@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/capabilities/session/ctrip-city.js

@@ -0,0 +1,186 @@
+/** Public supplier city metadata, independent of inventory and account sessions. */
+export const CTRIP_CITY_CATALOG_URL = 'https://m.ctrip.com/restapi/soa2/17909/SearchBoxRecommend';
+export const CTRIP_CITY_SUGGEST_URL = 'https://flights.ctrip.com/international/search/api/poi/search';
+export const CTRIP_HOTEL_CITY_URL = 'https://m.ctrip.com/restapi/soa2/34951/getHotelKeywords';
+const normalized = (s) => s.normalize('NFKC').trim().replace(/^中国(?=香港|澳门)/, '').toLowerCase();
+const text = (v) => typeof v === 'string' ? v.trim() : '';
+const code = (v) => /^[a-z]{3}$/i.test(text(v)) ? text(v).toUpperCase() : undefined;
+const object = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+export function parseCtripCityCatalog(value) {
+    const root = object(value);
+    if (object(root.ResponseStatus).Ack !== 'Success' || object(root.responseHead).errorCode !== '0' || !Array.isArray(root.recommendGroupList))
+        throw new Error('unrecognized city catalog');
+    const records = [];
+    let visited = 0;
+    const walk = (v, depth = 0) => {
+        if (++visited > 20_000 || depth > 12)
+            throw new Error('city catalog bounds');
+        if (Array.isArray(v)) {
+            for (const item of v)
+                walk(item, depth + 1);
+            return;
+        }
+        const r = object(v), c = code(r.code), name = text(r.name);
+        if (c && name && Number(r.id) > 0) {
+            records.push({ name, code: c, aliases: [name, text(r.eName), text(r.nameEn), text(r.namePy), text(r.specName)].filter(Boolean), context: text(r.specName) || undefined, requiresQualification: r.sameSpecCity === 1 });
+            if (Array.isArray(r.airportlst))
+                for (const item of r.airportlst) {
+                    const a = object(item), ac = code(a.code), an = text(a.name);
+                    if (ac && an)
+                        records.push({ name: an, code: ac, aliases: [an], context: name, airport: true });
+                }
+        }
+        for (const [key, child] of Object.entries(r))
+            if (key !== 'airportlst' && child && typeof child === 'object')
+                walk(child, depth + 1);
+    };
+    walk(root.recommendGroupList);
+    return records;
+}
+export function parseCtripCitySuggestions(value) {
+    const root = object(value);
+    if (!Array.isArray(root.Data))
+        throw new Error('unrecognized city suggestions');
+    const records = [];
+    let visited = 0;
+    const walk = (items, depth = 0) => {
+        if (depth > 5)
+            throw new Error('city suggestion bounds');
+        for (const value of items) {
+            if (++visited > 2_000)
+                throw new Error('city suggestion bounds');
+            const r = object(value), c = code(r.Code), name = text(r.Name);
+            if (c && name && [3, 4, 5].includes(Number(r.Type)))
+                records.push({
+                    name, code: c, aliases: [name, text(r.EName), text(r.NameAlias), text(r.ShortSpell)].filter(Boolean),
+                    context: [text(r.Country), text(r.Province)].filter(Boolean).join(' / ') || undefined, airport: Number(r.Type) === 3,
+                });
+            if (Array.isArray(r.Datas))
+                walk(r.Datas, depth + 1);
+            // Nearby cities must not be substituted for the requested destination.
+        }
+    };
+    walk(root.Data);
+    return records;
+}
+export function matchCtripCity(query, records) {
+    const input = normalized(query);
+    const matches = records.filter(r => r.code.toLowerCase() === input || r.aliases.some(a => normalized(a) === input));
+    const unique = [...new Map(matches.map(r => [`${r.code}:${r.context ?? ''}`, r])).values()];
+    // A city and its airport may share one code. An explicitly typed code remains exact.
+    const codes = new Set(unique.map(r => r.code));
+    if (codes.size === 1 && /^[a-z]{3}$/i.test(query.trim()))
+        return { ok: true, city: unique[0] };
+    if (unique.length === 1 && (!unique[0].requiresQualification || normalized(unique[0].context ?? '') === input))
+        return { ok: true, city: unique[0] };
+    return { ok: false, reason: unique.length ? 'ambiguous' : 'not-found', candidates: unique.slice(0, 8) };
+}
+async function readMetadata(url, init, fetcher) {
+    const response = await fetcher(url, { ...init, signal: AbortSignal.timeout(8_000), redirect: 'error' });
+    if (!response.ok || !response.body)
+        throw new Error('city metadata unavailable');
+    const reader = response.body.getReader(), chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > 512_000)
+                throw new Error('city metadata bounds');
+            chunks.push(value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+}
+let catalog;
+const catalogBody = {
+    head: { cver: '3', cid: '', extension: [{ name: 'source', value: 'ONLINE' }, { name: 'sotpGroup', value: 'CTrip' }, { name: 'sotpLocale', value: 'zh-CN' }] },
+    locale: 'zh-CN', departureCity: '', dataType: 0,
+};
+export async function resolveCtripFlightCity(query, fetcher = fetch) {
+    if (!query.trim() || query.length > 120)
+        return { ok: false, reason: 'not-found', candidates: [] };
+    if (fetcher === fetch && process.env.GOTRY_SESSION_LIVE === '0')
+        return { ok: false, reason: 'unavailable', candidates: [] };
+    try {
+        const load = () => readMetadata(CTRIP_CITY_CATALOG_URL, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(catalogBody) }, fetcher).then(parseCtripCityCatalog);
+        let records;
+        if (fetcher !== fetch)
+            records = await load();
+        else {
+            if (!catalog || Date.now() - catalog.at > 3_600_000)
+                catalog = { at: Date.now(), promise: load() };
+            try {
+                records = await catalog.promise;
+            }
+            catch {
+                catalog = undefined;
+                records = [];
+            }
+        }
+        const matched = matchCtripCity(query, records);
+        if (matched.ok || matched.reason === 'ambiguous')
+            return matched;
+        const url = new URL(CTRIP_CITY_SUGGEST_URL);
+        url.searchParams.set('key', query.trim().toUpperCase());
+        url.searchParams.set('filterAirport', 'false');
+        return matchCtripCity(query, parseCtripCitySuggestions(await readMetadata(url.href, {}, fetcher)));
+    }
+    catch {
+        return { ok: false, reason: 'unavailable', candidates: [] };
+    }
+}
+export function cityResolutionHint(query, result) {
+    if (result.reason === 'ambiguous')
+        return `城市「${query}」有多个候选，请确认城市或机场码：${result.candidates.map(c => `${c.name} ${c.code}${c.context ? `（${c.context}）` : ''}`).join('；')}`;
+    return `unresolved 城市「${query}」：${result.reason === 'unavailable' ? '携程城市解析服务暂不可用' : '供应商城市候选未精确匹配'}；请确认城市／机场名称，或提供 fromCityCode／toCityCode。城市解析失败不能证明该航线无库存或不受支持。`;
+}
+export function parseCtripHotelCities(value) {
+    const root = object(value), data = object(root.data), keywords = object(data.mainKeywordList).keywords;
+    if (object(root.ResponseStatus).Ack !== 'Success' || data.htlSpiderActionErrorCode || !Array.isArray(keywords) || keywords.length > 1_000)
+        throw new Error('hotel city metadata unavailable');
+    const records = [];
+    for (const item of keywords) {
+        const r = object(item), k = object(object(r.keyword).keywordContentInfo), region = object(object(r.controlInfo).regionInfo);
+        const display = object(region.displayCityModel), basic = object(region.basicCityModel), id = String(basic.cityId ?? '');
+        if (k.tripType !== 'CT' || !/^[1-9]\d{0,9}$/.test(id))
+            continue;
+        if (k.keywordCode !== undefined && String(k.keywordCode) !== id)
+            throw new Error('hotel city ID conflict');
+        const titles = Array.isArray(k.displayTexts) ? k.displayTexts.map(object).filter(t => t.key === 'MAIN_TITLE').map(t => text(t.value)) : [];
+        const name = text(display.cityName) || text(display.destinationName);
+        if (!name)
+            continue;
+        records.push({ id, name, aliases: [name, text(display.destinationName), text(display.destinationNameEN), ...titles].filter(Boolean),
+            countries: [text(display.countryName), text(display.countryNameEN)].filter(Boolean),
+            context: [text(display.countryName), text(display.provinceName)].filter(Boolean).join(' / ') });
+    }
+    return records;
+}
+export async function resolveCtripHotelCity(query, country, fetcher = fetch) {
+    if (!query.trim() || query.length > 120 || (country?.length ?? 0) > 120)
+        return { ok: false, reason: 'not-found', candidates: [] };
+    if (fetcher === fetch && process.env.GOTRY_SESSION_LIVE === '0')
+        return { ok: false, reason: 'unavailable', candidates: [] };
+    try {
+        const value = await readMetadata(CTRIP_HOTEL_CITY_URL, { method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ head: { platform: 'PC', bu: 'HBU', group: 'ctrip', locale: 'zh-CN' }, queryInfo: { keyword: query.trim(), actionType: 'destination' } }) }, fetcher);
+        const input = normalized(query);
+        const candidates = parseCtripHotelCities(value).filter(c => (!country || c.countries.some(a => normalized(a) === normalized(country))) && c.aliases.some(a => normalized(a) === input));
+        const unique = [...new Map(candidates.map(c => [c.id, c])).values()];
+        return unique.length === 1 ? { ok: true, city: unique[0] } : { ok: false, reason: unique.length ? 'ambiguous' : 'not-found', candidates: unique.slice(0, 8) };
+    }
+    catch {
+        return { ok: false, reason: 'unavailable', candidates: [] };
+    }
+}
+export function hotelResolutionHint(query, result) {
+    if (result.reason === 'ambiguous')
+        return `城市「${query}」有多个候选，请确认国家或城市：${result.candidates.map(c => `${c.name}（${c.context}，cityId=${c.id}）`).join('；')}`;
+    return `城市「${query}」${result.reason === 'unavailable' ? '的携程酒店城市解析服务暂不可用' : '未精确匹配供应商城市候选'}；可提供 country 消歧，或携程酒店 list 页 city= 数字作为 cityId。城市解析失败不能证明目的地不受支持。`;
+}

package/dist/capabilities/session/extension-bridge.js

@@ -19,12 +19,22 @@
  *   POST /results/:jobId   → 善果/失败回传(≤8MB;batchSearch ~550KB)
  * 语义:桥不存在即整个扩展车道不存在——fail-closed 不变量在调用方(session-search 的 needs-extension)。
  * 审计:job 提交/回传写 GuardAuditEntry 同款 JSONL(kind:'extension-session-job',channel 层负责)。
+ *
+ * AaaS A2(#674,威胁 S-5)组织维度:作业、取活者(parked/长轮询)、在飞作业、心跳时刻、节律、
+ * 事件都属于恰好一个组织。作业匹配要求组织严格相等(先于 origin/clientId/站点 capability 判定);
+ * 另一个组织的回包与「未知作业」一模一样地 404 且**不落任何行**,在飞作业纹丝不动。
+ * 取活者的组织只由挂载宿主在鉴权之后经 `handleMountedRequest(req, res, { organization })`
+ * 传入,**从不读请求体或请求头**;不传 = 缺省 `local`(桌面 loopback 桥与既有调用方行为逐字不变)。
+ * 发给扩展的 ExtensionJob 线上形状不变:组织只活在队列内部条目与账本列里。
  */
 import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createServer } from 'node:http';
+import { assertOrganizationId } from '../../src/tenant-state/ids.js';
+/** 缺省组织 = 今天的单车道:不传组织的调用方(桌面 loopback 桥、既有测试)都落在这里 */
+export const BRIDGE_DEFAULT_ORGANIZATION = 'local';
 /** 桥端口池(extension/manifest.json host_permissions 必须同面;§38 断言) */
 export const BRIDGE_PORTS = [8791, 8792, 8793, 8794, 8795];
 export const BRIDGE_PROTOCOL = 'session-bridge.v1';
@@ -82,7 +92,10 @@ export const DEFAULT_EXTENSION_WAIT_MS = 6_000;
 export const MAX_RESULT_BODY_BYTES = 8 * 1024 * 1024;
 /** 扩展客户端标识形状(每 SW 生命周期一个 crypto.randomUUID);导出供事件上行端点(批次 B)同链校验 */
 export const CLIENT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function jobMatches(entry, capabilities, origin, clientId) {
+function jobMatches(entry, capabilities, origin, clientId, organization) {
+    // 组织严格相等先于一切:站点/origin/clientId 全部吻合的另一个组织的取活者,也永远领不到这个作业
+    if (entry.organization !== organization)
+        return false;
     if (entry.preferredOrigin && entry.preferredOrigin !== origin)
         return false;
     if (entry.preferredClientId && entry.preferredClientId !== clientId)
@@ -121,6 +134,16 @@ const NAVIGATION_JOB_KINDS = new Set(['search', 'open-login']);
 export function isNavigationJobKind(kind) {
     return NAVIGATION_JOB_KINDS.has(kind);
 }
+/** 组织 id 是否合法(assertOrganizationId 的布尔形式;非法组织一律在碰任何状态之前被拒) */
+export function isBridgeOrganization(value) {
+    try {
+        assertOrganizationId(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function createBridgeJobQueue(opts = {}) {
     const extensionOrigins = new Set(opts.extensionOrigins ?? EXTENSION_ORIGINS);
     const now = opts.now ?? Date.now;
@@ -128,9 +151,13 @@ export function createBridgeJobQueue(opts = {}) {
     const queue = [];
     const inFlight = new Map();
     const parked = [];
-    let lastSeenAt = 0;
+    // 心跳时刻按组织分开记:一个组织的扩展在线,不代表另一个组织的扩展在线
+    const lastSeenAt = new Map();
     let closed = false;
-    const extensionConnected = () => lastSeenAt > 0 && now() - lastSeenAt < EXTENSION_CONNECTED_WINDOW_MS;
+    const extensionConnected = (organization = BRIDGE_DEFAULT_ORGANIZATION) => {
+        const seen = lastSeenAt.get(assertOrganizationId(organization)) ?? 0;
+        return seen > 0 && now() - seen < EXTENSION_CONNECTED_WINDOW_MS;
+    };
     /**
      * 账本写兜底:持久面故障不得打断桥协议主路径(write-before-submit 的 INSERT 除外,
      * 它在 submit 里直接决定提交成败)。stderr 留痕,作业照常流转。
@@ -146,48 +173,69 @@ export function createBridgeJobQueue(opts = {}) {
         }
     };
     /** 领走首个 capability 匹配的 job(移入 inFlight——回包按 jobId 路由,两处都可找到) */
-    function takeMatching(capabilities, origin, clientId) {
-        const idx = queue.findIndex((q) => jobMatches(q, capabilities, origin, clientId));
+    function takeMatching(capabilities, origin, clientId, organization) {
+        const idx = queue.findIndex((q) => jobMatches(q, capabilities, origin, clientId, organization));
         if (idx < 0)
             return null;
         const [next] = queue.splice(idx, 1);
         next.claimedOrigin = origin;
         next.claimedClientId = clientId;
         inFlight.set(next.job.jobId, next);
-        record('markClaimed', () => store.markClaimed(next.job.jobId, { origin, clientId }));
+        record('markClaimed', () => store.markClaimed(next.organization, next.job.jobId, { origin, clientId }));
         if (isNavigationJobKind(next.job.kind))
-            record('noteSiteHit', () => store.noteSiteHit(next.job.site));
+            record('noteSiteHit', () => store.noteSiteHit(next.organization, next.job.site));
         return next;
     }
     /** 扩展回包:queued 与 inFlight 两处都可寻址(job 执行失败 = result.ok:false,桥自身不吞) */
-    function resolveJob(jobId, parsed) {
+    function resolveJob(organization, jobId, parsed) {
         const inFlightHit = inFlight.get(jobId);
         if (inFlightHit) {
+            // 第二道防线:回包处理已把别的组织的 jobId 按「未知作业」挡在外面,这里再不认一次
+            if (inFlightHit.organization !== organization)
+                return;
             inFlight.delete(jobId);
             if (inFlightHit.timer)
                 clearTimeout(inFlightHit.timer);
-            record('markResolved', () => store.markResolved(jobId, parsed));
+            record('markResolved', () => store.markResolved(inFlightHit.organization, jobId, parsed));
             record('client-login-site', () => {
                 const names = Array.isArray(parsed.names) ? parsed.names : [];
                 if (parsed.ok === true && inFlightHit.job.kind === 'cookie-names' && names.length > 0 && inFlightHit.claimedClientId) {
-                    store.recordClientLoginSite(inFlightHit.claimedClientId, inFlightHit.job.site);
+                    store.recordClientLoginSite(inFlightHit.organization, inFlightHit.claimedClientId, inFlightHit.job.site);
                 }
             });
             inFlightHit.resolve({ ok: true, result: parsed, origin: inFlightHit.claimedOrigin, clientId: inFlightHit.claimedClientId });
             return;
         }
-        const idx = queue.findIndex((q) => q.job.jobId === jobId);
+        const idx = queue.findIndex((q) => q.job.jobId === jobId && q.organization === organization);
         if (idx < 0)
             return;
         const [entry] = queue.splice(idx, 1);
         if (entry.timer)
             clearTimeout(entry.timer);
-        record('markResolved', () => store.markResolved(jobId, parsed));
+        record('markResolved', () => store.markResolved(entry.organization, jobId, parsed));
         entry.resolve({ ok: true, result: parsed });
     }
+    /**
+     * 这个 jobId 属于另一个组织吗(内存里的排队/在飞条目,或账本里的行)?回包处理用它在**一切写入之前**
+     * 把别的组织的回包挡掉。读不了账本就证明不了「它不属于别的组织」,宁可当作属于(不落孤儿行)。
+     */
+    function belongsToAnotherOrganization(jobId, organization) {
+        const held = inFlight.get(jobId) ?? queue.find((q) => q.job.jobId === jobId);
+        if (held)
+            return held.organization !== organization;
+        if (!store)
+            return false;
+        try {
+            const owner = store.organizationOfJob(jobId);
+            return owner !== null && owner !== organization;
+        }
+        catch {
+            return true;
+        }
+    }
     /** 新 job 入队时即时派发给 capability 匹配的 parked 取活者(否则要白等一个 20s 长轮询周期) */
     function dispatchToParked(entry) {
-        const i = parked.findIndex((p) => jobMatches(entry, p.capabilities, p.origin, p.clientId));
+        const i = parked.findIndex((p) => jobMatches(entry, p.capabilities, p.origin, p.clientId, p.organization));
         if (i < 0)
             return false;
         const [p] = parked.splice(i, 1);
@@ -195,20 +243,24 @@ export function createBridgeJobQueue(opts = {}) {
         entry.claimedOrigin = p.origin;
         entry.claimedClientId = p.clientId;
         inFlight.set(entry.job.jobId, entry);
-        record('markClaimed', () => store.markClaimed(entry.job.jobId, { origin: p.origin, clientId: p.clientId }));
+        record('markClaimed', () => store.markClaimed(entry.organization, entry.job.jobId, { origin: p.origin, clientId: p.clientId }));
         if (isNavigationJobKind(entry.job.kind))
-            record('noteSiteHit', () => store.noteSiteHit(entry.job.site));
+            record('noteSiteHit', () => store.noteSiteHit(entry.organization, entry.job.site));
         p.res.statusCode = 200;
         p.res.setHeader('content-type', 'application/json');
         p.res.end(JSON.stringify({ job: entry.job }));
         return true;
     }
-    const stats = () => ({
-        queued: queue.length,
-        inFlight: inFlight.size,
-        parked: parked.length,
-        lastSeenMsAgo: lastSeenAt > 0 ? now() - lastSeenAt : null,
-    });
+    const stats = (organization = BRIDGE_DEFAULT_ORGANIZATION) => {
+        const org = assertOrganizationId(organization);
+        const seen = lastSeenAt.get(org) ?? 0;
+        return {
+            queued: queue.filter((q) => q.organization === org).length,
+            inFlight: [...inFlight.values()].filter((q) => q.organization === org).length,
+            parked: parked.filter((p) => p.organization === org).length,
+            lastSeenMsAgo: seen > 0 ? now() - seen : null,
+        };
+    };
     /**
      * 结算器(submit 与 recoverOnBoot 复活条目共用):内存三态清理 + 账本终态落笔。
      * 幂等护栏(settled 标记)防 waitTimer 兜底在 resolved 之后二次结算把账本写花。
@@ -233,19 +285,19 @@ export function createBridgeJobQueue(opts = {}) {
             if (store && !outcome.ok) {
                 if (outcome.reason === 'timeout') {
                     if (wasClaimed) {
-                        record('markUnresolved', () => store.markUnresolved(entry.job.jobId, { reason: 'timeout' }));
+                        record('markUnresolved', () => store.markUnresolved(entry.organization, entry.job.jobId, { reason: 'timeout' }));
                         if (isNavigationJobKind(entry.job.kind))
-                            record('applyCooldown', () => store.applyCooldown(entry.job.site));
+                            record('applyCooldown', () => store.applyCooldown(entry.organization, entry.job.site));
                     }
                     else {
-                        record('markVoid', () => store.markVoid(entry.job.jobId));
+                        record('markVoid', () => store.markVoid(entry.organization, entry.job.jobId));
                     }
                 }
                 else if (outcome.reason === 'extension-not-connected') {
-                    record('markVoid', () => store.markVoid(entry.job.jobId));
+                    record('markVoid', () => store.markVoid(entry.organization, entry.job.jobId));
                 }
                 else if (!wasClaimed) {
-                    record('markVoid', () => store.markVoid(entry.job.jobId));
+                    record('markVoid', () => store.markVoid(entry.organization, entry.job.jobId));
                 }
             }
             deliver?.(outcome);
@@ -272,6 +324,11 @@ export function createBridgeJobQueue(opts = {}) {
             return summary;
         }
         for (const row of pending) {
+            // 行里的组织必须是合法 id:被改坏的行还原不出所属组织,留在原地不派发(fail-closed),绝不猜成 local
+            if (!isBridgeOrganization(row.organization)) {
+                process.stderr.write(`[bridge] 账本恢复跳过组织非法的作业 ${row.id}\n`);
+                continue;
+            }
             const expired = row.timeout_at !== null && row.timeout_at <= now();
             let job = null;
             try {
@@ -284,6 +341,7 @@ export function createBridgeJobQueue(opts = {}) {
                 if (!expired && job) {
                     const entry = {
                         job,
+                        organization: row.organization,
                         resolve: null,
                         timer: null,
                         claimedOrigin: row.claimed_origin ?? undefined,
@@ -297,9 +355,9 @@ export function createBridgeJobQueue(opts = {}) {
                     summary.rehydratedInFlight++;
                 }
                 else {
-                    record('markUnresolved', () => store.markUnresolved(row.id, { reason: 'timeout' }));
+                    record('markUnresolved', () => store.markUnresolved(row.organization, row.id, { reason: 'timeout' }));
                     if (isNavigationJobKind(row.kind))
-                        record('applyCooldown', () => store.applyCooldown(row.site));
+                        record('applyCooldown', () => store.applyCooldown(row.organization, row.site));
                     summary.settledUnresolved++;
                 }
             }
@@ -307,6 +365,7 @@ export function createBridgeJobQueue(opts = {}) {
                 if (!expired && job) {
                     const entry = {
                         job,
+                        organization: row.organization,
                         resolve: null,
                         timer: null,
                     };
@@ -319,7 +378,7 @@ export function createBridgeJobQueue(opts = {}) {
                     summary.requeued++;
                 }
                 else {
-                    record('markVoid', () => store.markVoid(row.id));
+                    record('markVoid', () => store.markVoid(row.organization, row.id));
                     summary.voidedStale++;
                 }
             }
@@ -331,8 +390,19 @@ export function createBridgeJobQueue(opts = {}) {
      * 为挂载形态(查询式 results——gotry-backend 内核只支持精确路由,jobId 走 query)。
      * Origin 白名单校验内置于两种形态(远程形态同样强制:网页跨域请求必带邪恶 Origin)。
      */
-    function makeHandler(prefix, resultsViaQuery, statusExtra) {
-        return (req, res) => {
+    function makeHandler(prefix, resultsViaQuery, mounted, statusExtra) {
+        return (req, res, caller) => {
+            // 组织只来自挂载宿主在鉴权之后传入的 caller(loopback 桥恒为 local),**从不读请求体或请求头**;
+            // 非法组织先于一切 403,不碰任何状态
+            // 传了 caller 就必须带合法组织(缺字段/null 也算非法,绝不悄悄回落成 local);没传 caller = 单车道
+            const requested = mounted ? (caller === undefined ? BRIDGE_DEFAULT_ORGANIZATION : caller.organization) : BRIDGE_DEFAULT_ORGANIZATION;
+            if (!isBridgeOrganization(requested)) {
+                res.statusCode = 403;
+                res.setHeader('content-type', 'application/json');
+                res.end(JSON.stringify({ ok: false, error: 'organization-invalid' }));
+                return;
+            }
+            const organization = requested;
             if (closed) {
                 res.statusCode = 503;
                 res.end();
@@ -354,7 +424,7 @@ export function createBridgeJobQueue(opts = {}) {
             // 一切携带白名单扩展 Origin 的请求都刷新 lastSeen,否则 45s 后误判扩展掉线;
             // 无 Origin 的诊断 GET(/health /status)不记心跳,curl 探活不能伪造「扩展在线」
             if (originTrusted) {
-                lastSeenAt = now();
+                lastSeenAt.set(organization, now());
             }
             const finish = (code, body) => {
                 res.statusCode = code;
@@ -367,8 +437,8 @@ export function createBridgeJobQueue(opts = {}) {
             }
             if (req.method === 'GET' && path === '/status') {
                 finish(200, {
-                    ok: true, protocol: BRIDGE_PROTOCOL, ...stats(),
-                    extensionConnected: extensionConnected(),
+                    ok: true, protocol: BRIDGE_PROTOCOL, ...stats(organization),
+                    extensionConnected: extensionConnected(organization),
                     ...(statusExtra ? statusExtra() : {}),
                 });
                 return;
@@ -393,16 +463,16 @@ export function createBridgeJobQueue(opts = {}) {
                     })();
                     // 客户端注册落账(store 形态):轮询即刷新 origin/capabilities/last_seen(bridge_clients upsert)
                     if (pollerInfo.clientId) {
-                        record('upsertClient', () => store.upsertClient(pollerInfo.clientId, origin, [...(pollerInfo.capabilities ?? [])]));
+                        record('upsertClient', () => store.upsertClient(organization, pollerInfo.clientId, origin, [...(pollerInfo.capabilities ?? [])]));
                     }
-                    const next = takeMatching(pollerInfo.capabilities, origin, pollerInfo.clientId);
+                    const next = takeMatching(pollerInfo.capabilities, origin, pollerInfo.clientId, organization);
                     if (next) {
                         finish(200, { job: next.job });
                         return;
                     }
                     // 长轮询:hold ≤ JOBS_LONG_POLL_MS(必须 < MV3 SW 30s 存活窗口,每次响应都续命);
                     // 新 job 提交时即时唤醒 parked 取活者(见 dispatchToParked)
-                    const poller = { res, timer: null, capabilities: pollerInfo.capabilities, origin: origin, clientId: pollerInfo.clientId };
+                    const poller = { res, timer: null, capabilities: pollerInfo.capabilities, origin: origin, clientId: pollerInfo.clientId, organization };
                     const parkTimer = setTimeout(() => {
                         const i = parked.findIndex((p) => p.res === res);
                         if (i >= 0)
@@ -446,6 +516,13 @@ export function createBridgeJobQueue(opts = {}) {
                         finish(400, { ok: false, error: '回包不是 JSON' });
                         return;
                     }
+                    // 组织边界先于一切(含下面的 Origin/客户端校验):jobId 在内存或账本里属于另一个组织,
+                    // 就答得与未知作业一模一样(404 unknown-job),但**什么都不写**——不落孤儿行、不动在飞作业
+                    // (它自己的合法回包照常闭环),也不泄露「这个 id 存在」。
+                    if (belongsToAnotherOrganization(jobId, organization)) {
+                        finish(404, { ok: false, error: 'unknown-job' });
+                        return;
+                    }
                     const assigned = inFlight.get(jobId);
                     if (assigned?.claimedOrigin && assigned.claimedOrigin !== origin) {
                         finish(403, { ok: false, error: '作业由另一扩展 Origin 领取' });
@@ -458,14 +535,14 @@ export function createBridgeJobQueue(opts = {}) {
                     // 未知 jobId(批次 A):不再 200 静默丢弃——404 明示,孤儿回包内容落账
                     // (status='unresolved',result_json 保留)供对账。扩展 postResult 本就有
                     // catch 且不检查状态码(extension/background.js),协议兼容零改动。
-                    const known = assigned !== undefined || queue.some((q) => q.job.jobId === jobId);
+                    const known = assigned !== undefined || queue.some((q) => q.job.jobId === jobId && q.organization === organization);
                     if (!known) {
-                        record('orphan-result', () => store.recordOrphanResult(jobId, parsed));
+                        record('orphan-result', () => store.recordOrphanResult(organization, jobId, parsed));
                         finish(404, { ok: false, error: 'unknown-job' });
                         return;
                     }
                     finish(200, { ok: true });
-                    resolveJob(jobId, parsed);
+                    resolveJob(organization, jobId, parsed);
                 });
                 return;
             }
@@ -476,14 +553,31 @@ export function createBridgeJobQueue(opts = {}) {
         port: 0,
         extensionConnected,
         stats,
-        handleRequest: makeHandler('', false),
-        handleMountedRequest: makeHandler('/v1/session/bridge', true),
+        forOrganization(organization) {
+            const bound = assertOrganizationId(organization);
+            return {
+                get port() { return queueHandle.port; },
+                extensionConnected: () => extensionConnected(bound),
+                // 先展开调用方的选项、再盖上绑定的组织:下游传什么 organization 都改不了提交去向
+                submit: (job, submitOpts) => queueHandle.submit(job, { ...submitOpts, organization: bound }),
+                // 句柄只是视图,共享队列的生命周期归创建它的宿主
+                close: () => Promise.resolve(),
+            };
+        },
+        handleRequest: makeHandler('', false, false),
+        handleMountedRequest: makeHandler('/v1/session/bridge', true, true),
         ...(store ? { recoverOnBoot } : {}),
         submit(job, submitOpts = {}) {
             const extensionWaitMs = submitOpts.extensionWaitMs ?? DEFAULT_EXTENSION_WAIT_MS;
             const timeoutMs = submitOpts.timeoutMs ?? job.timeoutMs ?? 30_000;
             const full = { jobId: randomUUID(), ...job };
             return new Promise((resolve) => {
+                // 组织只能是合法 id:非法的在碰账本/队列之前就失败(fail-closed)
+                const organization = submitOpts.organization === undefined ? BRIDGE_DEFAULT_ORGANIZATION : submitOpts.organization;
+                if (!isBridgeOrganization(organization)) {
+                    resolve({ ok: false, reason: 'bridge-unavailable', summary: '指定的组织标识无效' });
+                    return;
+                }
                 if (closed) {
                     resolve({ ok: false, reason: 'bridge-unavailable', summary: '扩展桥已关闭' });
                     return;
@@ -500,20 +594,27 @@ export function createBridgeJobQueue(opts = {}) {
                 // 绝不派发无账作业。桌面纯内存形态此步整体跳过,行为零变化。
                 if (store) {
                     try {
-                        store.insertQueuedJob(full, now() + timeoutMs);
+                        store.insertQueuedJob(organization, full, now() + timeoutMs);
                     }
                     catch (e) {
                         resolve({ ok: false, reason: 'bridge-unavailable', summary: `桥账本写入失败,作业不入队:${e instanceof Error ? e.message : String(e)}` });
                         return;
                     }
                     if (isNavigationJobKind(full.kind))
-                        record('noteSiteHit', () => store.noteSiteHit(full.site));
+                        record('noteSiteHit', () => store.noteSiteHit(organization, full.site));
                 }
-                const entry = { job: full, resolve: null, timer: null, preferredOrigin: submitOpts.preferredOrigin, preferredClientId: submitOpts.preferredClientId };
+                const entry = { job: full, organization, resolve: null, timer: null, preferredOrigin: submitOpts.preferredOrigin, preferredClientId: submitOpts.preferredClientId };
                 const settle = armSettle(entry, resolve);
                 entry.resolve = settle;
                 entry.timer = setTimeout(() => {
-                    settle({ ok: false, reason: 'timeout', summary: `扩展未在 ${timeoutMs}ms 内回包(标签页无嗅探命中或扩展已停用)` });
+                    const stage = entry.claimedOrigin === undefined ? 'queued' : 'claimed';
+                    const task = full.kind === 'cookie-names' ? '登录态检查' : full.kind === 'search' ? '检索' : '登录页打开';
+                    settle({
+                        ok: false, reason: 'timeout', jobKind: full.kind, stage,
+                        summary: stage === 'queued'
+                            ? `扩展${task}等待领取超时（${timeoutMs}ms）；尚未执行，请检查扩展是否支持当前站点或正在处理其他作业`
+                            : `扩展${task}已领取但未在 ${timeoutMs}ms 内回传；请检查扩展运行错误与桥连接`,
+                    });
                 }, timeoutMs);
                 if (!dispatchToParked(entry))
                     queue.push(entry);
@@ -521,7 +622,7 @@ export function createBridgeJobQueue(opts = {}) {
                 let waited = 0;
                 const waitTimer = setInterval(() => {
                     waited += 250;
-                    if (queueHandle.extensionConnected()) {
+                    if (extensionConnected(organization)) {
                         clearInterval(waitTimer);
                         return;
                     }