aismemory 0.6.2 → 0.7.1

package/dist/__tests__/token-manager.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.test.js","sourceRoot":"","sources":["../../src/__tests__/token-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvL,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAWH;;;;;GAKG;AACH,SAAS,cAAc;IAKrB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAyB,EAAE;QAC/C,SAAS,EAAE,CAAC;QACZ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAChG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB;IAIzB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,SAAwB,EACxB,MAAM,GAAG,MAAM,EACf,QAAQ,GAAG,GAAG;IAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,SAAS,EAAE;YAAE,OAAO;QACxB,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oHAAoH,EAAE,KAAK,IAAI,EAAE;QAClI,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAEjF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAErC,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;QAElE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;QAC5E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEzC,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;QACxH,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,uBAAuB;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErB,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,4CAA4C;QAC1F,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,wEAAwE;QACxE,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3E,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,6CAA6C;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0IAA0I,EAAE,KAAK,IAAI,EAAE;QACxJ,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,qCAAqC;QACjE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErB,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C;QAEzF,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC;QAE9E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAEvE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE9E,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,sCAAsC;QAEpF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uIAAuI,EAAE,KAAK,IAAI,EAAE;QACrJ,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,4EAA4E;QAClG,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,oEAAoE;QACpE,mEAAmE;QACnE,+CAA+C;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,iEAAiE;QACjE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,oEAAoE;QACpE,8DAA8D;QAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6IAA6I,EAAE,KAAK,IAAI,EAAE;QAC3J,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,wCAAwC;QAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,qEAAqE;QACrE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;QAExD,GAAG,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,mDAAmD;QAC9F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,sEAAsE;QAExG,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;QAChE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,kFAAkF;QAClF,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sHAAsH,EAAE,KAAK,IAAI,EAAE;QACpI,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,uBAAuB;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErB,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,2DAA2D;QACzG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,oEAAoE;QACpE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,GAAG,CAAC,UAAU,EAAE,CAAC;QAEjB,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,4DAA4D;QAE1F,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iEAAiE;IACjE,4EAA4E;IAE5E,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,oFAAoF;QAC1G,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvC,GAAG,CAAC,cAAc,EAAE;YACpB,GAAG,CAAC,cAAc,EAAE;YACpB,GAAG,CAAC,cAAc,EAAE;SACrB,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,kEAAkE;QAClE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4IAA4I,EAAE,KAAK,IAAI,EAAE;QAC1J,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YACtC,IAAI,IAAI,GAAkB,IAAI,CAAC;YAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAmD,EAAE;gBAC3E,SAAS,EAAE,CAAC;gBACZ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,EAAE,CAAC,CAAC;gBAC9C,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5F,CAAC,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAErF,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,gCAAgC;YAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,GAAG,MAAM,CAAC;YAEd,sEAAsE;YACtE,iDAAiD;YACjD,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,wEAAwE;YACnH,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1B,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,yEAAyE;YACnH,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1B,0DAA0D;YAC1D,iEAAiE;YACjE,6DAA6D;YAC7D,mEAAmE;YACnE,wDAAwD;YACxD,sDAAsD;YACtD,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YACtD,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;YAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,uDAAuD;YAElF,iEAAiE;YACjE,wCAAwC;YACxC,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;YACrD,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1B,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;QAC5E,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,sEAAsE;QACtE,uEAAuE;QACvE,gBAAgB;QAChB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAmD,EAAE;YAC/E,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzF,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAmD,EAAE;YACnF,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,IAAI,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU;QACvG,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAE7F,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,mEAAmE;QACnE,6CAA6C;QAC7C,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB;QACnE,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iKAAiK,EAAE,KAAK,IAAI,EAAE;QAC/K,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc;QAC1C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErB,sEAAsE;QACtE,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,sDAAsD;QACpG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACpF,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,GAAG,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAmD,EAAE;YAC9E,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,sEAAsE;QACtE,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/token-rejection-reauth-e2e.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/token-rejection-reauth-e2e.test.js

@@ -0,0 +1,219 @@
+/**
+ * Final-review wave (2026-08-24) — CRITICAL fix: `TokenManager.invalidate()`
+ * wired to the mid-session 401 branch.
+ *
+ * Reproduces the JWT_SECRET-rotation scenario (CORBOT-A5BBD580): AIS
+ * rejects a token that is still time-valid from the client's point of view
+ * (e.g. the server rotated its signing secret). Before this fix,
+ * `ensureCredentials`'s key-enrolled path cleared the outer `creds` variable
+ * on a 401 but re-read the SAME rejected token straight back out of the
+ * TokenManager's `current` (still time-valid, so `getCredentials()` returned
+ * it via the fast path) — the "retry" was a no-op that re-sent the exact
+ * token AIS had just rejected. `tokenManager.invalidate()` drops `current`
+ * so the retry's `ensureCredentials()` call actually re-runs challenge/prove.
+ *
+ * Also covers the companion Fix 3 (restored `auth.key.success` telemetry +
+ * the one-line stderr confirmation on the first successful key-enrolled
+ * acquire): asserts both appear exactly once across a session that spans
+ * multiple tool calls and one forced re-auth.
+ *
+ * Follows the fake-AIS + spawned-built-binary pattern of
+ * silent-renewal-e2e.test.ts / agent-load-session-override-e2e.test.ts.
+ * `isAuthErrorResult` (src/auth-staleness.ts) is what detects the 401 body
+ * below — it requires `{ success: false, error: { code: 'TOKEN_EXPIRED' |
+ * 'INVALID_TOKEN' } }`, so the fake server's rejection body matches that
+ * shape exactly.
+ */
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { mkdtempSync, mkdirSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'path';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { generateAndSaveKeypair } from '../key-auth.js';
+// Long enough that the TokenManager's 75%-of-TTL background renewal never
+// fires during this short test — the retry the test exercises must be
+// driven purely by the mid-session 401, not by an incidental renewal.
+const LONG_TTL_MS = 60_000;
+let proveCalls = 0;
+/** GET /v1/agents/agent-1 (exact path) call count — the whoami data call. */
+let agentGetCalls = 0;
+function mintJwt() {
+    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({ sub: 'user-1', user_id: 'user-1', tenant_id: 'tenant-1', call: proveCalls })).toString('base64url');
+    return `${header}.${payload}.fakesig-${proveCalls}`;
+}
+describe('mid-session 401 (server-rejected, still-time-valid token) forces a real re-auth', () => {
+    let fakeAis;
+    let port = 0;
+    beforeAll(async () => {
+        fakeAis = createServer((req, res) => {
+            req.on('data', () => { });
+            req.on('end', () => {
+                const url = req.url ?? '';
+                if (url === '/v1/auth/challenge' && req.method === 'POST') {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: { nonce: 'test-nonce', exp: Math.floor(Date.now() / 1000) + 60, hmac: 'test-hmac' },
+                    }));
+                    return;
+                }
+                if (url === '/v1/auth/did-prove' && req.method === 'POST') {
+                    proveCalls += 1;
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: { bearerToken: mintJwt(), expiresAt: new Date(Date.now() + LONG_TTL_MS).toISOString() },
+                    }));
+                    return;
+                }
+                if (url.startsWith('/v1/agents') && !url.includes('/v1/agents/agent-') && req.method === 'GET') {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: {
+                            agents: [{ id: 'agent-1', name: 'Agent1', status: 'active' }],
+                            pagination: { total: 1, page: 1, limit: 100, hasMore: false },
+                        },
+                    }));
+                    return;
+                }
+                if (url === '/v1/agents/agent-1' && req.method === 'GET') {
+                    agentGetCalls += 1;
+                    // Reject exactly the SECOND data call — simulates AIS rejecting a
+                    // still-time-valid token mid-session (e.g. JWT_SECRET rotation).
+                    // The first call (initial whoami) and every call after the forced
+                    // re-auth succeed normally.
+                    if (agentGetCalls === 2) {
+                        res.writeHead(401, { 'content-type': 'application/json' });
+                        res.end(JSON.stringify({ success: false, error: { code: 'TOKEN_EXPIRED', message: 'token rejected' } }));
+                        return;
+                    }
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ success: true, data: { id: 'agent-1', name: 'Agent1', status: 'active' } }));
+                    return;
+                }
+                // Hydration / memory refresh / handoff / resolve / key-enroll — generic success.
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ success: true, data: {} }));
+            });
+        });
+        await new Promise((r) => {
+            fakeAis.listen(0, '127.0.0.1', () => {
+                const addr = fakeAis.address();
+                if (addr && typeof addr === 'object')
+                    port = addr.port;
+                r();
+            });
+        });
+    });
+    afterAll(async () => {
+        await new Promise((r) => fakeAis?.close(() => r()));
+    });
+    it('re-proves and the retried tool call succeeds; auth.key.success + its stderr line fire exactly once', async () => {
+        const distPath = resolve(__dirname, '..', '..', 'dist', 'index.js');
+        if (!existsSync(distPath)) {
+            throw new Error(`dist/index.js missing — run \`pnpm build\` first (looked at ${distPath})`);
+        }
+        proveCalls = 0;
+        agentGetCalls = 0;
+        const fakeHome = mkdtempSync(join(tmpdir(), 'aismem-token-rejection-'));
+        const aismemDir = join(fakeHome, '.aismemory');
+        mkdirSync(aismemDir, { recursive: true });
+        await generateAndSaveKeypair({
+            userId: 'user-1',
+            userDid: 'did:web:test:users:user-1',
+            keysDir: join(aismemDir, 'keys'),
+        });
+        let proc = null;
+        try {
+            proc = spawn('node', [distPath], {
+                env: { ...process.env, HOME: fakeHome, AIS_URL: `http://127.0.0.1:${port}`, AISMEMORY_TELEMETRY: '1' },
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdoutBuf = '';
+            let stderrBuf = '';
+            proc.stdout.on('data', (d) => { stdoutBuf += d.toString(); });
+            proc.stderr.on('data', (d) => { stderrBuf += d.toString(); });
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: 1, method: 'initialize',
+                params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'token-rejection-test', version: '0.0.0' } },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":1'), 5000, 'initialize response');
+            // ── whoami #1: establishes the manager's first acquire; ok. ──
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'whoami', arguments: {} },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":2'), 15000, 'first whoami');
+            expect(extractResponseText(stdoutBuf, 2)).toContain('agent-1');
+            expect(proveCalls).toBe(1);
+            expect(agentGetCalls).toBe(1);
+            // ── whoami #2: the fake server rejects this data call with a
+            // TOKEN_EXPIRED 401 even though the token is still time-valid. The
+            // client must invalidate() the manager, re-prove, and retry the tool
+            // call once — succeeding transparently in the SAME response. ──
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'whoami', arguments: {} },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":3'), 15000, 'whoami after server-side rejection');
+            const retriedText = extractResponseText(stdoutBuf, 3);
+            expect(retriedText).toContain('agent-1');
+            expect(retriedText).not.toContain('error');
+            // The rejection forced a real re-prove — not a no-op retry of the
+            // same rejected token — and the underlying data call was attempted a
+            // third time (2nd = rejected, 3rd = succeeded with the new token).
+            expect(proveCalls).toBe(2);
+            expect(agentGetCalls).toBe(3);
+            // The existing re-auth-and-retry log line fired exactly once.
+            const retryLogHits = stderrBuf.split('AIS rejected the cached token; re-authenticating and retrying once...').length - 1;
+            expect(retryLogHits).toBe(1);
+            // ── Fix 3: auth.key.success + its stderr confirmation fire on the
+            // FIRST successful key-enrolled acquire only — not again on the
+            // forced re-auth triggered by the 401 retry. ──
+            const stderrConfirmationHits = stderrBuf.split('Authenticated via DID key auth (no browser required)').length - 1;
+            expect(stderrConfirmationHits).toBe(1);
+            const telemetryKeySuccessHits = stderrBuf
+                .split('\n')
+                .filter((line) => line.includes('[aismemory-telemetry]') && line.includes('"auth.key.success"'))
+                .length;
+            expect(telemetryKeySuccessHits).toBe(1);
+        }
+        finally {
+            proc?.kill();
+            rmSync(fakeHome, { recursive: true, force: true });
+        }
+    }, 30000);
+});
+function waitFor(predicate, ms, label) {
+    return new Promise((resolveOuter, reject) => {
+        const start = Date.now();
+        const tick = () => {
+            if (predicate()) {
+                resolveOuter();
+                return;
+            }
+            if (Date.now() - start > ms) {
+                reject(new Error(`timeout waiting for ${label}`));
+                return;
+            }
+            setTimeout(tick, 50);
+        };
+        tick();
+    });
+}
+function extractResponseText(buf, id) {
+    for (const line of buf.split('\n')) {
+        if (!line.includes(`"id":${id}`))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            const text = parsed.result?.content?.[0]?.text;
+            if (typeof text === 'string')
+                return text;
+        }
+        catch { /* malformed line; skip */ }
+    }
+    return '';
+}
+//# sourceMappingURL=token-rejection-reauth-e2e.test.js.map

package/dist/__tests__/token-rejection-reauth-e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-rejection-reauth-e2e.test.js","sourceRoot":"","sources":["../../src/__tests__/token-rejection-reauth-e2e.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,0EAA0E;AAC1E,sEAAsE;AACtE,sEAAsE;AACtE,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,6EAA6E;AAC7E,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC9F,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,GAAG,MAAM,IAAI,OAAO,YAAY,UAAU,EAAE,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,iFAAiF,EAAE,GAAG,EAAE;IAC/F,IAAI,OAA2B,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACnE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAoD,CAAC,CAAC,CAAC;YAC3E,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;gBAE1B,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;qBAC1F,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1D,UAAU,IAAI,CAAC,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;qBAC9F,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC/F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;4BAC7D,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;yBAC9D;qBACF,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzD,aAAa,IAAI,CAAC,CAAC;oBACnB,kEAAkE;oBAClE,iEAAiE;oBACjE,kEAAkE;oBAClE,4BAA4B;oBAC5B,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;wBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;wBACzG,OAAO;oBACT,CAAC;oBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;gBAED,iFAAiF;gBACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;YAC5B,OAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACnC,MAAM,IAAI,GAAG,OAAQ,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvD,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,QAAQ,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,UAAU,GAAG,CAAC,CAAC;QACf,aAAa,GAAG,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,sBAAsB,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,2BAA2B;YACpC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,IAAI,GAA0C,IAAI,CAAC;QACvD,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;gBAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE;gBACtG,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY;gBAC3C,MAAM,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;aAC5H,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;YAE/E,gEAAgE;YAChE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;aACvF,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YACzE,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE9B,8DAA8D;YAC9D,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;aACvF,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;YAC/F,MAAM,WAAW,GAAG,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAE3C,kEAAkE;YAClE,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE9B,8DAA8D;YAC9D,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACzH,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE7B,mEAAmE;YACnE,gEAAgE;YAChE,gDAAgD;YAChD,MAAM,sBAAsB,GAAG,SAAS,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAClH,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvC,MAAM,uBAAuB,GAAG,SAAS;iBACtC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;iBAC/F,MAAM,CAAC;YACV,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,IAAI,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,SAAwB,EAAE,EAAU,EAAE,KAAa;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,SAAS,EAAE,EAAE,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3F,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,EAAU;IAClD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwD,CAAC;YACvF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/agent-preference.d.ts

@@ -0,0 +1,59 @@
+export interface AgentPreference {
+    schemaVersion: 2;
+    agentId: string;
+    tenantId: string;
+}
+/**
+ * Persist agent preference (schemaVersion + ids, no secrets) under
+ * ~/.aismemory/credentials.json with restrictive POSIX permissions
+ * (dir 0700, file 0600). Replaces legacy token-based persistence.
+ *
+ * F6 (CORBOT-48DD2E25): writes via a tmp file + renameSync so a crash
+ * mid-write can never leave a truncated/corrupt credentials.json behind,
+ * and two processes racing this same path never interleave partial writes
+ * (mirrors the atomic-write pattern in config.ts:59-62).
+ */
+export declare function saveAgentPreference(pref: {
+    agentId: string;
+    tenantId: string;
+}, home?: string): void;
+/**
+ * Migrate a legacy v1 credentials.json (token/agentId/tenantId/expiresAt) to
+ * the v2 schema (schemaVersion + ids only) IN PLACE, atomically — but ONLY
+ * when a device key is enrolled.
+ *
+ * F5a (CORBOT-48DD2E25): once a device key exists, the TokenManager mints
+ * its own tokens via key auth and the disk bearer is no longer needed —
+ * it must not survive past the first process start that observes both the
+ * v1 file and the enrolled key ("zero secrets at rest" was false for that
+ * window before this fix; the bearer used to live on disk until the next
+ * unrelated write).
+ *
+ * F5b (CORBOT-48DD2E25): when NO device key is enrolled, migrating here
+ * would strand that cohort with neither a live disk token nor a key to
+ * silently re-auth with — every silent stdio respawn would then demand a
+ * fresh browser bond, which 0.6.2 never did (it kept the token on disk and
+ * reconnected silently). So the v1 token is deliberately left in place
+ * until a key gets enrolled (this same check migrates it on the very next
+ * load) or a fresh device-flow completion overwrites the file.
+ *
+ * Best-effort: any read/parse/write failure is swallowed — migration must
+ * never block startup or credential loading. `home`/`hasKey` are
+ * parameterized for tests; production callers use the defaults.
+ */
+export declare function migrateCredentialsFileIfNeeded(home?: string, hasKey?: () => boolean): void;
+/**
+ * Load agent preference from ~/.aismemory/credentials.json.
+ * Handles both v2 files (agentId/tenantId only) and legacy v1 files
+ * (token/agentId/tenantId/expiresAt) — returns ids only.
+ * Returns null if file is missing or corrupt.
+ *
+ * Triggers migrateCredentialsFileIfNeeded() first (F5a/F5b) so every
+ * caller on this path — including the TokenManager's per-acquire
+ * resolveIdentity() in index.ts — helps migrate a v1 file left over from
+ * before the device key was enrolled.
+ */
+export declare function loadAgentPreference(home?: string, hasKey?: () => boolean): {
+    agentId: string;
+    tenantId: string;
+} | null;

package/dist/agent-preference.js

@@ -0,0 +1,127 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { credentialsDir, credentialsFilePath } from './oauth-credentials.js';
+import { hasEnrolledKey } from './key-auth.js';
+/** Default hasKey() check for `home`, wired to the real on-disk key store. */
+function defaultHasKey(home) {
+    return () => hasEnrolledKey({ keysDir: join(home, '.aismemory', 'keys') });
+}
+/**
+ * Persist agent preference (schemaVersion + ids, no secrets) under
+ * ~/.aismemory/credentials.json with restrictive POSIX permissions
+ * (dir 0700, file 0600). Replaces legacy token-based persistence.
+ *
+ * F6 (CORBOT-48DD2E25): writes via a tmp file + renameSync so a crash
+ * mid-write can never leave a truncated/corrupt credentials.json behind,
+ * and two processes racing this same path never interleave partial writes
+ * (mirrors the atomic-write pattern in config.ts:59-62).
+ */
+export function saveAgentPreference(pref, home = homedir()) {
+    const dir = credentialsDir(home);
+    const file = credentialsFilePath(home);
+    const tmp = `${file}.tmp`;
+    // Create directory with restrictive permissions (0700)
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Write the file with schemaVersion + ids (no legacy token/expiresAt)
+    const data = {
+        schemaVersion: 2,
+        agentId: pref.agentId,
+        tenantId: pref.tenantId,
+    };
+    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+    renameSync(tmp, file);
+    // chmod is the reliable path on POSIX
+    if (process.platform !== 'win32') {
+        chmodSync(file, 0o600);
+    }
+}
+/**
+ * Migrate a legacy v1 credentials.json (token/agentId/tenantId/expiresAt) to
+ * the v2 schema (schemaVersion + ids only) IN PLACE, atomically — but ONLY
+ * when a device key is enrolled.
+ *
+ * F5a (CORBOT-48DD2E25): once a device key exists, the TokenManager mints
+ * its own tokens via key auth and the disk bearer is no longer needed —
+ * it must not survive past the first process start that observes both the
+ * v1 file and the enrolled key ("zero secrets at rest" was false for that
+ * window before this fix; the bearer used to live on disk until the next
+ * unrelated write).
+ *
+ * F5b (CORBOT-48DD2E25): when NO device key is enrolled, migrating here
+ * would strand that cohort with neither a live disk token nor a key to
+ * silently re-auth with — every silent stdio respawn would then demand a
+ * fresh browser bond, which 0.6.2 never did (it kept the token on disk and
+ * reconnected silently). So the v1 token is deliberately left in place
+ * until a key gets enrolled (this same check migrates it on the very next
+ * load) or a fresh device-flow completion overwrites the file.
+ *
+ * Best-effort: any read/parse/write failure is swallowed — migration must
+ * never block startup or credential loading. `home`/`hasKey` are
+ * parameterized for tests; production callers use the defaults.
+ */
+export function migrateCredentialsFileIfNeeded(home = homedir(), hasKey = defaultHasKey(home)) {
+    const file = credentialsFilePath(home);
+    try {
+        if (!existsSync(file))
+            return;
+        const raw = readFileSync(file, 'utf-8');
+        const parsed = JSON.parse(raw);
+        // Already v2 (or an unrecognized shape) — nothing to migrate.
+        if (typeof parsed['token'] !== 'string')
+            return;
+        const agentId = parsed['agentId'];
+        const tenantId = parsed['tenantId'];
+        if (typeof agentId !== 'string' || typeof tenantId !== 'string')
+            return;
+        // F5b: do not strand the no-enrolled-key cohort.
+        if (!hasKey())
+            return;
+        const dir = credentialsDir(home);
+        const tmp = `${file}.tmp`;
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const data = { schemaVersion: 2, agentId, tenantId };
+        writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+        renameSync(tmp, file);
+        if (process.platform !== 'win32') {
+            chmodSync(file, 0o600);
+        }
+    }
+    catch {
+        // Best-effort — a migration failure must never block startup. The
+        // existing v1-tolerant parse in loadAgentPreference (below) and
+        // loadCredentials (index.ts) still work even if migration didn't run.
+    }
+}
+/**
+ * Load agent preference from ~/.aismemory/credentials.json.
+ * Handles both v2 files (agentId/tenantId only) and legacy v1 files
+ * (token/agentId/tenantId/expiresAt) — returns ids only.
+ * Returns null if file is missing or corrupt.
+ *
+ * Triggers migrateCredentialsFileIfNeeded() first (F5a/F5b) so every
+ * caller on this path — including the TokenManager's per-acquire
+ * resolveIdentity() in index.ts — helps migrate a v1 file left over from
+ * before the device key was enrolled.
+ */
+export function loadAgentPreference(home = homedir(), hasKey = defaultHasKey(home)) {
+    migrateCredentialsFileIfNeeded(home, hasKey);
+    const file = credentialsFilePath(home);
+    try {
+        if (!existsSync(file))
+            return null;
+        const content = readFileSync(file, 'utf-8');
+        const parsed = JSON.parse(content);
+        // Extract agentId and tenantId, ignoring any other fields (like token)
+        const agentId = parsed.agentId;
+        const tenantId = parsed.tenantId;
+        if (typeof agentId === 'string' && typeof tenantId === 'string') {
+            return { agentId, tenantId };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=agent-preference.js.map

package/dist/agent-preference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-preference.js","sourceRoot":"","sources":["../src/agent-preference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAQ/C,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA2C,EAC3C,OAAe,OAAO,EAAE;IAExB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAE1B,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjD,sEAAsE;IACtE,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IAEF,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEtB,sCAAsC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAe,OAAO,EAAE,EACxB,SAAwB,aAAa,CAAC,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAE9B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAE1D,8DAA8D;QAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO;QAEhD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO;QAExE,iDAAiD;QACjD,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO;QAEtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACrD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gEAAgE;QAChE,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,OAAO,EAAE,EACxB,SAAwB,aAAa,CAAC,IAAI,CAAC;IAK3C,8BAA8B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAE9D,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}