@bike4mind/cli 1.2.0 → 2.1.0

package/dist/{ApiClient-D0fQ2FT6.mjs → ApiClient-dIB3YQc2.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { n as logger, t as ConfigStore } from "./ConfigStore-qV7NrCgZ.mjs";
-import { t as version } from "./package-CGZIoxcs.mjs";
+import { n as logger, t as ConfigStore } from "./ConfigStore-BygzEI6H.mjs";
+import { t as version } from "./package-CRNnNXxq.mjs";
 import axios, { isAxiosError } from "axios";
 //#region src/auth/OAuthClient.ts
 /**
@@ -90,6 +90,33 @@ var OAuthClient = class {
 	}
 };
 //#endregion
+//#region src/auth/providerKeyFailure.ts
+const PROVIDER_KEY_ERROR_CODES = /* @__PURE__ */ new Set(["provider_not_configured", "provider_rejected"]);
+/**
+* A 401 whose body names a missing or rejected AI-provider key (e.g. /api/ai/tts). The
+* Bike4Mind credential was accepted, so refreshing or re-authenticating cannot fix it.
+* Shared by the ApiClient refresh interceptor and mapApiError in mcp/b4mApiClient.ts.
+*/
+function isProviderKeyFailure(data) {
+	const body = decodeBinaryBody(data);
+	if (!body || typeof body !== "object") return false;
+	const { errorCode } = body;
+	return typeof errorCode === "string" && PROVIDER_KEY_ERROR_CODES.has(errorCode);
+}
+/**
+* An arraybuffer-typed request (the generated-audio calls) gets its error body as raw
+* bytes, and the refresh interceptor sees it before any caller can decode it.
+*/
+function decodeBinaryBody(data) {
+	const bytes = data instanceof ArrayBuffer ? Buffer.from(data) : ArrayBuffer.isView(data) ? Buffer.from(data.buffer, data.byteOffset, data.byteLength) : void 0;
+	if (!bytes) return data;
+	try {
+		return JSON.parse(bytes.toString("utf8"));
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/auth/ApiClient.ts
 const USER_AGENT = `b4m-cli/${version}`;
 /**
@@ -121,6 +148,17 @@ var SessionRevokedError = class extends Error {
 	}
 };
 /**
+* 401 with no credential at all (no API key, no stored tokens): a config gap, not an expiry.
+* Not a SessionRevokedError, so checkSessionValid still reports "not revoked". The message keeps
+* `Authentication failed` for string-matching callers (turnController, handoff, ServerLlmBackend).
+*/
+var NotAuthenticatedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "NotAuthenticatedError";
+	}
+};
+/**
 * Authenticated API client for B4M services
 * Automatically injects access tokens from ConfigStore
 */
@@ -157,11 +195,12 @@ var ApiClient = class {
 			if (error.response?.status === 401) logger.debug("AUTH: Received 401 Unauthorized");
 			else if (error.response?.status === 403) logger.error("403 Forbidden", error);
 			if (this.apiKey) return Promise.reject(error);
+			if (error.response?.status === 401 && isProviderKeyFailure(error.response.data)) return Promise.reject(error);
 			if (error.response?.status === 401 && !originalRequest._retry) {
 				originalRequest._retry = true;
+				const tokens = await this.configStore.getAuthTokens();
+				if (!tokens) throw new NotAuthenticatedError("Authentication failed: not logged in. Please run `b4m login` to authenticate.");
 				try {
-					const tokens = await this.configStore.getAuthTokens();
-					if (!tokens) throw new Error("Not authenticated");
 					if (new Date(tokens.expiresAt).getTime() > Date.now()) {
 						logger.debug("AUTH: Access token has not expired, skipping refresh - 401 is likely transient");
 						return Promise.reject(error);
@@ -274,4 +313,4 @@ var ApiClient = class {
 	}
 };
 //#endregion
-export { OAuthClient as n, ApiClient as t };
+export { OAuthClient as i, NotAuthenticatedError as n, isProviderKeyFailure as r, ApiClient as t };