@openbkn/bkn-sdk 0.1.1-alpha.7 → 0.1.1-alpha.9

package/dist/{chunk-GAYXY7LP.js → chunk-BFE4SU3V.js}

@@ -4,11 +4,6 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/types.ts
-var DEFAULT_BUSINESS_DOMAIN = "bd_public";
-var DEFAULT_LIST_LIMIT = 30;
-var DEFAULT_QUERY_LIMIT = 50;
-
 // src/utils/errors.ts
 var HttpError = class extends Error {
   status;
@@ -77,189 +72,6 @@ function truncate(s, n) {
   return s.length > n ? `${s.slice(0, n)}\u2026` : s;
 }
 
-// src/config/store.ts
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  writeFileSync
-} from "fs";
-import { homedir } from "os";
-import { join } from "path";
-
-// src/auth/jwt.ts
-function decodeJwt(token) {
-  const parts = token.split(".");
-  if (parts.length < 2 || !parts[1]) return void 0;
-  try {
-    const json = Buffer.from(parts[1], "base64url").toString("utf8");
-    return JSON.parse(json);
-  } catch {
-    return void 0;
-  }
-}
-function isExpired(claims, nowMs = Date.now()) {
-  return claims?.exp !== void 0 && claims.exp * 1e3 < nowMs;
-}
-
-// src/config/store.ts
-var PROFILE_RE = /^[A-Za-z0-9_-]{1,64}$/;
-var IS_WIN = process.platform === "win32";
-function configDir() {
-  return process.env.BKN_CONFIG_DIR ?? join(homedir(), ".bkn");
-}
-function profileName() {
-  const raw = process.env.BKN_PROFILE?.trim();
-  if (!raw) return null;
-  if (!PROFILE_RE.test(raw)) {
-    throw new Error(`BKN_PROFILE='${raw}' is invalid. Use 1-64 chars from [A-Za-z0-9_-].`);
-  }
-  return raw;
-}
-function statePath() {
-  const profile = profileName();
-  return profile ? join(configDir(), "profiles", profile, "state.json") : join(configDir(), "state.json");
-}
-function encodeKey(baseUrl) {
-  return Buffer.from(baseUrl, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function platformDir(baseUrl) {
-  return join(configDir(), "platforms", encodeKey(baseUrl));
-}
-function userDir(baseUrl, userId) {
-  return join(platformDir(baseUrl), "users", userId);
-}
-function userIdFromToken(token) {
-  return decodeJwt(token.idToken ?? "")?.sub ?? decodeJwt(token.accessToken)?.sub ?? "default";
-}
-function readState() {
-  return readJson(statePath()) ?? {};
-}
-function writeState(state) {
-  writeJson(statePath(), state);
-}
-function activePlatform() {
-  return readState().currentPlatform;
-}
-function setActivePlatform(baseUrl) {
-  writeState({ ...readState(), currentPlatform: baseUrl });
-}
-function activeUserId(baseUrl) {
-  return readState().activeUsers?.[baseUrl];
-}
-function setActiveUser(baseUrl, userId) {
-  const state = readState();
-  writeState({ ...state, activeUsers: { ...state.activeUsers, [baseUrl]: userId } });
-}
-function readToken(baseUrl, userId = activeUserId(baseUrl)) {
-  if (!userId) return void 0;
-  return readJson(join(userDir(baseUrl, userId), "token.json")) ?? void 0;
-}
-function writeToken(baseUrl, token) {
-  const userId = userIdFromToken(token);
-  writeJson(join(userDir(baseUrl, userId), "token.json"), token, 384);
-  setActiveUser(baseUrl, userId);
-  return userId;
-}
-function deleteToken(baseUrl, userId = activeUserId(baseUrl)) {
-  if (!userId) return false;
-  const path = join(userDir(baseUrl, userId), "token.json");
-  if (!existsSync(path)) return false;
-  rmSync(path, { force: true });
-  return true;
-}
-function readPlatformConfig(baseUrl, userId = activeUserId(baseUrl)) {
-  if (!userId) return {};
-  return readJson(join(userDir(baseUrl, userId), "config.json")) ?? {};
-}
-function writePlatformConfig(baseUrl, config) {
-  const userId = activeUserId(baseUrl) ?? "default";
-  writeJson(join(userDir(baseUrl, userId), "config.json"), config);
-}
-function listPlatforms() {
-  const root = join(configDir(), "platforms");
-  if (!existsSync(root)) return [];
-  const state = readState();
-  const out = [];
-  for (const key of readdirSync(root)) {
-    const baseUrl = decodeKey(key);
-    if (!baseUrl) continue;
-    const usersRoot = join(root, key, "users");
-    if (!existsSync(usersRoot)) continue;
-    const users = [];
-    for (const userId of readdirSync(usersRoot)) {
-      const token = readJson(join(usersRoot, userId, "token.json"));
-      if (token) users.push({ userId, username: token.username, displayName: token.displayName });
-    }
-    if (users.length > 0) {
-      out.push({ baseUrl, users, activeUserId: state.activeUsers?.[baseUrl] });
-    }
-  }
-  return out;
-}
-function decodeKey(key) {
-  try {
-    const b64 = key.replace(/-/g, "+").replace(/_/g, "/");
-    return Buffer.from(b64, "base64").toString("utf8");
-  } catch {
-    return null;
-  }
-}
-function readJson(path) {
-  if (!existsSync(path)) return void 0;
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-function writeJson(path, value, mode = 384) {
-  const dir = path.slice(0, path.lastIndexOf("/")) || ".";
-  mkdirSync(dir, { recursive: true, ...IS_WIN ? {} : { mode: 448 } });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, IS_WIN ? {} : { mode });
-  if (!IS_WIN) chmodSync(path, mode);
-}
-
-// src/config/resolve.ts
-function resolveContext(opts = {}) {
-  const baseUrl = opts.baseUrl ?? process.env.BKN_BASE_URL ?? activePlatform();
-  if (!baseUrl) {
-    throw new InputError(
-      "No base URL. Pass --base-url, set BKN_BASE_URL, or run `openbkn auth login`."
-    );
-  }
-  const normalized = baseUrl.replace(/\/+$/, "");
-  const stored = readToken(normalized);
-  const explicit = opts.token ?? process.env.BKN_TOKEN;
-  const token = explicit ?? stored?.accessToken ?? "";
-  if (!token && !stored?.noAuth) {
-    throw new InputError("No access token. Set BKN_TOKEN or run `openbkn auth login`.");
-  }
-  const insecure = opts.insecure ?? stored?.tlsInsecure ?? false;
-  const refresh = !explicit && stored?.refreshToken ? {
-    refreshToken: stored.refreshToken,
-    persist: (t) => {
-      writeToken(normalized, {
-        ...stored,
-        accessToken: t.accessToken,
-        refreshToken: t.refreshToken ?? stored.refreshToken,
-        idToken: t.idToken ?? stored.idToken
-      });
-    }
-  } : void 0;
-  return {
-    baseUrl: normalized,
-    token,
-    businessDomain: opts.businessDomain ?? readPlatformConfig(normalized).businessDomain ?? DEFAULT_BUSINESS_DOMAIN,
-    insecure,
-    ...refresh ? { refresh } : {}
-  };
-}
-
 // src/auth/oauth.ts
 import { spawn } from "child_process";
 function normalizeBaseUrl(value) {
@@ -520,6 +332,194 @@ async function tryRefresh(ctx) {
   }
 }
 
+// src/types.ts
+var DEFAULT_BUSINESS_DOMAIN = "bd_public";
+var DEFAULT_LIST_LIMIT = 30;
+var DEFAULT_QUERY_LIMIT = 50;
+
+// src/config/store.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+// src/auth/jwt.ts
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length < 2 || !parts[1]) return void 0;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return void 0;
+  }
+}
+function isExpired(claims, nowMs = Date.now()) {
+  return claims?.exp !== void 0 && claims.exp * 1e3 < nowMs;
+}
+
+// src/config/store.ts
+var PROFILE_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var IS_WIN = process.platform === "win32";
+function configDir() {
+  return process.env.BKN_CONFIG_DIR ?? join(homedir(), ".bkn");
+}
+function profileName() {
+  const raw = process.env.BKN_PROFILE?.trim();
+  if (!raw) return null;
+  if (!PROFILE_RE.test(raw)) {
+    throw new Error(`BKN_PROFILE='${raw}' is invalid. Use 1-64 chars from [A-Za-z0-9_-].`);
+  }
+  return raw;
+}
+function statePath() {
+  const profile = profileName();
+  return profile ? join(configDir(), "profiles", profile, "state.json") : join(configDir(), "state.json");
+}
+function encodeKey(baseUrl) {
+  return Buffer.from(baseUrl, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function platformDir(baseUrl) {
+  return join(configDir(), "platforms", encodeKey(baseUrl));
+}
+function userDir(baseUrl, userId) {
+  return join(platformDir(baseUrl), "users", userId);
+}
+function userIdFromToken(token) {
+  return decodeJwt(token.idToken ?? "")?.sub ?? decodeJwt(token.accessToken)?.sub ?? "default";
+}
+function readState() {
+  return readJson(statePath()) ?? {};
+}
+function writeState(state) {
+  writeJson(statePath(), state);
+}
+function activePlatform() {
+  return readState().currentPlatform;
+}
+function setActivePlatform(baseUrl) {
+  writeState({ ...readState(), currentPlatform: baseUrl });
+}
+function activeUserId(baseUrl) {
+  return readState().activeUsers?.[baseUrl];
+}
+function setActiveUser(baseUrl, userId) {
+  const state = readState();
+  writeState({ ...state, activeUsers: { ...state.activeUsers, [baseUrl]: userId } });
+}
+function readToken(baseUrl, userId = activeUserId(baseUrl)) {
+  if (!userId) return void 0;
+  return readJson(join(userDir(baseUrl, userId), "token.json")) ?? void 0;
+}
+function writeToken(baseUrl, token) {
+  const userId = userIdFromToken(token);
+  writeJson(join(userDir(baseUrl, userId), "token.json"), token, 384);
+  setActiveUser(baseUrl, userId);
+  return userId;
+}
+function deleteToken(baseUrl, userId = activeUserId(baseUrl)) {
+  if (!userId) return false;
+  const path = join(userDir(baseUrl, userId), "token.json");
+  if (!existsSync(path)) return false;
+  rmSync(path, { force: true });
+  return true;
+}
+function readPlatformConfig(baseUrl, userId = activeUserId(baseUrl)) {
+  if (!userId) return {};
+  return readJson(join(userDir(baseUrl, userId), "config.json")) ?? {};
+}
+function writePlatformConfig(baseUrl, config) {
+  const userId = activeUserId(baseUrl) ?? "default";
+  writeJson(join(userDir(baseUrl, userId), "config.json"), config);
+}
+function listPlatforms() {
+  const root = join(configDir(), "platforms");
+  if (!existsSync(root)) return [];
+  const state = readState();
+  const out = [];
+  for (const key of readdirSync(root)) {
+    const baseUrl = decodeKey(key);
+    if (!baseUrl) continue;
+    const usersRoot = join(root, key, "users");
+    if (!existsSync(usersRoot)) continue;
+    const users = [];
+    for (const userId of readdirSync(usersRoot)) {
+      const token = readJson(join(usersRoot, userId, "token.json"));
+      if (token) users.push({ userId, username: token.username, displayName: token.displayName });
+    }
+    if (users.length > 0) {
+      out.push({ baseUrl, users, activeUserId: state.activeUsers?.[baseUrl] });
+    }
+  }
+  return out;
+}
+function decodeKey(key) {
+  try {
+    const b64 = key.replace(/-/g, "+").replace(/_/g, "/");
+    return Buffer.from(b64, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function readJson(path) {
+  if (!existsSync(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeJson(path, value, mode = 384) {
+  const dir = path.slice(0, path.lastIndexOf("/")) || ".";
+  mkdirSync(dir, { recursive: true, ...IS_WIN ? {} : { mode: 448 } });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, IS_WIN ? {} : { mode });
+  if (!IS_WIN) chmodSync(path, mode);
+}
+
+// src/config/resolve.ts
+function resolveContext(opts = {}) {
+  const baseUrl = opts.baseUrl ?? process.env.BKN_BASE_URL ?? activePlatform();
+  if (!baseUrl) {
+    throw new InputError(
+      "No base URL. Pass --base-url, set BKN_BASE_URL, or run `openbkn auth login`."
+    );
+  }
+  const normalized = baseUrl.replace(/\/+$/, "");
+  const stored = readToken(normalized);
+  const explicit = opts.token ?? process.env.BKN_TOKEN;
+  const token = explicit ?? stored?.accessToken ?? "";
+  if (!token && !stored?.noAuth) {
+    throw new InputError("No access token. Set BKN_TOKEN or run `openbkn auth login`.");
+  }
+  const insecure = opts.insecure ?? stored?.tlsInsecure ?? false;
+  const refresh = !explicit && stored?.refreshToken ? {
+    refreshToken: stored.refreshToken,
+    persist: (t) => {
+      writeToken(normalized, {
+        ...stored,
+        accessToken: t.accessToken,
+        refreshToken: t.refreshToken ?? stored.refreshToken,
+        idToken: t.idToken ?? stored.idToken
+      });
+    }
+  } : void 0;
+  return {
+    baseUrl: normalized,
+    token,
+    businessDomain: opts.businessDomain ?? readPlatformConfig(normalized).businessDomain ?? DEFAULT_BUSINESS_DOMAIN,
+    insecure,
+    ...refresh ? { refresh } : {}
+  };
+}
+
 // src/api/safe.ts
 var ADMIN = "/api/safe/v1/admin";
 function notOnSafe(operation) {
@@ -748,6 +748,15 @@ function admin(ctx) {
   };
 }
 
+// src/api/auth-fetch.ts
+async function authFetch(ctx, send) {
+  let res = await send();
+  if (res.status === 401 && ctx.refresh && await tryRefresh(ctx)) {
+    res = await send();
+  }
+  return res;
+}
+
 // src/api/agent-chat.ts
 var FACTORY = "/api/agent-factory";
 async function fetchAgentInfo(ctx, agentId, version = "v0") {
@@ -816,16 +825,19 @@ async function sendChat(ctx, info, query, opts = {}) {
     stream: Boolean(opts.stream)
   };
   if (opts.conversationId) body.conversation_id = opts.conversationId;
-  const res = await fetch(`${ctx.baseUrl}${FACTORY}/v1/app/${info.key}/chat/completion`, {
-    method: "POST",
-    headers: {
-      ...buildHeaders(ctx),
-      "content-type": "application/json",
-      accept: opts.stream ? "text/event-stream" : "application/json",
-      "x-language": "zh-CN"
-    },
-    body: JSON.stringify(body)
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${FACTORY}/v1/app/${info.key}/chat/completion`, {
+      method: "POST",
+      headers: {
+        ...buildHeaders(ctx),
+        "content-type": "application/json",
+        accept: opts.stream ? "text/event-stream" : "application/json",
+        "x-language": "zh-CN"
+      },
+      body: JSON.stringify(body)
+    })
+  );
   if (!res.ok) throw new HttpError(res.status, res.statusText, await res.text());
   const contentType = res.headers.get("content-type") ?? "";
   if (opts.stream && contentType.includes("text/event-stream")) {
@@ -1039,11 +1051,14 @@ function parseBody(text) {
 }
 async function post(ctx, knId, sessionId, body) {
   applyTls(ctx);
-  const res = await fetch(mcpUrl(ctx), {
-    method: "POST",
-    headers: headers(ctx, knId, sessionId),
-    body: JSON.stringify(body)
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(mcpUrl(ctx), {
+      method: "POST",
+      headers: headers(ctx, knId, sessionId),
+      body: JSON.stringify(body)
+    })
+  );
   const text = await res.text();
   if (!res.ok) throw new HttpError(res.status, res.statusText, text);
   return { res, text };
@@ -2727,7 +2742,10 @@ async function uploadBkn(ctx, tarBuffer, opts = {}) {
     new Blob([new Uint8Array(tarBuffer)], { type: "application/octet-stream" }),
     "bkn.tar"
   );
-  const res = await fetch(url, { method: "POST", headers: buildHeaders(ctx), body: form2 });
+  const res = await authFetch(
+    ctx,
+    () => fetch(url, { method: "POST", headers: buildHeaders(ctx), body: form2 })
+  );
   const text = await res.text();
   if (!res.ok) throw new HttpError(res.status, res.statusText, text);
   return text ? JSON.parse(text) : void 0;
@@ -2736,7 +2754,7 @@ async function downloadBkn(ctx, knId, opts = {}) {
   applyTls(ctx);
   const url = new URL(`${ctx.baseUrl}${BKNS}/${encodeURIComponent(knId)}`);
   url.searchParams.set("branch", opts.branch ?? "main");
-  const res = await fetch(url, { method: "GET", headers: buildHeaders(ctx) });
+  const res = await authFetch(ctx, () => fetch(url, { method: "GET", headers: buildHeaders(ctx) }));
   if (!res.ok) throw new HttpError(res.status, res.statusText, await res.text());
   return Buffer.from(await res.arrayBuffer());
 }
@@ -3646,15 +3664,18 @@ function deltaContent(chunk) {
 }
 async function chatCompletionsStream(ctx, model, messages, onDelta) {
   applyTls(ctx);
-  const res = await fetch(`${ctx.baseUrl}${API}/chat/completions`, {
-    method: "POST",
-    headers: {
-      ...buildHeaders(ctx),
-      "content-type": "application/json",
-      accept: "text/event-stream"
-    },
-    body: JSON.stringify({ model, messages, stream: true })
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${API}/chat/completions`, {
+      method: "POST",
+      headers: {
+        ...buildHeaders(ctx),
+        "content-type": "application/json",
+        accept: "text/event-stream"
+      },
+      body: JSON.stringify({ model, messages, stream: true })
+    })
+  );
   if (!res.ok) throw new HttpError(res.status, res.statusText, await res.text());
   const reader = res.body?.getReader();
   if (!reader) throw new Error("No response body for stream");
@@ -3761,11 +3782,14 @@ async function registerSkillZip(ctx, bytes, opts = {}) {
   form2.set("file", new Blob([bytes]), opts.filename ?? "skill.zip");
   if (opts.source) form2.set("source", opts.source);
   if (opts.extendInfo) form2.set("extend_info", JSON.stringify(opts.extendInfo));
-  const res = await fetch(`${ctx.baseUrl}${BASE5}/skills`, {
-    method: "POST",
-    headers: buildHeaders(ctx),
-    body: form2
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${BASE5}/skills`, {
+      method: "POST",
+      headers: buildHeaders(ctx),
+      body: form2
+    })
+  );
   const text = await res.text();
   if (!res.ok) throw new HttpError(res.status, res.statusText, text);
   return text ? JSON.parse(text) : void 0;
@@ -3775,20 +3799,26 @@ async function updateSkillPackageZip(ctx, skillId, bytes, filename = "skill.zip"
   const form2 = new FormData();
   form2.set("file_type", "zip");
   form2.set("file", new Blob([bytes]), filename);
-  const res = await fetch(`${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/package`, {
-    method: "PUT",
-    headers: buildHeaders(ctx),
-    body: form2
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/package`, {
+      method: "PUT",
+      headers: buildHeaders(ctx),
+      body: form2
+    })
+  );
   const text = await res.text();
   if (!res.ok) throw new HttpError(res.status, res.statusText, text);
   return text ? JSON.parse(text) : void 0;
 }
 async function downloadSkill(ctx, skillId) {
   applyTls(ctx);
-  const res = await fetch(`${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/download`, {
-    headers: buildHeaders(ctx)
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/download`, {
+      headers: buildHeaders(ctx)
+    })
+  );
   if (!res.ok) throw new HttpError(res.status, res.statusText, await res.text());
   return new Uint8Array(await res.arrayBuffer());
 }
@@ -3942,9 +3972,11 @@ var PATH = "/api/agent-operator-integration/v1/tool-box";
 var IMPEX = "/api/agent-operator-integration/v1/impex";
 async function exportConfig(ctx, id, type = "toolbox") {
   applyTls(ctx);
-  const res = await fetch(
-    `${ctx.baseUrl}${IMPEX}/export/${encodeURIComponent(type)}/${encodeURIComponent(id)}`,
-    { headers: buildHeaders(ctx) }
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${IMPEX}/export/${encodeURIComponent(type)}/${encodeURIComponent(id)}`, {
+      headers: buildHeaders(ctx)
+    })
   );
   const buf = new Uint8Array(await res.arrayBuffer());
   if (!res.ok) throw new HttpError(res.status, res.statusText, new TextDecoder().decode(buf));
@@ -3955,11 +3987,14 @@ async function importConfig(ctx, filePath, type = "toolbox") {
   const buf = await readFile2(filePath);
   const form2 = new FormData();
   form2.append("data", new Blob([new Uint8Array(buf)]), basename3(filePath));
-  const res = await fetch(`${ctx.baseUrl}${IMPEX}/import/${encodeURIComponent(type)}`, {
-    method: "POST",
-    headers: buildHeaders(ctx),
-    body: form2
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${IMPEX}/import/${encodeURIComponent(type)}`, {
+      method: "POST",
+      headers: buildHeaders(ctx),
+      body: form2
+    })
+  );
   const text = await res.text();
   if (!res.ok) throw new HttpError(res.status, res.statusText, text);
   return text ? JSON.parse(text) : text;
@@ -3970,11 +4005,14 @@ async function uploadTool(ctx, boxId, filePath, metadataType = "openapi") {
   const form2 = new FormData();
   form2.append("metadata_type", metadataType);
   form2.append("data", new Blob([new Uint8Array(buf)]), basename3(filePath));
-  const res = await fetch(`${ctx.baseUrl}${PATH}/${encodeURIComponent(boxId)}/tool`, {
-    method: "POST",
-    headers: buildHeaders(ctx),
-    body: form2
-  });
+  const res = await authFetch(
+    ctx,
+    () => fetch(`${ctx.baseUrl}${PATH}/${encodeURIComponent(boxId)}/tool`, {
+      method: "POST",
+      headers: buildHeaders(ctx),
+      body: form2
+    })
+  );
   const text = await res.text();
   if (!res.ok) throw new HttpError(res.status, res.statusText, text);
   return text ? JSON.parse(text) : text;
@@ -4947,16 +4985,16 @@ async function rawCall(ctx, path, opts = {}) {
     if (!extra["content-type"]) extra["content-type"] = "application/json";
   }
   const method = opts.method ?? (body !== void 0 ? "POST" : "GET");
-  const headers2 = buildHeaders(
-    { ...ctx, businessDomain: opts.businessDomain ?? ctx.businessDomain },
-    extra
-  );
+  const headersFor = () => buildHeaders({ ...ctx, businessDomain: opts.businessDomain ?? ctx.businessDomain }, extra);
   if (opts.verbose) process.stderr.write(`> ${method} ${url}
 `);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 3e4);
   try {
-    const res = await fetch(url, { method, headers: headers2, body, signal: controller.signal });
+    const res = await authFetch(
+      ctx,
+      () => fetch(url, { method, headers: headersFor(), body, signal: controller.signal })
+    );
     return { status: res.status, statusText: res.statusText, body: await res.text() };
   } finally {
     clearTimeout(timer);
@@ -4989,6 +5027,7 @@ __export(auth_exports, {
   attachNoAuth: () => attachNoAuth,
   attachToken: () => attachToken,
   currentToken: () => currentToken,
+  currentTokenFresh: () => currentTokenFresh,
   deletePlatform: () => deletePlatform,
   exportCreds: () => exportCreds,
   hostOf: () => hostOf,
@@ -5055,6 +5094,30 @@ function currentToken() {
   if (!token) throw new InputError("Not logged in. Run `openbkn auth login <url> --token <t>`.");
   return token.accessToken;
 }
+async function currentTokenFresh() {
+  const baseUrl = activePlatform();
+  const token = baseUrl ? readToken(baseUrl) : void 0;
+  if (!baseUrl || !token) {
+    throw new InputError("Not logged in. Run `openbkn auth login <url> --token <t>`.");
+  }
+  const claims = decodeJwt(token.accessToken);
+  const decodable = claims?.exp !== void 0;
+  const needsRefresh = decodable ? isExpired(claims) : true;
+  if (token.refreshToken && needsRefresh) {
+    try {
+      const t = await refreshAccessToken(baseUrl, token.refreshToken);
+      writeToken(baseUrl, {
+        ...token,
+        accessToken: t.accessToken,
+        refreshToken: t.refreshToken ?? token.refreshToken,
+        idToken: t.idToken ?? token.idToken
+      });
+      return t.accessToken;
+    } catch {
+    }
+  }
+  return token.accessToken;
+}
 function whoami() {
   const baseUrl = activePlatform();
   const token = baseUrl ? readToken(baseUrl) : void 0;
@@ -5125,26 +5188,26 @@ function exportCreds() {
 }
 
 export {
-  rawCall,
-  DEFAULT_BUSINESS_DOMAIN,
-  DEFAULT_LIST_LIMIT,
-  DEFAULT_QUERY_LIMIT,
   HttpError,
   InputError,
   toExitCode,
   formatError,
-  decodeJwt,
-  activePlatform,
-  setActivePlatform,
-  readPlatformConfig,
-  writePlatformConfig,
-  resolveContext,
   isHeadless,
   openBrowser,
   fetchAuthStatus,
   deviceLogin,
   credentialDeviceLogin,
   request,
+  rawCall,
+  DEFAULT_BUSINESS_DOMAIN,
+  DEFAULT_LIST_LIMIT,
+  DEFAULT_QUERY_LIMIT,
+  decodeJwt,
+  activePlatform,
+  setActivePlatform,
+  readPlatformConfig,
+  writePlatformConfig,
+  resolveContext,
   getUserSafe,
   admin,
   agents,
@@ -5165,6 +5228,7 @@ export {
   attachNoAuth,
   status,
   currentToken,
+  currentTokenFresh,
   whoami,
   listPlatforms2 as listPlatforms,
   use,
@@ -5174,4 +5238,4 @@ export {
   exportCreds,
   auth_exports
 };
-//# sourceMappingURL=chunk-GAYXY7LP.js.map
+//# sourceMappingURL=chunk-BFE4SU3V.js.map