@agentunion/fastaun-browser 0.4.12 → 0.4.13

package/CHANGELOG.md

@@ -6,6 +6,33 @@
 
 ---
 
+## 0.4.13 — 2026-06-09
+
+### 新功能
+- **发送结果回填 envelope**：`message.send` / `group.send` / `message.thought.put` / `group.thought.put` 的返回结果新增规范化 `envelope` 字段，使发送方回执与接收端信封元数据一致；新增 `APP_SEND_ENVELOPE_METHODS` 与 `sendResultEnvelope()` / `attachSendResultEnvelope()`，rpc-pipeline 在 `postprocess` 后统一附加，V2 加密路径经 `_skipSendResultEnvelope` 标志跳过明文附加、由外层 V2 协调器在加密后补挂避免重复（四语言对齐）
+
+### 修复
+- **refresh_token 失效自愈**：新增需重登判定（命中 `relogin_required` 或 `missing refresh_token` / `invalid_or_expired_refresh_token` / `refresh not supported`）与清缓存逻辑；刷新失败需重登时清空本地 `access_token`/`refresh_token`/`kite_token` 并持久化，client 层 token 刷新循环检测到需重登时发布 `token.refresh_exhausted` 事件（带 `relogin_required: true`）、断连触发重连，下次 `connectSession` 因无可用 token 自动走两步登录；refresh RPC 补传 `aid`/`device_id`/`slot_id`/`access_token`/`sdk_lang`/`sdk_version`，`AuthError` 携带 `data` 透传服务端响应（四语言对齐）
+- **token 刷新日志文案修正**：修复连续刷新失败日志拼写错误（`token refreshconsecutivefailed` → 规范文案），token 循环中 `publish`/`_handleTransportDisconnect` 补齐 `await`
+- **protected_headers 类型归一**：V2 发送方法的 envelope 元数据归一时识别 `ProtectedHeaders` 对象（经 `toObject()` 探测）并转 dict，修复传入对象（非 dict）时 protected_headers 被丢弃的问题（四语言对齐）
+
+### 优化
+- **app_message_envelope 字段收窄**：envelope 键收窄为可转发元数据（`from`/`to`/`group_id`/`type`/`kind`/`version`/`timestamp`/`encrypted`/`context`/`protected_headers`/`payload_type`），移除 `message_id`/`seq`/`device_id`/`slot_id` 等本地与传输层字段，不再向应用层泄漏内部字段并剔除 `_auth`（四语言对齐）
+- **RPC 日志 token 脱敏**：短 RPC 请求/响应 debug 日志对 `access_token`/`refresh_token`/`kite_token`/`token` 及 `_token` 结尾键递归脱敏，避免明文 token 落日志；浏览器环境受 crypto 限制只输出 `<redacted len=N>`（不含 sha256，与 Node/Go 略有差异）
+
+### 测试
+- `refresh 业务失败且要求重登时应清掉本地 token 缓存`
+- `connectSession 在 refresh 失败后应继续走两步登录`
+- `应用层消息 envelope 只保留可转发字段并归一化 headers`
+- 更新 `publishAppEvent` 与群撤回相关用例断言 envelope 收窄、不含 `message_id`/`seq`/`device_id`/`slot_id`
+
+### 服务端协同（本版本配套）
+- **`auth.refresh_token` 响应结构化**：新增 `relogin_required` / `retryable` / `diagnostic` / `aid` / `refresh_count` 字段，SDK 据 `relogin_required`/`retryable` 区分"重新登录"与"退避重试"，不再单纯按 `error` 字符串判断
+- **JWT 老 SDK 兼容与即时吊销**：`AUN_JWT_LEGACY_ACCESS_TOKEN_COMPAT`（默认开）放行合法 JWT 避免迁移期重连风暴；`auth.token.revoked` 事件携带 `jti`/`expires_at`，gateway 按真实 TTL 缓存吊销
+- **V2 P2P 写入幂等**：服务端 `v2_write_peer_message`/`v2_write_peer_wrap` 捕获唯一键冲突逐字段比对，重发相同 message_id 幂等返回、不再产生 seq 空洞；自发自收跳过重复 self-sync 推送
+
+---
+
 ## 0.4.12 — 2026-06-08
 
 ### 新功能

package/_packed_docs/CHANGELOG.md

@@ -6,6 +6,33 @@
 
 ---
 
+## 0.4.13 — 2026-06-09
+
+### 新功能
+- **发送结果回填 envelope**：`message.send` / `group.send` / `message.thought.put` / `group.thought.put` 的返回结果新增规范化 `envelope` 字段，使发送方回执与接收端信封元数据一致；新增 `APP_SEND_ENVELOPE_METHODS` 与 `sendResultEnvelope()` / `attachSendResultEnvelope()`，rpc-pipeline 在 `postprocess` 后统一附加，V2 加密路径经 `_skipSendResultEnvelope` 标志跳过明文附加、由外层 V2 协调器在加密后补挂避免重复（四语言对齐）
+
+### 修复
+- **refresh_token 失效自愈**：新增需重登判定（命中 `relogin_required` 或 `missing refresh_token` / `invalid_or_expired_refresh_token` / `refresh not supported`）与清缓存逻辑；刷新失败需重登时清空本地 `access_token`/`refresh_token`/`kite_token` 并持久化，client 层 token 刷新循环检测到需重登时发布 `token.refresh_exhausted` 事件（带 `relogin_required: true`）、断连触发重连，下次 `connectSession` 因无可用 token 自动走两步登录；refresh RPC 补传 `aid`/`device_id`/`slot_id`/`access_token`/`sdk_lang`/`sdk_version`，`AuthError` 携带 `data` 透传服务端响应（四语言对齐）
+- **token 刷新日志文案修正**：修复连续刷新失败日志拼写错误（`token refreshconsecutivefailed` → 规范文案），token 循环中 `publish`/`_handleTransportDisconnect` 补齐 `await`
+- **protected_headers 类型归一**：V2 发送方法的 envelope 元数据归一时识别 `ProtectedHeaders` 对象（经 `toObject()` 探测）并转 dict，修复传入对象（非 dict）时 protected_headers 被丢弃的问题（四语言对齐）
+
+### 优化
+- **app_message_envelope 字段收窄**：envelope 键收窄为可转发元数据（`from`/`to`/`group_id`/`type`/`kind`/`version`/`timestamp`/`encrypted`/`context`/`protected_headers`/`payload_type`），移除 `message_id`/`seq`/`device_id`/`slot_id` 等本地与传输层字段，不再向应用层泄漏内部字段并剔除 `_auth`（四语言对齐）
+- **RPC 日志 token 脱敏**：短 RPC 请求/响应 debug 日志对 `access_token`/`refresh_token`/`kite_token`/`token` 及 `_token` 结尾键递归脱敏，避免明文 token 落日志；浏览器环境受 crypto 限制只输出 `<redacted len=N>`（不含 sha256，与 Node/Go 略有差异）
+
+### 测试
+- `refresh 业务失败且要求重登时应清掉本地 token 缓存`
+- `connectSession 在 refresh 失败后应继续走两步登录`
+- `应用层消息 envelope 只保留可转发字段并归一化 headers`
+- 更新 `publishAppEvent` 与群撤回相关用例断言 envelope 收窄、不含 `message_id`/`seq`/`device_id`/`slot_id`
+
+### 服务端协同（本版本配套）
+- **`auth.refresh_token` 响应结构化**：新增 `relogin_required` / `retryable` / `diagnostic` / `aid` / `refresh_count` 字段，SDK 据 `relogin_required`/`retryable` 区分"重新登录"与"退避重试"，不再单纯按 `error` 字符串判断
+- **JWT 老 SDK 兼容与即时吊销**：`AUN_JWT_LEGACY_ACCESS_TOKEN_COMPAT`（默认开）放行合法 JWT 避免迁移期重连风暴；`auth.token.revoked` 事件携带 `jti`/`expires_at`，gateway 按真实 TTL 缓存吊销
+- **V2 P2P 写入幂等**：服务端 `v2_write_peer_message`/`v2_write_peer_wrap` 捕获唯一键冲突逐字段比对，重发相同 message_id 幂等返回、不再产生 seq 空洞；自发自收跳过重复 self-sync 推送
+
+---
+
 ## 0.4.12 — 2026-06-08
 
 ### 新功能

package/_packed_docs/sdk/09-group-rpc-manual.md

@@ -2082,11 +2082,9 @@ SDK 收到后自动调用 `group.pull` 拉取最新消息并逐条解密后交
 {
     "envelope": {
         "group_id": "g-abc123.agentid.pub",
-        "seq": 42,
-        "message_id": "uuid",
-        "sender_aid": "alice.agentid.pub",
-        "message_type": "group.message",
-        "dispatch_mode": "broadcast"
+        "from": "alice.agentid.pub",
+        "type": "text",
+        "timestamp": 1234567890000
     },
     "group_id": "g-abc123.agentid.pub",
     "seq": 42,
@@ -2098,7 +2096,7 @@ SDK 收到后自动调用 `group.pull` 拉取最新消息并逐条解密后交
 }
 ```
 
-SDK 交付给应用层的 `payload` 是明文业务 JSON 对象；群消息信封字段统一放在 `envelope`。0.4.x 兼容期仍保留顶层 `group_id` / `seq` / `message_id` / `sender_aid` 等别名，下一个大版本 0.5.* 将移除这些顶层别名，请通过 `msg["envelope"]["message_id"]` 等路径访问。
+SDK 交付给应用层的 `payload` 是明文业务 JSON 对象；群消息信封字段统一放在 `envelope`。`envelope` 只保留可转发的归一化元数据，`from` 由 `sender_aid` 归一化而来，`timestamp` 由 `created_at` / `t_server` 归一化而来。0.4.x 兼容期仍保留顶层 `group_id` / `seq` / `message_id` / `sender_aid` / `dispatch_mode` 等别名，下一个大版本 0.5.* 将移除这些顶层别名；请通过 `msg["envelope"]["from"]`、`msg["envelope"]["timestamp"]` 等路径访问。
 
 ### event/group.message_recalled
 
@@ -2109,11 +2107,11 @@ SDK 交付给应用层的 `payload` 是明文业务 JSON 对象；群消息信
 ```json
 {
     "envelope": {
-        "module_id": "group",
         "group_id": "g-abc123.agentid.pub",
-        "seq": 43,
-        "message_id": "grm-uuid",
-        "sender_aid": "alice.agentid.pub"
+        "from": "alice.agentid.pub",
+        "type": "group.message_recalled",
+        "kind": "group.message_recalled",
+        "timestamp": 1234567890000
     },
     "module_id": "group",
     "group_id": "g-abc123.agentid.pub",
@@ -2130,11 +2128,11 @@ SDK 交付给应用层的 `payload` 是明文业务 JSON 对象；群消息信
 }
 ```
 
-SDK 交付给应用层的撤回事件同样带 `envelope`。`envelope` 表示当前交付的撤回 tombstone / 通知自身信封，不是被撤回原消息的信封；业务侧被撤回的原消息列表继续使用 `message_ids` / `target_message_seqs`。0.4.x 兼容期仍保留顶层 `group_id` / `seq` / `message_id` / `sender_aid` 等别名，下一个大版本 0.5.* 将移除这些顶层别名。
+SDK 交付给应用层的撤回事件同样带 `envelope`。`envelope` 表示当前交付的撤回 tombstone / 通知自身信封，不是被撤回原消息的信封；业务侧被撤回的原消息列表继续使用 `message_ids` / `target_message_seqs`。`message_id` / `seq` 继续只保留在顶层兼容字段中，不进入 `envelope`。0.4.x 兼容期仍保留顶层 `group_id` / `seq` / `message_id` / `sender_aid` 等别名，下一个大版本 0.5.* 将移除这些顶层别名。
 
 | 字段 | 类型 | 说明 |
 |------|------|------|
-| `envelope` | object | 撤回 tombstone / 通知自身信封，包含 `module_id`、`group_id`、`seq`、`message_id`、`sender_aid`、`device_id`、`slot_id` 等存在的字段 |
+| `envelope` | object | 撤回 tombstone / 通知自身信封，包含 `group_id`、`from`、`type`、`kind`、`timestamp`、`encrypted`、`context`、`protected_headers` 等存在的字段 |
 | `module_id` | string | 固定 `"group"` |
 | `group_id` | string | 群组 ID |
 | `seq` | integer | 当前交付的撤回 tombstone / 通知 seq；在线 push 为 notice_seq，原 seq 占位 tombstone 为原消息 seq |

package/_packed_docs/sdk/09-message-rpc-manual.md

@@ -513,10 +513,9 @@ result = await client.call("message.ack", {"seq": 150})
 ```json
 {
     "envelope": {
-        "message_id": "uuid-1",
         "from": "alice.agentid.pub",
         "to": "bob.agentid.pub",
-        "seq": 42,
+        "type": "text",
         "timestamp": 1234567890000,
         "encrypted": false
     },
@@ -531,7 +530,7 @@ result = await client.call("message.ack", {"seq": 150})
 }
 ```
 
-SDK 交付给应用层的 `payload` 是明文业务 JSON 对象；信封字段统一放在 `envelope`。0.4.x 兼容期仍保留顶层 `message_id` / `from` / `to` / `seq` / `timestamp` 等别名，下一个大版本 0.5.* 将移除这些顶层别名，请通过 `msg["envelope"]["seq"]` 等路径访问。
+SDK 交付给应用层的 `payload` 是明文业务 JSON 对象；信封字段统一放在 `envelope`。`envelope` 只保留可转发的归一化元数据，`from` 由 `from_aid` / `sender_aid` 归一化而来，`timestamp` 由 `created_at` / `t_server` 归一化而来。0.4.x 兼容期仍保留顶层 `message_id` / `from` / `to` / `seq` / `timestamp` 等别名，下一个大版本 0.5.* 将移除这些顶层别名；请通过 `msg["envelope"]["from"]`、`msg["envelope"]["timestamp"]` 等路径访问。
 
 ### 订阅
 
@@ -550,10 +549,10 @@ client.on("message.received", lambda msg: print(msg["payload"]))
 ```json
 {
     "envelope": {
-        "message_id": "recall-uuid",
         "from": "alice.agentid.pub",
         "to": "bob.agentid.pub",
-        "seq": 43,
+        "type": "message.recalled",
+        "kind": "message.recalled",
         "timestamp": 1234567890000
     },
     "message_id": "recall-uuid",
@@ -565,11 +564,11 @@ client.on("message.received", lambda msg: print(msg["payload"]))
 }
 ```
 
-SDK 交付给应用层的撤回事件同样带 `envelope`。`envelope` 表示撤回 tombstone / 通知自身的信封，不是被撤回原消息的信封；被撤回的原消息继续通过 `message_ids` 表达。0.4.x 兼容期仍保留顶层 `message_id` / `from` / `to` / `seq` / `timestamp` 等别名，下一个大版本 0.5.* 将移除这些顶层别名。
+SDK 交付给应用层的撤回事件同样带 `envelope`。`envelope` 表示撤回 tombstone / 通知自身的信封，不是被撤回原消息的信封；被撤回的原消息继续通过 `message_ids` 表达。`message_id` / `seq` 继续只保留在顶层兼容字段中，不进入 `envelope`。0.4.x 兼容期仍保留顶层 `message_id` / `from` / `to` / `seq` / `timestamp` 等别名，下一个大版本 0.5.* 将移除这些顶层别名。
 
 | 字段 | 类型 | 说明 |
 |------|------|------|
-| `envelope` | object | 撤回 tombstone / 通知自身信封，包含 `message_id`、`from`、`to`、`seq`、`timestamp`、`device_id`、`slot_id` 等存在的字段 |
+| `envelope` | object | 撤回 tombstone / 通知自身信封，包含 `from`、`to`、`type`、`kind`、`timestamp`、`encrypted`、`context`、`protected_headers` 等存在的字段 |
 | `message_id` | string | 撤回 tombstone / 通知自身的 message_id |
 | `tombstone_message_id` | string | 兼容别名，等同于撤回 tombstone / 通知自身的 `message_id` |
 | `from` | string | 发送方（撤回者）AID |

package/dist/auth.d.ts

@@ -159,6 +159,8 @@ export declare class AuthFlow {
     addTrustedRootPem(pem: string): void;
     private _loadTrustedRoots;
     private _rememberTokens;
+    private _refreshFailureRequiresRelogin;
+    private _clearCachedTokens;
     /** 验证服务端返回的 new_cert，通过后正式接受 */
     private _validateNewCert;
     /** 获取缓存的有效 access_token */

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAkE,MAAM,aAAa,CAAC;AAQ7G,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,UAAU,EAEf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAwFpB,UAAU,WAAY,SAAQ,UAAU;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7D;AAqTD;;;;;;;;GAQG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,IAAI,CAA0B;IACtC,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI;IAElC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAKnC;IAEX,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,IAAI,CAAgB;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,YAAY,CAA+B;IAGnD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,kBAAkB,CAAoC;IAC9D,OAAO,CAAC,gBAAgB,CAAkF;IAC1G,OAAO,CAAC,iBAAiB,CAAkF;IAC3G,OAAO,CAAC,mBAAmB,CAAkC;IAC7D,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAmC;gBAEjD,IAAI,EAAE;QAChB,UAAU,EAAE,UAAU,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB;IAaD,4CAA4C;IAC5C,WAAW,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI;IAKlD,eAAe;IACT,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAuBzD,uBAAuB;IACjB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQtE,2CAA2C;IACrC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAItE,2BAA2B;IAC3B,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI;IAM7D,kBAAkB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAKrE;;;;;OAKG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsEzE;;OAEG;IACG,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BnE;;OAEG;IACG,mBAAmB,CACvB,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,UAAU,GAAG,IAAI,EAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,GACA,OAAO,CAAC,UAAU,CAAC;IA2BtB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,UAAU,GAAG,IAAI,EAC5B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GAAG;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,GACA,OAAO,CAAC,WAAW,CAAC;IA0IvB;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,cAAc,CAAC;IAkB1B;;OAEG;IACG,qBAAqB,CACzB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAkChB,sDAAsD;YACxC,SAAS;IA+EvB,qBAAqB;YACP,UAAU;IAexB,wBAAwB;YACV,UAAU;IAoBxB;;;;;;;;;;;;;;OAcG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5E,oCAAoC;YACtB,uBAAuB;IAWrC,4CAA4C;IAC5C,OAAO,CAAC,8BAA8B;IAmBtC,oBAAoB;YACN,uBAAuB;YAyBvB,MAAM;IAiCpB,sBAAsB;YACR,mBAAmB;IAajC,yCAAyC;YAC3B,kBAAkB;YAqElB,qBAAqB;YAiDrB,oBAAoB;IAqElC,2BAA2B;YACb,mBAAmB;IAUjC,8BAA8B;YAChB,oBAAoB;YAQpB,yBAAyB;IA2BvC,2BAA2B;YACb,0BAA0B;IAcxC,gCAAgC;YAClB,gBAAgB;YA2ChB,mBAAmB;IAcjC,sBAAsB;YACR,sBAAsB;IAqBpC,oCAAoC;YACtB,uBAAuB;IAyCrC,8BAA8B;IAC9B,kBAAkB,IAAI,MAAM;IAQ5B,iCAAiC;IACjC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQpC,OAAO,CAAC,iBAAiB;IAmCzB,OAAO,CAAC,eAAe;IAqBvB,gCAAgC;YAClB,gBAAgB;IA4E9B,2BAA2B;IAC3B,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAErE,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAY1C,sBAAsB;IAItB,wBAAwB;YACV,oBAAoB;YA0BpB,kBAAkB;YAOlB,gBAAgB;IAgC9B,kCAAkC;IAClC,kBAAkB,IAAI,IAAI;CAe3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAkE,MAAM,aAAa,CAAC;AAkC7G,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,UAAU,EAEf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAwFpB,UAAU,WAAY,SAAQ,UAAU;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7D;AAqTD;;;;;;;;GAQG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,IAAI,CAA0B;IACtC,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI;IAElC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAKnC;IAEX,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,IAAI,CAAgB;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,YAAY,CAA+B;IAGnD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,kBAAkB,CAAoC;IAC9D,OAAO,CAAC,gBAAgB,CAAkF;IAC1G,OAAO,CAAC,iBAAiB,CAAkF;IAC3G,OAAO,CAAC,mBAAmB,CAAkC;IAC7D,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAmC;gBAEjD,IAAI,EAAE;QAChB,UAAU,EAAE,UAAU,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB;IAaD,4CAA4C;IAC5C,WAAW,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI;IAKlD,eAAe;IACT,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAuBzD,uBAAuB;IACjB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQtE,2CAA2C;IACrC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAItE,2BAA2B;IAC3B,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI;IAM7D,kBAAkB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAKrE;;;;;OAKG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsEzE;;OAEG;IACG,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BnE;;OAEG;IACG,mBAAmB,CACvB,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,UAAU,GAAG,IAAI,EAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,GACA,OAAO,CAAC,UAAU,CAAC;IA2BtB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,UAAU,GAAG,IAAI,EAC5B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GAAG;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,GACA,OAAO,CAAC,WAAW,CAAC;IA6IvB;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,cAAc,CAAC;IAwB1B;;OAEG;IACG,qBAAqB,CACzB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAkChB,sDAAsD;YACxC,SAAS;IA+EvB,qBAAqB;YACP,UAAU;IAexB,wBAAwB;YACV,UAAU;IAoBxB;;;;;;;;;;;;;;OAcG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5E,oCAAoC;YACtB,uBAAuB;IAWrC,4CAA4C;IAC5C,OAAO,CAAC,8BAA8B;IAmBtC,oBAAoB;YACN,uBAAuB;YAyBvB,MAAM;IAiCpB,sBAAsB;YACR,mBAAmB;IA8BjC,yCAAyC;YAC3B,kBAAkB;YAqElB,qBAAqB;YAiDrB,oBAAoB;IAqElC,2BAA2B;YACb,mBAAmB;IAUjC,8BAA8B;YAChB,oBAAoB;YAQpB,yBAAyB;IA2BvC,2BAA2B;YACb,0BAA0B;IAcxC,gCAAgC;YAClB,gBAAgB;YA2ChB,mBAAmB;IAcjC,sBAAsB;YACR,sBAAsB;IAqBpC,oCAAoC;YACtB,uBAAuB;IAyCrC,8BAA8B;IAC9B,kBAAkB,IAAI,MAAM;IAQ5B,iCAAiC;IACjC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQpC,OAAO,CAAC,iBAAiB;IAmCzB,OAAO,CAAC,eAAe;IAqBvB,OAAO,CAAC,8BAA8B;YAYxB,kBAAkB;IAuBhC,gCAAgC;YAClB,gBAAgB;IA4E9B,2BAA2B;IAC3B,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAErE,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAY1C,sBAAsB;IAItB,wBAAwB;YACV,oBAAoB;YA0BpB,kBAAkB;YAOlB,gBAAgB;IAgC9B,kCAAkC;IAClC,kBAAkB,IAAI,IAAI;CAe3B"}

package/dist/auth.js

@@ -7,6 +7,32 @@ import { ROOT_CA_PEM } from './certs/root.js';
 import { VERSION as AUN_SDK_VERSION } from './version.js';
 const _noopLog = { error: () => { }, warn: () => { }, info: () => { }, debug: () => { } };
 const AUN_SDK_LANG = 'javascript';
+const SENSITIVE_RPC_LOG_KEYS = new Set([
+    'access_token',
+    'refresh_token',
+    'kite_token',
+    'token',
+]);
+function redactRpcLogPayload(value, key = '', depth = 0) {
+    const keyLower = key.toLowerCase();
+    if (SENSITIVE_RPC_LOG_KEYS.has(keyLower) || keyLower.endsWith('_token')) {
+        const text = String(value ?? '');
+        return text ? `<redacted len=${text.length}>` : '';
+    }
+    if (depth >= 6)
+        return '<max-depth>';
+    if (Array.isArray(value)) {
+        return value.map((item) => redactRpcLogPayload(item, '', depth + 1));
+    }
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [childKey, childValue] of Object.entries(value)) {
+            out[childKey] = redactRpcLogPayload(childValue, childKey, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
 import { isJsonObject, } from './types.js';
 // ── ASN.1 / PEM 工具 ────────────────────────────────────
 /** 拆分 PEM bundle 为独立的 PEM 字符串数组 */
@@ -669,6 +695,9 @@ export class AuthFlow {
                 catch (e) {
                     if (!(e instanceof AuthError))
                         throw e;
+                    if (this._refreshFailureRequiresRelogin(e)) {
+                        await this._clearCachedTokens(identity, e.message);
+                    }
                     // refresh 失败，重新登录
                 }
             }
@@ -702,9 +731,11 @@ export class AuthFlow {
         this._log.debug(`refreshCachedTokens enter: aid=${identity.aid} gateway=${gatewayUrl}`);
         try {
             const refreshToken = String(identity.refresh_token ?? '');
-            if (!refreshToken)
+            if (!refreshToken) {
+                await this._clearCachedTokens(identity, 'missing refresh_token');
                 throw new AuthError('missing refresh_token');
-            const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken);
+            }
+            const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken, identity);
             this._rememberTokens(identity, refreshed);
             await this._validateNewCert(identity, gatewayUrl);
             await this._persistIdentity(identity);
@@ -712,6 +743,9 @@ export class AuthFlow {
             return identity;
         }
         catch (err) {
+            if (this._refreshFailureRequiresRelogin(err)) {
+                await this._clearCachedTokens(identity, err instanceof Error ? err.message : String(err));
+            }
             this._log.debug(`refreshCachedTokens exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
             throw err;
         }
@@ -798,13 +832,13 @@ export class AuthFlow {
                             method,
                             params,
                         });
-                        this._log.debug(`short RPC request full: ${requestPayload}`);
+                        this._log.debug(`short RPC request full: ${JSON.stringify(redactRpcLogPayload(JSON.parse(requestPayload)))}`);
                         ws.send(requestPayload);
                         return;
                     }
                     // 第二条消息是 RPC 响应
                     globalThis.clearTimeout(timeout);
-                    this._log.debug(`short RPC response full: method=${method} ${JSON.stringify(msg)}`);
+                    this._log.debug(`short RPC response full: method=${method} ${JSON.stringify(redactRpcLogPayload(msg))}`);
                     try {
                         ws.close();
                     }
@@ -819,7 +853,7 @@ export class AuthFlow {
                         return;
                     }
                     if (result.success === false) {
-                        reject(new AuthError(String(result.error ?? `${method} failed`)));
+                        reject(new AuthError(String(result.error ?? `${method} failed`), { data: result }));
                         return;
                     }
                     resolve(result);
@@ -963,12 +997,32 @@ export class AuthFlow {
         return phase2;
     }
     /** 刷新 access token */
-    async _refreshAccessToken(gatewayUrl, refreshToken) {
-        const result = await this._shortRpc(gatewayUrl, 'auth.refresh_token', {
+    async _refreshAccessToken(gatewayUrl, refreshToken, identity) {
+        const params = {
             refresh_token: refreshToken,
-        });
+            sdk_lang: AUN_SDK_LANG,
+            sdk_version: AUN_SDK_VERSION,
+        };
+        if (identity) {
+            const aid = String(identity.aid ?? '').trim();
+            const deviceId = String(identity.device_id ?? '').trim();
+            const slotId = String(identity.slot_id ?? '').trim();
+            const accessToken = String(identity.access_token ?? '').trim();
+            if (aid)
+                params.aid = aid;
+            if (deviceId)
+                params.device_id = deviceId;
+            if (slotId)
+                params.slot_id = slotId;
+            if (accessToken)
+                params.access_token = accessToken;
+            if (typeof identity.access_token_expires_at === 'number') {
+                params.access_token_expires_at = identity.access_token_expires_at;
+            }
+        }
+        const result = await this._shortRpc(gatewayUrl, 'auth.refresh_token', params);
         if (!result.success) {
-            throw new AuthError(String(result.error ?? 'refresh failed'));
+            throw new AuthError(String(result.error ?? 'refresh failed'), { data: result });
         }
         return result;
     }
@@ -1354,6 +1408,41 @@ export class AuthFlow {
         if (typeof activeCert === 'string' && activeCert)
             identity._pending_active_cert = activeCert;
     }
+    _refreshFailureRequiresRelogin(err) {
+        if (!(err instanceof AuthError))
+            return false;
+        const data = err.data;
+        if (isJsonObject(data)) {
+            if (data.relogin_required === true)
+                return true;
+            const error = String(data.error ?? '').trim().toLowerCase();
+            return ['missing refresh_token', 'invalid_or_expired_refresh_token', 'refresh not supported'].includes(error);
+        }
+        const message = err.message.trim().toLowerCase();
+        return ['missing refresh_token', 'invalid_or_expired_refresh_token', 'refresh not supported'].includes(message);
+    }
+    async _clearCachedTokens(identity, reason = '') {
+        const aid = String(identity.aid ?? '');
+        const hadToken = Boolean(identity.access_token ||
+            identity.refresh_token ||
+            identity.kite_token ||
+            identity.token ||
+            identity.access_token_expires_at);
+        if (!hadToken)
+            return;
+        identity.access_token = '';
+        identity.refresh_token = '';
+        identity.kite_token = '';
+        identity.token = '';
+        identity.access_token_expires_at = 0;
+        try {
+            await this._persistIdentity(identity);
+            this._log.warn(`cleared cached tokens after refresh failure: aid=${aid} reason=${reason}`);
+        }
+        catch (persistErr) {
+            this._log.warn(`failed to persist token cleanup: aid=${aid} err=${persistErr instanceof Error ? persistErr.message : String(persistErr)}`);
+        }
+    }
     /** 验证服务端返回的 new_cert，通过后正式接受 */
     async _validateNewCert(identity, gatewayUrl = '') {
         const newCertPem = identity._pending_new_cert;