@acosmi/sdk-ts 1.3.2 → 1.4.1

package/dist/node/adapters/anthropic.d.cts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-28x02ITB.cjs';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-CbG9NqE-.cjs';
 
 /** 实现 ProviderAdapter, 用于 Anthropic 原生模型 */
 declare class AnthropicAdapter implements ProviderAdapter {

package/dist/node/adapters/anthropic.d.ts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-28x02ITB.js';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-CbG9NqE-.js';
 
 /** 实现 ProviderAdapter, 用于 Anthropic 原生模型 */
 declare class AnthropicAdapter implements ProviderAdapter {

package/dist/node/adapters/openai.d.cts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-28x02ITB.cjs';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-CbG9NqE-.cjs';
 
 /** 实现 ProviderAdapter, 用于所有非 Anthropic 厂商 */
 declare class OpenAIAdapter implements ProviderAdapter {

package/dist/node/adapters/openai.d.ts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-28x02ITB.js';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-CbG9NqE-.js';
 
 /** 实现 ProviderAdapter, 用于所有非 Anthropic 厂商 */
 declare class OpenAIAdapter implements ProviderAdapter {

package/dist/node/{index-28x02ITB.d.cts → index-CbG9NqE-.d.cts}

@@ -1024,4 +1024,4 @@ declare function getAdapter(provider: string): ProviderAdapter;
  */
 declare function getAdapterForModel(m: ManagedModel): ProviderAdapter;
 
-export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenResponse as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenSet as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };
+export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenSet as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenResponse as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };

package/dist/node/{index-28x02ITB.d.ts → index-CbG9NqE-.d.ts}

@@ -1024,4 +1024,4 @@ declare function getAdapter(provider: string): ProviderAdapter;
  */
 declare function getAdapterForModel(m: ManagedModel): ProviderAdapter;
 
-export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenResponse as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenSet as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };
+export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenSet as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenResponse as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };

package/dist/node/index.cjs

@@ -1058,7 +1058,7 @@ init_adapters();
 
 // src/auth.ts
 var authTimeoutMs = 3e4;
-async function discover(serverURL, signal) {
+async function discoverWithProfile(serverURL, profile, signal) {
   let parsed;
   try {
     parsed = new URL(serverURL.replace(/\/+$/, ""));
@@ -1066,7 +1066,7 @@ async function discover(serverURL, signal) {
     throw new Error(`discover: invalid server URL: ${e instanceof Error ? e.message : String(e)}`);
   }
   const origin = `${parsed.protocol}//${parsed.host}`;
-  const endpoint = `${origin}/.well-known/oauth-authorization-server/desktop`;
+  const endpoint = `${origin}/.well-known/oauth-authorization-server/${profile}`;
   const ctl = withTimeout(authTimeoutMs, signal);
   let resp;
   try {
@@ -1092,6 +1092,12 @@ async function discover(serverURL, signal) {
   }
   return meta;
 }
+async function discover(serverURL, signal) {
+  return discoverWithProfile(serverURL, "desktop", signal);
+}
+async function discoverWebOAuthMetadata(serverURL, signal) {
+  return discoverWithProfile(serverURL, "web", signal);
+}
 async function register(meta, appName, signal) {
   const regReq = {
     client_name: appName,
@@ -1123,12 +1129,50 @@ async function register(meta, appName, signal) {
     throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
-async function generateCodeVerifier() {
+async function registerWebOAuthClient(meta, opts, signal) {
+  const regReq = {
+    client_name: opts.clientName,
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    redirect_uris: opts.redirectURIs,
+    response_types: ["code"],
+    ...opts.scopes ? { scope: opts.scopes.join(" ") } : {}
+  };
+  const ctl = withTimeout(authTimeoutMs, signal);
+  let resp;
+  try {
+    resp = await fetch(meta.registration_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(regReq),
+      signal: ctl.signal
+    });
+  } catch (e) {
+    throw new Error(`register: ${e instanceof Error ? e.message : String(e)}`);
+  } finally {
+    ctl.dispose();
+  }
+  if (resp.status !== 200 && resp.status !== 201) {
+    throw new Error(`register: HTTP ${resp.status}`);
+  }
+  try {
+    return await resp.json();
+  } catch (e) {
+    throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function randomBase64Url32() {
   const c = await getCrypto();
   const b = new Uint8Array(32);
   c.getRandomValues(b);
   return base64urlNoPad(b);
 }
+async function generateCodeVerifier() {
+  return randomBase64Url32();
+}
+async function generateState() {
+  return randomBase64Url32();
+}
 async function codeChallenge(verifier) {
   const c = await getCrypto();
   const buf = await c.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
@@ -1162,6 +1206,7 @@ var ErrAuthDenied = "auth_denied";
 var ErrTimeout = "auth_timeout";
 var ErrTokenExchange = "token_exchange_failed";
 var ErrSSLProxy = "ssl_proxy_detected";
+var ErrStateMismatch = "state_mismatch";
 function isSSLError(err) {
   const msg = err instanceof Error ? err.message : String(err);
   return msg.includes("tls:") || msg.includes("x509:") || msg.includes("certificate");
@@ -1275,6 +1320,51 @@ async function authorize(meta, clientID, scopes, opts = {}) {
 function htmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+async function createWebAuthorizationRequest(meta, opts) {
+  const verifier = await generateCodeVerifier();
+  const challenge = await codeChallenge(verifier);
+  const state = await generateState();
+  const authURL = new URL(meta.authorization_endpoint);
+  authURL.searchParams.set("response_type", "code");
+  authURL.searchParams.set("client_id", opts.clientID);
+  authURL.searchParams.set("redirect_uri", opts.redirectURI);
+  authURL.searchParams.set("code_challenge", challenge);
+  authURL.searchParams.set("code_challenge_method", "S256");
+  authURL.searchParams.set("state", state);
+  authURL.searchParams.set("scope", opts.scopes.join(" "));
+  if (opts.loginHint) {
+    authURL.searchParams.set("login_hint", opts.loginHint);
+  }
+  return {
+    authUrl: authURL.toString(),
+    state,
+    verifier,
+    clientID: opts.clientID,
+    redirectURI: opts.redirectURI,
+    serverURL: opts.serverURL,
+    createdAt: Date.now()
+  };
+}
+async function completeWebAuthorizationRequest(pending, params, signal) {
+  if (!params.code) {
+    throw new Error("completeWebAuthorizationRequest: missing authorization code");
+  }
+  if (params.state !== pending.state) {
+    throw new Error(
+      `completeWebAuthorizationRequest: ${ErrStateMismatch}: callback state does not match pending state (possible CSRF)`
+    );
+  }
+  const meta = await discoverWebOAuthMetadata(pending.serverURL, signal);
+  const resp = await exchangeCode(
+    meta,
+    pending.clientID,
+    params.code,
+    pending.redirectURI,
+    pending.verifier,
+    signal
+  );
+  return newTokenSet(resp, pending.clientID, pending.serverURL);
+}
 async function exchangeCode(meta, clientID, code, redirectURI, codeVerifier, signal) {
   const data = new URLSearchParams({
     grant_type: "authorization_code",
@@ -2152,6 +2242,9 @@ var FilterStatusFallbackTkdistSkew = "fallback-tkdist-deployment-skew";
 var FilterStatusFallbackNoBuckets = "fallback-no-buckets";
 var FilterStatusFallbackMissingUser = "fallback-missing-userid";
 var FilterStatusUnknown = "";
+var ErrOAuthCORSBlocked = "oauth_cors_blocked";
+var ErrRefreshProxyFailed = "refresh_proxy_failed";
+var ErrTokenExpired = "token_expired";
 function newDeferred() {
   let resolve;
   let reject;
@@ -2167,6 +2260,12 @@ var Client = class _Client {
   serverURL;
   /** Compliance API 根地址 (已 trim 尾随 /); null = 走默认 ${serverURL}/admin-api */
   complianceBaseURL;
+  /** OAuth metadata profile — 刷新 token 时发现 metadata 用 (默认 'desktop') */
+  oauthMetadataProfile;
+  /** Browser Web OAuth refresh strategy (default 'direct') */
+  browserRefreshMode;
+  /** Same-origin refresh proxy URL for browserRefreshMode='server-proxy' */
+  refreshProxyURL;
   /** OAuth metadata (lazy loaded) */
   meta = null;
   /** 当前 token (内存) */
@@ -2201,6 +2300,9 @@ var Client = class _Client {
   constructor(cfg = {}) {
     this.serverURL = (cfg.serverURL ?? "https://acosmi.com").replace(/\/+$/, "");
     this.complianceBaseURL = cfg.complianceBaseURL ? cfg.complianceBaseURL.replace(/\/+$/, "") : null;
+    this.oauthMetadataProfile = cfg.oauthMetadataProfile ?? "desktop";
+    this.browserRefreshMode = cfg.browserRefreshMode ?? "direct";
+    this.refreshProxyURL = cfg.refreshProxyURL ?? null;
     this.store = cfg.store ?? defaultTokenStore();
     this.fetchImpl = cfg.fetchImpl ?? globalThis.fetch.bind(globalThis);
     this.retryPolicy = effectivePolicy(cfg.retryPolicy ?? null);
@@ -2375,7 +2477,7 @@ var Client = class _Client {
     if (tokens) {
       if (!meta) {
         try {
-          meta = await discover(this.serverURL, signal);
+          meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
         } catch (e) {
           console.warn(`[acosmi-sdk] warning: discover for revocation failed: ${e instanceof Error ? e.message : String(e)}`);
         }
@@ -2444,27 +2546,7 @@ var Client = class _Client {
         if (!tokenSetIsExpired(this.tokens)) {
           return this.tokens.access_token;
         }
-        if (this.meta == null) {
-          try {
-            this.meta = await discover(this.serverURL, signal);
-          } catch (e) {
-            throw new Error(
-              `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
-            );
-          }
-        }
-        let tokenResp;
-        try {
-          tokenResp = await refreshToken(this.meta, this.tokens.client_id, this.tokens.refresh_token, signal);
-        } catch (e) {
-          throw new Error(`refresh token: ${e instanceof Error ? e.message : String(e)}`);
-        }
-        this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
-        try {
-          await this.store.save(this.tokens);
-        } catch (e) {
-          console.warn(`[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`);
-        }
+        await this.refreshCurrentToken(signal);
         return this.tokens.access_token;
       })
     );
@@ -2477,26 +2559,111 @@ var Client = class _Client {
         if (this.tokens == null) {
           throw new Error("no tokens to refresh");
         }
-        if (this.meta == null) {
-          this.meta = await discover(this.serverURL, signal);
-        }
-        const tokenResp = await refreshToken(
-          this.meta,
-          this.tokens.client_id,
-          this.tokens.refresh_token,
-          signal
-        );
-        this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
-        try {
-          await this.store.save(this.tokens);
-        } catch (e) {
-          console.warn(
-            `[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`
-          );
-        }
+        await this.refreshCurrentToken(signal);
       })
     );
   }
+  async refreshCurrentToken(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (this.browserRefreshMode === "none") {
+      throw new Error(`${ErrTokenExpired}: token refresh disabled`);
+    }
+    if (this.browserRefreshMode === "server-proxy") {
+      await this.refreshCurrentTokenViaProxy(signal);
+      return;
+    }
+    await this.refreshCurrentTokenDirect(signal);
+  }
+  async refreshCurrentTokenDirect(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (this.meta == null) {
+      try {
+        this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
+      } catch (e) {
+        throw new Error(
+          `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
+    }
+    let tokenResp;
+    try {
+      tokenResp = await refreshToken(
+        this.meta,
+        this.tokens.client_id,
+        this.tokens.refresh_token,
+        signal
+      );
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      if (isLikelyBrowserOAuthCORSError(message)) {
+        throw new Error(`${ErrOAuthCORSBlocked}: refresh token: ${message}`);
+      }
+      throw new Error(`refresh token: ${message}`);
+    }
+    this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
+    await this.saveRefreshedToken();
+  }
+  async refreshCurrentTokenViaProxy(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (!this.refreshProxyURL) {
+      throw new Error(`${ErrRefreshProxyFailed}: refreshProxyURL is required`);
+    }
+    let resp;
+    try {
+      resp = await this.fetchImpl(this.refreshProxyURL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          client_id: this.tokens.client_id,
+          refresh_token: this.tokens.refresh_token,
+          server_url: this.tokens.server_url || this.serverURL
+        }),
+        signal
+      });
+    } catch (e) {
+      throw new Error(
+        `${ErrRefreshProxyFailed}: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (!resp.ok) {
+      let message = "";
+      try {
+        const body2 = await resp.json();
+        if (typeof body2.error === "string") message = body2.error;
+      } catch {
+      }
+      throw new Error(`${ErrRefreshProxyFailed}: HTTP ${resp.status}: ${message}`);
+    }
+    let body;
+    try {
+      body = await resp.json();
+    } catch (e) {
+      throw new Error(
+        `${ErrRefreshProxyFailed}: decode: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (!isTokenSetLike(body.tokenSet)) {
+      throw new Error(`${ErrRefreshProxyFailed}: response missing tokenSet`);
+    }
+    this.tokens = body.tokenSet;
+    await this.saveRefreshedToken();
+  }
+  async saveRefreshedToken() {
+    if (this.tokens == null) return;
+    try {
+      await this.store.save(this.tokens);
+    } catch (e) {
+      console.warn(
+        `[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+  }
   /** 互斥锁 helper (替代 Go sync.Mutex) */
   withMu(fn) {
     const next = this.mu.then(fn, fn);
@@ -3195,6 +3362,15 @@ function defaultTokenStore() {
   }
   return new InMemoryTokenStore();
 }
+function isLikelyBrowserOAuthCORSError(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("failed to fetch") || lower.includes("networkerror") || lower.includes("cors") || lower.includes("http 403");
+}
+function isTokenSetLike(value) {
+  if (value == null || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.access_token === "string" && typeof candidate.refresh_token === "string" && typeof candidate.expires_at === "string" && typeof candidate.scope === "string" && typeof candidate.client_id === "string" && typeof candidate.server_url === "string";
+}
 function zeroModelCapabilities() {
   return {
     supports_thinking: false,
@@ -5385,8 +5561,10 @@ exports.ErrBrowserOpen = ErrBrowserOpen;
 exports.ErrComplianceStepUpRequired = ErrComplianceStepUpRequired;
 exports.ErrDiscovery = ErrDiscovery;
 exports.ErrEnvelopeGateClosed = ErrEnvelopeGateClosed;
+exports.ErrOAuthCORSBlocked = ErrOAuthCORSBlocked;
 exports.ErrProviderNotConfigured = ErrProviderNotConfigured;
 exports.ErrProviderUnknownNoRetry = ErrProviderUnknownNoRetry;
+exports.ErrRefreshProxyFailed = ErrRefreshProxyFailed;
 exports.ErrRegistration = ErrRegistration;
 exports.ErrSSLProxy = ErrSSLProxy;
 exports.ErrSealApprovalContractHashMismatch = ErrSealApprovalContractHashMismatch;
@@ -5397,8 +5575,10 @@ exports.ErrSealApprovalNotApproved = ErrSealApprovalNotApproved;
 exports.ErrSealApprovalSealMismatch = ErrSealApprovalSealMismatch;
 exports.ErrSealApprovalTransactorMismatch = ErrSealApprovalTransactorMismatch;
 exports.ErrSealUseAlreadyConsumed = ErrSealUseAlreadyConsumed;
+exports.ErrStateMismatch = ErrStateMismatch;
 exports.ErrTimeout = ErrTimeout;
 exports.ErrTokenExchange = ErrTokenExchange;
+exports.ErrTokenExpired = ErrTokenExpired;
 exports.EventAuthURL = EventAuthURL;
 exports.EventComplete = EventComplete;
 exports.EventError = EventError;
@@ -5452,17 +5632,22 @@ exports.bucketRowIsCommercial = bucketRowIsCommercial;
 exports.buildBetas = buildBetas;
 exports.classifyComplianceError = classifyComplianceError;
 exports.commerceScopes = commerceScopes;
+exports.completeWebAuthorizationRequest = completeWebAuthorizationRequest;
 exports.complianceScopes = complianceScopes;
 exports.computeBackoff = computeBackoff;
+exports.createWebAuthorizationRequest = createWebAuthorizationRequest;
 exports.defaultRetryable = defaultRetryable;
 exports.defaultSafeToRetry = defaultSafeToRetry;
 exports.discover = discover;
+exports.discoverWebOAuthMetadata = discoverWebOAuthMetadata;
+exports.discoverWithProfile = discoverWithProfile;
 exports.effectivePolicy = effectivePolicy;
 exports.exchangeCode = exchangeCode;
 exports.extractAnthropicBlockMeta = extractAnthropicBlockMeta;
 exports.fileLockDefaults = fileLockDefaults;
 exports.findDesktopVisualUnderstandingModel = findDesktopVisualUnderstandingModel;
 exports.findFirstModelByInputModality = findFirstModelByInputModality;
+exports.generateState = generateState;
 exports.getAdapter = getAdapter;
 exports.getAdapterForModel = getAdapterForModel;
 exports.isBillingConfirmable = isBillingConfirmable;
@@ -5481,6 +5666,7 @@ exports.parseSettlement = parseSettlement;
 exports.parseSourcesEvent = parseSourcesEvent;
 exports.refreshToken = refreshToken;
 exports.register = register;
+exports.registerWebOAuthClient = registerWebOAuthClient;
 exports.revokeToken = revokeToken;
 exports.sanitize = sanitize_exports;
 exports.skillScopes = skillScopes;