axauth 3.2.0 → 3.3.0

package/dist/auth/adapter.d.ts

@@ -241,6 +241,22 @@ interface AuthAdapter {
      * to specify which provider's token to extract.
      */
     getAccessToken(creds: Credentials, options?: TokenOptions): string | undefined;
+    /**
+     * Check whether credentials are expired.
+     *
+     * Returns:
+     * - `true` when credentials are expired (or inside refresh buffer)
+     * - `false` when credentials are valid
+     * - `undefined` when expiry cannot be determined
+     */
+    isExpired(creds: Credentials, bufferSeconds?: number): boolean | undefined;
+    /**
+     * Check whether credentials can be refreshed.
+     *
+     * Returns true when credentials contain a refresh token compatible with
+     * the adapter's underlying auth format.
+     */
+    isRefreshable(creds: Credentials): boolean;
     /**
      * Convert credentials to environment variables.
      *

package/dist/auth/agents/claude.js

@@ -5,6 +5,7 @@
  */
 import path from "node:path";
 import { extractCredsFromDirectory } from "../extract-creds-from-directory.js";
+import { isCredentialExpired, isTokenExpired } from "../is-token-expired.js";
 import { CREDS_FILE_NAME, installCredentials, removeCredentials, } from "./claude-install.js";
 import { AGENT_ID, checkAuth, findStoredCredentials as findStoredCredentialsInternal, getEnvironmentCredentials as getEnvironmentCredentialsInternal, } from "./claude-storage.js";
 /** Claude Code authentication adapter */
@@ -61,6 +62,23 @@ const claudeCodeAdapter = {
         }
         return undefined;
     },
+    isExpired(creds, bufferSeconds = 60) {
+        const data = creds.data;
+        const token = (creds.type === "oauth-credentials" || creds.type === "oauth-token") &&
+            typeof data.accessToken === "string"
+            ? data.accessToken
+            : undefined;
+        if (token) {
+            const expired = isTokenExpired(token, bufferSeconds);
+            if (expired !== undefined)
+                return expired;
+        }
+        return isCredentialExpired(data, bufferSeconds);
+    },
+    isRefreshable(creds) {
+        return (creds.type === "oauth-credentials" &&
+            typeof creds.data.refreshToken === "string");
+    },
     credentialsToEnvironment(creds) {
         const environment = {};
         const data = creds.data;

package/dist/auth/agents/codex.js

@@ -5,6 +5,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { isCredentialExpired, isTokenExpired } from "../is-token-expired.js";
 import { checkAuth, findStoredCredentials, getEnvironmentCredentials, } from "./codex-auth-check.js";
 import { CREDS_FILE_NAME, installCodexCredentials, removeCodexCredentials, } from "./codex-install.js";
 const AGENT_ID = "codex";
@@ -61,6 +62,36 @@ const codexAdapter = {
         }
         return undefined;
     },
+    isExpired(creds, bufferSeconds = 60) {
+        const data = creds.data;
+        const token = (creds.type === "api-key" && typeof data.apiKey === "string"
+            ? data.apiKey
+            : undefined) ??
+            (creds.type === "oauth-credentials" &&
+                typeof data.access_token === "string"
+                ? data.access_token
+                : undefined) ??
+            (creds.type === "oauth-credentials" &&
+                typeof data.tokens === "object" &&
+                data.tokens !== null &&
+                typeof data.tokens.access_token === "string"
+                ? data.tokens.access_token
+                : undefined);
+        if (token) {
+            const expired = isTokenExpired(token, bufferSeconds);
+            if (expired !== undefined)
+                return expired;
+        }
+        return isCredentialExpired(data, bufferSeconds);
+    },
+    isRefreshable(creds) {
+        if (creds.type !== "oauth-credentials")
+            return false;
+        const tokens = typeof creds.data.tokens === "object" && creds.data.tokens !== null
+            ? creds.data.tokens
+            : undefined;
+        return typeof tokens?.refresh_token === "string";
+    },
     credentialsToEnvironment(creds) {
         const environment = {};
         const data = creds.data;

package/dist/auth/agents/copilot.js

@@ -6,6 +6,7 @@
  */
 import path from "node:path";
 import { extractCredsFromDirectory } from "../extract-creds-from-directory.js";
+import { isCredentialExpired, isTokenExpired } from "../is-token-expired.js";
 import { resolveCustomDirectory } from "../validate-directories.js";
 import { findFirstAvailableToken } from "./copilot-auth-check.js";
 import { CREDS_FILE_NAME, installCopilotCredentials, } from "./copilot-install.js";
@@ -109,6 +110,20 @@ const copilotAdapter = {
         }
         return undefined;
     },
+    isExpired(creds, bufferSeconds = 60) {
+        const token = typeof creds.data.accessToken === "string"
+            ? creds.data.accessToken
+            : undefined;
+        if (token) {
+            const expired = isTokenExpired(token, bufferSeconds);
+            if (expired !== undefined)
+                return expired;
+        }
+        return isCredentialExpired(creds.data, bufferSeconds);
+    },
+    isRefreshable() {
+        return false;
+    },
     credentialsToEnvironment(creds) {
         const environment = {};
         const data = creds.data;

package/dist/auth/agents/gemini.js

@@ -5,6 +5,7 @@
  */
 import path from "node:path";
 import { extractCredsFromDirectory } from "../extract-creds-from-directory.js";
+import { isCredentialExpired, isTokenExpired } from "../is-token-expired.js";
 import { checkEnvironmentAuth, findCredentials } from "./gemini-auth-check.js";
 import { installOAuthCredentials, removeGeminiCredentials, } from "./gemini-install.js";
 const AGENT_ID = "gemini";
@@ -91,6 +92,26 @@ const geminiAdapter = {
         }
         return undefined;
     },
+    isExpired(creds, bufferSeconds = 60) {
+        const data = creds.data;
+        const token = (creds.type === "api-key" && typeof data.apiKey === "string"
+            ? data.apiKey
+            : undefined) ??
+            (creds.type === "oauth-credentials" &&
+                typeof data.access_token === "string"
+                ? data.access_token
+                : undefined);
+        if (token) {
+            const expired = isTokenExpired(token, bufferSeconds);
+            if (expired !== undefined)
+                return expired;
+        }
+        return isCredentialExpired(data, bufferSeconds);
+    },
+    isRefreshable(creds) {
+        return (creds.type === "oauth-credentials" &&
+            typeof creds.data.refresh_token === "string");
+    },
     credentialsToEnvironment(creds) {
         const environment = {};
         const data = creds.data;

package/dist/auth/agents/opencode.js

@@ -8,6 +8,7 @@
  * - Data (auth): ~/.local/share/opencode (XDG_DATA_HOME/opencode)
  */
 import path from "node:path";
+import { isCredentialExpired, isTokenExpired } from "../is-token-expired.js";
 import { extractTokenFromEntry, OpenCodeAuth } from "./opencode-schema.js";
 import { AGENT_ID, CREDS_FILE_NAME, getDefaultAuthFilePath, mapToCredentialType, readAuthFile, } from "./opencode-credentials.js";
 import { installCredentials, removeCredentials } from "./opencode-storage.js";
@@ -122,6 +123,21 @@ const opencodeAdapter = {
             return undefined;
         return extractTokenFromEntry(parsed.data);
     },
+    isExpired(creds, bufferSeconds = 60) {
+        const parsed = OpenCodeAuth.safeParse(creds.data);
+        if (!parsed.success)
+            return undefined;
+        if (parsed.data.type !== "oauth")
+            return undefined;
+        const tokenExpired = isTokenExpired(parsed.data.access, bufferSeconds);
+        if (tokenExpired !== undefined)
+            return tokenExpired;
+        return isCredentialExpired({ expires: parsed.data.expires }, bufferSeconds);
+    },
+    isRefreshable(creds) {
+        const parsed = OpenCodeAuth.safeParse(creds.data);
+        return parsed.success && parsed.data.type === "oauth";
+    },
     credentialsToEnvironment() {
         // OpenCode requires auth.json file, no env var support
         return {};

package/dist/auth/get-access-token-with-refresh.js

@@ -1,4 +1,3 @@
-import { isCredentialExpired, isTokenExpired } from "./is-token-expired.js";
 import { refreshAndPersist } from "./refresh-credentials.js";
 function findCredentialsWithEnvironmentPriority(adapter, options) {
     const environmentCredentials = adapter.getEnvironmentCredentials?.();
@@ -7,16 +6,14 @@ function findCredentialsWithEnvironmentPriority(adapter, options) {
     const stored = adapter.findStoredCredentials(options);
     return stored?.credentials;
 }
-function shouldRefreshToken(token, creds, options) {
+function shouldRefreshToken(adapter, creds, options) {
     if (creds.type === "api-key")
         return false;
     if (options?.skipRefresh)
         return false;
-    let expired = isTokenExpired(token);
-    if (expired === undefined) {
-        expired = isCredentialExpired(creds.data);
-    }
-    return expired === true;
+    if (!adapter.isRefreshable(creds))
+        return false;
+    return adapter.isExpired(creds) === true;
 }
 async function getAgentAccessTokenFromStoredCredentials(agentId, adapter, options, getAccessToken) {
     const stored = adapter.findStoredCredentials({
@@ -33,7 +30,7 @@ async function getAccessTokenWithRefresh(agentId, creds, options, dependencies)
     const token = dependencies.adapter.getAccessToken(creds, options);
     if (!token)
         return undefined;
-    if (!shouldRefreshToken(token, creds, options)) {
+    if (!shouldRefreshToken(dependencies.adapter, creds, options)) {
         return token;
     }
     const result = await refreshAndPersist(agentId, creds, (resolvedAgentId, refreshedCreds, installOptions) => dependencies.installCredentials(resolvedAgentId, refreshedCreds, installOptions), {

package/dist/auth/is-token-expired.js

@@ -18,18 +18,15 @@
  */
 const SECONDS_THRESHOLD = 10_000_000_000;
 /**
- * Check if a JWT token is expired.
- *
- * Decodes the JWT payload and checks the `exp` claim against current time.
+ * Extract the `exp` claim from a JWT as milliseconds.
  *
- * @param token - The JWT token string
- * @param bufferSeconds - Buffer before actual expiry (default: 60s)
- * @returns true if expired, false if valid, undefined if not a valid JWT
+ * Decodes the base64url payload and reads the `exp` field (seconds -> ms).
+ * Returns undefined if the string is not a valid JWT or has no `exp` claim.
  */
-function isTokenExpired(token, bufferSeconds = 60) {
+function jwtExpiryMs(token) {
     const parts = token.split(".");
     if (parts.length !== 3)
-        return undefined; // Not a JWT
+        return undefined;
     const payloadPart = parts[1];
     if (!payloadPart)
         return undefined;
@@ -40,14 +37,30 @@ function isTokenExpired(token, bufferSeconds = 60) {
         const payload = JSON.parse(atob(padded));
         const exp = payload.exp;
         if (typeof exp !== "number")
-            return undefined; // No exp claim
-        const nowSeconds = Date.now() / 1000;
-        return nowSeconds > exp - bufferSeconds;
+            return undefined;
+        return exp * 1000;
     }
     catch {
-        return undefined; // Invalid JWT
+        return undefined;
     }
 }
+/**
+ * Check if a JWT token is expired.
+ *
+ * Decodes the JWT payload and checks the `exp` claim against current time.
+ *
+ * @param token - The JWT token string
+ * @param bufferSeconds - Buffer before actual expiry (default: 60s)
+ * @returns true if expired, false if valid, undefined if not a valid JWT
+ */
+function isTokenExpired(token, bufferSeconds = 60) {
+    const expiryMs = jwtExpiryMs(token);
+    if (expiryMs === undefined)
+        return undefined;
+    const nowMs = Date.now();
+    const bufferMs = bufferSeconds * 1000;
+    return nowMs > expiryMs - bufferMs;
+}
 /**
  * Check if credentials have expired using explicit timestamp fields.
  *
@@ -103,6 +116,13 @@ function extractExpiryTimestamp(data) {
             ? data.expires * 1000
             : data.expires;
     }
+    // JWT fallback: decode flat access_token for exp claim.
+    const accessToken = typeof data.access_token === "string" ? data.access_token : undefined;
+    if (accessToken !== undefined) {
+        const expMs = jwtExpiryMs(accessToken);
+        if (expMs !== undefined)
+            return expMs;
+    }
     return undefined;
 }
 /**

package/package.json

@@ -2,7 +2,7 @@
   "name": "axauth",
   "author": "Łukasz Jerciński",
   "license": "MIT",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Authentication management library and CLI for AI coding agents",
   "repository": {
     "type": "git",