@agentunion/fastaun 0.5.33 → 0.5.35

package/dist/auth.js

@@ -16,7 +16,7 @@ import * as http from 'node:http';
 import * as https from 'node:https';
 import * as path from 'node:path';
 import { URL, fileURLToPath } from 'node:url';
-import { AuthError, StateError, ValidationError, AUNError, mapRemoteError } from './errors.js';
+import { AuthError, ConnectionError, StateError, ValidationError, AUNError, mapRemoteError } from './errors.js';
 import { shortRpcViaNetworkActor } from './transport.js';
 import { isJsonObject, } from './types.js';
 import { VERSION as AUN_SDK_VERSION } from './version.js';
@@ -659,7 +659,7 @@ export class AuthFlow {
         let identity = this._loadIdentityOrRaise(opts?.aid);
         this._logger.debug(`authenticate enter: aid=${identity.aid}, gateway=${gatewayUrl}`);
         try {
-            // 优先复用 tokenStore 里的 cached access_token（未过期且有 refresh_token）
+            // 优先复用 tokenStore 里的 cached access_token（未过期）
             // 避免每次调 authenticate 都走两阶段重登的网络往返
             // 注意：_loadIdentityOrRaise 不带 instance_state（access_token 等），
             // 这里需要主动走 _loadInstanceState 拿到 token
@@ -667,7 +667,7 @@ export class AuthFlow {
             const identityWithState = { ...identity, ...instanceState };
             const cachedToken = AuthFlow._getCachedAccessToken(identityWithState);
             const cachedRefresh = String(identityWithState.refresh_token ?? '');
-            if (cachedToken && cachedRefresh) {
+            if (cachedToken) {
                 // 复用 cached token 前必须验证本地身份完整性：
                 // cert 存在 + cert 公钥 == keypair 公钥 + cert 时间窗口有效。
                 // 任何一项不通过 → 不复用，走两步重登（或抛错）。
@@ -824,7 +824,7 @@ export class AuthFlow {
      */
     async connectSession(transport, challenge, gatewayUrl, opts) {
         const tStart = Date.now();
-        const nonce = this._extractChallengeNonce(challenge);
+        let nonce = this._extractChallengeNonce(challenge);
         const deviceId = String(opts?.deviceId ?? '');
         const slotId = String(opts?.slotId ?? '');
         const deliveryMode = opts?.deliveryMode ?? null;
@@ -832,6 +832,27 @@ export class AuthFlow {
         const shortTtlMs = opts?.shortTtlMs;
         const extraInfo = opts?.extraInfo;
         this.setInstanceContext({ deviceId, slotId });
+        let reconnectRequired = false;
+        const initializeSession = async (token) => {
+            if (reconnectRequired && typeof transport.connect === 'function') {
+                nonce = this._extractChallengeNonce(await transport.connect(gatewayUrl));
+                reconnectRequired = false;
+            }
+            try {
+                return await this._initializeSession(transport, nonce, token, {
+                    deviceId, slotId, deliveryMode, connectionKind, shortTtlMs, extraInfo,
+                });
+            }
+            catch (err) {
+                if (err instanceof AuthError)
+                    reconnectRequired = true;
+                else if (err instanceof ConnectionError && /\bcode=4001\b/.test(err.message)) {
+                    reconnectRequired = true;
+                    throw new AuthError(err.message);
+                }
+                throw err;
+            }
+        };
         this._logger.debug(`connectSession enter: gateway=${gatewayUrl}, device_id=${deviceId}, slot_id=${slotId}, has_explicit_token=${!!opts?.accessToken}, has_challenge_nonce=${!!nonce}`);
         try {
             let identity;
@@ -845,14 +866,7 @@ export class AuthFlow {
             const explicitToken = String(opts?.accessToken || '');
             if (explicitToken && identity !== null) {
                 try {
-                    const hello = await this._initializeSession(transport, nonce, explicitToken, {
-                        deviceId,
-                        slotId,
-                        deliveryMode,
-                        connectionKind,
-                        shortTtlMs,
-                        extraInfo,
-                    });
+                    const hello = await initializeSession(explicitToken);
                     identity.access_token = explicitToken;
                     this._persistIdentity(identity);
                     this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=explicit_token aid=${String(identity.aid ?? '')}`);
@@ -868,29 +882,15 @@ export class AuthFlow {
             if (identity === null) {
                 const authContext = await this.ensureAuthenticated(gatewayUrl);
                 const token = String(authContext.token);
-                const hello = await this._initializeSession(transport, nonce, token, {
-                    deviceId,
-                    slotId,
-                    deliveryMode,
-                    connectionKind,
-                    shortTtlMs,
-                    extraInfo,
-                });
+                const hello = await initializeSession(token);
                 this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=ensure_authenticated aid=${String(authContext.identity?.aid ?? '')}`);
                 return { ...authContext, hello };
             }
             // 策略 2：缓存的 access_token
             const cachedToken = AuthFlow._getCachedAccessToken(identity);
-            if (cachedToken) {
+            if (cachedToken && cachedToken !== explicitToken) {
                 try {
-                    const hello = await this._initializeSession(transport, nonce, cachedToken, {
-                        deviceId,
-                        slotId,
-                        deliveryMode,
-                        connectionKind,
-                        shortTtlMs,
-                        extraInfo,
-                    });
+                    const hello = await initializeSession(cachedToken);
                     this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=cached_token aid=${String(identity.aid ?? '')}`);
                     return { token: cachedToken, identity, hello };
                 }
@@ -907,14 +907,7 @@ export class AuthFlow {
                     identity = await this.refreshCachedTokens(gatewayUrl, identity);
                     const newCachedToken = AuthFlow._getCachedAccessToken(identity);
                     if (newCachedToken) {
-                        const hello = await this._initializeSession(transport, nonce, newCachedToken, {
-                            deviceId,
-                            slotId,
-                            deliveryMode,
-                            connectionKind,
-                            shortTtlMs,
-                            extraInfo,
-                        });
+                        const hello = await initializeSession(newCachedToken);
                         this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=refresh_token aid=${String(identity.aid ?? '')}`);
                         return { token: newCachedToken, identity, hello };
                     }
@@ -934,14 +927,7 @@ export class AuthFlow {
             if (!token) {
                 throw new AuthError('authenticate did not return access_token');
             }
-            const hello = await this._initializeSession(transport, nonce, token, {
-                deviceId,
-                slotId,
-                deliveryMode,
-                connectionKind,
-                shortTtlMs,
-                extraInfo,
-            });
+            const hello = await initializeSession(token);
             identity = this.loadIdentity(identity.aid);
             this._logger.debug(`connectSession exit: elapsed=${Date.now() - tStart}ms strategy=full_reauth aid=${String(identity?.aid ?? '')}`);
             return { token, identity, hello };
@@ -1562,8 +1548,12 @@ export class AuthFlow {
             agent_md_validation_v1: true,
             p2p_peer_pull_v1: true,
             gateway_migrate_v1: true,
+            elastic_connections_v1: true,
+            sync_channels_v1: true,
             ...(this._requestAdmission && this._verifySsl && this._riskCapabilityEnabled?.() ? { risk_test_v1: true } : {}),
         };
+        if (connectionKind !== 'long' || typeof extraInfoRaw?._sync_parent === 'string' || capabilities.udp_standby_v1 !== true)
+            delete capabilities.udp_standby_v1;
         const request = {
             nonce,
             auth: { method: 'kite_token', token },
@@ -1592,6 +1582,10 @@ export class AuthFlow {
         // 长短连接选项：默认 long 时不写入 options（保持 wire 兼容）
         if (connectionKind === 'short') {
             const options = { kind: 'short' };
+            if (typeof extraInfoRaw?._sync_parent === 'string') {
+                options.purpose = 'history_sync';
+                options.parent_connection_id = extraInfoRaw._sync_parent;
+            }
             const ttl = Number(opts?.shortTtlMs ?? 0);
             if (ttl > 0) {
                 options.short_ttl_ms = ttl;