@openbkn/bkn-sdk 0.1.1-alpha.7 → 0.1.1-alpha.8

package/dist/{chunk-GAYXY7LP.js → chunk-DTU5DGJW.js}

@@ -4,11 +4,6 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/types.ts
-var DEFAULT_BUSINESS_DOMAIN = "bd_public";
-var DEFAULT_LIST_LIMIT = 30;
-var DEFAULT_QUERY_LIMIT = 50;
-
 // src/utils/errors.ts
 var HttpError = class extends Error {
   status;
@@ -77,189 +72,6 @@ function truncate(s, n) {
   return s.length > n ? `${s.slice(0, n)}\u2026` : s;
 }
 
-// src/config/store.ts
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  writeFileSync
-} from "fs";
-import { homedir } from "os";
-import { join } from "path";
-
-// src/auth/jwt.ts
-function decodeJwt(token) {
-  const parts = token.split(".");
-  if (parts.length < 2 || !parts[1]) return void 0;
-  try {
-    const json = Buffer.from(parts[1], "base64url").toString("utf8");
-    return JSON.parse(json);
-  } catch {
-    return void 0;
-  }
-}
-function isExpired(claims, nowMs = Date.now()) {
-  return claims?.exp !== void 0 && claims.exp * 1e3 < nowMs;
-}
-
-// src/config/store.ts
-var PROFILE_RE = /^[A-Za-z0-9_-]{1,64}$/;
-var IS_WIN = process.platform === "win32";
-function configDir() {
-  return process.env.BKN_CONFIG_DIR ?? join(homedir(), ".bkn");
-}
-function profileName() {
-  const raw = process.env.BKN_PROFILE?.trim();
-  if (!raw) return null;
-  if (!PROFILE_RE.test(raw)) {
-    throw new Error(`BKN_PROFILE='${raw}' is invalid. Use 1-64 chars from [A-Za-z0-9_-].`);
-  }
-  return raw;
-}
-function statePath() {
-  const profile = profileName();
-  return profile ? join(configDir(), "profiles", profile, "state.json") : join(configDir(), "state.json");
-}
-function encodeKey(baseUrl) {
-  return Buffer.from(baseUrl, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function platformDir(baseUrl) {
-  return join(configDir(), "platforms", encodeKey(baseUrl));
-}
-function userDir(baseUrl, userId) {
-  return join(platformDir(baseUrl), "users", userId);
-}
-function userIdFromToken(token) {
-  return decodeJwt(token.idToken ?? "")?.sub ?? decodeJwt(token.accessToken)?.sub ?? "default";
-}
-function readState() {
-  return readJson(statePath()) ?? {};
-}
-function writeState(state) {
-  writeJson(statePath(), state);
-}
-function activePlatform() {
-  return readState().currentPlatform;
-}
-function setActivePlatform(baseUrl) {
-  writeState({ ...readState(), currentPlatform: baseUrl });
-}
-function activeUserId(baseUrl) {
-  return readState().activeUsers?.[baseUrl];
-}
-function setActiveUser(baseUrl, userId) {
-  const state = readState();
-  writeState({ ...state, activeUsers: { ...state.activeUsers, [baseUrl]: userId } });
-}
-function readToken(baseUrl, userId = activeUserId(baseUrl)) {
-  if (!userId) return void 0;
-  return readJson(join(userDir(baseUrl, userId), "token.json")) ?? void 0;
-}
-function writeToken(baseUrl, token) {
-  const userId = userIdFromToken(token);
-  writeJson(join(userDir(baseUrl, userId), "token.json"), token, 384);
-  setActiveUser(baseUrl, userId);
-  return userId;
-}
-function deleteToken(baseUrl, userId = activeUserId(baseUrl)) {
-  if (!userId) return false;
-  const path = join(userDir(baseUrl, userId), "token.json");
-  if (!existsSync(path)) return false;
-  rmSync(path, { force: true });
-  return true;
-}
-function readPlatformConfig(baseUrl, userId = activeUserId(baseUrl)) {
-  if (!userId) return {};
-  return readJson(join(userDir(baseUrl, userId), "config.json")) ?? {};
-}
-function writePlatformConfig(baseUrl, config) {
-  const userId = activeUserId(baseUrl) ?? "default";
-  writeJson(join(userDir(baseUrl, userId), "config.json"), config);
-}
-function listPlatforms() {
-  const root = join(configDir(), "platforms");
-  if (!existsSync(root)) return [];
-  const state = readState();
-  const out = [];
-  for (const key of readdirSync(root)) {
-    const baseUrl = decodeKey(key);
-    if (!baseUrl) continue;
-    const usersRoot = join(root, key, "users");
-    if (!existsSync(usersRoot)) continue;
-    const users = [];
-    for (const userId of readdirSync(usersRoot)) {
-      const token = readJson(join(usersRoot, userId, "token.json"));
-      if (token) users.push({ userId, username: token.username, displayName: token.displayName });
-    }
-    if (users.length > 0) {
-      out.push({ baseUrl, users, activeUserId: state.activeUsers?.[baseUrl] });
-    }
-  }
-  return out;
-}
-function decodeKey(key) {
-  try {
-    const b64 = key.replace(/-/g, "+").replace(/_/g, "/");
-    return Buffer.from(b64, "base64").toString("utf8");
-  } catch {
-    return null;
-  }
-}
-function readJson(path) {
-  if (!existsSync(path)) return void 0;
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-function writeJson(path, value, mode = 384) {
-  const dir = path.slice(0, path.lastIndexOf("/")) || ".";
-  mkdirSync(dir, { recursive: true, ...IS_WIN ? {} : { mode: 448 } });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, IS_WIN ? {} : { mode });
-  if (!IS_WIN) chmodSync(path, mode);
-}
-
-// src/config/resolve.ts
-function resolveContext(opts = {}) {
-  const baseUrl = opts.baseUrl ?? process.env.BKN_BASE_URL ?? activePlatform();
-  if (!baseUrl) {
-    throw new InputError(
-      "No base URL. Pass --base-url, set BKN_BASE_URL, or run `openbkn auth login`."
-    );
-  }
-  const normalized = baseUrl.replace(/\/+$/, "");
-  const stored = readToken(normalized);
-  const explicit = opts.token ?? process.env.BKN_TOKEN;
-  const token = explicit ?? stored?.accessToken ?? "";
-  if (!token && !stored?.noAuth) {
-    throw new InputError("No access token. Set BKN_TOKEN or run `openbkn auth login`.");
-  }
-  const insecure = opts.insecure ?? stored?.tlsInsecure ?? false;
-  const refresh = !explicit && stored?.refreshToken ? {
-    refreshToken: stored.refreshToken,
-    persist: (t) => {
-      writeToken(normalized, {
-        ...stored,
-        accessToken: t.accessToken,
-        refreshToken: t.refreshToken ?? stored.refreshToken,
-        idToken: t.idToken ?? stored.idToken
-      });
-    }
-  } : void 0;
-  return {
-    baseUrl: normalized,
-    token,
-    businessDomain: opts.businessDomain ?? readPlatformConfig(normalized).businessDomain ?? DEFAULT_BUSINESS_DOMAIN,
-    insecure,
-    ...refresh ? { refresh } : {}
-  };
-}
-
 // src/auth/oauth.ts
 import { spawn } from "child_process";
 function normalizeBaseUrl(value) {
@@ -520,6 +332,194 @@ async function tryRefresh(ctx) {
   }
 }
 
+// src/types.ts
+var DEFAULT_BUSINESS_DOMAIN = "bd_public";
+var DEFAULT_LIST_LIMIT = 30;
+var DEFAULT_QUERY_LIMIT = 50;
+
+// src/config/store.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+// src/auth/jwt.ts
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length < 2 || !parts[1]) return void 0;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return void 0;
+  }
+}
+function isExpired(claims, nowMs = Date.now()) {
+  return claims?.exp !== void 0 && claims.exp * 1e3 < nowMs;
+}
+
+// src/config/store.ts
+var PROFILE_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var IS_WIN = process.platform === "win32";
+function configDir() {
+  return process.env.BKN_CONFIG_DIR ?? join(homedir(), ".bkn");
+}
+function profileName() {
+  const raw = process.env.BKN_PROFILE?.trim();
+  if (!raw) return null;
+  if (!PROFILE_RE.test(raw)) {
+    throw new Error(`BKN_PROFILE='${raw}' is invalid. Use 1-64 chars from [A-Za-z0-9_-].`);
+  }
+  return raw;
+}
+function statePath() {
+  const profile = profileName();
+  return profile ? join(configDir(), "profiles", profile, "state.json") : join(configDir(), "state.json");
+}
+function encodeKey(baseUrl) {
+  return Buffer.from(baseUrl, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function platformDir(baseUrl) {
+  return join(configDir(), "platforms", encodeKey(baseUrl));
+}
+function userDir(baseUrl, userId) {
+  return join(platformDir(baseUrl), "users", userId);
+}
+function userIdFromToken(token) {
+  return decodeJwt(token.idToken ?? "")?.sub ?? decodeJwt(token.accessToken)?.sub ?? "default";
+}
+function readState() {
+  return readJson(statePath()) ?? {};
+}
+function writeState(state) {
+  writeJson(statePath(), state);
+}
+function activePlatform() {
+  return readState().currentPlatform;
+}
+function setActivePlatform(baseUrl) {
+  writeState({ ...readState(), currentPlatform: baseUrl });
+}
+function activeUserId(baseUrl) {
+  return readState().activeUsers?.[baseUrl];
+}
+function setActiveUser(baseUrl, userId) {
+  const state = readState();
+  writeState({ ...state, activeUsers: { ...state.activeUsers, [baseUrl]: userId } });
+}
+function readToken(baseUrl, userId = activeUserId(baseUrl)) {
+  if (!userId) return void 0;
+  return readJson(join(userDir(baseUrl, userId), "token.json")) ?? void 0;
+}
+function writeToken(baseUrl, token) {
+  const userId = userIdFromToken(token);
+  writeJson(join(userDir(baseUrl, userId), "token.json"), token, 384);
+  setActiveUser(baseUrl, userId);
+  return userId;
+}
+function deleteToken(baseUrl, userId = activeUserId(baseUrl)) {
+  if (!userId) return false;
+  const path = join(userDir(baseUrl, userId), "token.json");
+  if (!existsSync(path)) return false;
+  rmSync(path, { force: true });
+  return true;
+}
+function readPlatformConfig(baseUrl, userId = activeUserId(baseUrl)) {
+  if (!userId) return {};
+  return readJson(join(userDir(baseUrl, userId), "config.json")) ?? {};
+}
+function writePlatformConfig(baseUrl, config) {
+  const userId = activeUserId(baseUrl) ?? "default";
+  writeJson(join(userDir(baseUrl, userId), "config.json"), config);
+}
+function listPlatforms() {
+  const root = join(configDir(), "platforms");
+  if (!existsSync(root)) return [];
+  const state = readState();
+  const out = [];
+  for (const key of readdirSync(root)) {
+    const baseUrl = decodeKey(key);
+    if (!baseUrl) continue;
+    const usersRoot = join(root, key, "users");
+    if (!existsSync(usersRoot)) continue;
+    const users = [];
+    for (const userId of readdirSync(usersRoot)) {
+      const token = readJson(join(usersRoot, userId, "token.json"));
+      if (token) users.push({ userId, username: token.username, displayName: token.displayName });
+    }
+    if (users.length > 0) {
+      out.push({ baseUrl, users, activeUserId: state.activeUsers?.[baseUrl] });
+    }
+  }
+  return out;
+}
+function decodeKey(key) {
+  try {
+    const b64 = key.replace(/-/g, "+").replace(/_/g, "/");
+    return Buffer.from(b64, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function readJson(path) {
+  if (!existsSync(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeJson(path, value, mode = 384) {
+  const dir = path.slice(0, path.lastIndexOf("/")) || ".";
+  mkdirSync(dir, { recursive: true, ...IS_WIN ? {} : { mode: 448 } });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, IS_WIN ? {} : { mode });
+  if (!IS_WIN) chmodSync(path, mode);
+}
+
+// src/config/resolve.ts
+function resolveContext(opts = {}) {
+  const baseUrl = opts.baseUrl ?? process.env.BKN_BASE_URL ?? activePlatform();
+  if (!baseUrl) {
+    throw new InputError(
+      "No base URL. Pass --base-url, set BKN_BASE_URL, or run `openbkn auth login`."
+    );
+  }
+  const normalized = baseUrl.replace(/\/+$/, "");
+  const stored = readToken(normalized);
+  const explicit = opts.token ?? process.env.BKN_TOKEN;
+  const token = explicit ?? stored?.accessToken ?? "";
+  if (!token && !stored?.noAuth) {
+    throw new InputError("No access token. Set BKN_TOKEN or run `openbkn auth login`.");
+  }
+  const insecure = opts.insecure ?? stored?.tlsInsecure ?? false;
+  const refresh = !explicit && stored?.refreshToken ? {
+    refreshToken: stored.refreshToken,
+    persist: (t) => {
+      writeToken(normalized, {
+        ...stored,
+        accessToken: t.accessToken,
+        refreshToken: t.refreshToken ?? stored.refreshToken,
+        idToken: t.idToken ?? stored.idToken
+      });
+    }
+  } : void 0;
+  return {
+    baseUrl: normalized,
+    token,
+    businessDomain: opts.businessDomain ?? readPlatformConfig(normalized).businessDomain ?? DEFAULT_BUSINESS_DOMAIN,
+    insecure,
+    ...refresh ? { refresh } : {}
+  };
+}
+
 // src/api/safe.ts
 var ADMIN = "/api/safe/v1/admin";
 function notOnSafe(operation) {
@@ -4947,16 +4947,17 @@ async function rawCall(ctx, path, opts = {}) {
     if (!extra["content-type"]) extra["content-type"] = "application/json";
   }
   const method = opts.method ?? (body !== void 0 ? "POST" : "GET");
-  const headers2 = buildHeaders(
-    { ...ctx, businessDomain: opts.businessDomain ?? ctx.businessDomain },
-    extra
-  );
+  const headersFor = () => buildHeaders({ ...ctx, businessDomain: opts.businessDomain ?? ctx.businessDomain }, extra);
   if (opts.verbose) process.stderr.write(`> ${method} ${url}
 `);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 3e4);
+  const send = () => fetch(url, { method, headers: headersFor(), body, signal: controller.signal });
   try {
-    const res = await fetch(url, { method, headers: headers2, body, signal: controller.signal });
+    let res = await send();
+    if (res.status === 401 && ctx.refresh && await tryRefresh(ctx)) {
+      res = await send();
+    }
     return { status: res.status, statusText: res.statusText, body: await res.text() };
   } finally {
     clearTimeout(timer);
@@ -4989,6 +4990,7 @@ __export(auth_exports, {
   attachNoAuth: () => attachNoAuth,
   attachToken: () => attachToken,
   currentToken: () => currentToken,
+  currentTokenFresh: () => currentTokenFresh,
   deletePlatform: () => deletePlatform,
   exportCreds: () => exportCreds,
   hostOf: () => hostOf,
@@ -5055,6 +5057,30 @@ function currentToken() {
   if (!token) throw new InputError("Not logged in. Run `openbkn auth login <url> --token <t>`.");
   return token.accessToken;
 }
+async function currentTokenFresh() {
+  const baseUrl = activePlatform();
+  const token = baseUrl ? readToken(baseUrl) : void 0;
+  if (!baseUrl || !token) {
+    throw new InputError("Not logged in. Run `openbkn auth login <url> --token <t>`.");
+  }
+  const claims = decodeJwt(token.accessToken);
+  const decodable = claims?.exp !== void 0;
+  const needsRefresh = decodable ? isExpired(claims) : true;
+  if (token.refreshToken && needsRefresh) {
+    try {
+      const t = await refreshAccessToken(baseUrl, token.refreshToken);
+      writeToken(baseUrl, {
+        ...token,
+        accessToken: t.accessToken,
+        refreshToken: t.refreshToken ?? token.refreshToken,
+        idToken: t.idToken ?? token.idToken
+      });
+      return t.accessToken;
+    } catch {
+    }
+  }
+  return token.accessToken;
+}
 function whoami() {
   const baseUrl = activePlatform();
   const token = baseUrl ? readToken(baseUrl) : void 0;
@@ -5125,26 +5151,26 @@ function exportCreds() {
 }
 
 export {
-  rawCall,
-  DEFAULT_BUSINESS_DOMAIN,
-  DEFAULT_LIST_LIMIT,
-  DEFAULT_QUERY_LIMIT,
   HttpError,
   InputError,
   toExitCode,
   formatError,
-  decodeJwt,
-  activePlatform,
-  setActivePlatform,
-  readPlatformConfig,
-  writePlatformConfig,
-  resolveContext,
   isHeadless,
   openBrowser,
   fetchAuthStatus,
   deviceLogin,
   credentialDeviceLogin,
   request,
+  rawCall,
+  DEFAULT_BUSINESS_DOMAIN,
+  DEFAULT_LIST_LIMIT,
+  DEFAULT_QUERY_LIMIT,
+  decodeJwt,
+  activePlatform,
+  setActivePlatform,
+  readPlatformConfig,
+  writePlatformConfig,
+  resolveContext,
   getUserSafe,
   admin,
   agents,
@@ -5165,6 +5191,7 @@ export {
   attachNoAuth,
   status,
   currentToken,
+  currentTokenFresh,
   whoami,
   listPlatforms2 as listPlatforms,
   use,
@@ -5174,4 +5201,4 @@ export {
   exportCreds,
   auth_exports
 };
-//# sourceMappingURL=chunk-GAYXY7LP.js.map
+//# sourceMappingURL=chunk-DTU5DGJW.js.map