@wirecat/cli-core 0.535.0 → 0.537.0

package/CHANGELOG.md

@@ -7,6 +7,23 @@ shape of this file.
 
 ## Unreleased
 
+## 0.537.0 — 01.11.2026
+
+### Added
+
+- **`tokenKeeper.tokens({ refresh: true })`** (and `accessToken({ refresh: true })`): after a server refuses an
+  access token whose `expiresAt` still called it fresh (a revoked session), refresh under the shared lock anyway. A
+  different fresh token another process saved meanwhile is answered instead of a second refresh.
+
+## 0.536.0 — 01.11.2026
+
+### Fixed
+
+- **A server mail search that ran out of time says so.** When the server's own deadline cut a search or the read of
+  its finds short, `searchMailServer` reported `search.server-failed` (`provider_unavailable`), as if the server had
+  refused. It now reports `search.server-timeout` (`timeout`), as when `--server-time` ends it, so a caller knows to
+  give it more time.
+
 ## 0.535.0 — 01.11.2026
 
 ### Added

package/dist/mail/server-search.js

@@ -18,6 +18,12 @@ const refusal = {
     no_words: "--backend server needs words, people, a subject, a date or a state to send to the server",
 };
 const BOUND = Symbol("bound");
+/** A call the server's own deadline cut short is the time bound's, as one cut by --server-time is. */
+const failureOf = (error) => error instanceof CliError && error.code === "rate_limited"
+    ? "rate_limited"
+    : error instanceof CliError && error.code === "timeout"
+        ? "time_or_abort_bound"
+        : "search_failed";
 /** The newest first: a server's UIDs grow as mail arrives in the folder. */
 const newest = (uids, count) => [...uids].sort((one, other) => Number(other) - Number(one)).slice(0, count);
 /**
@@ -112,7 +118,7 @@ export const searchMailServer = async (store, mailbox, access, request) => {
                 if (!open)
                     return;
                 pending.delete(call);
-                fail(call, error instanceof CliError && error.code === "rate_limited" ? "rate_limited" : "search_failed");
+                fail(call, failureOf(error));
             }
         }));
         if (!open)
@@ -143,10 +149,7 @@ export const searchMailServer = async (store, mailbox, access, request) => {
     });
     let outcome;
     try {
-        outcome = await Promise.race([
-            run().then(() => "done", () => "failed"),
-            bound,
-        ]);
+        outcome = await Promise.race([run().then(() => "done", failureOf), bound]);
     }
     finally {
         open = false;
@@ -158,12 +161,13 @@ export const searchMailServer = async (store, mailbox, access, request) => {
         throw openFailure;
     if (unsupported)
         return skip("unsupported");
+    const ended = outcome === BOUND || outcome === "done" ? "time_or_abort_bound" : outcome;
     for (const call of pending)
-        fail(call, outcome === "failed" ? "search_failed" : "time_or_abort_bound");
+        fail(call, ended);
     if (outcome !== "done" || (fresh.length > 0 && raws === undefined)) {
         // What was found but not read in time is the archive's to answer: none of it is claimed as the server's.
         if (pending.size === 0)
-            fail(null, outcome === "failed" ? "search_failed" : "time_or_abort_bound");
+            fail(null, ended);
         for (const item of fresh)
             sources.delete(sourceKey(item.threadId, item.messageId));
         report.returned = sources.size;

package/dist/oauth/index.d.ts

@@ -1,5 +1,5 @@
 export { type Authorization, type AuthorizeOptions, authorize } from "./authorize.js";
-export { type SignInOptions, type TokenKeeper, type TokenKeeperOptions, tokenKeeper } from "./keeper.js";
+export { type SignInOptions, type TokenKeeper, type TokenKeeperOptions, type TokensOptions, tokenKeeper, } from "./keeper.js";
 export type { ExchangeContext, OAuthClient, OAuthProvider, RequestContext, TokenSet } from "./provider.js";
 export { requestTokens, revokeToken, TOKEN_LOG_ALLOW, TOKEN_LOG_EVENT } from "./requests.js";
 export { type CredentialStorageOptions, credentialStorage, driveSessionCodec, type EncodeInput, oauthAccount, type StoredTokens, standardCodec, type TokenCodec, type TokenStorage, zoomTokenCodec, } from "./storage.js";

package/dist/oauth/index.js

@@ -1,4 +1,4 @@
 export { authorize } from "./authorize.js";
-export { tokenKeeper } from "./keeper.js";
+export { tokenKeeper, } from "./keeper.js";
 export { requestTokens, revokeToken, TOKEN_LOG_ALLOW, TOKEN_LOG_EVENT } from "./requests.js";
 export { credentialStorage, driveSessionCodec, oauthAccount, standardCodec, zoomTokenCodec, } from "./storage.js";

package/dist/oauth/keeper.d.ts

@@ -23,9 +23,16 @@ export type SignInOptions = Omit<AuthorizeOptions, "provider" | "signal"> & {
     /** Runs before anything is saved; it may refuse the account or add fields to the entry (drive's `principal`). */
     accept?: (tokens: TokenSet) => Promise<Record<string, unknown> | undefined> | Record<string, unknown> | undefined;
 };
+export interface TokensOptions {
+    /**
+     * The server refused the access token this keeper last answered, though `expiresAt` called it fresh (a revoked
+     * session): refresh under the lock anyway, unless another process already saved a different fresh one.
+     */
+    refresh?: boolean;
+}
 export interface TokenKeeper {
-    accessToken(): Promise<string>;
-    tokens(): Promise<TokenSet>;
+    accessToken(options?: TokensOptions): Promise<string>;
+    tokens(options?: TokensOptions): Promise<TokenSet>;
     signIn(options: SignInOptions): Promise<{
         scopes: string[];
     }>;

package/dist/oauth/keeper.js

@@ -87,25 +87,39 @@ export const tokenKeeper = (options) => {
         return kept && fresh(kept) && kept.refreshToken === saved.refreshToken ? kept : undefined;
     };
     const forget = () => refreshedInMemory.delete(lockPath);
-    const tokens = async () => {
+    let answered;
+    const answer = (given) => {
+        answered = given;
+        return given;
+    };
+    const tokens = async ({ refresh = false } = {}) => {
         const seen = storage.read();
         if (!seen)
             throw notSignedIn();
-        if (fresh(seen.tokens))
-            return seen.tokens;
-        const kept = remembered(seen.tokens);
-        if (kept)
-            return kept;
-        return shared(async () => {
+        if (!refresh) {
+            const kept = remembered(seen.tokens);
+            if (kept)
+                return answer(kept);
+            if (fresh(seen.tokens))
+                return answer(seen.tokens);
+        }
+        const refused = answered ?? remembered(seen.tokens) ?? seen.tokens;
+        return answer(await shared(async () => {
             const current = storage.read();
             if (!current)
                 throw notSignedIn();
+            const latest = remembered(current.tokens) ?? current.tokens;
             // Another process refreshed while this one waited for the lock: its result is the one to use.
-            if (fresh(current.tokens) || current.tokens.refreshToken !== seen.tokens.refreshToken)
-                return current.tokens;
-            const keptMeanwhile = remembered(current.tokens);
-            if (keptMeanwhile)
-                return keptMeanwhile;
+            if (refresh) {
+                if (latest.accessToken !== refused.accessToken && fresh(latest))
+                    return latest;
+            }
+            else {
+                if (latest !== current.tokens)
+                    return latest;
+                if (fresh(current.tokens) || current.tokens.refreshToken !== seen.tokens.refreshToken)
+                    return current.tokens;
+            }
             const client = clientOf(current);
             const refreshed = await exchange({ grant_type: "refresh_token", refresh_token: current.tokens.refreshToken }, context(client, current.tokens));
             // A rotated refresh token is saved even so: kept only in memory, it would die with the process.
@@ -114,12 +128,12 @@ export const tokenKeeper = (options) => {
             else
                 storage.write({ tokens: refreshed, client });
             return refreshed;
-        });
+        }));
     };
     return {
         tokens,
-        accessToken: async () => {
-            const current = await tokens();
+        accessToken: async (tokensOptions) => {
+            const current = await tokens(tokensOptions);
             if (!current.accessToken)
                 throw notSignedIn();
             return current.accessToken;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.535.0",
+  "version": "0.537.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",