@kubun/credential 0.15.0 → 0.17.0

package/lib/refreshing-credential-provider.d.ts

@@ -1,4 +1,5 @@
-import type { Credential, CredentialProvider, OAuthProviderDefinition } from '@kubun/credential-types';
+import type { OAuthProviderDefinition } from '@kokuin/oauth';
+import type { Credential, CredentialProvider } from '@kubun/credential-types';
 import type { Logger } from '@kubun/logger';
 import { EventEmitter } from '@sozai/event';
 import type { Runtime } from '@sozai/runtime';

package/lib/refreshing-credential-provider.js

@@ -1,3 +1,4 @@
+import { OAuthTokenError, refreshToken as requestRefreshedToken } from '@kokuin/oauth';
 import { normalizeDID } from '@kokuin/token';
 import { EventEmitter } from '@sozai/event';
 const DEFAULT_BUFFER_SECONDS = 300;
@@ -103,42 +104,26 @@ export class RefreshingCredentialProvider {
     // outcome and does not emit or fall back itself.
     async #exchange(providerName, ownerDID, credential, refreshToken) {
         const provider = this.#providers.find((p)=>p.name === providerName);
-        if (provider == null || provider.clientID == null || provider.clientSecret == null) {
+        if (provider == null) {
             return {
                 ok: false,
                 category: 'configuration'
             };
         }
-        let response;
-        try {
-            response = await this.#runtime.fetch(provider.tokenEndpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                },
-                body: new URLSearchParams({
-                    grant_type: 'refresh_token',
-                    refresh_token: refreshToken,
-                    client_id: provider.clientID,
-                    client_secret: provider.clientSecret
-                })
-            });
-        } catch  {
-            return {
-                ok: false,
-                category: 'transient'
-            };
-        }
-        if (!response.ok) {
-            return {
-                ok: false,
-                category: await this.#classifyErrorResponse(response)
-            };
-        }
         let tokenData;
         try {
-            tokenData = await response.json();
-        } catch  {
+            tokenData = await requestRefreshedToken({
+                definition: provider,
+                runtime: this.#runtime,
+                refreshToken
+            });
+        } catch (err) {
+            if (err instanceof OAuthTokenError) {
+                return {
+                    ok: false,
+                    category: err.code === 'invalid_grant' ? 'invalid_grant' : 'transient'
+                };
+            }
             return {
                 ok: false,
                 category: 'transient'
@@ -159,9 +144,15 @@ export class RefreshingCredentialProvider {
                 credential: refreshed
             });
         } catch  {
+            // A rotated refresh token (the endpoint issued a new one) means the prior
+            // token may already be invalidated server-side, so a lost write here
+            // cannot fall back to the stale credential — that would silently retry a
+            // refresh token the provider has already discarded. Surface it as the
+            // terminal re-auth category instead.
+            const rotated = tokenData.refresh_token != null && tokenData.refresh_token !== refreshToken;
             return {
                 ok: false,
-                category: 'persistence'
+                category: rotated ? 'invalid_grant' : 'persistence'
             };
         }
         return {
@@ -169,17 +160,4 @@ export class RefreshingCredentialProvider {
             credential: refreshed
         };
     }
-    // Distinguishes a confirmed OAuth invalidation from a generic non-OK status.
-    // The standard OAuth2 error response is `{ "error": "invalid_grant", ... }` in
-    // the JSON body of a 400; anything else — including an empty or non-JSON body —
-    // is treated as transient so a stale-but-valid token is never abandoned.
-    async #classifyErrorResponse(response) {
-        try {
-            const body = await response.json();
-            if (body?.error === 'invalid_grant') return 'invalid_grant';
-        } catch  {
-        // Empty or non-JSON error body: cannot confirm invalidation.
-        }
-        return 'transient';
-    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/credential",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -16,13 +16,14 @@
   ],
   "dependencies": {
     "@kokuin/jwe": "^0.1.0",
+    "@kokuin/oauth": "^0.1.0",
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential-types": "^0.15.0",
-    "@kubun/db": "^0.15.0",
-    "@kubun/hlc": "^0.15.0",
-    "@kubun/id": "^0.15.0",
-    "@kubun/logger": "^0.15.0",
-    "@kubun/store-credential": "^0.15.0",
+    "@kubun/credential-types": "^0.17.0",
+    "@kubun/db": "^0.17.0",
+    "@kubun/hlc": "^0.17.0",
+    "@kubun/id": "^0.17.0",
+    "@kubun/logger": "^0.17.0",
+    "@kubun/store-credential": "^0.17.0",
     "@noble/ciphers": "^2.4.0",
     "@noble/hashes": "^2.4.0",
     "@sozai/codec": "^0.4.0",
@@ -30,7 +31,7 @@
     "@sozai/runtime": "^0.1.0"
   },
   "devDependencies": {
-    "@kubun/db-better-sqlite": "^0.15.0"
+    "@kubun/db-better-sqlite": "^0.17.0"
   },
   "publishConfig": {
     "access": "public"
@@ -38,8 +39,8 @@
   "scripts": {
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
-    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build:js": "del 'lib/**/*.js' && swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "del 'lib/**/*.d.ts' 'lib/**/*.d.ts.map' && tsc --emitDeclarationOnly --skipLibCheck",
     "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
     "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit -p tsconfig.test.json",