cartethyia 2.7.9 → 2.8.1

package/src/providers/integrations/buddy/buddy-identity.ts

@@ -1,300 +0,0 @@
-import type { ProviderDispatchContext } from "../../provider-contracts";
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { decodeJwtPayload } from "../../authentication/oauth-flow-store";
-import { buddyAccountUid } from "./buddy-oauth-shared";
-import type { CanonicalRequest } from "../../../protocol/canonical-model";
-
-/**
- * Which upstream client a buddy provider presents itself as.
- *
- * `desktop` is what every buddy provider sends today and stays the default for
- * all four. `cli` is the identity the reference gateways use for CLI traffic: a
- * different header set, a different User-Agent formula, and a different CN
- * upstream.
- *
- * Nothing flips to `cli` implicitly. Being wrong here is what gets an account
- * blocked upstream, so a provider changes identity only when an operator or an
- * account says so.
- */
-export type BuddyIdentity = "desktop" | "cli";
-
-/**
- * Resolves the identity one buddy dispatch presents.
- *
- * Precedence is account then provider: an account authorized as a CLI keeps
- * that identity even when the provider default changes, because the upstream
- * recorded it at login. The provider-level flag is
- * `compatibilityProfile.cli_identity`, already declared, validated, and
- * defaulted — it just never reached these adapters before.
- */
-export function resolveBuddyIdentity(
-  context: ProviderDispatchContext | undefined,
-  profileIdentity?: boolean | undefined,
-): BuddyIdentity {
-  const accountRaw = context?.credential.auth_state?.["cliIdentity"];
-  if (accountRaw === true) return "cli";
-  if (accountRaw === false) return "desktop";
-  return profileIdentity === true ? "cli" : "desktop";
-}
-
-/**
- * The upstream's `X-User-Id` for a buddy dispatch.
- *
- * The reference CLI sends the literal `anonymous` when it has no uid rather
- * than omitting the header, so an unauthenticated dispatch still looks like a
- * client rather than like a caller that forgot a header.
- *
- * When the credential carries a JWT, the `sub` claim is the upstream uid and
- * wins over the gateway's internal account id — the two can differ after an
- * import, and the channel check keys on the upstream identity. Opaque API keys
- * carry no identity, so the internal account id is the fallback.
- */
-export function buddyUserId(context?: ProviderDispatchContext): string {
-  const secret = context?.credential?.secret;
-  const token = secret ? new TextDecoder().decode(secret).trim() : "";
-  const uid = buddyAccountUid(token);
-  if (uid !== undefined) return uid;
-  const accountId = context?.credential.account_id;
-  return accountId !== undefined && accountId.length > 0 ? accountId : "anonymous";
-}
-
-/**
- * Claim names a buddy access token may carry the enterprise id under.
- *
- * A list of candidates rather than one name because the upstream's token shape
- * is not pinned anywhere this codebase can verify, and guessing one name would
- * silently report "personal" for every account whose token spells it another
- * way. Every candidate is a plausible spelling of the same fact; the first that
- * holds a non-empty string wins, and a token carrying none yields no enterprise.
- */
-const ENTERPRISE_CLAIMS: readonly string[] = [
-  "enterprise_id",
-  "enterpriseId",
-  "enterprise",
-  "tenant_id",
-  "tenantId",
-  "org_id",
-  "organization_id",
-];
-
-/**
- * The enterprise this buddy account belongs to, or `undefined` for a personal
- * one.
- *
- * Two sources, in this order:
- *
- * 1. **`auth_state.enterpriseId`** — written when the account was authorized, or
- *    set by an operator for an account whose token does not carry the fact.
- *    Wins because it is the one a human can correct.
- * 2. **A claim on the access token** — for accounts authorized before this
- *    existed, whose `auth_state` was never populated.
- *
- * Deliberately conservative: no enterprise id means *personal*, and personal is
- * what the gateway already sends. An unknown account is therefore unchanged
- * rather than being given an enterprise it may not have — claiming one the
- * upstream does not recognise is the kind of mismatch that draws a channel
- * check.
- */
-export function buddyEnterprise(context?: ProviderDispatchContext): string | undefined {
-  const stored = context?.credential.auth_state?.["enterpriseId"];
-  if (typeof stored === "string" && stored.trim().length > 0) return stored.trim();
-  const token = context?.credential.secret;
-  if (token === undefined || token.length === 0) return undefined;
-  const claims = decodeJwtPayload(new TextDecoder().decode(token).trim());
-  if (claims === undefined) return undefined;
-  for (const claim of ENTERPRISE_CLAIMS) {
-    const value = claims[claim];
-    if (typeof value === "string" && value.trim().length > 0) return value.trim();
-  }
-  return undefined;
-}
-
-/**
- * Per-account device binding (`qimei36`) for the buddy providers.
- *
- * The desktop auth state sends `X-Device-Id-List: {"qimei36":"…"}` alongside
- * the Turing token — a second, independent device identity. Pinning it per
- * account makes every account in a pool present a distinct device to the
- * upstream risk control instead of sharing the machine's single fingerprint.
- *
- * Resolution order:
- * 1. `auth_state.qimei36` — explicit operator-set binding (imported or edited).
- * 2. Derived deterministically from the internal account id (sha256 → 32 hex).
- *    This keeps the binding stable across restarts without a database write,
- *    and gives each freshly-added account its own id automatically.
- *
- * IMPORTANT — the derived fallback is **not portable across instances**:
- * export/import mints a NEW account id, so the derived binding changes and the
- * upstream channel check (11128) rejects the re-imported account. The export
- * path therefore materializes the raw result of this resolver into
- * `auth_state.qimei36` whenever an account relies on the derivation, so a
- * re-import carries the exact same device identity.
- *
- * Returns `undefined` only when no account id is available (unauthenticated).
- */
-export function resolveBuddyDeviceBinding(context?: ProviderDispatchContext): string | undefined {
-  const explicit = context?.credential.auth_state?.["qimei36"];
-  if (typeof explicit === "string" && explicit.trim().length > 0) return explicit.trim();
-  const accountId = context?.credential.account_id;
-  if (accountId === undefined || accountId.length === 0) return undefined;
-  return createHash("sha256").update(`wb2a:qimei36:${accountId}`).digest("hex").slice(0, 32);
-}
-
-/** Materializes the portable binding for an account into a stored auth-state
- * map, when the account does not already pin one explicitly. Used by the
- * export path so a re-import keeps the exact qimei36 device identity. */
-export function materializeBuddyDeviceBinding(
-  accountId: string,
-  authState: Readonly<Record<string, unknown>> | undefined,
-): Record<string, unknown> | undefined {
-  const existing = authState?.["qimei36"];
-  if (typeof existing === "string" && existing.trim().length > 0) return undefined;
-  if (accountId.length === 0) return undefined;
-  const derived = createHash("sha256").update(`wb2a:qimei36:${accountId}`).digest("hex").slice(0, 32);
-  return { ...(authState ?? {}), qimei36: derived };
-}
-
-/**
- * The OAuth identity header family the reference ships on every cloud API call
- * (`runIdentityHeaders`): `X-User-Id` plus the base64 `X-Userinfo` envelope and
- * the auth-method / id-source markers.
- *
- * The JWT `sub` is the uid; the base64 envelope mirrors the reference exactly:
- * `{ uin, owner_uin?, id_source?, token_source? }` — one leg per identity
- * field that exists, so a personal account sends `{uin}` while an enterprise
- * account adds `owner_uin`. `X-Auth-Method` / `X-Id-Source` are only sent when
- * the operator pinned them in `auth_state` (there is no reliable source to
- * invent them from). An opaque API key carries no uid and yields nothing.
- */
-export function buddyOAuthIdentityHeaders(
-  context?: ProviderDispatchContext,
-): Record<string, string> {
-  const secret = context?.credential?.secret;
-  const token = secret ? new TextDecoder().decode(secret).trim() : "";
-  const uid = buddyAccountUid(token) ?? context?.credential.account_id ?? "";
-  if (uid.length === 0) return {};
-  const enterpriseId = buddyEnterprise(context);
-  const state = context?.credential.auth_state;
-  const idSource =
-    typeof state?.["idSource"] === "string" && (state["idSource"] as string).trim().length > 0
-      ? (state["idSource"] as string).trim()
-      : undefined;
-  const method =
-    typeof state?.["authMethod"] === "string" && (state["authMethod"] as string).trim().length > 0
-      ? (state["authMethod"] as string).trim()
-      : undefined;
-  const headers: Record<string, string> = { "X-User-Id": uid };
-  if (method !== undefined) headers["X-Auth-Method"] = method;
-  if (idSource !== undefined) headers["X-Id-Source"] = idSource;
-  if (enterpriseId !== undefined || idSource !== undefined || method !== undefined) {
-    const info: Record<string, string> = { uin: uid };
-    if (enterpriseId !== undefined) info["owner_uin"] = enterpriseId;
-    if (idSource !== undefined) info["id_source"] = idSource;
-    if (method !== undefined) info["token_source"] = method;
-    headers["X-Userinfo"] = Buffer.from(JSON.stringify(info), "utf-8").toString("base64");
-  }
-  return headers;
-}
-
-/**
- * Whether this dispatch is in the reference's private-data mode. The CLI only
- * sends `X-Private-Data: true` while the session is private; otherwise the
- * header is deleted, never sent as `false`. The gateway has no session-level
- * private flag, so the operator pins one per account in `auth_state.privateData`.
- */
-export function buddyPrivateData(context?: ProviderDispatchContext): boolean {
-  return context?.credential.auth_state?.["privateData"] === true;
-}
-
-/**
- * The effective agent purpose for one dispatch, matching the reference's
- * `getEffectiveAgentPurpose` behavior as closely as the gateway can:
- *
- * - `PERSONAL_AGENT_ROLE` set → `person_agent` (same env the CLI reads);
- * - otherwise an inbound `x-agent-purpose` header is preserved (the caller
- *   already stated a purpose — same shape the reference passes through);
- * - otherwise the header is omitted. The reference does not invent `conversation`.
- */
-export function buddyAgentPurpose(
-  context?: ProviderDispatchContext,
-  request?: CanonicalRequest,
-): string | undefined {
-  if (process.env.PERSONAL_AGENT_ROLE && process.env.PERSONAL_AGENT_ROLE.trim().length > 0) {
-    return "person_agent";
-  }
-  const inbound = context?.request_headers?.["x-agent-purpose"]?.trim();
-  if (inbound !== undefined && inbound.length > 0) return inbound;
-  const fromRequest = request?.metadata?.["agent_purpose"];
-  if (typeof fromRequest === "string" && fromRequest.trim().length > 0) return fromRequest.trim();
-  return undefined;
-}
-
-/**
- * Desktop risk token, sent only when the account actually has one.
- *
- * The account's own `auth_state` wins. When it carries none, a file the
- * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
- * `/app/data/device_token`) is read instead — cached for five minutes, and
- * ignored when it is larger than 1 KB, because a token file that size is not
- * a token. A missing file is the normal case and reads as "no token".
- */
-const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
-const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
-let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
-
-export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
-  const state = context?.credential.auth_state;
-  const value = state?.["deviceToken"] ?? state?.["device_token"];
-  if (typeof value === "string" && value.trim().length > 0) return value.trim();
-  return readDeviceTokenFile();
-}
-
-/**
- * The reference `X-Device-Token` pair, per the official desktop app.
- *
- * The desktop client always presents one of the
- * two on chat traffic — a real token from the TuringShield SDK, or an
- * `X-Device-Token-Error` when the SDK cannot produce one. It never omits both,
- * and it sends the header on every realm (Intl and CN alike).
- *
- * The TuringShield SDK was a proprietary native addon shipped under
- * `vendor/turing-sdk/`; it has been removed. The fallback path below is the
- * captured token (auth_state / `CARTETHYIA_DEVICE_TOKEN_FILE`) and then the
- * official failure state.
- *
- * - Legacy token (auth_state/file) → used when no SDK is available.
- * - CLI identity never carries a device token (the CLI has no device).
- */
-export async function buddyDeviceTokenHeaders(args: {
-  realm: "intl" | "cn";
-  context: ProviderDispatchContext | undefined;
-  cliIdentity: boolean | undefined;
-}): Promise<Record<string, string>> {
-  const { context, cliIdentity } = args;
-  void args.realm; // the desktop client sends the token on both realms
-  if (resolveBuddyIdentity(context, cliIdentity) === "cli") return {};
-  const token = readBuddyDeviceToken(context);
-  if (token !== undefined) return { "x-device-token": token };
-  return { "x-device-token-error": "sdk_not_initialized" };
-}
-
-function readDeviceTokenFile(): string | undefined {
-  const now = Date.now();
-  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
-    return deviceTokenFileCache.value;
-  }
-  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
-  let value: string | undefined;
-  try {
-    const raw = readFileSync(path);
-    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
-      const text = raw.toString("utf8").trim();
-      if (text.length > 0) value = text;
-    }
-  } catch {
-    value = undefined;
-  }
-  deviceTokenFileCache = { value, readAt: now };
-  return value;
-}

package/src/providers/integrations/buddy/buddy-oauth-shared.ts

@@ -1,341 +0,0 @@
-/**
- * The buddy-family device-login mechanism (`cb`, `cbcn`).
- *
- * All three complete device login against the same plugin auth endpoints: a
- * state POST, a token poll that answers the pending code `11217` until the user
- * finishes in the browser, and a refresh POST. They answer one
- * `{ data: { accessToken, refreshToken, tokenType, expiresIn } }` envelope and
- * carry one identity header set, so the envelope accessors, the token
- * projection, the account label, and the flow itself live here. Each provider's
- * `*-oauth.ts` supplies one `BuddyOAuthVariant` — endpoints, domain, platform,
- * user agent, and response-code reading — and nothing else.
- */
-import {
-  decodeJwtPayload,
-  expiryFromSeconds,
-  nonEmptyTrimmedString,
-  readJsonResponse,
-  record,
-} from "../../authentication/oauth-flow-store";
-import type {
-  OAuthDeviceFlowContext,
-  OAuthDevicePollResult,
-  OAuthDeviceStartResult,
-  OAuthExchangeResult,
-} from "../../authentication/oauth-flow-store";
-import type { OAuthTokenRefreshResult } from "../../authentication/oauth-refresh-service";
-import { OAuthDeviceFlow } from "../../authentication/oauth-device-flow";
-import type { FetchLike } from "../../authentication/oauth-client";
-
-/** Token fields the buddy plugin auth endpoints return inside `data`. */
-export interface BuddyTokenData {
-  readonly accessToken?: unknown;
-  readonly refreshToken?: unknown;
-  readonly tokenType?: unknown;
-  readonly expiresIn?: unknown;
-}
-
-/** The `data` object of a buddy auth response, or `undefined` when absent. */
-export function buddyResponseData(payload: unknown): Record<string, unknown> | undefined {
-  return record(record(payload)?.data);
-}
-
-/** Projects one buddy auth response onto the token fields the flow consumes. */
-export function parseBuddyTokenData(payload: unknown): BuddyTokenData {
-  const data = buddyResponseData(payload) ?? {};
-  return {
-    accessToken: data.accessToken,
-    refreshToken: data.refreshToken,
-    tokenType: data.tokenType,
-    expiresIn: data.expiresIn,
-  };
-}
-
-/**
- * Reads the envelope `code` strictly: a finite number, or a string that parses
- * as one. Anything else — a JSON `null` included — is `undefined`, so a
- * malformed response cannot read as success.
- */
-export function strictResponseCode(payload: unknown): number | undefined {
-  const root = record(payload);
-  if (typeof root?.code === "number" && Number.isFinite(root.code)) return root.code;
-  if (typeof root?.code === "string" && Number.isFinite(Number(root.code))) return Number(root.code);
-  return undefined;
-}
-
-/**
- * Reads the envelope `code` through `Number()`, which is how the buddy
- * gateway is read. Looser than `strictResponseCode` on a malformed payload: a
- * `null` code coerces to `0`, i.e. success, and `true` to `1`. Kept verbatim
- * rather than tightened because nothing here shows what that gateway sends for
- * an absent code, and rejecting a response it accepts would break a login that
- * works today.
- */
-export function coercingResponseCode(payload: unknown): number | undefined {
-  const n = Number(record(payload)?.code);
-  return Number.isFinite(n) ? n : undefined;
-}
-
-/** One provider's configuration of the buddy device-login flow. */
-export interface BuddyOAuthVariant {
-  readonly providerId: string;
-  /** Display name for error messages (`OAuthClient.providerLabel`). */
-  readonly providerLabel: string;
-  /** Stamped into the `x-domain` header of every auth request. */
-  readonly domain: string;
-  /** `platform` query parameter of the device-start request. */
-  readonly platform: string;
-  /** Resolves version metadata, then builds the `User-Agent` of one auth request. */
-  readonly userAgent: () => Promise<string>;
-  readonly deviceStartUrl: string;
-  readonly devicePollUrl: string;
-  readonly refreshUrl: string;
-  /** Reads the envelope `code`; see `strictResponseCode` / `coercingResponseCode`. */
-  readonly responseCode: (payload: unknown) => number | undefined;
-}
-
-const DEVICE_EXPIRY_SECONDS = 900;
-/** Envelope code the token poll answers while the browser step is unfinished. */
-const BUDDY_PENDING_CODE = 11217;
-
-/**
- * Resolves the account uid from a buddy OAuth access token for endpoints that
- * score by uid (the growth `/v2/report` event's `userId`, the `X-User-Id`
- * billing header). The JWT `sub` claim is the uid; `uid` is accepted as a
- * forward-compatible alias. Returns `undefined` for opaque API keys, which
- * carry no identity — those callers must fail closed, never report as another
- * account.
- */
-export function buddyAccountUid(accessToken: string): string | undefined {
-  const claims = decodeJwtPayload(accessToken);
-  if (!claims) return undefined;
-  return nonEmptyTrimmedString(claims.sub) ?? nonEmptyTrimmedString(claims.uid);
-}
-
-/**
- * A buddy OAuth access token is a Keycloak JWT that inlines the account
- * identity (`name`, `preferred_username`, `email`, `given_name`/`family_name`).
- * Resolve a human display label from it so the account shows "Borneo usar
- * <borneousar@gmail.com>" instead of the generic `${providerId} account`.
- * Falls back to `undefined` when the token carries no usable identity, letting
- * the console keep the operator-supplied label.
- */
-function buddyAccountLabel(accessToken: string): string | undefined {
-  const claims = decodeJwtPayload(accessToken);
-  if (!claims) return undefined;
-  const email = nonEmptyTrimmedString(claims.email) ?? nonEmptyTrimmedString(claims.preferred_username);
-  const given = nonEmptyTrimmedString(claims.given_name);
-  const family = nonEmptyTrimmedString(claims.family_name);
-  const full =
-    given && family ? `${given} ${family}` : nonEmptyTrimmedString(claims.name) ?? undefined;
-  if (email && full) return `${full} <${email}>`;
-  return email ?? full ?? nonEmptyTrimmedString(claims.sub);
-}
-
-function tokenResult(
-  variant: BuddyOAuthVariant,
-  payload: unknown,
-  fallbackRefresh?: string,
-): OAuthExchangeResult {
-  const data = parseBuddyTokenData(payload);
-  const access = nonEmptyTrimmedString(data.accessToken);
-  if (!access) throw new Error(`${variant.providerId} token response omitted accessToken`);
-  const refresh = nonEmptyTrimmedString(data.refreshToken) ?? fallbackRefresh ?? "";
-  const accountLabel = buddyAccountLabel(access);
-  return {
-    access,
-    refresh,
-    expiresAt: expiryFromSeconds(data.expiresIn, 86_400),
-    ...(accountLabel === undefined ? {} : { accountLabel }),
-  };
-}
-
-/** Client identity headers shared by every auth request of one variant. */
-async function authIdentityHeaders(variant: BuddyOAuthVariant): Promise<Record<string, string>> {
-  return {
-    accept: "application/json",
-    "user-agent": await variant.userAgent(),
-    "x-requested-with": "XMLHttpRequest",
-    "x-domain": variant.domain,
-    "x-product": "SaaS",
-  };
-}
-
-async function deviceStartHeaders(variant: BuddyOAuthVariant): Promise<Record<string, string>> {
-  return {
-    "content-type": "application/json",
-    ...(await authIdentityHeaders(variant)),
-    "x-no-authorization": "true",
-    "x-no-user-id": "true",
-  };
-}
-
-async function devicePollHeaders(variant: BuddyOAuthVariant): Promise<Record<string, string>> {
-  return {
-    ...(await authIdentityHeaders(variant)),
-    "x-no-authorization": "true",
-    "x-no-user-id": "true",
-    "x-no-enterprise-id": "true",
-    "x-no-department-info": "true",
-  };
-}
-
-async function refreshHeaders(
-  variant: BuddyOAuthVariant,
-  refreshToken: string,
-): Promise<Record<string, string>> {
-  return {
-    "content-type": "application/json",
-    ...(await authIdentityHeaders(variant)),
-    "x-refresh-token": refreshToken,
-    "x-auth-refresh-source": "plugin",
-  };
-}
-
-/** Buddy state-polling OAuth client for one provider variant. */
-export class BuddyOAuthClient extends OAuthDeviceFlow {
-  override readonly supportsDeviceCode = true;
-  override readonly supportsBrowserCode = false;
-
-  protected override readonly providerLabel: string;
-  protected override readonly clientId = "";
-  protected override readonly tokenUrl = "";
-  protected override readonly scopes = "";
-
-  readonly #variant: BuddyOAuthVariant;
-
-  constructor(variant: BuddyOAuthVariant, fetchFn: FetchLike = globalThis.fetch) {
-    super(fetchFn);
-    this.#variant = variant;
-    this.providerLabel = variant.providerLabel;
-  }
-
-  override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
-    const url = `${this.#variant.deviceStartUrl}?platform=${encodeURIComponent(this.#variant.platform)}`;
-    const response = await this.fetchFn(url, {
-      method: "POST",
-      headers: await deviceStartHeaders(this.#variant),
-      body: "{}",
-    });
-    const payload = await readJsonResponse(response, `${this.#variant.providerId} device authorization`);
-    if (this.#variant.responseCode(payload) !== 0) {
-      throw new Error(
-        `${this.#variant.providerId} state error: ${nonEmptyTrimmedString(record(payload)?.msg) ?? "missing state/authUrl"}`,
-      );
-    }
-    const data = buddyResponseData(payload);
-    const deviceAuthId = nonEmptyTrimmedString(data?.state);
-    const verificationUri = nonEmptyTrimmedString(data?.authUrl);
-    if (!deviceAuthId || !verificationUri) {
-      throw new Error(`${this.#variant.providerId} device authorization returned an invalid response`);
-    }
-    return {
-      verificationUri,
-      userCode: "",
-      deviceAuthId,
-      intervalSeconds: 5,
-      expiresInSeconds: DEVICE_EXPIRY_SECONDS,
-    };
-  }
-
-  override async pollDeviceAuth(
-    deviceAuthId: string,
-    _context?: OAuthDeviceFlowContext,
-  ): Promise<OAuthDevicePollResult> {
-    const url = `${this.#variant.devicePollUrl}?state=${encodeURIComponent(deviceAuthId)}`;
-    const response = await this.fetchFn(url, {
-      method: "GET",
-      headers: await devicePollHeaders(this.#variant),
-    });
-    const textBody = await response.text();
-    let payload: unknown;
-    try {
-      payload = JSON.parse(textBody) as unknown;
-    } catch {
-      return {
-        status: "failed",
-        reason: `${this.#variant.providerId} token endpoint returned invalid JSON`,
-      };
-    }
-    if (!response.ok) {
-      return {
-        status: "failed",
-        reason: `${this.#variant.providerId} token polling failed (${response.status})`,
-      };
-    }
-    const code = this.#variant.responseCode(payload);
-    if (code === BUDDY_PENDING_CODE) return { status: "pending" };
-    if (code !== 0) {
-      return {
-        status: "failed",
-        reason:
-          nonEmptyTrimmedString(record(payload)?.msg) ?? `${this.#variant.providerId} token polling failed`,
-      };
-    }
-    const data = buddyResponseData(payload);
-    const access = nonEmptyTrimmedString(data?.accessToken);
-    if (!access) {
-      return {
-        status: "failed",
-        reason: `${this.#variant.providerId} token response omitted accessToken`,
-      };
-    }
-    // The profile nickname is a second, authorized request the reference makes
-    // once the token lands — the JWT carries the email but not always a
-    // display name. Best-effort by design: a login must not fail because the
-    // profile endpoint was unreachable, so every miss falls back to the label
-    // the token itself yields.
-    const nickname = await this.fetchAccountNickname(deviceAuthId, access);
-    if (nickname === undefined) return { status: "complete", result: tokenResult(this.#variant, payload) };
-    const result = tokenResult(this.#variant, payload);
-    return {
-      status: "complete",
-      result: { ...result, accountLabel: result.accountLabel ?? nickname },
-    };
-  }
-
-  /** Reads the account profile nickname, or `undefined` on any miss. */
-  private async fetchAccountNickname(
-    deviceAuthId: string,
-    accessToken: string,
-  ): Promise<string | undefined> {
-    try {
-      // Both references call `/v2/plugin/login/account` with the token after
-      // the poll succeeds; the poll URL is the same versioned plugin root, so
-      // the profile path is derived from it rather than declared per variant.
-      const url = `${this.#variant.devicePollUrl.replace("/plugin/auth/token", "/plugin/login/account")}?state=${encodeURIComponent(deviceAuthId)}`;
-      const response = await this.fetchFn(url, {
-        method: "GET",
-        headers: {
-          ...(await devicePollHeaders(this.#variant)),
-          authorization: `Bearer ${accessToken}`,
-        },
-      });
-      if (!response.ok) return undefined;
-      const profile = buddyResponseData((await response.json()) as unknown);
-      return nonEmptyTrimmedString(profile?.nickname);
-    } catch {
-      return undefined;
-    }
-  }
-
-  override async refresh(refreshToken: string, signal?: AbortSignal): Promise<OAuthTokenRefreshResult> {
-    const response = await this.fetchFn(this.#variant.refreshUrl, {
-      method: "POST",
-      headers: await refreshHeaders(this.#variant, refreshToken),
-      body: "{}",
-      ...(signal === undefined ? {} : { signal }),
-    });
-    const payload = await readJsonResponse(response, `${this.#variant.providerId} token refresh`);
-    if (this.#variant.responseCode(payload) !== 0) {
-      const detail = nonEmptyTrimmedString(record(payload)?.msg);
-      throw new Error(`${this.#variant.providerId} token refresh failed${detail ? `: ${detail}` : ""}`);
-    }
-    const result = tokenResult(this.#variant, payload, refreshToken);
-    return {
-      access: result.access,
-      ...(result.refresh ? { refresh: result.refresh } : {}),
-      expiresAt: result.expiresAt,
-    };
-  }
-}