@cjhyy/code-shell-core 0.7.0 → 0.7.1

package/dist/protocol/types.d.ts

@@ -7,7 +7,7 @@
  *   Server → Client: notifications (stream events, approval requests)
  *   Server → Client: responses (results of requests)
  */
-import type { StreamEvent, TokenUsage, TerminalReason, ApprovalRequest, ApprovalResult, PermissionMode } from "../types.js";
+import type { StreamEvent, TokenUsage, TerminalReason, ApprovalRequest, ApprovalResult, PermissionMode, SessionForkLineage, SessionWorkspace } from "../types.js";
 export interface RpcRequest {
     jsonrpc: "2.0";
     id: string | number;
@@ -48,7 +48,7 @@ export declare const ErrorCodes: {
     readonly Cancelled: -32005;
 };
 export type InputAttachmentKind = "image" | "file" | "directory";
-export type InputAttachmentOrigin = "paste" | "os-drop" | "file-panel" | "picker" | "mention" | "generated" | "tool";
+export type InputAttachmentOrigin = "paste" | "os-drop" | "file-panel" | "picker" | "mention" | "generated" | "mobile" | "tool";
 export interface InputAttachmentMeta {
     id: string;
     sessionId: string;
@@ -139,9 +139,30 @@ export interface RunResult {
     turnCount: number;
     usage: TokenUsage;
 }
+export interface ForkSessionParams {
+    sourceSessionId: string;
+    targetSessionId?: string;
+    mode: "full";
+    /** Inclusive source event cursor; omitted freezes the current tail. */
+    throughEventId?: string;
+    /** Desktop host ownership generation; ignored by protocol-only hosts. */
+    quickChatClaimId?: string;
+}
+export interface ForkSessionResult {
+    sessionId: string;
+    mode: "full";
+    forkedFrom: SessionForkLineage;
+    workspace: SessionWorkspace;
+    copiedEventCount: number;
+    titleSuggestion?: string;
+}
 /** Respond to an approval request from the server. */
 export interface ApproveParams {
     sessionId: string;
+    /** Connection owner echoed from ApprovalRequestNotification when present. */
+    connectionId?: string;
+    /** Session-owner generation echoed from ApprovalRequestNotification when present. */
+    generation?: number;
     requestId: string;
     decision: ApprovalResult;
 }
@@ -294,6 +315,10 @@ export interface AgentStreamEventNotification {
 export interface ApprovalRequestNotification {
     /** Originating engine session when known. */
     sessionId?: string;
+    /** Connection owner required by strict multi-connection hosts. */
+    connectionId?: string;
+    /** Monotonic owner generation required by strict multi-connection hosts. */
+    generation?: number;
     requestId: string;
     request: ApprovalRequest;
 }
@@ -308,8 +333,14 @@ export interface StatusNotification {
     status: "ready" | "running" | "error" | "shutdown";
     message?: string;
 }
+/** Server accepted and queued an agent/run request after synchronous validation. */
+export interface RunAcceptedNotification {
+    requestId: string | number;
+    sessionId: string;
+}
 export declare const Methods: {
     readonly Run: "agent/run";
+    readonly ForkSession: "agent/forkSession";
     readonly Approve: "agent/approve";
     readonly Cancel: "agent/cancel";
     readonly Configure: "agent/configure";
@@ -336,6 +367,7 @@ export declare const Methods: {
      *  for the desktop background panel. Output/kill of a shell still goes through
      *  BackgroundShells by shellId; this is list-only across all three kinds. */
     readonly BackgroundWork: "agent/backgroundWork";
+    readonly RunAccepted: "agent/runAccepted";
     readonly StreamEvent: "agent/streamEvent";
     readonly ApprovalRequest: "agent/approvalRequest";
     /** Server-initiated resolution of a pending approval/ask (e.g. a goal-mode

package/dist/protocol/types.js

@@ -29,6 +29,7 @@ export const ErrorCodes = {
 export const Methods = {
     // Client → Server
     Run: "agent/run",
+    ForkSession: "agent/forkSession",
     Approve: "agent/approve",
     Cancel: "agent/cancel",
     Configure: "agent/configure",
@@ -56,6 +57,7 @@ export const Methods = {
      *  BackgroundShells by shellId; this is list-only across all three kinds. */
     BackgroundWork: "agent/backgroundWork",
     // Server → Client (notifications, no id)
+    RunAccepted: "agent/runAccepted",
     StreamEvent: "agent/streamEvent",
     ApprovalRequest: "agent/approvalRequest",
     /** Server-initiated resolution of a pending approval/ask (e.g. a goal-mode

package/dist/services/dream-consolidation.d.ts

@@ -21,6 +21,7 @@
 import type { LLMClientBase } from "../llm/client-base.js";
 import type { ToolRegistry } from "../tool-system/registry.js";
 import type { ToolContext } from "../tool-system/context.js";
+import type { TokenUsage } from "../types.js";
 export interface DreamConsolidationInput {
     /** LLM client for the consolidation calls. */
     llmClient: LLMClientBase;
@@ -36,6 +37,8 @@ export interface DreamConsolidationInput {
     projectDir?: string;
     /** For log attribution. */
     sessionId?: string;
+    /** Owning Engine session/Goal recorder; process billing already happened. */
+    onUsage?: (usage: TokenUsage) => void;
 }
 export interface DreamConsolidationResult {
     /** True if the loop ran (with or without writes); false if it bailed early. */

package/dist/services/dream-consolidation.js

@@ -71,9 +71,12 @@ export async function runDreamConsolidation(input) {
             messages,
             tools: toolDefs,
             maxTokens: 2048,
-            recordUsage: false,
+            billingEnabled: true,
+            requestVisible: false,
             reasoning: { mode: "off" },
         });
+        if (resp.usage)
+            input.onUsage?.(resp.usage);
         if (resp.toolCalls.length === 0) {
             logger.info("memory.dream_finished", {
                 sessionId,

package/dist/services/index.d.ts

@@ -2,7 +2,7 @@
  * Services index — re-exports all service modules.
  */
 export { analytics, trackEvent } from "./analytics.js";
-export { authorize, refreshToken, type OAuthConfig, type OAuthTokens } from "./oauth.js";
+export { authorize, refreshToken, generatePKCE, createHardenedOAuthFetch, type OAuthConfig, type OAuthTokens, type OAuthAuthorizeOptions, type OAuthRefreshOptions, type HardenedOAuthFetchOptions, } from "./oauth.js";
 export { notify, notifyComplete, notifyError } from "./notifier.js";
 export { diagnostics } from "./diagnostics.js";
 export { buildExtractionPrompt, parseExtractionResponse, type ExtractedMemory, } from "./extract-memories.js";

package/dist/services/index.js

@@ -8,7 +8,7 @@ export { analytics, trackEvent } from "./analytics.js";
 // `microCompact` that truncated long *messages* by char count, unrelated
 // to the tool_result-based microcompact in ContextManager). Removed to end
 // the "which microcompact?" ambiguity — the source of truth is ContextManager.
-export { authorize, refreshToken } from "./oauth.js";
+export { authorize, refreshToken, generatePKCE, createHardenedOAuthFetch, } from "./oauth.js";
 export { notify, notifyComplete, notifyError } from "./notifier.js";
 export { diagnostics } from "./diagnostics.js";
 export { buildExtractionPrompt, parseExtractionResponse, } from "./extract-memories.js";

package/dist/services/oauth.d.ts

@@ -1,27 +1,51 @@
-/**
- * OAuth service — OAuth 2.0 authorization code flow with PKCE.
- *
- * Supports browser-based login flow for API authentication.
- */
+/** OAuth 2.0 authorization-code + PKCE primitives for host applications. */
 export interface OAuthConfig {
     clientId: string;
+    clientSecret?: string;
     authorizationEndpoint: string;
     tokenEndpoint: string;
     redirectUri?: string;
     scopes?: string[];
+    resource?: string;
 }
 export interface OAuthTokens {
     accessToken: string;
     refreshToken?: string;
     expiresAt?: number;
     tokenType: string;
+    scope?: string;
+}
+export interface OAuthAuthorizeOptions {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    openExternal?: (url: string) => Promise<void> | void;
+    fetch?: typeof fetch;
+    callbackHost?: "127.0.0.1";
+    /** Zero asks the OS for an ephemeral port. */
+    callbackPort?: number;
+}
+export interface OAuthRefreshOptions {
+    fetch?: typeof fetch;
+    now?: number;
+}
+export interface HardenedOAuthFetchOptions {
+    /** Maximum redirects followed after the initial request. */
+    maxRedirects?: number;
 }
 /**
- * Run the OAuth authorization code flow.
- * Opens a browser for user login and waits for the callback.
+ * Wrap fetch with OAuth-specific redirect handling. Every hop is validated;
+ * POST/Authorization requests never cross origins, so authorization codes,
+ * verifiers, refresh tokens, client secrets, and revocation tokens cannot be
+ * forwarded by an upstream 30x response.
  */
-export declare function authorize(config: OAuthConfig): Promise<OAuthTokens>;
+export declare function createHardenedOAuthFetch(baseFetch?: typeof fetch, options?: HardenedOAuthFetchOptions): typeof fetch;
+export declare function generatePKCE(): {
+    verifier: string;
+    challenge: string;
+};
 /**
- * Refresh an access token using a refresh token.
+ * Run an OAuth authorization-code flow. The host owns browser launching and
+ * injects `openExternal`; core only listens on an ephemeral loopback port.
  */
-export declare function refreshToken(config: OAuthConfig, refreshTokenValue: string): Promise<OAuthTokens>;
+export declare function authorize(config: OAuthConfig, options?: OAuthAuthorizeOptions): Promise<OAuthTokens>;
+export declare function refreshToken(config: OAuthConfig, refreshTokenValue: string, options?: OAuthRefreshOptions): Promise<OAuthTokens>;

package/dist/services/oauth.js

@@ -1,81 +1,209 @@
-/**
- * OAuth service — OAuth 2.0 authorization code flow with PKCE.
- *
- * Supports browser-based login flow for API authentication.
- */
+/** OAuth 2.0 authorization-code + PKCE primitives for host applications. */
+import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
-import { randomBytes, createHash } from "node:crypto";
-import { execFile } from "node:child_process";
-import { browserOpenCommand } from "./browser-open.js";
+import { mergeOAuthTokenResponse } from "../credentials/oauth.js";
+const OAUTH_REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+function normalizedHostname(hostname) {
+    return hostname
+        .replace(/^\[|\]$/g, "")
+        .replace(/\.$/, "")
+        .toLowerCase();
+}
+function ipv4Octets(hostname) {
+    const parts = normalizedHostname(hostname).split(".");
+    if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part)))
+        return undefined;
+    const octets = parts.map(Number);
+    return octets.every((part) => part >= 0 && part <= 255) ? octets : undefined;
+}
+function isLoopbackHostname(hostname) {
+    const host = normalizedHostname(hostname);
+    const octets = ipv4Octets(host);
+    return host === "localhost" || host === "::1" || Boolean(octets && octets[0] === 127);
+}
+function isPrivateNetworkHostname(hostname) {
+    const host = normalizedHostname(hostname);
+    const octets = ipv4Octets(host);
+    if (octets) {
+        const [a, b] = octets;
+        return (a === 0 ||
+            a === 10 ||
+            (a === 100 && b >= 64 && b <= 127) ||
+            (a === 169 && b === 254) ||
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            (a === 198 && (b === 18 || b === 19)));
+    }
+    if (!host.includes(":"))
+        return false;
+    return host === "::" || host.startsWith("fc") || host.startsWith("fd") || /^fe[89ab]/.test(host);
+}
+function validateOAuthRequestUrl(url) {
+    if (url.username || url.password)
+        throw new Error("OAuth endpoint must not include credentials");
+    const loopback = isLoopbackHostname(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+        throw new Error("OAuth endpoint must use HTTPS (HTTP is allowed only for localhost)");
+    }
+    if (!loopback && isPrivateNetworkHostname(url.hostname)) {
+        throw new Error("OAuth endpoint must not target a private network address");
+    }
+}
 /**
- * Generate PKCE code verifier and challenge.
+ * Wrap fetch with OAuth-specific redirect handling. Every hop is validated;
+ * POST/Authorization requests never cross origins, so authorization codes,
+ * verifiers, refresh tokens, client secrets, and revocation tokens cannot be
+ * forwarded by an upstream 30x response.
  */
-function generatePKCE() {
+export function createHardenedOAuthFetch(baseFetch = fetch, options = {}) {
+    const maxRedirects = Math.max(0, Math.min(10, options.maxRedirects ?? 5));
+    return (async (input, init) => {
+        const initial = new Request(input, init);
+        let currentUrl = new URL(initial.url);
+        const initialLoopback = isLoopbackHostname(currentUrl.hostname);
+        let method = initial.method.toUpperCase();
+        let headers = new Headers(initial.headers);
+        let body = method === "GET" || method === "HEAD"
+            ? undefined
+            : new Uint8Array(await initial.clone().arrayBuffer());
+        const secretBearing = (method !== "GET" && method !== "HEAD") || headers.has("authorization");
+        for (let redirectCount = 0;; redirectCount++) {
+            validateOAuthRequestUrl(currentUrl);
+            const request = new Request(currentUrl, {
+                method,
+                headers,
+                body: body ? body.slice() : undefined,
+                redirect: "manual",
+                signal: initial.signal,
+            });
+            const response = await baseFetch(request);
+            if (!OAUTH_REDIRECT_STATUSES.has(response.status))
+                return response;
+            const location = response.headers.get("location");
+            if (!location)
+                return response;
+            if (redirectCount >= maxRedirects)
+                throw new Error("OAuth redirect limit exceeded");
+            const nextUrl = new URL(location, currentUrl);
+            validateOAuthRequestUrl(nextUrl);
+            if (!initialLoopback && isLoopbackHostname(nextUrl.hostname)) {
+                throw new Error("OAuth redirect to a local network target is not allowed");
+            }
+            if (secretBearing && nextUrl.origin !== currentUrl.origin) {
+                throw new Error("OAuth secret-bearing request refused a cross-origin redirect");
+            }
+            if (response.status === 303 ||
+                ((response.status === 301 || response.status === 302) && method === "POST")) {
+                method = "GET";
+                body = undefined;
+                headers = new Headers(headers);
+                headers.delete("content-type");
+                headers.delete("content-length");
+            }
+            currentUrl = nextUrl;
+        }
+    });
+}
+export function generatePKCE() {
     const verifier = randomBytes(32).toString("base64url");
     const challenge = createHash("sha256").update(verifier).digest("base64url");
     return { verifier, challenge };
 }
-/**
- * Open a URL in the system browser.
- */
-function openBrowser(url) {
-    // execFile with an argv array — no shell, so the URL can't be interpreted.
-    const { cmd, args } = browserOpenCommand(process.platform, url);
-    execFile(cmd, args, () => { });
+function tokensFromSecret(secret) {
+    return {
+        accessToken: secret.accessToken,
+        refreshToken: secret.refreshToken,
+        expiresAt: secret.expiresAt ? Date.parse(secret.expiresAt) : undefined,
+        tokenType: secret.tokenType ?? "Bearer",
+        scope: secret.scope,
+    };
+}
+function callbackSettings(config, options) {
+    const host = options.callbackHost ?? "127.0.0.1";
+    if (!config.redirectUri) {
+        return { host, port: options.callbackPort ?? 0, path: "/callback" };
+    }
+    const redirect = new URL(config.redirectUri);
+    if (redirect.protocol !== "http:" ||
+        (redirect.hostname !== "127.0.0.1" && redirect.hostname !== "localhost")) {
+        throw new Error("OAuth redirectUri must be an HTTP loopback URL");
+    }
+    const port = options.callbackPort ?? Number(redirect.port || "80");
+    return {
+        host,
+        port,
+        path: redirect.pathname || "/callback",
+        fixedRedirect: options.callbackPort === undefined ? redirect.toString() : undefined,
+    };
 }
 /**
- * Run the OAuth authorization code flow.
- * Opens a browser for user login and waits for the callback.
+ * Run an OAuth authorization-code flow. The host owns browser launching and
+ * injects `openExternal`; core only listens on an ephemeral loopback port.
  */
-export async function authorize(config) {
+export async function authorize(config, options = {}) {
+    if (options.signal?.aborted)
+        throw new Error("OAuth authorization aborted");
+    const callback = callbackSettings(config, options);
     const { verifier, challenge } = generatePKCE();
     const state = randomBytes(16).toString("hex");
-    const port = 18910 + Math.floor(Math.random() * 100);
-    const redirectUri = config.redirectUri ?? `http://localhost:${port}/callback`;
-    // Build authorization URL
-    const params = new URLSearchParams({
-        response_type: "code",
-        client_id: config.clientId,
-        redirect_uri: redirectUri,
-        state,
-        code_challenge: challenge,
-        code_challenge_method: "S256",
-    });
-    if (config.scopes?.length) {
-        params.set("scope", config.scopes.join(" "));
-    }
-    const authUrl = `${config.authorizationEndpoint}?${params.toString()}`;
+    const fetchFn = createHardenedOAuthFetch(options.fetch ?? fetch);
+    const openExternal = options.openExternal;
+    if (!openExternal)
+        throw new Error("OAuth authorize requires an openExternal host callback");
     return new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => {
-            server.close();
-            reject(new Error("OAuth authorization timed out (120s)"));
-        }, 120_000);
+        let settled = false;
+        let timer;
+        let redirectUri = "";
+        const cleanup = () => {
+            if (timer)
+                clearTimeout(timer);
+            options.signal?.removeEventListener("abort", onAbort);
+            if (server.listening)
+                server.close();
+        };
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(err instanceof Error ? err : new Error(String(err)));
+        };
+        const succeed = (tokens) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(tokens);
+        };
+        const onAbort = () => fail(new Error("OAuth authorization aborted"));
         const server = createServer(async (req, res) => {
-            if (!req.url?.startsWith("/callback")) {
+            const requestUrl = new URL(req.url ?? "/", redirectUri || "http://127.0.0.1");
+            if (requestUrl.pathname !== callback.path) {
                 res.writeHead(404);
                 res.end("Not found");
                 return;
             }
-            const url = new URL(req.url, `http://localhost:${port}`);
-            const code = url.searchParams.get("code");
-            const returnedState = url.searchParams.get("state");
-            const error = url.searchParams.get("error");
-            clearTimeout(timeout);
-            if (error) {
-                res.writeHead(200, { "Content-Type": "text/html" });
-                res.end("<html><body><h1>Authorization failed</h1><p>You can close this window.</p></body></html>");
-                server.close();
-                reject(new Error(`OAuth error: ${error}`));
+            const returnedState = requestUrl.searchParams.get("state");
+            const code = requestUrl.searchParams.get("code");
+            const oauthError = requestUrl.searchParams.get("error");
+            if (returnedState !== state) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<h1>Invalid OAuth callback</h1><p>You can close this window.</p>");
+                fail(new Error("Invalid OAuth callback: state mismatch"));
                 return;
             }
-            if (!code || returnedState !== state) {
-                res.writeHead(400, { "Content-Type": "text/html" });
-                res.end("<html><body><h1>Invalid callback</h1></body></html>");
-                server.close();
-                reject(new Error("Invalid OAuth callback: missing code or state mismatch"));
+            if (oauthError) {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<h1>Authorization was not completed</h1><p>You can close this window.</p>");
+                fail(new Error(oauthError === "access_denied" ? "OAuth access denied" : "OAuth failed"));
+                return;
+            }
+            if (!code) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<h1>Invalid OAuth callback</h1><p>You can close this window.</p>");
+                fail(new Error("Invalid OAuth callback: missing code"));
                 return;
             }
-            // Exchange code for tokens
             try {
                 const tokenParams = new URLSearchParams({
                     grant_type: "authorization_code",
@@ -84,68 +212,75 @@ export async function authorize(config) {
                     client_id: config.clientId,
                     code_verifier: verifier,
                 });
-                const tokenRes = await fetch(config.tokenEndpoint, {
+                if (config.clientSecret)
+                    tokenParams.set("client_secret", config.clientSecret);
+                if (config.resource)
+                    tokenParams.set("resource", config.resource);
+                const tokenRes = await fetchFn(config.tokenEndpoint, {
                     method: "POST",
                     headers: { "Content-Type": "application/x-www-form-urlencoded" },
                     body: tokenParams.toString(),
+                    signal: options.signal,
                 });
                 if (!tokenRes.ok) {
-                    throw new Error(`Token exchange failed: ${tokenRes.status} ${await tokenRes.text()}`);
+                    throw new Error(`OAuth token exchange failed (${tokenRes.status})`);
                 }
-                const data = (await tokenRes.json());
-                const tokens = {
-                    accessToken: data.access_token,
-                    refreshToken: data.refresh_token,
-                    expiresAt: data.expires_in
-                        ? Date.now() + data.expires_in * 1000
-                        : undefined,
-                    tokenType: data.token_type ?? "Bearer",
-                };
-                res.writeHead(200, { "Content-Type": "text/html" });
-                res.end("<html><body><h1>Authorization successful!</h1><p>You can close this window.</p></body></html>");
-                server.close();
-                resolve(tokens);
+                const secret = mergeOAuthTokenResponse(undefined, (await tokenRes.json()));
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<h1>Authorization successful</h1><p>You can close this window.</p>");
+                succeed(tokensFromSecret(secret));
             }
             catch (err) {
-                res.writeHead(500, { "Content-Type": "text/html" });
-                res.end("<html><body><h1>Token exchange failed</h1></body></html>");
-                server.close();
-                reject(err);
+                res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<h1>Token exchange failed</h1><p>You can close this window.</p>");
+                fail(err);
             }
         });
-        server.listen(port, () => {
-            openBrowser(authUrl);
-        });
-        server.on("error", (err) => {
-            clearTimeout(timeout);
-            reject(new Error(`OAuth server error: ${err.message}`));
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        server.once("error", (err) => fail(new Error(`OAuth callback server failed: ${err.message}`)));
+        server.listen(callback.port, callback.host, () => {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                fail(new Error("OAuth callback server did not expose a loopback port"));
+                return;
+            }
+            redirectUri =
+                callback.fixedRedirect ?? `http://${callback.host}:${address.port}${callback.path}`;
+            const authUrl = new URL(config.authorizationEndpoint);
+            authUrl.searchParams.set("response_type", "code");
+            authUrl.searchParams.set("client_id", config.clientId);
+            authUrl.searchParams.set("redirect_uri", redirectUri);
+            authUrl.searchParams.set("state", state);
+            authUrl.searchParams.set("code_challenge", challenge);
+            authUrl.searchParams.set("code_challenge_method", "S256");
+            if (config.scopes?.length)
+                authUrl.searchParams.set("scope", config.scopes.join(" "));
+            if (config.resource)
+                authUrl.searchParams.set("resource", config.resource);
+            timer = setTimeout(() => fail(new Error("OAuth authorization timed out")), options.timeoutMs ?? 120_000);
+            Promise.resolve(openExternal(authUrl.toString())).catch(fail);
         });
     });
 }
-/**
- * Refresh an access token using a refresh token.
- */
-export async function refreshToken(config, refreshTokenValue) {
+export async function refreshToken(config, refreshTokenValue, options = {}) {
     const params = new URLSearchParams({
         grant_type: "refresh_token",
         client_id: config.clientId,
         refresh_token: refreshTokenValue,
     });
-    const res = await fetch(config.tokenEndpoint, {
+    if (config.clientSecret)
+        params.set("client_secret", config.clientSecret);
+    if (config.scopes?.length)
+        params.set("scope", config.scopes.join(" "));
+    if (config.resource)
+        params.set("resource", config.resource);
+    const res = await createHardenedOAuthFetch(options.fetch ?? fetch)(config.tokenEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: params.toString(),
     });
-    if (!res.ok) {
-        throw new Error(`Token refresh failed: ${res.status}`);
-    }
-    const data = (await res.json());
-    return {
-        accessToken: data.access_token,
-        refreshToken: data.refresh_token ?? refreshTokenValue,
-        expiresAt: data.expires_in
-            ? Date.now() + data.expires_in * 1000
-            : undefined,
-        tokenType: data.token_type ?? "Bearer",
-    };
+    if (!res.ok)
+        throw new Error(`OAuth token refresh failed (${res.status})`);
+    const secret = mergeOAuthTokenResponse({ accessToken: "replaced", refreshToken: refreshTokenValue }, (await res.json()), { now: options.now });
+    return tokensFromSecret(secret);
 }