@wirecat/cli-core 0.536.0 → 0.537.0

package/CHANGELOG.md

@@ -7,6 +7,14 @@ shape of this file.
 
 ## Unreleased
 
+## 0.537.0 — 01.11.2026
+
+### Added
+
+- **`tokenKeeper.tokens({ refresh: true })`** (and `accessToken({ refresh: true })`): after a server refuses an
+  access token whose `expiresAt` still called it fresh (a revoked session), refresh under the shared lock anyway. A
+  different fresh token another process saved meanwhile is answered instead of a second refresh.
+
 ## 0.536.0 — 01.11.2026
 
 ### Fixed

package/dist/oauth/index.d.ts

@@ -1,5 +1,5 @@
 export { type Authorization, type AuthorizeOptions, authorize } from "./authorize.js";
-export { type SignInOptions, type TokenKeeper, type TokenKeeperOptions, tokenKeeper } from "./keeper.js";
+export { type SignInOptions, type TokenKeeper, type TokenKeeperOptions, type TokensOptions, tokenKeeper, } from "./keeper.js";
 export type { ExchangeContext, OAuthClient, OAuthProvider, RequestContext, TokenSet } from "./provider.js";
 export { requestTokens, revokeToken, TOKEN_LOG_ALLOW, TOKEN_LOG_EVENT } from "./requests.js";
 export { type CredentialStorageOptions, credentialStorage, driveSessionCodec, type EncodeInput, oauthAccount, type StoredTokens, standardCodec, type TokenCodec, type TokenStorage, zoomTokenCodec, } from "./storage.js";

package/dist/oauth/index.js

@@ -1,4 +1,4 @@
 export { authorize } from "./authorize.js";
-export { tokenKeeper } from "./keeper.js";
+export { tokenKeeper, } from "./keeper.js";
 export { requestTokens, revokeToken, TOKEN_LOG_ALLOW, TOKEN_LOG_EVENT } from "./requests.js";
 export { credentialStorage, driveSessionCodec, oauthAccount, standardCodec, zoomTokenCodec, } from "./storage.js";

package/dist/oauth/keeper.d.ts

@@ -23,9 +23,16 @@ export type SignInOptions = Omit<AuthorizeOptions, "provider" | "signal"> & {
     /** Runs before anything is saved; it may refuse the account or add fields to the entry (drive's `principal`). */
     accept?: (tokens: TokenSet) => Promise<Record<string, unknown> | undefined> | Record<string, unknown> | undefined;
 };
+export interface TokensOptions {
+    /**
+     * The server refused the access token this keeper last answered, though `expiresAt` called it fresh (a revoked
+     * session): refresh under the lock anyway, unless another process already saved a different fresh one.
+     */
+    refresh?: boolean;
+}
 export interface TokenKeeper {
-    accessToken(): Promise<string>;
-    tokens(): Promise<TokenSet>;
+    accessToken(options?: TokensOptions): Promise<string>;
+    tokens(options?: TokensOptions): Promise<TokenSet>;
     signIn(options: SignInOptions): Promise<{
         scopes: string[];
     }>;

package/dist/oauth/keeper.js

@@ -87,25 +87,39 @@ export const tokenKeeper = (options) => {
         return kept && fresh(kept) && kept.refreshToken === saved.refreshToken ? kept : undefined;
     };
     const forget = () => refreshedInMemory.delete(lockPath);
-    const tokens = async () => {
+    let answered;
+    const answer = (given) => {
+        answered = given;
+        return given;
+    };
+    const tokens = async ({ refresh = false } = {}) => {
         const seen = storage.read();
         if (!seen)
             throw notSignedIn();
-        if (fresh(seen.tokens))
-            return seen.tokens;
-        const kept = remembered(seen.tokens);
-        if (kept)
-            return kept;
-        return shared(async () => {
+        if (!refresh) {
+            const kept = remembered(seen.tokens);
+            if (kept)
+                return answer(kept);
+            if (fresh(seen.tokens))
+                return answer(seen.tokens);
+        }
+        const refused = answered ?? remembered(seen.tokens) ?? seen.tokens;
+        return answer(await shared(async () => {
             const current = storage.read();
             if (!current)
                 throw notSignedIn();
+            const latest = remembered(current.tokens) ?? current.tokens;
             // Another process refreshed while this one waited for the lock: its result is the one to use.
-            if (fresh(current.tokens) || current.tokens.refreshToken !== seen.tokens.refreshToken)
-                return current.tokens;
-            const keptMeanwhile = remembered(current.tokens);
-            if (keptMeanwhile)
-                return keptMeanwhile;
+            if (refresh) {
+                if (latest.accessToken !== refused.accessToken && fresh(latest))
+                    return latest;
+            }
+            else {
+                if (latest !== current.tokens)
+                    return latest;
+                if (fresh(current.tokens) || current.tokens.refreshToken !== seen.tokens.refreshToken)
+                    return current.tokens;
+            }
             const client = clientOf(current);
             const refreshed = await exchange({ grant_type: "refresh_token", refresh_token: current.tokens.refreshToken }, context(client, current.tokens));
             // A rotated refresh token is saved even so: kept only in memory, it would die with the process.
@@ -114,12 +128,12 @@ export const tokenKeeper = (options) => {
             else
                 storage.write({ tokens: refreshed, client });
             return refreshed;
-        });
+        }));
     };
     return {
         tokens,
-        accessToken: async () => {
-            const current = await tokens();
+        accessToken: async (tokensOptions) => {
+            const current = await tokens(tokensOptions);
             if (!current.accessToken)
                 throw notSignedIn();
             return current.accessToken;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.536.0",
+  "version": "0.537.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",