@bike4mind/cli 0.18.5 → 0.20.1

package/dist/ApiClient-BPmlalut.mjs

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+import { n as logger, t as ConfigStore } from "./ConfigStore-CNfbeaJf.mjs";
+import { t as version } from "./package-CxHSRXdp.mjs";
+import axios, { isAxiosError } from "axios";
+//#region src/auth/OAuthClient.ts
+/**
+* OAuth 2.0 Device Authorization Flow client
+* Implements RFC 8628 for CLI authentication
+*/
+var OAuthClient = class {
+	constructor(baseURL = "http://localhost:3000") {
+		this.clientId = "b4m-cli";
+		this.apiClient = axios.create({
+			baseURL,
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	/**
+	* Initiate device authorization flow
+	* Returns device code, user code, and verification URL
+	*/
+	async initiateDeviceFlow() {
+		return (await this.apiClient.post("/api/oauth/device/initiate", { client_id: this.clientId })).data;
+	}
+	/**
+	* Poll for access token
+	* Returns token response if approved, or throws error with status
+	*/
+	async pollForToken(deviceCode) {
+		try {
+			const response = await this.apiClient.post("/api/oauth/device/token", {
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				device_code: deviceCode,
+				client_id: this.clientId
+			}, { validateStatus: () => true });
+			if ("error" in response.data) throw new Error(response.data.error);
+			return response.data;
+		} catch (error) {
+			if (axios.isAxiosError(error) && error.response?.data?.error) throw new Error(error.response.data.error);
+			throw error;
+		}
+	}
+	/**
+	* Wait for user authorization with automatic polling
+	* Implements exponential backoff and respects server's interval
+	*/
+	async waitForAuthorization(deviceCode, interval, onStatus) {
+		let pollInterval = interval * 1e3;
+		const maxInterval = 3e4;
+		onStatus?.("Waiting for user authorization...");
+		await this.sleep(pollInterval);
+		while (true) try {
+			return await this.pollForToken(deviceCode);
+		} catch (error) {
+			if (error instanceof Error) {
+				const errorMessage = error.message;
+				if (errorMessage === "authorization_pending") {
+					onStatus?.("Waiting for user authorization...");
+					await this.sleep(pollInterval);
+					continue;
+				}
+				if (errorMessage === "slow_down") {
+					pollInterval = Math.min(pollInterval + 5e3, maxInterval);
+					onStatus?.("Slowing down polling...");
+					await this.sleep(pollInterval);
+					continue;
+				}
+				if (errorMessage === "access_denied") throw new Error("User denied the authorization request");
+				if (errorMessage === "expired_token") throw new Error("Authorization code has expired");
+				throw error;
+			}
+			throw error;
+		}
+	}
+	/**
+	* Refresh an expired access token
+	*/
+	async refreshToken(refreshToken) {
+		return (await this.apiClient.post("/api/oauth/refresh", {
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: this.clientId
+		})).data;
+	}
+	/**
+	* Sleep for specified milliseconds
+	*/
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+};
+//#endregion
+//#region src/auth/ApiClient.ts
+const USER_AGENT = `b4m-cli/${version}`;
+/**
+* Per-request timeout. Generous by design: a waited chat (POST /api/chat with wait:true)
+* runs a full server-side quest, so the bound only exists to stop a hung backend from
+* wedging a caller forever, not to cap a normal long quest. Override with B4M_API_TIMEOUT_MS
+* (0 disables the timeout entirely).
+*/
+const DEFAULT_API_TIMEOUT_MS = 6e5;
+function resolveTimeoutMs() {
+	const raw = process.env.B4M_API_TIMEOUT_MS;
+	if (raw === void 0 || raw.trim() === "") return DEFAULT_API_TIMEOUT_MS;
+	const parsed = Number(raw);
+	return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_API_TIMEOUT_MS;
+}
+/**
+* Thrown by the response interceptor only when the session is DEFINITIVELY revoked - the
+* refresh token was rejected (400/401 invalid_grant), or a request still 401s after a
+* successful refresh. A transient refresh outage (5xx / network / timeout) throws a plain
+* Error instead, so callers that must distinguish "log out" from "retry" (e.g.
+* checkSessionValid / the WS reconnect loop) can key on the type. The human-readable
+* message is preserved on both paths so existing `error.message.includes(...)` callers are
+* unaffected.
+*/
+var SessionRevokedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SessionRevokedError";
+	}
+};
+/**
+* Authenticated API client for B4M services
+* Automatically injects access tokens from ConfigStore
+*/
+var ApiClient = class {
+	/**
+	* @param apiKey - When set, requests authenticate with this instance API key via
+	*   the `x-api-key` header and the OAuth-JWT path (Bearer injection + refresh-on-401)
+	*   is bypassed entirely. Omit to keep the default stored-JWT behavior unchanged.
+	*/
+	constructor(baseURL = "http://localhost:3000", configStore, apiKey) {
+		this.configStore = configStore || new ConfigStore();
+		this.oauthClient = new OAuthClient(baseURL);
+		this.apiKey = apiKey;
+		this.client = axios.create({
+			baseURL,
+			timeout: resolveTimeoutMs(),
+			headers: {
+				"Content-Type": "application/json",
+				"User-Agent": USER_AGENT,
+				"X-B4M-Client": USER_AGENT
+			}
+		});
+		this.client.interceptors.request.use(async (config) => {
+			if (this.apiKey) {
+				config.headers["x-api-key"] = this.apiKey;
+				return config;
+			}
+			const tokens = await this.configStore.getAuthTokens();
+			if (tokens) config.headers.Authorization = `Bearer ${tokens.accessToken}`;
+			return config;
+		}, (error) => Promise.reject(error));
+		this.client.interceptors.response.use((response) => response, async (error) => {
+			const originalRequest = error.config;
+			if (error.response?.status === 401) logger.debug("AUTH: Received 401 Unauthorized");
+			else if (error.response?.status === 403) logger.error("403 Forbidden", error);
+			if (this.apiKey) return Promise.reject(error);
+			if (error.response?.status === 401 && !originalRequest._retry) {
+				originalRequest._retry = true;
+				try {
+					const tokens = await this.configStore.getAuthTokens();
+					if (!tokens) throw new Error("Not authenticated");
+					if (Date.now() - (new Date(tokens.expiresAt).getTime() - 6048e5) < 36e5) {
+						logger.debug("AUTH: Access token is fresh, skipping refresh — 401 is likely transient");
+						return Promise.reject(error);
+					}
+					logger.debug("AUTH: Attempting token refresh");
+					const newTokens = await this.oauthClient.refreshToken(tokens.refreshToken);
+					logger.debug("AUTH: Token refresh successful");
+					const expiresAt = new Date(Date.now() + newTokens.expires_in * 1e3).toISOString();
+					await this.configStore.setAuthTokens({
+						accessToken: newTokens.access_token,
+						refreshToken: newTokens.refresh_token,
+						expiresAt,
+						userId: tokens.userId
+					});
+					originalRequest.headers.Authorization = `Bearer ${newTokens.access_token}`;
+					logger.debug("AUTH: Retrying request with new token");
+					return this.client(originalRequest);
+				} catch (refreshError) {
+					const refreshMsg = refreshError instanceof Error ? refreshError.message : "Unknown error";
+					logger.warn(`AUTH: Token refresh failed: ${refreshMsg}`);
+					const tokens = await this.configStore.getAuthTokens();
+					if (tokens && new Date(tokens.expiresAt) <= /* @__PURE__ */ new Date()) await this.configStore.clearAuthTokens();
+					const msg = "Authentication expired. Please run `b4m login` again.";
+					const refreshStatus = isAxiosError(refreshError) ? refreshError.response?.status : void 0;
+					if (refreshStatus === 400 || refreshStatus === 401) throw new SessionRevokedError(msg);
+					throw new Error(msg);
+				}
+			}
+			if (error.response?.status === 401 && originalRequest._retry) {
+				logger.debug("AUTH: Token refresh retry failed");
+				const tokens = await this.configStore.getAuthTokens();
+				if (tokens && new Date(tokens.expiresAt) <= /* @__PURE__ */ new Date()) await this.configStore.clearAuthTokens();
+				throw new SessionRevokedError("Authentication failed. Please run /login to authenticate.");
+			}
+			return Promise.reject(error);
+		});
+	}
+	/**
+	* Make a GET request
+	*/
+	async get(url, config) {
+		return (await this.client.get(url, config)).data;
+	}
+	/**
+	* Make a POST request
+	*/
+	async post(url, data, config) {
+		logger.debug(`[ApiClient] POST ${this.client.defaults.baseURL}${url}`);
+		logger.debug(`[ApiClient] Request body: ${JSON.stringify(data)}`);
+		const response = await this.client.post(url, data, config);
+		logger.debug(`[ApiClient] Response status: ${response.status}`);
+		return response.data;
+	}
+	/**
+	* Make a PUT request
+	*/
+	async put(url, data, config) {
+		return (await this.client.put(url, data, config)).data;
+	}
+	/**
+	* Make a DELETE request
+	*/
+	async delete(url, config) {
+		return (await this.client.delete(url, config)).data;
+	}
+	/**
+	* Get the underlying axios instance for advanced use cases (e.g., streaming)
+	*/
+	getAxiosInstance() {
+		return this.client;
+	}
+	/**
+	* Check if user is authenticated
+	*/
+	async isAuthenticated() {
+		return this.configStore.isAuthenticated();
+	}
+	/**
+	* Get current user information
+	*/
+	async getCurrentUser() {
+		try {
+			const tokens = await this.configStore.getAuthTokens();
+			if (!tokens) return null;
+			return { id: tokens.userId };
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Verifies the session is still valid via a cheap authed GET. The response interceptor
+	* above already attempts a token refresh and retries on 401, so a resolved call means the
+	* session is valid (fresh or transparently refreshed). Returns false ONLY on a
+	* `SessionRevokedError` (the refresh token was rejected, or a 401 survived a refresh);
+	* every other outcome - a transient refresh outage, a network blip, or the interceptor's
+	* fresh-token 401 skip - is treated as transient and returns true, so callers keep
+	* retrying rather than tearing down on a blip.
+	*
+	* Used by WebSocketConnectionManager to distinguish "session revoked" from "transient
+	* network issue" when a WS connect attempt fails to open - a WS close event carries no
+	* HTTP status, so this is the only way to tell the two apart.
+	*/
+	async checkSessionValid() {
+		try {
+			await this.get("/api/identify");
+			return true;
+		} catch (err) {
+			return !(err instanceof SessionRevokedError);
+		}
+	}
+};
+//#endregion
+export { OAuthClient as n, ApiClient as t };