@agentunion/fastaun-browser 0.2.17 → 0.2.19

package/dist/auth.js

@@ -4,6 +4,7 @@
 import { base64ToUint8, uint8ToBase64, pemToArrayBuffer, toBufferSource } from './crypto.js';
 import { AuthError, StateError, ValidationError, mapRemoteError } from './errors.js';
 import { ROOT_CA_PEM } from './certs/root.js';
+const _noopLog = { error: () => { }, warn: () => { }, info: () => { }, debug: () => { } };
 import { isJsonObject, } from './types.js';
 // ── ASN.1 / PEM 工具 ────────────────────────────────────
 /** 拆分 PEM bundle 为独立的 PEM 字符串数组 */
@@ -334,6 +335,8 @@ function gatewayHttpUrl(gatewayUrl, path) {
  *   - 证书自动续期
  */
 export class AuthFlow {
+    _log = _noopLog;
+    setLogger(log) { this._log = log; }
     static _INSTANCE_STATE_FIELDS = [
         'access_token',
         'refresh_token',
@@ -368,14 +371,23 @@ export class AuthFlow {
     // ── 公开 API ──────────────────────────────────────
     /** 加载本地身份信息 */
     async loadIdentity(aid) {
-        const identity = await this._loadIdentityOrRaise(aid);
-        const cert = await this._keystore.loadCert(identity.aid);
-        if (cert)
-            identity.cert = cert;
-        const instanceState = await this._loadInstanceState(identity.aid);
-        if (instanceState)
-            Object.assign(identity, instanceState);
-        return identity;
+        const tStart = Date.now();
+        this._log.debug(`loadIdentity enter: aid=${aid ?? '<current>'}`);
+        try {
+            const identity = await this._loadIdentityOrRaise(aid);
+            const cert = await this._keystore.loadCert(identity.aid);
+            if (cert)
+                identity.cert = cert;
+            const instanceState = await this._loadInstanceState(identity.aid);
+            if (instanceState)
+                Object.assign(identity, instanceState);
+            this._log.debug(`loadIdentity exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid} has_cert=${!!identity.cert}`);
+            return identity;
+        }
+        catch (err) {
+            this._log.debug(`loadIdentity exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
     }
     /** 加载身份，不存在时返回 null */
     async loadIdentityOrNull(aid) {
@@ -410,265 +422,381 @@ export class AuthFlow {
      *   3. 保存返回的证书
      */
     async createAid(gatewayUrl, aid) {
+        const tStart = Date.now();
+        this._log.debug(`createAid enter: aid=${aid} gateway=${gatewayUrl}`);
         AuthFlow._validateAidName(aid);
-        const identity = await this._ensureLocalIdentity(aid);
-        if (identity.cert) {
-            return { aid: identity.aid, cert: identity.cert };
-        }
-        // 本地有密钥但无证书 — 尝试注册
         try {
-            const created = await this._createAid(gatewayUrl, identity);
-            Object.assign(identity, created);
-        }
-        catch (e) {
-            if (e instanceof Error && e.message.includes('already exists')) {
-                // AID 已在服务端注册，尝试下载证书恢复
-                try {
-                    const recovered = await this._recoverCertViaDownload(gatewayUrl, identity);
-                    Object.assign(identity, recovered);
+            const identity = await this._ensureLocalIdentity(aid);
+            if (identity.cert) {
+                this._log.debug(`createAid exit: elapsed=${Date.now() - tStart}ms aid=${aid} reason=already_has_cert`);
+                return { aid: identity.aid, cert: identity.cert };
+            }
+            // 本地有密钥但无证书 — 尝试注册
+            try {
+                const created = await this._createAid(gatewayUrl, identity);
+                Object.assign(identity, created);
+            }
+            catch (e) {
+                if (e instanceof Error && e.message.includes('already exists')) {
+                    // AID 已在服务端注册，尝试下载证书恢复
+                    try {
+                        const recovered = await this._recoverCertViaDownload(gatewayUrl, identity);
+                        Object.assign(identity, recovered);
+                    }
+                    catch {
+                        this._log.debug(`createAid exit (error): elapsed=${Date.now() - tStart}ms aid=${aid} err=already_registered_recover_failed`);
+                        throw new StateError(`AID ${aid} already registered on server but local certificate is missing. ` +
+                            `Certificate download recovery failed. Options: ` +
+                            `(1) use a different AID name, or ` +
+                            `(2) restart server to clear registration.`);
+                    }
                 }
-                catch {
-                    throw new StateError(`AID ${aid} already registered on server but local certificate is missing. ` +
-                        `Certificate download recovery failed. Options: ` +
-                        `(1) use a different AID name, or ` +
-                        `(2) restart server to clear registration.`);
+                else {
+                    throw e;
                 }
             }
-            else {
-                throw e;
-            }
+            await this._persistIdentity(identity);
+            this._aid = identity.aid;
+            this._log.debug(`createAid exit: elapsed=${Date.now() - tStart}ms aid=${aid}`);
+            return { aid: identity.aid, cert: identity.cert };
+        }
+        catch (err) {
+            this._log.debug(`createAid exit (error): elapsed=${Date.now() - tStart}ms aid=${aid} err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        await this._persistIdentity(identity);
-        this._aid = identity.aid;
-        return { aid: identity.aid, cert: identity.cert };
     }
     /**
      * 认证已有 AID — login1/login2 双阶段流程。
+     *
+     * 优先复用 keystore 里的 cached access_token（未过期且有 refresh_token），
+     * 避免每次 authenticate 都走两阶段重登的网络往返。与 Python SDK 行为对齐。
      */
     async authenticate(gatewayUrl, aid) {
-        const identity = await this._loadIdentityOrRaise(aid);
-        if (!identity.cert) {
-            // 尝试下载恢复证书
-            try {
-                const recovered = await this._recoverCertViaDownload(gatewayUrl, identity);
-                Object.assign(identity, recovered);
-                await this._persistIdentity(identity);
+        const tStart = Date.now();
+        this._log.debug(`authenticate enter: aid=${aid ?? '<current>'} gateway=${gatewayUrl}`);
+        try {
+            const identity = await this._loadIdentityOrRaise(aid);
+            // 优先复用 cached access_token（未过期且有 refresh_token）
+            // 避免每次调 authenticate 都走两阶段重登
+            // 注意：_loadIdentityOrRaise 直接走 keystore.loadIdentity，不包含 instance_state
+            // （IndexedDB 把 access_token / refresh_token / expires_at 拆到 STORE_INSTANCE_STATE）
+            // 这里需要主动 _loadInstanceState 拿到 token，否则永远走 _login。
+            const instanceState = await this._loadInstanceState(identity.aid);
+            const identityWithState = instanceState
+                ? { ...identity, ...instanceState }
+                : identity;
+            const cachedToken = this._getCachedAccessToken(identityWithState);
+            const cachedRefresh = String(identityWithState.refresh_token ?? '');
+            if (cachedToken && cachedRefresh) {
+                this._log.debug(`authenticate reusing cached token: aid=${identity.aid} expires_at=${identityWithState.access_token_expires_at}`);
+                this._aid = identity.aid;
+                return {
+                    aid: identity.aid,
+                    access_token: cachedToken,
+                    refresh_token: cachedRefresh,
+                    expires_at: identityWithState.access_token_expires_at,
+                    gateway: gatewayUrl,
+                };
             }
-            catch (e) {
-                throw new StateError(`local certificate missing and recovery failed: ${e}. ` +
-                    `Run auth.createAid() to register a new identity.`);
+            if (!identity.cert) {
+                // 尝试下载恢复证书
+                try {
+                    const recovered = await this._recoverCertViaDownload(gatewayUrl, identity);
+                    Object.assign(identity, recovered);
+                    await this._persistIdentity(identity);
+                }
+                catch (e) {
+                    throw new StateError(`local certificate missing and recovery failed: ${e}. ` +
+                        `Run auth.createAid() to register a new identity.`);
+                }
             }
-        }
-        let login;
-        try {
-            login = await this._login(gatewayUrl, identity);
-        }
-        catch (e) {
-            // 证书未在服务端注册或公钥不匹配 — 自动重新注册
-            if (e instanceof AuthError && (String(e.message).includes('not registered') || String(e.message).includes('public key mismatch'))) {
-                console.warn(`[auth] 证书未在服务端注册，自动重新注册: aid=${identity.aid}`);
-                const created = await this._createAid(gatewayUrl, identity);
-                identity.cert = created.cert;
-                await this._persistIdentity(identity);
+            let login;
+            try {
                 login = await this._login(gatewayUrl, identity);
             }
-            else {
-                throw e;
+            catch (e) {
+                // 证书未在服务端注册或公钥不匹配 — 自动重新注册
+                if (e instanceof AuthError && (String(e.message).includes('not registered') || String(e.message).includes('public key mismatch'))) {
+                    this._log.warn(`[auth] cert not registered on server, auto re-register: aid=${identity.aid}`);
+                    const created = await this._createAid(gatewayUrl, identity);
+                    identity.cert = created.cert;
+                    await this._persistIdentity(identity);
+                    login = await this._login(gatewayUrl, identity);
+                }
+                else {
+                    throw e;
+                }
             }
+            this._rememberTokens(identity, login);
+            await this._validateNewCert(identity, gatewayUrl);
+            await this._persistIdentity(identity);
+            this._aid = identity.aid;
+            this._log.debug(`authenticate exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}`);
+            return {
+                aid: identity.aid,
+                access_token: identity.access_token,
+                refresh_token: identity.refresh_token,
+                expires_at: identity.access_token_expires_at,
+                gateway: gatewayUrl,
+            };
+        }
+        catch (err) {
+            this._log.debug(`authenticate exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        this._rememberTokens(identity, login);
-        await this._validateNewCert(identity, gatewayUrl);
-        await this._persistIdentity(identity);
-        this._aid = identity.aid;
-        return {
-            aid: identity.aid,
-            access_token: identity.access_token,
-            refresh_token: identity.refresh_token,
-            expires_at: identity.access_token_expires_at,
-            gateway: gatewayUrl,
-        };
     }
     /**
      * 确保已认证（如无身份则先注册再登录）。
      */
     async ensureAuthenticated(gatewayUrl) {
-        const identity = await this._ensureIdentity();
-        if (!identity.cert) {
-            const created = await this._createAid(gatewayUrl, identity);
-            Object.assign(identity, created);
+        const tStart = Date.now();
+        this._log.debug(`ensureAuthenticated enter: gateway=${gatewayUrl}`);
+        try {
+            const identity = await this._ensureIdentity();
+            if (!identity.cert) {
+                const created = await this._createAid(gatewayUrl, identity);
+                Object.assign(identity, created);
+                await this._persistIdentity(identity);
+            }
+            const login = await this._login(gatewayUrl, identity);
+            this._rememberTokens(identity, login);
+            await this._validateNewCert(identity, gatewayUrl);
             await this._persistIdentity(identity);
+            const token = (identity.access_token || identity.token || identity.kite_token);
+            if (!token)
+                throw new AuthError('login2 did not return access token');
+            this._log.debug(`ensureAuthenticated exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}`);
+            return { token, identity };
+        }
+        catch (err) {
+            this._log.debug(`ensureAuthenticated exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        const login = await this._login(gatewayUrl, identity);
-        this._rememberTokens(identity, login);
-        await this._validateNewCert(identity, gatewayUrl);
-        await this._persistIdentity(identity);
-        const token = (identity.access_token || identity.token || identity.kite_token);
-        if (!token)
-            throw new AuthError('login2 did not return access token');
-        return { token, identity };
     }
     /**
      * 使用已有 token 初始化 WebSocket 会话。
      */
     async initializeWithToken(transport, challenge, accessToken, opts) {
-        const params = isJsonObject(challenge?.params) ? challenge.params : {};
-        const nonce = String(params.nonce ?? '');
-        if (!nonce)
-            throw new AuthError('gateway challenge missing nonce');
-        this.setInstanceContext({
-            deviceId: String(opts?.deviceId ?? this._deviceId ?? ''),
-            slotId: String(opts?.slotId ?? this._slotId ?? ''),
-        });
-        await this._initializeSession(transport, nonce, accessToken, {
-            deviceId: String(opts?.deviceId ?? this._deviceId ?? ''),
-            slotId: String(opts?.slotId ?? this._slotId ?? ''),
-            deliveryMode: opts?.deliveryMode ?? null,
-        });
+        const tStart = Date.now();
+        this._log.debug(`initializeWithToken enter: device_id=${opts?.deviceId ?? this._deviceId} slot_id=${opts?.slotId ?? this._slotId}`);
+        try {
+            const params = isJsonObject(challenge?.params) ? challenge.params : {};
+            const nonce = String(params.nonce ?? '');
+            if (!nonce)
+                throw new AuthError('gateway challenge missing nonce');
+            this.setInstanceContext({
+                deviceId: String(opts?.deviceId ?? this._deviceId ?? ''),
+                slotId: String(opts?.slotId ?? this._slotId ?? ''),
+            });
+            await this._initializeSession(transport, nonce, accessToken, {
+                deviceId: String(opts?.deviceId ?? this._deviceId ?? ''),
+                slotId: String(opts?.slotId ?? this._slotId ?? ''),
+                deliveryMode: opts?.deliveryMode ?? null,
+                connectionKind: opts?.connectionKind ?? 'long',
+                shortTtlMs: opts?.shortTtlMs ?? 0,
+                extraInfo: opts?.extraInfo,
+            });
+            this._log.debug(`initializeWithToken exit: elapsed=${Date.now() - tStart}ms`);
+        }
+        catch (err) {
+            this._log.debug(`initializeWithToken exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
     }
     /**
      * 连接会话 — 多策略认证：显式 token → 缓存 token → refresh → 重新登录。
      */
     async connectSession(transport, challenge, gatewayUrl, accessToken) {
-        const params = isJsonObject(challenge?.params) ? challenge.params : {};
-        const nonce = String(params.nonce ?? '');
-        if (!nonce)
-            throw new AuthError('gateway challenge missing nonce');
-        const connectOptions = isJsonObject(accessToken)
-            ? accessToken
-            : { accessToken };
-        const deviceId = String(connectOptions.deviceId ?? this._deviceId ?? '');
-        const slotId = String(connectOptions.slotId ?? this._slotId ?? '');
-        const deliveryMode = connectOptions.deliveryMode ?? null;
-        this.setInstanceContext({ deviceId, slotId });
-        let identity;
+        const tStart = Date.now();
+        const explicitTokenInput = isJsonObject(accessToken) ? !!accessToken.accessToken : !!accessToken;
+        this._log.debug(`connectSession enter: gateway=${gatewayUrl} has_explicit_token=${explicitTokenInput}`);
         try {
-            identity = await this.loadIdentity();
-        }
-        catch {
-            identity = null;
-        }
-        // 策略 1: 显式 token
-        const explicitToken = String(connectOptions.accessToken ?? '');
-        if (explicitToken && identity !== null) {
+            const params = isJsonObject(challenge?.params) ? challenge.params : {};
+            const nonce = String(params.nonce ?? '');
+            if (!nonce)
+                throw new AuthError('gateway challenge missing nonce');
+            const connectOptions = (isJsonObject(accessToken)
+                ? accessToken
+                : { accessToken });
+            const deviceId = String(connectOptions.deviceId ?? this._deviceId ?? '');
+            const slotId = String(connectOptions.slotId ?? this._slotId ?? '');
+            const deliveryMode = connectOptions.deliveryMode ?? null;
+            const connectionKind = connectOptions.connectionKind ?? 'long';
+            const shortTtlMs = connectOptions.shortTtlMs ?? 0;
+            const extraInfo = connectOptions.extraInfo;
+            this.setInstanceContext({ deviceId, slotId });
+            let identity;
             try {
-                await this._initializeSession(transport, nonce, explicitToken, {
-                    deviceId,
-                    slotId,
-                    deliveryMode,
-                });
-                identity.access_token = explicitToken;
-                await this._persistIdentity(identity);
-                return { token: explicitToken, identity };
+                identity = await this.loadIdentity();
             }
-            catch (e) {
-                if (!(e instanceof AuthError))
-                    throw e;
-                // 显式 token 失败，继续尝试其他方式
+            catch {
+                identity = null;
             }
-        }
-        // 无本地身份 — 先注册 + 登录
-        if (identity === null) {
-            const authContext = await this.ensureAuthenticated(gatewayUrl);
-            const token = authContext.token;
-            await this._initializeSession(transport, nonce, token, {
-                deviceId,
-                slotId,
-                deliveryMode,
-            });
-            return authContext;
-        }
-        // 策略 2: 缓存 token
-        const cachedToken = this._getCachedAccessToken(identity);
-        if (cachedToken) {
-            try {
-                await this._initializeSession(transport, nonce, cachedToken, {
+            // 策略 1: 显式 token
+            const explicitToken = String(connectOptions.accessToken ?? '');
+            if (explicitToken && identity !== null) {
+                try {
+                    await this._initializeSession(transport, nonce, explicitToken, {
+                        deviceId,
+                        slotId,
+                        deliveryMode,
+                        connectionKind,
+                        shortTtlMs,
+                        extraInfo,
+                    });
+                    identity.access_token = explicitToken;
+                    await this._persistIdentity(identity);
+                    this._log.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=explicit_token aid=${identity.aid}`);
+                    return { token: explicitToken, identity };
+                }
+                catch (e) {
+                    if (!(e instanceof AuthError))
+                        throw e;
+                    // 显式 token 失败，继续尝试其他方式
+                }
+            }
+            // 无本地身份 — 先注册 + 登录
+            if (identity === null) {
+                const authContext = await this.ensureAuthenticated(gatewayUrl);
+                const token = authContext.token;
+                await this._initializeSession(transport, nonce, token, {
                     deviceId,
                     slotId,
                     deliveryMode,
+                    connectionKind,
+                    shortTtlMs,
+                    extraInfo,
                 });
-                return { token: cachedToken, identity };
-            }
-            catch (e) {
-                if (!(e instanceof AuthError))
-                    throw e;
-                // 缓存 token 失败，尝试刷新
+                this._log.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=ensure_authenticated`);
+                return authContext;
             }
-        }
-        // 策略 3: refresh token
-        const refreshToken = String(identity.refresh_token ?? '');
-        if (refreshToken) {
-            try {
-                identity = await this.refreshCachedTokens(gatewayUrl, identity);
-                const refreshedToken = this._getCachedAccessToken(identity);
-                if (refreshedToken) {
-                    await this._initializeSession(transport, nonce, refreshedToken, {
+            // 策略 2: 缓存 token
+            const cachedToken = this._getCachedAccessToken(identity);
+            if (cachedToken) {
+                try {
+                    await this._initializeSession(transport, nonce, cachedToken, {
                         deviceId,
                         slotId,
                         deliveryMode,
+                        connectionKind,
+                        shortTtlMs,
+                        extraInfo,
                     });
-                    return { token: refreshedToken, identity };
+                    this._log.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=cached_token aid=${identity.aid}`);
+                    return { token: cachedToken, identity };
+                }
+                catch (e) {
+                    if (!(e instanceof AuthError))
+                        throw e;
+                    // 缓存 token 失败，尝试刷新
                 }
             }
-            catch (e) {
-                if (!(e instanceof AuthError))
-                    throw e;
-                // refresh 失败，重新登录
+            // 策略 3: refresh token
+            const refreshToken = String(identity.refresh_token ?? '');
+            if (refreshToken) {
+                try {
+                    identity = await this.refreshCachedTokens(gatewayUrl, identity);
+                    const refreshedToken = this._getCachedAccessToken(identity);
+                    if (refreshedToken) {
+                        await this._initializeSession(transport, nonce, refreshedToken, {
+                            deviceId,
+                            slotId,
+                            deliveryMode,
+                            connectionKind,
+                            shortTtlMs,
+                            extraInfo,
+                        });
+                        this._log.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=refresh aid=${identity.aid}`);
+                        return { token: refreshedToken, identity };
+                    }
+                }
+                catch (e) {
+                    if (!(e instanceof AuthError))
+                        throw e;
+                    // refresh 失败，重新登录
+                }
             }
+            // 策略 4: 重新登录
+            const login = await this.authenticate(gatewayUrl, identity.aid);
+            const token = String(login.access_token ?? '');
+            if (!token)
+                throw new AuthError('authenticate did not return access_token');
+            await this._initializeSession(transport, nonce, token, {
+                deviceId,
+                slotId,
+                deliveryMode,
+                connectionKind,
+                shortTtlMs,
+                extraInfo,
+            });
+            identity = await this.loadIdentity(identity.aid);
+            this._log.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=re_login aid=${identity.aid}`);
+            return { token, identity };
+        }
+        catch (err) {
+            this._log.debug(`connectSession exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        // 策略 4: 重新登录
-        const login = await this.authenticate(gatewayUrl, identity.aid);
-        const token = String(login.access_token ?? '');
-        if (!token)
-            throw new AuthError('authenticate did not return access_token');
-        await this._initializeSession(transport, nonce, token, {
-            deviceId,
-            slotId,
-            deliveryMode,
-        });
-        identity = await this.loadIdentity(identity.aid);
-        return { token, identity };
     }
     /**
      * 刷新 token。
      */
     async refreshCachedTokens(gatewayUrl, identity) {
-        const refreshToken = String(identity.refresh_token ?? '');
-        if (!refreshToken)
-            throw new AuthError('missing refresh_token');
-        const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken);
-        this._rememberTokens(identity, refreshed);
-        await this._validateNewCert(identity, gatewayUrl);
-        await this._persistIdentity(identity);
-        return identity;
+        const tStart = Date.now();
+        this._log.debug(`refreshCachedTokens enter: aid=${identity.aid} gateway=${gatewayUrl}`);
+        try {
+            const refreshToken = String(identity.refresh_token ?? '');
+            if (!refreshToken)
+                throw new AuthError('missing refresh_token');
+            const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken);
+            this._rememberTokens(identity, refreshed);
+            await this._validateNewCert(identity, gatewayUrl);
+            await this._persistIdentity(identity);
+            this._log.debug(`refreshCachedTokens exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}`);
+            return identity;
+        }
+        catch (err) {
+            this._log.debug(`refreshCachedTokens exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
     }
     /**
      * 统一的对端证书验证入口：时间有效性 + 链验证 + CRL + OCSP + AID 绑定。
      */
     async verifyPeerCertificate(gatewayUrl, certPem, expectedAid) {
-        const cert = parseCertDer(certPem);
-        const now = Date.now() / 1000;
-        ensureCertTimeValid(cert, 'peer certificate', now);
-        await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid);
+        const tStart = Date.now();
+        this._log.debug(`verifyPeerCertificate enter: aid=${expectedAid} gateway=${gatewayUrl}`);
         try {
-            await this._verifyAuthCertRevocation(gatewayUrl, cert, expectedAid);
-        }
-        catch (e) {
-            const errMsg = e instanceof Error ? e.message : String(e);
-            if (/revoked/i.test(errMsg))
-                throw e instanceof AuthError ? e : new AuthError(errMsg);
-            console.warn('[aun_core.auth] CRL 检查不可用，降级继续:', errMsg);
-        }
-        try {
-            await this._verifyAuthCertOcsp(gatewayUrl, cert, expectedAid);
-        }
-        catch (e) {
-            const errMsg = e instanceof Error ? e.message : String(e);
-            if (/revoked/i.test(errMsg))
-                throw e instanceof AuthError ? e : new AuthError(errMsg);
-            console.warn('[aun_core.auth] OCSP 检查不可用，降级继续:', errMsg);
+            const cert = parseCertDer(certPem);
+            const now = Date.now() / 1000;
+            ensureCertTimeValid(cert, 'peer certificate', now);
+            await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid);
+            try {
+                await this._verifyAuthCertRevocation(gatewayUrl, cert, expectedAid);
+            }
+            catch (e) {
+                const errMsg = e instanceof Error ? e.message : String(e);
+                if (/revoked/i.test(errMsg))
+                    throw e instanceof AuthError ? e : new AuthError(errMsg);
+                this._log.warn('[aun_core.auth] CRL check unavailable, degrade and continue:', errMsg);
+            }
+            try {
+                await this._verifyAuthCertOcsp(gatewayUrl, cert, expectedAid);
+            }
+            catch (e) {
+                const errMsg = e instanceof Error ? e.message : String(e);
+                if (/revoked/i.test(errMsg))
+                    throw e instanceof AuthError ? e : new AuthError(errMsg);
+                this._log.warn('[aun_core.auth] OCSP check unavailable, degrade and continue:', errMsg);
+            }
+            if (cert.subjectCN !== expectedAid) {
+                throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}, got ${cert.subjectCN || 'none'}`);
+            }
+            this._log.debug(`verifyPeerCertificate exit: elapsed=${Date.now() - tStart}ms aid=${expectedAid}`);
         }
-        if (cert.subjectCN !== expectedAid) {
-            throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}, got ${cert.subjectCN || 'none'}`);
+        catch (err) {
+            this._log.debug(`verifyPeerCertificate exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
     }
     // ── 内部方法：短连接 RPC ──────────────────────────
@@ -850,7 +978,9 @@ export class AuthFlow {
     }
     /** 初始化 WebSocket 会话（auth.connect RPC） */
     async _initializeSession(transport, nonce, token, opts) {
-        const result = await transport.call('auth.connect', {
+        const connectionKind = opts?.connectionKind ?? 'long';
+        const shortTtlMs = opts?.shortTtlMs ?? 0;
+        const request = {
             nonce,
             auth: { method: 'kite_token', token },
             protocol: { min: '1.0', max: '1.0' },
@@ -858,7 +988,22 @@ export class AuthFlow {
             client: { slot_id: String(opts?.slotId ?? this._slotId ?? '') },
             delivery_mode: opts?.deliveryMode ?? { mode: 'fanout' },
             capabilities: { e2ee: true, group_e2ee: true },
-        });
+        };
+        // 长短连接选项：默认 long 时不写入 options（保持 wire 兼容）
+        if (connectionKind === 'short') {
+            const options = { kind: 'short' };
+            if (shortTtlMs > 0) {
+                options.short_ttl_ms = shortTtlMs;
+            }
+            request.options = options;
+        }
+        // extra_info：应用层自定义信息（PID/HOME/备注等），踢人时透传给被踢方
+        const extraInfo = opts?.extraInfo;
+        if (extraInfo && Object.keys(extraInfo).length > 0) {
+            request.extra_info = extraInfo;
+        }
+        this._log.debug(`auth.connect send: device_id=${opts?.deviceId ?? ''} slot_id=${opts?.slotId ?? ''} kind=${connectionKind}`);
+        const result = await transport.call('auth.connect', request);
         const status = isJsonObject(result) ? result.status : undefined;
         if (status !== 'ok') {
             throw new AuthError(`initialize failed: ${JSON.stringify(result)}`);
@@ -889,7 +1034,7 @@ export class AuthFlow {
             const errMsg = e instanceof Error ? e.message : String(e);
             if (/revoked/i.test(errMsg))
                 throw e instanceof AuthError ? e : new AuthError(errMsg);
-            console.warn('[aun_core.auth] CRL 检查不可用，降级继续:', errMsg);
+            this._log.warn('[aun_core.auth] CRL check unavailable, degrade and continue:', errMsg);
         }
         // 验证 OCSP
         try {
@@ -899,7 +1044,7 @@ export class AuthFlow {
             const errMsg = e instanceof Error ? e.message : String(e);
             if (/revoked/i.test(errMsg))
                 throw e instanceof AuthError ? e : new AuthError(errMsg);
-            console.warn('[aun_core.auth] OCSP 检查不可用，降级继续:', errMsg);
+            this._log.warn('[aun_core.auth] OCSP check unavailable, degrade and continue:', errMsg);
         }
         // 验证 client_nonce 签名
         try {
@@ -1224,7 +1369,7 @@ export class AuthFlow {
                     const errMsg = e instanceof Error ? e.message : String(e);
                     if (/revoked/i.test(errMsg))
                         throw e instanceof AuthError ? e : new AuthError(errMsg);
-                    console.warn('[aun_core.auth] CRL 检查不可用，降级继续:', errMsg);
+                    this._log.warn('[aun_core.auth] CRL check unavailable, degrade and continue:', errMsg);
                 }
                 try {
                     await this._verifyAuthCertOcsp(gatewayUrl, cert);
@@ -1233,7 +1378,7 @@ export class AuthFlow {
                     const errMsg = e instanceof Error ? e.message : String(e);
                     if (/revoked/i.test(errMsg))
                         throw e instanceof AuthError ? e : new AuthError(errMsg);
-                    console.warn('[aun_core.auth] OCSP 检查不可用，降级继续:', errMsg);
+                    this._log.warn('[aun_core.auth] OCSP check unavailable, degrade and continue:', errMsg);
                 }
             }
             // 验证通过，正式接受
@@ -1241,7 +1386,7 @@ export class AuthFlow {
         }
         catch (e) {
             // 验证失败，静默拒绝（不影响主流程）
-            console.warn(`拒绝服务端返回的 new_cert (${identity.aid}):`, e);
+            this._log.warn(`reject server-returned new_cert (${identity.aid}):`, e);
         }
         // active_cert 同步：验证公钥匹配后更新本地 cert
         const activeCertPem = identity._pending_active_cert;
@@ -1256,12 +1401,12 @@ export class AuthFlow {
                         identity.cert = activeCertPem;
                     }
                     else {
-                        console.warn(`[auth] 服务端 active_cert 公钥与本地私钥不匹配，拒绝同步 (aid=${identity.aid})`);
+                        this._log.warn(`[auth] active_cert public key mismatches local private key, reject sync (aid=${identity.aid})`);
                     }
                 }
             }
             catch (e) {
-                console.warn(`[auth] active_cert 同步异常 (${identity.aid}):`, e);
+                this._log.warn(`[auth] active_cert sync exception (${identity.aid}):`, e);
             }
         }
     }
@@ -1291,13 +1436,23 @@ export class AuthFlow {
     /** 确保本地有密钥对（没有则生成） */
     async _ensureLocalIdentity(aid) {
         const existing = await this._keystore.loadIdentity(aid);
-        if (existing) {
+        // 必须确认有 keypair（private_key_pem + public_key_der_b64）才算"已存在"
+        // 否则 keystore 可能只有 metadata（如 gateway_url）但没有真正的密钥材料
+        if (existing && existing.private_key_pem && existing.public_key_der_b64) {
             this._aid = aid;
             return existing;
         }
         const identity = await this._crypto.generateIdentity();
         identity.aid = aid;
-        await this._persistIdentity(identity);
+        // 保留 keystore 已有的 metadata（如 gateway_url），避免覆盖
+        if (existing) {
+            for (const [k, v] of Object.entries(existing)) {
+                if (k !== 'aid' && !(k in identity)) {
+                    identity[k] = v;
+                }
+            }
+        }
+        await this._persistIdentity(identity); // 立即持久化 keypair，避免服务端拒绝后丢失
         this._aid = aid;
         return identity;
     }