: 'not_requested' },
+                        authorization: authorizationFromGrantedScopes(USER_INFO_AUTHORIZATION_SCOPES),
                         userInfo: {
                             app_user_id: `${appUserId}:${miniProgramId}`,
                             profile: { nickname: currentUser?.nickname || '', avatar: currentUser?.avatar || '' },

package/dist/index.cjs.js

@@ -640,7 +640,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3-alpha.0';
+    : '0.7.3-alpha.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。
@@ -1449,7 +1449,7 @@ function createViewportModule(requester) {
  * @returns 当前用户的登录态与公开基础资料。
  *
  * 未开通网络权限且当前黑盒 APP 用户已登录时，该能力会静默建立或读取按小程序隔离的
- * `app_user_id`，不展示授权 UI；仅在 profile 授权后返回昵称与头像。未登录时返回
+ * `app_user_id`，并隐式授予 `identity` 与 `profile` 后返回昵称与头像，不展示授权 UI。未登录时返回
  * `{ isHeyboxAppLoggedIn: false, authorization: null, userInfo: null }`。
  *
  * @throws {HbMiniProgramSDKError} 当 SDK 调用失败时抛出。
@@ -1473,6 +1473,9 @@ function getSteamGameList(requester, options) {
     return requester.request(USER_GET_STEAM_GAME_LIST_METHOD, options);
 }
 
+/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
+
 function createUserModule(requester) {
     return {
         getInfo: () => getInfo(requester),
@@ -1847,6 +1850,7 @@ const hbSDK = {
 
 exports.HbMiniProgramNetworkError = HbMiniProgramNetworkError;
 exports.HbMiniProgramSDKError = HbMiniProgramSDKError;
+exports.USER_INFO_AUTHORIZATION_SCOPES = USER_INFO_AUTHORIZATION_SCOPES;
 exports.auth = auth;
 exports.cloud = cloud;
 exports.default = hbSDK;

package/dist/index.esm.js

@@ -636,7 +636,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3-alpha.0';
+    : '0.7.3-alpha.2';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。
@@ -1445,7 +1445,7 @@ function createViewportModule(requester) {
  * @returns 当前用户的登录态与公开基础资料。
  *
  * 未开通网络权限且当前黑盒 APP 用户已登录时，该能力会静默建立或读取按小程序隔离的
- * `app_user_id`，不展示授权 UI；仅在 profile 授权后返回昵称与头像。未登录时返回
+ * `app_user_id`，并隐式授予 `identity` 与 `profile` 后返回昵称与头像，不展示授权 UI。未登录时返回
  * `{ isHeyboxAppLoggedIn: false, authorization: null, userInfo: null }`。
  *
  * @throws {HbMiniProgramSDKError} 当 SDK 调用失败时抛出。
@@ -1469,6 +1469,9 @@ function getSteamGameList(requester, options) {
     return requester.request(USER_GET_STEAM_GAME_LIST_METHOD, options);
 }
 
+/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
+
 function createUserModule(requester) {
     return {
         getInfo: () => getInfo(requester),
@@ -1841,4 +1844,4 @@ const hbSDK = {
     cloud,
 };
 
-export { HbMiniProgramNetworkError, HbMiniProgramSDKError, auth, cloud, hbSDK as default, device, getHandshakeState, navigation, network, off, on, onHandshakeStateChange, share, storage, ui, user, viewport };
+export { HbMiniProgramNetworkError, HbMiniProgramSDKError, USER_INFO_AUTHORIZATION_SCOPES, auth, cloud, hbSDK as default, device, getHandshakeState, navigation, network, off, on, onHandshakeStateChange, share, storage, ui, user, viewport };

package/dist/protocol.cjs.js

@@ -444,6 +444,9 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
     },
 ];
 
+/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
+
 exports.AUTH_LOGIN_METHOD = AUTH_LOGIN_METHOD;
 exports.CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD;
 exports.CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD;
@@ -474,6 +477,7 @@ exports.UI_SHOW_LOADING_METHOD = UI_SHOW_LOADING_METHOD;
 exports.UI_SHOW_TOAST_METHOD = UI_SHOW_TOAST_METHOD;
 exports.USER_GET_INFO_METHOD = USER_GET_INFO_METHOD;
 exports.USER_GET_STEAM_GAME_LIST_METHOD = USER_GET_STEAM_GAME_LIST_METHOD;
+exports.USER_INFO_AUTHORIZATION_SCOPES = USER_INFO_AUTHORIZATION_SCOPES;
 exports.USER_REVOKE_AUTHORIZATION_METHOD = USER_REVOKE_AUTHORIZATION_METHOD;
 exports.VIEWPORT_GET_WINDOW_INFO_METHOD = VIEWPORT_GET_WINDOW_INFO_METHOD;
 exports.VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD = VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD;

package/dist/protocol.esm.js

@@ -442,4 +442,7 @@ const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
     },
 ];
 
-export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_NETWORK_PROTECTED_PATHS, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, computeTrustedIframeUserGesture, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isOfficialMiniProgramNetworkUrl, isProtectedMiniProgramNetworkPath, normalizeMiniProgramNetworkPathname, parseMiniProgramRuntimePermissions };
+/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
+
+export { AUTH_LOGIN_METHOD, CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD, CLOUD_LEADERBOARD_GET_INFO_METHOD, CLOUD_LEADERBOARD_GET_LIST_METHOD, CLOUD_LEADERBOARD_SUBMIT_METHOD, DEVICE_SET_CLIPBOARD_METHOD, DEVICE_VIBRATE_METHOD, MINI_PROGRAM_BRIDGE_NONCE_PARAM, MINI_PROGRAM_MESSAGE_NAMESPACE, MINI_PROGRAM_MESSAGE_VERSION, MINI_PROGRAM_NETWORK_PROTECTED_PATHS, MINI_PROGRAM_PROTOCOL_CAPABILITIES, NAVIGATION_CLOSE_METHOD, NAVIGATION_OPEN_APP_PAGE_METHOD, NAVIGATION_RELOAD_METHOD, NETWORK_REQUEST_METHOD, RUNTIME_LOCATION_PROBE_METHOD, SDK_CSP_VIOLATION_METHOD, SDK_HANDSHAKE_METHOD, SDK_LOCATION_REPORT_METHOD, SHARE_SCREENSHOT_METHOD, SHARE_SHOW_SHARE_MENU_METHOD, STORAGE_GET_STORAGE_METHOD, STORAGE_SET_STORAGE_METHOD, UI_HIDE_LOADING_METHOD, UI_SHOW_LOADING_METHOD, UI_SHOW_TOAST_METHOD, USER_GET_INFO_METHOD, USER_GET_STEAM_GAME_LIST_METHOD, USER_INFO_AUTHORIZATION_SCOPES, USER_REVOKE_AUTHORIZATION_METHOD, VIEWPORT_GET_WINDOW_INFO_METHOD, VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD, computeTrustedIframeUserGesture, isManagedMiniProgramRuntimePermissionKey, isMiniProgramBridgeMessage, isOfficialMiniProgramNetworkUrl, isProtectedMiniProgramNetworkPath, normalizeMiniProgramNetworkPathname, parseMiniProgramRuntimePermissions };

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3-alpha.0';
+    : '0.7.3-alpha.2';
 
 var re = {exports: {}};
 

package/dist/vite.esm.js

@@ -5,7 +5,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3-alpha.0';
+    : '0.7.3-alpha.2';
 
 var re = {exports: {}};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.7.3-alpha.0",
+  "version": "0.7.3-alpha.2",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",

package/skill/SKILL.md

@@ -41,7 +41,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 1. Import the root package eagerly; the SDK starts its handshake automatically and capability calls wait for it internally.
 2. For a network-enabled mini-program, use `auth.login({ scopes? })` to obtain `{ code, expiresIn: 300, scopes }`. Identity is always implicit; request only optional scopes the business actually needs.
 3. Send the code only to the developer's backend. That backend follows the backend OpenAPI documentation to exchange it for a token; mini-program code must never exchange application credentials itself.
-4. For a network-disabled mini-program, call `user.getInfo()` to read the current login state and `userInfo.app_user_id`. This read is silent and does not require a trusted user action. It cannot obtain a code or call OpenAPI.
+4. For a network-disabled mini-program, call `user.getInfo()` to read the current login state, `userInfo.app_user_id`, and `userInfo.profile`. The Host silently grants the current local user scopes (`identity` and `profile`), so this call does not require a trusted user action or authorization UI. It still cannot obtain a code or call OpenAPI.
 5. Handle `HbMiniProgramSDKError` for SDK initialization and capability failures.
 6. Handle `HbMiniProgramNetworkError` separately when HTTP completed but `validateStatus` rejected the status.
 7. Use `getHandshakeState()` for the current persistent handshake state and `onHandshakeStateChange()` for an immediate replay plus future changes. Cancel the returned subscription when the page or component unmounts.

package/skill/references/api-protocol.md

@@ -131,6 +131,8 @@ export type {
   SteamGamePrice,
   SteamGameListSort,
 } from './modules/user';
+export { USER_INFO_AUTHORIZATION_SCOPES } from './modules/user';
+export type { UserInfoAuthorizationScope } from './modules/user';
 export type { ScreenshotPayload, ScreenshotResult } from './modules/share/screenshot';
 export type { ShowShareMenuPayload, ShowShareMenuResult } from './modules/share/show-share-menu';
 export type {
@@ -208,7 +210,7 @@ Reference 由 `@heybox/hb-sdk` 的公开导出与源码注释自动生成，不
 
 | 导出面 | Classes | Functions | Interfaces | Types | Constants |
 | --- | ---: | ---: | ---: | ---: | ---: |
-| Root API | 2 | 4 | 50 | 53 | 0 |
-| Protocol API | 0 | 7 | 46 | 64 | 30 |
+| Root API | 2 | 4 | 50 | 54 | 1 |
+| Protocol API | 0 | 7 | 46 | 65 | 31 |
 | Miniapp Publish API | 0 | 5 | 2 | 0 | 0 |
 | Vite API | 0 | 1 | 0 | 0 | 0 |

package/skill/references/api-root.md

@@ -24,7 +24,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.7.2`
+- Version at generation time: `0.7.3-alpha.2`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -86,6 +86,8 @@ export type {
   SteamGamePrice,
   SteamGameListSort,
 } from './modules/user';
+export { USER_INFO_AUTHORIZATION_SCOPES } from './modules/user';
+export type { UserInfoAuthorizationScope } from './modules/user';
 export type {
   MiniProgramScreenshotOptions,
   MiniProgramScreenshotRect,
@@ -413,18 +415,18 @@ onUnmounted(stopHandshakeState)
 
 ## 未开通网络权限
 
-无网络小程序可以在本地能力中使用按小程序隔离的 `app_user_id`：
+无网络小程序可以在本地能力中使用按小程序隔离的 `app_user_id` 和公开资料：
 
 ```ts
 import hbSDK from '@heybox/hb-sdk'
 
 async function getCurrentUser() {
   const result = await hbSDK.user.getInfo()
-  return result.userInfo?.app_user_id
+  return result.userInfo
 }
 ```
 
-`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回未登录状态；已登录时静默返回 `userInfo.app_user_id`。这条路径不能获取授权码或调用 OpenAPI，也不要把 `app_user_id` 发送到外部服务。
+`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回未登录状态；已登录时隐式授予当前本地用户 scopes（`identity`、`profile`），静默返回 `userInfo.app_user_id`、`profile.nickname` 和 `profile.avatar`。这条路径不能获取授权码或调用 OpenAPI，也不能把身份或资料发送到外部服务。
 
 ## 已开通网络权限
 

package/skill/references/recipes.md

@@ -49,18 +49,18 @@ onUnmounted(stopHandshakeState)
 
 ## 未开通网络权限
 
-无网络小程序可以在本地能力中使用按小程序隔离的 `app_user_id`：
+无网络小程序可以在本地能力中使用按小程序隔离的 `app_user_id` 和公开资料：
 
 ```ts
 import hbSDK from '@heybox/hb-sdk'
 
 async function getCurrentUser() {
   const result = await hbSDK.user.getInfo()
-  return result.userInfo?.app_user_id
+  return result.userInfo
 }
 ```
 
-`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回未登录状态；已登录时静默返回 `userInfo.app_user_id`。这条路径不能获取授权码或调用 OpenAPI，也不要把 `app_user_id` 发送到外部服务。
+`user.getInfo()` 不展示授权弹窗，也不要求可信用户手势。未登录时返回未登录状态；已登录时隐式授予当前本地用户 scopes（`identity`、`profile`），静默返回 `userInfo.app_user_id`、`profile.nickname` 和 `profile.avatar`。这条路径不能获取授权码或调用 OpenAPI，也不能把身份或资料发送到外部服务。
 
 ## 已开通网络权限
 
@@ -109,7 +109,7 @@ async function loginFromUserAction() {
 | 小程序类型     | 身份入口                  | 结果用途                                               |
 | -------------- | ------------------------- | ------------------------------------------------------ |
 | 已开通网络权限 | `auth.login({ scopes? })` | 获取短期授权码，由开发者服务端换取 OpenAPI token       |
-| 未开通网络权限 | `user.getInfo()`          | 静默读取当前小程序隔离的 `userInfo.app_user_id`        |
+| 未开通网络权限 | `user.getInfo()`          | 静默读取隔离身份及昵称头像，隐式授予本地用户 scopes    |
 
 不要混用两条路径。SDK 不向小程序页面提供 token、cookie、黑盒用户 ID 或平台私有凭据。
 
@@ -155,9 +155,9 @@ async function loginFromUserAction() {
 
 小程序页面只把 `code` 发送到自己的服务端。开发者服务端再按后端 OpenAPI 文档，用服务端保存的应用凭据交换 token；页面不得自行交换，也不得持有应用私密凭据。`auth.login()` 不返回 user、profile、`app_user_id` 或 token。
 
-开发者服务端用 access token 调用 `GET /user_miniprogram/openapi/v1/user` 读取当前用户。响应始终包含 `app_user_id`；token 含 `profile` 时还会返回 `nickname` 和 `avatar`。不要再请求已下线的 `/user/identity` 或 `/user/profile`。
+## 后端 OpenAPI
 
-服务端完成换票后，应只把业务需要的 `app_user_id`、`nickname`、`avatar` 等资料或业务 session 返回给页面；页面不接触 access token。
+开发者服务端按[在线用户身份与登录文档](https://docs.xiaoheihe.cn/hb_sdk/guide/auth)完成授权码交换和用户读取。小程序页面只提交 `auth.login()` 返回的短期 code，不持有服务端密钥、access token 或认证 header；Agent Skill 不分发服务端凭据操作示例。
 
 ## 用户操作和错误
 
@@ -196,20 +196,20 @@ async function revokeAuthorizationFromUserAction() {
 
 ## 未开通网络权限
 
-未开通网络权限的小程序不走授权码流程。需要当前用户在本小程序内的稳定隔离身份时调用：
+未开通网络权限的小程序不走授权码流程。需要当前用户在本小程序内的稳定隔离身份和公开资料时调用：
 
 ```ts
 import hbSDK from '@heybox/hb-sdk'
 
 async function getCurrentUser() {
   const result = await hbSDK.user.getInfo()
-  return result.userInfo?.app_user_id
+  return result.userInfo
 }
 ```
 
-`user.getInfo()` 是静默身份接口，不展示授权弹窗，也不要求可信用户手势。未登录时返回 `isHeyboxAppLoggedIn: false`；已登录时默认建立并返回当前小程序隔离的 `app_user_id`。调用该接口即表示允许平台为当前小程序建立隔离身份；每次成功调用都会广播一次 `user_info_authorization_change`，其中 `identity` 为 `granted`，即使授权状态没有发生变化。撤销授权后再次调用仍会静默建立新的隔离身份。
+`user.getInfo()` 是静默本地用户接口，不展示授权弹窗，也不要求可信用户手势。未登录时返回 `isHeyboxAppLoggedIn: false`；已登录时隐式授予当前本地用户 scopes（`identity`、`profile`），建立并返回当前小程序隔离的 `app_user_id`、`profile.nickname` 和 `profile.avatar`。每次成功调用都会广播一次 `user_info_authorization_change`，其中 `identity` 与 `profile` 均为 `granted`，即使授权状态没有发生变化。撤销授权后再次调用仍会静默建立新的隔离身份并恢复无网络模式的隐式授权。
 
-这类小程序无法获取授权码，也无法调用 OpenAPI；在未开通网络权限时调用 `auth.login()` 同样返回 `SERVER_API_REQUIRED`。Host 提供的 current-user APIs 与平台代管能力继续按各自权限工作，但页面不能把其中的身份或资料发送到外部服务。
+这类小程序无法获取授权码，也无法调用 OpenAPI；在未开通网络权限时调用 `auth.login()` 同样返回 `SERVER_API_REQUIRED`。隐式 full-scope 仅适用于 Host 本地用户资料能力，不代表开放网络或服务端凭据；页面不能把其中的身份或资料发送到外部服务。
 
 ## 网络请求边界
 

package/skill/references/safety-boundaries.md

@@ -17,7 +17,7 @@
 - 需要授权 UI 时，`auth.login()` 必须来自可信用户手势，否则返回 `USER_GESTURE_REQUIRED`；用户取消或关闭时返回 `AUTHORIZATION_CANCELLED`。已授权时可以静默返回新 code。
 - `user.getSteamGameList()` 仅供未开通网络权限的小程序通过 Host 读取；已开通网络权限时返回 `SERVER_API_REQUIRED`，且授权码与 OpenAPI 不提供 Steam 游戏库 scope 或资源接口。
 - 已开通网络权限时，公开的 `user.getInfo()` 返回 `SERVER_API_REQUIRED`；对应身份和资料数据应由开发者服务端通过 OpenAPI 获取。
-- 未开通网络权限时，使用 `user.getInfo()` 静默读取 `userInfo.app_user_id`，不能获取 code 或调用 OpenAPI。
+- 未开通网络权限时，`user.getInfo()` 隐式授予 `identity` 与 `profile`，静默返回 `userInfo.app_user_id`、昵称和头像；这条路径仍不能获取 code 或调用 OpenAPI。
 - `user.revokeAuthorization()` 在两种网络模式下都要求可信用户手势；成功后必须停止使用并清理业务缓存的旧身份、资料和服务端会话。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
 - 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。

package/skill/scripts/markdown-sections.mjs

@@ -0,0 +1,36 @@
+export function extractSection(markdown, heading) {
+  const lines = markdown.split('\n');
+  const start = lines.findIndex((line) => line.trim() === heading);
+  if (start === -1) return '';
+  const level = heading.match(/^#+/)?.[0].length ?? 2;
+  const out = [lines[start]];
+  let fenceChar = '';
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const line = lines[index];
+    const fenceMatch = line.match(/^\s*(`{3,}|~{3,})/);
+
+    if (fenceChar) {
+      out.push(line);
+      if (fenceMatch?.[1]?.startsWith(fenceChar)) fenceChar = '';
+      continue;
+    }
+
+    if (fenceMatch) {
+      fenceChar = fenceMatch[1][0];
+      out.push(line);
+      continue;
+    }
+
+    const headingMatch = line.match(/^(#+)\s/);
+    if (headingMatch && headingMatch[1].length <= level) break;
+    out.push(line);
+  }
+  return out.join('\n').trimEnd();
+}
+
+export function replaceRequiredSection(markdown, heading, replacement) {
+  const section = extractSection(markdown, heading);
+  if (!section) throw new Error(`sync-references: 未找到待覆盖章节 ${heading}`);
+  const start = markdown.indexOf(section);
+  return `${markdown.slice(0, start)}${replacement.trimEnd()}${markdown.slice(start + section.length)}`;
+}

package/skill/scripts/sync-references.mjs

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
 import ts from 'typescript';
+import { extractSection, replaceRequiredSection } from './markdown-sections.mjs';
 import { createSkillContentHash, createSkillManifest, normalizeSkillManifest } from './skill-metadata.mjs';
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
@@ -36,38 +37,6 @@ function read(relativePath) {
   return readFileSync(path.join(repoRoot, relativePath), 'utf8').trimEnd();
 }
 
-function extractSection(markdown, heading) {
-  const lines = markdown.split('\n');
-  const start = lines.findIndex((line) => line.trim() === heading);
-  if (start === -1) return '';
-  const level = heading.match(/^#+/)?.[0].length ?? 2;
-  const out = [lines[start]];
-  let fenceChar = '';
-  for (let index = start + 1; index < lines.length; index += 1) {
-    const line = lines[index];
-    const fenceMatch = line.match(/^\s*(`{3,}|~{3,})/);
-
-    if (fenceChar) {
-      out.push(line);
-      if (fenceMatch?.[1]?.startsWith(fenceChar)) {
-        fenceChar = '';
-      }
-      continue;
-    }
-
-    if (fenceMatch) {
-      fenceChar = fenceMatch[1][0];
-      out.push(line);
-      continue;
-    }
-
-    const headingMatch = line.match(/^(#+)\s/);
-    if (headingMatch && headingMatch[1].length <= level) break;
-    out.push(line);
-  }
-  return out.join('\n').trimEnd();
-}
-
 function fenced(language, value) {
   const content = value.trimEnd();
   const longestFence = Math.max(2, ...Array.from(content.matchAll(/`{3,}/g), (match) => match[0].length));
@@ -239,6 +208,15 @@ const readme = read('packages/hb-sdk/README.md');
 const cliGuide = frontmatterless(read('apps/docs/hb-sdk/guide/cli.md'));
 const quickStart = frontmatterless(read('apps/docs/hb-sdk/guide/quick-start.md'));
 const authGuide = frontmatterless(read('apps/docs/hb-sdk/guide/auth.md'));
+const authGuideForSkill = replaceRequiredSection(
+  authGuide,
+  '## 后端 OpenAPI',
+  [
+    '## 后端 OpenAPI',
+    '',
+    '开发者服务端按[在线用户身份与登录文档](https://docs.xiaoheihe.cn/hb_sdk/guide/auth)完成授权码交换和用户读取。小程序页面只提交 `auth.login()` 返回的短期 code，不持有服务端密钥、access token 或认证 header；Agent Skill 不分发服务端凭据操作示例。',
+  ].join('\n'),
+);
 const lifecycleGuide = frontmatterless(read('apps/docs/hb-sdk/guide/lifecycle.md'));
 const errorGuide = frontmatterless(read('apps/docs/hb-sdk/guide/error-handling.md'));
 const loginGate = frontmatterless(read('apps/docs/hb-sdk/recipes/login-gate.md'));
@@ -535,7 +513,7 @@ ${rewriteBundledRecipeLinks(quickStart)}
 
 ## User and login
 
-${rewriteBundledRecipeLinks(authGuide)}
+${rewriteBundledRecipeLinks(authGuideForSkill)}
 
 ## Lifecycle events
 

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.7.2+skill.4dbf3cd47129",
+  "skillVersion": "0.7.3-alpha.2+skill.b3df263ce69d",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.7.2",
-    "compatibility": "0.7.2"
+    "version": "0.7.3-alpha.2",
+    "compatibility": "0.7.3-alpha.2"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-4dbf3cd471293ade5b4b2cfe0f156d1365adffee4e7da36c6a30cb7dbb37319a"
+  "integrity": "sha256-b3df263ce69dd631bb62b0a33bdb2943cce4db93271100d5f96d947b04444195"
 }

package/types/index.d.ts

@@ -5,6 +5,8 @@ export type { MiniProgramEventHandler, MiniProgramEventName, MiniProgramEventPay
 export type { LoginOptions, LoginPayload, LoginResult, LoginScope, MiniProgramAuthModule } from './modules/auth';
 export type { DeleteCurrentUserLeaderboardEntryPayload, DeleteCurrentUserLeaderboardEntryResult, GetCurrentUserLeaderboardEntryPayload, GetCurrentUserLeaderboardEntryResult, GetLeaderboardInfoPayload, GetLeaderboardInfoResult, GetLeaderboardListPayload, GetLeaderboardListResult, LeaderboardEntry, LeaderboardOrder, MiniProgramCloudLeaderboardModule, MiniProgramCloudModule, SubmitLeaderboardEntryPayload, SubmitLeaderboardEntryResult, } from './modules/cloud';
 export type { AuthorizedUserInfo, GetUserInfoPayload, GetUserInfoResult, RevokeAuthorizationPayload, RevokeAuthorizationResult, GetSteamGameListOptions, GetSteamGameListPayload, GetSteamGameListResult, MiniProgramUserInfoResult, MiniProgramUserModule, UserInfoAuthorization, UserInfoAuthorizationStatus, SteamGameListData, SteamGameListItem, SteamGamePrice, SteamGameListSort, } from './modules/user';
+export { USER_INFO_AUTHORIZATION_SCOPES } from './modules/user';
+export type { UserInfoAuthorizationScope } from './modules/user';
 export type { MiniProgramScreenshotOptions, MiniProgramScreenshotRect, MiniProgramShareChannel, MiniProgramShareModule, MiniProgramSharePostOptions, MiniProgramShowShareMenuOptions, ScreenshotPayload, ScreenshotResult, ShowShareMenuPayload, ShowShareMenuResult, } from './modules/share';
 export type { GetWindowInfoPayload, GetWindowInfoResult, MiniProgramNavigationBarForegroundStyle, MiniProgramSafeArea, MiniProgramSetNavigationBarStyleOptions, MiniProgramViewportModule, MiniProgramWindowInfoResult, SetNavigationBarStylePayload, SetNavigationBarStyleResult, } from './modules/viewport';
 export type { GetStoragePayload, GetStorageResult, MiniProgramStorageModule, SetStoragePayload } from './modules/storage';

package/types/modules/user/get-info.d.ts

@@ -15,7 +15,7 @@ export type GetUserInfoResult = MiniProgramUserInfoResult;
  * @returns 当前用户的登录态与公开基础资料。
  *
  * 未开通网络权限且当前黑盒 APP 用户已登录时，该能力会静默建立或读取按小程序隔离的
- * `app_user_id`，不展示授权 UI；仅在 profile 授权后返回昵称与头像。未登录时返回
+ * `app_user_id`，并隐式授予 `identity` 与 `profile` 后返回昵称与头像，不展示授权 UI。未登录时返回
  * `{ isHeyboxAppLoggedIn: false, authorization: null, userInfo: null }`。
  *
  * @throws {HbMiniProgramSDKError} 当 SDK 调用失败时抛出。

package/types/modules/user/types.d.ts

@@ -1,16 +1,18 @@
 /** 用户资料授权状态。 */
 export type UserInfoAuthorizationStatus = 'not_required' | 'not_requested' | 'granted' | 'denied';
-/** 当前小程序对用户身份与公开资料的授权状态。 */
-export interface UserInfoAuthorization {
-    identity: UserInfoAuthorizationStatus;
-    profile: UserInfoAuthorizationStatus;
+/** 当前用户信息能力支持的完整 scope 目录。新增 scope 时必须更新这里。 */
+export declare const USER_INFO_AUTHORIZATION_SCOPES: readonly ["identity", "profile"];
+export type UserInfoAuthorizationScope = (typeof USER_INFO_AUTHORIZATION_SCOPES)[number];
+type CanonicalUserInfoAuthorization = Record<UserInfoAuthorizationScope, UserInfoAuthorizationStatus>;
+/** 当前小程序对 canonical 用户信息 scope 的授权状态。 */
+export interface UserInfoAuthorization extends CanonicalUserInfoAuthorization {
 }
 /**
  * 已获准向当前小程序披露的用户资料。
  *
  * @remarks
- * 未开通网络权限且当前黑盒 APP 用户已登录时，Runtime 会静默建立或读取隔离身份，
- * `user.getInfo()` 随即返回该对象。撤销授权后旧身份失效，调用方应停止使用并清理
+ * 未开通网络权限且当前黑盒 APP 用户已登录时，Runtime 会隐式授予 `identity` 与
+ * `profile`，静默建立或读取隔离身份，并由 `user.getInfo()` 返回该对象。撤销授权后旧身份失效，调用方应停止使用并清理
  * 本地缓存；再次调用 `user.getInfo()` 会静默建立新的隔离身份。
  */
 export interface AuthorizedUserInfo {
@@ -24,7 +26,7 @@ export interface AuthorizedUserInfo {
      * 不应解析格式或依赖固定长度。
      */
     app_user_id: string;
-    /** 仅在 `profile` 授权后返回昵称与头像。 */
+    /** `profile` 已授权时返回昵称与头像；当前 Heybox Runtime 在无网络模式下隐式授予该 scope。 */
     profile: {
         nickname: string;
         avatar: string;
@@ -35,7 +37,8 @@ export interface AuthorizedUserInfo {
  *
  * @remarks
  * 未登录时 `isHeyboxAppLoggedIn` 为 `false`，授权状态和用户资料均为 `null`。
- * 当前 Heybox Runtime 在无网络模式且已登录时会静默建立身份并返回 `userInfo`；
+ * 当前 Heybox Runtime 在无网络模式且已登录时会隐式授予 `identity` 与 `profile`，
+ * 静默建立身份并返回 `userInfo`；
  * Host 在已登录但身份暂不可用时仍可返回 `null`，调用方必须进行空值判断。
  */
 export type MiniProgramUserInfoResult = {
@@ -47,3 +50,4 @@ export type MiniProgramUserInfoResult = {
     authorization: UserInfoAuthorization;
     userInfo: AuthorizedUserInfo | null;
 };
+export {};

package/types/protocol.d.ts

@@ -10,6 +10,8 @@ export type { MiniProgramDeviceMethod, MiniProgramAuthMethod, MiniProgramBridgeM
 export type { LoginOptions, LoginPayload, LoginResult, LoginScope } from './modules/auth';
 export type { DeleteCurrentUserLeaderboardEntryPayload, DeleteCurrentUserLeaderboardEntryResult, GetCurrentUserLeaderboardEntryPayload, GetCurrentUserLeaderboardEntryResult, GetLeaderboardInfoPayload, GetLeaderboardInfoResult, GetLeaderboardListPayload, GetLeaderboardListResult, LeaderboardEntry, LeaderboardOrder, SubmitLeaderboardEntryPayload, SubmitLeaderboardEntryResult, } from './modules/cloud';
 export type { AuthorizedUserInfo, GetUserInfoPayload, GetUserInfoResult, RevokeAuthorizationPayload, RevokeAuthorizationResult, GetSteamGameListOptions, GetSteamGameListPayload, GetSteamGameListResult, MiniProgramUserInfoResult, UserInfoAuthorization, UserInfoAuthorizationStatus, SteamGameListData, SteamGameListItem, SteamGamePrice, SteamGameListSort, } from './modules/user';
+export { USER_INFO_AUTHORIZATION_SCOPES } from './modules/user';
+export type { UserInfoAuthorizationScope } from './modules/user';
 export type { ScreenshotPayload, ScreenshotResult } from './modules/share/screenshot';
 export type { ShowShareMenuPayload, ShowShareMenuResult } from './modules/share/show-share-menu';
 export type { MiniProgramScreenshotOptions, MiniProgramScreenshotRect, MiniProgramShareChannel, MiniProgramSharePostOptions, MiniProgramShowShareMenuOptions, } from './modules/share';