@heybox/hb-sdk 0.7.4-alpha.1 → 0.7.4-alpha.4

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.7.4-alpha.4
+
+### SDK
+
+- 同步 `auth.login()` 授权弹窗展示说明与 Agent Skill 引用。
+
+### Runtime
+
+- 修复首次授权弹窗仅显示占位信息的问题；展示小程序名称和图标，并在申请 `profile` 时预览当前账号昵称和头像，资料读取失败继续使用中性占位。
+- 展示资料读取增加独立超时与取消边界，避免可选请求阻塞授权队列；账号切换、撤销或 Runtime 终止会立即取消当前确认界面。
+- Mobile/PC Host 启动配置复用已可信解析的小程序资料，回退请求携带 canonical version，避免预览或开发实例展示线上版本资料。
+- 将 hb-sdk release family 单测接入 `build_changed_packages` MR 门禁。
+
+## 0.7.4-alpha.3
+
+### Runtime
+
+- 兼容缺少 User Activation API 的旧版 iOS WKWebView；支持环境继续使用标准用户激活状态，旧版环境回退到父文档捕获的近期 iframe 输入与焦点组合判定。旧环境的手势门禁强度低于标准环境，环境读取失败一律拒绝。
+
 ## 0.7.4-alpha.1
 
 ### Breaking / Host Runtime

package/dist/cli-chunks/{build-Cej8ObyY.cjs → build-BqGFRLe-.cjs}

@@ -5,8 +5,8 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var runtimeGate = require('./runtime-gate-CtV7rWyX.cjs');
-var index = require('./index-BCd2vU5D.cjs');
-var projectVite = require('./project-vite-BtIYxLkt.cjs');
+var index = require('./index-CyEqCbeu.cjs');
+var projectVite = require('./project-vite-BUY9DgYo.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-DATgeHkI.cjs → context-DTr3hRTv.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var session = require('./session-9ZWPGpqB.cjs');
+var session = require('./session-BUjFX2U2.cjs');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');

package/dist/cli-chunks/{create-LXHV_lW5.cjs → create-OkiiiH4I.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-BCd2vU5D.cjs');
+var index = require('./index-CyEqCbeu.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CDuVyGm9.cjs → dev-j7W9R7ew.cjs}

@@ -6,15 +6,15 @@ var path = require('node:path');
 var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
-var context = require('./context-DATgeHkI.cjs');
+var context = require('./context-DTr3hRTv.cjs');
 var node_crypto = require('node:crypto');
 var undici = require('undici');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-BCd2vU5D.cjs');
-var projectVite = require('./project-vite-BtIYxLkt.cjs');
+var index = require('./index-CyEqCbeu.cjs');
+var projectVite = require('./project-vite-BUY9DgYo.cjs');
 var fs$1 = require('node:fs/promises');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
-require('./session-9ZWPGpqB.cjs');
+require('./session-BUjFX2U2.cjs');
 require('fs');
 require('constants');
 require('stream');
@@ -2005,7 +2005,7 @@ function createHeyboxProtocol(payload) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.1';
+    : '0.7.4-alpha.4';
 
 class DevPermissionOverrideStoreError extends Error {
     code;

package/dist/cli-chunks/{doctor-BqmQrPaV.cjs → doctor-BO0vkDny.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-BCd2vU5D.cjs');
+var index = require('./index-CyEqCbeu.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-Ck7X1LRP.cjs → index-CZuvk1Rg.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index$2 = require('./index-BCd2vU5D.cjs');
+var index$2 = require('./index-CyEqCbeu.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');

package/dist/cli-chunks/{index-BCd2vU5D.cjs → index-CyEqCbeu.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BCd2vU5D.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CyEqCbeu.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BCd2vU5D.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CyEqCbeu.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BCd2vU5D.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CyEqCbeu.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BCd2vU5D.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CyEqCbeu.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BCd2vU5D.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CyEqCbeu.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.7.4-alpha.1';
+const BUILT_CLI_VERSION = '0.7.4-alpha.4';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13684,35 +13684,35 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BLTILOf-.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CuAGltGs.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BLTILOf-.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CuAGltGs.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BLTILOf-.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CuAGltGs.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-Cej8ObyY.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-BqGFRLe-.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-LXHV_lW5.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-OkiiiH4I.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CDuVyGm9.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-j7W9R7ew.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BqmQrPaV.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-BO0vkDny.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-Bp9SK8C3.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-tPMcxgpi.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{login-BLTILOf-.cjs → login-CuAGltGs.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-9ZWPGpqB.cjs');
+var session = require('./session-BUjFX2U2.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-BCd2vU5D.cjs');
+var index = require('./index-CyEqCbeu.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-BtIYxLkt.cjs → project-vite-BUY9DgYo.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-BCd2vU5D.cjs');
+var index = require('./index-CyEqCbeu.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-Bp9SK8C3.cjs → remote-tPMcxgpi.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-BCd2vU5D.cjs');
-var session = require('./session-9ZWPGpqB.cjs');
+var index = require('./index-CyEqCbeu.cjs');
+var session = require('./session-BUjFX2U2.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
@@ -10,7 +10,7 @@ var path = require('node:path');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
 var runtimeGate = require('./runtime-gate-CtV7rWyX.cjs');
 var node_crypto = require('node:crypto');
-var context = require('./context-DATgeHkI.cjs');
+var context = require('./context-DTr3hRTv.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -271,7 +271,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-Ck7X1LRP.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-CZuvk1Rg.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {

package/dist/cli-chunks/{session-9ZWPGpqB.cjs → session-BUjFX2U2.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-BCd2vU5D.cjs');
+var index = require('./index-CyEqCbeu.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-BCd2vU5D.cjs');
+var index = require('./cli-chunks/index-CyEqCbeu.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/browser-dev-host/main.js

@@ -216,11 +216,18 @@ function readBrowserEnvironment() {
         return { activeElement: null };
     }
 }
-/** 按浏览器消息、用户激活和目标 iframe 焦点生成请求级可信手势快照。 */
-function computeTrustedIframeUserGesture(event, iframe, environment = readBrowserEnvironment()) {
-    return (event.isTrusted === true
-        && environment.userActivation?.isActive === true
-        && environment.activeElement === iframe);
+const USER_GESTURE_TTL_MS = 1000;
+/** 优先使用 User Activation；旧版 WebView 使用带时效的 iframe 焦点回退。 */
+function computeTrustedIframeUserGesture(iframe, environment = readBrowserEnvironment()) {
+    if (environment.userActivation) {
+        return environment.userActivation.isActive === true;
+    }
+    const lastUserInteractionAt = environment.lastUserInteractionAt;
+    const now = environment.now ?? Date.now();
+    return (environment.activeElement === iframe
+        && lastUserInteractionAt !== undefined
+        && now >= lastUserInteractionAt
+        && now - lastUserInteractionAt <= USER_GESTURE_TTL_MS);
 }
 
 const RUNTIME_GATE_PROBE_METHOD = 'runtime.gate.probe';
@@ -238,6 +245,7 @@ class MiniProgramBridgeServer {
         this.onDuplicateHandshake = options.onDuplicateHandshake;
         this.onInternalEvent = options.onInternalEvent;
         this.handleMessage = this.onMessage.bind(this);
+        this.handleUserInteraction = this.onUserInteraction.bind(this);
         this.dispatcher = options.dispatcher;
         this.targetOrigin = options.targetOrigin || '*';
     }
@@ -248,6 +256,9 @@ class MiniProgramBridgeServer {
         }
         this.started = true;
         window.addEventListener('message', this.handleMessage);
+        for (const eventName of ['pointerdown', 'touchend', 'mousedown', 'keydown']) {
+            window.addEventListener(eventName, this.handleUserInteraction, true);
+        }
     }
     /** 设置发送给 iframe 的 targetOrigin。 */
     setTargetOrigin(targetOrigin) {
@@ -263,6 +274,10 @@ class MiniProgramBridgeServer {
             timestamp: Date.now(),
         });
         window.removeEventListener('message', this.handleMessage);
+        for (const eventName of ['pointerdown', 'touchend', 'mousedown', 'keydown']) {
+            window.removeEventListener(eventName, this.handleUserInteraction, true);
+        }
+        this.lastUserInteractionAt = undefined;
     }
     /** 向 iframe 内小程序派发生命周期或业务事件。 */
     postEvent(eventName, payload) {
@@ -297,13 +312,31 @@ class MiniProgramBridgeServer {
             return;
         }
         if (message.type === 'request') {
-            this.handleRequest(message, computeTrustedIframeUserGesture(event, this.iframe));
+            let trustedUserGesture = false;
+            try {
+                trustedUserGesture = computeTrustedIframeUserGesture(this.iframe, {
+                    activeElement: document.activeElement,
+                    userActivation: navigator.userActivation,
+                    lastUserInteractionAt: this.lastUserInteractionAt,
+                    now: Date.now(),
+                });
+            }
+            catch {
+                trustedUserGesture = false;
+            }
+            this.handleRequest(message, trustedUserGesture);
             return;
         }
         if (message.type === 'event' && this.handshaken) {
             this.onInternalEvent?.(message);
         }
     }
+    onUserInteraction(event) {
+        const path = typeof event.composedPath === 'function' ? event.composedPath() : [];
+        if (event.target === this.iframe || path.includes(this.iframe)) {
+            this.lastUserInteractionAt = Date.now();
+        }
+    }
     isTrustedMiniProgramMessage(event) {
         return (event.source === this.iframe.contentWindow &&
             isMiniProgramBridgeMessage(event.data) &&
@@ -624,6 +657,63 @@ function parseAPIResponse(response, fallbackMessage) {
     return data;
 }
 
+/**
+ * @packageDocumentation
+ * 定义 AccountUserBaseInfo 接口的 Runtime endpoint 契约。
+ */
+/**
+ * AccountUserBaseInfo 原始信封 endpoint。
+ *
+ * @remarks
+ * 供需要区分 `login`、`relogin` 等认证状态的领域服务使用；调用输入仍为 `void`，
+ * wire path 只由本 API contract owner 维护。
+ */
+const accountUserBaseInfoEnvelopeEndpoint = {
+    auth: 'optional',
+    channel: 'api',
+    id: 'heybox.account.user_base_info.envelope.get',
+    method: 'GET',
+    path: '/account/get_user_base_info',
+};
+
+/**
+ * @packageDocumentation
+ * 定义 UserMiniprogramPublicDetail 接口的 Runtime endpoint 契约。
+ */
+/** 用户侧工坊小程序详情 endpoint。 */
+const userMiniprogramPublicDetailEndpoint = {
+    auth: 'optional',
+    channel: 'api',
+    failurePresentation: 'none',
+    id: 'heybox.user_miniprogram.public.detail.get',
+    method: 'GET',
+    path: '/user_miniprogram/public/detail',
+    /**
+     * 把业务输入映射为接口 query。
+     *
+     * @param input - 已由调用方提供的接口输入。
+     */
+    query(input) {
+        return {
+            mini_program_id: input.mini_program_id,
+            ...(input.miniprogram_version ? { miniprogram_version: input.miniprogram_version } : {}),
+            ...(input.preview_token ? { preview_token: input.preview_token } : {}),
+            ...(input.local_dev_launch_token ? { local_dev_launch_token: input.local_dev_launch_token } : {}),
+            ...(input.entry ? { entry: input.entry } : {}),
+            ...(input.h_src_parent ? { h_src_parent: input.h_src_parent } : {}),
+        };
+    },
+    /**
+     * 保留标准响应信封，由迁移页维持旧 `status` 分支语义。
+     *
+     * @param response - Runtime request pipeline 返回的 transport 响应。
+     * @param _input - 当前 endpoint 输入；解析响应时无需读取。
+     */
+    parse(response, _input) {
+        return parseAPIResponse(response, '工坊小程序详情加载失败');
+    },
+};
+
 function runtimeContextBody(runtimeContext) {
     return { mini_program_id: runtimeContext.miniProgramId };
 }
@@ -964,6 +1054,7 @@ async function requestEndpoint(network, endpoint, input, context) {
 }
 
 const USER_INFO_AUTHORIZATION_SCOPE_SET = new Set(USER_INFO_AUTHORIZATION_SCOPES);
+const AUTHORIZATION_PRESENTATION_DETAILS_TIMEOUT_MS = 1000;
 function createAuthorizationCoordinator(options) {
     const listeners = new Set();
     const localIdentityCache = new Map();
@@ -972,13 +1063,18 @@ function createAuthorizationCoordinator(options) {
     let generation = 0;
     let disposed = false;
     let presentationQueue = Promise.resolve();
+    let activePresentationController;
     const unsubscribeAccount = options.account.onChange((userId) => {
+        invalidateAuthorizationContext();
+        emit('heybox_app_login_change', { isHeyboxAppLoggedIn: Boolean(userId) });
+    });
+    function invalidateAuthorizationContext() {
         generation += 1;
+        activePresentationController?.abort();
         localIdentityCache.clear();
         localIdentityInflight.clear();
         grantedScopes.clear();
-        emit('heybox_app_login_change', { isHeyboxAppLoggedIn: Boolean(userId) });
-    });
+    }
     function emit(name, payload) {
         for (const listener of listeners) {
             try {
@@ -1036,12 +1132,14 @@ function createAuthorizationCoordinator(options) {
         }
         return userId;
     }
-    async function request(endpoint, input) {
+    async function request(endpoint, input, signal = options.operationContext.signal) {
         try {
-            return await requestEndpoint(options.network, endpoint, input, {
+            if (signal.aborted)
+                throw createAbortError$3();
+            return await waitForAbortableOperation(requestEndpoint(options.network, endpoint, input, {
                 credentials: 'heybox-session',
-                signal: options.operationContext.signal,
-            });
+                signal,
+            }), signal);
         }
         catch (error) {
             if (options.operationContext.signal.aborted) {
@@ -1071,7 +1169,19 @@ function createAuthorizationCoordinator(options) {
         }).catch(() => undefined);
     }
     function runPresentation(operation) {
-        const result = presentationQueue.then(operation, operation);
+        const run = async () => {
+            const controller = createLinkedAbortController(options.operationContext.signal);
+            activePresentationController = controller;
+            try {
+                return await operation(controller.signal);
+            }
+            finally {
+                if (activePresentationController === controller)
+                    activePresentationController = undefined;
+                controller.abort();
+            }
+        };
+        const result = presentationQueue.then(run, run);
         presentationQueue = result.then(() => undefined, () => undefined);
         return result;
     }
@@ -1084,14 +1194,17 @@ function createAuthorizationCoordinator(options) {
             await cancelAuthorization(miniProgramId, challengeValue.challenge);
             throw createCapabilityBridgeError('AUTHORIZATION_PRESENTATION_UNAVAILABLE', '授权确认界面不可用');
         }
-        return runPresentation(async () => {
+        return runPresentation(async (presentationSignal) => {
+            await assertAuthorizationContext(expectedUserId, expectedGeneration);
+            const presentationDetails = await loadAuthorizationPresentationDetails(miniProgramId, challengeValue.displayedScopes, presentationSignal);
             await assertAuthorizationContext(expectedUserId, expectedGeneration);
             let decision;
             try {
                 decision = await options.authPresentation.confirmAuthorization({
                     miniProgramId,
                     scopes: challengeValue.displayedScopes,
-                    signal: options.operationContext.signal,
+                    ...presentationDetails,
+                    signal: presentationSignal,
                 });
             }
             catch (error) {
@@ -1115,6 +1228,53 @@ function createAuthorizationCoordinator(options) {
             return selectedScopes;
         });
     }
+    async function loadAuthorizationPresentationDetails(miniProgramId, displayedScopes, presentationSignal) {
+        const detailController = createLinkedAbortController(presentationSignal);
+        const timeout = setTimeout(() => detailController.abort(), AUTHORIZATION_PRESENTATION_DETAILS_TIMEOUT_MS);
+        try {
+            const trustedMiniProgram = normalizeMiniProgramPresentation(options.miniProgramPresentation);
+            const [miniProgram, userProfile] = await Promise.all([
+                trustedMiniProgram ? Promise.resolve(trustedMiniProgram) : loadMiniProgramPresentation(miniProgramId, detailController.signal),
+                displayedScopes.includes('profile') ? loadUserProfilePresentation(detailController.signal) : Promise.resolve(undefined),
+            ]);
+            return {
+                ...(miniProgram ? { miniProgram } : {}),
+                ...(userProfile ? { userProfile } : {}),
+            };
+        }
+        finally {
+            clearTimeout(timeout);
+            detailController.abort();
+        }
+    }
+    async function loadMiniProgramPresentation(miniProgramId, signal) {
+        try {
+            const version = options.identity.get()?.version?.trim();
+            const envelope = await request(userMiniprogramPublicDetailEndpoint, {
+                mini_program_id: miniProgramId,
+                ...(version ? { miniprogram_version: version } : {}),
+            }, signal);
+            const result = readSuccessfulResult$3(envelope, '小程序公开资料');
+            const name = readOptionalPresentationText(result.name);
+            const avatarUrl = readOptionalPresentationText(result.icon_url);
+            return name || avatarUrl ? { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) } : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async function loadUserProfilePresentation(signal) {
+        try {
+            const envelope = await request(accountUserBaseInfoEnvelopeEndpoint, undefined, signal);
+            const result = readSuccessfulResult$3(envelope, '账号基础信息');
+            const nickname = readOptionalPresentationText(result.display_username);
+            const avatar = readOptionalPresentationText(result.display_avatar);
+            return nickname || avatar ? { ...(nickname ? { nickname } : {}), ...(avatar ? { avatar } : {}) } : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
     async function login(scopes, trustedUserGesture) {
         const miniProgramId = requireCanonicalMiniProgramId();
         const userId = await requireAuthenticatedUser(trustedUserGesture);
@@ -1231,10 +1391,7 @@ function createAuthorizationCoordinator(options) {
         });
         await assertAuthorizationContext(userId, expectedGeneration);
         readSuccessfulResult$3(envelope, '用户授权撤销');
-        generation += 1;
-        localIdentityCache.clear();
-        localIdentityInflight.clear();
-        grantedScopes.clear();
+        invalidateAuthorizationContext();
         emit('user_info_authorization_change', { identity: 'denied', profile: 'denied' });
         return undefined;
     }
@@ -1251,11 +1408,8 @@ function createAuthorizationCoordinator(options) {
             if (disposed)
                 return;
             disposed = true;
-            generation += 1;
+            invalidateAuthorizationContext();
             unsubscribeAccount();
-            localIdentityCache.clear();
-            localIdentityInflight.clear();
-            grantedScopes.clear();
             listeners.clear();
         },
     };
@@ -1339,6 +1493,46 @@ function validateSelectedScopes(scopes, displayedScopes) {
     }
     return selected;
 }
+function readOptionalPresentationText(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function normalizeMiniProgramPresentation(value) {
+    const name = readOptionalPresentationText(value?.name);
+    const avatarUrl = readOptionalPresentationText(value?.avatarUrl);
+    return name || avatarUrl ? { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) } : undefined;
+}
+function createLinkedAbortController(parent) {
+    const controller = new AbortController();
+    if (parent.aborted) {
+        controller.abort(parent.reason);
+    }
+    else {
+        parent.addEventListener('abort', () => controller.abort(parent.reason), { once: true, signal: controller.signal });
+    }
+    return controller;
+}
+function waitForAbortableOperation(operation, signal) {
+    if (signal.aborted)
+        return Promise.reject(createAbortError$3());
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (callback) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener('abort', onAbort);
+            callback();
+        };
+        const onAbort = () => settle(() => reject(createAbortError$3()));
+        signal.addEventListener('abort', onAbort, { once: true });
+        operation.then((value) => settle(() => resolve(value)), (error) => settle(() => reject(error)));
+    });
+}
+function createAbortError$3() {
+    const error = new Error('The operation was aborted');
+    error.name = 'AbortError';
+    return error;
+}
 function validateScopeArray(value, label) {
     if (!Array.isArray(value) ||
         value.some((scope) => typeof scope !== 'string' || !USER_INFO_AUTHORIZATION_SCOPE_SET.has(scope)) ||
@@ -3267,25 +3461,6 @@ function isBridgeError$1(error) {
     return isCapabilityRecord(error) && typeof error.code === 'string' && typeof error.message === 'string';
 }
 
-/**
- * @packageDocumentation
- * 定义 AccountUserBaseInfo 接口的 Runtime endpoint 契约。
- */
-/**
- * AccountUserBaseInfo 原始信封 endpoint。
- *
- * @remarks
- * 供需要区分 `login`、`relogin` 等认证状态的领域服务使用；调用输入仍为 `void`，
- * wire path 只由本 API contract owner 维护。
- */
-const accountUserBaseInfoEnvelopeEndpoint = {
-    auth: 'optional',
-    channel: 'api',
-    id: 'heybox.account.user_base_info.envelope.get',
-    method: 'GET',
-    path: '/account/get_user_base_info',
-};
-
 /**
  * @packageDocumentation
  * 定义 GameSteamGetGameList 接口的 Runtime endpoint 契约。
@@ -3878,6 +4053,7 @@ function createRuntimeCapabilityModules(options) {
         identity: options.identity,
         operationContext,
         authPresentation: options.authPresentation,
+        miniProgramPresentation: options.miniProgramPresentation,
     });
     let user;
     let cloud;
@@ -4564,6 +4740,7 @@ class MiniProgramRuntimeImpl {
         if (this.isInactive())
             return;
         this.runtimePermissions = configuration.runtimePermissions;
+        this.miniProgramPresentation = configuration.miniProgramPresentation;
         this.locationBasePath = configuration.locationBasePath;
         this.anonymousStorageScope = configuration.anonymousStorageScope ?? this.options.anonymousStorageScope;
         this.allowedHttpOrigins = configuration.allowedHttpOrigins ?? this.options.allowedHttpOrigins;
@@ -4625,6 +4802,7 @@ class MiniProgramRuntimeImpl {
             terminalSignal: this.terminalController.signal,
             eventSink,
             authPresentation: this.options.authPresentation,
+            miniProgramPresentation: this.miniProgramPresentation,
             anonymousStorageScope: this.anonymousStorageScope,
             storageLimits: this.options.storageLimits,
             allowedHttpOrigins: this.allowedHttpOrigins,

package/dist/index.cjs.js

@@ -671,7 +671,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.1';
+    : '0.7.4-alpha.4';
 
 const DEFAULT_TIMEOUT = 10000;
 const HANDSHAKE_RETRY_INTERVAL = 250;

package/dist/index.esm.js

@@ -667,7 +667,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.1';
+    : '0.7.4-alpha.4';
 
 const DEFAULT_TIMEOUT = 10000;
 const HANDSHAKE_RETRY_INTERVAL = 250;

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.1';
+    : '0.7.4-alpha.4';
 
 var re = {exports: {}};
 

package/dist/vite.esm.js

@@ -5,7 +5,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.1';
+    : '0.7.4-alpha.4';
 
 var re = {exports: {}};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.7.4-alpha.1",
+  "version": "0.7.4-alpha.4",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -55,7 +55,7 @@
   "dependencies": {
     "parse5": "^7.3.0",
     "undici": "^7.28.0",
-    "@heybox/hb-sdk-protocol": "0.7.4-alpha.1"
+    "@heybox/hb-sdk-protocol": "0.7.4-alpha.4"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -96,7 +96,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-sdk-runtime": "~0.7.4-alpha.1",
+    "@heybox/hb-sdk-runtime": "~0.7.4-alpha.4",
     "@heybox/hb-api": "~1.25.20"
   },
   "publishConfig": {

package/skill/references/api-root.md

@@ -24,7 +24,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.7.4-alpha.1`
+- Version at generation time: `0.7.4-alpha.4`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`

package/skill/references/recipes.md

@@ -163,6 +163,8 @@ async function loginFromUserAction() {
 
 需要展示登录或授权 UI 时，调用必须来自按钮点击等可信用户手势，否则返回 `USER_GESTURE_REQUIRED`。用户取消、拒绝或关闭授权页面时返回 `AUTHORIZATION_CANCELLED`，业务应停留在当前页面并允许稍后重试。
 
+首次授权时，Host 授权页会展示当前小程序的名称和图标；申请 `profile` scope 时，还会预览当前小黑盒账号的昵称和头像，帮助用户确认资料披露对象。Runtime 优先复用 Host 启动阶段已经解析的资料，读取补充资料失败或超时时使用中性占位，不影响用户继续授权。账号切换、授权撤销或 Runtime 终止会关闭当前确认界面；这些 Host 展示字段不会加入 `auth.login()` 返回值。
+
 用户已授权所需 scope 时，`auth.login()` 可以不展示 UI，静默返回新的短期授权码。业务仍应把可能出现的授权 UI 设计在明确的用户操作之后，不要在页面初始化阶段自动调用。
 
 ## 撤销当前小程序授权

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.7.4-alpha.1+skill.012bc6457d0f",
+  "skillVersion": "0.7.4-alpha.4+skill.248b8d6d06cb",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.7.4-alpha.1",
-    "compatibility": "0.7.4-alpha.1"
+    "version": "0.7.4-alpha.4",
+    "compatibility": "0.7.4-alpha.4"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-012bc6457d0f8f3c30feb117ba0cbcde986dcbb4587587aade7a5a09b1bc3261"
+  "integrity": "sha256-248b8d6d06cb00817bfadca1bc5fd0d15112088f6548c11cb6d715453e2a6d4d"
 }