appmesh 1.3.3 → 3.1.0

package/src/appmesh_tcp.js

@@ -6,7 +6,7 @@ import fs from 'fs'
 import os from 'os'
 import { v1 as uuidv1 } from 'uuid'
 import msgpack from 'msgpack-lite'
-import AppMeshClient, { AppMeshError, TotpRequiredError, AppRemovedError, TransportDisconnectedError, DEFAULT_CA_FILE } from './appmesh.js'
+import AppMeshClient, { AppMeshError, AppRemovedError, TransportDisconnectedError, DEFAULT_CA_FILE } from './appmesh.js'
 
 // Constants
 const TCP_BLOCK_SIZE = 16 * 1024 - 128 // TLS-optimized chunk size
@@ -19,14 +19,7 @@ const HTTP_HEADER_KEY_X_RECV_FILE_SOCKET = 'X-Recv-File-Socket'
 const HTTP_HEADER_KEY_USER_AGENT = 'User-Agent'
 const HTTP_HEADER_KEY_X_FILE_PATH = 'X-File-Path'
 const HTTP_HEADER_KEY_AUTH = 'Authorization'
-
-// Auth endpoints returning a new access_token in the JSON body (allowlist per
-// docs/source/SDKContract.md "Auth Token Synchronization").
-// Login/auth/totp_validate: apply token only when the request carried X-Set-Cookie: true
-const AUTH_SET_COOKIE_PATHS = new Set(['/appmesh/login', '/appmesh/auth', '/appmesh/totp/validate'])
-// Renew/setup: always apply (client already has an active session)
-const AUTH_RENEW_PATHS = new Set(['/appmesh/token/renew', '/appmesh/totp/setup'])
-const LOGOFF_PATH = '/appmesh/self/logoff'
+const HTTP_HEADER_KEY_X_TARGET_HOST = 'X-Target-Host'
 
 /**
  * TCP transport for secure TLS connections and framed App Mesh messages.
@@ -342,7 +335,7 @@ class AppMeshClientTCP extends AppMeshClient {
     super('https://127.0.0.1:6060', sslConfig)
     this.tcpTransport = new TCPTransport(tcpAddress, sslConfig)
 
-    // Store JWT token explicitly since cookies don't work with TCP
+    // Store the caller-owned bearer explicitly for TCP requests.
     this._token = ''
   }
 
@@ -371,59 +364,17 @@ class AppMeshClientTCP extends AppMeshClient {
   }
 
   /**
-   * Handle token updates for transports that cannot rely on cookies.
-   *
-   * This method is called after login, renew_token, and authenticate operations.
-   * Since TCP doesn't support cookies, we store the token explicitly.
+   * Handle caller-owned bearer updates for TCP.
    *
    * @param {string} token - New JWT token
    * @private
    * @override
    */
   _handleTokenUpdate (token) {
-    // Base implementation stores the token and handles refresh scheduling
     super._handleTokenUpdate(token)
     this._token = token || ''
   }
 
-  /**
-   * Extract and apply a token from auth endpoint responses. TCP has no Set-Cookie,
-   * so the token comes from the JSON body — only on HTTP 200 and only for the
-   * SDKContract.md auth endpoint allowlist.
-   * @param {Object} response - Normalized response object from _request
-   * @param {string} path - Request URI path
-   * @param {Object} requestHeaders - Headers sent with the request
-   * @private
-   */
-  _syncTransportToken (response, path, requestHeaders) {
-    if (response.status !== 200) return
-
-    if (path === LOGOFF_PATH) {
-      this._handleTokenUpdate(null)
-      return
-    }
-
-    // Login/auth/totp_validate: apply only when client requested cookie mode
-    if (AUTH_SET_COOKIE_PATHS.has(path)) {
-      if (!requestHeaders || requestHeaders['X-Set-Cookie'] !== 'true') return
-    } else if (!AUTH_RENEW_PATHS.has(path)) {
-      return
-    }
-
-    let data = response.data
-    // Parse if it's a Buffer containing JSON
-    if (Buffer.isBuffer(data)) {
-      try {
-        data = JSON.parse(data.toString(ENCODING_UTF8))
-      } catch (e) {
-        return // Not JSON, ignore
-      }
-    }
-    if (data && data.access_token) {
-      this._handleTokenUpdate(data.access_token)
-    }
-  }
-
   /**
    * Send an App Mesh request over TCP transport and normalize the response shape.
    * @private
@@ -447,7 +398,13 @@ class AppMeshClientTCP extends AppMeshClient {
     // Add authentication token if available
     const token = this._getAccessToken()
     if (token) {
-      request.headers[HTTP_HEADER_KEY_AUTH] = token
+      request.headers[HTTP_HEADER_KEY_AUTH] = `Bearer ${token}`
+    }
+
+    if (this.forwardingHost) {
+      request.headers[HTTP_HEADER_KEY_X_TARGET_HOST] = this.forwardingHost.includes(':')
+        ? this.forwardingHost
+        : `${this.forwardingHost}:${this.tcpTransport.address[1]}`
     }
 
     if (options.headers) {
@@ -507,15 +464,9 @@ class AppMeshClientTCP extends AppMeshClient {
       config: options
     }
 
-    // Sync token from auth endpoint responses (login, authenticate, renew_token, logoff)
-    this._syncTransportToken(result, path, request.headers)
-
-    // Mirror the HTTP transport: never swallow a non-200 into a success value
-    if (result.status !== 200) {
+    // Mirror the HTTP transport: never swallow a non-2xx into a success value.
+    if (result.status < 200 || result.status >= 300) {
       const errMsg = this._extractErrorMessage(result.data)
-      if (result.status === 428) {
-        throw new TotpRequiredError(errMsg, result.data)
-      }
       throw new AppMeshError(errMsg, result.status, result.data)
     }
 
@@ -581,11 +532,11 @@ class AppMeshClientTCP extends AppMeshClient {
    *
    * @param {string} filePath - Remote file path
    * @param {string} [localFile=null] - Local destination path; defaults to the basename of filePath
-   * @param {boolean} [applyAttrs=true] - Apply returned mode and best-effort owner/group metadata
+   * @param {boolean} [applyAttrs=false] - Apply returned mode and best-effort owner/group metadata
    * on non-Windows Node.js hosts
    * @override
    */
-  async download_file (filePath, localFile = null, applyAttrs = true) {
+  async download_file (filePath, localFile = null, applyAttrs = false) {
     if (!localFile) localFile = filePath.split(/[\\/]/).pop()
     const headers = {
       [HTTP_HEADER_KEY_X_FILE_PATH]: encodeURIComponent(filePath),
@@ -653,11 +604,11 @@ class AppMeshClientTCP extends AppMeshClient {
    *
    * @param {string} localFile - Local file path
    * @param {string} [filePath=null] - Remote destination path; defaults to the basename of localFile
-   * @param {boolean} [applyAttrs=true] - Send local mode/uid/gid metadata so the server can
+   * @param {boolean} [applyAttrs=false] - Send local mode/uid/gid metadata so the server can
    * recreate permissions and ownership when supported
    * @override
    */
-  async upload_file (localFile, filePath = null, applyAttrs = true) {
+  async upload_file (localFile, filePath = null, applyAttrs = false) {
     if (!filePath) filePath = localFile.split(/[\\/]/).pop()
     if (!fs.existsSync(localFile)) {
       throw new Error(`Local file not found: ${localFile}`)
@@ -709,7 +660,7 @@ class AppMeshClientTCP extends AppMeshClient {
    * @returns {Promise<Object>} Subscription result with subscription_id, app_name, events.
    */
   async subscribe (appName, events, callback) {
-    this._enableDemuxer()
+    await this._enableDemuxer()
 
     let path = '/appmesh/subscribe'
     if (appName && appName !== '*') {
@@ -759,7 +710,7 @@ class AppMeshClientTCP extends AppMeshClient {
   async add_app (name, appJson, subscribeEvents, callback) {
     const options = {}
     if (subscribeEvents && subscribeEvents.length > 0) {
-      this._enableDemuxer()
+      await this._enableDemuxer()
       options.params = { subscribe_events: subscribeEvents.join(',') }
     }
 
@@ -777,8 +728,11 @@ class AppMeshClientTCP extends AppMeshClient {
    * Enable demuxer for concurrent request-response and event routing.
    * @private
    */
-  _enableDemuxer () {
-    if (this._demuxer) return
+  async _enableDemuxer () {
+    if (this._demuxer && this._demuxer._running) return
+    if (!this.tcpTransport.connected()) {
+      await this.tcpTransport.connect()
+    }
     this._demuxer = new MessageDemuxer(this.tcpTransport)
     this._demuxer.start()
   }

package/src/worker.js

@@ -29,6 +29,15 @@ class ProcessSupersededError extends AppMeshError {
   }
 }
 
+/** Permanent worker request rejection (HTTP 400); retrying cannot recover. */
+class WorkerRejectedError extends AppMeshError {
+  /** @param {string} message @param {any} responseData */
+  constructor (message, responseData = null) {
+    super(message, 400, responseData, 'WORKER_REJECTED')
+    this.name = 'WorkerRejectedError'
+  }
+}
+
 /**
  * True when `value` looks like a {host, port} address object rather than an SSL config.
  * Mirrors the acceptance logic in appmesh_tcp.js (kept local: appmesh_tcp.js is lazy-imported).
@@ -91,10 +100,8 @@ class AppMeshWorker {
    * @param {Object} [options.logger=console] - Logger instance
    * @param {AppMeshClient} [options.client] - Optional pre-built `AppMeshClient` instance to reuse.
    *   When supplied, `baseURL` and `sslConfig` are ignored and the worker shares the caller's
-   *   client (and therefore its token-refresh state). Use this when a single process needs both
-   *   client (outbound calls like `AddApp`) and worker (`fetch_task`/`send_task_result`) roles to
-   *   avoid two independent `/token/renew` loops fighting each other — the daemon blacklists
-   *   the previous token on every renew, so the slower refresher gets 401 "Token has been revoked".
+   *   client (and therefore its caller-owned bearer). Use this when a single process needs both
+   *   client (outbound calls like `AddApp`) and worker (`fetch_task`/`send_task_result`) roles.
    *
    * @example
    * import fs from 'fs';
@@ -109,7 +116,7 @@ class AppMeshWorker {
    * @example
    * // Share a single client between client-role and worker-role usage:
    * const client = new AppMeshClient('https://127.0.0.1:6060', sslConfig);
-   * await client.login('user', 'pass');
+   * client.set_bearer_token(process.env.APPMESH_BEARER_TOKEN);
    * const worker = new AppMeshWorker('https://127.0.0.1:6060', sslConfig, { client });
    */
   constructor (
@@ -125,7 +132,6 @@ class AppMeshWorker {
       this._client = options.client
     } else {
       this._client = new AppMeshClient(baseURL, sslConfig)
-      this._client.set_auto_refresh_token(false) // Task endpoints use APP_MESH_PROCESS_KEY; no JWT refresh needed.
     }
     this._logger = options.logger || console
     this._stopped = false
@@ -167,15 +173,17 @@ class AppMeshWorker {
    * Fetch task data in the currently running App Mesh application process.
    *
    * Used by App Mesh application process to obtain the payload from App Mesh service
-   * that a client pushed to it. This method will retry indefinitely until successful
-   * or cancelled via {@link AppMeshWorker#stop}, in which case `null` is resolved.
+   * that a client pushed to it. This method retries transient failures indefinitely
+   * until successful or cancelled via {@link AppMeshWorker#stop}; HTTP 400/412 stop
+   * the loop. Cancellation resolves `null`.
    *
    * @async
    * @returns {Promise<string|Buffer|null>} The raw payload bytes/body provided by the
    *   invoking client, or `null` when the fetch loop was cancelled via stop()
    * @throws {ProcessSupersededError} The daemon reported HTTP 412 — this process key was
-   *   superseded by a newer process instance; the caller should stop serving (an app
-   *   entry point typically catches this and exits).
+   *   superseded by a newer process instance.
+   * @throws {WorkerRejectedError} The daemon reported a permanent HTTP 400; an app entry
+   *   point should stop serving and exit.
    */
   async fetch_task () {
     const { processKey, appName } = this._getRuntimeEnv()
@@ -187,7 +195,7 @@ class AppMeshWorker {
       const attemptStart = Date.now()
       try {
         const response = await this._client.request('get', path, null, {
-          params: { process_key: processKey }
+          headers: { 'X-AppMesh-Process-Key': processKey }
         })
 
         if (response.status === 200) {
@@ -202,6 +210,12 @@ class AppMeshWorker {
             response.data
           )
         }
+        if (response.status === 400) {
+          throw new WorkerRejectedError(
+            'fetch_task permanently rejected with status 400',
+            response.data
+          )
+        }
 
         this._logger.warn(
           `fetch_task failed with status ${response.status}: ${response.data}, retrying...`
@@ -218,6 +232,12 @@ class AppMeshWorker {
               error.responseData
             )
         }
+        if (error.statusCode === 400) {
+          this._logger.error(`fetch_task permanently rejected: ${error.message}`)
+          throw error instanceof WorkerRejectedError
+            ? error
+            : new WorkerRejectedError(error.message, error.responseData)
+        }
         this._logger.warn(`fetch_task error: ${error.message}, retrying...`)
       }
 
@@ -247,7 +267,7 @@ class AppMeshWorker {
     let response
     try {
       response = await this._client.request('put', path, result, {
-        params: { process_key: processKey }
+        headers: { 'X-AppMesh-Process-Key': processKey }
       })
     } catch (error) {
       // request() throws AppMeshError on non-200
@@ -309,7 +329,7 @@ class AppMeshWorkerTCP extends AppMeshWorker {
    * @param {Array<string, number>|{host: string, port: number}} [tcpAddress=['127.0.0.1', 6059]] - TCP server address
    * @param {Object} [options={}] - Additional options
    * @param {Object} [options.logger=console] - Logger instance
-   * @param {AppMeshClientTCP} [options.client] - Pre-built client to reuse (shares token-refresh state); see AppMeshWorker for why. When set, sslConfig/tcpAddress are ignored.
+   * @param {AppMeshClientTCP} [options.client] - Pre-built client to reuse (shares its caller-owned bearer); when set, sslConfig/tcpAddress are ignored.
    *
    * @example
    * import fs from 'fs';
@@ -324,7 +344,7 @@ class AppMeshWorkerTCP extends AppMeshWorker {
    * // Share a single TCP client between client-role and worker-role usage:
    * import { AppMeshClientTCP } from 'appmesh/tcp';
    * const client = new AppMeshClientTCP(sslConfig, ['127.0.0.1', 6059]);
-   * await client.login('user', 'pass');
+   * client.set_bearer_token(process.env.APPMESH_BEARER_TOKEN);
    * const worker = new AppMeshWorkerTCP(sslConfig, ['127.0.0.1', 6059], { client });
    */
   constructor (
@@ -353,7 +373,6 @@ class AppMeshWorkerTCP extends AppMeshWorker {
     if (!this._client) {
       const { AppMeshClientTCP } = await import('./appmesh_tcp.js')
       this._client = new AppMeshClientTCP(this._sslConfig, this._tcpAddress)
-      this._client.set_auto_refresh_token(false) // Task endpoints use APP_MESH_PROCESS_KEY; no JWT refresh needed.
     }
     return this._client
   }
@@ -420,6 +439,7 @@ export {
   AppMeshWorker,
   AppMeshWorkerTCP,
   ProcessSupersededError,
+  WorkerRejectedError,
   withServer
 }
 export default AppMeshWorker

package/src/appmesh_oauth.js

@@ -1,367 +0,0 @@
-// appmesh_oauth.js - App Mesh client with Keycloak OAuth2 authentication support.
-// Mirrors the Python SDK's AppMeshClientOAuth (client_http_oauth.py): tokens are obtained
-// directly from Keycloak and the access token is used as the Bearer token for daemon calls.
-import axios from "axios";
-import AppMeshClient, { AppMeshError } from "./appmesh.js";
-
-// OAuth2 scopes requesting identity claims so userinfo returns preferred_username/email
-const DEFAULT_OAUTH_SCOPE = "openid profile email";
-
-/**
- * AppMeshClient with Keycloak as the identity provider.
- *
- * Authentication (login, token renewal, logout, userinfo) is performed directly against
- * Keycloak's OpenID Connect endpoints; the Keycloak access token is then used as this
- * client's token for App Mesh daemon API calls (RBAC is enforced by the daemon).
- */
-class AppMeshClientOAuth extends AppMeshClient {
-  /**
-   * Initialize an App Mesh client with Keycloak support.
-   * @param {Object} oauth2 - Keycloak configuration for oauth2 authentication:
-   *   - authServerUrl: Keycloak server URL (e.g. "https://keycloak.example.com/auth")
-   *   - realm: Keycloak realm
-   *   - clientId: Keycloak client ID
-   *   - clientSecret: Keycloak client secret (optional, confidential clients only)
-   * @param {string} [baseURL] - App Mesh daemon URL (see AppMeshClient)
-   * @param {Object|false|null} [sslConfig] - SSL tri-state for the daemon connection (see AppMeshClient)
-   */
-  constructor(oauth2, baseURL = undefined, sslConfig = null) {
-    super(baseURL, sslConfig);
-
-    if (!oauth2 || !oauth2.authServerUrl || !oauth2.realm || !oauth2.clientId) {
-      throw new AppMeshError(
-        "oauth2 config requires authServerUrl, realm and clientId",
-        400,
-        null,
-        "INVALID_OAUTH_CONFIG",
-      );
-    }
-
-    /** @type {Object} Keycloak configuration @private */
-    this._oauth2 = {
-      authServerUrl: String(oauth2.authServerUrl).replace(/\/+$/, ""),
-      realm: oauth2.realm,
-      clientId: oauth2.clientId,
-      clientSecret: oauth2.clientSecret || null,
-    };
-
-    /** @type {Object} Complete Keycloak token response (access_token, refresh_token, ...) @private */
-    this._oauthToken = {};
-
-    // Dedicated axios instance for Keycloak endpoints (the inherited this._client
-    // targets the App Mesh daemon and injects daemon-specific headers/cookies)
-    /** @private */
-    this._oauthClient = axios.create({
-      timeout: 60000,
-      validateStatus: () => true,
-    });
-  }
-
-  /**
-   * Build a Keycloak OpenID Connect endpoint URL for the configured realm.
-   * @param {string} name - Endpoint name (e.g. "token", "auth/device", "logout", "userinfo")
-   * @returns {string} Full endpoint URL
-   * @private
-   */
-  _oauthEndpoint(name) {
-    return `${this._oauth2.authServerUrl}/realms/${encodeURIComponent(this._oauth2.realm)}/protocol/openid-connect/${name}`;
-  }
-
-  /**
-   * POST x-www-form-urlencoded params to a Keycloak endpoint, adding client credentials.
-   * @param {string} endpoint - Endpoint name for _oauthEndpoint()
-   * @param {Object} params - Form fields (null/undefined values are skipped)
-   * @returns {Promise<any>} Raw axios response (any status)
-   * @private
-   */
-  async _oauthPost(endpoint, params) {
-    const form = new URLSearchParams();
-    form.append("client_id", this._oauth2.clientId);
-    if (this._oauth2.clientSecret)
-      form.append("client_secret", this._oauth2.clientSecret);
-    for (const [key, value] of Object.entries(params)) {
-      // Values are appended as-is (strings): TOTP codes keep leading zeros
-      if (value !== null && value !== undefined)
-        form.append(key, String(value));
-    }
-    return this._oauthClient.post(this._oauthEndpoint(endpoint), form);
-  }
-
-  /**
-   * Extract the OAuth2 "error" code from a Keycloak error response body.
-   * @param {any} data - Response body
-   * @returns {string} OAuth2 error code or ""
-   * @private
-   */
-  static _oauthErrorCode(data) {
-    if (typeof data === "string") {
-      try {
-        data = JSON.parse(data);
-      } catch (_) {
-        return "";
-      }
-    }
-    return data && typeof data === "object" && typeof data.error === "string"
-      ? data.error
-      : "";
-  }
-
-  /**
-   * Store a full Keycloak token response and propagate the access token to the base client.
-   * @param {Object} tokenResponse - Complete Keycloak token endpoint response
-   * @private
-   */
-  _storeOauthToken(tokenResponse) {
-    this._oauthToken = tokenResponse || {};
-    this._handleTokenUpdate(this._oauthToken.access_token || null);
-  }
-
-  /**
-   * Login with username and password using the OAuth2 Direct Access Grant (Resource
-   * Owner Password Credentials) against Keycloak.
-   * @param {string} username - The name of the user
-   * @param {string} password - The password of the user
-   * @param {string} [totpCode] - TOTP code if enabled for the user. Passed verbatim as a
-   *   string: leading zeros matter (e.g. "012345")
-   * @param {string|number} [tokenExpire] - Ignored by the Keycloak login flow
-   * @param {string} [audience] - Ignored by the Keycloak login flow
-   * @returns {Promise<void>} Resolves when login succeeds
-   * @throws {AppMeshError} If authentication fails
-   */
-  async login(
-    username,
-    password,
-    totpCode = null,
-    tokenExpire = null,
-    audience = null,
-  ) {
-    if (tokenExpire || audience) {
-      console.warn(
-        "tokenExpire and audience are ignored by the Keycloak login flow",
-      );
-    }
-    if (!username || !password) {
-      throw new AppMeshError(
-        "Username and password are required",
-        400,
-        null,
-        "INVALID_CREDENTIALS",
-      );
-    }
-
-    const response = await this._oauthPost("token", {
-      grant_type: "password",
-      username,
-      password,
-      scope: DEFAULT_OAUTH_SCOPE,
-      // Pass TOTP as-is (string): a numeric conversion would strip leading zeros
-      totp: totpCode ? String(totpCode) : null,
-    });
-    if (response.status !== 200) {
-      throw new AppMeshError(
-        `Keycloak login failed: ${this._extractErrorMessage(response.data)}`,
-        response.status,
-        response.data,
-        "OAUTH_LOGIN_FAILED",
-      );
-    }
-    this._storeOauthToken(response.data);
-  }
-
-  /**
-   * Login via the OAuth 2.0 Device Authorization Grant (RFC 8628).
-   *
-   * For browserless/input-constrained environments: the user opens
-   * `verification_uri_complete` (or `verification_uri` + `user_code`) on another device,
-   * and this call polls the token endpoint until approval, denial, or expiry.
-   *
-   * Requires "OAuth 2.0 Device Authorization Grant" enabled on the Keycloak client.
-   *
-   * @param {Function} [onPrompt] - Callback receiving the device authorization response
-   *   (keys per RFC 8628 §3.2: `user_code`, `verification_uri`, `verification_uri_complete`,
-   *   `expires_in`, `interval`) to present the instructions to the user. Defaults to
-   *   printing them to the console.
-   * @param {string} [scope] - OAuth2 scopes to request
-   * @returns {Promise<void>} Resolves once the user approved the request
-   * @throws {AppMeshError} When the user denies the request, the device code expires,
-   *   or the token request fails for any other reason
-   */
-  async login_device_flow(onPrompt = null, scope = DEFAULT_OAUTH_SCOPE) {
-    const deviceResponse = await this._oauthPost("auth/device", { scope });
-    if (deviceResponse.status !== 200) {
-      throw new AppMeshError(
-        `Device authorization request failed: ${this._extractErrorMessage(deviceResponse.data)}`,
-        deviceResponse.status,
-        deviceResponse.data,
-        "OAUTH_DEVICE_FLOW_FAILED",
-      );
-    }
-    const device = deviceResponse.data;
-
-    if (onPrompt) {
-      onPrompt(device);
-    } else {
-      const uri = device.verification_uri_complete || device.verification_uri;
-      console.log(
-        `To sign in, open ${uri} and enter code: ${device.user_code}`,
-      );
-    }
-
-    // RFC 8628 §3.5: poll no faster than "interval", stop once the device code expires
-    let interval = parseInt(device.interval, 10) || 5;
-    const deadline =
-      Date.now() + (parseInt(device.expires_in, 10) || 600) * 1000;
-
-    for (;;) {
-      const remaining = (deadline - Date.now()) / 1000;
-      if (remaining <= 0) {
-        throw new AppMeshError(
-          "Device authorization expired before the user approved the request",
-          null,
-          null,
-          "OAUTH_DEVICE_FLOW_EXPIRED",
-        );
-      }
-      await this._sleep(Math.min(interval, remaining));
-
-      const response = await this._oauthPost("token", {
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: device.device_code,
-      });
-      if (response.status === 200) {
-        this._storeOauthToken(response.data);
-        return;
-      }
-      const error = AppMeshClientOAuth._oauthErrorCode(response.data);
-      if (error === "authorization_pending") {
-        continue;
-      }
-      if (error === "slow_down") {
-        interval += 5; // RFC 8628 §3.5: back off by 5 seconds
-        continue;
-      }
-      throw new AppMeshError(
-        `Device authorization failed: ${error || this._extractErrorMessage(response.data)}`,
-        response.status,
-        response.data,
-        "OAUTH_DEVICE_FLOW_FAILED",
-      );
-    }
-  }
-
-  /**
-   * Sleep helper used by the device-flow polling loop.
-   * @param {number} seconds - Duration in seconds
-   * @returns {Promise<void>}
-   * @protected
-   */
-  _sleep(seconds) {
-    return new Promise((resolve) => setTimeout(resolve, seconds * 1000));
-  }
-
-  /**
-   * Renew the current Keycloak token using the refresh token.
-   * Keycloak rotates the refresh token: the complete new token response is stored.
-   * @param {string|number} [tokenExpire] - Ignored by the Keycloak refresh flow
-   * @returns {Promise<void>}
-   * @throws {AppMeshError} If no refresh token is available or the renewal fails
-   */
-  async renew_token(tokenExpire = null) {
-    // eslint-disable-line no-unused-vars
-    const refreshToken = this._oauthToken && this._oauthToken.refresh_token;
-    if (!refreshToken) {
-      throw new AppMeshError(
-        "No Keycloak refresh token available to renew",
-        null,
-        null,
-        "OAUTH_NO_REFRESH_TOKEN",
-      );
-    }
-
-    const response = await this._oauthPost("token", {
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-    });
-    if (response.status !== 200) {
-      throw new AppMeshError(
-        `Keycloak token renewal failed: ${this._extractErrorMessage(response.data)}`,
-        response.status,
-        response.data,
-        "OAUTH_RENEW_FAILED",
-      );
-    }
-    // Keycloak rotates refresh tokens: replace the whole stored token response
-    this._storeOauthToken(response.data);
-  }
-
-  /**
-   * Log out of the current session from Keycloak and the App Mesh daemon.
-   * The daemon logoff (super.logout) runs BEFORE the local token is cleared so it can
-   * still authenticate; the Keycloak session is revoked via the refresh token.
-   * @returns {Promise<boolean>} true when the Keycloak session was revoked
-   */
-  async logout() {
-    let result = false;
-    const refreshToken = this._oauthToken && this._oauthToken.refresh_token;
-    if (refreshToken) {
-      try {
-        const response = await this._oauthPost("logout", {
-          refresh_token: refreshToken,
-        });
-        if (response.status >= 200 && response.status < 300) {
-          result = true;
-        } else {
-          console.warn(
-            `Failed to logout from Keycloak: ${this._extractErrorMessage(response.data)}`,
-          );
-        }
-      } catch (error) {
-        console.warn(`Failed to logout from Keycloak: ${error.message}`);
-      }
-    }
-
-    // Daemon-side logoff before clearing the local token (it still needs the token)
-    await super.logout();
-    this._oauthToken = {};
-
-    return result;
-  }
-
-  /**
-   * Get Keycloak OIDC userinfo for the current access token, directly from Keycloak.
-   * Unlike get_current_user() (inherited), which asks the App Mesh daemon
-   * /appmesh/user/self, this queries the Keycloak userinfo endpoint without the daemon.
-   * @returns {Promise<Object>} Keycloak userinfo (OIDC claims such as `sub`,
-   *   `preferred_username`, `email`)
-   * @throws {AppMeshError} If no access token is available or the request fails
-   */
-  async get_oauth_userinfo() {
-    const accessToken = this._oauthToken && this._oauthToken.access_token;
-    if (!accessToken) {
-      throw new AppMeshError(
-        "No Keycloak access token available",
-        null,
-        null,
-        "OAUTH_NO_ACCESS_TOKEN",
-      );
-    }
-    const response = await this._oauthClient.get(
-      this._oauthEndpoint("userinfo"),
-      {
-        headers: { Authorization: `Bearer ${accessToken}` },
-      },
-    );
-    if (response.status !== 200) {
-      throw new AppMeshError(
-        `Keycloak userinfo request failed: ${this._extractErrorMessage(response.data)}`,
-        response.status,
-        response.data,
-        "OAUTH_USERINFO_FAILED",
-      );
-    }
-    return response.data;
-  }
-}
-
-export { AppMeshClientOAuth };
-export default AppMeshClientOAuth;