aismemory 0.6.2 → 0.7.1

package/dist/__tests__/split-brain-upgrade-e2e.test.js

@@ -0,0 +1,206 @@
+/**
+ * CORBOT-48DD2E25 (F4/F5a): upgrade split-brain regression lock.
+ *
+ * Reproduces the exact upgrade scenario the adjudication traced: a home
+ * directory that already has BOTH an enrolled device key (from a prior
+ * 0.7.0 session) AND a leftover v1 credentials.json (a stale bearer that
+ * predates the key — the shape every home was left in by 0.6.2, or by any
+ * 0.7.0 session before enrollKeyIfNeeded ran).
+ *
+ * Before the fix, `main()` unconditionally pinned `runPostAuth(creds)` to
+ * this stale disk token at startup (index.ts, the `if (creds) {...}` block
+ * after the transport connects) — so `hydrateIdentity`, the memory-refresh
+ * timer, and auto-handoff all closed over the stale bearer, while the very
+ * next tool call mints and uses a DIFFERENT token via the TokenManager
+ * (key-auth path). Two live tokens, one session: split-brain.
+ *
+ * This test proves the stale disk bearer is never sent to AIS at all (F4),
+ * and that the disk file itself gets migrated to v2 (no token key) by the
+ * time startup post-auth would have run (F5a).
+ */
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'path';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { generateAndSaveKeypair } from '../key-auth.js';
+const STALE_DISK_TOKEN = 'STALE-DISK-TOKEN-V1-MUST-NEVER-BE-SENT';
+function mintJwt(callNumber) {
+    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({ sub: 'user-1', user_id: 'user-1', tenant_id: 'tenant-1', call: callNumber })).toString('base64url');
+    return `${header}.${payload}.fakesig-${callNumber}`;
+}
+describe('upgrade split-brain: stale v1 disk token never used when a device key is enrolled', () => {
+    let fakeAis;
+    let port = 0;
+    let authHeadersSeen = [];
+    let proveCalls = 0;
+    beforeAll(async () => {
+        fakeAis = createServer((req, res) => {
+            req.on('data', () => { });
+            req.on('end', () => {
+                const url = req.url ?? '';
+                const auth = req.headers['authorization'] ?? '';
+                if (auth)
+                    authHeadersSeen.push(auth);
+                if (url === '/v1/auth/challenge' && req.method === 'POST') {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: { nonce: 'test-nonce', exp: Math.floor(Date.now() / 1000) + 60, hmac: 'test-hmac' },
+                    }));
+                    return;
+                }
+                if (url === '/v1/auth/did-prove' && req.method === 'POST') {
+                    proveCalls += 1;
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: {
+                            bearerToken: mintJwt(proveCalls),
+                            expiresAt: new Date(Date.now() + 3600 * 1000).toISOString(),
+                        },
+                    }));
+                    return;
+                }
+                if (url.startsWith('/v1/agents') && !url.includes('/v1/agents/agent-') && req.method === 'GET') {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: {
+                            agents: [{ id: 'agent-1', name: 'Agent1', status: 'active' }],
+                            pagination: { total: 1, page: 1, limit: 100, hasMore: false },
+                        },
+                    }));
+                    return;
+                }
+                if (url === '/v1/agents/agent-1' && req.method === 'GET') {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ success: true, data: { id: 'agent-1', name: 'Agent1', status: 'active' } }));
+                    return;
+                }
+                // hydration (/v1/agents/agent-1/full-context), memory refresh,
+                // handoff — generic success.
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ success: true, data: {} }));
+            });
+        });
+        await new Promise((resolveListen) => {
+            fakeAis.listen(0, '127.0.0.1', () => {
+                const addr = fakeAis.address();
+                if (addr && typeof addr === 'object')
+                    port = addr.port;
+                resolveListen();
+            });
+        });
+    });
+    afterAll(async () => {
+        await new Promise((r) => fakeAis?.close(() => r()));
+    });
+    it('startup with an enrolled key + stale v1 disk token: hydrate/refresh/handoff never carry the stale bearer, and the disk file is migrated to v2', async () => {
+        const distPath = resolve(__dirname, '..', '..', 'dist', 'index.js');
+        if (!existsSync(distPath)) {
+            throw new Error(`dist/index.js missing — run \`pnpm build\` first (looked at ${distPath})`);
+        }
+        authHeadersSeen = [];
+        proveCalls = 0;
+        const fakeHome = mkdtempSync(join(tmpdir(), 'aismem-split-brain-'));
+        const aismemDir = join(fakeHome, '.aismemory');
+        mkdirSync(aismemDir, { recursive: true });
+        // A device key is already enrolled (prior session).
+        await generateAndSaveKeypair({
+            userId: 'user-1',
+            userDid: 'did:web:test:users:user-1',
+            keysDir: join(aismemDir, 'keys'),
+        });
+        // AND a stale v1 credentials.json is still sitting on disk, valid
+        // (not expired) so the pre-fix code's isCredsStale() margin check
+        // would happily accept it as the "live" session.
+        const credsPath = join(aismemDir, 'credentials.json');
+        writeFileSync(credsPath, JSON.stringify({
+            token: STALE_DISK_TOKEN,
+            agentId: 'agent-1',
+            tenantId: 'tenant-1',
+            expiresAt: new Date(Date.now() + 3600 * 1000).toISOString(),
+        }));
+        let proc = null;
+        try {
+            proc = spawn('node', [distPath], {
+                env: { ...process.env, HOME: fakeHome, AIS_URL: `http://127.0.0.1:${port}` },
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdoutBuf = '';
+            proc.stdout.on('data', (d) => { stdoutBuf += d.toString(); });
+            proc.stderr.on('data', () => { });
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: 0, method: 'initialize',
+                params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'split-brain-test', version: '0.0.0' } },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":0'), 5000, 'initialize response');
+            // Drive one real tool call through the key-auth (TokenManager) path
+            // so post-auth wiring (hydrate/refresh/handoff) actually runs.
+            const id1 = 1;
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: id1, method: 'tools/call', params: { name: 'whoami', arguments: {} },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes(`"id":${id1}`), 15000, 'first whoami response');
+            expect(extractResponseText(stdoutBuf, id1)).toContain('agent-1');
+            // Give async post-auth (enrollKeyIfNeeded no-op, hydrateIdentity,
+            // applyMemoryRefresh, setupAutoHandoff) a moment to run.
+            await new Promise((r) => setTimeout(r, 500));
+            // F4: the stale disk bearer must NEVER have been sent to AIS, from
+            // startup through post-auth — every Authorization header observed
+            // must be a manager-minted token, never the stale one.
+            const staleBearerHeader = `Bearer ${STALE_DISK_TOKEN}`;
+            expect(authHeadersSeen).not.toContain(staleBearerHeader);
+            expect(proveCalls).toBeGreaterThan(0); // the TokenManager did mint its own token
+            // F5a: the on-disk file must already be migrated to v2 (ids only) —
+            // the stale bearer does not survive past this same process start.
+            const rawOnDisk = readFileSync(credsPath, 'utf-8');
+            const parsedOnDisk = JSON.parse(rawOnDisk);
+            expect(parsedOnDisk.schemaVersion).toBe(2);
+            expect(Object.prototype.hasOwnProperty.call(parsedOnDisk, 'token')).toBe(false);
+            expect(rawOnDisk).not.toContain(STALE_DISK_TOKEN);
+        }
+        finally {
+            proc?.kill();
+            try {
+                rmSync(fakeHome, { recursive: true, force: true });
+            }
+            catch { /* ignore */ }
+        }
+    }, 30000);
+});
+function waitFor(predicate, ms, label) {
+    return new Promise((resolveOuter, reject) => {
+        const start = Date.now();
+        const tick = () => {
+            if (predicate()) {
+                resolveOuter();
+                return;
+            }
+            if (Date.now() - start > ms) {
+                reject(new Error(`timeout waiting for ${label}`));
+                return;
+            }
+            setTimeout(tick, 50);
+        };
+        tick();
+    });
+}
+function extractResponseText(buf, id) {
+    for (const line of buf.split('\n')) {
+        if (!line.includes(`"id":${id}`))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            const text = parsed.result?.content?.[0]?.text;
+            if (typeof text === 'string')
+                return text;
+        }
+        catch { /* malformed line; skip */ }
+    }
+    return '';
+}
+//# sourceMappingURL=split-brain-upgrade-e2e.test.js.map

package/dist/__tests__/split-brain-upgrade-e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"split-brain-upgrade-e2e.test.js","sourceRoot":"","sources":["../../src/__tests__/split-brain-upgrade-e2e.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAElE,SAAS,OAAO,CAAC,UAAkB;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC9F,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,GAAG,MAAM,IAAI,OAAO,YAAY,UAAU,EAAE,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,mFAAmF,EAAE,GAAG,EAAE;IACjG,IAAI,OAA2B,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,eAAe,GAAa,EAAE,CAAC;IACnC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACnE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAmB,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBAChD,IAAI,IAAI;oBAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAErC,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;qBAC1F,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1D,UAAU,IAAI,CAAC,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC;4BAChC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;yBAC5D;qBACF,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC/F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;4BAC7D,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;yBAC9D;qBACF,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;gBAED,+DAA+D;gBAC/D,6BAA6B;gBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,aAAa,EAAE,EAAE;YACxC,OAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACnC,MAAM,IAAI,GAAG,OAAQ,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvD,aAAa,EAAE,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+IAA+I,EAAE,KAAK,IAAI,EAAE;QAC7J,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,QAAQ,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,eAAe,GAAG,EAAE,CAAC;QACrB,UAAU,GAAG,CAAC,CAAC;QAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,oDAAoD;QACpD,MAAM,sBAAsB,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,2BAA2B;YACpC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;SACjC,CAAC,CAAC;QAEH,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACtD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SAC5D,CAAC,CAAC,CAAC;QAEJ,IAAI,IAAI,GAA0C,IAAI,CAAC;QACvD,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;gBAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE;gBAC5E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAc,CAAC,CAAC,CAAC;YAE7C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY;gBAC3C,MAAM,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;aACxH,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;YAE/E,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,GAAG,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;aACzF,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;YACvF,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAEjE,kEAAkE;YAClE,yDAAyD;YACzD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAE7C,mEAAmE;YACnE,kEAAkE;YAClE,uDAAuD;YACvD,MAAM,iBAAiB,GAAG,UAAU,gBAAgB,EAAE,CAAC;YACvD,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;YAEjF,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YACtE,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,SAAwB,EAAE,EAAU,EAAE,KAAa;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,SAAS,EAAE,EAAE,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3F,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,EAAU;IAClD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwD,CAAC;YACvF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/__tests__/token-manager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/token-manager.test.js

@@ -0,0 +1,403 @@
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { hasEnrolledKey } from '../key-auth.js';
+import { createTokenManager, AisUnreachableError } from '../token-manager.js';
+describe('hasEnrolledKey', () => {
+    it('false for empty dir, true for one v1 key, false for two keys', () => {
+        const dir = mkdtempSync(join(tmpdir(), 'ais-keys-'));
+        expect(hasEnrolledKey({ keysDir: dir })).toBe(false);
+        writeFileSync(join(dir, 'a.json'), JSON.stringify({ version: 1, userId: 'u', userDid: 'd', keyType: 'Ed25519', privateKey: 'x', publicKey: 'y', publicKeyJwk: {}, createdAt: 'now' }));
+        expect(hasEnrolledKey({ keysDir: dir })).toBe(true);
+        writeFileSync(join(dir, 'b.json'), JSON.stringify({ version: 1 }));
+        expect(hasEnrolledKey({ keysDir: dir })).toBe(false);
+    });
+});
+/**
+ * Controllable `authenticate` test double. Starts in 'ok' mode returning
+ * sequential tokens (t1, t2, t3, ...), each with a 1h TTL computed from the
+ * current (possibly fake) clock at call time. `setMode('fail')` makes every
+ * subsequent call reject until switched back.
+ */
+function createAuthMock() {
+    let mode = 'ok';
+    let tokenIndex = 0;
+    let callCount = 0;
+    const fn = vi.fn(async () => {
+        callCount++;
+        if (mode === 'fail') {
+            throw new Error(`auth-failed-${callCount}`);
+        }
+        tokenIndex++;
+        return { token: `t${tokenIndex}`, expiresAt: new Date(Date.now() + 3_600_000).toISOString() };
+    });
+    return { fn, calls: () => callCount, setMode: (m) => { mode = m; } };
+}
+function createIdentityMock() {
+    let callCount = 0;
+    const fn = vi.fn(async () => {
+        callCount++;
+        return { agentId: 'agent-1', tenantId: 'tenant-1' };
+    });
+    return { fn, calls: () => callCount };
+}
+/**
+ * Advances fake timers in small steps until `predicate()` is true, so
+ * jittered backoff delays never need hand-calculated exact totals.
+ */
+async function advanceUntil(predicate, stepMs = 50_000, maxSteps = 200) {
+    for (let i = 0; i < maxSteps; i++) {
+        if (predicate())
+            return;
+        await vi.advanceTimersByTimeAsync(stepMs);
+    }
+    if (!predicate()) {
+        throw new Error(`advanceUntil: condition not met after ${maxSteps * stepMs}ms`);
+    }
+}
+describe('createTokenManager', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+    });
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+    it('bullet 1: first getCredentials() authenticates + resolves identity; concurrent callers share one in-flight acquire', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        const [c1, c2] = await Promise.all([mgr.getCredentials(), mgr.getCredentials()]);
+        expect(auth.calls()).toBe(1);
+        expect(identity.calls()).toBe(1);
+        expect(c1).toEqual(c2);
+        expect(c1.token).toBe('t1');
+        expect(c1.agentId).toBe('agent-1');
+        expect(c1.tenantId).toBe('tenant-1');
+        mgr.stop();
+    });
+    it('bullet 2: renews at 75% of TTL, swaps token/expiresAt in place, does not re-resolve identity', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        const first = await mgr.getCredentials();
+        expect(first.token).toBe('t1');
+        await vi.advanceTimersByTimeAsync(2_700_000); // 75% of the 1h TTL
+        expect(auth.calls()).toBe(2);
+        const second = await mgr.getCredentials();
+        expect(second.token).toBe('t2');
+        expect(identity.calls()).toBe(1); // identity resolved only on first acquire
+        expect(second.agentId).toBe('agent-1');
+        expect(second.tenantId).toBe('tenant-1');
+        mgr.stop();
+    });
+    it('bullet 3: renewal failure retries with backoff, emits renew.retry, and keeps returning the current token', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const events = [];
+        const mgr = createTokenManager({
+            authenticate: auth.fn,
+            resolveIdentity: identity.fn,
+            onEvent: (event, detail) => events.push({ event, detail }),
+        });
+        await mgr.getCredentials(); // acquire t1 (call #1)
+        auth.setMode('fail');
+        await vi.advanceTimersByTimeAsync(2_700_000); // trips the 75%-TTL renewal → call #2 fails
+        expect(auth.calls()).toBe(2);
+        expect(events.filter((e) => e.event === 'renew.retry')).toHaveLength(1);
+        // Current token (t1) is still returned; it has not hit hard expiry yet.
+        await expect(mgr.getCredentials()).resolves.toMatchObject({ token: 't1' });
+        await vi.advanceTimersByTimeAsync(6_500); // 5s backoff ± 20% jitter → next retry fires
+        expect(auth.calls()).toBe(3);
+        expect(events.filter((e) => e.event === 'renew.retry')).toHaveLength(2);
+        mgr.stop();
+    });
+    it('bullet 4: after hard expiry getCredentials() rejects with AisUnreachableError (retries continue; first success recovers with no restart)', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const events = [];
+        const mgr = createTokenManager({
+            authenticate: auth.fn,
+            resolveIdentity: identity.fn,
+            onEvent: (event, detail) => events.push({ event, detail }),
+        });
+        await mgr.getCredentials(); // acquire t1, expiresAt = start + 1h
+        auth.setMode('fail');
+        await vi.advanceTimersByTimeAsync(2_700_000); // 75% TTL → first failed renewal (call #2)
+        // Advance, in small steps, through repeated backoff retries (capped at
+        // 300s ± 20% jitter) until the token hard-expires and the event fires.
+        await advanceUntil(() => events.some((e) => e.event === 'renew.hard_expiry'));
+        expect(events.filter((e) => e.event === 'renew.hard_expiry')).toHaveLength(1);
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        await expect(mgr.getCredentials()).rejects.toThrow('AIS unreachable');
+        await expect(mgr.getCredentials()).rejects.toThrow('no action needed');
+        // hard_expiry must fire only once per outage even as failures continue —
+        // advance through at least one more capped-backoff retry attempt.
+        await vi.advanceTimersByTimeAsync(400_000);
+        expect(events.filter((e) => e.event === 'renew.hard_expiry')).toHaveLength(1);
+        // First success after the outage recovers getCredentials() with no restart
+        // (same manager instance; identity resolved only on the very first acquire).
+        const callsBeforeRecovery = auth.calls();
+        auth.setMode('ok');
+        await advanceUntil(() => auth.calls() > callsBeforeRecovery);
+        const recovered = await mgr.getCredentials();
+        expect(recovered.token).not.toBe('t1');
+        expect(recovered.agentId).toBe('agent-1');
+        expect(identity.calls()).toBe(1);
+        mgr.stop();
+    });
+    it('bullet 5: stop() clears all timers so no further renewal attempts occur', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        await mgr.getCredentials();
+        expect(auth.calls()).toBe(1);
+        mgr.stop();
+        await vi.advanceTimersByTimeAsync(3_600_000); // well past the 75%-TTL renewal point
+        expect(auth.calls()).toBe(1);
+    });
+    it('reliability fix: sequential getCredentials() calls during an outage share one backoff window instead of each hammering authenticate()', async () => {
+        const auth = createAuthMock();
+        auth.setMode('fail'); // AIS is down from the very first call — no successful acquire ever happens
+        const identity = createIdentityMock();
+        const events = [];
+        const mgr = createTokenManager({
+            authenticate: auth.fn,
+            resolveIdentity: identity.fn,
+            onEvent: (event, detail) => events.push({ event, detail }),
+        });
+        // N sequential (not concurrent) calls in quick succession — no time
+        // advances between them, mirroring a single MCP chat turn bursting
+        // several tool calls while AIS is unreachable.
+        const N = 5;
+        for (let i = 0; i < N; i++) {
+            await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        }
+        // Exactly one authenticate() attempt for the whole burst, not N.
+        expect(auth.calls()).toBe(1);
+        expect(events.filter((e) => e.event === 'renew.retry')).toHaveLength(1);
+        // After the backoff window (5s ± 20% jitter) elapses and the server
+        // heals, a getCredentials() call attempts again and succeeds.
+        auth.setMode('ok');
+        await vi.advanceTimersByTimeAsync(6_500);
+        const recovered = await mgr.getCredentials();
+        expect(recovered.agentId).toBe('agent-1');
+        expect(auth.calls()).toBe(2);
+        mgr.stop();
+    });
+    it('invalidate(): forces a fresh acquire, and the new token reschedules renewal from its own expiry (not the invalidated token\'s old schedule)', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        const first = await mgr.getCredentials(); // T=0: acquires t1, expires T=3_600_000
+        expect(first.token).toBe('t1');
+        expect(auth.calls()).toBe(1);
+        // Let time pass before invalidating so t1's original 75%-TTL renewal
+        // slot (T=2_700_000) and t2's fresh slot (computed from whenever the
+        // re-acquire actually happens) are measurably different.
+        await vi.advanceTimersByTimeAsync(100_000); // T=100_000
+        mgr.invalidate();
+        const second = await mgr.getCredentials(); // re-acquires t2 at T=100_000, expires T=3_700_000
+        expect(second.token).toBe('t2');
+        expect(auth.calls()).toBe(2);
+        expect(identity.calls()).toBe(1); // identity still resolved only once — invalidate() doesn't touch that
+        // t1's OLD renewal slot (absolute T=2_700_000) must not fire — it was
+        // superseded when the re-acquire rescheduled renewal off t2's expiry.
+        await vi.advanceTimersByTimeAsync(2_600_000); // now T=2_700_000
+        expect(auth.calls()).toBe(2);
+        // t2's OWN 75%-TTL slot (T=100_000 acquire + 2_700_000 = T=2_800_000) fires here.
+        await vi.advanceTimersByTimeAsync(100_000); // now T=2_800_000
+        expect(auth.calls()).toBe(3);
+        mgr.stop();
+    });
+    it('invalidate() during an active backoff window does not bypass the gate — the next getCredentials() still rejects fast', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        await mgr.getCredentials(); // acquire t1 (call #1)
+        auth.setMode('fail');
+        await vi.advanceTimersByTimeAsync(2_700_000); // 75% TTL -> renewal fails (call #2), backoff window opens
+        expect(auth.calls()).toBe(2);
+        // t1 is still time-valid (not hard-expired) at this point — without
+        // invalidate(), getCredentials() would just return it via the fast path
+        // without ever touching the backoff gate. invalidate() drops it so the
+        // gate is exercised, but must NOT reset retryDelayMs/lastAttemptAt.
+        mgr.invalidate();
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(auth.calls()).toBe(2); // gated — no extra authenticate() attempt inside the window
+        mgr.stop();
+    });
+    // ─────────────────────────────────────────────────────────────────────────
+    // CORBOT-4F7CAA8E: TokenManager hardening (F1, F2a, F2b, F3, F7)
+    // ─────────────────────────────────────────────────────────────────────────
+    it('F2a: recordFailure runs exactly once per failed inFlight regardless of concurrent waiter count', async () => {
+        const auth = createAuthMock();
+        auth.setMode('fail'); // AIS down from the first call — cold-start failure, shared by 3 concurrent waiters
+        const identity = createIdentityMock();
+        const events = [];
+        const mgr = createTokenManager({
+            authenticate: auth.fn,
+            resolveIdentity: identity.fn,
+            onEvent: (event, detail) => events.push({ event, detail }),
+        });
+        const results = await Promise.allSettled([
+            mgr.getCredentials(),
+            mgr.getCredentials(),
+            mgr.getCredentials(),
+        ]);
+        for (const r of results) {
+            expect(r.status).toBe('rejected');
+        }
+        // One shared inFlight authenticate() attempt for all 3 waiters...
+        expect(auth.calls()).toBe(1);
+        // ...and exactly one recordFailure — NOT one per waiter (which would
+        // escalate retryDelayMs 5s -> 10s -> 20s from a single failure).
+        expect(events.filter((e) => e.event === 'renew.retry')).toHaveLength(1);
+        mgr.stop();
+    });
+    it('F1: renew() joins the shared inFlight instead of racing a second authenticate() when the gate window and the jittered retry timer disagree', async () => {
+        // Force jitter() to always draw its maximum factor (1.2x) so the
+        // jittered retry timer fires measurably LATER than the un-jittered
+        // backoff value. Before the fix, getCredentials()'s gate compared
+        // against the un-jittered retryDelayMs, so a call landing in that gap
+        // would slip past the gate and start its OWN authenticate() call while
+        // the background renew() timer was still pending — a second, concurrent
+        // authenticate() for the same outage window. The race only matters once
+        // the current token has hard-expired (before that the fast path shields
+        // every call), so this test uses a short (40s) TTL to reach hard expiry
+        // quickly instead of the 1h TTL used elsewhere in this file.
+        const randomSpy = vi.spyOn(Math, 'random').mockReturnValue(1);
+        try {
+            const identity = createIdentityMock();
+            let mode = 'ok';
+            let callCount = 0;
+            const auth = vi.fn(async () => {
+                callCount++;
+                if (mode === 'fail') {
+                    throw new Error(`auth-failed-${callCount}`);
+                }
+                return { token: `t${callCount}`, expiresAt: new Date(Date.now() + 40_000).toISOString() };
+            });
+            const mgr = createTokenManager({ authenticate: auth, resolveIdentity: identity.fn });
+            await mgr.getCredentials(); // t1, call #1, expires T=40_000
+            expect(callCount).toBe(1);
+            mode = 'fail';
+            // scheduleRenewal floors at 30s (F7), so the background renewal fires
+            // at T=30_000 (before t1's own T=40_000 expiry).
+            await vi.advanceTimersByTimeAsync(30_000); // T=30_000 -> call #2 fails; retryDelayMs=5_000, nextAttemptAt=T=36_000
+            expect(callCount).toBe(2);
+            await vi.advanceTimersByTimeAsync(6_000); // T=36_000 -> call #3 fails; retryDelayMs=10_000, nextAttemptAt=T=48_000
+            expect(callCount).toBe(3);
+            // T=47_000: t1 (expired T=40_000) is now hard-expired, so
+            // getCredentials() actually reaches the gate instead of the fast
+            // path. The OLD, buggy gate compared against the un-jittered
+            // retryDelayMs (36_000+10_000=46_000) and would have let this call
+            // through — racing the real jittered schedule (36_000 +
+            // jitter(10_000)=48_000 with the pinned 1.2x factor).
+            await vi.advanceTimersByTimeAsync(11_000); // T=47_000
+            await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+            expect(callCount).toBe(3); // gated -- no extra authenticate() call from this call
+            // Cross the real jittered mark (T=48_000) -- only the background
+            // renew() timer makes the next attempt.
+            await vi.advanceTimersByTimeAsync(2_000); // T=49_000
+            expect(callCount).toBe(4);
+            mgr.stop();
+        }
+        finally {
+            randomSpy.mockRestore();
+        }
+    });
+    it('F3: a failed FIRST acquire (no current token) schedules the background retry loop, matching renew()\'s catch', async () => {
+        const auth = createAuthMock();
+        auth.setMode('fail'); // AIS down before any successful acquire ever happens
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(auth.calls()).toBe(1);
+        // Recovery must happen purely from the background retry loop this fix
+        // schedules on a cold-start failure — no further getCredentials() call
+        // is made here.
+        auth.setMode('ok');
+        await advanceUntil(() => auth.calls() > 1, 6_500, 5);
+        expect(auth.calls()).toBe(2);
+        mgr.stop();
+    });
+    it('F7: acquire() rejects an expiresAt in the past', async () => {
+        const identity = createIdentityMock();
+        let authCalls = 0;
+        const pastAuth = vi.fn(async () => {
+            authCalls++;
+            return { token: 'past-token', expiresAt: new Date(Date.now() - 1_000).toISOString() };
+        });
+        const mgr = createTokenManager({ authenticate: pastAuth, resolveIdentity: identity.fn });
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(authCalls).toBe(1);
+        mgr.stop();
+    });
+    it('F7: scheduleRenewal floors the renewal delay at 30s even for a short-TTL token', async () => {
+        const identity = createIdentityMock();
+        let authCalls = 0;
+        const shortTtlAuth = vi.fn(async () => {
+            authCalls++;
+            return { token: `s${authCalls}`, expiresAt: new Date(Date.now() + 10_000).toISOString() }; // 10s TTL
+        });
+        const mgr = createTokenManager({ authenticate: shortTtlAuth, resolveIdentity: identity.fn });
+        await mgr.getCredentials();
+        expect(authCalls).toBe(1);
+        // 75% of a 10s TTL is 7.5s -- without the 30s floor, renewal would
+        // already have fired well before this point.
+        await vi.advanceTimersByTimeAsync(20_000);
+        expect(authCalls).toBe(1);
+        await vi.advanceTimersByTimeAsync(10_500); // crosses the 30s floor
+        expect(authCalls).toBe(2);
+        mgr.stop();
+    });
+    it('F2b regression (escalated-backoff rotation strand): invalidate({resetBackoff:true}) after escalated backoff lets the next getCredentials() re-prove immediately', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        await mgr.getCredentials(); // t1, call #1
+        auth.setMode('fail');
+        // Escalate backoff through several failed renewals: 5s -> 10s -> 20s.
+        await vi.advanceTimersByTimeAsync(2_700_000); // 75% TTL -> renewal fails, call #2 (retryDelayMs=5s)
+        expect(auth.calls()).toBe(2);
+        await advanceUntil(() => auth.calls() >= 3, 6_500, 5); // call #3 (retryDelayMs=10s)
+        await advanceUntil(() => auth.calls() >= 4, 12_500, 5); // call #4 (retryDelayMs=20s)
+        expect(auth.calls()).toBe(4);
+        // t1 is still time-valid — a plain getCredentials() would just return it
+        // via the fast path. Simulate the server-rejection / JWT-rotation case
+        // invalidate() exists for: the server (now healthy again) rejects the
+        // still-time-valid token mid-session.
+        auth.setMode('ok');
+        mgr.invalidate({ resetBackoff: true });
+        // Must re-prove IMMEDIATELY — the escalated 20s backoff window (still
+        // very much active by wall-clock terms) must NOT gate this call.
+        const recovered = await mgr.getCredentials();
+        expect(recovered.token).not.toBe('t1');
+        expect(auth.calls()).toBe(5);
+        mgr.stop();
+    });
+    it('acquire(): a non-finite expiresAt from authenticate() rejects instead of scheduling a near-zero renewal loop', async () => {
+        const identity = createIdentityMock();
+        let authCalls = 0;
+        const badAuth = vi.fn(async () => {
+            authCalls++;
+            return { token: 'bad-token', expiresAt: 'garbage' };
+        });
+        const mgr = createTokenManager({ authenticate: badAuth, resolveIdentity: identity.fn });
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(authCalls).toBe(1);
+        // If the bad expiresAt had scheduled a renewal timer, its NaN-derived
+        // delay would tight-loop. Instead: the very next call, made with no
+        // time advance, must be gated by the normal backoff window rather than
+        // firing a second authenticate() attempt immediately.
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(authCalls).toBe(1);
+        // Only after the backoff window elapses does a second attempt happen.
+        await vi.advanceTimersByTimeAsync(6_500);
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(authCalls).toBe(2);
+        mgr.stop();
+    });
+});
+//# sourceMappingURL=token-manager.test.js.map