@agentunion/fastaun-browser 0.4.11 → 0.4.13

package/dist/bundle.js

@@ -454,7 +454,7 @@ var init_indexeddb_store = __esm({
 });
 
 // src/version.ts
-var VERSION = "0.4.11";
+var VERSION = "0.4.13";
 
 // src/types.ts
 var ConnectionState = /* @__PURE__ */ ((ConnectionState2) => {
@@ -1838,6 +1838,31 @@ var _noopLog4 = { error: () => {
 }, debug: () => {
 } };
 var AUN_SDK_LANG = "javascript";
+var SENSITIVE_RPC_LOG_KEYS = /* @__PURE__ */ new Set([
+  "access_token",
+  "refresh_token",
+  "kite_token",
+  "token"
+]);
+function redactRpcLogPayload(value, key = "", depth = 0) {
+  const keyLower = key.toLowerCase();
+  if (SENSITIVE_RPC_LOG_KEYS.has(keyLower) || keyLower.endsWith("_token")) {
+    const text = String(value ?? "");
+    return text ? `<redacted len=${text.length}>` : "";
+  }
+  if (depth >= 6) return "<max-depth>";
+  if (Array.isArray(value)) {
+    return value.map((item) => redactRpcLogPayload(item, "", depth + 1));
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+      out[childKey] = redactRpcLogPayload(childValue, childKey, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
 function splitPemBundle(bundle) {
   const marker = "-----END CERTIFICATE-----";
   const certs = [];
@@ -2401,6 +2426,9 @@ var _AuthFlow = class _AuthFlow {
           }
         } catch (e) {
           if (!(e instanceof AuthError)) throw e;
+          if (this._refreshFailureRequiresRelogin(e)) {
+            await this._clearCachedTokens(identity, e.message);
+          }
         }
       }
       const login = await this.authenticate(gatewayUrl, identity.aid);
@@ -2430,14 +2458,20 @@ var _AuthFlow = class _AuthFlow {
     this._log.debug(`refreshCachedTokens enter: aid=${identity.aid} gateway=${gatewayUrl}`);
     try {
       const refreshToken = String(identity.refresh_token ?? "");
-      if (!refreshToken) throw new AuthError("missing refresh_token");
-      const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken);
+      if (!refreshToken) {
+        await this._clearCachedTokens(identity, "missing refresh_token");
+        throw new AuthError("missing refresh_token");
+      }
+      const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken, identity);
       this._rememberTokens(identity, refreshed);
       await this._validateNewCert(identity, gatewayUrl);
       await this._persistIdentity(identity);
       this._log.debug(`refreshCachedTokens exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}`);
       return identity;
     } catch (err) {
+      if (this._refreshFailureRequiresRelogin(err)) {
+        await this._clearCachedTokens(identity, err instanceof Error ? err.message : String(err));
+      }
       this._log.debug(`refreshCachedTokens exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
       throw err;
     }
@@ -2518,12 +2552,12 @@ var _AuthFlow = class _AuthFlow {
               method,
               params
             });
-            this._log.debug(`short RPC request full: ${requestPayload}`);
+            this._log.debug(`short RPC request full: ${JSON.stringify(redactRpcLogPayload(JSON.parse(requestPayload)))}`);
             ws.send(requestPayload);
             return;
           }
           globalThis.clearTimeout(timeout);
-          this._log.debug(`short RPC response full: method=${method} ${JSON.stringify(msg)}`);
+          this._log.debug(`short RPC response full: method=${method} ${JSON.stringify(redactRpcLogPayload(msg))}`);
           try {
             ws.close();
           } catch {
@@ -2538,7 +2572,7 @@ var _AuthFlow = class _AuthFlow {
             return;
           }
           if (result.success === false) {
-            reject(new AuthError(String(result.error ?? `${method} failed`)));
+            reject(new AuthError(String(result.error ?? `${method} failed`), { data: result }));
             return;
           }
           resolve(result);
@@ -2674,12 +2708,28 @@ var _AuthFlow = class _AuthFlow {
     return phase2;
   }
   /** 刷新 access token */
-  async _refreshAccessToken(gatewayUrl, refreshToken) {
-    const result = await this._shortRpc(gatewayUrl, "auth.refresh_token", {
-      refresh_token: refreshToken
-    });
+  async _refreshAccessToken(gatewayUrl, refreshToken, identity) {
+    const params = {
+      refresh_token: refreshToken,
+      sdk_lang: AUN_SDK_LANG,
+      sdk_version: VERSION
+    };
+    if (identity) {
+      const aid = String(identity.aid ?? "").trim();
+      const deviceId = String(identity.device_id ?? "").trim();
+      const slotId = String(identity.slot_id ?? "").trim();
+      const accessToken = String(identity.access_token ?? "").trim();
+      if (aid) params.aid = aid;
+      if (deviceId) params.device_id = deviceId;
+      if (slotId) params.slot_id = slotId;
+      if (accessToken) params.access_token = accessToken;
+      if (typeof identity.access_token_expires_at === "number") {
+        params.access_token_expires_at = identity.access_token_expires_at;
+      }
+    }
+    const result = await this._shortRpc(gatewayUrl, "auth.refresh_token", params);
     if (!result.success) {
-      throw new AuthError(String(result.error ?? "refresh failed"));
+      throw new AuthError(String(result.error ?? "refresh failed"), { data: result });
     }
     return result;
   }
@@ -3012,6 +3062,35 @@ var _AuthFlow = class _AuthFlow {
     const activeCert = authResult.active_cert;
     if (typeof activeCert === "string" && activeCert) identity._pending_active_cert = activeCert;
   }
+  _refreshFailureRequiresRelogin(err) {
+    if (!(err instanceof AuthError)) return false;
+    const data = err.data;
+    if (isJsonObject(data)) {
+      if (data.relogin_required === true) return true;
+      const error = String(data.error ?? "").trim().toLowerCase();
+      return ["missing refresh_token", "invalid_or_expired_refresh_token", "refresh not supported"].includes(error);
+    }
+    const message = err.message.trim().toLowerCase();
+    return ["missing refresh_token", "invalid_or_expired_refresh_token", "refresh not supported"].includes(message);
+  }
+  async _clearCachedTokens(identity, reason = "") {
+    const aid = String(identity.aid ?? "");
+    const hadToken = Boolean(
+      identity.access_token || identity.refresh_token || identity.kite_token || identity.token || identity.access_token_expires_at
+    );
+    if (!hadToken) return;
+    identity.access_token = "";
+    identity.refresh_token = "";
+    identity.kite_token = "";
+    identity.token = "";
+    identity.access_token_expires_at = 0;
+    try {
+      await this._persistIdentity(identity);
+      this._log.warn(`cleared cached tokens after refresh failure: aid=${aid} reason=${reason}`);
+    } catch (persistErr) {
+      this._log.warn(`failed to persist token cleanup: aid=${aid} err=${persistErr instanceof Error ? persistErr.message : String(persistErr)}`);
+    }
+  }
   /** 验证服务端返回的 new_cert，通过后正式接受 */
   async _validateNewCert(identity, gatewayUrl = "") {
     const newCertPem = identity._pending_new_cert;
@@ -3710,6 +3789,52 @@ var ClientRuntime = class {
 var PUSHED_SEQS_LIMIT = 5e4;
 var PENDING_ORDERED_LIMIT = 5e4;
 var GROUP_RECALL_SEEN_LIMIT = 1e4;
+var APP_MESSAGE_ENVELOPE_KEYS = [
+  "module_id",
+  "message_type",
+  "type",
+  "kind",
+  "version",
+  "from",
+  "from_aid",
+  "sender_aid",
+  "to",
+  "to_aid",
+  "group_id",
+  "timestamp",
+  "created_at",
+  "encrypted",
+  "context",
+  "protected_headers",
+  "headers",
+  "payload_type"
+];
+var APP_SEND_ENVELOPE_METHODS = /* @__PURE__ */ new Set([
+  "message.send",
+  "group.send",
+  "message.thought.put",
+  "group.thought.put"
+]);
+var APP_GROUP_EVENT_ENVELOPE_KEYS = [
+  "module_id",
+  "event_id",
+  "event_seq",
+  "seq",
+  "event_type",
+  "action",
+  "group_id",
+  "actor_aid",
+  "sender_aid",
+  "member_aid",
+  "target_aid",
+  "operator_aid",
+  "created_at",
+  "timestamp",
+  "t_server",
+  "status",
+  "device_id",
+  "slot_id"
+];
 function formatDeliveryError(error) {
   return error instanceof Error ? error : String(error);
 }
@@ -3792,8 +3917,131 @@ var MessageDeliveryEngine = class {
     return result;
   }
   normalizePublishedMessagePayload(event, payload) {
-    if (!this.isInstanceScopedMessageEvent(event)) return payload;
-    return this.stripInternalSenderDeviceFields(this.attachCurrentInstanceContext(payload));
+    if (this.isInstanceScopedMessageEvent(event)) {
+      return this.attachAppMessageEnvelope(this.stripInternalSenderDeviceFields(this.attachCurrentInstanceContext(payload)));
+    }
+    if (this.isGroupScopedEvent(event)) {
+      return this.attachAppGroupEventEnvelope(this.attachCurrentInstanceContext(payload));
+    }
+    return payload;
+  }
+  envelopeMetadata(value) {
+    let source = value;
+    if (source && typeof source === "object") {
+      const maybeHeaders = source;
+      if (typeof maybeHeaders.toObject === "function") source = maybeHeaders.toObject();
+    }
+    if (!isJsonObject(source)) return void 0;
+    const out = {};
+    for (const [key, item] of Object.entries(source)) {
+      if (key === "_auth") continue;
+      out[key] = item;
+    }
+    return Object.keys(out).length > 0 ? out : void 0;
+  }
+  appMessageEnvelope(payload) {
+    if (!isJsonObject(payload)) return {};
+    const message = payload;
+    const body = isJsonObject(message.payload) ? message.payload : {};
+    const envelope = {};
+    const firstValue = (...values) => {
+      for (const value of values) {
+        if (value === void 0 || value === null) continue;
+        if (typeof value === "string" && !value.trim()) continue;
+        return value;
+      }
+      return void 0;
+    };
+    const setIfPresent = (key, value) => {
+      if (value === void 0 || value === null) return;
+      if (typeof value === "string" && !value.trim()) return;
+      envelope[key] = value;
+    };
+    setIfPresent("from", firstValue(message.from, message.from_aid, message.sender_aid));
+    setIfPresent("to", firstValue(message.to, message.to_aid));
+    setIfPresent("group_id", message.group_id);
+    setIfPresent("type", firstValue(body.type, message.type, message.message_type, message.payload_type));
+    setIfPresent("kind", firstValue(body.kind, message.kind));
+    setIfPresent("version", firstValue(body.version, message.version));
+    setIfPresent("timestamp", firstValue(message.timestamp, message.created_at, message.t_server));
+    if ("encrypted" in message) envelope.encrypted = Boolean(message.encrypted);
+    const context = this.envelopeMetadata(message.context);
+    if (context) envelope.context = context;
+    const protectedHeaders = this.envelopeMetadata(message.protected_headers) ?? this.envelopeMetadata(message.headers);
+    if (protectedHeaders) envelope.protected_headers = protectedHeaders;
+    setIfPresent("payload_type", firstValue(message.payload_type, protectedHeaders?.payload_type));
+    return envelope;
+  }
+  isGroupScopedEvent(event) {
+    return event === "group.changed";
+  }
+  appGroupEventEnvelope(payload) {
+    if (!isJsonObject(payload)) return {};
+    const groupEvent = payload;
+    const envelope = {};
+    for (const key of APP_GROUP_EVENT_ENVELOPE_KEYS) {
+      if (Object.prototype.hasOwnProperty.call(groupEvent, key)) envelope[key] = groupEvent[key];
+    }
+    return envelope;
+  }
+  attachAppMessageEnvelope(payload) {
+    if (!isJsonObject(payload)) return payload;
+    const result = { ...payload };
+    result.envelope = this.appMessageEnvelope(result);
+    return result;
+  }
+  sendResultEnvelope(method, params, result, encrypted) {
+    if (!APP_SEND_ENVELOPE_METHODS.has(method)) return {};
+    const body = isJsonObject(params.payload) ? params.payload : {};
+    const resultObj = isJsonObject(result) ? result : {};
+    const envelope = {};
+    const firstValue = (...values) => {
+      for (const value of values) {
+        if (value === void 0 || value === null) continue;
+        if (typeof value === "string" && !value.trim()) continue;
+        return value;
+      }
+      return void 0;
+    };
+    const setIfPresent = (key, value) => {
+      if (value === void 0 || value === null) return;
+      if (typeof value === "string" && !value.trim()) return;
+      envelope[key] = value;
+    };
+    setIfPresent("from", this.runtime.client._aid);
+    if (method.startsWith("message.")) {
+      setIfPresent("to", params.to);
+    } else {
+      setIfPresent("group_id", params.group_id);
+    }
+    setIfPresent("type", firstValue(body.type, params.type, params.message_type, params.payload_type));
+    setIfPresent("kind", firstValue(body.kind, params.kind));
+    setIfPresent("version", firstValue(body.version, params.version));
+    setIfPresent("timestamp", firstValue(params.timestamp, resultObj.timestamp, resultObj.created_at, resultObj.t_server, Date.now()));
+    envelope.encrypted = Boolean(encrypted);
+    const context = this.envelopeMetadata(params.context);
+    if (context) envelope.context = context;
+    const protectedHeaders = this.envelopeMetadata(params.protected_headers) ?? this.envelopeMetadata(params.headers);
+    if (protectedHeaders) envelope.protected_headers = protectedHeaders;
+    setIfPresent("payload_type", firstValue(params.payload_type, protectedHeaders?.payload_type, body.type));
+    return envelope;
+  }
+  attachSendResultEnvelope(method, params, result, encrypted) {
+    if (!APP_SEND_ENVELOPE_METHODS.has(method) || !isJsonObject(result)) return result;
+    const out = { ...result };
+    out.envelope = this.sendResultEnvelope(method, params, out, encrypted);
+    if ("payload" in params) {
+      out.payload = params.payload;
+    } else if ("content" in params) {
+      out.payload = params.content;
+    }
+    return out;
+  }
+  attachAppGroupEventEnvelope(payload) {
+    if (!isJsonObject(payload)) return payload;
+    const result = { ...payload };
+    result.envelope = this.appGroupEventEnvelope(result);
+    return result;
   }
   stripInternalSenderDeviceFields(payload) {
     if (!isJsonObject(payload)) return payload;
@@ -3813,6 +4061,11 @@ var MessageDeliveryEngine = class {
     const payloadType = String(payload.type ?? payload.kind ?? "").trim();
     if (msgType !== "message.recalled" && payloadType !== "message.recalled") return null;
     const event = { ...payload };
+    for (const key of APP_MESSAGE_ENVELOPE_KEYS) {
+      if (Object.prototype.hasOwnProperty.call(msg, key) && !(key in event)) {
+        event[key] = msg[key];
+      }
+    }
     const rawIds = event.message_ids;
     let messageIds = Array.isArray(rawIds) ? rawIds.map((item) => String(item ?? "").trim()).filter(Boolean) : [];
     if (messageIds.length === 0) {
@@ -3831,7 +4084,10 @@ var MessageDeliveryEngine = class {
     if (!("to" in event)) event.to = msg.to ?? msg.to_aid ?? "";
     if (!("timestamp" in event)) event.timestamp = msg.timestamp ?? msg.t_server ?? event.recalled_at ?? 0;
     if ("seq" in msg && !("seq" in event)) event.seq = msg.seq;
-    if ("message_id" in msg && !("tombstone_message_id" in event)) event.tombstone_message_id = msg.message_id;
+    if ("message_id" in msg) {
+      event.message_id = msg.message_id;
+      if (!("tombstone_message_id" in event)) event.tombstone_message_id = msg.message_id;
+    }
     if ("device_id" in msg && !("device_id" in event)) event.device_id = msg.device_id;
     if ("slot_id" in msg && !("slot_id" in event)) event.slot_id = msg.slot_id;
     return event;
@@ -3850,6 +4106,11 @@ var MessageDeliveryEngine = class {
     const payloadType = String(payload.type ?? payload.kind ?? "").trim();
     if (msgType !== "group.message_recalled" && payloadType !== "group.message_recalled") return null;
     const event = { ...payload };
+    for (const key of APP_MESSAGE_ENVELOPE_KEYS) {
+      if (Object.prototype.hasOwnProperty.call(msg, key) && !(key in event)) {
+        event[key] = msg[key];
+      }
+    }
     const rawIds = event.message_ids;
     let messageIds = Array.isArray(rawIds) ? rawIds.map((item) => String(item ?? "").trim()).filter(Boolean) : [];
     if (messageIds.length === 0) {
@@ -3867,7 +4128,10 @@ var MessageDeliveryEngine = class {
     if (!("group_id" in event)) event.group_id = msg.group_id ?? "";
     if (!("timestamp" in event)) event.timestamp = msg.timestamp ?? msg.t_server ?? event.recalled_at ?? 0;
     if ("seq" in msg) event.seq = msg.seq;
-    if ("message_id" in msg && !("tombstone_message_id" in event)) event.tombstone_message_id = msg.message_id;
+    if ("message_id" in msg) {
+      event.message_id = msg.message_id;
+      if (!("tombstone_message_id" in event)) event.tombstone_message_id = msg.message_id;
+    }
     return event;
   }
   groupRecallDedupKey(groupId, payload) {
@@ -4357,6 +4621,14 @@ var MessageDeliveryEngine = class {
       return;
     }
     const ns = `group_event:${groupId}`;
+    if (this.isSelfJoinGroupChanged(data)) {
+      const contig = client._seqTracker.getContiguousSeq(ns);
+      const maxSeen = client._seqTracker.getMaxSeenSeq(ns);
+      if (contig === 0 && maxSeen === 0 && eventSeq > 1) {
+        client._clientLog.debug(`group.changed self-join baseline: group=${groupId}, event_seq=${eventSeq}, baseline=${eventSeq - 1}`);
+        client._seqTracker.forceContiguousSeq(ns, eventSeq - 1);
+      }
+    }
     const contigBefore = client._seqTracker.getContiguousSeq(ns);
     if (eventSeq <= contigBefore || client._pushedSeqs.get(ns)?.has(eventSeq)) {
       client._clientLog.debug(`group.changed skipped duplicate/stale: group=${groupId}, event_seq=${eventSeq}, contiguous=${contigBefore}`);
@@ -4382,6 +4654,16 @@ var MessageDeliveryEngine = class {
       client._safeAsync(this.fillGroupEventGap(groupId));
     }
   }
+  isSelfJoinGroupChanged(data) {
+    const action = String(data.action ?? "").trim();
+    if (!["member_added", "joined", "join_approved", "invite_code_used"].includes(action)) return false;
+    const selfAid = String(this.runtime.client._aid ?? "").trim();
+    if (!selfAid) return false;
+    const joinedAid = String(data.joined_aid ?? data.member_aid ?? data.aid ?? "").trim();
+    if (joinedAid === selfAid) return true;
+    const actorAid = String(data.actor_aid ?? "").trim();
+    return !joinedAid && ["joined", "invite_code_used"].includes(action) && actorAid === selfAid;
+  }
   enqueueOnlineUnreadHint(data) {
     const client = this.runtime.client;
     const groupId = String(data.group_id ?? "").trim();
@@ -5336,6 +5618,8 @@ var RpcPipeline = class {
   async callImpl(method, params) {
     const client = this.runtime.client;
     const p = this.preflight(method, params).params;
+    const skipSendResultEnvelope = Boolean(p._skip_send_result_envelope);
+    delete p._skip_send_result_envelope;
     if (method === "message.send") {
       const encrypt = p.encrypt !== void 0 ? p.encrypt : true;
       delete p.encrypt;
@@ -5399,12 +5683,12 @@ var RpcPipeline = class {
     const pullGateKey = this.pullGateKeyForCall(method, p);
     if (pullGateKey) {
       return await this.runPullSerialized(pullGateKey, async () => {
-        return await this.callImplInner(method, p);
+        return await this.callImplInner(method, p, skipSendResultEnvelope);
       });
     }
-    return await this.callImplInner(method, p);
+    return await this.callImplInner(method, p, skipSendResultEnvelope);
   }
-  async callImplInner(method, p) {
+  async callImplInner(method, p, skipSendResultEnvelope = false) {
     const client = this.runtime.client;
     if (method === "message.pull") {
       await client._ensureV2SessionReady("message.pull");
@@ -5452,6 +5736,14 @@ var RpcPipeline = class {
     const callTimeout = NON_IDEMPOTENT_METHODS.has(method) ? NON_IDEMPOTENT_TIMEOUT : void 0;
     let result = callTimeout ? await client._transport.call(method, p, callTimeout) : await client._transport.call(method, p);
     result = await this.postprocessResult(method, p, result);
+    if (!skipSendResultEnvelope) {
+      result = client._delivery.attachSendResultEnvelope(
+        method,
+        p,
+        result,
+        Boolean(p.encrypted)
+      );
+    }
     return result;
   }
   preflight(method, params) {
@@ -5482,7 +5774,8 @@ var RpcPipeline = class {
     if (!client._instanceProtectedHeaders || !PROTECTED_HEADERS_METHODS.has(method)) {
       return;
     }
-    const existing = isJsonObject(params.protected_headers) ? params.protected_headers : {};
+    const existingValue = params.protected_headers ?? params.headers;
+    const existing = isJsonObject(existingValue) ? existingValue : {};
     params.protected_headers = { ...client._instanceProtectedHeaders, ...existing };
   }
   normalizeOutboundMessagePayload(params, method = "") {
@@ -10513,17 +10806,34 @@ var V2E2EECoordinator = class {
       return client.call("message.send", {
         to: toAid,
         payload: envelope,
-        encrypt: false
+        encrypt: false,
+        _skip_send_result_envelope: true
       });
     };
     try {
-      return await attempt(true);
+      const result = await attempt(true);
+      return client._delivery.attachSendResultEnvelope("message.send", {
+        to: toAid,
+        payload,
+        message_id: opts?.messageId,
+        timestamp: opts?.timestamp,
+        protected_headers: opts?.protectedHeaders,
+        context: opts?.context
+      }, result, true);
     } catch (exc) {
       const excCode = exc?.code;
       if (V2_RETRYABLE_CODES.has(excCode)) {
         client._clientLog.debug(`V2 P2P speculative send rejected (code=${excCode}), refreshing bootstrap`);
         this.deleteBootstrapCacheEntry(toAid);
-        return attempt(false);
+        const result = await attempt(false);
+        return client._delivery.attachSendResultEnvelope("message.send", {
+          to: toAid,
+          payload,
+          message_id: opts?.messageId,
+          timestamp: opts?.timestamp,
+          protected_headers: opts?.protectedHeaders,
+          context: opts?.context
+        }, result, true);
       }
       throw exc;
     }
@@ -10690,7 +11000,14 @@ var V2E2EECoordinator = class {
           client._saveSeqTrackerState();
         }
       }
-      return result;
+      return client._delivery.attachSendResultEnvelope("group.send", {
+        group_id: gid,
+        payload,
+        message_id: opts?.messageId,
+        timestamp: opts?.timestamp,
+        protected_headers: opts?.protectedHeaders,
+        context: opts?.context
+      }, result, true);
     } catch (exc) {
       const excCode = exc?.code;
       if (V2_RETRYABLE_CODES.has(excCode)) {
@@ -10706,7 +11023,14 @@ var V2E2EECoordinator = class {
             client._saveSeqTrackerState();
           }
         }
-        return result;
+        return client._delivery.attachSendResultEnvelope("group.send", {
+          group_id: gid,
+          payload,
+          message_id: opts?.messageId,
+          timestamp: opts?.timestamp,
+          protected_headers: opts?.protectedHeaders,
+          context: opts?.context
+        }, result, true);
       }
       throw exc;
     }
@@ -10887,13 +11211,27 @@ var V2E2EECoordinator = class {
       return result;
     };
     try {
-      return await attempt(true);
+      const result = await attempt(true);
+      return client._delivery.attachSendResultEnvelope("message.thought.put", {
+        ...params,
+        to: toAid,
+        payload,
+        thought_id: thoughtId,
+        timestamp
+      }, result, true);
     } catch (exc) {
       const excCode = Number(exc?.code);
       if (V2_RETRYABLE_CODES.has(excCode)) {
         client._clientLog.debug(`V2 P2P thought put speculative rejected (code=${String(excCode)}), refreshing bootstrap`);
         this.deleteBootstrapCacheEntry(toAid);
-        return await attempt(false);
+        const result = await attempt(false);
+        return client._delivery.attachSendResultEnvelope("message.thought.put", {
+          ...params,
+          to: toAid,
+          payload,
+          thought_id: thoughtId,
+          timestamp
+        }, result, true);
       }
       throw exc;
     }
@@ -10943,13 +11281,27 @@ var V2E2EECoordinator = class {
       return result;
     };
     try {
-      return await attempt(true);
+      const result = await attempt(true);
+      return client._delivery.attachSendResultEnvelope("group.thought.put", {
+        ...params,
+        group_id: groupId,
+        payload,
+        thought_id: thoughtId,
+        timestamp
+      }, result, true);
     } catch (exc) {
       const excCode = Number(exc?.code);
       if (V2_RETRYABLE_CODES.has(excCode)) {
         client._clientLog.debug(`V2 group thought put speculative rejected (code=${String(excCode)}), refreshing bootstrap`);
         this.deleteBootstrapCacheEntry(`group:${groupId}`);
-        return await attempt(false);
+        const result = await attempt(false);
+        return client._delivery.attachSendResultEnvelope("group.thought.put", {
+          ...params,
+          group_id: groupId,
+          payload,
+          thought_id: thoughtId,
+          timestamp
+        }, result, true);
       }
       throw exc;
     }
@@ -15126,6 +15478,20 @@ function _v2ConcatBytes(...parts) {
 function formatCaughtError2(error) {
   return error instanceof Error ? error : String(error);
 }
+var RELOGIN_REFRESH_ERRORS = /* @__PURE__ */ new Set([
+  "missing refresh_token",
+  "invalid_or_expired_refresh_token",
+  "refresh not supported"
+]);
+function authErrorRequiresRelogin(error) {
+  const data = error.data;
+  if (isJsonObject(data)) {
+    if (data.relogin_required === true) return true;
+    const code = String(data.error ?? "").trim().toLowerCase();
+    if (RELOGIN_REFRESH_ERRORS.has(code)) return true;
+  }
+  return RELOGIN_REFRESH_ERRORS.has(error.message.trim().toLowerCase());
+}
 function v2E2eeMeta2(envelope) {
   const suite = String(envelope.suite ?? "");
   const modeSuite = String(envelope.suite ?? "unknown");
@@ -16540,16 +16906,28 @@ var _AUNClient = class _AUNClient {
           this._tokenRefreshFailures = 0;
         } catch (exc) {
           if (exc instanceof AuthError) {
+            if (authErrorRequiresRelogin(exc)) {
+              this._clientLog.warn(`token refresh requires relogin, stopping refresh loop and triggering reconnect: ${exc.message}`);
+              await this._dispatcher.publish("token.refresh_exhausted", {
+                aid: this._identity?.aid ?? null,
+                consecutive_failures: 1,
+                last_error: String(exc),
+                relogin_required: true
+              });
+              this._tokenRefreshFailures = 0;
+              await this._handleTransportDisconnect(new Error("token refresh relogin required, triggering reconnect"));
+              return;
+            }
             this._tokenRefreshFailures++;
             if (this._tokenRefreshFailures >= 3) {
-              this._clientLog.warn(`token refreshconsecutivefailed ${this._tokenRefreshFailures}  , stop refresh loop and trigger reconnect`);
-              this._dispatcher.publish("token.refresh_exhausted", {
+              this._clientLog.warn(`token refresh failed ${this._tokenRefreshFailures} consecutive times, stopping refresh loop and triggering reconnect`);
+              await this._dispatcher.publish("token.refresh_exhausted", {
                 aid: this._identity?.aid ?? null,
                 consecutive_failures: this._tokenRefreshFailures,
                 last_error: String(exc)
               });
               this._tokenRefreshFailures = 0;
-              this._handleTransportDisconnect(new Error("token refresh exhausted, triggering reconnect"));
+              await this._handleTransportDisconnect(new Error("token refresh exhausted, triggering reconnect"));
               return;
             }
             this._clientLog.warn(`token refresh failed (${this._tokenRefreshFailures}/3), next retry: ${String(exc)}`);
@@ -16684,6 +17062,21 @@ var _AUNClient = class _AUNClient {
         if (!this._sessionParams) {
           throw new StateError("missing connect params for reconnect");
         }
+        {
+          const identity = this._identity;
+          if (identity) {
+            const cachedToken = String(identity.access_token ?? "");
+            const expiresAt = this._auth.getAccessTokenExpiry(identity);
+            if (cachedToken && (expiresAt === null || expiresAt > Date.now() / 1e3 + 30)) {
+              this._sessionParams.access_token = cachedToken;
+            } else {
+              this._clientLog.debug(`reconnect: cached token expired or missing for aid=${this._aid ?? ""}, clearing to trigger re-login`);
+              this._sessionParams.access_token = "";
+            }
+          } else {
+            this._sessionParams.access_token = "";
+          }
+        }
         await this._connectOnce(this._sessionParams, true);
         this._lastError = null;
         this._lastErrorCode = null;
@@ -19249,6 +19642,8 @@ var ServiceProxyClient = class {
     const stats = { connection_mode: mode, connections: 0, registered: 0, handled_requests: 0, wakeup_count: 0 };
     try {
       if (mode === "persistent") {
+        const maxReconnectDelay = 6e4;
+        let _delay = Math.max(0, opts.reconnectDelaySeconds ?? 1) * 1e3;
         while (this._running) {
           try {
             await this._autoRegisterServicesWithGateway();
@@ -19261,10 +19656,21 @@ var ServiceProxyClient = class {
             stats.connections = Number(stats.connections) + 1;
             stats.registered = Number(result.registered ?? stats.registered);
             stats.handled_requests = Number(stats.handled_requests) + Number(result.handled_requests ?? 0);
+            _delay = Math.max(0, opts.reconnectDelaySeconds ?? 1) * 1e3;
           } catch (exc) {
             if (!this._running) break;
-            this._logWarn(`persistent tunnel reconnect scheduled after error: ${formatError(exc)}`);
-            await sleep(Math.max(0, opts.reconnectDelaySeconds ?? 1) * 1e3);
+            if (exc instanceof AuthError) {
+              this._logWarn(`persistent tunnel auth error, re-authenticating: ${formatError(exc)}`);
+              try {
+                await this._authenticateForAccessToken();
+              } catch (reAuthExc) {
+                this._logWarn(`re-authentication failed: ${formatError(reAuthExc)}`);
+              }
+            } else {
+              this._logWarn(`persistent tunnel reconnect scheduled after error: ${formatError(exc)}`);
+            }
+            await sleep(_delay);
+            _delay = Math.min(_delay * 2, maxReconnectDelay);
           } finally {
             this._activeTunnel?.close();
             this._activeTunnel = null;