@msdongcha/auth-kit 0.0.1 → 0.0.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## Unreleased
+
+## 0.0.3 - 2026-10-23
+
+- `logout()` 在清理本地 TokenStore 前调用 IAM `/api/v1/auth/logout` 撤销 refresh token，并返回明确的 `LOGOUT_FAILED` 错误。
+- 新增 `getMemberships()`，以统一类型返回当前用户的租户成员列表。
+- 新增 `switchTenant()`，在服务端返回完整 token 后原子切换会话，并保护并发切换。
+
 ## 0.0.1
 
 - 初始发布：无 UI Auth-kit 核心、配置校验、跳转决策、显式 SessionAdapter 与 refresh single-flight。

package/README.md

@@ -1,25 +1,179 @@
 # @msdongcha/auth-kit
 
-无 UI、framework-agnostic 的认证域名校验、统一登录地址、账号密码登录、refresh、可信上下文消费与 logout 工具。它不包含 React、Router、页面、表单、样式或后端授权实现。
+## 初始化
+
+```bash
+pnpm add @msdongcha/auth-kit
+```
+
+`TokenStore` 由业务应用实现。SDK 只通过它读取、轮换和清理 token；不会读取 React、Router、页面状态或浏览器存储。
 
 ```ts
-import { create } from '@msdongcha/auth-kit'
+import { create, type TokenStore } from '@msdongcha/auth-kit'
+
+const tokenStore: TokenStore = {
+  get: () => {
+    const accessToken = sessionStorage.getItem('access_token')
+    const refreshToken = sessionStorage.getItem('refresh_token')
+    return accessToken ? { accessToken, refreshToken: refreshToken ?? undefined } : null
+  },
+  set: ({ accessToken, refreshToken }) => {
+    sessionStorage.setItem('access_token', accessToken)
+    if (refreshToken) sessionStorage.setItem('refresh_token', refreshToken)
+    else sessionStorage.removeItem('refresh_token')
+  },
+  clear: () => {
+    sessionStorage.removeItem('access_token')
+    sessionStorage.removeItem('refresh_token')
+  },
+}
 
 const auth = create({
   authDomain: 'https://iam.example.com',
-  appCode: 'business-web',
-  allowedCallbackOrigins: ['https://business.example.com'],
+  app: 'business-web',
+  tokenStore,
 })
+```
+
+`authDomain` 必须是 HTTPS；仅当 `runtime` 为 `development` 或 `test` 时允许 localhost HTTP。`app` 是认证入口使用的应用标识。`fetchImpl` 用于注入 fetch 实现或测试替身。
+
+不要配置 `allowedCallbackOrigins`。回跳地址的白名单只由 IAM 服务端配置和校验，SDK 不在客户端复制这项授权决策。
+
+## `create(config)` 返回的客户端
+
+### `validate()`
 
-const authorizeUrl = auth.buildAuthorizeUrl({
-  callbackUrl: 'https://business.example.com/auth/callback',
+校验认证域名及当前 runtime 是否允许该 URL。
+
+```ts
+const result = auth.validate()
+if (!result.ok) console.error(result.error)
+```
+
+### `buildAuthorizeUrl(options?)`
+
+创建 IAM 登录地址，只输出 `app`、`return_to` 和可选的 `state` 参数。
+
+```ts
+const result = auth.buildAuthorizeUrl({
+  returnTo: 'https://business.example.com/orders',
+  state: 'csrf-state',
 })
+
+if (result.ok) window.location.assign(result.value)
+```
+
+显式传入 `returnTo` 时优先使用。浏览器中省略它时，SDK 使用当前页面的绝对 URL，并删除查询或 hash 中的 `access_token`、`refresh_token`、`code`、`id_token` 和 `token` 参数。非浏览器环境必须显式传入有效的 `returnTo`，否则返回 `RETURN_TO_UNAVAILABLE`。SDK 只校验 URL 格式与 runtime；最终回跳是否允许由 IAM 服务端决定。
+
+`appCode`、`clientId` 和 `callbackUrl` 仍是迁移期的兼容别名，分别归一化为 `app` 和 `returnTo`；SDK 不会输出 `client_id` 或 `callback_url`。
+
+### `login(username, password)`
+
+向 `POST /api/v1/auth/token` 发送 `{ username, password }`，将返回的 token 写入 `TokenStore`，并返回 token、可选的可信上下文和身份信息。
+
+```ts
+const result = await auth.login('alice', 'secret')
+if (!result.ok) throw new Error(result.error)
+```
+
+### `refreshToken()`
+
+使用 `TokenStore` 中的 refresh token 调用 `POST /api/v1/auth/refresh`。同一客户端实例中的并发刷新会合并为一次请求；成功后轮换 token，失败时清空 token。
+
+```ts
+const result = await auth.refreshToken()
+if (!result.ok) window.location.assign('/login')
+```
+
+### `getIdentity()`
+
+从 `TokenStore` 读取 access token，以 Bearer token 调用 `GET /api/v1/auth/me`，返回 IAM 远程响应中的 user、roles 和 permissions。SDK 不使用 JWKS，也不在本地解析 token。
+
+```ts
+const result = await auth.getIdentity()
+if (result.ok && result.value.permissions.includes('orders:read')) {
+  // 渲染订单入口
+}
+```
+
+### `getContext()`
+
+同样通过 `GET /api/v1/auth/me` 获取远程数据，但只在响应包含可信的 `principal_kind`、`selected_tenant`、`default_target` 和 `app_access` 时返回 `AuthContext`。缺少这些字段时返回 `AUTH_CONTEXT_MISSING`；`app_access.allowed` 为 false 时返回 `APP_ACCESS_DENIED`。不会从 roles 或 memberships 推断上下文。
+
+```ts
+const result = await auth.getContext()
+if (result.ok) console.log(result.value.selectedTenant)
+```
+
+### `getMemberships()`
+
+使用 `TokenStore` 中的 access token 调用 `GET /api/v1/auth/memberships`，返回 camelCase 的租户成员列表。SDK 会保留 `membershipStatus`；列表中的成员关系不代表服务端一定允许切换。
+
+```ts
+const result = await auth.getMemberships()
+if (result.ok) {
+  for (const membership of result.value) {
+    console.log(membership.tenantId, membership.isDefault)
+  }
+}
+```
+
+### `switchTenant(membershipId)`
+
+使用当前 access token 调用 `POST /api/v1/auth/switch-tenant`。服务端返回完整的新 access token 和 refresh token 后，SDK 才会原子替换 `TokenStore`；请求失败或响应不完整时保留原会话。
+
+同一客户端实例中，对相同 membership 的并发切换会合并为一次请求；切换未完成时请求其他 membership 会返回 `TENANT_SWITCH_IN_PROGRESS`。
+
+```ts
+const result = await auth.switchTenant('membership-id')
+if (result.ok) {
+  console.log(result.value.identity?.roles)
+}
+```
+
+### `logout()`
+
+如果 `TokenStore` 中存在 refresh token，则调用 `POST /api/v1/auth/logout` 撤销它，请求体为 `{ refresh_token }`。无论服务端请求成功或失败，SDK 都会清空本地 `TokenStore`；请求失败时返回 `LOGOUT_FAILED`。没有 refresh token 时只执行本地清理。
+
+```ts
+const result = await auth.logout()
+if (!result.ok) console.error(result.error)
+```
+
+## 其他公开工具
+
+### `sanitizeCallbackUrl(url)`
+
+返回已删除认证参数的路径、查询和 hash，适合回调页在写入 TokenStore 后清理浏览器地址。
+
+```ts
+window.history.replaceState(null, '', sanitizeCallbackUrl(window.location.href))
+```
+
+### `resolveTenantDecision(input)`
+
+优先消费 `AuthContext` 中受信任的 selected tenant。只有显式设置 `allowLegacyDefault: true` 时，才兼容一个激活的 legacy `isDefault` membership。
+
+```ts
+const decision = resolveTenantDecision({ context: authContext })
+if (decision.ok) useTenant(decision.value.selectedTenant.id)
 ```
 
-`getContext()` 需要后端返回可信 `principal_kind`、`selected_tenant`、`default_target` 和 `app_access`。当前服务端响应缺失这些字段时，SDK 返回 `AUTH_CONTEXT_MISSING` 或 `APP_ACCESS_DENIED`，不会从 roles 或 memberships 猜测。
+### `createAuthKit(config)`
+
+旧版兼容入口。它返回 `validateConfiguration()`、`buildAuthorizeUrl()`、`decideDestination(context)` 和 `applySession(result, adapter?)`。新业务使用 `create()`；此入口仅保留给仍依赖旧配置和返回形状的调用方。
+
+### `createRefreshCoordinator()`
+
+创建旧版 refresh single-flight 协调器。`refresh(task)` 会让同一实例中并发的布尔刷新任务共用一个 Promise。
+
+```ts
+const coordinator = createRefreshCoordinator()
+await coordinator.refresh(() => refreshBusinessSession())
+```
 
-`getIdentity()` 是旧 `/api/v1/auth/me` 的兼容读取入口，只用于 IAM 内部页面展示 user、tenant、membership、roles 和 permissions；它不能替代可信 `AuthContext`，也不能放行外部业务 callback。
+## 公开类型与结果
 
-应用应通过一个 `TokenStore` adapter 将 SDK 接到自己的 session store。SDK 负责 login/refresh HTTP 与 token rotation，应用业务 client 只负责 Bearer 注入和一次重试。
+`AuthKitConfig`、`AuthClient`、`TokenStore`、`TokenSet`、`AuthIdentity`、`AuthContext`、`TenantMembership`、`AuthKitResult`、`LoginResult`、`AuthorizeOptions`、`TenantDecision` 和相关 legacy 类型均从包根导出。由 `create()` 返回的客户端方法返回 `{ ok: true, value }` 或 `{ ok: false, error, retryable? }`；调用方应先判断 `ok` 再读取 `value`。
 
-`createAuthKit` 和 `createRefreshCoordinator` 保留为旧版本兼容入口，新业务请使用 `create`。
+SDK 可以解包 IAM 的 `{ success, message, data }` 响应信封，也兼容裸 JSON 响应。它不实现 IAM 后端授权、回跳白名单或 JWKS token 校验。

package/dist/index.d.ts

@@ -48,9 +48,11 @@ export interface SessionAdapter<T = void> {
 }
 export interface AuthKitConfig {
     authDomain: string;
+    app?: string;
+    /** @deprecated 请改用 app。 */
     appCode?: string;
+    /** @deprecated 请改用 app。 */
     clientId?: string;
-    allowedCallbackOrigins?: readonly string[];
     tokenStore?: TokenStore;
     fetchImpl?: typeof fetch;
     runtime?: 'development' | 'test' | 'staging' | 'production';
@@ -66,7 +68,7 @@ export interface LegacyAuthKitConfig {
     allowedLoginOrigins?: readonly string[];
     isLoginHost?: boolean;
 }
-export type AuthErrorCode = 'AUTH_DOMAIN_MISSING' | 'AUTH_DOMAIN_INVALID' | 'CALLBACK_URL_INVALID' | 'CALLBACK_ORIGIN_DENIED' | 'AUTH_ENTRY_CALLBACK_LOOP' | 'LOGIN_REQUIRED' | 'INVALID_CREDENTIALS' | 'AUTH_CONTEXT_MISSING' | 'PRINCIPAL_CONTEXT_INVALID' | 'TENANT_CONTEXT_INVALID' | 'TENANT_ACCESS_DENIED' | 'APP_ACCESS_DENIED' | 'CALLBACK_REJECTED' | 'TOKEN_EXPIRED' | 'REFRESH_FAILED' | 'LOGOUT_FAILED' | 'AUTH_PROTOCOL_UNAVAILABLE';
+export type AuthErrorCode = 'AUTH_DOMAIN_MISSING' | 'AUTH_DOMAIN_INVALID' | 'CALLBACK_URL_INVALID' | 'RETURN_TO_UNAVAILABLE' | 'AUTH_ENTRY_CALLBACK_LOOP' | 'LOGIN_REQUIRED' | 'INVALID_CREDENTIALS' | 'AUTH_CONTEXT_MISSING' | 'PRINCIPAL_CONTEXT_INVALID' | 'TENANT_CONTEXT_INVALID' | 'TENANT_ACCESS_DENIED' | 'TENANT_SWITCH_IN_PROGRESS' | 'APP_ACCESS_DENIED' | 'CALLBACK_REJECTED' | 'TOKEN_EXPIRED' | 'REFRESH_FAILED' | 'LOGOUT_FAILED' | 'AUTH_PROTOCOL_UNAVAILABLE';
 export type AuthKitError = AuthErrorCode | 'LOGIN_ENTRY_URL_MISSING' | 'INVALID_LOGIN_ENTRY_URL' | 'LOGIN_ENTRY_ORIGIN_DENIED' | 'INVALID_CALLBACK' | 'CROSS_APP_CONTEXT' | 'IDENTITY_CONTEXT_MISSING';
 export type AuthKitResult<T> = {
     ok: true;
@@ -89,22 +91,36 @@ export interface AuthIdentity {
     permissions: string[];
     attrs?: Record<string, unknown>;
 }
+export interface TenantMembership {
+    membershipId: string;
+    tenantId: string;
+    tenantName?: string;
+    membershipStatus: string;
+    isDefault: boolean;
+}
 export interface AuthorizeOptions {
-    callbackUrl: string;
+    returnTo?: string;
+    app?: string;
+    /** @deprecated 请改用 returnTo。 */
+    callbackUrl?: string;
+    /** @deprecated 请改用 app。 */
     appCode?: string;
+    /** @deprecated 请改用 app。 */
     clientId?: string;
     state?: string;
 }
 export interface AuthClient {
     validate: () => AuthKitResult<void>;
-    buildAuthorizeUrl: (options: AuthorizeOptions) => AuthKitResult<string>;
+    buildAuthorizeUrl: (options?: AuthorizeOptions) => AuthKitResult<string>;
     login: (username: string, password: string) => Promise<AuthKitResult<LoginResult>>;
     refreshToken: () => Promise<AuthKitResult<LoginResult>>;
     getIdentity: () => Promise<AuthKitResult<AuthIdentity>>;
     getContext: () => Promise<AuthKitResult<AuthContext>>;
+    getMemberships: () => Promise<AuthKitResult<TenantMembership[]>>;
+    switchTenant: (membershipId: string) => Promise<AuthKitResult<LoginResult>>;
     logout: () => Promise<AuthKitResult<void>>;
 }
-/** 清理回调 URL 中不应保留在 history 或 referrer 的认证参数。 */
+/** 清理不应保留在 history 或 referrer 的认证参数。 */
 export declare function sanitizeCallbackUrl(value: string): string;
 export interface LegacyMembershipCandidate {
     membershipId: string;
@@ -129,7 +145,7 @@ export declare function createAuthKit(config: LegacyAuthKitConfig): {
     validateConfiguration: () => AuthKitResult<{
         loginEntryUrl: string;
     }>;
-    buildAuthorizeUrl: (requestedTenantId?: string) => AuthKitResult<{
+    buildAuthorizeUrl: (_requestedTenantId?: string) => AuthKitResult<{
         url: string;
     }>;
     decideDestination: (context: AuthContext) => AuthKitResult<{

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,wBAAwB,GAAG,eAAe,GAAG,oBAAoB,CAAA;AAEhH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,GAAG,UAAU,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,CAAC,CAAA;CACV;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,QAAQ,GAAG,IAAI,CAAA;IAC1B,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAA;IAC/B,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,IAAI;IACtC,GAAG,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpD,KAAK,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAA;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GACrB,qBAAqB,GACrB,qBAAqB,GACrB,sBAAsB,GACtB,wBAAwB,GACxB,0BAA0B,GAC1B,gBAAgB,GAChB,qBAAqB,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,wBAAwB,GACxB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,2BAA2B,CAAA;AAE/B,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,yBAAyB,GACzB,yBAAyB,GACzB,2BAA2B,GAC3B,kBAAkB,GAClB,mBAAmB,GACnB,0BAA0B,CAAA;AAE9B,MAAM,MAAM,aAAa,CAAC,CAAC,IACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE3D,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,QAAQ,CAAC,EAAE,YAAY,CAAA;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,iBAAiB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,MAAM,CAAC,CAAA;IACvE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAA;IAClF,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAA;IACvD,WAAW,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAA;IACvD,UAAU,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAA;IACrD,MAAM,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;CAC3C;AAED,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAoFD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAA;IAC9B,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;CAChD;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,CAAA;IAC7E,WAAW,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAClD,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,GAAG,aAAa,CAAC,cAAc,CAAC,CAqBhC;AAkBD,wBAAgB,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAoHxD;AAED,gCAAgC;AAChC,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB;iCAMrB,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;4CAO3B,MAAM,KAAG,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;iCAYlD,WAAW,KAAG,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC;2BAUtE,UAAU,CAAC,OAAO,CAAC,YAAY,cAAc,KAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;EAMjH;AAED,kCAAkC;AAClC,wBAAgB,wBAAwB;kBAGtB,MAAM,OAAO,CAAC,OAAO,CAAC;EAKvC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,wBAAwB,GAAG,eAAe,GAAG,oBAAoB,CAAA;AAEhH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,GAAG,UAAU,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,CAAC,CAAA;CACV;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,QAAQ,GAAG,IAAI,CAAA;IAC1B,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAA;IAC/B,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,IAAI;IACtC,GAAG,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpD,KAAK,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAA;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GACrB,qBAAqB,GACrB,qBAAqB,GACrB,sBAAsB,GACtB,uBAAuB,GACvB,0BAA0B,GAC1B,gBAAgB,GAChB,qBAAqB,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,wBAAwB,GACxB,sBAAsB,GACtB,2BAA2B,GAC3B,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,2BAA2B,CAAA;AAE/B,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,yBAAyB,GACzB,yBAAyB,GACzB,2BAA2B,GAC3B,kBAAkB,GAClB,mBAAmB,GACnB,0BAA0B,CAAA;AAE9B,MAAM,MAAM,aAAa,CAAC,CAAC,IACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE3D,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,QAAQ,CAAC,EAAE,YAAY,CAAA;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,gBAAgB,KAAK,aAAa,CAAC,MAAM,CAAC,CAAA;IACxE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAA;IAClF,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAA;IACvD,WAAW,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAA;IACvD,UAAU,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAA;IACrD,cAAc,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAA;IAChE,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAA;IAC3E,MAAM,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;CAC3C;AAmBD,wCAAwC;AACxC,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGzD;AA+HD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAA;IAC9B,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;CAChD;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,CAAA;IAC7E,WAAW,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAClD,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,GAAG,aAAa,CAAC,cAAc,CAAC,CAqBhC;AAkBD,wBAAgB,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAgNxD;AAED,gCAAgC;AAChC,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB;iCAMrB,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;6CAO1B,MAAM,KAAG,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;iCAUnD,WAAW,KAAG,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC;2BAUtE,UAAU,CAAC,OAAO,CAAC,YAAY,cAAc,KAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;EAMjH;AAED,kCAAkC;AAClC,wBAAgB,wBAAwB;kBAGtB,MAAM,OAAO,CAAC,OAAO,CAAC;EAKvC"}

package/dist/index.js

@@ -1,9 +1,24 @@
-/** 清理回调 URL 中不应保留在 history 或 referrer 的认证参数。 */
+const SENSITIVE_CALLBACK_PARAMS = ['access_token', 'refresh_token', 'code', 'id_token', 'token'];
+function removeSensitiveCallbackParams(url) {
+    for (const param of SENSITIVE_CALLBACK_PARAMS)
+        url.searchParams.delete(param);
+    const hash = url.hash.slice(1);
+    const queryIndex = hash.indexOf('?');
+    const hashQuery = queryIndex >= 0 ? hash.slice(queryIndex + 1) : hash.includes('=') ? hash : null;
+    if (!hashQuery)
+        return url;
+    const hashParams = new URLSearchParams(hashQuery);
+    for (const param of SENSITIVE_CALLBACK_PARAMS)
+        hashParams.delete(param);
+    const sanitizedHashQuery = hashParams.toString();
+    url.hash = queryIndex >= 0
+        ? sanitizedHashQuery ? `${hash.slice(0, queryIndex)}?${sanitizedHashQuery}` : hash.slice(0, queryIndex)
+        : sanitizedHashQuery;
+    return url;
+}
+/** 清理不应保留在 history 或 referrer 的认证参数。 */
 export function sanitizeCallbackUrl(value) {
-    const url = new URL(value);
-    url.searchParams.delete('access_token');
-    url.searchParams.delete('refresh_token');
-    url.searchParams.delete('code');
+    const url = removeSensitiveCallbackParams(new URL(value));
     return `${url.pathname}${url.search}${url.hash}`;
 }
 function parseHttpUrl(value, allowLocalhost = true) {
@@ -19,6 +34,16 @@ function parseHttpUrl(value, allowLocalhost = true) {
         return null;
     }
 }
+function currentBrowserUrl() {
+    if (typeof window === 'undefined')
+        return null;
+    try {
+        return removeSensitiveCallbackParams(new URL(window.location.href)).toString();
+    }
+    catch {
+        return null;
+    }
+}
 function ok(value) {
     return { ok: true, value };
 }
@@ -28,6 +53,12 @@ function fail(error, retryable = false) {
 function isRecord(value) {
     return Boolean(value && typeof value === 'object');
 }
+/** 认证服务与业务接口统一使用响应信封，SDK 对外仍返回既有领域对象。 */
+function unwrapResponse(value) {
+    if (!isRecord(value) || !('success' in value))
+        return { ok: true, value };
+    return value.success === true ? { ok: true, value: value.data } : { ok: false };
+}
 function stringValue(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
@@ -90,6 +121,37 @@ function normalizeIdentity(value) {
         ...(attrs ? { attrs } : {}),
     };
 }
+function normalizeBoolean(value) {
+    if (value === true || value === 1 || value === '1' || value === 'true')
+        return true;
+    if (value === false || value === 0 || value === '0' || value === 'false')
+        return false;
+    return undefined;
+}
+function normalizeMemberships(value) {
+    if (!isRecord(value) || !Array.isArray(value.memberships))
+        return null;
+    const memberships = [];
+    for (const item of value.memberships) {
+        if (!isRecord(item))
+            return null;
+        const membershipId = stringValue(item.membership_id)?.trim();
+        const tenantId = stringValue(item.tenant_id)?.trim();
+        const membershipStatus = stringValue(item.membership_status)?.trim();
+        const tenantName = stringValue(item.tenant_name)?.trim();
+        const isDefault = item.is_default === undefined ? false : normalizeBoolean(item.is_default);
+        if (!membershipId || !tenantId || !membershipStatus || isDefault === undefined)
+            return null;
+        memberships.push({
+            membershipId,
+            tenantId,
+            ...(tenantName ? { tenantName } : {}),
+            membershipStatus,
+            isDefault,
+        });
+    }
+    return memberships;
+}
 /** 只消费后端 selected tenant；旧接口仅允许 is_default 兼容，不猜 joined_at 或身份。 */
 export function resolveTenantDecision(input) {
     const context = input.context;
@@ -136,6 +198,8 @@ export function create(config) {
     const tokenStore = config.tokenStore ?? createMemoryStore();
     const authDomain = config.authDomain.replace(/\/$/, '');
     let refreshPending = null;
+    let membershipsPending = null;
+    let switchPending = null;
     function validate() {
         if (!config.authDomain)
             return fail('AUTH_DOMAIN_MISSING');
@@ -143,20 +207,20 @@ export function create(config) {
             return fail('AUTH_DOMAIN_INVALID');
         return ok(undefined);
     }
-    function buildAuthorizeUrl(options) {
+    function buildAuthorizeUrl(options = {}) {
         const valid = validate();
         if (!valid.ok)
             return valid;
-        const callbackUrl = parseHttpUrl(options.callbackUrl, config.runtime === 'development' || config.runtime === 'test');
+        const url = new URL('/auth/login', `${authDomain}/`);
+        const app = options.app ?? config.app ?? options.appCode ?? options.clientId ?? config.appCode ?? config.clientId ?? '';
+        const configuredReturnTo = options.returnTo ?? options.callbackUrl;
+        const returnTo = configuredReturnTo ?? currentBrowserUrl();
+        if (returnTo === null)
+            return fail('RETURN_TO_UNAVAILABLE');
+        const callbackUrl = parseHttpUrl(returnTo, config.runtime === 'development' || config.runtime === 'test');
         if (!callbackUrl)
             return fail('CALLBACK_URL_INVALID');
-        const allowedOrigins = config.allowedCallbackOrigins ?? [];
-        if (allowedOrigins.length > 0 && !allowedOrigins.includes(callbackUrl.origin))
-            return fail('CALLBACK_ORIGIN_DENIED');
-        const url = new URL('/auth/login', `${authDomain}/`);
-        url.searchParams.set('app', options.appCode ?? config.appCode ?? '');
-        url.searchParams.set('client_id', options.clientId ?? config.clientId ?? '');
-        url.searchParams.set('callback_url', callbackUrl.toString());
+        url.searchParams.set('app', app);
         url.searchParams.set('return_to', callbackUrl.toString());
         if (options.state)
             url.searchParams.set('state', options.state);
@@ -176,7 +240,10 @@ export function create(config) {
             });
             if (!response.ok)
                 return responseError(response.status);
-            const body = await response.json();
+            const responseBody = unwrapResponse(await response.json());
+            if (!responseBody.ok)
+                return fail('AUTH_PROTOCOL_UNAVAILABLE');
+            const body = responseBody.value;
             const tokens = toTokenSet(body);
             if (!tokens)
                 return fail('AUTH_PROTOCOL_UNAVAILABLE');
@@ -202,7 +269,12 @@ export function create(config) {
                 tokenStore.clear();
                 return response.status === 401 ? fail('TOKEN_EXPIRED') : responseError(response.status);
             }
-            const body = await response.json();
+            const responseBody = unwrapResponse(await response.json());
+            if (!responseBody.ok) {
+                tokenStore.clear();
+                return fail('AUTH_PROTOCOL_UNAVAILABLE');
+            }
+            const body = responseBody.value;
             const tokens = toTokenSet(body);
             if (!tokens) {
                 tokenStore.clear();
@@ -221,45 +293,131 @@ export function create(config) {
             refreshPending = runRefresh().finally(() => { refreshPending = null; });
         return refreshPending;
     }
-    async function getContext() {
+    async function getAuthorizedJson(path, init = {}, forbiddenError = 'APP_ACCESS_DENIED', preserveLegacyErrors = false) {
         const current = tokenStore.get();
         if (!current?.accessToken)
             return fail('LOGIN_REQUIRED');
+        let response;
         try {
-            const response = await fetchImpl(`${authDomain}/api/v1/auth/me`, { headers: { Authorization: `Bearer ${current.accessToken}` } });
-            if (!response.ok)
-                return response.status === 401 ? fail('TOKEN_EXPIRED') : responseError(response.status);
-            const context = normalizeContext(await response.json());
-            if (!context)
-                return fail('AUTH_CONTEXT_MISSING');
-            if (!context.appAccess?.allowed)
-                return fail('APP_ACCESS_DENIED');
-            return ok(context);
+            response = await fetchImpl(`${authDomain}${path}`, {
+                ...init,
+                headers: {
+                    Authorization: `Bearer ${current.accessToken}`,
+                    ...(init.body === undefined ? {} : { 'Content-Type': 'application/json' }),
+                },
+            });
         }
         catch {
             return fail('AUTH_PROTOCOL_UNAVAILABLE', true);
         }
+        if (!response.ok) {
+            if (response.status === 401)
+                return fail('TOKEN_EXPIRED');
+            if (response.status === 403)
+                return fail(forbiddenError);
+            if (preserveLegacyErrors)
+                return responseError(response.status);
+            return fail('AUTH_PROTOCOL_UNAVAILABLE', response.status === 429 || response.status >= 500);
+        }
+        try {
+            const responseBody = unwrapResponse(await response.json());
+            if (!responseBody.ok)
+                return fail('AUTH_PROTOCOL_UNAVAILABLE');
+            return ok(responseBody.value);
+        }
+        catch {
+            return fail('AUTH_PROTOCOL_UNAVAILABLE', preserveLegacyErrors);
+        }
+    }
+    function getRemoteIdentity() {
+        return getAuthorizedJson('/api/v1/auth/me', {}, 'APP_ACCESS_DENIED', true);
+    }
+    async function getContext() {
+        const remoteIdentity = await getRemoteIdentity();
+        if (!remoteIdentity.ok)
+            return remoteIdentity;
+        const context = normalizeContext(remoteIdentity.value);
+        if (!context)
+            return fail('AUTH_CONTEXT_MISSING');
+        if (!context.appAccess?.allowed)
+            return fail('APP_ACCESS_DENIED');
+        return ok(context);
     }
     async function getIdentity() {
-        const current = tokenStore.get();
-        if (!current?.accessToken)
-            return fail('LOGIN_REQUIRED');
+        const remoteIdentity = await getRemoteIdentity();
+        if (!remoteIdentity.ok)
+            return remoteIdentity;
+        const identity = normalizeIdentity(remoteIdentity.value);
+        return identity ? ok(identity) : fail('AUTH_PROTOCOL_UNAVAILABLE');
+    }
+    async function runGetMemberships() {
+        const result = await getAuthorizedJson('/api/v1/auth/memberships', {}, 'TENANT_ACCESS_DENIED');
+        if (!result.ok)
+            return result;
+        const memberships = normalizeMemberships(result.value);
+        return memberships ? ok(memberships) : fail('AUTH_PROTOCOL_UNAVAILABLE');
+    }
+    function getMemberships() {
+        if (!membershipsPending)
+            membershipsPending = runGetMemberships().finally(() => { membershipsPending = null; });
+        return membershipsPending;
+    }
+    async function runSwitchTenant(membershipId) {
+        const result = await getAuthorizedJson('/api/v1/auth/switch-tenant', {
+            method: 'POST',
+            body: JSON.stringify({ membership_id: membershipId }),
+        }, 'TENANT_ACCESS_DENIED');
+        if (!result.ok)
+            return result;
+        const tokens = toTokenSet(result.value);
+        if (!tokens?.refreshToken)
+            return fail('AUTH_PROTOCOL_UNAVAILABLE');
+        const context = isRecord(result.value) ? normalizeContext(result.value.context ?? result.value.auth_context) ?? undefined : undefined;
+        const identity = normalizeIdentity(result.value) ?? undefined;
+        tokenStore.set(tokens);
+        return ok({ ...tokens, context, identity });
+    }
+    function switchTenant(rawMembershipId) {
+        const membershipId = rawMembershipId.trim();
+        if (!membershipId)
+            return Promise.resolve(fail('TENANT_CONTEXT_INVALID'));
+        if (switchPending) {
+            return switchPending.membershipId === membershipId
+                ? switchPending.promise
+                : Promise.resolve(fail('TENANT_SWITCH_IN_PROGRESS'));
+        }
+        const promise = runSwitchTenant(membershipId).finally(() => {
+            if (switchPending?.promise === promise)
+                switchPending = null;
+        });
+        switchPending = { membershipId, promise };
+        return promise;
+    }
+    async function logout() {
         try {
-            const response = await fetchImpl(`${authDomain}/api/v1/auth/me`, { headers: { Authorization: `Bearer ${current.accessToken}` } });
+            const current = tokenStore.get();
+            if (!current?.refreshToken)
+                return ok(undefined);
+            const valid = validate();
+            if (!valid.ok)
+                return valid;
+            const response = await fetchImpl(`${authDomain}/api/v1/auth/logout`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ refresh_token: current.refreshToken }),
+            });
             if (!response.ok)
-                return response.status === 401 ? fail('TOKEN_EXPIRED') : responseError(response.status);
-            const identity = normalizeIdentity(await response.json());
-            return identity ? ok(identity) : fail('AUTH_PROTOCOL_UNAVAILABLE');
+                return fail('LOGOUT_FAILED', response.status >= 408);
+            return ok(undefined);
         }
         catch {
-            return fail('AUTH_PROTOCOL_UNAVAILABLE', true);
+            return fail('LOGOUT_FAILED', true);
+        }
+        finally {
+            tokenStore.clear();
         }
     }
-    async function logout() {
-        tokenStore.clear();
-        return ok(undefined);
-    }
-    return { validate, buildAuthorizeUrl, login, refreshToken, getIdentity, getContext, logout };
+    return { validate, buildAuthorizeUrl, login, refreshToken, getIdentity, getContext, getMemberships, switchTenant, logout };
 }
 /** 创建旧版兼容实例；新业务接入请使用 create。 */
 export function createAuthKit(config) {
@@ -276,18 +434,15 @@ export function createAuthKit(config) {
             return fail('LOGIN_ENTRY_ORIGIN_DENIED');
         return ok({ loginEntryUrl: entryUrl.toString() });
     }
-    function buildAuthorizeUrl(requestedTenantId) {
+    function buildAuthorizeUrl(_requestedTenantId) {
         const valid = validateConfiguration();
         if (!valid.ok)
             return valid;
         if (config.isLoginHost)
             return fail('AUTH_ENTRY_CALLBACK_LOOP');
         const url = new URL(valid.value.loginEntryUrl);
-        url.searchParams.set('client_id', config.clientId);
         url.searchParams.set('app', config.appCode);
         url.searchParams.set('return_to', callbackUrl.toString());
-        if (requestedTenantId)
-            url.searchParams.set('requested_tenant_id', requestedTenantId);
         return ok({ url: url.toString() });
     }
     function decideDestination(context) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@msdongcha/auth-kit",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Framework-agnostic authentication context, redirect, callback and session coordination utilities.",
   "type": "module",
   "main": "./dist/index.js",