@acosmi/sdk-ts 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -9,6 +9,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.4.1] — 2026-05-22
+
+### Added
+
+- **`Config.browserRefreshMode?: 'direct' | 'server-proxy' | 'none'`** 与
+  `refreshProxyURL` — 浏览器 Web OAuth token 刷新策略。默认 `direct` 保持既有行为；
+  `server-proxy` 可把刷新收口到同源 Route Handler，规避 OAuth issuer CORS 403；
+  `none` 用于产品自行处理过期登录态。新增错误码常量
+  `ErrOAuthCORSBlocked`、`ErrRefreshProxyFailed`、`ErrTokenExpired`。
+
+---
+
 ## [1.4.0] — 2026-05-21
 
 > csign `/login` Web OAuth 接入复核审计（`docs/audit/csign-login-oauth-audit-result-2026-05-21`）

package/dist/browser/index.mjs

@@ -2240,6 +2240,9 @@ var FilterStatusFallbackTkdistSkew = "fallback-tkdist-deployment-skew";
 var FilterStatusFallbackNoBuckets = "fallback-no-buckets";
 var FilterStatusFallbackMissingUser = "fallback-missing-userid";
 var FilterStatusUnknown = "";
+var ErrOAuthCORSBlocked = "oauth_cors_blocked";
+var ErrRefreshProxyFailed = "refresh_proxy_failed";
+var ErrTokenExpired = "token_expired";
 function newDeferred() {
   let resolve;
   let reject;
@@ -2257,6 +2260,10 @@ var Client = class _Client {
   complianceBaseURL;
   /** OAuth metadata profile — 刷新 token 时发现 metadata 用 (默认 'desktop') */
   oauthMetadataProfile;
+  /** Browser Web OAuth refresh strategy (default 'direct') */
+  browserRefreshMode;
+  /** Same-origin refresh proxy URL for browserRefreshMode='server-proxy' */
+  refreshProxyURL;
   /** OAuth metadata (lazy loaded) */
   meta = null;
   /** 当前 token (内存) */
@@ -2292,6 +2299,8 @@ var Client = class _Client {
     this.serverURL = (cfg.serverURL ?? "https://acosmi.com").replace(/\/+$/, "");
     this.complianceBaseURL = cfg.complianceBaseURL ? cfg.complianceBaseURL.replace(/\/+$/, "") : null;
     this.oauthMetadataProfile = cfg.oauthMetadataProfile ?? "desktop";
+    this.browserRefreshMode = cfg.browserRefreshMode ?? "direct";
+    this.refreshProxyURL = cfg.refreshProxyURL ?? null;
     this.store = cfg.store ?? defaultTokenStore();
     this.fetchImpl = cfg.fetchImpl ?? globalThis.fetch.bind(globalThis);
     this.retryPolicy = effectivePolicy(cfg.retryPolicy ?? null);
@@ -2535,27 +2544,7 @@ var Client = class _Client {
         if (!tokenSetIsExpired(this.tokens)) {
           return this.tokens.access_token;
         }
-        if (this.meta == null) {
-          try {
-            this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
-          } catch (e) {
-            throw new Error(
-              `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
-            );
-          }
-        }
-        let tokenResp;
-        try {
-          tokenResp = await refreshToken(this.meta, this.tokens.client_id, this.tokens.refresh_token, signal);
-        } catch (e) {
-          throw new Error(`refresh token: ${e instanceof Error ? e.message : String(e)}`);
-        }
-        this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
-        try {
-          await this.store.save(this.tokens);
-        } catch (e) {
-          console.warn(`[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`);
-        }
+        await this.refreshCurrentToken(signal);
         return this.tokens.access_token;
       })
     );
@@ -2568,26 +2557,111 @@ var Client = class _Client {
         if (this.tokens == null) {
           throw new Error("no tokens to refresh");
         }
-        if (this.meta == null) {
-          this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
-        }
-        const tokenResp = await refreshToken(
-          this.meta,
-          this.tokens.client_id,
-          this.tokens.refresh_token,
-          signal
-        );
-        this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
-        try {
-          await this.store.save(this.tokens);
-        } catch (e) {
-          console.warn(
-            `[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`
-          );
-        }
+        await this.refreshCurrentToken(signal);
       })
     );
   }
+  async refreshCurrentToken(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (this.browserRefreshMode === "none") {
+      throw new Error(`${ErrTokenExpired}: token refresh disabled`);
+    }
+    if (this.browserRefreshMode === "server-proxy") {
+      await this.refreshCurrentTokenViaProxy(signal);
+      return;
+    }
+    await this.refreshCurrentTokenDirect(signal);
+  }
+  async refreshCurrentTokenDirect(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (this.meta == null) {
+      try {
+        this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
+      } catch (e) {
+        throw new Error(
+          `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
+    }
+    let tokenResp;
+    try {
+      tokenResp = await refreshToken(
+        this.meta,
+        this.tokens.client_id,
+        this.tokens.refresh_token,
+        signal
+      );
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      if (isLikelyBrowserOAuthCORSError(message)) {
+        throw new Error(`${ErrOAuthCORSBlocked}: refresh token: ${message}`);
+      }
+      throw new Error(`refresh token: ${message}`);
+    }
+    this.tokens = newTokenSet(tokenResp, this.tokens.client_id, this.serverURL);
+    await this.saveRefreshedToken();
+  }
+  async refreshCurrentTokenViaProxy(signal) {
+    if (this.tokens == null) {
+      throw new Error("no tokens to refresh");
+    }
+    if (!this.refreshProxyURL) {
+      throw new Error(`${ErrRefreshProxyFailed}: refreshProxyURL is required`);
+    }
+    let resp;
+    try {
+      resp = await this.fetchImpl(this.refreshProxyURL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          client_id: this.tokens.client_id,
+          refresh_token: this.tokens.refresh_token,
+          server_url: this.tokens.server_url || this.serverURL
+        }),
+        signal
+      });
+    } catch (e) {
+      throw new Error(
+        `${ErrRefreshProxyFailed}: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (!resp.ok) {
+      let message = "";
+      try {
+        const body2 = await resp.json();
+        if (typeof body2.error === "string") message = body2.error;
+      } catch {
+      }
+      throw new Error(`${ErrRefreshProxyFailed}: HTTP ${resp.status}: ${message}`);
+    }
+    let body;
+    try {
+      body = await resp.json();
+    } catch (e) {
+      throw new Error(
+        `${ErrRefreshProxyFailed}: decode: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (!isTokenSetLike(body.tokenSet)) {
+      throw new Error(`${ErrRefreshProxyFailed}: response missing tokenSet`);
+    }
+    this.tokens = body.tokenSet;
+    await this.saveRefreshedToken();
+  }
+  async saveRefreshedToken() {
+    if (this.tokens == null) return;
+    try {
+      await this.store.save(this.tokens);
+    } catch (e) {
+      console.warn(
+        `[acosmi-sdk] warning: save refreshed token failed: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+  }
   /** 互斥锁 helper (替代 Go sync.Mutex) */
   withMu(fn) {
     const next = this.mu.then(fn, fn);
@@ -3286,6 +3360,15 @@ function defaultTokenStore() {
   }
   return new InMemoryTokenStore();
 }
+function isLikelyBrowserOAuthCORSError(message) {
+  const lower = message.toLowerCase();
+  return lower.includes("failed to fetch") || lower.includes("networkerror") || lower.includes("cors") || lower.includes("http 403");
+}
+function isTokenSetLike(value) {
+  if (value == null || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.access_token === "string" && typeof candidate.refresh_token === "string" && typeof candidate.expires_at === "string" && typeof candidate.scope === "string" && typeof candidate.client_id === "string" && typeof candidate.server_url === "string";
+}
 function zeroModelCapabilities() {
   return {
     supports_thinking: false,
@@ -5462,6 +5545,6 @@ Client.prototype.getBugReport = async function(bugID, signal) {
   return resp.data;
 };
 
-export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, LocalStorageTokenStore as DefaultBrowserTokenStore, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
+export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, LocalStorageTokenStore as DefaultBrowserTokenStore, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map