@factorialco/fcode-cli 1.4.0 → 2.0.0

package/README.md

@@ -20,7 +20,7 @@ $ npm install -g @factorialco/fcode-cli
 $ fcode COMMAND
 running command...
 $ fcode (--version)
-@factorialco/fcode-cli/1.4.0 linux-x64 node-v22.22.3
+@factorialco/fcode-cli/2.0.0 linux-x64 node-v22.22.3
 $ fcode --help [COMMAND]
 USAGE
   $ fcode COMMAND
@@ -828,7 +828,7 @@ EXAMPLES
 
 ## `fcode team:push`
 
-Update cloud team settings (timezone, error handler, inheritance) from team.json
+Update cloud team settings (timezone, error handler, inheritance, webhook auth) from team.json
 
 ```
 USAGE
@@ -838,7 +838,7 @@ FLAGS
   -f, --force  Force command
 
 DESCRIPTION
-  Update cloud team settings (timezone, error handler, inheritance) from team.json
+  Update cloud team settings (timezone, error handler, inheritance, webhook auth) from team.json
 
 EXAMPLES
   $ fcode team:push

package/dist/commands/http.d.ts

@@ -11,12 +11,14 @@ export default class Http extends Command {
     };
     run(): Promise<void>;
     /**
-     * Enforces the process's configured webhook basic auth, simulating the cloud
-     * webhook endpoint. The username/password come from processes/<slug>/metadata.json;
-     * an env-var placeholder (e.g. $WEBHOOK_PASSWORD) is resolved against the workspace
-     * variables. Returns true when the request may proceed, false after writing a 401.
+     * Enforces the webhook's configured auth, simulating the cloud webhook endpoint: the effective
+     * configuration names a variable, whose value is looked up in the workspace variables and compared
+     * against the configured header. A missing or malformed header, an undefined variable, a mismatch,
+     * or a webhook inheriting a workspace configuration that team.json does not have, is rejected.
+     * Returns true when the request may proceed, false after writing a 403.
      */
     private _checkWebhookAuth;
+    private _forbid;
     private _handleProcessExecution;
     private _sendResponse;
 }

package/dist/commands/http.js

@@ -7,6 +7,9 @@ const process_runner_1 = require("../services/process-runner");
 const process_1 = require("../repositories/process");
 const variable_1 = require("../repositories/variable");
 const workspace_1 = require("../config/workspace");
+const team_1 = require("../repositories/team");
+const webhook_auth_1 = require("../services/webhook-auth");
+const types_1 = require("../core/types");
 class Http extends core_1.Command {
     async run() {
         const { flags: { port, logLevel, 'auth-user': authUser, 'auth-password': authPassword, jsonLogs }, } = await this.parse(Http);
@@ -16,11 +19,17 @@ class Http extends core_1.Command {
             : null;
         const { slug: teamSlug } = await new workspace_1.default().getTeamOrigin();
         const processRepository = new process_1.default();
+        const teamRepository = new team_1.default();
+        if (useBasicAuth) {
+            this.warn(`--auth-user/--auth-password protect the whole server through the ${types_1.DEFAULT_WEBHOOK_AUTH_HEADER} header, ` +
+                `so a webhook expecting its credential there cannot be exercised at the same time.`);
+        }
         const handler = async (req, res) => {
             // CORS headers
             res.setHeader('Access-Control-Allow-Origin', '*');
             res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Fcode-Async');
+            // Reflected rather than fixed, so a webhook using a custom auth header passes the preflight.
+            res.setHeader('Access-Control-Allow-Headers', req.headers['access-control-request-headers'] ?? 'Content-Type, Authorization, Fcode-Async');
             if (req.method === 'OPTIONS') {
                 res.writeHead(204);
                 res.end();
@@ -77,7 +86,7 @@ class Http extends core_1.Command {
                     res.end(JSON.stringify({ success: false, error: `Process slug required in path (e.g. /api/${teamSlug}/webhooks/my-process)` }));
                     return;
                 }
-                if (!(await this._checkWebhookAuth(req, res, processRepository, slug))) {
+                if (!(await this._checkWebhookAuth(req, res, processRepository, teamRepository, slug))) {
                     return;
                 }
                 await this._handleProcessExecution(req, res, slug, urlObj, logLevel, jsonLogs);
@@ -110,12 +119,13 @@ class Http extends core_1.Command {
         await new Promise(() => { });
     }
     /**
-     * Enforces the process's configured webhook basic auth, simulating the cloud
-     * webhook endpoint. The username/password come from processes/<slug>/metadata.json;
-     * an env-var placeholder (e.g. $WEBHOOK_PASSWORD) is resolved against the workspace
-     * variables. Returns true when the request may proceed, false after writing a 401.
+     * Enforces the webhook's configured auth, simulating the cloud webhook endpoint: the effective
+     * configuration names a variable, whose value is looked up in the workspace variables and compared
+     * against the configured header. A missing or malformed header, an undefined variable, a mismatch,
+     * or a webhook inheriting a workspace configuration that team.json does not have, is rejected.
+     * Returns true when the request may proceed, false after writing a 403.
      */
-    async _checkWebhookAuth(req, res, processRepository, slug) {
+    async _checkWebhookAuth(req, res, processRepository, teamRepository, slug) {
         let webhook;
         try {
             webhook = (await processRepository.find(slug)).webhook;
@@ -124,28 +134,34 @@ class Http extends core_1.Command {
             // Unknown process: let the execution path report the 404.
             return true;
         }
-        if (!webhook || (!webhook.username && !webhook.password)) {
-            return true;
+        // Read per request, like the process metadata above, so editing team.json while the server
+        // runs takes effect without a restart.
+        const teamWebhookAuth = (await teamRepository.find()).webhookAuth;
+        let effectiveAuth;
+        try {
+            effectiveAuth = (0, webhook_auth_1.resolveEffectiveAuth)(webhook, teamWebhookAuth);
         }
-        const variables = await new variable_1.default().findAllForExecution();
-        const values = new Map(variables.map((variable) => [variable.key, variable.value]));
-        const resolvePlaceholder = (value) => {
-            if (!value)
-                return '';
-            const match = value.match(/^\$\{?([A-Za-z_]\w*)\}?$/);
-            return match ? values.get(match[1]) ?? value : value;
-        };
-        const expected = Buffer.from(`${resolvePlaceholder(webhook.username)}:${resolvePlaceholder(webhook.password)}`).toString('base64');
-        const authHeader = req.headers['authorization'] ?? '';
-        const match = authHeader.match(/^Basic (.+)$/);
-        if (!match || match[1] !== expected) {
-            res.setHeader('WWW-Authenticate', 'Basic realm="Factorial Code Webhook"');
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: false, error: 'Unauthorized' }));
+        catch (error) {
+            // Fails closed, and says why: otherwise this reads as a wrong token rather than a local
+            // configuration the developer still has to complete.
+            this.warn(`Rejecting the ${slug} webhook: ${error.message}`);
+            this._forbid(res);
+            return false;
+        }
+        const variables = effectiveAuth === null ? [] : await new variable_1.default().findAllForExecution();
+        const variableValue = variables.find((variable) => variable.key === effectiveAuth?.variableKey)?.value;
+        const result = (0, webhook_auth_1.checkWebhookAuth)(effectiveAuth, req.headers, variableValue);
+        if (!result.authorized) {
+            this.warn(`Rejecting the ${slug} webhook: ${result.reason}`);
+            this._forbid(res);
             return false;
         }
         return true;
     }
+    _forbid(res) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: false, error: 'Forbidden' }));
+    }
     async _handleProcessExecution(req, res, slug, urlObj, logLevel, jsonLogs) {
         if (req.method !== 'GET' && req.method !== 'POST') {
             res.writeHead(405, { 'Content-Type': 'application/json' });

package/dist/commands/team/push.js

@@ -30,12 +30,17 @@ class TeamPushCommand extends api_client_command_1.default {
             const processId = await this._teamRepository.resolveSlugToId(team.errorHandlerConfig.processSlug);
             update.executionErrorHandlerConfig = { processId, tag: team.errorHandlerConfig.tag ?? null };
         }
+        // Sent unconditionally, null arm included: team.json is the source of truth, so removing
+        // webhookAuth from it must clear the cloud configuration rather than leave it dangling.
+        update.webhookAuth = team.webhookAuth
+            ? { headerName: team.webhookAuth.headerName ?? null, variableKey: team.webhookAuth.variableKey }
+            : { variableKey: null };
         await this._fcodeGraphQLClient.pushTeam(update);
         await this.workspaceConfig.setTeamStoredHash(team.contentHash);
         cli_1.default.log(color_1.default.green('✅ team settings pushed'));
     }
 }
-TeamPushCommand.description = 'Update cloud team settings (timezone, error handler, inheritance) from team.json';
+TeamPushCommand.description = 'Update cloud team settings (timezone, error handler, inheritance, webhook auth) from team.json';
 TeamPushCommand.examples = ['$ fcode team:push'];
 TeamPushCommand.flags = types_1.ForceFlag;
 exports.default = TeamPushCommand;

package/dist/core/types.d.ts

@@ -10,6 +10,7 @@ export type Credentials = {
 export interface Token {
     access_token: string;
     refresh_token: string;
+    expires_at?: number;
 }
 export interface UserInfo {
     groups: string[];
@@ -98,18 +99,33 @@ export type MergedResource = MergedResourceRecord & {
 };
 export type ProgrammingLanguage = 'JAVASCRIPT' | 'PYTHON';
 export declare const programmingLanguageDisplayName: (programmingLanguage: ProgrammingLanguage) => string;
+export type WebhookAuthMode = 'NONE' | 'TEAM' | 'CUSTOM';
+export declare const DEFAULT_WEBHOOK_AUTH_HEADER = "Authorization";
+export interface WebhookAuth {
+    /**
+     * Header the caller must send the credential in. Omitted when it is the default
+     * `Authorization`, whose value must be `Bearer <token>`; any other header takes the raw value.
+     */
+    headerName?: string;
+    /**
+     * Key of the team variable holding the expected value. Only the name travels, never the
+     * value, and the variable does not need to exist yet.
+     */
+    variableKey: string;
+}
 export interface ProcessWebhook {
     enabled: boolean;
-    username?: string;
-    password?: string;
+    /** Omitted when the webhook is public, so an unprotected webhook stays minimal on disk. */
+    authMode?: WebhookAuthMode;
+    /** The webhook's own configuration, only meaningful with the CUSTOM mode. */
+    auth?: WebhookAuth;
 }
-export type AppRole = 'INSTALL' | 'SETTINGS' | 'USER_FACING_FORM' | 'NONE';
+export type AppRole = 'INSTALL' | 'SETTINGS' | 'USER_FACING_FORM' | 'UNINSTALL' | 'NONE';
+export type FormAuthMode = 'NONE' | 'FACTORIAL';
 export interface ProcessForm {
     enabled: boolean;
     appRole?: AppRole;
-}
-export interface ProcessVisibility {
-    isPublic: boolean;
+    authMode?: FormAuthMode;
 }
 export interface ProcessMetadataFields {
     name: string;
@@ -117,7 +133,6 @@ export interface ProcessMetadataFields {
     tags: string[];
     webhook?: ProcessWebhook;
     form?: ProcessForm;
-    visibility?: ProcessVisibility;
 }
 export declare class Process extends Resource {
     id: string;
@@ -128,7 +143,6 @@ export declare class Process extends Resource {
     tags: string[];
     webhook?: ProcessWebhook;
     form?: ProcessForm;
-    visibility?: ProcessVisibility;
     script: {
         parametersSchema: any;
         programmingLanguage: ProgrammingLanguage;
@@ -213,7 +227,8 @@ export declare class Team extends Resource {
     zoneId?: string;
     errorHandlerConfig?: ErrorHandlerConfig;
     parentTeamSlugs: string[];
-    constructor(slug: string, parentTeamSlugs: string[], zoneId?: string, errorHandlerConfig?: ErrorHandlerConfig);
+    webhookAuth?: WebhookAuth;
+    constructor(slug: string, parentTeamSlugs: string[], zoneId?: string, errorHandlerConfig?: ErrorHandlerConfig, webhookAuth?: WebhookAuth);
     get contentHash(): string;
 }
 export interface RawErrorHandlerConfig {
@@ -225,11 +240,16 @@ export interface RawTeamSettings {
     zoneId?: string;
     errorHandlerConfig?: RawErrorHandlerConfig | null;
     parentTeamSlugs: string[];
+    webhookAuth?: WebhookAuth | null;
 }
 export interface TeamUpdateInput {
     zoneId?: string;
     parentTeamSlugs?: string[];
     executionErrorHandlerConfig?: RawErrorHandlerConfig | null;
+    webhookAuth?: {
+        headerName?: string | null;
+        variableKey?: string | null;
+    } | null;
 }
 export type ResourceMetadata = {
     [key: string]: any;

package/dist/core/types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAccount = exports.Dependency = exports.DependenciesFlags = exports.TeamNameArg = exports.ResourceSlugArg = exports.ForceFlag = exports.ScriptLibraryNotFound = exports.ProcessNotFound = exports.Team = exports.ProgrammingLanguageManifest = exports.Variable = exports.VersionedScriptLibrary = exports.ScriptLibrary = exports.VersionedProcess = exports.Process = exports.programmingLanguageDisplayName = exports.ResourceStatus = exports.OnConflictResolution = exports.Resource = void 0;
+exports.ServiceAccount = exports.Dependency = exports.DependenciesFlags = exports.TeamNameArg = exports.ResourceSlugArg = exports.ForceFlag = exports.ScriptLibraryNotFound = exports.ProcessNotFound = exports.Team = exports.ProgrammingLanguageManifest = exports.Variable = exports.VersionedScriptLibrary = exports.ScriptLibrary = exports.VersionedProcess = exports.Process = exports.DEFAULT_WEBHOOK_AUTH_HEADER = exports.programmingLanguageDisplayName = exports.ResourceStatus = exports.OnConflictResolution = exports.Resource = void 0;
 const core_1 = require("@oclif/core");
 const crypto = require("node:crypto");
 const canonical_hash_1 = require("../utils/canonical-hash");
@@ -37,6 +37,8 @@ const programmingLanguageDisplayName = (programmingLanguage) => {
     }
 };
 exports.programmingLanguageDisplayName = programmingLanguageDisplayName;
+// The header assumed when none is configured; its value carries a Bearer scheme.
+exports.DEFAULT_WEBHOOK_AUTH_HEADER = 'Authorization';
 class Process extends Resource {
     constructor(id, slug, script, readme, manifest, settings, metadata, resolvingTeamSlug) {
         super();
@@ -47,7 +49,6 @@ class Process extends Resource {
         this.tags = metadata.tags;
         this.webhook = metadata.webhook;
         this.form = metadata.form;
-        this.visibility = metadata.visibility;
         this.script = script;
         this.readme = readme;
         this.manifest = settings.dependencies.scopedToProcess && manifest !== null ? manifest : { dependencies: [] };
@@ -64,7 +65,6 @@ class Process extends Resource {
             tags: this.tags || [],
             webhook: this.webhook || null,
             form: this.form || null,
-            visibility: this.visibility || null,
             manifestDependencies: this.manifest.dependencies,
             dependenciesScopedToProcess: this.settings.dependencies.scopedToProcess,
         });
@@ -165,19 +165,27 @@ class ProgrammingLanguageManifest extends Resource {
 }
 exports.ProgrammingLanguageManifest = ProgrammingLanguageManifest;
 class Team extends Resource {
-    constructor(slug, parentTeamSlugs, zoneId, errorHandlerConfig) {
+    constructor(slug, parentTeamSlugs, zoneId, errorHandlerConfig, webhookAuth) {
         super();
         this.slug = slug;
         this.parentTeamSlugs = parentTeamSlugs;
         this.zoneId = zoneId;
         this.errorHandlerConfig = errorHandlerConfig;
+        this.webhookAuth = webhookAuth;
     }
     get contentHash() {
-        return (0, canonical_hash_1.canonicalJsonHash)({
+        const payload = {
             zoneId: this.zoneId || null,
             errorHandlerConfig: this.errorHandlerConfig || null,
             parentTeamSlugs: [...(this.parentTeamSlugs || [])].sort(),
-        });
+        };
+        // Inserted only when set, so every team.json that predates webhook auth keeps the
+        // hash already stored in .fcode and does not report a phantom conflict. A key present
+        // with an undefined value would not do: canonicalStringify writes that as null.
+        if (this.webhookAuth) {
+            payload.webhookAuth = this.webhookAuth;
+        }
+        return (0, canonical_hash_1.canonicalJsonHash)(payload);
     }
 }
 exports.Team = Team;

package/dist/repositories/process.js

@@ -136,7 +136,6 @@ class ProcessRepository extends resource_1.default {
                 tags: Array.isArray(raw.tags) ? raw.tags : [],
                 webhook: raw.webhook,
                 form: raw.form,
-                visibility: raw.visibility,
             };
         }
         catch (error) {
@@ -157,9 +156,6 @@ class ProcessRepository extends resource_1.default {
         if (process.form !== undefined) {
             metadata.form = process.form;
         }
-        if (process.visibility !== undefined) {
-            metadata.visibility = process.visibility;
-        }
         return metadata;
     }
     async findParameters(processSlug) {

package/dist/repositories/team.d.ts

@@ -1,7 +1,7 @@
 import { RawTeamSettings, Team } from '../core/types';
 import WorkspaceConfig from '../config/workspace';
 /**
- * Reads/writes the singleton team.json (timezone, error handler, inheritance) at the
+ * Reads/writes the singleton team.json (timezone, error handler, inheritance, webhook auth) at the
  * workspace root. Unlike collection resources this is not a ResourceRepositoryBase:
  * there is exactly one team, so there is no slug-keyed collection to manage.
  *
@@ -19,5 +19,7 @@ export default class TeamRepository {
     resolveSlugToId(processSlug: string): Promise<string>;
     resolveIdToSlug(processId: string): Promise<string>;
     private parseErrorHandler;
+    /** A configuration without a variable key is meaningless, so it is read as absent. */
+    private parseWebhookAuth;
     private toFile;
 }

package/dist/repositories/team.js

@@ -6,7 +6,7 @@ const workspace_1 = require("../config/workspace");
 const file_utils_1 = require("../utils/file-utils");
 const TEAM_FILENAME = 'team.json';
 /**
- * Reads/writes the singleton team.json (timezone, error handler, inheritance) at the
+ * Reads/writes the singleton team.json (timezone, error handler, inheritance, webhook auth) at the
  * workspace root. Unlike collection resources this is not a ResourceRepositoryBase:
  * there is exactly one team, so there is no slug-keyed collection to manage.
  *
@@ -29,7 +29,7 @@ class TeamRepository {
         }
         catch { }
         const parentTeamSlugs = Array.isArray(raw.parentTeamSlugs) ? raw.parentTeamSlugs : [];
-        return new types_1.Team(slug, parentTeamSlugs, raw.zoneId, this.parseErrorHandler(raw.errorHandlerConfig));
+        return new types_1.Team(slug, parentTeamSlugs, raw.zoneId, this.parseErrorHandler(raw.errorHandlerConfig), this.parseWebhookAuth(raw.webhookAuth));
     }
     save(team) {
         (0, file_utils_1.outputFileSyncIfChanged)(TEAM_FILENAME, JSON.stringify(this.toFile(team), null, 2));
@@ -43,7 +43,7 @@ class TeamRepository {
                 tag: raw.errorHandlerConfig.tag ?? null,
             };
         }
-        return new types_1.Team(raw.slug, raw.parentTeamSlugs ?? [], raw.zoneId, errorHandlerConfig);
+        return new types_1.Team(raw.slug, raw.parentTeamSlugs ?? [], raw.zoneId, errorHandlerConfig, this.parseWebhookAuth(raw.webhookAuth));
     }
     async resolveSlugToId(processSlug) {
         const { processes } = await this.workspaceConfig.getActiveTeam();
@@ -60,6 +60,18 @@ class TeamRepository {
         }
         return { processSlug: raw.processSlug, tag: raw.tag ?? null };
     }
+    /** A configuration without a variable key is meaningless, so it is read as absent. */
+    parseWebhookAuth(raw) {
+        if (!raw || typeof raw.variableKey !== 'string' || raw.variableKey.length === 0) {
+            return undefined;
+        }
+        const webhookAuth = { variableKey: raw.variableKey };
+        // The default header is left out so a pull writes the minimal form.
+        if (typeof raw.headerName === 'string' && raw.headerName.length > 0 && raw.headerName !== types_1.DEFAULT_WEBHOOK_AUTH_HEADER) {
+            webhookAuth.headerName = raw.headerName;
+        }
+        return webhookAuth;
+    }
     toFile(team) {
         const file = { parentTeamSlugs: team.parentTeamSlugs ?? [] };
         if (team.zoneId !== undefined) {
@@ -68,6 +80,10 @@ class TeamRepository {
         if (team.errorHandlerConfig !== undefined) {
             file.errorHandlerConfig = team.errorHandlerConfig;
         }
+        // Last, so adding webhook auth to an existing team.json is a purely additive diff.
+        if (team.webhookAuth !== undefined) {
+            file.webhookAuth = team.webhookAuth;
+        }
         return file;
     }
 }

package/dist/services/auth-service.d.ts

@@ -6,6 +6,9 @@ declare const AuthService: {
     getUserInfo(authUrl: string, token: Token): Promise<UserInfo>;
     globalConfig: GlobalConfig;
     isAuthenticated(url: string): Promise<boolean>;
+    isTokenExpiring(token: Token): boolean;
+    refreshToken(authUrl: string, refreshToken: string): Promise<Token>;
+    tryRefresh(url: string, { authUrl, token, userInfo }: AuthInfo): Promise<boolean>;
     login({ url, authUrl, email, password, clientId, clientSecret, accessToken }: Credentials): Promise<AuthInfo>;
     logout(url: string): Promise<void>;
 };

package/dist/services/auth-service.js

@@ -7,6 +7,15 @@ const global_1 = require("../config/global");
 const color_1 = require("@oclif/color");
 const AUTH_URL_PATH = '/protocol/openid-connect';
 const AUTH_CLIENT_ID = 'cli';
+// Refresh this long before the access token actually expires, so a token
+// snapshotted at command init doesn't die mid-command.
+const TOKEN_EXPIRY_MARGIN_SECONDS = 300;
+function withExpiresAt(token) {
+    if (typeof token.expires_in === 'number') {
+        return { ...token, expires_at: Math.floor(Date.now() / 1000) + token.expires_in };
+    }
+    return token;
+}
 const AuthService = {
     clientId: process.env.FCODE_CLIENT_ID || AUTH_CLIENT_ID,
     async getToken({ authUrl, email, password, clientId, clientSecret }) {
@@ -44,7 +53,7 @@ const AuthService = {
         });
         const token = await response.json();
         if (response.ok) {
-            return token;
+            return withExpiresAt(token);
         }
         throw token.error_description;
     },
@@ -64,14 +73,21 @@ const AuthService = {
     globalConfig: new global_1.default(),
     async isAuthenticated(url) {
         try {
-            const { authUrl, token } = await this.globalConfig.getAuthInfo(url);
+            const authInfo = await this.globalConfig.getAuthInfo(url);
+            const { authUrl, token } = authInfo;
             try {
+                if (this.isTokenExpiring(token)) {
+                    throw new Error('Access token expired or about to expire');
+                }
                 await this.getUserInfo(authUrl, token);
             }
             catch (error) {
-                await this.globalConfig.clearAuthInfo(url);
-                cli_1.default.log(color_1.default.yellow('🚪  Session expired, please login again'));
-                throw error;
+                const refreshed = await this.tryRefresh(url, authInfo);
+                if (!refreshed) {
+                    await this.globalConfig.clearAuthInfo(url);
+                    cli_1.default.log(color_1.default.yellow('🚪  Session expired, please login again'));
+                    throw error;
+                }
             }
             return true;
         }
@@ -79,6 +95,41 @@ const AuthService = {
             return false;
         }
     },
+    isTokenExpiring(token) {
+        return token.expires_at !== undefined && Date.now() / 1000 >= token.expires_at - TOKEN_EXPIRY_MARGIN_SECONDS;
+    },
+    async refreshToken(authUrl, refreshToken) {
+        const body = new URLSearchParams({
+            client_id: this.clientId,
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        });
+        const response = await (0, node_fetch_1.default)(`${authUrl}${AUTH_URL_PATH}/token`, {
+            body: body.toString(),
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            method: 'POST',
+        });
+        const token = await response.json();
+        if (response.ok) {
+            return withExpiresAt(token);
+        }
+        throw token.error_description;
+    },
+    async tryRefresh(url, { authUrl, token, userInfo }) {
+        if (!token.refresh_token) {
+            return false;
+        }
+        try {
+            const refreshedToken = await this.refreshToken(authUrl, token.refresh_token);
+            await this.globalConfig.setAuthInfo(url, { authUrl, token: refreshedToken, userInfo });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
     async login({ url, authUrl, email, password, clientId, clientSecret, accessToken }) {
         const token = accessToken
             ? { access_token: accessToken, refresh_token: '' }

package/dist/services/fcode-graphql-client.d.ts

@@ -32,8 +32,18 @@ declare class FcodeGraphQLClient {
     removeVariable(id: String | undefined): Promise<Process>;
     programmingLanguageManifest(programmingLanguage: ProgrammingLanguage): Promise<ProgrammingLanguageManifest>;
     private inheritedTeam;
+    /**
+     * The public mode and the default header name are left out, so a public webhook — or one
+     * using the default header — keeps the metadata.json it already had on disk.
+     */
     private mapWebhook;
     mapProcess({ id, slug, name, description, tags, script, readme, manifest, settings, triggers, resolvingTeamSlug }: any): Process;
+    /**
+     * GraphQL nests the webhook configuration under `settings`, while team.json and the REST API
+     * keep it flat. Mapping it explicitly is what keeps that mismatch from silently reading as
+     * undefined.
+     */
+    mapTeamSettings(team: any): RawTeamSettings;
     team(): Promise<RawTeamSettings>;
     pushTeam(update: TeamUpdateInput): Promise<RawTeamSettings>;
     mapProgrammingLanguageManifest(programmingLanguageManifest: any): ProgrammingLanguageManifest;