@alphafox/cli 0.1.2 → 0.1.4

package/dist/auth/refresh.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Silent access-token renewal via refresh_token grant.
+ * Access tokens are short-lived (~10m); refresh tokens last ~30d (web ADR).
+ */
+import type { ProfileConfig } from "../config/profiles";
+import { type StoredTokens } from "../keychain/store";
+/** Refresh when access token expires within this window. */
+export declare const ACCESS_TOKEN_REFRESH_SKEW_MS = 60000;
+export declare function accessTokenNeedsRefresh(tokens: StoredTokens, now?: number): boolean;
+/**
+ * Exchange refresh_token for a new AT/RT pair and persist to keychain.
+ * Returns null if no tokens, no refresh token, or the AS rejects renewal.
+ */
+export declare function refreshStoredTokens(profile: ProfileConfig, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, options?: {
+    readonly now?: number;
+    readonly force?: boolean;
+}): Promise<StoredTokens | null>;
+/** Test helper: clear in-flight map between cases. */
+export declare function clearRefreshInflightForTests(): void;

package/dist/auth/refresh.js

@@ -0,0 +1,188 @@
+"use strict";
+/**
+ * Silent access-token renewal via refresh_token grant.
+ * Access tokens are short-lived (~10m); refresh tokens last ~30d (web ADR).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESS_TOKEN_REFRESH_SKEW_MS = void 0;
+exports.accessTokenNeedsRefresh = accessTokenNeedsRefresh;
+exports.refreshStoredTokens = refreshStoredTokens;
+exports.clearRefreshInflightForTests = clearRefreshInflightForTests;
+const store_1 = require("../keychain/store");
+/** Refresh when access token expires within this window. */
+exports.ACCESS_TOKEN_REFRESH_SKEW_MS = 60_000;
+/** In-flight refresh promises so concurrent API calls share one rotation. */
+const inflightByProfile = new Map();
+function accessTokenNeedsRefresh(tokens, now = Date.now()) {
+    if (!tokens.refreshToken?.trim()) {
+        return false;
+    }
+    return tokens.expiresAt <= now + exports.ACCESS_TOKEN_REFRESH_SKEW_MS;
+}
+/**
+ * Exchange refresh_token for a new AT/RT pair and persist to keychain.
+ * Returns null if no tokens, no refresh token, or the AS rejects renewal.
+ */
+async function refreshStoredTokens(profile, env = process.env, fetchImpl = fetch, options = {}) {
+    const existing = (0, store_1.loadTokens)(profile.name, env);
+    if (!existing?.refreshToken?.trim()) {
+        return null;
+    }
+    if (!options.force &&
+        !accessTokenNeedsRefresh(existing, options.now ?? Date.now())) {
+        return existing;
+    }
+    const key = profile.name;
+    const pending = inflightByProfile.get(key);
+    if (pending) {
+        return pending;
+    }
+    const work = performRefresh(profile, existing, env, fetchImpl).finally(() => {
+        inflightByProfile.delete(key);
+    });
+    inflightByProfile.set(key, work);
+    return work;
+}
+async function performRefresh(profile, existing, env, fetchImpl) {
+    const origin = profile.apiBaseUrl.replace(/\/$/, "").replace(/\/api\/v1$/, "");
+    const url = `${origin}/api/auth/oauth/token`;
+    const body = {
+        grant_type: "refresh_token",
+        refresh_token: existing.refreshToken,
+        client_id: existing.clientId || profile.clientId,
+    };
+    let response;
+    try {
+        response = await fetchFollowingSameSiteRedirects(fetchImpl, url, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json",
+                "X-Alphafox-Client": "alphafox-cli",
+                "X-Alphafox-Client-Version": env.ALPHAFOX_CLI_VERSION ?? "0.1.0",
+            },
+            body: JSON.stringify(body),
+            redirect: "manual",
+        });
+    }
+    catch {
+        return null;
+    }
+    if (response.status >= 400) {
+        return null;
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch {
+        return null;
+    }
+    if (!json || typeof json !== "object") {
+        return null;
+    }
+    const o = json;
+    const access = typeof o.access_token === "string"
+        ? o.access_token
+        : typeof o.accessToken === "string"
+            ? o.accessToken
+            : null;
+    const refresh = typeof o.refresh_token === "string"
+        ? o.refresh_token
+        : typeof o.refreshToken === "string"
+            ? o.refreshToken
+            : null;
+    if (!access || !refresh) {
+        return null;
+    }
+    const expiresIn = typeof o.expires_in === "number"
+        ? o.expires_in
+        : typeof o.expiresIn === "number"
+            ? o.expiresIn
+            : 600;
+    const scopeRaw = typeof o.scope === "string"
+        ? o.scope
+        : existing.scopes.join(" ");
+    const next = {
+        accessToken: access,
+        refreshToken: refresh,
+        expiresAt: Date.now() + expiresIn * 1000,
+        environment: existing.environment || profile.name,
+        issuer: existing.issuer || profile.issuer,
+        audience: existing.audience || profile.audience,
+        clientId: existing.clientId || profile.clientId,
+        scopes: scopeRaw.split(/\s+/).filter(Boolean),
+    };
+    (0, store_1.saveTokens)(profile.name, next, env);
+    return next;
+}
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+async function fetchFollowingSameSiteRedirects(fetchImpl, startUrl, init, maxHops = 5) {
+    let url = startUrl;
+    let method = (init.method ?? "GET").toUpperCase();
+    let body = init.body;
+    let response = await fetchImpl(url, {
+        ...init,
+        method,
+        body,
+        redirect: "manual",
+    });
+    for (let hop = 0; hop < maxHops && REDIRECT_STATUSES.has(response.status); hop++) {
+        const location = response.headers.get("location");
+        if (!location)
+            break;
+        const nextUrl = new URL(location, url).toString();
+        if (!sameAuthSite(originOf(url), originOf(nextUrl)))
+            break;
+        if (response.status === 303 ||
+            ((response.status === 301 || response.status === 302) &&
+                method !== "GET" &&
+                method !== "HEAD")) {
+            method = "GET";
+            body = undefined;
+        }
+        url = nextUrl;
+        response = await fetchImpl(url, {
+            ...init,
+            method,
+            body,
+            redirect: "manual",
+        });
+    }
+    return response;
+}
+function originOf(value) {
+    if (!value)
+        return null;
+    try {
+        if (value.startsWith("http://") || value.startsWith("https://")) {
+            return new URL(value).origin;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function sameAuthSite(a, b) {
+    if (!a || !b)
+        return false;
+    if (a === b)
+        return true;
+    try {
+        const ua = new URL(a);
+        const ub = new URL(b);
+        if (ua.protocol !== ub.protocol)
+            return false;
+        const ha = ua.hostname.replace(/^www\./i, "").toLowerCase();
+        const hb = ub.hostname.replace(/^www\./i, "").toLowerCase();
+        return ha === hb && ua.port === ub.port;
+    }
+    catch {
+        return false;
+    }
+}
+/** Test helper: clear in-flight map between cases. */
+function clearRefreshInflightForTests() {
+    inflightByProfile.clear();
+}

package/dist/http/client.d.ts

@@ -8,6 +8,8 @@ export interface ApiRequestOptions {
     readonly requestId?: string;
     readonly skipAuth?: boolean;
     readonly idempotencyKey?: string;
+    /** Internal: already attempted one silent refresh+retry for this call. */
+    readonly _refreshRetried?: boolean;
 }
 export interface ApiResponse {
     readonly status: number;

package/dist/http/client.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.apiRequest = apiRequest;
 const envelope_1 = require("../envelope");
+const refresh_1 = require("../auth/refresh");
 const store_1 = require("../keychain/store");
 const allowlist_1 = require("../catalog/allowlist");
 async function apiRequest(options, env = process.env, fetchImpl = fetch) {
@@ -48,15 +49,24 @@ async function apiRequest(options, env = process.env, fetchImpl = fetch) {
         ...(options.headers ?? {}),
     };
     if (!options.skipAuth) {
-        const tokens = (0, store_1.loadTokens)(options.profile.name, env);
+        let tokens = (0, store_1.loadTokens)(options.profile.name, env);
+        // Proactive refresh before the access token expires (or once already expired).
+        if (tokens && (0, refresh_1.accessTokenNeedsRefresh)(tokens)) {
+            const renewed = await (0, refresh_1.refreshStoredTokens)(options.profile, env, fetchImpl, { force: true });
+            if (renewed) {
+                tokens = renewed;
+            }
+        }
         if (tokens) {
-            // Never send tokens to a different origin than the profile audience.
+            // Never send tokens to a different site than the profile audience.
+            // Apex/www (and trailing host variants) of the same registrable domain
+            // are treated as equivalent so production domain redirects do not break CLI.
             const tokenAudienceOrigin = originOf(tokens.audience);
             const targetOrigin = originOf(url);
             if (tokens.audience &&
                 tokenAudienceOrigin &&
                 targetOrigin &&
-                tokenAudienceOrigin !== targetOrigin) {
+                !sameAuthSite(tokenAudienceOrigin, targetOrigin)) {
                 throw Object.assign(new Error("Refusing to send stored tokens to a different origin than token audience (fail-closed)."), {
                     status: 403,
                     type: "authorization",
@@ -72,12 +82,15 @@ async function apiRequest(options, env = process.env, fetchImpl = fetch) {
     const init = {
         method: options.method.toUpperCase(),
         headers,
+        // Follow redirects ourselves so Authorization is re-attached after apex→www.
+        // fetch()'s automatic redirect drops Authorization on cross-origin hops.
+        redirect: "manual",
     };
     if (options.body !== undefined) {
         headers["Content-Type"] = "application/json";
         init.body = JSON.stringify(options.body);
     }
-    const response = await fetchImpl(url, init);
+    const response = await fetchFollowingAuthRedirects(fetchImpl, url, init);
     const bodyText = await response.text();
     let json = null;
     try {
@@ -89,6 +102,19 @@ async function apiRequest(options, env = process.env, fetchImpl = fetch) {
     const responseRequestId = response.headers.get("x-request-id") ??
         response.headers.get("X-Request-Id") ??
         requestId;
+    // Reactive: one silent refresh+retry on 401 for authenticated product calls.
+    if (response.status === 401 &&
+        !options.skipAuth &&
+        !options._refreshRetried &&
+        !isOAuthAsPath) {
+        const tokens = (0, store_1.loadTokens)(options.profile.name, env);
+        if (tokens?.refreshToken?.trim()) {
+            const renewed = await (0, refresh_1.refreshStoredTokens)(options.profile, env, fetchImpl, { force: true });
+            if (renewed) {
+                return apiRequest({ ...options, requestId, _refreshRetried: true }, env, fetchImpl);
+            }
+        }
+    }
     return {
         status: response.status,
         headers: response.headers,
@@ -97,7 +123,44 @@ async function apiRequest(options, env = process.env, fetchImpl = fetch) {
         json,
     };
 }
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/**
+ * Re-issue requests on same-site redirects while keeping Authorization.
+ * Needed because alphafox.app → www.alphafox.app is a cross-origin hop for fetch.
+ */
+async function fetchFollowingAuthRedirects(fetchImpl, startUrl, init, maxHops = 5) {
+    let url = startUrl;
+    let method = (init.method ?? "GET").toUpperCase();
+    let body = init.body;
+    let response = await fetchImpl(url, { ...init, method, body, redirect: "manual" });
+    for (let hop = 0; hop < maxHops && REDIRECT_STATUSES.has(response.status); hop++) {
+        const location = response.headers.get("location");
+        if (!location) {
+            break;
+        }
+        const nextUrl = new URL(location, url).toString();
+        if (!sameAuthSite(originOf(url), originOf(nextUrl))) {
+            break;
+        }
+        // 303 switches to GET without body; 301/302 historically do for non-GET.
+        if (response.status === 303 ||
+            ((response.status === 301 || response.status === 302) && method !== "GET" && method !== "HEAD")) {
+            method = "GET";
+            body = undefined;
+        }
+        url = nextUrl;
+        response = await fetchImpl(url, {
+            ...init,
+            method,
+            body,
+            redirect: "manual",
+        });
+    }
+    return response;
+}
 function originOf(value) {
+    if (!value)
+        return null;
     try {
         if (value.startsWith("http://") || value.startsWith("https://")) {
             return new URL(value).origin;
@@ -108,3 +171,22 @@ function originOf(value) {
         return null;
     }
 }
+/** Apex and www hosts of the same site share auth tokens. */
+function sameAuthSite(a, b) {
+    if (!a || !b)
+        return false;
+    if (a === b)
+        return true;
+    try {
+        const ua = new URL(a);
+        const ub = new URL(b);
+        if (ua.protocol !== ub.protocol)
+            return false;
+        const ha = ua.hostname.replace(/^www\./i, "").toLowerCase();
+        const hb = ub.hostname.replace(/^www\./i, "").toLowerCase();
+        return ha === hb && ua.port === ub.port;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/keychain/store.js

@@ -38,10 +38,14 @@ function saveTokens(profile, tokens, env = process.env) {
 function loadTokens(profile, env = process.env) {
     // Controlled test injection — never document as prod automation.
     if (env.ALPHAFOX_TEST_ACCESS_TOKEN?.trim()) {
+        const expiresAtRaw = env.ALPHAFOX_TEST_EXPIRES_AT?.trim();
+        const expiresAt = expiresAtRaw
+            ? Number(expiresAtRaw)
+            : Date.now() + 3600_000;
         return {
             accessToken: env.ALPHAFOX_TEST_ACCESS_TOKEN.trim(),
             refreshToken: env.ALPHAFOX_TEST_REFRESH_TOKEN?.trim() ?? "",
-            expiresAt: Date.now() + 3600_000,
+            expiresAt: Number.isFinite(expiresAt) ? expiresAt : Date.now() + 3600_000,
             environment: profile,
             issuer: env.ALPHAFOX_TEST_ISSUER ?? "",
             audience: env.ALPHAFOX_TEST_AUDIENCE ?? "",

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_NAME = "alphafox";
 export declare const CLI_PACKAGE = "@alphafox/cli";
-export declare const CLI_VERSION = "0.1.2";
+export declare const CLI_VERSION = "0.1.4";
 export declare const CLI_CONTRACT_VERSION = "2026-08-11";

package/dist/version.js

@@ -3,5 +3,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
 exports.CLI_NAME = "alphafox";
 exports.CLI_PACKAGE = "@alphafox/cli";
-exports.CLI_VERSION = "0.1.2";
+exports.CLI_VERSION = "0.1.4";
 exports.CLI_CONTRACT_VERSION = "2026-08-11";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphafox/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Alphafox CLI \u2014 Agent/Human entry for the public Application API.",
   "type": "commonjs",
   "bin": {