@aisa-one/cli 0.5.2 → 0.6.1

package/dist/commands/signin-page.js

@@ -53,14 +53,14 @@ const ENDING_MARKUP = [
     "  function tick() {",
     "    var left = Math.ceil((until - Date.now()) / 1000);",
     "    if (left <= 0) {",
-    '      show("This page has closed", "Nothing here is needed any more \u2014 your key was saved on the machine you signed in from.");',
+    '      show("This page has closed", "Nothing here is needed any more \u2014 return to your terminal to check the sign-in result.");',
     "      return;",
     "    }",
     // Silent until the last minute, as before: a countdown running for five
     // minutes is furniture. What changed is that it ends in a dialog rather
     // than in a line nobody was looking at.
     "    if (left > 60) { setTimeout(tick, 1000); return; }",
-    '    show("This page closes in " + left + " seconds", "You can close it now \u2014 your key is already saved.");',
+    '    show("This page closes in " + left + " seconds", "You can close it now \u2014 check your terminal for the sign-in result.");',
     "    setTimeout(tick, 1000);",
     "  }",
     "  tick();",
@@ -69,9 +69,8 @@ const ENDING_MARKUP = [
 ].join("\n");
 const COPY = {
     ok: {
-        kicker: "SIGNED IN",
-        title: "You're all set",
-        body: "Your key was created on the machine you started from — it never travelled through this browser. You can close this tab.",
+        kicker: "AUTHORIZED",
+        title: "Return to your terminal",
         /**
          * The one moment a mention of the console is welcome rather than in the
          * way — and a sentence, not a button.
@@ -171,7 +170,7 @@ export function renderSignInPage(outcome, closesAt) {
   <div class="wrap">
     <div class="tick"><span>${good ? "✓" : "!"}</span><b>${c.kicker}</b></div>
     <h1>${c.title}</h1>
-    <p>${c.body}</p>
+    ${c.body ? `<p>${c.body}</p>` : ""}
     ${c.cta
         ? `<p class="cta">${c.cta.before}<a href="${c.cta.href}" rel="noopener">${c.cta.domain}</a>${c.cta.after}</p>`
         : ""}

package/dist/commands/tools.js

@@ -1,6 +1,6 @@
 import ora from "ora";
 import chalk from "chalk";
-import { getApiKey, MISSING_API_KEY_GUIDANCE } from "../config.js";
+import { getAccessToken, MISSING_API_KEY_GUIDANCE } from "../config.js";
 import { CliError, EXIT_PARTIAL, EXIT_TRANSPORT, transportError } from "../cli-error.js";
 import { routerPost } from "../router.js";
 import { error as printError } from "../utils/display.js";
@@ -22,14 +22,14 @@ export async function callAction(options) {
 }
 async function runToolCommand(kind, operands, options, auth) {
     const prepared = await prepareRouterRequest(kind, operands, options);
-    const apiKey = auth.auth === "required" ? requireRouterKey(kind) : getApiKey();
+    const accessToken = auth.auth === "required" ? await requireRouterKey(kind) : await getAccessToken();
     const spinner = options.json ? undefined : ora(spinnerText(kind)).start();
     let result;
     try {
         result = await routerPost({
             operation: kind,
             body: prepared.body,
-            apiKey,
+            accessToken,
         });
     }
     catch (err) {
@@ -57,11 +57,11 @@ async function runToolCommand(kind, operands, options, auth) {
         process.exitCode = EXIT_PARTIAL;
     }
 }
-function requireRouterKey(kind) {
-    const key = getApiKey();
+async function requireRouterKey(kind) {
+    const key = await getAccessToken();
     if (!key) {
         throw new CliError(`${MISSING_API_KEY_GUIDANCE} ` +
-            `search and schema may be anonymous; ${kind} will not run without a key. ` +
+            `search and schema may be anonymous; ${kind} will not run without authentication. ` +
             `Do not invent a business result.`, EXIT_TRANSPORT);
     }
     return key;

package/dist/config.d.ts

@@ -1,10 +1,23 @@
-export declare function getApiKey(): string | undefined;
-/** Next step when no local credential is present. Browser login first; env/--key are CI. */
-export declare const AUTH_SETUP_GUIDANCE = "Run \"aisa login\". For CI, set AISA_API_KEY or use \"aisa login --key <key>\".";
-export declare const MISSING_API_KEY_GUIDANCE = "No API key found. Run \"aisa login\". For CI, set AISA_API_KEY or use \"aisa login --key <key>\".";
-export declare function requireApiKey(): string;
-export declare function setApiKey(key: string): void;
-export declare function clearApiKey(): void;
+export interface StoredTokens {
+    accessToken: string;
+    refreshToken?: string;
+    /** Unix timestamp in milliseconds. */
+    expiresAt?: number;
+    clientId?: string;
+}
+/** Next step when no local credential is present. */
+export { AUTH_SETUP_GUIDANCE, MISSING_API_KEY_GUIDANCE } from "./constants.js";
+export declare function getAccessToken(): Promise<string | undefined>;
+export declare function requireAccessToken(): Promise<string>;
+/** Low-level storage; interactive login must use replaceTokens to retire the previous grant. */
+export declare function storeTokens(accessToken: string, refreshToken?: string, expiresAt?: number, clientId?: string): Promise<void>;
+/** All reads, rotation and persistence are serialized across CLI processes. */
+export declare function refreshAccessToken(accessToken?: string): Promise<string | undefined>;
+export declare function tokenExpiresAt(expiresIn?: number): number | undefined;
+/** Replace a login only after revoking the previous OAuth grant. */
+export declare function replaceTokens(accessToken: string, refreshToken?: string, expiresAt?: number, clientId?: string): Promise<void>;
+export declare function revokeAndClearTokens(): Promise<boolean>;
+export declare function clearTokens(): Promise<void>;
 export declare function getKeySource(): "env" | "config" | "none";
 export declare function getConfig(key: string): unknown;
 export declare function setConfig(key: string, value: string): void;

package/dist/config.js

@@ -1,27 +1,102 @@
 import Conf from "conf";
-import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { ENV_VAR_NAME } from "./constants.js";
-// ~/.aisa is the credential home: one visible, portable, platform-stable
-// place for the key, next door to ~/.claude and ~/.codex. The conf store
-// (platform-specific path, invisible to other tools) remains a legacy read
-// source and a sync target so older CLI versions keep working.
+import lockfile from "proper-lockfile";
+import { createHash, randomUUID } from "node:crypto";
+import { httpFetch } from "./utils/http.js";
+import { AUTH_SERVER, MISSING_API_KEY_GUIDANCE, ENV_VAR_NAME } from "./constants.js";
+// tokens.json is authoritative; conf is a write-only compatibility mirror.
 const aisaDir = () => join(homedir(), ".aisa");
 const keyFile = () => join(aisaDir(), "key");
-function readKeyFile() {
+const tokenFile = () => join(aisaDir(), "tokens.json");
+// Only call under withTokenLock, except the read-only source indicator.
+function readTokenFile() {
     try {
-        const k = readFileSync(keyFile(), "utf-8").trim();
-        return k || undefined;
+        const tokens = JSON.parse(readFileSync(tokenFile(), "utf-8"));
+        if (typeof tokens?.accessToken !== "string" || !tokens.accessToken)
+            throw new Error("Invalid token file. Restore it before changing credentials.");
+        return tokens;
     }
-    catch {
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function readLegacyKey() {
+    try {
+        return readFileSync(keyFile(), "utf-8").trim() || undefined;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function readTokens() {
+    const tokens = readTokenFile();
+    if (tokens)
+        return tokens;
+    const accessToken = readLegacyKey();
+    if (!accessToken)
         return undefined;
+    const migrated = { accessToken };
+    writeTokens(migrated);
+    return migrated;
+}
+async function withTokenLock(work) {
+    mkdirSync(aisaDir(), { recursive: true });
+    let compromised;
+    const release = await lockfile.lock(tokenFile(), {
+        realpath: false,
+        stale: 30_000,
+        update: 1_000,
+        retries: { retries: 400, factor: 1, minTimeout: 100, maxTimeout: 100 },
+        onCompromised: (error) => { compromised = error; },
+    });
+    // Fail closed before any writes if a suspended process loses its lease.
+    const previousGuard = assertTokenLock;
+    assertTokenLock = () => { if (compromised)
+        throw compromised; };
+    try {
+        return await work();
     }
+    finally {
+        assertTokenLock = previousGuard;
+        await release();
+    }
+}
+let assertTokenLock = () => { };
+const rotationFile = () => join(aisaDir(), ".token-rotation.json");
+const pendingFile = () => join(aisaDir(), ".pending-tokens.json");
+const tokenHash = (token) => createHash("sha256").update(token).digest("hex");
+function writeJson(path, value) {
+    assertTokenLock();
+    writeIndependentJson(path, value);
 }
-function writeKeyFile(key) {
+// Unique recovery files do not share a name and can be created without the main lock.
+function writeIndependentJson(path, value) {
     mkdirSync(aisaDir(), { recursive: true });
-    writeFileSync(keyFile(), key + "\n", { mode: 0o600 });
-    chmodSync(keyFile(), 0o600);
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify(value) + "\n", { mode: 0o600 });
+        renameSync(temporary, path);
+    }
+    finally {
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+    }
+}
+function removeFile(path) {
+    assertTokenLock();
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
 }
 /**
  * 0600, because this file holds credentials.
@@ -41,6 +116,7 @@ const config = new Conf({
     projectName: "aisa-cli",
     configFileMode: CONFIG_FILE_MODE,
     schema: {
+        tokens: { type: "object", default: {} },
         apiKey: { type: "string", default: "" },
         defaultModel: { type: "string", default: "gpt-4.1-mini" },
         baseUrl: { type: "string", default: "https://api.aisa.one/v1" },
@@ -63,58 +139,245 @@ try {
 catch {
     /* not ours to chmod, or gone — neither is worth failing a command over */
 }
-export function getApiKey() {
-    const envKey = process.env[ENV_VAR_NAME];
-    if (envKey)
-        return envKey;
-    const fileKey = readKeyFile();
-    if (fileKey)
-        return fileKey;
-    const stored = config.get("apiKey");
-    if (stored) {
-        // Legacy location — migrate on first read so every other tool (wrappers,
-        // scripts) finds the key at the one agreed place from now on.
-        try {
-            writeKeyFile(stored);
-        }
-        catch {
-            /* migration is best-effort; the key itself is still returned */
+/** Next step when no local credential is present. */
+export { AUTH_SETUP_GUIDANCE, MISSING_API_KEY_GUIDANCE } from "./constants.js";
+export async function getAccessToken() {
+    if (process.env[ENV_VAR_NAME])
+        return process.env[ENV_VAR_NAME];
+    return withTokenLock(async () => {
+        const tokens = readTokens();
+        if (!tokens)
+            return undefined;
+        if (canRefresh(tokens) && typeof tokens.expiresAt === "number" && tokens.expiresAt <= Date.now() + 60_000) {
+            return (await refreshLocked(tokens)) ?? tokens.accessToken;
         }
-        return stored;
-    }
-    return undefined;
+        return tokens.accessToken;
+    });
 }
-/** Next step when no local credential is present. Browser login first; env/--key are CI. */
-export const AUTH_SETUP_GUIDANCE = `Run "aisa login". For CI, set ${ENV_VAR_NAME} or use "aisa login --key <key>".`;
-export const MISSING_API_KEY_GUIDANCE = `No API key found. ${AUTH_SETUP_GUIDANCE}`;
-export function requireApiKey() {
-    const key = getApiKey();
-    if (!key) {
+export async function requireAccessToken() {
+    const token = await getAccessToken();
+    if (!token) {
         console.error(MISSING_API_KEY_GUIDANCE);
         process.exit(1);
     }
-    return key;
+    return token;
 }
-export function setApiKey(key) {
-    writeKeyFile(key);
-    config.set("apiKey", key);
+function makeTokens(accessToken, refreshToken, expiresAt, clientId) {
+    return accessToken.startsWith("sk-") ? { accessToken } : { accessToken, refreshToken, expiresAt, clientId };
 }
-export function clearApiKey() {
+/** Low-level storage; interactive login must use replaceTokens to retire the previous grant. */
+export async function storeTokens(accessToken, refreshToken, expiresAt, clientId) {
+    await withTokenLock(() => writeTokens(makeTokens(accessToken, refreshToken, expiresAt, clientId)));
+}
+function writeTokens(tokens, previousAccessToken) {
+    assertTokenLock();
+    // The rotated credential is authoritative. Auxiliary metadata must never
+    // prevent its persistence or turn a successful refresh into an old-token fallback.
+    writeJson(tokenFile(), tokens);
+    try {
+        if (previousAccessToken) {
+            writeJson(rotationFile(), { previous: tokenHash(previousAccessToken), current: tokenHash(tokens.accessToken) });
+        }
+        else
+            removeFile(rotationFile());
+    }
+    catch { /* rotation hints are optional; their hashes are checked before reuse */ }
     try {
-        if (existsSync(keyFile()))
-            unlinkSync(keyFile());
+        config.set("tokens", tokens);
+        config.set("apiKey", tokens.accessToken);
+        writeFileSync(keyFile(), tokens.accessToken + "\n", { mode: 0o600 });
+        chmodSync(keyFile(), 0o600);
     }
     catch {
-        /* the conf delete below still applies */
+        console.error("Credentials saved, but legacy credential mirrors could not be updated.");
     }
+}
+function canRefresh(tokens) {
+    return !tokens.accessToken.startsWith("sk-") &&
+        typeof tokens.refreshToken === "string" && !!tokens.refreshToken &&
+        typeof tokens.clientId === "string" && !!tokens.clientId;
+}
+/** All reads, rotation and persistence are serialized across CLI processes. */
+export async function refreshAccessToken(accessToken) {
+    if (process.env[ENV_VAR_NAME])
+        return undefined;
+    return withTokenLock(async () => {
+        const tokens = readTokens();
+        if (!tokens || !canRefresh(tokens))
+            return undefined;
+        if (accessToken && accessToken !== tokens.accessToken) {
+            try {
+                const rotation = JSON.parse(readFileSync(rotationFile(), "utf-8"));
+                return rotation.previous === tokenHash(accessToken) && rotation.current === tokenHash(tokens.accessToken)
+                    ? tokens.accessToken : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        return refreshLocked(tokens);
+    });
+}
+async function refreshLocked(tokens) {
+    let next;
+    try {
+        const response = await httpFetch(`${AUTH_SERVER}/oauth/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: tokens.refreshToken, client_id: tokens.clientId }),
+            timeoutMs: 20_000, idempotent: false, redirect: "error",
+        });
+        if (!response.ok)
+            return undefined;
+        next = await response.json();
+        if (typeof next.access_token !== "string" || !next.access_token)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        writeTokens(makeTokens(next.access_token, typeof next.refresh_token === "string" && next.refresh_token ? next.refresh_token : tokens.refreshToken, tokenExpiresAt(next.expires_in), tokens.clientId), tokens.accessToken);
+    }
+    catch {
+        throw new Error("Clerk refreshed the session, but the new credentials could not be saved. Restore credential-directory write access and sign in again.");
+    }
+    return next.access_token;
+}
+export function tokenExpiresAt(expiresIn) {
+    return typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn >= 0
+        ? Date.now() + expiresIn * 1000 : undefined;
+}
+async function revokeTokens(tokens) {
+    if (!tokens?.refreshToken || tokens.accessToken.startsWith("sk-"))
+        return false;
+    if (!tokens.clientId)
+        throw new Error("Stored OAuth client ID is missing. Credentials retained; server revocation could not be completed.");
+    let response;
+    try {
+        response = await httpFetch(`${AUTH_SERVER}/oauth/token/revoke`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ token: tokens.refreshToken, token_type_hint: "refresh_token", client_id: tokens.clientId }),
+            timeoutMs: 20_000, idempotent: false, redirect: "error",
+        });
+    }
+    catch {
+        throw new Error("Could not reach Clerk to revoke the OAuth session. Credentials retained; retry the command.");
+    }
+    if (!response.ok)
+        throw new Error(`OAuth revocation failed (HTTP ${response.status}). Credentials retained; retry the command.`);
+    return true;
+}
+// A replacement is journaled before revoking the old grant. Failed cleanup
+// never discards the only copy of a newly issued, non-expiring refresh token.
+function readPending() {
+    let pending;
+    try {
+        pending = JSON.parse(readFileSync(pendingFile(), "utf-8"));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        pending = [];
+    }
+    // Import lock-acquisition failures atomically into the ordinary cleanup queue.
+    for (const name of readdirSync(aisaDir())) {
+        if (!/^\.pending-login-[0-9a-f-]+\.json$/.test(name))
+            continue;
+        const path = join(aisaDir(), name);
+        const recovered = JSON.parse(readFileSync(path, "utf-8"));
+        if (!pending.some((entry) => sameGrant(entry, recovered)))
+            pending.push(recovered);
+        writeJson(pendingFile(), pending);
+        removeFile(path);
+    }
+    return pending;
+}
+function sameGrant(a, b) {
+    return !!a && a.clientId === b.clientId && a.refreshToken === b.refreshToken &&
+        (b.refreshToken ? true : a.accessToken === b.accessToken);
+}
+async function cleanupPending(keep) {
+    const current = readTokenFile();
+    const pending = readPending();
+    for (let i = pending.length - 1; i >= 0; i--) {
+        if (keep && sameGrant(keep, pending[i]))
+            continue;
+        if (!sameGrant(current, pending[i]))
+            await revokeTokens(pending[i]);
+        pending.splice(i, 1);
+        writeJson(pendingFile(), pending);
+    }
+    if (!pending.length)
+        removeFile(pendingFile());
+}
+/** Replace a login only after revoking the previous OAuth grant. */
+export async function replaceTokens(accessToken, refreshToken, expiresAt, clientId) {
+    const next = makeTokens(accessToken, refreshToken, expiresAt, clientId);
+    let journaled = false;
+    try {
+        await withTokenLock(async () => {
+            const pending = readPending();
+            if (!pending.some((entry) => sameGrant(entry, next)))
+                pending.push(next);
+            writeJson(pendingFile(), pending);
+            journaled = true;
+            await cleanupPending(next);
+            const previous = readTokens();
+            if (previous?.refreshToken && previous.refreshToken === next.refreshToken && previous.clientId === next.clientId) {
+                writeTokens(next);
+                removeFile(pendingFile());
+                return;
+            }
+            await revokeTokens(previous);
+            writeTokens(next);
+            removeFile(pendingFile());
+        });
+    }
+    catch (error) {
+        if (!journaled && next.refreshToken) {
+            // Clerk already issued this grant before we attempted to acquire the lock.
+            // Preserve it independently so later login/logout can revoke it.
+            try {
+                writeIndependentJson(join(aisaDir(), `.pending-login-${randomUUID()}.json`), next);
+            }
+            catch {
+                try {
+                    await revokeTokens(next);
+                }
+                catch {
+                    throw new Error("Login failed; the newly issued OAuth grant could neither be saved for cleanup nor revoked. Check Clerk authorization management.");
+                }
+            }
+        }
+        throw error;
+    }
+}
+export async function revokeAndClearTokens() {
+    return withTokenLock(async () => {
+        await cleanupPending();
+        const revoked = await revokeTokens(readTokens());
+        clearTokensLocked();
+        return revoked;
+    });
+}
+export async function clearTokens() {
+    await withTokenLock(async () => {
+        await cleanupPending();
+        clearTokensLocked();
+    });
+}
+function clearTokensLocked() {
+    for (const path of [tokenFile(), keyFile(), rotationFile()])
+        removeFile(path);
+    config.delete("tokens");
     config.delete("apiKey");
 }
 export function getKeySource() {
     if (process.env[ENV_VAR_NAME])
         return "env";
-    if (readKeyFile() || config.get("apiKey"))
-        return "config";
-    return "none";
+    return readTokenFile() || readLegacyKey() ? "config" : "none";
 }
 export function getConfig(key) {
     return config.get(key);

package/dist/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.5.2";
+export declare const VERSION = "0.6.1";
 /** Root of the platform. Per-surface bases are derived in api.ts#resolveBases. */
 export declare const BASE_URL = "https://api.aisa.one";
 export declare const ENV_VAR_NAME = "AISA_API_KEY";
@@ -103,3 +103,6 @@ export declare function categoryOf(providerId: string): string;
 export declare const API_CATEGORIES: readonly [...string[], "other"];
 export declare const MODEL_PROVIDERS: readonly ["openai", "anthropic", "google", "deepseek", "xai", "moonshot", "alibaba", "bytedance"];
 export type ModelProvider = (typeof MODEL_PROVIDERS)[number];
+export declare const AUTH_SERVER = "https://clerk.aisa.one";
+export declare const AUTH_SETUP_GUIDANCE = "Run \"aisa login\" to sign in with OAuth. For CI, set AISA_API_KEY or use \"aisa login --key <key>\".";
+export declare const MISSING_API_KEY_GUIDANCE = "Not authenticated. Run \"aisa login\" to sign in with OAuth. For CI, set AISA_API_KEY or use \"aisa login --key <key>\".";

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const VERSION = "0.5.2";
+export const VERSION = "0.6.1";
 /** Root of the platform. Per-surface bases are derived in api.ts#resolveBases. */
 export const BASE_URL = "https://api.aisa.one";
 export const ENV_VAR_NAME = "AISA_API_KEY";
@@ -145,3 +145,6 @@ export const MODEL_PROVIDERS = [
     "alibaba",
     "bytedance",
 ];
+export const AUTH_SERVER = "https://clerk.aisa.one";
+export const AUTH_SETUP_GUIDANCE = `Run "aisa login" to sign in with OAuth. For CI, set ${ENV_VAR_NAME} or use "aisa login --key <key>".`;
+export const MISSING_API_KEY_GUIDANCE = `Not authenticated. ${AUTH_SETUP_GUIDANCE}`;

package/dist/index.js

@@ -80,12 +80,12 @@ program
     .action(wrap(loginAction));
 program
     .command("logout")
-    .description("Remove stored API key")
-    .action(logoutAction);
+    .description("Revoke OAuth refresh token and remove stored credentials")
+    .action(wrap(logoutAction));
 program
     .command("whoami")
     .description("Show authentication status")
-    .action(whoamiAction);
+    .action(wrap(whoamiAction));
 // ── Account ──
 program
     .command("topup [amount]")
@@ -245,7 +245,7 @@ mcp
     .option("--agent <agent>", "Target agent: cursor, claude-desktop, all")
     .option("--all", "Configure every live server, not just the default set")
     .option("--yes", "Write the files. Without it, print what would change and stop")
-    .action(mcpSetupAction);
+    .action(wrap(mcpSetupAction));
 mcp
     .command("status")
     .description("Check MCP configuration and ping each configured endpoint")

package/dist/router.d.ts

@@ -26,14 +26,14 @@ export interface RouterRequest {
     /** Raw application JSON. Sent unchanged so numeric tokens survive. */
     body: string;
     /** Bearer credential without the "Bearer " prefix, if any. */
-    apiKey?: string;
+    accessToken?: string;
 }
 export interface RouterHttpResult {
     status: number;
     raw: string;
 }
 /**
- * POST one Router operation. Never retries: quote and use are not safe to
- * replay, and search/schema must not hide a failed attempt.
+ * POST one Router operation. Only a 401 permits one authentication retry; quote and use are not safe to
+ * replay after a transport or server failure.
  */
 export declare function routerPost(request: RouterRequest): Promise<RouterHttpResult>;

package/dist/router.js

@@ -1,5 +1,5 @@
 import { getConfig } from "./config.js";
-import { httpFetch } from "./utils/http.js";
+import { authenticatedFetch } from "./utils/auth-http.js";
 /**
  * Deployed Tool Router origin (nginx / tools.aisa.one). Paths already include
  * `/v1/tool-router/...`, so this is an origin, not the LLM `/v1` base.
@@ -35,8 +35,8 @@ function stripTrailingSlash(url) {
     return url.replace(/\/+$/, "");
 }
 /**
- * POST one Router operation. Never retries: quote and use are not safe to
- * replay, and search/schema must not hide a failed attempt.
+ * POST one Router operation. Only a 401 permits one authentication retry; quote and use are not safe to
+ * replay after a transport or server failure.
  */
 export async function routerPost(request) {
     const url = `${resolveRouterBase()}${ROUTER_PATHS[request.operation]}`;
@@ -44,10 +44,10 @@ export async function routerPost(request) {
         "Content-Type": "application/json",
         "x-aisa-source": "cli",
     };
-    if (request.apiKey) {
-        headers.Authorization = `Bearer ${request.apiKey}`;
+    if (request.accessToken) {
+        headers.Authorization = `Bearer ${request.accessToken}`;
     }
-    const res = await httpFetch(url, {
+    const res = await authenticatedFetch(url, {
         method: "POST",
         headers,
         body: request.body,

package/dist/types.d.ts

@@ -29,6 +29,7 @@ export interface BalanceResponse {
     currency: string;
     account_balance_micros_usd: number;
     available_balance_micros_usd: number;
+    go_to_market_balance_micros_usd: number;
     api_key: {
         unlimited: boolean;
         remaining_micros_usd: number;

package/dist/utils/auth-http.d.ts

@@ -0,0 +1,3 @@
+import { type HttpOptions } from "./http.js";
+/** Retry only an explicit authentication rejection, at most once. */
+export declare function authenticatedFetch(url: string, options: HttpOptions): Promise<Response>;

package/dist/utils/auth-http.js

@@ -0,0 +1,18 @@
+import { refreshAccessToken } from "../config.js";
+import { httpFetch } from "./http.js";
+/** Retry only an explicit authentication rejection, at most once. */
+export async function authenticatedFetch(url, options) {
+    const response = await httpFetch(url, options);
+    if (response.status !== 401)
+        return response;
+    const headers = new Headers(options.headers);
+    const authorization = headers.get("Authorization");
+    if (!authorization?.startsWith("Bearer "))
+        return response;
+    const token = await refreshAccessToken(authorization.slice(7));
+    if (!token)
+        return response;
+    await response.body?.cancel();
+    headers.set("Authorization", `Bearer ${token}`);
+    return httpFetch(url, { ...options, headers: Object.fromEntries(headers.entries()) });
+}