@bastani/pi-ai 0.9.40-alpha.2 → 0.9.41-alpha.1

package/dist/auth/oauth/xai.js.map

@@ -1 +1 @@
-{"version":3,"file":"xai.js","sourceRoot":"","sources":["../../../src/auth/oauth/xai.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,SAAS,GAAG,gEAAgE,CAAC;AACnF,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AACnE,MAAM,aAAa,GAAG,gCAAgC,CAAC;AACvD,4FAA4F;AAC5F,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAmB5C,SAAS,cAAc,CAAC,IAAgB,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAgB,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,oEAAoE;AACpE,SAAS,uBAAuB,CAAC,GAAW;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAA8B,EAAE,MAAmB;IACvF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACnD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC;YACjC,MAAM;SACN,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;QAClD,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;KACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,QAA2B;IAClE,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,WAAW,GAChB,OAAO,QAAQ,CAAC,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,KAAK,CAAC,aAAa,MAAM,iBAAiB,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACxC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,eAAe,GACpB,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,uBAAuB,GAC5B,OAAO,IAAI,CAAC,yBAAyB,KAAK,QAAQ,IAAI,IAAI,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC;QAC9F,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,yBAAyB,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACN,UAAU,EAAE,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC;QAC/C,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3C,eAAe,EAAE,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAClF,uBAAuB;QACvB,eAAe;QACf,gBAAgB,EAAE,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC;KACpD,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAgB,EAAE,oBAA6B;IACpF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACpD,uEAAuE;IACvE,MAAM,OAAO,GACZ,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,oBAAoB;QACvD,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GACrB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACrG,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM;QACN,OAAO;QACP,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,GAAG,eAAe;KAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC9B,mBAAmB,EACnB;QACC,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,IAAI;KACd,EACD,MAAM,CACN,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,cAAc,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAqB,EAAE,MAAmB;IACtE,OAAO,uBAAuB,CAAkB;QAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC9B,aAAa,EACb;gBACC,UAAU,EAAE,8CAA8C;gBAC1D,SAAS,EAAE,aAAa;gBACxB,WAAW,EAAE,MAAM,CAAC,UAAU;aAC9B,EACD,MAAM,CACN,CAAC;YAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAClC,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACtG,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;gBACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;YAC7E,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YACjE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QAChG,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,WAAoC;IAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC,eAAe;QACzE,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,YAAoB,EAAE,MAAmB;IACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC9B,aAAa,EACb;QACC,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,aAAa;QACxB,aAAa,EAAE,YAAY;KAC3B,EACD,MAAM,CACN,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAc;IAClC,IAAI,EAAE,2BAA2B;IACjC,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,qCAAqC;IACjD,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;IAE5E,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;CACD,CAAC","sourcesContent":["/**\n * xAI OAuth device-code flow.\n */\n\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\n\nconst XAI_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\";\nconst XAI_SCOPE = \"openid profile email offline_access grok-cli:access api:access\";\nconst XAI_DEVICE_CODE_URL = \"https://auth.x.ai/oauth2/device/code\";\nconst XAI_TOKEN_URL = \"https://auth.x.ai/oauth2/token\";\n// Refresh slightly before the reported expiry to avoid using a token that dies mid-request.\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\nconst DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;\n\ntype JsonObject = Record<string, unknown>;\n\ntype OAuthHttpResponse = {\n\tok: boolean;\n\tstatus: number;\n\tbody: JsonObject;\n};\n\ntype XaiDeviceCode = {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUri: string;\n\tverificationUriComplete?: string;\n\tintervalSeconds?: number;\n\texpiresInSeconds: number;\n};\n\nfunction requiredString(body: JsonObject, field: string): string {\n\tconst value = body[field];\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new Error(`Invalid xAI OAuth response field: ${field}`);\n\t}\n\treturn value;\n}\n\nfunction positiveNumber(body: JsonObject, field: string): number {\n\tconst value = body[field];\n\tif (typeof value !== \"number\" || !Number.isFinite(value) || value <= 0) {\n\t\tthrow new Error(`Invalid xAI OAuth response field: ${field}`);\n\t}\n\treturn value;\n}\n\n// The verification URI is opened in the user's browser; force it to be an https URL\n// so a malicious response cannot make `open` launch something else.\nfunction validateVerificationUri(raw: string): string {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(raw);\n\t} catch {\n\t\tthrow new Error(\"Untrusted verification URI in xAI OAuth response\");\n\t}\n\tif (url.protocol !== \"https:\") {\n\t\tthrow new Error(\"Untrusted verification URI in xAI OAuth response\");\n\t}\n\treturn url.href;\n}\n\nasync function postForm(url: string, fields: Record<string, string>, signal: AbortSignal): Promise<OAuthHttpResponse> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams(fields),\n\t\t\tsignal,\n\t\t});\n\t} catch (error) {\n\t\tif (signal.aborted) {\n\t\t\tthrow new Error(\"Login cancelled\");\n\t\t}\n\t\tthrow error;\n\t}\n\n\tlet body: JsonObject;\n\ttry {\n\t\tconst parsed = (await response.json()) as unknown;\n\t\tbody = parsed && typeof parsed === \"object\" && !Array.isArray(parsed) ? (parsed as JsonObject) : {};\n\t} catch {\n\t\tif (signal.aborted) {\n\t\t\tthrow new Error(\"Login cancelled\");\n\t\t}\n\t\tthrow new Error(`xAI OAuth returned invalid JSON (HTTP ${response.status})`);\n\t}\n\treturn {\n\t\tok: response.ok,\n\t\tstatus: response.status,\n\t\tbody,\n\t};\n}\n\nfunction requestFailure(action: string, response: OAuthHttpResponse): Error {\n\tconst error = typeof response.body.error === \"string\" ? response.body.error : undefined;\n\tconst description =\n\t\ttypeof response.body.error_description === \"string\" ? response.body.error_description : undefined;\n\tconst detail = [error, description].filter(Boolean).join(\": \");\n\treturn new Error(`xAI OAuth ${action} failed (HTTP ${response.status})${detail ? `: ${detail}` : \"\"}`);\n}\n\nfunction parseDeviceCode(body: JsonObject): XaiDeviceCode {\n\t// RFC 8628 allows interval 0 (no minimum wait); fall back to the poller's\n\t// default instead of failing on non-positive or malformed values.\n\tconst interval = body.interval;\n\tconst intervalSeconds =\n\t\ttypeof interval === \"number\" && Number.isFinite(interval) && interval > 0 ? interval : undefined;\n\tconst verificationUriComplete =\n\t\ttypeof body.verification_uri_complete === \"string\" && body.verification_uri_complete.length > 0\n\t\t\t? validateVerificationUri(body.verification_uri_complete)\n\t\t\t: undefined;\n\treturn {\n\t\tdeviceCode: requiredString(body, \"device_code\"),\n\t\tuserCode: requiredString(body, \"user_code\"),\n\t\tverificationUri: validateVerificationUri(requiredString(body, \"verification_uri\")),\n\t\tverificationUriComplete,\n\t\tintervalSeconds,\n\t\texpiresInSeconds: positiveNumber(body, \"expires_in\"),\n\t};\n}\n\nfunction credentialsFromTokenResponse(body: JsonObject, previousRefreshToken?: string): OAuthCredential {\n\tconst access = requiredString(body, \"access_token\");\n\t// xAI may omit refresh_token on refresh when the token is not rotated.\n\tconst refresh =\n\t\tbody.refresh_token === undefined && previousRefreshToken\n\t\t\t? previousRefreshToken\n\t\t\t: requiredString(body, \"refresh_token\");\n\tconst expiresInSeconds =\n\t\tbody.expires_in === undefined ? DEFAULT_TOKEN_LIFETIME_SECONDS : positiveNumber(body, \"expires_in\");\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess,\n\t\trefresh,\n\t\texpires: Date.now() + expiresInSeconds * 1000 - REFRESH_SKEW_MS,\n\t};\n}\n\nasync function requestDeviceCode(signal: AbortSignal): Promise<XaiDeviceCode> {\n\tconst response = await postForm(\n\t\tXAI_DEVICE_CODE_URL,\n\t\t{\n\t\t\tclient_id: XAI_CLIENT_ID,\n\t\t\tscope: XAI_SCOPE,\n\t\t\treferrer: \"pi\",\n\t\t},\n\t\tsignal,\n\t);\n\tif (!response.ok) {\n\t\tthrow requestFailure(\"device authorization\", response);\n\t}\n\treturn parseDeviceCode(response.body);\n}\n\nasync function pollForTokens(device: XaiDeviceCode, signal: AbortSignal): Promise<OAuthCredential> {\n\treturn pollOAuthDeviceCodeFlow<OAuthCredential>({\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst response = await postForm(\n\t\t\t\tXAI_TOKEN_URL,\n\t\t\t\t{\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t\tclient_id: XAI_CLIENT_ID,\n\t\t\t\t\tdevice_code: device.deviceCode,\n\t\t\t\t},\n\t\t\t\tsignal,\n\t\t\t);\n\n\t\t\tif (response.ok) {\n\t\t\t\treturn { status: \"complete\", value: credentialsFromTokenResponse(response.body) };\n\t\t\t}\n\n\t\t\tconst error = response.body.error;\n\t\t\tif (error === \"authorization_pending\") {\n\t\t\t\treturn { status: \"pending\" };\n\t\t\t}\n\t\t\tif (error === \"slow_down\") {\n\t\t\t\tconst interval = response.body.interval;\n\t\t\t\treturn { status: \"slow_down\", intervalSeconds: typeof interval === \"number\" ? interval : undefined };\n\t\t\t}\n\t\t\tif (error === \"access_denied\" || error === \"authorization_denied\") {\n\t\t\t\treturn { status: \"failed\", message: \"xAI device authorization was denied\" };\n\t\t\t}\n\t\t\tif (error === \"expired_token\") {\n\t\t\t\treturn { status: \"failed\", message: \"xAI device code expired\" };\n\t\t\t}\n\t\t\treturn { status: \"failed\", message: requestFailure(\"device token polling\", response).message };\n\t\t},\n\t});\n}\n\nasync function loginXai(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\tconst device = await requestDeviceCode(interaction.signal);\n\tinteraction.notify({\n\t\ttype: \"device_code\",\n\t\tuserCode: device.userCode,\n\t\tverificationUri: device.verificationUriComplete ?? device.verificationUri,\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t});\n\treturn pollForTokens(device, interaction.signal);\n}\n\nasync function refreshXaiToken(refreshToken: string, signal: AbortSignal): Promise<OAuthCredential> {\n\tconst response = await postForm(\n\t\tXAI_TOKEN_URL,\n\t\t{\n\t\t\tgrant_type: \"refresh_token\",\n\t\t\tclient_id: XAI_CLIENT_ID,\n\t\t\trefresh_token: refreshToken,\n\t\t},\n\t\tsignal,\n\t);\n\tif (!response.ok) {\n\t\tthrow requestFailure(\"token refresh\", response);\n\t}\n\treturn credentialsFromTokenResponse(response.body, refreshToken);\n}\n\nexport const xaiOAuth: OAuthAuth = {\n\tname: \"xAI (Grok/X subscription)\",\n\tisSubscription: true,\n\tloginLabel: \"Sign in with SuperGrok or X Premium\",\n\tlogin: loginXai,\n\trefresh: (credential, signal) => refreshXaiToken(credential.refresh, signal),\n\n\tasync toAuth(credential) {\n\t\treturn { apiKey: credential.access };\n\t},\n};\n"]}
+{"version":3,"file":"xai.js","sourceRoot":"","sources":["../../../src/auth/oauth/xai.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,SAAS,GAAG,gEAAgE,CAAC;AACnF,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AACnE,MAAM,aAAa,GAAG,gCAAgC,CAAC;AACvD,4FAA4F;AAC5F,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAmB5C,SAAS,cAAc,CAAC,IAAgB,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAgB,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,oEAAoE;AACpE,SAAS,uBAAuB,CAAC,GAAW;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAA8B,EAAE,MAAmB;IACvF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACnD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC;YACjC,MAAM;SACN,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;QAClD,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;KACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,QAA2B;IAClE,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,WAAW,GAChB,OAAO,QAAQ,CAAC,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,KAAK,CAAC,aAAa,MAAM,iBAAiB,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACxC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,eAAe,GACpB,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,uBAAuB,GAC5B,OAAO,IAAI,CAAC,yBAAyB,KAAK,QAAQ,IAAI,IAAI,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC;QAC9F,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,yBAAyB,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACN,UAAU,EAAE,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC;QAC/C,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3C,eAAe,EAAE,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAClF,uBAAuB;QACvB,eAAe;QACf,gBAAgB,EAAE,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC;KACpD,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAgB,EAAE,oBAA6B;IACpF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACpD,uEAAuE;IACvE,MAAM,OAAO,GACZ,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,oBAAoB;QACvD,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GACrB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACrG,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM;QACN,OAAO;QACP,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,GAAG,eAAe;KAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC9B,mBAAmB,EACnB;QACC,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,IAAI;KACd,EACD,MAAM,CACN,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,cAAc,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAqB,EAAE,MAAmB;IACtE,OAAO,uBAAuB,CAAkB;QAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC9B,aAAa,EACb;gBACC,UAAU,EAAE,8CAA8C;gBAC1D,SAAS,EAAE,aAAa;gBACxB,WAAW,EAAE,MAAM,CAAC,UAAU;aAC9B,EACD,MAAM,CACN,CAAC;YAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAClC,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACtG,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;gBACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;YAC7E,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YACjE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QAChG,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,WAAoC;IAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC,eAAe;QACzE,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,YAAoB,EAAE,MAAmB;IACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC9B,aAAa,EACb;QACC,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,aAAa;QACxB,aAAa,EAAE,YAAY;KAC3B,EACD,MAAM,CACN,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAC/E,WAAW,EACV,OAAO,QAAQ,CAAC,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;SAClG,CAAC;QACF,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,yBAAyB,CAAC,wCAAwC,QAAQ,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE;gBAC1G,YAAY;aACZ,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAc;IAClC,IAAI,EAAE,2BAA2B;IACjC,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,qCAAqC;IACjD,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;IAE5E,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;CACD,CAAC","sourcesContent":["/**\n * xAI OAuth device-code flow.\n */\n\nimport { isPermanentRefreshRejection, OAuthRefreshRejectedError } from \"../oauth-refresh-errors.ts\";\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\n\nconst XAI_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\";\nconst XAI_SCOPE = \"openid profile email offline_access grok-cli:access api:access\";\nconst XAI_DEVICE_CODE_URL = \"https://auth.x.ai/oauth2/device/code\";\nconst XAI_TOKEN_URL = \"https://auth.x.ai/oauth2/token\";\n// Refresh slightly before the reported expiry to avoid using a token that dies mid-request.\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\nconst DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;\n\ntype JsonObject = Record<string, unknown>;\n\ntype OAuthHttpResponse = {\n\tok: boolean;\n\tstatus: number;\n\tbody: JsonObject;\n};\n\ntype XaiDeviceCode = {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUri: string;\n\tverificationUriComplete?: string;\n\tintervalSeconds?: number;\n\texpiresInSeconds: number;\n};\n\nfunction requiredString(body: JsonObject, field: string): string {\n\tconst value = body[field];\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new Error(`Invalid xAI OAuth response field: ${field}`);\n\t}\n\treturn value;\n}\n\nfunction positiveNumber(body: JsonObject, field: string): number {\n\tconst value = body[field];\n\tif (typeof value !== \"number\" || !Number.isFinite(value) || value <= 0) {\n\t\tthrow new Error(`Invalid xAI OAuth response field: ${field}`);\n\t}\n\treturn value;\n}\n\n// The verification URI is opened in the user's browser; force it to be an https URL\n// so a malicious response cannot make `open` launch something else.\nfunction validateVerificationUri(raw: string): string {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(raw);\n\t} catch {\n\t\tthrow new Error(\"Untrusted verification URI in xAI OAuth response\");\n\t}\n\tif (url.protocol !== \"https:\") {\n\t\tthrow new Error(\"Untrusted verification URI in xAI OAuth response\");\n\t}\n\treturn url.href;\n}\n\nasync function postForm(url: string, fields: Record<string, string>, signal: AbortSignal): Promise<OAuthHttpResponse> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams(fields),\n\t\t\tsignal,\n\t\t});\n\t} catch (error) {\n\t\tif (signal.aborted) {\n\t\t\tthrow new Error(\"Login cancelled\");\n\t\t}\n\t\tthrow error;\n\t}\n\n\tlet body: JsonObject;\n\ttry {\n\t\tconst parsed = (await response.json()) as unknown;\n\t\tbody = parsed && typeof parsed === \"object\" && !Array.isArray(parsed) ? (parsed as JsonObject) : {};\n\t} catch {\n\t\tif (signal.aborted) {\n\t\t\tthrow new Error(\"Login cancelled\");\n\t\t}\n\t\tthrow new Error(`xAI OAuth returned invalid JSON (HTTP ${response.status})`);\n\t}\n\treturn {\n\t\tok: response.ok,\n\t\tstatus: response.status,\n\t\tbody,\n\t};\n}\n\nfunction requestFailure(action: string, response: OAuthHttpResponse): Error {\n\tconst error = typeof response.body.error === \"string\" ? response.body.error : undefined;\n\tconst description =\n\t\ttypeof response.body.error_description === \"string\" ? response.body.error_description : undefined;\n\tconst detail = [error, description].filter(Boolean).join(\": \");\n\treturn new Error(`xAI OAuth ${action} failed (HTTP ${response.status})${detail ? `: ${detail}` : \"\"}`);\n}\n\nfunction parseDeviceCode(body: JsonObject): XaiDeviceCode {\n\t// RFC 8628 allows interval 0 (no minimum wait); fall back to the poller's\n\t// default instead of failing on non-positive or malformed values.\n\tconst interval = body.interval;\n\tconst intervalSeconds =\n\t\ttypeof interval === \"number\" && Number.isFinite(interval) && interval > 0 ? interval : undefined;\n\tconst verificationUriComplete =\n\t\ttypeof body.verification_uri_complete === \"string\" && body.verification_uri_complete.length > 0\n\t\t\t? validateVerificationUri(body.verification_uri_complete)\n\t\t\t: undefined;\n\treturn {\n\t\tdeviceCode: requiredString(body, \"device_code\"),\n\t\tuserCode: requiredString(body, \"user_code\"),\n\t\tverificationUri: validateVerificationUri(requiredString(body, \"verification_uri\")),\n\t\tverificationUriComplete,\n\t\tintervalSeconds,\n\t\texpiresInSeconds: positiveNumber(body, \"expires_in\"),\n\t};\n}\n\nfunction credentialsFromTokenResponse(body: JsonObject, previousRefreshToken?: string): OAuthCredential {\n\tconst access = requiredString(body, \"access_token\");\n\t// xAI may omit refresh_token on refresh when the token is not rotated.\n\tconst refresh =\n\t\tbody.refresh_token === undefined && previousRefreshToken\n\t\t\t? previousRefreshToken\n\t\t\t: requiredString(body, \"refresh_token\");\n\tconst expiresInSeconds =\n\t\tbody.expires_in === undefined ? DEFAULT_TOKEN_LIFETIME_SECONDS : positiveNumber(body, \"expires_in\");\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess,\n\t\trefresh,\n\t\texpires: Date.now() + expiresInSeconds * 1000 - REFRESH_SKEW_MS,\n\t};\n}\n\nasync function requestDeviceCode(signal: AbortSignal): Promise<XaiDeviceCode> {\n\tconst response = await postForm(\n\t\tXAI_DEVICE_CODE_URL,\n\t\t{\n\t\t\tclient_id: XAI_CLIENT_ID,\n\t\t\tscope: XAI_SCOPE,\n\t\t\treferrer: \"pi\",\n\t\t},\n\t\tsignal,\n\t);\n\tif (!response.ok) {\n\t\tthrow requestFailure(\"device authorization\", response);\n\t}\n\treturn parseDeviceCode(response.body);\n}\n\nasync function pollForTokens(device: XaiDeviceCode, signal: AbortSignal): Promise<OAuthCredential> {\n\treturn pollOAuthDeviceCodeFlow<OAuthCredential>({\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst response = await postForm(\n\t\t\t\tXAI_TOKEN_URL,\n\t\t\t\t{\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t\tclient_id: XAI_CLIENT_ID,\n\t\t\t\t\tdevice_code: device.deviceCode,\n\t\t\t\t},\n\t\t\t\tsignal,\n\t\t\t);\n\n\t\t\tif (response.ok) {\n\t\t\t\treturn { status: \"complete\", value: credentialsFromTokenResponse(response.body) };\n\t\t\t}\n\n\t\t\tconst error = response.body.error;\n\t\t\tif (error === \"authorization_pending\") {\n\t\t\t\treturn { status: \"pending\" };\n\t\t\t}\n\t\t\tif (error === \"slow_down\") {\n\t\t\t\tconst interval = response.body.interval;\n\t\t\t\treturn { status: \"slow_down\", intervalSeconds: typeof interval === \"number\" ? interval : undefined };\n\t\t\t}\n\t\t\tif (error === \"access_denied\" || error === \"authorization_denied\") {\n\t\t\t\treturn { status: \"failed\", message: \"xAI device authorization was denied\" };\n\t\t\t}\n\t\t\tif (error === \"expired_token\") {\n\t\t\t\treturn { status: \"failed\", message: \"xAI device code expired\" };\n\t\t\t}\n\t\t\treturn { status: \"failed\", message: requestFailure(\"device token polling\", response).message };\n\t\t},\n\t});\n}\n\nasync function loginXai(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\tconst device = await requestDeviceCode(interaction.signal);\n\tinteraction.notify({\n\t\ttype: \"device_code\",\n\t\tuserCode: device.userCode,\n\t\tverificationUri: device.verificationUriComplete ?? device.verificationUri,\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t});\n\treturn pollForTokens(device, interaction.signal);\n}\n\nasync function refreshXaiToken(refreshToken: string, signal: AbortSignal): Promise<OAuthCredential> {\n\tconst response = await postForm(\n\t\tXAI_TOKEN_URL,\n\t\t{\n\t\t\tgrant_type: \"refresh_token\",\n\t\t\tclient_id: XAI_CLIENT_ID,\n\t\t\trefresh_token: refreshToken,\n\t\t},\n\t\tsignal,\n\t);\n\tif (!response.ok) {\n\t\tconst rejection = {\n\t\t\tstatus: response.status,\n\t\t\tcode: typeof response.body.error === \"string\" ? response.body.error : undefined,\n\t\t\tdescription:\n\t\t\t\ttypeof response.body.error_description === \"string\" ? response.body.error_description : undefined,\n\t\t};\n\t\tif (isPermanentRefreshRejection(rejection)) {\n\t\t\tthrow new OAuthRefreshRejectedError(`xAI OAuth token refresh failed (HTTP ${response.status})`, rejection, [\n\t\t\t\trefreshToken,\n\t\t\t]);\n\t\t}\n\t\tthrow requestFailure(\"token refresh\", response);\n\t}\n\treturn credentialsFromTokenResponse(response.body, refreshToken);\n}\n\nexport const xaiOAuth: OAuthAuth = {\n\tname: \"xAI (Grok/X subscription)\",\n\tisSubscription: true,\n\tloginLabel: \"Sign in with SuperGrok or X Premium\",\n\tlogin: loginXai,\n\trefresh: (credential, signal) => refreshXaiToken(credential.refresh, signal),\n\n\tasync toAuth(credential) {\n\t\treturn { apiKey: credential.access };\n\t},\n};\n"]}

package/dist/auth/oauth-refresh-errors.d.ts

@@ -0,0 +1,46 @@
+/** A token endpoint's error code and description, as the provider sent them. */
+export interface OAuthErrorDetail {
+    code?: string;
+    description?: string;
+}
+/** A token endpoint's answer to a refresh, by HTTP status and the provider's error code and description. */
+export interface OAuthRefreshRejection extends OAuthErrorDetail {
+    status: number;
+}
+/** Reads `error` / `error.code` / `code` and `error_description` / `error.message` / `message` from a JSON body. */
+export declare function parseOAuthErrorBody(body: string): OAuthErrorDetail;
+/** Whether a refresh rejection means the stored login is revoked or expired, so only signing in again helps. */
+export declare function isPermanentRefreshRejection(rejection: OAuthRefreshRejection): boolean;
+/** Whether `code` is one of the OAuth error codes that mark a refresh token as permanently unusable. */
+export declare function isPermanentRefreshErrorCode(code: string): boolean;
+/**
+ * Finds a permanent refresh rejection in an error message from a refresher that does not throw
+ * {@link OAuthRefreshRejectedError}: an embedded JSON error body (`error`, nested `error.code`, or `code`) or a bare
+ * permanent code, plus the body's description. Returns nothing if no permanent code appears.
+ */
+export declare function findPermanentRefreshRejectionInText(text: string): OAuthErrorDetail | undefined;
+/** The provider's error code, if it looks like one; anything else could be echoed request data. */
+export declare function safeOAuthErrorCode(code: string | undefined): string | undefined;
+/** The provider's description, unless it echoes a presented secret, carries a URL, or is too long to be one. */
+export declare function safeOAuthErrorDescription(description: string | undefined, presentedSecrets: readonly string[]): string | undefined;
+/** `: code: description` with only the parts that are safe to show, or nothing. */
+export declare function formatOAuthErrorDetail(detail: OAuthErrorDetail, presentedSecrets: readonly string[]): string;
+/**
+ * A token endpoint rejected a refresh because the stored login is revoked or expired. Carries only the HTTP status
+ * and the provider's error code and description, the latter dropped if it echoes the presented token.
+ */
+export declare class OAuthRefreshRejectedError extends Error {
+    readonly name = "OAuthRefreshRejectedError";
+    readonly status: number;
+    readonly code: string | undefined;
+    readonly description: string | undefined;
+    constructor(summary: string, rejection: OAuthRefreshRejection, presentedSecrets: readonly string[]);
+}
+/** Recognises the rejection across duplicated module copies (source and built output), not only by identity. */
+export declare function isOAuthRefreshRejectedError(error: Error): error is OAuthRefreshRejectedError;
+/**
+ * Whether a failed fetch provably never sent its request (no connection was made). Only then may a refresh token be
+ * presented again: after an abort, a timeout, or a connection lost mid-request the server may already have rotated it.
+ */
+export declare function requestNeverReachedServer(error: Error): boolean;
+//# sourceMappingURL=oauth-refresh-errors.d.ts.map

package/dist/auth/oauth-refresh-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh-errors.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-refresh-errors.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4GAA4G;AAC5G,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC9D,MAAM,EAAE,MAAM,CAAC;CACf;AAyCD,oHAAoH;AACpH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAclE;AAED,gHAAgH;AAChH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAKrF;AAED,wGAAwG;AACxG,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjE;AAuBD;;;;GAIG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAY9F;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE/E;AAED,gHAAgH;AAChH,wBAAgB,yBAAyB,CACxC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,gBAAgB,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,GAAG,SAAS,CAIpB;AAED,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAI5G;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,SAAkB,IAAI,+BAA+B;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,YAAY,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,SAAS,MAAM,EAAE,EAKjG;CACD;AAED,gHAAgH;AAChH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,IAAI,yBAAyB,CAK5F;AAOD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAK/D"}

package/dist/auth/oauth-refresh-errors.js

@@ -0,0 +1,150 @@
+/** Codes that mean the stored refresh token can never be used again (OAuth 2.0 and OpenAI's refresh_token_*). */
+const PERMANENT_REFRESH_ERROR_CODES = new Set([
+    "invalid_grant",
+    "refresh_token_expired",
+    "refresh_token_reused",
+    "refresh_token_invalidated",
+]);
+/** HTTP 401 from a token endpoint: the provider no longer accepts this login, whatever its error code. */
+const UNAUTHORIZED_STATUS = 401;
+/** A longer description is dropped rather than cut, so an echoed token cannot survive as a prefix. */
+const MAX_DESCRIPTION_LENGTH = 300;
+const ERROR_CODE_PATTERN = /^[A-Za-z0-9_.:-]{1,64}$/;
+const URL_PATTERN = /\b[a-z][a-z0-9+.-]*:\/\//i;
+/**
+ * Network errors raised before a request was sent: the connection was never established, so the server cannot
+ * have seen (or rotated) the refresh token. Node reports the code on `cause`; Bun on the error itself.
+ */
+const UNDELIVERED_REQUEST_ERROR_CODES = new Set([
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "ENETUNREACH",
+    "EHOSTUNREACH",
+    "UND_ERR_CONNECT_TIMEOUT",
+]);
+function textField(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function objectField(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** Reads `error` / `error.code` / `code` and `error_description` / `error.message` / `message` from a JSON body. */
+export function parseOAuthErrorBody(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return {};
+    }
+    const json = objectField(parsed);
+    if (!json)
+        return {};
+    const nested = objectField(json.error);
+    return {
+        code: textField(json.error) ?? textField(nested?.code) ?? textField(json.code),
+        description: textField(json.error_description) ?? textField(nested?.message) ?? textField(json.message),
+    };
+}
+/** Whether a refresh rejection means the stored login is revoked or expired, so only signing in again helps. */
+export function isPermanentRefreshRejection(rejection) {
+    return (rejection.status === UNAUTHORIZED_STATUS ||
+        (rejection.code !== undefined && isPermanentRefreshErrorCode(rejection.code)));
+}
+/** Whether `code` is one of the OAuth error codes that mark a refresh token as permanently unusable. */
+export function isPermanentRefreshErrorCode(code) {
+    return PERMANENT_REFRESH_ERROR_CODES.has(code.toLowerCase());
+}
+const JSON_STRING = String.raw `"((?:[^"\\]|\\.)*)"`;
+const TEXT_ERROR_CODE_PATTERNS = [
+    new RegExp(String.raw `"error"\s*:\s*${JSON_STRING}`, "g"),
+    new RegExp(String.raw `"error"\s*:\s*\{[^{}]*?"code"\s*:\s*${JSON_STRING}`, "g"),
+    new RegExp(String.raw `"code"\s*:\s*${JSON_STRING}`, "g"),
+];
+const TEXT_ERROR_DESCRIPTION_PATTERNS = [
+    new RegExp(String.raw `"error_description"\s*:\s*${JSON_STRING}`),
+    new RegExp(String.raw `"error"\s*:\s*\{[^{}]*?"message"\s*:\s*${JSON_STRING}`),
+];
+const BARE_PERMANENT_REFRESH_ERROR_CODE = new RegExp(String.raw `\b(${[...PERMANENT_REFRESH_ERROR_CODES].join("|")})\b`, "i");
+function jsonStringContent(escaped) {
+    try {
+        const value = JSON.parse(`"${escaped}"`);
+        return typeof value === "string" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Finds a permanent refresh rejection in an error message from a refresher that does not throw
+ * {@link OAuthRefreshRejectedError}: an embedded JSON error body (`error`, nested `error.code`, or `code`) or a bare
+ * permanent code, plus the body's description. Returns nothing if no permanent code appears.
+ */
+export function findPermanentRefreshRejectionInText(text) {
+    const embeddedCodes = TEXT_ERROR_CODE_PATTERNS.flatMap((pattern) => [...text.matchAll(pattern)].map((match) => jsonStringContent(match[1] ?? "")));
+    const code = embeddedCodes.find((candidate) => candidate !== undefined && isPermanentRefreshErrorCode(candidate)) ??
+        BARE_PERMANENT_REFRESH_ERROR_CODE.exec(text)?.[1];
+    if (code === undefined)
+        return undefined;
+    const description = TEXT_ERROR_DESCRIPTION_PATTERNS.map((pattern) => pattern.exec(text)?.[1])
+        .map((escaped) => (escaped === undefined ? undefined : jsonStringContent(escaped)))
+        .find((candidate) => candidate !== undefined);
+    return { code, description };
+}
+/** The provider's error code, if it looks like one; anything else could be echoed request data. */
+export function safeOAuthErrorCode(code) {
+    return code !== undefined && ERROR_CODE_PATTERN.test(code) ? code : undefined;
+}
+/** The provider's description, unless it echoes a presented secret, carries a URL, or is too long to be one. */
+export function safeOAuthErrorDescription(description, presentedSecrets) {
+    const text = description?.replace(/\s+/g, " ").trim();
+    if (!text || text.length > MAX_DESCRIPTION_LENGTH || URL_PATTERN.test(text))
+        return undefined;
+    return presentedSecrets.some((secret) => secret.length > 0 && text.includes(secret)) ? undefined : text;
+}
+/** `: code: description` with only the parts that are safe to show, or nothing. */
+export function formatOAuthErrorDetail(detail, presentedSecrets) {
+    const parts = [safeOAuthErrorCode(detail.code), safeOAuthErrorDescription(detail.description, presentedSecrets)];
+    const shown = parts.filter((part) => part !== undefined);
+    return shown.length > 0 ? `: ${shown.join(": ")}` : "";
+}
+/**
+ * A token endpoint rejected a refresh because the stored login is revoked or expired. Carries only the HTTP status
+ * and the provider's error code and description, the latter dropped if it echoes the presented token.
+ */
+export class OAuthRefreshRejectedError extends Error {
+    name = "OAuthRefreshRejectedError";
+    status;
+    code;
+    description;
+    constructor(summary, rejection, presentedSecrets) {
+        super(`${summary}${formatOAuthErrorDetail(rejection, presentedSecrets)}`);
+        this.status = rejection.status;
+        this.code = safeOAuthErrorCode(rejection.code);
+        this.description = safeOAuthErrorDescription(rejection.description, presentedSecrets);
+    }
+}
+/** Recognises the rejection across duplicated module copies (source and built output), not only by identity. */
+export function isOAuthRefreshRejectedError(error) {
+    return (error instanceof OAuthRefreshRejectedError ||
+        (error.name === "OAuthRefreshRejectedError" && "status" in error && typeof error.status === "number"));
+}
+function errorCode(error) {
+    const code = "code" in error ? error.code : undefined;
+    return typeof code === "string" ? code : undefined;
+}
+/**
+ * Whether a failed fetch provably never sent its request (no connection was made). Only then may a refresh token be
+ * presented again: after an abort, a timeout, or a connection lost mid-request the server may already have rotated it.
+ */
+export function requestNeverReachedServer(error) {
+    if (error.name === "AbortError" || error.name === "TimeoutError")
+        return false;
+    const cause = error.cause instanceof Error ? error.cause : undefined;
+    const code = errorCode(error) ?? (cause ? errorCode(cause) : undefined);
+    return code !== undefined && UNDELIVERED_REQUEST_ERROR_CODES.has(code);
+}
+//# sourceMappingURL=oauth-refresh-errors.js.map

package/dist/auth/oauth-refresh-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh-errors.js","sourceRoot":"","sources":["../../src/auth/oauth-refresh-errors.ts"],"names":[],"mappings":"AAaA,iHAAiH;AACjH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC7C,eAAe;IACf,uBAAuB;IACvB,sBAAsB;IACtB,2BAA2B;CAC3B,CAAC,CAAC;AAEH,0GAA0G;AAC1G,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,sGAAsG;AACtG,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AACrD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD;;;GAGG;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC/C,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,cAAc;IACd,yBAAyB;CACzB,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,KAA4B;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,KAA4B;IAChD,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAE,KAA+C;QAClD,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC/C,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO;QACN,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9E,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;KACvG,CAAC;AACH,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CAAC,SAAgC;IAC3E,OAAO,CACN,SAAS,CAAC,MAAM,KAAK,mBAAmB;QACxC,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,2BAA2B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAC7E,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACvD,OAAO,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,qBAAqB,CAAC;AACpD,MAAM,wBAAwB,GAAG;IAChC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iBAAiB,WAAW,EAAE,EAAE,GAAG,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,uCAAuC,WAAW,EAAE,EAAE,GAAG,CAAC;IAC/E,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gBAAgB,WAAW,EAAE,EAAE,GAAG,CAAC;CACxD,CAAC;AACF,MAAM,+BAA+B,GAAG;IACvC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,6BAA6B,WAAW,EAAE,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,0CAA0C,WAAW,EAAE,CAAC;CAC7E,CAAC;AACF,MAAM,iCAAiC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,MAAM,CAAC,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAE7H,SAAS,iBAAiB,CAAC,OAAe;IACzC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAc,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CAAC,IAAY;IAC/D,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAClE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,IAAI,GACT,aAAa,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACpG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,WAAW,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC3F,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;SAClF,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IAC1D,OAAO,IAAI,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,yBAAyB,CACxC,WAA+B,EAC/B,gBAAmC;IAEnC,MAAM,IAAI,GAAG,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,sBAAsB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACzG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,MAAwB,EAAE,gBAAmC;IACnG,MAAM,KAAK,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,yBAAyB,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACjC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,MAAM,CAAS;IACf,IAAI,CAAqB;IACzB,WAAW,CAAqB;IAEzC,YAAY,OAAe,EAAE,SAAgC,EAAE,gBAAmC;QACjG,KAAK,CAAC,GAAG,OAAO,GAAG,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,yBAAyB,CAAC,SAAS,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACvF,CAAC;CACD;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CAAC,KAAY;IACvD,OAAO,CACN,KAAK,YAAY,yBAAyB;QAC1C,CAAC,KAAK,CAAC,IAAI,KAAK,2BAA2B,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CACrG,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAY;IAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,IAAI,KAAK,SAAS,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC","sourcesContent":["import type { JsonValue } from \"../types.ts\";\n\n/** A token endpoint's error code and description, as the provider sent them. */\nexport interface OAuthErrorDetail {\n\tcode?: string;\n\tdescription?: string;\n}\n\n/** A token endpoint's answer to a refresh, by HTTP status and the provider's error code and description. */\nexport interface OAuthRefreshRejection extends OAuthErrorDetail {\n\tstatus: number;\n}\n\n/** Codes that mean the stored refresh token can never be used again (OAuth 2.0 and OpenAI's refresh_token_*). */\nconst PERMANENT_REFRESH_ERROR_CODES = new Set([\n\t\"invalid_grant\",\n\t\"refresh_token_expired\",\n\t\"refresh_token_reused\",\n\t\"refresh_token_invalidated\",\n]);\n\n/** HTTP 401 from a token endpoint: the provider no longer accepts this login, whatever its error code. */\nconst UNAUTHORIZED_STATUS = 401;\n\n/** A longer description is dropped rather than cut, so an echoed token cannot survive as a prefix. */\nconst MAX_DESCRIPTION_LENGTH = 300;\nconst ERROR_CODE_PATTERN = /^[A-Za-z0-9_.:-]{1,64}$/;\nconst URL_PATTERN = /\\b[a-z][a-z0-9+.-]*:\\/\\//i;\n\n/**\n * Network errors raised before a request was sent: the connection was never established, so the server cannot\n * have seen (or rotated) the refresh token. Node reports the code on `cause`; Bun on the error itself.\n */\nconst UNDELIVERED_REQUEST_ERROR_CODES = new Set([\n\t\"ECONNREFUSED\",\n\t\"ENOTFOUND\",\n\t\"EAI_AGAIN\",\n\t\"ENETUNREACH\",\n\t\"EHOSTUNREACH\",\n\t\"UND_ERR_CONNECT_TIMEOUT\",\n]);\n\nfunction textField(value: JsonValue | undefined): string | undefined {\n\treturn typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction objectField(value: JsonValue | undefined): { readonly [key: string]: JsonValue } | undefined {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value)\n\t\t? (value as { readonly [key: string]: JsonValue })\n\t\t: undefined;\n}\n\n/** Reads `error` / `error.code` / `code` and `error_description` / `error.message` / `message` from a JSON body. */\nexport function parseOAuthErrorBody(body: string): OAuthErrorDetail {\n\tlet parsed: JsonValue;\n\ttry {\n\t\tparsed = JSON.parse(body);\n\t} catch {\n\t\treturn {};\n\t}\n\tconst json = objectField(parsed);\n\tif (!json) return {};\n\tconst nested = objectField(json.error);\n\treturn {\n\t\tcode: textField(json.error) ?? textField(nested?.code) ?? textField(json.code),\n\t\tdescription: textField(json.error_description) ?? textField(nested?.message) ?? textField(json.message),\n\t};\n}\n\n/** Whether a refresh rejection means the stored login is revoked or expired, so only signing in again helps. */\nexport function isPermanentRefreshRejection(rejection: OAuthRefreshRejection): boolean {\n\treturn (\n\t\trejection.status === UNAUTHORIZED_STATUS ||\n\t\t(rejection.code !== undefined && isPermanentRefreshErrorCode(rejection.code))\n\t);\n}\n\n/** Whether `code` is one of the OAuth error codes that mark a refresh token as permanently unusable. */\nexport function isPermanentRefreshErrorCode(code: string): boolean {\n\treturn PERMANENT_REFRESH_ERROR_CODES.has(code.toLowerCase());\n}\n\nconst JSON_STRING = String.raw`\"((?:[^\"\\\\]|\\\\.)*)\"`;\nconst TEXT_ERROR_CODE_PATTERNS = [\n\tnew RegExp(String.raw`\"error\"\\s*:\\s*${JSON_STRING}`, \"g\"),\n\tnew RegExp(String.raw`\"error\"\\s*:\\s*\\{[^{}]*?\"code\"\\s*:\\s*${JSON_STRING}`, \"g\"),\n\tnew RegExp(String.raw`\"code\"\\s*:\\s*${JSON_STRING}`, \"g\"),\n];\nconst TEXT_ERROR_DESCRIPTION_PATTERNS = [\n\tnew RegExp(String.raw`\"error_description\"\\s*:\\s*${JSON_STRING}`),\n\tnew RegExp(String.raw`\"error\"\\s*:\\s*\\{[^{}]*?\"message\"\\s*:\\s*${JSON_STRING}`),\n];\nconst BARE_PERMANENT_REFRESH_ERROR_CODE = new RegExp(String.raw`\\b(${[...PERMANENT_REFRESH_ERROR_CODES].join(\"|\")})\\b`, \"i\");\n\nfunction jsonStringContent(escaped: string): string | undefined {\n\ttry {\n\t\tconst value: JsonValue = JSON.parse(`\"${escaped}\"`);\n\t\treturn typeof value === \"string\" ? value : undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Finds a permanent refresh rejection in an error message from a refresher that does not throw\n * {@link OAuthRefreshRejectedError}: an embedded JSON error body (`error`, nested `error.code`, or `code`) or a bare\n * permanent code, plus the body's description. Returns nothing if no permanent code appears.\n */\nexport function findPermanentRefreshRejectionInText(text: string): OAuthErrorDetail | undefined {\n\tconst embeddedCodes = TEXT_ERROR_CODE_PATTERNS.flatMap((pattern) =>\n\t\t[...text.matchAll(pattern)].map((match) => jsonStringContent(match[1] ?? \"\")),\n\t);\n\tconst code =\n\t\tembeddedCodes.find((candidate) => candidate !== undefined && isPermanentRefreshErrorCode(candidate)) ??\n\t\tBARE_PERMANENT_REFRESH_ERROR_CODE.exec(text)?.[1];\n\tif (code === undefined) return undefined;\n\tconst description = TEXT_ERROR_DESCRIPTION_PATTERNS.map((pattern) => pattern.exec(text)?.[1])\n\t\t.map((escaped) => (escaped === undefined ? undefined : jsonStringContent(escaped)))\n\t\t.find((candidate) => candidate !== undefined);\n\treturn { code, description };\n}\n\n/** The provider's error code, if it looks like one; anything else could be echoed request data. */\nexport function safeOAuthErrorCode(code: string | undefined): string | undefined {\n\treturn code !== undefined && ERROR_CODE_PATTERN.test(code) ? code : undefined;\n}\n\n/** The provider's description, unless it echoes a presented secret, carries a URL, or is too long to be one. */\nexport function safeOAuthErrorDescription(\n\tdescription: string | undefined,\n\tpresentedSecrets: readonly string[],\n): string | undefined {\n\tconst text = description?.replace(/\\s+/g, \" \").trim();\n\tif (!text || text.length > MAX_DESCRIPTION_LENGTH || URL_PATTERN.test(text)) return undefined;\n\treturn presentedSecrets.some((secret) => secret.length > 0 && text.includes(secret)) ? undefined : text;\n}\n\n/** `: code: description` with only the parts that are safe to show, or nothing. */\nexport function formatOAuthErrorDetail(detail: OAuthErrorDetail, presentedSecrets: readonly string[]): string {\n\tconst parts = [safeOAuthErrorCode(detail.code), safeOAuthErrorDescription(detail.description, presentedSecrets)];\n\tconst shown = parts.filter((part): part is string => part !== undefined);\n\treturn shown.length > 0 ? `: ${shown.join(\": \")}` : \"\";\n}\n\n/**\n * A token endpoint rejected a refresh because the stored login is revoked or expired. Carries only the HTTP status\n * and the provider's error code and description, the latter dropped if it echoes the presented token.\n */\nexport class OAuthRefreshRejectedError extends Error {\n\toverride readonly name = \"OAuthRefreshRejectedError\";\n\treadonly status: number;\n\treadonly code: string | undefined;\n\treadonly description: string | undefined;\n\n\tconstructor(summary: string, rejection: OAuthRefreshRejection, presentedSecrets: readonly string[]) {\n\t\tsuper(`${summary}${formatOAuthErrorDetail(rejection, presentedSecrets)}`);\n\t\tthis.status = rejection.status;\n\t\tthis.code = safeOAuthErrorCode(rejection.code);\n\t\tthis.description = safeOAuthErrorDescription(rejection.description, presentedSecrets);\n\t}\n}\n\n/** Recognises the rejection across duplicated module copies (source and built output), not only by identity. */\nexport function isOAuthRefreshRejectedError(error: Error): error is OAuthRefreshRejectedError {\n\treturn (\n\t\terror instanceof OAuthRefreshRejectedError ||\n\t\t(error.name === \"OAuthRefreshRejectedError\" && \"status\" in error && typeof error.status === \"number\")\n\t);\n}\n\nfunction errorCode(error: Error): string | undefined {\n\tconst code = \"code\" in error ? error.code : undefined;\n\treturn typeof code === \"string\" ? code : undefined;\n}\n\n/**\n * Whether a failed fetch provably never sent its request (no connection was made). Only then may a refresh token be\n * presented again: after an abort, a timeout, or a connection lost mid-request the server may already have rotated it.\n */\nexport function requestNeverReachedServer(error: Error): boolean {\n\tif (error.name === \"AbortError\" || error.name === \"TimeoutError\") return false;\n\tconst cause = error.cause instanceof Error ? error.cause : undefined;\n\tconst code = errorCode(error) ?? (cause ? errorCode(cause) : undefined);\n\treturn code !== undefined && UNDELIVERED_REQUEST_ERROR_CODES.has(code);\n}\n"]}

package/dist/auth/resolve.d.ts

@@ -23,6 +23,29 @@ export declare function resolveProviderAuth(provider: {
     id: string;
     auth: ProviderAuth;
 }, credentials: CredentialStore, authContext: AuthContext, overrides?: AuthResolutionOverrides): Promise<AuthResult | undefined>;
+/** How long a refresh keeps its caller waiting for one token exchange. */
+export declare const OAUTH_REFRESH_TIMEOUT_MS = 60000;
+/**
+ * How long a refresh keeps the credential lock while its token exchange is still running, so no other refresh
+ * presents a token the exchange may already have rotated. A response after this is still persisted, lock-free.
+ */
+export declare const OAUTH_REFRESH_LOCK_HOLD_MS: number;
+/**
+ * How long a graceful shutdown waits for token exchanges still in flight, and for persisting their results, before
+ * the process exits (see {@link drainPendingOAuthRotations}).
+ *
+ * Abrupt termination (SIGKILL, a crash, power loss) cannot wait. If the provider already rotated the refresh token
+ * when that happens, its response never reaches the process and the stored login keeps the replaced token; the
+ * next refresh then fails and `/login <provider>` signs in again.
+ */
+export declare const OAUTH_SHUTDOWN_DRAIN_MS = 3000;
+/**
+ * Waits for every started OAuth token exchange to settle and its result to be persisted, at most `timeoutMs`.
+ * Callers stop waiting for an exchange after {@link OAUTH_REFRESH_TIMEOUT_MS} while it keeps running, so a process
+ * that exits gracefully calls this first: the provider may already have rotated the token. Resolves `true` once none
+ * is in flight, `false` when the bound passes first; never rejects.
+ */
+export declare function drainPendingOAuthRotations(timeoutMs?: number): Promise<boolean>;
 /** Cancellation stops waiting for the credential lock, not an already started token rotation. */
 export declare function refreshStoredOAuthCredential(credentials: CredentialStore, providerId: string, oauth: OAuthAuth, needsRefresh: (credential: OAuthCredential) => boolean, signal: AbortSignal): Promise<OAuthCredential | undefined>;
 /**

package/dist/auth/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,KAAK,EAGX,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,6FAA6F;AAC7F,eAAO,MAAM,mCAAmC,QAAS,CAAC;AAE1D,qHAAqH;AACrH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,MAAM,WAAW,uBAAuB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAC5C,WAAW,EAAE,eAAe,EAC5B,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAwBjC;AA6DD,iGAAiG;AACjG,wBAAsB,4BAA4B,CACjD,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,EAChB,YAAY,EAAE,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,EACtD,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CA+BtC;AAiDD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,WAAW,EAAE,eAAe,EAC5B,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAC5C,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQjC"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAW/C,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,KAAK,EAGX,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,6FAA6F;AAC7F,eAAO,MAAM,mCAAmC,QAAS,CAAC;AAE1D,qHAAqH;AACrH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,MAAM,WAAW,uBAAuB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAC5C,WAAW,EAAE,eAAe,EAC5B,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAwBjC;AA2DD,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AAQvE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAiB7C;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,SAAS,GAAE,MAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB9G;AA2JD,iGAAiG;AACjG,wBAAsB,4BAA4B,CACjD,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,EAChB,YAAY,EAAE,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,EACtD,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CA4CtC;AAiDD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,WAAW,EAAE,eAAe,EAC5B,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAC5C,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQjC"}

package/dist/auth/resolve.js

@@ -1,6 +1,8 @@
 import { normalizeProviderId } from "../provider-id.js";
 import { operationSignal, raceWithAbortSignal } from "../utils/abort.js";
+import { formatThrownValue } from "../utils/diagnostics.js";
 import { ModelsError } from "../utils/models-error.js";
+import { findPermanentRefreshRejectionInText, isOAuthRefreshRejectedError, safeOAuthErrorCode, safeOAuthErrorDescription, } from "./oauth-refresh-errors.js";
 export { ModelsError } from "../utils/models-error.js";
 /** Bound for pre-transport request-auth work: credential read, OAuth refresh, and toAuth. */
 export const REQUEST_AUTH_PREPARATION_TIMEOUT_MS = 15_000;
@@ -67,7 +69,180 @@ function overlayEnvAuthContext(base, env) {
     };
 }
 const DEFAULT_OAUTH_MINIMUM_VALIDITY_MS = 5 * 60 * 1000;
-const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 60_000;
+/** How long a refresh keeps its caller waiting for one token exchange. */
+export const OAUTH_REFRESH_TIMEOUT_MS = 60_000;
+/**
+ * How long a refresh keeps the credential lock while its token exchange is still running, so no other refresh
+ * presents a token the exchange may already have rotated. A response after this is still persisted, lock-free.
+ */
+export const OAUTH_REFRESH_LOCK_HOLD_MS = 2 * OAUTH_REFRESH_TIMEOUT_MS;
+/**
+ * Signal handed to a provider's token exchange. Nothing aborts it: once sent, the provider may already have
+ * rotated the refresh token, so only the exchange's own response can tell us the replacement.
+ */
+const TOKEN_EXCHANGE_SIGNAL = new AbortController().signal;
+/**
+ * How long a graceful shutdown waits for token exchanges still in flight, and for persisting their results, before
+ * the process exits (see {@link drainPendingOAuthRotations}).
+ *
+ * Abrupt termination (SIGKILL, a crash, power loss) cannot wait. If the provider already rotated the refresh token
+ * when that happens, its response never reaches the process and the stored login keeps the replaced token; the
+ * next refresh then fails and `/login <provider>` signs in again.
+ */
+export const OAUTH_SHUTDOWN_DRAIN_MS = 3_000;
+/** One entry per started token exchange, settled once its result is persisted or given up on. */
+const pendingTokenExchanges = new Set();
+function trackTokenExchange() {
+    let settle;
+    const pending = new Promise((resolve) => {
+        settle = resolve;
+    });
+    pendingTokenExchanges.add(pending);
+    return () => {
+        pendingTokenExchanges.delete(pending);
+        settle();
+    };
+}
+/**
+ * Waits for every started OAuth token exchange to settle and its result to be persisted, at most `timeoutMs`.
+ * Callers stop waiting for an exchange after {@link OAUTH_REFRESH_TIMEOUT_MS} while it keeps running, so a process
+ * that exits gracefully calls this first: the provider may already have rotated the token. Resolves `true` once none
+ * is in flight, `false` when the bound passes first; never rejects.
+ */
+export async function drainPendingOAuthRotations(timeoutMs = OAUTH_SHUTDOWN_DRAIN_MS) {
+    const deadline = Date.now() + timeoutMs;
+    while (pendingTokenExchanges.size > 0) {
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0)
+            return false;
+        let timer;
+        const expired = new Promise((resolve) => {
+            timer = setTimeout(resolve, remainingMs);
+        });
+        try {
+            await Promise.race([Promise.all(pendingTokenExchanges), expired]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    return true;
+}
+const MAX_ERROR_CHAIN_DEPTH = 5;
+/**
+ * The provider's error code (or HTTP status) and description for a refresh it rejected because the stored login is
+ * revoked or expired: an {@link OAuthRefreshRejectedError} anywhere in the cause chain, or a permanent OAuth error
+ * code in a custom refresher's message. Never request bodies, URLs, or tokens.
+ */
+function describeRejectedLogin(error, presented) {
+    const secrets = [presented.refresh, presented.access];
+    const describe = (code, description) => {
+        const safeDescription = safeOAuthErrorDescription(description, secrets);
+        return safeDescription ? `${code} (${safeDescription})` : code;
+    };
+    let current = error;
+    for (let depth = 0; depth < MAX_ERROR_CHAIN_DEPTH && current !== undefined && current !== null; depth++) {
+        if (current instanceof Error && isOAuthRefreshRejectedError(current)) {
+            return describe(safeOAuthErrorCode(current.code) ?? `HTTP ${current.status}`, current.description);
+        }
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    current = error;
+    for (let depth = 0; depth < MAX_ERROR_CHAIN_DEPTH && current !== undefined && current !== null; depth++) {
+        const rejection = findPermanentRefreshRejectionInText(formatThrownValue(current));
+        const code = safeOAuthErrorCode(rejection?.code);
+        if (code !== undefined)
+            return describe(code, rejection?.description);
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    return undefined;
+}
+/**
+ * Per credential store and provider, why the last late rotation could not be saved: only the save error's `code` or
+ * `name`, never its message, which may contain paths or tokens. Keyed by store so one store's lost save is never
+ * reported against another's login. Cleared by a later save or rotation, or once a refresh failure reports it.
+ */
+const unsavedLateRotations = new WeakMap();
+function unsavedLateRotationsFor(credentials) {
+    let byProvider = unsavedLateRotations.get(credentials);
+    if (byProvider === undefined) {
+        byProvider = new Map();
+        unsavedLateRotations.set(credentials, byProvider);
+    }
+    return byProvider;
+}
+function safeSaveErrorReason(error) {
+    if (error instanceof Error) {
+        const code = "code" in error ? error.code : undefined;
+        return typeof code === "string" && /^[A-Z][A-Z0-9_]{0,63}$/.test(code) ? code : error.name;
+    }
+    return "unknown error";
+}
+/** The sentence explaining a lost late rotation for `providerId` in `credentials`, reported once. */
+function takeUnsavedLateRotationNote(credentials, providerId) {
+    const byProvider = unsavedLateRotations.get(credentials);
+    const reason = byProvider?.get(providerId);
+    if (reason === undefined)
+        return "";
+    byProvider?.delete(providerId);
+    return ` An earlier refresh for ${providerId} succeeded, but its new login could not be saved (${reason}).`;
+}
+function oauthRefreshFailure(credentials, providerId, error, presented) {
+    const rejectedLogin = describeRejectedLogin(error, presented);
+    const unsavedNote = takeUnsavedLateRotationNote(credentials, providerId);
+    if (rejectedLogin === undefined) {
+        const message = unsavedNote
+            ? `OAuth refresh failed for ${providerId}.${unsavedNote}`
+            : `OAuth refresh failed for ${providerId}`;
+        return new ModelsError("oauth", message, { cause: error });
+    }
+    return new ModelsError("oauth", `OAuth refresh failed for ${providerId}: ${rejectedLogin}. The provider rejected the stored login; run /login ${providerId} to sign in again.${unsavedNote}`);
+}
+/** A token exchange that settles after its timeout already rotated the token server-side, so keep its result. */
+function persistLateRotation(credentials, providerId, rotatedFrom, rotation) {
+    const settled = trackTokenExchange();
+    void rotation
+        .then((late) => credentials
+        .modify(providerId, async (current) => current?.type === "oauth" && current.refresh === rotatedFrom.refresh ? late : undefined)
+        .then(() => {
+        unsavedLateRotations.get(credentials)?.delete(providerId);
+    }, (saveError) => {
+        unsavedLateRotationsFor(credentials).set(providerId, safeSaveErrorReason(saveError));
+    }), 
+    // The exchange itself failed: nothing was rotated that could be lost.
+    () => undefined)
+        .finally(settled);
+}
+/**
+ * Runs one token exchange under the credential lock. The caller stops waiting after {@link OAUTH_REFRESH_TIMEOUT_MS};
+ * the lock is kept until the exchange settles or {@link OAUTH_REFRESH_LOCK_HOLD_MS} passes, after which a late
+ * response is still persisted.
+ */
+async function rotateOAuthCredential(credentials, providerId, oauth, current, stopCallerWaiting) {
+    const rotation = oauth.refresh(current, TOKEN_EXCHANGE_SIGNAL);
+    const callerWait = AbortSignal.timeout(OAUTH_REFRESH_TIMEOUT_MS);
+    const onCallerWaitExpired = () => {
+        stopCallerWaiting(new ModelsError("oauth", `OAuth refresh failed for ${providerId}`, { cause: callerWait.reason }));
+    };
+    callerWait.addEventListener("abort", onCallerWaitExpired, { once: true });
+    const lockHold = AbortSignal.timeout(OAUTH_REFRESH_LOCK_HOLD_MS);
+    try {
+        return await raceWithAbortSignal(rotation, lockHold);
+    }
+    catch (error) {
+        if (lockHold.aborted)
+            persistLateRotation(credentials, providerId, current, rotation);
+        throw error;
+    }
+    finally {
+        callerWait.removeEventListener("abort", onCallerWaitExpired);
+    }
+}
+/** A login another process saved after this refresh read the store, e.g. its own rotation of the same token. */
+async function readNewerOAuthCredential(credentials, providerId, rejected) {
+    const latest = await credentials.read(providerId).catch(() => undefined);
+    return latest?.type === "oauth" && latest.refresh !== rejected.refresh ? latest : undefined;
+}
 /** Cancellation stops waiting for the credential lock, not an already started token rotation. */
 export async function refreshStoredOAuthCredential(credentials, providerId, oauth, needsRefresh, signal) {
     let post;
@@ -76,8 +251,14 @@ export async function refreshStoredOAuthCredential(credentials, providerId, oaut
     signal.addEventListener("abort", cancelLockWait, { once: true });
     if (signal.aborted)
         cancelLockWait();
+    let stopCallerWaiting;
+    /** Set once the token exchange starts; settles its pending entry when the transaction that commits it ends. */
+    let exchangeSettled;
+    const callerWaitExpired = new Promise((_, reject) => {
+        stopCallerWaiting = reject;
+    });
     try {
-        post = await credentials.modify(providerId, async (current) => {
+        const transaction = credentials.modify(providerId, async (current) => {
             signal.removeEventListener("abort", cancelLockWait);
             signal.throwIfAborted();
             if (current?.type !== "oauth")
@@ -85,13 +266,21 @@ export async function refreshStoredOAuthCredential(credentials, providerId, oaut
             if (!needsRefresh(current))
                 return undefined;
             try {
-                const refreshSignal = AbortSignal.timeout(DEFAULT_OAUTH_REFRESH_TIMEOUT_MS);
-                return await raceWithAbortSignal(oauth.refresh(current, refreshSignal), refreshSignal);
+                exchangeSettled ??= trackTokenExchange();
+                const rotated = await rotateOAuthCredential(credentials, providerId, oauth, current, stopCallerWaiting);
+                unsavedLateRotations.get(credentials)?.delete(providerId);
+                return rotated;
             }
             catch (error) {
-                throw new ModelsError("oauth", `OAuth refresh failed for ${providerId}`, { cause: error });
+                const newer = await readNewerOAuthCredential(credentials, providerId, current);
+                if (newer)
+                    return newer;
+                throw oauthRefreshFailure(credentials, providerId, error, current);
             }
         }, { signal: lockWait.signal });
+        const untrackExchange = () => exchangeSettled?.();
+        void transaction.then(untrackExchange, untrackExchange);
+        post = await Promise.race([transaction, callerWaitExpired]);
     }
     catch (error) {
         if (error instanceof ModelsError)