agent-messenger 2.33.0 → 2.35.0

package/src/platforms/discord/commands/dm.ts

@@ -1,4 +1,4 @@
-import { Command } from 'commander'
+import { Command, InvalidArgumentError } from 'commander'
 
 import { handleError } from '@/shared/utils/error-handler'
 import { formatOutput } from '@/shared/utils/output'
@@ -7,6 +7,18 @@ import { DiscordClient } from '../client'
 import { DiscordCredentialManager } from '../credential-manager'
 import type { DiscordDMChannel } from '../types'
 
+function parseLimit(value: string): number {
+  const parsed = Number(value)
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw new InvalidArgumentError('Must be a positive integer.')
+  }
+  return parsed
+}
+
+function channelTypeLabel(type: number): string {
+  return type === 1 ? 'DM' : 'Group DM'
+}
+
 export async function listAction(options: { pretty?: boolean }): Promise<void> {
   try {
     const credManager = new DiscordCredentialManager()
@@ -22,7 +34,7 @@ export async function listAction(options: { pretty?: boolean }): Promise<void> {
 
     const output = channels.map((channel: DiscordDMChannel) => ({
       id: channel.id,
-      type: channel.type === 1 ? 'DM' : 'Group DM',
+      type: channelTypeLabel(channel.type),
       name: channel.name || null,
       recipients: channel.recipients.map((user) => ({
         id: user.id,
@@ -52,7 +64,7 @@ export async function createAction(userId: string, options: { pretty?: boolean }
 
     const output = {
       id: channel.id,
-      type: channel.type === 1 ? 'DM' : 'Group DM',
+      type: channelTypeLabel(channel.type),
       name: channel.name || null,
       recipients: channel.recipients.map((user) => ({
         id: user.id,
@@ -66,6 +78,42 @@ export async function createAction(userId: string, options: { pretty?: boolean }
   }
 }
 
+export async function unreadAction(options: { limit?: number; pretty?: boolean }): Promise<void> {
+  try {
+    const credManager = new DiscordCredentialManager()
+    const config = await credManager.load()
+
+    if (!config.token) {
+      console.log(formatOutput({ error: 'Not authenticated. Run "auth extract" first.' }, options.pretty))
+      process.exit(1)
+    }
+
+    const client = await new DiscordClient().login({ token: config.token })
+    const result = await client.getUnreadDMs({ limit: options.limit })
+
+    const output = {
+      channels: result.channels.map((channel) => ({
+        id: channel.id,
+        type: channelTypeLabel(channel.type),
+        name: channel.name,
+        recipients: channel.recipients.map((user) => ({
+          id: user.id,
+          username: user.username,
+        })),
+        last_message_id: channel.lastMessageId,
+        unread_count: channel.unreadCount,
+      })),
+      count: result.count,
+      total_unread: result.totalUnread,
+      complete: result.complete,
+    }
+
+    console.log(formatOutput(output, options.pretty))
+  } catch (error) {
+    handleError(error as Error)
+  }
+}
+
 export const dmCommand = new Command('dm')
   .description('DM channel commands')
   .addCommand(
@@ -81,3 +129,15 @@ export const dmCommand = new Command('dm')
       .option('--pretty', 'Pretty print JSON output')
       .action(createAction),
   )
+  .addCommand(
+    new Command('unread')
+      .description('List unread DM and group-DM channels, newest first')
+      .option('--limit <n>', 'Max number of channels to return', parseLimit)
+      .option('--pretty', 'Pretty print JSON output')
+      .action((options) => {
+        unreadAction({
+          limit: options.limit,
+          pretty: options.pretty,
+        })
+      }),
+  )

package/src/platforms/discord/index.ts

@@ -26,6 +26,7 @@ export type {
   DiscordMessage,
   DiscordReaction,
   DiscordReadState,
+  DiscordReadStateSnapshot,
   DiscordRelationship,
   DiscordRole,
   DiscordRoleColors,
@@ -33,6 +34,8 @@ export type {
   DiscordSearchOptions,
   DiscordSearchResponse,
   DiscordSearchResult,
+  DiscordUnreadDM,
+  DiscordUnreadDMsResult,
   DiscordUnreadMention,
   DiscordUnreadMentionsResult,
   DiscordUser,

package/src/platforms/discord/listener.test.ts

@@ -143,19 +143,28 @@ describe('parseReadStates', () => {
       { id: 'c2', read_state_type: 2, mention_count: 5 },
     ])
 
-    expect(result).toEqual([{ channelId: 'c1', lastMessageId: '100', mentionCount: 1 }])
+    expect(result.states).toEqual([{ channelId: 'c1', lastMessageId: '100', mentionCount: 1 }])
   })
 
   it('normalizes missing last_message_id and mention_count', () => {
     const result = parseReadStates([{ id: 'c1' }])
 
-    expect(result).toEqual([{ channelId: 'c1', lastMessageId: null, mentionCount: 0 }])
+    expect(result.states).toEqual([{ channelId: 'c1', lastMessageId: null, mentionCount: 0 }])
   })
 
   it('skips malformed entries but keeps valid ones', () => {
     const result = parseReadStates([{ id: 'c1', mention_count: 1 }, { mention_count: 3 }])
 
-    expect(result).toEqual([{ channelId: 'c1', lastMessageId: null, mentionCount: 1 }])
+    expect(result.states).toEqual([{ channelId: 'c1', lastMessageId: null, mentionCount: 1 }])
+  })
+
+  it('treats a bare array payload as complete', () => {
+    expect(parseReadStates([{ id: 'c1' }]).partial).toBe(false)
+  })
+
+  it('reads the partial flag from a versioned payload', () => {
+    expect(parseReadStates({ entries: [{ id: 'c1' }], version: 7, partial: true }).partial).toBe(true)
+    expect(parseReadStates({ entries: [{ id: 'c1' }], version: 7 }).partial).toBe(false)
   })
 
   it('throws on a non-array, non-versioned payload', () => {

package/src/platforms/discord/listener.ts

@@ -3,16 +3,22 @@ import { EventEmitter } from 'events'
 import WebSocket from 'ws'
 
 import type { DiscordClient } from './client'
-import type { DiscordListenerEventMap, DiscordGatewayGenericEvent, DiscordReadState } from './types'
+import type {
+  DiscordListenerEventMap,
+  DiscordGatewayGenericEvent,
+  DiscordReadState,
+  DiscordReadStateSnapshot,
+} from './types'
 import { DiscordGatewayOpcode, DiscordRawReadStateSchema, DiscordReadyReadStateSchema } from './types'
 
-export function parseReadStates(value: unknown): DiscordReadState[] {
+export function parseReadStates(value: unknown): DiscordReadStateSnapshot {
   const parsed = DiscordReadyReadStateSchema.safeParse(value)
   if (!parsed.success) {
     throw new Error('Discord READY contained an invalid read_state payload')
   }
 
   const entries = Array.isArray(parsed.data) ? parsed.data : parsed.data.entries
+  const partial = Array.isArray(parsed.data) ? false : (parsed.data.partial ?? false)
 
   const readStates: DiscordReadState[] = []
   for (const entry of entries) {
@@ -25,7 +31,7 @@ export function parseReadStates(value: unknown): DiscordReadState[] {
       mentionCount: state.data.mention_count ?? 0,
     })
   }
-  return readStates
+  return { states: readStates, partial }
 }
 
 const GATEWAY_URL = 'wss://gateway.discord.gg/?v=10&encoding=json'
@@ -80,6 +86,7 @@ export class DiscordListener {
   private token: string | null = null
   private cachedUser: { id: string; username: string } | null = null
   private readState: DiscordReadState[] | null = null
+  private readStatePartial = false
   private generation = 0
   private startPromise: Promise<void> | null = null
   private pendingStartReject: ((error: Error) => void) | null = null
@@ -202,6 +209,10 @@ export class DiscordListener {
     return this.readState
   }
 
+  getReadStateSnapshot(): DiscordReadStateSnapshot | null {
+    return this.readState === null ? null : { states: this.readState, partial: this.readStatePartial }
+  }
+
   private isCurrent(generation: number, ws?: WebSocket): boolean {
     if (generation !== this.generation || !this.running) return false
     if (ws !== undefined && this.ws !== ws) return false
@@ -326,7 +337,9 @@ export class DiscordListener {
       this.sessionId = d.session_id
       this.resumeGatewayUrl = d.resume_gateway_url
       this.cachedUser = d.user
-      this.readState = d.read_state === undefined ? [] : parseReadStates(d.read_state)
+      const snapshot = d.read_state === undefined ? null : parseReadStates(d.read_state)
+      this.readState = snapshot === null ? [] : snapshot.states
+      this.readStatePartial = snapshot?.partial ?? false
       this.reconnectAttempts = 0
       this.emitter.emit('connected', { user: d.user, sessionId: d.session_id })
       return

package/src/platforms/discord/types.ts

@@ -139,6 +139,13 @@ export interface DiscordReadState {
   mentionCount: number
 }
 
+// When partial is true the entries are an incomplete slice, so an absent channel
+// carries no information: it may simply have been left out of this payload.
+export interface DiscordReadStateSnapshot {
+  states: DiscordReadState[]
+  partial: boolean
+}
+
 export interface DiscordUnreadMention extends DiscordMention {
   mention_count: number
 }
@@ -153,6 +160,31 @@ export interface DiscordUnreadMentionsResult {
   windowDays: number
 }
 
+export interface DiscordUnreadDM {
+  id: string
+  type: number
+  name: string | null
+  recipients: DiscordUser[]
+  lastMessageId: string
+  // Discord's own badge counter, which counts every message in a DM rather than
+  // only mentions. null when the channel has no READY read-state entry (count
+  // unknown); 0 when the DM is muted, since muting stops the counter but still
+  // leaves the channel unread.
+  unreadCount: number | null
+}
+
+// count and totalUnread describe every unread DM found, so they stay truthful when
+// `channels` is capped by a limit. totalUnread sums known counts only, meaning
+// channels with an unknown count contribute nothing to it. complete is false when
+// Discord delivered a partial read state, in which case never-opened DMs may be
+// missing from the result.
+export interface DiscordUnreadDMsResult {
+  channels: DiscordUnreadDM[]
+  count: number
+  totalUnread: number
+  complete: boolean
+}
+
 export interface DiscordSearchResult {
   id: string
   channel_id: string
@@ -512,7 +544,11 @@ export type DiscordRawReadState = z.infer<typeof DiscordRawReadStateSchema>
 // VERSIONED_READ_STATES gateway capability is negotiated.
 export const DiscordReadyReadStateSchema = z.union([
   z.array(z.unknown()),
-  z.object({ entries: z.array(z.unknown()), version: z.number().optional() }),
+  z.object({
+    entries: z.array(z.unknown()),
+    version: z.number().optional(),
+    partial: z.boolean().optional(),
+  }),
 ])
 
 export type DiscordGatewayEvent =

package/src/platforms/kakaotalk/auth/kakao-login.ts

@@ -7,8 +7,8 @@ import type { KakaoDeviceType, KakaoLoginResult } from '../types'
 const ANDROID_APP_VERSION = '25.9.2'
 const ANDROID_OS_VERSION = '13'
 const ANDROID_API_LEVEL = '33'
-const ANDROID_AGENT = `android/${ANDROID_APP_VERSION}/ko`
-const ANDROID_USER_AGENT = `KT/${ANDROID_APP_VERSION} An/${ANDROID_OS_VERSION} ko`
+export const ANDROID_AGENT = `android/${ANDROID_APP_VERSION}/ko`
+export const ANDROID_USER_AGENT = `KT/${ANDROID_APP_VERSION} An/${ANDROID_OS_VERSION} ko`
 const ANDROID_LOGIN_URL = 'https://katalk.kakao.com/android/account/login.json'
 const ANDROID_PASSCODE_URL = 'https://katalk.kakao.com/android/account/passcodeLogin/generate'
 const ANDROID_REGISTER_URL = 'https://katalk.kakao.com/android/account/passcodeLogin/registerDevice'

package/src/platforms/kakaotalk/auth/oauth-refresh.test.ts

@@ -0,0 +1,225 @@
+import { describe, expect, it, mock } from 'bun:test'
+
+import { KakaoOAuthRefreshError, refreshKakaoOAuthToken } from './oauth-refresh'
+
+const HEX_DEVICE_UUID = 'a'.repeat(64)
+const credentials = {
+  accessToken: 'access-secret',
+  refreshToken: 'refresh-secret',
+  deviceUuid: HEX_DEVICE_UUID,
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  })
+}
+
+function captureError(promise: Promise<unknown>): Promise<KakaoOAuthRefreshError> {
+  return promise.then(
+    () => {
+      throw new Error('Expected refresh to fail')
+    },
+    (error: unknown) => {
+      expect(error).toBeInstanceOf(KakaoOAuthRefreshError)
+      return error as KakaoOAuthRefreshError
+    },
+  )
+}
+
+function expectSecretsRedacted(error: Error, ...secrets: string[]): void {
+  const rendered = `${String(error)}\n${error.stack ?? ''}\n${JSON.stringify(error)}`
+  for (const secret of secrets) {
+    expect(rendered).not.toContain(secret)
+  }
+}
+
+describe('refreshKakaoOAuthToken', () => {
+  it('sends the Android sub-device refresh request and returns rotated tokens', async () => {
+    const fetchImpl = mock(async () =>
+      jsonResponse({
+        status: 0,
+        access_token: 'new-access',
+        refresh_token: 'new-refresh',
+        token_type: 'bearer',
+        expires_in: 3600,
+      }),
+    )
+
+    const result = await refreshKakaoOAuthToken(credentials, {
+      fetchImpl,
+      requestId: () => 'request-id',
+    })
+
+    expect(result).toEqual({
+      accessToken: 'new-access',
+      refreshToken: 'new-refresh',
+      tokenType: 'bearer',
+      expiresIn: 3600,
+    })
+    expect(fetchImpl).toHaveBeenCalledTimes(1)
+
+    const [url, init] = fetchImpl.mock.calls[0] as unknown as [string, RequestInit]
+    expect(url).toBe('https://katalk.kakao.com/android/account/oauth2_token.json')
+    expect(init.method).toBe('POST')
+    expect(init.headers).toEqual({
+      A: 'android/25.9.2/ko',
+      Authorization: `access-secret-${HEX_DEVICE_UUID}`,
+      'User-Agent': 'KT/25.9.2 An/13 ko',
+      'Accept-Language': 'ko',
+      'Content-Type': 'application/json; charset=utf-8',
+      C: 'request-id',
+      Connection: 'Close',
+    })
+    expect(JSON.parse(String(init.body))).toEqual({
+      access_token: credentials.accessToken,
+      refresh_token: credentials.refreshToken,
+      grant_type: 'refresh_token',
+    })
+    expect(init.signal).toBeInstanceOf(AbortSignal)
+  })
+
+  it('derives the Android device id for a non-hex UUID', async () => {
+    const fetchImpl = mock(async () => jsonResponse({ status: 0, access_token: 'new-access' }))
+
+    await refreshKakaoOAuthToken({ ...credentials, deviceUuid: 'device-uuid' }, { fetchImpl })
+
+    const [, init] = fetchImpl.mock.calls[0] as unknown as [string, RequestInit]
+    expect(init.headers).toMatchObject({
+      Authorization: 'access-secret-db214b8bbba42ef7a5fbc4c1bbba91305178ade87b29f1378f55b69fc04caac5',
+    })
+  })
+
+  it('preserves the input refresh token when Kakao does not rotate it', async () => {
+    const fetchImpl = mock(async () => jsonResponse({ status: 0, access_token: 'new-access' }))
+
+    await expect(refreshKakaoOAuthToken(credentials, { fetchImpl })).resolves.toEqual({
+      accessToken: 'new-access',
+      refreshToken: credentials.refreshToken,
+      tokenType: undefined,
+      expiresIn: undefined,
+    })
+  })
+
+  it('rejects missing credentials before making a request', async () => {
+    const fetchImpl = mock(async () => jsonResponse({ status: 0, access_token: 'unused' }))
+
+    const error = await captureError(refreshKakaoOAuthToken({ ...credentials, refreshToken: '' }, { fetchImpl }))
+
+    expect(error).toMatchObject({ code: 'refresh_credentials_missing' })
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  it('classifies a Kakao rejection with safe status metadata', async () => {
+    const fetchImpl = mock(async () =>
+      jsonResponse({ status: -950, message: 'rejected', raw: 'raw-response-secret' }, 401),
+    )
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl }))
+
+    expect(error).toMatchObject({ code: 'refresh_rejected', serverStatus: -950, httpStatus: 401 })
+    expectSecretsRedacted(error, credentials.accessToken, credentials.refreshToken, 'raw-response-secret')
+  })
+
+  it('classifies an HTTP failure without a Kakao status', async () => {
+    const fetchImpl = mock(async () => jsonResponse({ message: 'unavailable' }, 503))
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl }))
+
+    expect(error).toMatchObject({ code: 'refresh_http_error', httpStatus: 503 })
+    expect(error.serverStatus).toBeUndefined()
+  })
+
+  it('rejects a malformed successful response without exposing the body', async () => {
+    const fetchImpl = mock(async () => jsonResponse({ status: 0, access_token: '', raw: 'do-not-log' }))
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl }))
+
+    expect(error).toMatchObject({ code: 'refresh_malformed_response', httpStatus: 200 })
+    expectSecretsRedacted(error, credentials.accessToken, credentials.refreshToken, 'do-not-log')
+  })
+
+  it('rejects a non-JSON response without exposing its text', async () => {
+    const fetchImpl = mock(async () => new Response('body-secret', { status: 200 }))
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl }))
+
+    expect(error).toMatchObject({ code: 'refresh_malformed_response', httpStatus: 200 })
+    expectSecretsRedacted(error, credentials.accessToken, credentials.refreshToken, 'body-secret')
+  })
+
+  it('aborts a request after the configured timeout', async () => {
+    const fetchImpl = mock(
+      async (_url: string | URL | Request, init?: RequestInit): Promise<Response> =>
+        await new Promise((_resolve, reject) => {
+          init?.signal?.addEventListener('abort', () => {
+            reject(Object.assign(new Error('timed out with access-secret'), { name: 'AbortError' }))
+          })
+        }),
+    )
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl, timeoutMs: 5 }))
+
+    expect(error).toMatchObject({ code: 'refresh_timeout' })
+    expectSecretsRedacted(error, credentials.accessToken, credentials.refreshToken)
+  })
+
+  it('keeps the timeout active while consuming a stalled response body', async () => {
+    const fetchImpl = mock(async (_url: string | URL | Request, init?: RequestInit): Promise<Response> => {
+      const body = new ReadableStream<Uint8Array>({
+        start(controller) {
+          const fallback = setTimeout(() => {
+            controller.error(Object.assign(new Error('stalled body access-secret'), { name: 'AbortError' }))
+          }, 50)
+
+          init?.signal?.addEventListener(
+            'abort',
+            () => {
+              clearTimeout(fallback)
+              controller.error(Object.assign(new Error('stalled body access-secret'), { name: 'AbortError' }))
+            },
+            { once: true },
+          )
+        },
+      })
+
+      return new Response(body, { status: 200, headers: { 'Content-Type': 'application/json' } })
+    })
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl, timeoutMs: 5 }))
+
+    expect(error).toMatchObject({ code: 'refresh_timeout' })
+    expectSecretsRedacted(error, credentials.accessToken, credentials.refreshToken)
+  })
+
+  it('classifies response body transport failures without retaining a secret-bearing cause', async () => {
+    const fetchImpl = mock(async (): Promise<Response> => {
+      const body = new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.error(new Error(`body failure ${credentials.accessToken} ${credentials.refreshToken}`))
+        },
+      })
+
+      return new Response(body, { status: 200, headers: { 'Content-Type': 'application/json' } })
+    })
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl }))
+
+    expect(error).toMatchObject({ code: 'refresh_request_failed' })
+    expect(error.cause).toBeUndefined()
+    expectSecretsRedacted(error, credentials.accessToken, credentials.refreshToken)
+  })
+
+  it('classifies network failures without retaining a secret-bearing cause', async () => {
+    const fetchImpl = mock(async () => {
+      throw new Error(`network failure ${credentials.accessToken} ${credentials.refreshToken}`)
+    })
+
+    const error = await captureError(refreshKakaoOAuthToken(credentials, { fetchImpl }))
+
+    expect(error).toMatchObject({ code: 'refresh_request_failed' })
+    expect(error.cause).toBeUndefined()
+    expectSecretsRedacted(error, credentials.accessToken, credentials.refreshToken)
+  })
+})

package/src/platforms/kakaotalk/auth/oauth-refresh.ts

@@ -0,0 +1,144 @@
+import { createHash, randomUUID } from 'node:crypto'
+
+import { ANDROID_AGENT, ANDROID_USER_AGENT } from './kakao-login'
+
+const ANDROID_OAUTH_REFRESH_URL = 'https://katalk.kakao.com/android/account/oauth2_token.json'
+const DEFAULT_REFRESH_TIMEOUT_MS = 15_000
+
+export type KakaoOAuthRefreshErrorCode =
+  | 'refresh_credentials_missing'
+  | 'refresh_http_error'
+  | 'refresh_malformed_response'
+  | 'refresh_rejected'
+  | 'refresh_request_failed'
+  | 'refresh_timeout'
+
+export class KakaoOAuthRefreshError extends Error {
+  readonly code: KakaoOAuthRefreshErrorCode
+  readonly serverStatus?: number
+  readonly httpStatus?: number
+
+  constructor(code: KakaoOAuthRefreshErrorCode, options?: { serverStatus?: number; httpStatus?: number }) {
+    super(`KakaoTalk OAuth token refresh failed (${code})`)
+    this.name = 'KakaoOAuthRefreshError'
+    this.code = code
+    this.serverStatus = options?.serverStatus
+    this.httpStatus = options?.httpStatus
+  }
+}
+
+export interface KakaoOAuthRefreshInput {
+  accessToken: string
+  refreshToken: string
+  deviceUuid: string
+}
+
+export interface KakaoOAuthRefreshResult {
+  accessToken: string
+  refreshToken: string
+  tokenType?: string
+  expiresIn?: number
+}
+
+export interface KakaoOAuthRefreshOptions {
+  fetchImpl?: typeof fetch
+  requestId?: () => string
+  timeoutMs?: number
+}
+
+function buildDeviceId(deviceUuid: string): string {
+  if (/^[a-f0-9]{40,64}$/i.test(deviceUuid)) return deviceUuid
+  return createHash('sha256').update(`dkljleskljfeisflssljeif ${deviceUuid}`, 'utf8').digest('hex')
+}
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null
+}
+
+function transportError(error: unknown, signal: AbortSignal): KakaoOAuthRefreshError {
+  const timedOut = signal.aborted || (error instanceof Error && error.name === 'AbortError')
+  return new KakaoOAuthRefreshError(timedOut ? 'refresh_timeout' : 'refresh_request_failed')
+}
+
+export async function refreshKakaoOAuthToken(
+  input: KakaoOAuthRefreshInput,
+  options: KakaoOAuthRefreshOptions = {},
+): Promise<KakaoOAuthRefreshResult> {
+  if (!input.accessToken || !input.refreshToken || !input.deviceUuid) {
+    throw new KakaoOAuthRefreshError('refresh_credentials_missing')
+  }
+
+  const fetchImpl = options.fetchImpl ?? fetch
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_REFRESH_TIMEOUT_MS)
+
+  try {
+    let response: Response
+    try {
+      response = await fetchImpl(ANDROID_OAUTH_REFRESH_URL, {
+        method: 'POST',
+        headers: {
+          A: ANDROID_AGENT,
+          Authorization: `${input.accessToken}-${buildDeviceId(input.deviceUuid)}`,
+          'User-Agent': ANDROID_USER_AGENT,
+          'Accept-Language': 'ko',
+          'Content-Type': 'application/json; charset=utf-8',
+          C: (options.requestId ?? randomUUID)(),
+          Connection: 'Close',
+        },
+        body: JSON.stringify({
+          access_token: input.accessToken,
+          refresh_token: input.refreshToken,
+          grant_type: 'refresh_token',
+        }),
+        signal: controller.signal,
+      })
+    } catch (error) {
+      throw transportError(error, controller.signal)
+    }
+
+    let body: Record<string, unknown> | null
+    try {
+      body = readRecord(await response.json())
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw transportError(error, controller.signal)
+      body = null
+    }
+
+    const serverStatus = body && typeof body.status === 'number' ? body.status : undefined
+    if (!response.ok) {
+      throw new KakaoOAuthRefreshError(
+        serverStatus !== undefined && serverStatus !== 0 ? 'refresh_rejected' : 'refresh_http_error',
+        { serverStatus: serverStatus !== 0 ? serverStatus : undefined, httpStatus: response.status },
+      )
+    }
+
+    if (!body) {
+      throw new KakaoOAuthRefreshError('refresh_malformed_response', { httpStatus: response.status })
+    }
+
+    if (serverStatus !== undefined && serverStatus !== 0) {
+      throw new KakaoOAuthRefreshError('refresh_rejected', {
+        serverStatus,
+        httpStatus: response.status,
+      })
+    }
+
+    const accessToken = typeof body.access_token === 'string' ? body.access_token : ''
+    if (!accessToken) {
+      throw new KakaoOAuthRefreshError('refresh_malformed_response', { httpStatus: response.status })
+    }
+
+    return {
+      accessToken,
+      refreshToken:
+        typeof body.refresh_token === 'string' && body.refresh_token ? body.refresh_token : input.refreshToken,
+      tokenType: typeof body.token_type === 'string' && body.token_type ? body.token_type : undefined,
+      expiresIn: typeof body.expires_in === 'number' ? body.expires_in : undefined,
+    }
+  } finally {
+    clearTimeout(timeout)
+  }
+}