@acosmi/sdk-ts 1.3.2 → 1.4.1

package/dist/index.mjs

@@ -1056,7 +1056,7 @@ init_adapters();
 
 // src/auth.ts
 var authTimeoutMs = 3e4;
-async function discover(serverURL, signal) {
+async function discoverWithProfile(serverURL, profile, signal) {
   let parsed;
   try {
     parsed = new URL(serverURL.replace(/\/+$/, ""));
@@ -1064,7 +1064,7 @@ async function discover(serverURL, signal) {
     throw new Error(`discover: invalid server URL: ${e instanceof Error ? e.message : String(e)}`);
   }
   const origin = `${parsed.protocol}//${parsed.host}`;
-  const endpoint = `${origin}/.well-known/oauth-authorization-server/desktop`;
+  const endpoint = `${origin}/.well-known/oauth-authorization-server/${profile}`;
   const ctl = withTimeout(authTimeoutMs, signal);
   let resp;
   try {
@@ -1090,6 +1090,12 @@ async function discover(serverURL, signal) {
   }
   return meta;
 }
+async function discover(serverURL, signal) {
+  return discoverWithProfile(serverURL, "desktop", signal);
+}
+async function discoverWebOAuthMetadata(serverURL, signal) {
+  return discoverWithProfile(serverURL, "web", signal);
+}
 async function register(meta, appName, signal) {
   const regReq = {
     client_name: appName,
@@ -1121,12 +1127,50 @@ async function register(meta, appName, signal) {
     throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
-async function generateCodeVerifier() {
+async function registerWebOAuthClient(meta, opts, signal) {
+  const regReq = {
+    client_name: opts.clientName,
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    redirect_uris: opts.redirectURIs,
+    response_types: ["code"],
+    ...opts.scopes ? { scope: opts.scopes.join(" ") } : {}
+  };
+  const ctl = withTimeout(authTimeoutMs, signal);
+  let resp;
+  try {
+    resp = await fetch(meta.registration_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(regReq),
+      signal: ctl.signal
+    });
+  } catch (e) {
+    throw new Error(`register: ${e instanceof Error ? e.message : String(e)}`);
+  } finally {
+    ctl.dispose();
+  }
+  if (resp.status !== 200 && resp.status !== 201) {
+    throw new Error(`register: HTTP ${resp.status}`);
+  }
+  try {
+    return await resp.json();
+  } catch (e) {
+    throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function randomBase64Url32() {
   const c = await getCrypto();
   const b = new Uint8Array(32);
   c.getRandomValues(b);
   return base64urlNoPad(b);
 }
+async function generateCodeVerifier() {
+  return randomBase64Url32();
+}
+async function generateState() {
+  return randomBase64Url32();
+}
 async function codeChallenge(verifier) {
   const c = await getCrypto();
   const buf = await c.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
@@ -1160,6 +1204,7 @@ var ErrAuthDenied = "auth_denied";
 var ErrTimeout = "auth_timeout";
 var ErrTokenExchange = "token_exchange_failed";
 var ErrSSLProxy = "ssl_proxy_detected";
+var ErrStateMismatch = "state_mismatch";
 function isSSLError(err) {
   const msg = err instanceof Error ? err.message : String(err);
   return msg.includes("tls:") || msg.includes("x509:") || msg.includes("certificate");
@@ -1273,6 +1318,51 @@ async function authorize(meta, clientID, scopes, opts = {}) {
 function htmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+async function createWebAuthorizationRequest(meta, opts) {
+  const verifier = await generateCodeVerifier();
+  const challenge = await codeChallenge(verifier);
+  const state = await generateState();
+  const authURL = new URL(meta.authorization_endpoint);
+  authURL.searchParams.set("response_type", "code");
+  authURL.searchParams.set("client_id", opts.clientID);
+  authURL.searchParams.set("redirect_uri", opts.redirectURI);
+  authURL.searchParams.set("code_challenge", challenge);
+  authURL.searchParams.set("code_challenge_method", "S256");
+  authURL.searchParams.set("state", state);
+  authURL.searchParams.set("scope", opts.scopes.join(" "));
+  if (opts.loginHint) {
+    authURL.searchParams.set("login_hint", opts.loginHint);
+  }
+  return {
+    authUrl: authURL.toString(),
+    state,
+    verifier,
+    clientID: opts.clientID,
+    redirectURI: opts.redirectURI,
+    serverURL: opts.serverURL,
+    createdAt: Date.now()
+  };
+}
+async function completeWebAuthorizationRequest(pending, params, signal) {
+  if (!params.code) {
+    throw new Error("completeWebAuthorizationRequest: missing authorization code");
+  }
+  if (params.state !== pending.state) {
+    throw new Error(
+      `completeWebAuthorizationRequest: ${ErrStateMismatch}: callback state does not match pending state (possible CSRF)`
+    );
+  }
+  const meta = await discoverWebOAuthMetadata(pending.serverURL, signal);
+  const resp = await exchangeCode(
+    meta,
+    pending.clientID,
+    params.code,
+    pending.redirectURI,
+    pending.verifier,
+    signal
+  );
+  return newTokenSet(resp, pending.clientID, pending.serverURL);
+}
 async function exchangeCode(meta, clientID, code, redirectURI, codeVerifier, signal) {
   const data = new URLSearchParams({
     grant_type: "authorization_code",
@@ -2150,6 +2240,9 @@ var FilterStatusFallbackTkdistSkew = "fallback-tkdist-deployment-skew";
 var FilterStatusFallbackNoBuckets = "fallback-no-buckets";
 var FilterStatusFallbackMissingUser = "fallback-missing-userid";
 var FilterStatusUnknown = "";
+var ErrOAuthCORSBlocked = "oauth_cors_blocked";
+var ErrRefreshProxyFailed = "refresh_proxy_failed";
+var ErrTokenExpired = "token_expired";
 function newDeferred() {
   let resolve;
   let reject;
@@ -2165,6 +2258,12 @@ var Client = class _Client {
   serverURL;
   /** Compliance API 根地址 (已 trim 尾随 /); null = 走默认 ${serverURL}/admin-api */
   complianceBaseURL;
+  /** OAuth metadata profile — 刷新 token 时发现 metadata 用 (默认 'desktop') */
+  oauthMetadataProfile;
+  /** Browser Web OAuth refresh strategy (default 'direct') */
+  browserRefreshMode;
+  /** Same-origin refresh proxy URL for browserRefreshMode='server-proxy' */
+  refreshProxyURL;
   /** OAuth metadata (lazy loaded) */
   meta = null;
   /** 当前 token (内存) */
@@ -2199,6 +2298,9 @@ var Client = class _Client {
   constructor(cfg = {}) {
     this.serverURL = (cfg.serverURL ?? "https://acosmi.com").replace(/\/+$/, "");
     this.complianceBaseURL = cfg.complianceBaseURL ? cfg.complianceBaseURL.replace(/\/+$/, "") : null;
+    this.oauthMetadataProfile = cfg.oauthMetadataProfile ?? "desktop";
+    this.browserRefreshMode = cfg.browserRefreshMode ?? "direct";
+    this.refreshProxyURL = cfg.refreshProxyURL ?? null;
     this.store = cfg.store ?? defaultTokenStore();
     this.fetchImpl = cfg.fetchImpl ?? globalThis.fetch.bind(globalThis);
     this.retryPolicy = effectivePolicy(cfg.retryPolicy ?? null);
@@ -2373,7 +2475,7 @@ var Client = class _Client {
     if (tokens) {
       if (!meta) {
         try {
-          meta = await discover(this.serverURL, signal);
+          meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
         } catch (e) {
           console.warn(`[acosmi-sdk] warning: discover for revocation failed: ${e instanceof Error ? e.message : String(e)}`);
         }
@@ -2442,27 +2544,7 @@ var Client = class _Client {
         if (!tokenSetIsExpired(this.tokens)) {
           return this.tokens.access_token;
         }
-        if (this.meta == null) {
-          try {
-            this.meta = await discover(this.serverURL, signal);
-          } catch (e) {
-            throw new Error(
-              `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
-            );
-          }
-        }
-        let tokenResp;
-        try {
-          tokenResp = await refreshToken(this.meta, this.tokens.client_id, this.tokens.refresh_token, signal);
-        } catch (e) {
-          throw new Error(`refresh token: ${e instanceof Error ? e.message : String(e)}`);
-        }
-        this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
-        try {
-          await this.store.save(this.tokens);
-        } catch (e) {
-          console.warn(`[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`);
-        }
+        await this.refreshCurrentToken(signal);
         return this.tokens.access_token;
       })
     );
@@ -2475,26 +2557,111 @@ var Client = class _Client {
         if (this.tokens == null) {
           throw new Error("no tokens to refresh");
         }
-        if (this.meta == null) {
-          this.meta = await discover(this.serverURL, signal);
-        }
-        const tokenResp = await refreshToken(
-          this.meta,
-          this.tokens.client_id,
-          this.tokens.refresh_token,
-          signal
-        );
-        this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
-        try {
-          await this.store.save(this.tokens);
-        } catch (e) {
-          console.warn(
-            `[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`
-          );
-        }
+        await this.refreshCurrentToken(signal);
       })
     );
   }
+  async refreshCurrentToken(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (this.browserRefreshMode === "none") {
+      throw new Error(`${ErrTokenExpired}: token refresh disabled`);
+    }
+    if (this.browserRefreshMode === "server-proxy") {
+      await this.refreshCurrentTokenViaProxy(signal);
+      return;
+    }
+    await this.refreshCurrentTokenDirect(signal);
+  }
+  async refreshCurrentTokenDirect(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (this.meta == null) {
+      try {
+        this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
+      } catch (e) {
+        throw new Error(
+          `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
+    }
+    let tokenResp;
+    try {
+      tokenResp = await refreshToken(
+        this.meta,
+        this.tokens.client_id,
+        this.tokens.refresh_token,
+        signal
+      );
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      if (isLikelyBrowserOAuthCORSError(message)) {
+        throw new Error(`${ErrOAuthCORSBlocked}: refresh token: ${message}`);
+      }
+      throw new Error(`refresh token: ${message}`);
+    }
+    this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
+    await this.saveRefreshedToken();
+  }
+  async refreshCurrentTokenViaProxy(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (!this.refreshProxyURL) {
+      throw new Error(`${ErrRefreshProxyFailed}: refreshProxyURL is required`);
+    }
+    let resp;
+    try {
+      resp = await this.fetchImpl(this.refreshProxyURL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          client_id: this.tokens.client_id,
+          refresh_token: this.tokens.refresh_token,
+          server_url: this.tokens.server_url || this.serverURL
+        }),
+        signal
+      });
+    } catch (e) {
+      throw new Error(
+        `${ErrRefreshProxyFailed}: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (!resp.ok) {
+      let message = "";
+      try {
+        const body2 = await resp.json();
+        if (typeof body2.error === "string") message = body2.error;
+      } catch {
+      }
+      throw new Error(`${ErrRefreshProxyFailed}: HTTP ${resp.status}: ${message}`);
+    }
+    let body;
+    try {
+      body = await resp.json();
+    } catch (e) {
+      throw new Error(
+        `${ErrRefreshProxyFailed}: decode: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (!isTokenSetLike(body.tokenSet)) {
+      throw new Error(`${ErrRefreshProxyFailed}: response missing tokenSet`);
+    }
+    this.tokens = body.tokenSet;
+    await this.saveRefreshedToken();
+  }
+  async saveRefreshedToken() {
+    if (this.tokens == null) return;
+    try {
+      await this.store.save(this.tokens);
+    } catch (e) {
+      console.warn(
+        `[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+  }
   /** 互斥锁 helper (替代 Go sync.Mutex) */
   withMu(fn) {
     const next = this.mu.then(fn, fn);
@@ -3193,6 +3360,15 @@ function defaultTokenStore() {
   }
   return new InMemoryTokenStore();
 }
+function isLikelyBrowserOAuthCORSError(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("failed to fetch") || lower.includes("networkerror") || lower.includes("cors") || lower.includes("http 403");
+}
+function isTokenSetLike(value) {
+  if (value == null || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.access_token === "string" && typeof candidate.refresh_token === "string" && typeof candidate.expires_at === "string" && typeof candidate.scope === "string" && typeof candidate.client_id === "string" && typeof candidate.server_url === "string";
+}
 function zeroModelCapabilities() {
   return {
     supports_thinking: false,
@@ -5369,6 +5545,6 @@ Client.prototype.getBugReport = async function(bugID, signal) {
   return resp.data;
 };
 
-export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrTimeout, ErrTokenExchange, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, complianceScopes, computeBackoff, defaultRetryable, defaultSafeToRetry, discover, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
+export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map