@agentunion/fastaun 0.2.17 → 0.2.18

package/dist/auth.js

@@ -309,263 +309,335 @@ export class AuthFlow {
      * 如果 AID 已在服务端注册但本地证书丢失，尝试从 PKI 端点下载恢复。
      */
     async createAid(gatewayUrl, aid) {
+        const tStart = Date.now();
         AuthFlow._validateAidName(aid);
-        let identity = this._ensureLocalIdentity(aid);
-        if (identity.cert) {
-            return { aid: identity.aid, cert: identity.cert };
-        }
-        // 本地有密钥但无证书——尝试注册
+        this._logger.debug(`createAid enter: aid=${aid}, gateway=${gatewayUrl}`);
         try {
-            const created = await this._createAid(gatewayUrl, identity);
-            Object.assign(identity, created);
-        }
-        catch (e) {
-            if (!(e instanceof AUNError) || !String(e.message).includes('already exists')) {
-                throw e;
+            let identity = this._ensureLocalIdentity(aid);
+            if (identity.cert) {
+                this._logger.debug(`createAid exit: elapsed=${Date.now() - tStart}ms (already has cert) aid=${aid}`);
+                return { aid: identity.aid, cert: identity.cert };
             }
-            // AID 已在服务端注册，尝试从 PKI 下载恢复证书
+            // 本地有密钥但无证书——尝试注册
             try {
-                identity = await this._recoverCertViaDownload(gatewayUrl, identity);
+                const created = await this._createAid(gatewayUrl, identity);
+                Object.assign(identity, created);
+                this._logger.debug(`AID register ok: aid=${aid}`);
             }
-            catch {
-                throw new StateError(`AID ${aid} already registered on server but local certificate is missing. ` +
-                    `Certificate download recovery failed. Options: ` +
-                    `(1) use a different AID name, or ` +
-                    `(2) restart Kite server to clear registration.`);
+            catch (e) {
+                if (!(e instanceof AUNError) || !String(e.message).includes('already exists')) {
+                    this._logger.error(`AID register failed: aid=${aid}, error=${e instanceof Error ? e.message : String(e)}`);
+                    throw e;
+                }
+                // AID 已在服务端注册，尝试从 PKI 下载恢复证书
+                try {
+                    identity = await this._recoverCertViaDownload(gatewayUrl, identity);
+                }
+                catch {
+                    throw new StateError(`AID ${aid} already registered on server but local certificate is missing. ` +
+                        `Certificate download recovery failed. Options: ` +
+                        `(1) use a different AID name, or ` +
+                        `(2) restart Kite server to clear registration.`);
+                }
             }
+            this._persistIdentity(identity);
+            this._aid = String(identity.aid);
+            this._logger.debug(`createAid exit: elapsed=${Date.now() - tStart}ms aid=${aid}`);
+            return { aid: identity.aid, cert: identity.cert };
+        }
+        catch (err) {
+            this._logger.debug(`createAid exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        this._persistIdentity(identity);
-        this._aid = String(identity.aid);
-        return { aid: identity.aid, cert: identity.cert };
     }
     /**
      * 认证（登录）到 Gateway。
      * 执行两阶段挑战-应答认证，返回 token 信息。
      */
     async authenticate(gatewayUrl, opts) {
+        const tStart = Date.now();
         let identity = this._loadIdentityOrRaise(opts?.aid);
-        if (!identity.cert) {
-            // 本地有密钥但无证书——尝试从 PKI 下载恢复
+        this._logger.debug(`authenticate enter: aid=${identity.aid}, gateway=${gatewayUrl}`);
+        try {
+            if (!identity.cert) {
+                // 本地有密钥但无证书——尝试从 PKI 下载恢复
+                try {
+                    identity = await this._recoverCertViaDownload(gatewayUrl, identity);
+                    this._persistIdentity(identity);
+                }
+                catch (e) {
+                    throw new StateError(`local certificate missing and recovery failed: ${e instanceof Error ? e.message : String(e)}. ` +
+                        `Run auth.createAid() to register a new identity.`);
+                }
+            }
+            let login;
             try {
-                identity = await this._recoverCertViaDownload(gatewayUrl, identity);
-                this._persistIdentity(identity);
+                login = await this._login(gatewayUrl, identity);
+                this._logger.debug(`auth login ok: aid=${identity.aid}`);
             }
             catch (e) {
-                throw new StateError(`local certificate missing and recovery failed: ${e instanceof Error ? e.message : String(e)}. ` +
-                    `Run auth.createAid() to register a new identity.`);
+                // 证书未在服务端注册或公钥不匹配 — 自动重新注册
+                if (e instanceof AuthError && (String(e.message).includes('not registered') || String(e.message).includes('public key mismatch'))) {
+                    this._logger.warn(`cert not registered on server, auto re-register: aid=${identity.aid}`);
+                    const created = await this._createAid(gatewayUrl, identity);
+                    identity.cert = created.cert;
+                    this._persistIdentity(identity);
+                    login = await this._login(gatewayUrl, identity);
+                }
+                else {
+                    throw e;
+                }
             }
+            AuthFlow._rememberTokens(identity, login);
+            await this._validateNewCert(identity, gatewayUrl);
+            this._persistIdentity(identity);
+            this._aid = String(identity.aid);
+            this._logger.debug(`authenticate exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}`);
+            return {
+                aid: identity.aid,
+                access_token: identity.access_token,
+                refresh_token: identity.refresh_token,
+                expires_at: identity.access_token_expires_at,
+                gateway: gatewayUrl,
+            };
         }
-        let login;
-        try {
-            login = await this._login(gatewayUrl, identity);
-        }
-        catch (e) {
-            // 证书未在服务端注册或公钥不匹配 — 自动重新注册
-            if (e instanceof AuthError && (String(e.message).includes('not registered') || String(e.message).includes('public key mismatch'))) {
-                this._logger.warn(`证书未在服务端注册，自动重新注册: aid=${identity.aid}`);
-                const created = await this._createAid(gatewayUrl, identity);
-                identity.cert = created.cert;
-                this._persistIdentity(identity);
-                login = await this._login(gatewayUrl, identity);
-            }
-            else {
-                throw e;
-            }
+        catch (err) {
+            this._logger.debug(`authenticate exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        AuthFlow._rememberTokens(identity, login);
-        await this._validateNewCert(identity, gatewayUrl);
-        this._persistIdentity(identity);
-        this._aid = String(identity.aid);
-        return {
-            aid: identity.aid,
-            access_token: identity.access_token,
-            refresh_token: identity.refresh_token,
-            expires_at: identity.access_token_expires_at,
-            gateway: gatewayUrl,
-        };
     }
     /**
      * 确保已认证（自动创建 + 登录）。
      * 如果没有本地身份则创建，然后执行登录流程。
      */
     async ensureAuthenticated(gatewayUrl) {
-        const identity = this._ensureIdentity();
-        if (!identity.cert) {
-            const created = await this._createAid(gatewayUrl, identity);
-            Object.assign(identity, created);
+        const tStart = Date.now();
+        this._logger.debug(`ensureAuthenticated enter: gateway=${gatewayUrl}`);
+        try {
+            const identity = this._ensureIdentity();
+            if (!identity.cert) {
+                const created = await this._createAid(gatewayUrl, identity);
+                Object.assign(identity, created);
+                this._persistIdentity(identity);
+            }
+            const login = await this._login(gatewayUrl, identity);
+            AuthFlow._rememberTokens(identity, login);
+            await this._validateNewCert(identity, gatewayUrl);
             this._persistIdentity(identity);
+            const token = identity.access_token || identity.token || identity.kite_token;
+            if (!token) {
+                throw new AuthError('login2 did not return access token');
+            }
+            this._logger.debug(`ensureAuthenticated exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}`);
+            return { token, identity };
         }
-        const login = await this._login(gatewayUrl, identity);
-        AuthFlow._rememberTokens(identity, login);
-        await this._validateNewCert(identity, gatewayUrl);
-        this._persistIdentity(identity);
-        const token = identity.access_token || identity.token || identity.kite_token;
-        if (!token) {
-            throw new AuthError('login2 did not return access token');
+        catch (err) {
+            this._logger.debug(`ensureAuthenticated exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        return { token, identity };
     }
     /**
      * 刷新缓存的 token。
      * 使用 refresh_token 获取新的 access_token。
      */
     async refreshCachedTokens(gatewayUrl, identity) {
+        const tStart = Date.now();
         const refreshToken = String(identity.refresh_token || '');
         if (!refreshToken) {
+            this._logger.error(`token refresh failed: missing refresh_token, aid=${identity.aid}`);
             throw new AuthError('missing refresh_token');
         }
-        const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken);
-        AuthFlow._rememberTokens(identity, refreshed);
-        await this._validateNewCert(identity, gatewayUrl);
-        this._persistIdentity(identity);
-        return identity;
+        this._logger.debug(`refreshCachedTokens enter: aid=${identity.aid}`);
+        try {
+            const refreshed = await this._refreshAccessToken(gatewayUrl, refreshToken);
+            AuthFlow._rememberTokens(identity, refreshed);
+            await this._validateNewCert(identity, gatewayUrl);
+            this._persistIdentity(identity);
+            this._logger.debug(`refreshCachedTokens exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}`);
+            return identity;
+        }
+        catch (err) {
+            this._logger.debug(`refreshCachedTokens exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
     }
     /**
      * 使用 token 初始化 WebSocket 会话。
      * 发送 auth.connect RPC 完成会话握手。
      */
     async initializeWithToken(transport, challenge, accessToken, opts) {
-        const nonce = this._extractChallengeNonce(challenge);
-        this.setInstanceContext({
-            deviceId: String(opts?.deviceId ?? ''),
-            slotId: String(opts?.slotId ?? ''),
-        });
-        await this._initializeSession(transport, nonce, accessToken, {
-            deviceId: String(opts?.deviceId ?? ''),
-            slotId: String(opts?.slotId ?? ''),
-            deliveryMode: opts?.deliveryMode ?? null,
-        });
+        const tStart = Date.now();
+        this._logger.debug(`initializeWithToken enter: deviceId=${opts?.deviceId ?? ''}, slotId=${opts?.slotId ?? ''}`);
+        try {
+            const nonce = this._extractChallengeNonce(challenge);
+            this.setInstanceContext({
+                deviceId: String(opts?.deviceId ?? ''),
+                slotId: String(opts?.slotId ?? ''),
+            });
+            await this._initializeSession(transport, nonce, accessToken, {
+                deviceId: String(opts?.deviceId ?? ''),
+                slotId: String(opts?.slotId ?? ''),
+                deliveryMode: opts?.deliveryMode ?? null,
+            });
+            this._logger.debug(`initializeWithToken exit: elapsed=${Date.now() - tStart}ms`);
+        }
+        catch (err) {
+            this._logger.debug(`initializeWithToken exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
     }
     /**
      * 连接会话（自动选择认证策略）。
      * 依次尝试：显式 token → 缓存 token → 刷新 token → 完整重认证。
      */
     async connectSession(transport, challenge, gatewayUrl, opts) {
+        const tStart = Date.now();
         const nonce = this._extractChallengeNonce(challenge);
         const deviceId = String(opts?.deviceId ?? '');
         const slotId = String(opts?.slotId ?? '');
         const deliveryMode = opts?.deliveryMode ?? null;
         this.setInstanceContext({ deviceId, slotId });
-        let identity;
+        this._logger.debug(`connectSession enter: gateway=${gatewayUrl}, device_id=${deviceId}, slot_id=${slotId}, has_explicit_token=${!!opts?.accessToken}, has_challenge_nonce=${!!nonce}`);
         try {
-            identity = this.loadIdentity();
-        }
-        catch {
-            identity = null;
-        }
-        // 策略 1：显式 token
-        const explicitToken = String(opts?.accessToken || '');
-        if (explicitToken && identity !== null) {
+            let identity;
             try {
-                await this._initializeSession(transport, nonce, explicitToken, {
-                    deviceId,
-                    slotId,
-                    deliveryMode,
-                });
-                identity.access_token = explicitToken;
-                this._persistIdentity(identity);
-                return { token: explicitToken, identity };
+                identity = this.loadIdentity();
             }
-            catch (exc) {
-                if (!(exc instanceof AuthError))
-                    throw exc;
-                this._logger.debug(`explicit_token 认证失败，尝试下一方式: ${exc.message}`);
+            catch {
+                identity = null;
             }
-        }
-        // 无本地身份时，执行完整认证
-        if (identity === null) {
-            const authContext = await this.ensureAuthenticated(gatewayUrl);
-            const token = String(authContext.token);
-            await this._initializeSession(transport, nonce, token, {
-                deviceId,
-                slotId,
-                deliveryMode,
-            });
-            return authContext;
-        }
-        // 策略 2：缓存的 access_token
-        const cachedToken = AuthFlow._getCachedAccessToken(identity);
-        if (cachedToken) {
-            try {
-                await this._initializeSession(transport, nonce, cachedToken, {
+            // 策略 1：显式 token
+            const explicitToken = String(opts?.accessToken || '');
+            if (explicitToken && identity !== null) {
+                try {
+                    await this._initializeSession(transport, nonce, explicitToken, {
+                        deviceId,
+                        slotId,
+                        deliveryMode,
+                    });
+                    identity.access_token = explicitToken;
+                    this._persistIdentity(identity);
+                    this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=explicit_token aid=${String(identity.aid ?? '')}`);
+                    return { token: explicitToken, identity };
+                }
+                catch (exc) {
+                    if (!(exc instanceof AuthError))
+                        throw exc;
+                    this._logger.debug(`explicit_token auth failed, try next method: ${exc.message}`);
+                }
+            }
+            // 无本地身份时，执行完整认证
+            if (identity === null) {
+                const authContext = await this.ensureAuthenticated(gatewayUrl);
+                const token = String(authContext.token);
+                await this._initializeSession(transport, nonce, token, {
                     deviceId,
                     slotId,
                     deliveryMode,
                 });
-                return { token: cachedToken, identity };
-            }
-            catch (exc) {
-                if (!(exc instanceof AuthError))
-                    throw exc;
-                this._logger.debug(`cached_token 认证失败，尝试刷新: ${exc.message}`);
+                this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=ensure_authenticated aid=${String(authContext.identity?.aid ?? '')}`);
+                return authContext;
             }
-        }
-        // 策略 3：refresh_token
-        const refreshToken = String(identity.refresh_token || '');
-        if (refreshToken) {
-            try {
-                identity = await this.refreshCachedTokens(gatewayUrl, identity);
-                const newCachedToken = AuthFlow._getCachedAccessToken(identity);
-                if (newCachedToken) {
-                    await this._initializeSession(transport, nonce, newCachedToken, {
+            // 策略 2：缓存的 access_token
+            const cachedToken = AuthFlow._getCachedAccessToken(identity);
+            if (cachedToken) {
+                try {
+                    await this._initializeSession(transport, nonce, cachedToken, {
                         deviceId,
                         slotId,
                         deliveryMode,
                     });
-                    return { token: newCachedToken, identity };
+                    this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=cached_token aid=${String(identity.aid ?? '')}`);
+                    return { token: cachedToken, identity };
+                }
+                catch (exc) {
+                    if (!(exc instanceof AuthError))
+                        throw exc;
+                    this._logger.debug(`cached_token auth failed, try refresh: ${exc.message}`);
                 }
             }
-            catch (exc) {
-                if (!(exc instanceof AuthError))
-                    throw exc;
-                this._logger.debug(`refresh_token 认证失败，将重新登录: ${exc.message}`);
+            // 策略 3：refresh_token
+            const refreshToken = String(identity.refresh_token || '');
+            if (refreshToken) {
+                try {
+                    identity = await this.refreshCachedTokens(gatewayUrl, identity);
+                    const newCachedToken = AuthFlow._getCachedAccessToken(identity);
+                    if (newCachedToken) {
+                        await this._initializeSession(transport, nonce, newCachedToken, {
+                            deviceId,
+                            slotId,
+                            deliveryMode,
+                        });
+                        this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=refresh_token aid=${String(identity.aid ?? '')}`);
+                        return { token: newCachedToken, identity };
+                    }
+                }
+                catch (exc) {
+                    if (!(exc instanceof AuthError))
+                        throw exc;
+                    this._logger.debug(`refresh_token auth failed, will re-login: ${exc.message}`);
+                }
             }
+            // 策略 4：完整重认证
+            const login = await this.authenticate(gatewayUrl, { aid: identity.aid });
+            const token = String(login.access_token || '');
+            if (!token) {
+                throw new AuthError('authenticate did not return access_token');
+            }
+            await this._initializeSession(transport, nonce, token, {
+                deviceId,
+                slotId,
+                deliveryMode,
+            });
+            identity = this.loadIdentity(identity.aid);
+            this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=full_reauth aid=${String(identity?.aid ?? '')}`);
+            return { token, identity };
         }
-        // 策略 4：完整重认证
-        const login = await this.authenticate(gatewayUrl, { aid: identity.aid });
-        const token = String(login.access_token || '');
-        if (!token) {
-            throw new AuthError('authenticate did not return access_token');
+        catch (err) {
+            this._logger.debug(`connectSession exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        await this._initializeSession(transport, nonce, token, {
-            deviceId,
-            slotId,
-            deliveryMode,
-        });
-        identity = this.loadIdentity(identity.aid);
-        return { token, identity };
     }
     /**
      * 验证对端证书：时间有效性 + 链验证 + CRL + OCSP + AID 绑定。
      * 用于 E2EE 握手中验证通信对端的身份证书。
      */
     async verifyPeerCertificate(gatewayUrl, certPem, expectedAid) {
-        const cert = _loadX509(certPem);
-        const nowMs = Date.now();
-        _ensureCertTimeValid(cert, 'peer certificate', nowMs);
-        await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid);
-        try {
-            await this._verifyAuthCertRevocation(gatewayUrl, cert, expectedAid);
-        }
-        catch (e) {
-            const errMsg = e instanceof Error ? e.message : String(e);
-            if (/revoked/i.test(errMsg))
-                throw e instanceof AuthError ? e : new AuthError(errMsg);
-            this._logger.warn(`CRL 检查不可用，降级继续: ${errMsg}`);
-        }
+        const tStart = Date.now();
+        this._logger.debug(`verifyPeerCertificate enter: aid=${expectedAid}, gateway=${gatewayUrl}`);
         try {
-            await this._verifyAuthCertOcsp(gatewayUrl, cert, expectedAid);
-        }
-        catch (exc) {
-            const errMsg = exc instanceof Error ? exc.message : String(exc);
-            if (/revoked/i.test(errMsg))
-                throw exc instanceof AuthError ? exc : new AuthError(errMsg);
-            this._logger.warn(`OCSP 校验不可用，降级继续: ${errMsg}`);
+            const cert = _loadX509(certPem);
+            const nowMs = Date.now();
+            _ensureCertTimeValid(cert, 'peer certificate', nowMs);
+            await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid);
+            try {
+                await this._verifyAuthCertRevocation(gatewayUrl, cert, expectedAid);
+            }
+            catch (e) {
+                const errMsg = e instanceof Error ? e.message : String(e);
+                if (/revoked/i.test(errMsg))
+                    throw e instanceof AuthError ? e : new AuthError(errMsg);
+                this._logger.warn(`CRL verification unavailable, skipping: ${errMsg}`);
+            }
+            try {
+                await this._verifyAuthCertOcsp(gatewayUrl, cert, expectedAid);
+            }
+            catch (exc) {
+                const errMsg = exc instanceof Error ? exc.message : String(exc);
+                if (/revoked/i.test(errMsg))
+                    throw exc instanceof AuthError ? exc : new AuthError(errMsg);
+                this._logger.warn(`OCSP verification unavailable, skipping: ${errMsg}`);
+            }
+            // 检查 CN 匹配
+            const cn = _certSubjectCN(cert);
+            if (cn !== expectedAid) {
+                throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}, got ${cn || 'none'}`);
+            }
+            this._logger.debug(`verifyPeerCertificate exit: elapsed=${Date.now() - tStart}ms aid=${expectedAid}`);
         }
-        // 检查 CN 匹配
-        const cn = _certSubjectCN(cert);
-        if (cn !== expectedAid) {
-            throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}, got ${cn || 'none'}`);
+        catch (err) {
+            this._logger.debug(`verifyPeerCertificate exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
     }
     // ── 内部方法：短连接 RPC ────────────────────────────────────
@@ -574,6 +646,7 @@ export class AuthFlow {
      * 流程：连接 → 接收 challenge → 发送请求 → 接收响应 → 关闭。
      */
     async _shortRpc(gatewayUrl, method, params) {
+        this._logger.debug(`_shortRpc enter: method=${method}, gateway=${gatewayUrl}`);
         const ws = await this._connectionFactory(gatewayUrl);
         try {
             // 接收 challenge（第一条消息）
@@ -651,38 +724,60 @@ export class AuthFlow {
     }
     /** 两阶段登录 */
     async _login(gatewayUrl, identity) {
+        const tStart = Date.now();
         const clientNonce = this._crypto.newClientNonce();
-        // Phase 1: 发送 AID + 证书 + 客户端 nonce
-        const phase1 = await this._shortRpc(gatewayUrl, 'auth.aid_login1', {
-            aid: identity.aid,
-            cert: identity.cert,
-            client_nonce: clientNonce,
-        });
-        // 验证 Phase 1 响应（证书链 + 签名）
-        await this._verifyPhase1Response(gatewayUrl, phase1, clientNonce);
-        // Phase 2: 用私钥签名 nonce
-        const [signature, clientTime] = this._crypto.signLoginNonce(String(identity.private_key_pem), String(phase1.nonce));
-        const phase2 = await this._shortRpc(gatewayUrl, 'auth.aid_login2', {
-            aid: identity.aid,
-            request_id: phase1.request_id,
-            nonce: phase1.nonce,
-            client_time: clientTime,
-            signature,
-        });
-        return phase2;
+        this._logger.debug(`_login enter: aid=${identity.aid}`);
+        try {
+            // Phase 1: 发送 AID + 证书 + 客户端 nonce
+            const phase1 = await this._shortRpc(gatewayUrl, 'auth.aid_login1', {
+                aid: identity.aid,
+                cert: identity.cert,
+                client_nonce: clientNonce,
+            });
+            this._logger.debug(`login1 response recv: aid=${identity.aid}, request_id=${phase1.request_id}`);
+            // 验证 Phase 1 响应（证书链 + 签名）
+            await this._verifyPhase1Response(gatewayUrl, phase1, clientNonce);
+            this._logger.debug(`login1 verify ok: aid=${identity.aid}`);
+            // Phase 2: 用私钥签名 nonce
+            const [signature, clientTime] = this._crypto.signLoginNonce(String(identity.private_key_pem), String(phase1.nonce));
+            this._logger.debug(`login2 start: aid=${identity.aid}`);
+            const phase2 = await this._shortRpc(gatewayUrl, 'auth.aid_login2', {
+                aid: identity.aid,
+                request_id: phase1.request_id,
+                nonce: phase1.nonce,
+                client_time: clientTime,
+                signature,
+            });
+            this._logger.debug(`_login exit: elapsed=${Date.now() - tStart}ms aid=${identity.aid}, has_token=${!!phase2.access_token || !!phase2.token}`);
+            return phase2;
+        }
+        catch (err) {
+            this._logger.debug(`_login exit (error): elapsed=${Date.now() - tStart}ms aid=${identity.aid} err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
     }
     /** 刷新 access_token */
     async _refreshAccessToken(gatewayUrl, refreshToken) {
-        const result = await this._shortRpc(gatewayUrl, 'auth.refresh_token', {
-            refresh_token: refreshToken,
-        });
-        if (!result.success) {
-            throw new AuthError(String(result.error || 'refresh failed'));
+        const tStart = Date.now();
+        this._logger.debug(`_refreshAccessToken enter`);
+        try {
+            const result = await this._shortRpc(gatewayUrl, 'auth.refresh_token', {
+                refresh_token: refreshToken,
+            });
+            if (!result.success) {
+                throw new AuthError(String(result.error || 'refresh failed'));
+            }
+            this._logger.debug(`_refreshAccessToken exit: elapsed=${Date.now() - tStart}ms`);
+            return result;
+        }
+        catch (err) {
+            this._logger.debug(`_refreshAccessToken exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
+            throw err;
         }
-        return result;
     }
     /** 会话初始化：发送 auth.connect RPC */
     async _initializeSession(transport, nonce, token, opts) {
+        this._logger.debug(`session init start: deviceId=${opts?.deviceId ?? ''}, slotId=${opts?.slotId ?? ''}`);
         const result = await transport.call('auth.connect', {
             nonce,
             auth: { method: 'kite_token', token },
@@ -697,8 +792,10 @@ export class AuthFlow {
         });
         const status = isJsonObject(result) ? result.status : undefined;
         if (status !== 'ok') {
+            this._logger.error(`sessioninitfailed: status=${status}, result=${JSON.stringify(result)}`);
             throw new AuthError(`initialize failed: ${JSON.stringify(result)}`);
         }
+        this._logger.debug('sessioninitok');
     }
     // ── 内部方法：证书验证 ──────────────────────────────────────
     /**
@@ -732,7 +829,7 @@ export class AuthFlow {
             const errMsg = e instanceof Error ? e.message : String(e);
             if (/revoked/i.test(errMsg))
                 throw e instanceof AuthError ? e : new AuthError(errMsg);
-            this._logger.warn(`CRL 检查不可用，降级继续: ${errMsg}`);
+            this._logger.warn(`CRL verification unavailable, skipping: ${errMsg}`);
         }
         try {
             await this._verifyAuthCertOcsp(gatewayUrl, authCert);
@@ -741,7 +838,7 @@ export class AuthFlow {
             const errMsg = exc instanceof Error ? exc.message : String(exc);
             if (/revoked/i.test(errMsg))
                 throw exc instanceof AuthError ? exc : new AuthError(errMsg);
-            this._logger.warn(`OCSP 校验不可用，降级继续: ${errMsg}`);
+            this._logger.warn(`OCSP verification unavailable, skipping: ${errMsg}`);
         }
         // 验证 client_nonce 签名
         try {
@@ -915,7 +1012,7 @@ export class AuthFlow {
                 revokedSerials = new Set(serialsArr.map((s) => String(s).toLowerCase()));
             }
             // 如果两者都没有，返回空集合（无吊销记录）
-            this._logger.debug('CRL PEM 解析失败，使用 JSON revoked_serials 降级');
+            this._logger.debug('CRL PEM parse failed, using JSON revoked_serials fallback');
         }
         // 缓存 TTL：默认 5 分钟，最大 24 小时
         const now = Date.now();
@@ -1088,7 +1185,7 @@ export class AuthFlow {
             // OCSP DER 解析失败时，降级信赖 JSON status 字段
             if (e instanceof AuthError)
                 throw e;
-            this._logger.debug(`OCSP DER 解析失败，使用 JSON status 降级: ${e instanceof Error ? e.message : String(e)}`);
+            this._logger.debug(`OCSP DER parse failed, using JSON status fallback: ${e instanceof Error ? e.message : String(e)}`);
             if (!status) {
                 throw new AuthError('gateway OCSP endpoint returned invalid response and no status field');
             }
@@ -1359,7 +1456,7 @@ export class AuthFlow {
                     const errMsg = e instanceof Error ? e.message : String(e);
                     if (/revoked/i.test(errMsg))
                         throw e instanceof AuthError ? e : new AuthError(errMsg);
-                    this._logger.warn(`CRL 检查不可用，降级继续: ${errMsg}`);
+                    this._logger.warn(`CRL verification unavailable, skipping: ${errMsg}`);
                 }
                 try {
                     await this._verifyAuthCertOcsp(gatewayUrl, cert);
@@ -1368,7 +1465,7 @@ export class AuthFlow {
                     const errMsg = exc instanceof Error ? exc.message : String(exc);
                     if (/revoked/i.test(errMsg))
                         throw exc instanceof AuthError ? exc : new AuthError(errMsg);
-                    this._logger.warn(`OCSP 校验不可用，降级继续: ${errMsg}`);
+                    this._logger.warn(`OCSP verification unavailable, skipping: ${errMsg}`);
                 }
             }
             // 验证通过，正式接受
@@ -1376,10 +1473,10 @@ export class AuthFlow {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                this._logger.warn(`拒绝服务端返回的 new_cert (${identity.aid}): ${e.message}`);
+                this._logger.warn(`rejected server new_cert (${identity.aid}): ${e.message}`);
             }
             else {
-                this._logger.warn(`new_cert 验证异常 (${identity.aid}): ${e instanceof Error ? e.message : String(e)}`);
+                this._logger.warn(`new_cert verification error (${identity.aid}): ${e instanceof Error ? e.message : String(e)}`);
             }
         }
         // active_cert 同步：验证公钥匹配后更新本地 cert
@@ -1396,12 +1493,12 @@ export class AuthFlow {
                         identity.cert = activeCertPem;
                     }
                     else {
-                        this._logger.warn(`服务端 active_cert 公钥与本地私钥不匹配，拒绝同步 (aid=${identity.aid})`);
+                        this._logger.warn(`active_cert public key mismatch with local private key, rejecting sync (aid=${identity.aid})`);
                     }
                 }
             }
             catch (e) {
-                this._logger.warn(`active_cert 同步异常 (${identity.aid}): ${e instanceof Error ? e.message : String(e)}`);
+                this._logger.warn(`active_cert sync error (${identity.aid}): ${e instanceof Error ? e.message : String(e)}`);
             }
         }
     }