funolio-agent 1.0.4 → 1.0.6

package/dist/auth/token-refresh.js

@@ -1,28 +1,80 @@
 "use strict";
 /**
- * REMOVED: OAuth token refresh has been removed.
+ * Token Refresh Module — Funolio Agent OAuth System
  *
- * Connection to LLM providers is now exclusively via:
- *   1. CLI providers (claude-cli, codex-cli) — handle their own auth/refresh
- *   2. API key (BYOK) — API keys don't expire
+ * For Anthropic tokens: delegates refresh to the Funolio server (cloud mode)
+ * to prevent race conditions with single-use refresh tokens.
+ * The server is the sole authority for refreshing with Anthropic.
  *
- * The token-refresh module previously handled:
- *   - Anthropic OAuth token refresh (single-use rotation)
- *   - OpenAI OAuth token refresh
- *   - Google/Gemini OAuth token refresh
- *   - Server-delegated token refresh (cloud mode)
+ * For OpenAI/Gemini: refreshes directly (their tokens aren't single-use).
  *
- * CLI providers now handle all token lifecycle internally.
+ * Config: `tokenRefreshAuthority` in ~/.funolio/config.json
+ *   - "cloud" (default): Server refreshes Anthropic tokens
+ *   - "local": Legacy direct refresh (for self-hosted without a server)
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenRefreshError = void 0;
-exports.needsRefresh = needsRefresh;
-exports.refreshToken = refreshToken;
 exports.refreshOpenAIToken = refreshOpenAIToken;
 exports.refreshGeminiToken = refreshGeminiToken;
 exports.writeClaudeCredentials = writeClaudeCredentials;
 exports.writeCodexCredentials = writeCodexCredentials;
 exports.seedServerWithToken = seedServerWithToken;
+exports.needsRefresh = needsRefresh;
+exports.refreshToken = refreshToken;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const crypto = __importStar(require("crypto"));
+const child_process_1 = require("child_process");
+const credential_reader_1 = require("./credential-reader");
+const config_1 = require("../config");
+// ── Constants ───────────────────────────────────────────────────────────────
+const REFRESH_TIMEOUT_MS = 30_000;
+const EXPIRY_BUFFER_MS = 5 * 60_000; // 5 minutes
+// Anthropic OAuth (used only in local/fallback mode)
+const ANTHROPIC_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+const ANTHROPIC_CLIENT_ID = atob('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl');
+// OpenAI Codex OAuth (from pi-ai/src/utils/oauth/openai-codex.ts)
+const OPENAI_TOKEN_URL = 'https://auth.openai.com/oauth/token';
+const OPENAI_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+// Google Gemini CLI OAuth (from pi-ai/src/utils/oauth/google-gemini-cli.ts)
+const GEMINI_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const GEMINI_CLIENT_ID = atob('NjgxMjU1ODA5Mzk1LW9vOGZ0Mm9wcmRybnA5ZTNhcWY2YXYzaG1kaWIxMzVqLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29t');
+const GEMINI_CLIENT_SECRET = atob('R09DU1BYLTR1SGdNUG0tMW83U2stZ2VWNkN1NWNsWEZzeGw=');
+// ── Types ───────────────────────────────────────────────────────────────────
 class TokenRefreshError extends Error {
     provider;
     httpStatus;
@@ -34,22 +86,408 @@ class TokenRefreshError extends Error {
     }
 }
 exports.TokenRefreshError = TokenRefreshError;
-/** @deprecated Always returns false. API keys don't expire. */
-function needsRefresh(_credential) {
-    return false;
+// ── Config Reader ───────────────────────────────────────────────────────────
+/**
+ * Read the token refresh authority from config.
+ * Returns "cloud" (default) or "local".
+ */
+function getTokenRefreshAuthority() {
+    try {
+        const configPath = path.join(os.homedir(), '.funolio', 'config.json');
+        if (fs.existsSync(configPath)) {
+            const cfg = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+            if (cfg.tokenRefreshAuthority === 'local')
+                return 'local';
+        }
+    }
+    catch { /* default to cloud */ }
+    return 'cloud';
+}
+/**
+ * Read the bot API key from config (bb_sk_ prefixed).
+ * Needed for authenticating with the server's token-refresh endpoint.
+ */
+function getBotApiKey() {
+    try {
+        const configPath = path.join(os.homedir(), '.funolio', 'config.json');
+        if (fs.existsSync(configPath)) {
+            const cfg = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+            // Try auth.token first (set during `funolio-agent init`)
+            if (cfg.auth?.token)
+                return cfg.auth.token;
+        }
+    }
+    catch { /* ignore */ }
+    return null;
+}
+// ── Retry Helper ────────────────────────────────────────────────────────────
+async function withRetry(fn, provider, maxAttempts = 3) {
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastError = err;
+            const normalized = String(err?.message || '').toLowerCase();
+            const nonRetryable = normalized.includes('invalid_grant')
+                || normalized.includes('refresh token not found or invalid')
+                || /\(400\)/.test(normalized);
+            if (nonRetryable) {
+                break;
+            }
+            if (attempt < maxAttempts) {
+                const delayMs = Math.pow(2, attempt - 1) * 1000;
+                console.log(`[token-refresh] ${provider} refresh attempt ${attempt}/${maxAttempts} failed, retrying in ${delayMs}ms...`);
+                await new Promise(resolve => setTimeout(resolve, delayMs));
+            }
+        }
+    }
+    const statusMatch = lastError?.message?.match(/\((\d{3})\)/);
+    const httpStatus = statusMatch ? parseInt(statusMatch[1], 10) : undefined;
+    throw new TokenRefreshError(provider, `${provider} token refresh failed after ${maxAttempts} attempts: ${lastError?.message}`, httpStatus);
+}
+// ── Fetch with Timeout ──────────────────────────────────────────────────────
+async function fetchWithTimeout(url, init, timeoutMs = REFRESH_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ── Cloud Refresh (via Funolio Server) ──────────────────────────────────────
+/**
+ * Refresh an Anthropic token via the Funolio server.
+ * The server holds the refresh token and is the sole authority for
+ * exchanging it with Anthropic. This prevents race conditions.
+ *
+ * Returns updated credential with new access token (refresh token unchanged
+ * on the agent side — we don't need it).
+ */
+async function refreshViaServer(credential) {
+    const apiKey = getBotApiKey();
+    if (!apiKey) {
+        throw new TokenRefreshError(credential.provider, 'No bot API key found in config. Run `funolio-agent init` to set up, or set tokenRefreshAuthority to "local".');
+    }
+    const serverUrl = process.env.FUNOLIO_API_URL || config_1.FUNOLIO_API_URL;
+    const url = `${serverUrl}/api/v1/bot/token-refresh`;
+    console.log(`[token-refresh] Requesting ${credential.provider} token refresh from server...`);
+    const response = await fetchWithTimeout(url, {
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${apiKey}`,
+            'Content-Type': 'application/json',
+            'Accept': 'application/json',
+        },
+        body: JSON.stringify({ provider: credential.provider }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new TokenRefreshError(credential.provider, `Server token refresh failed (${response.status}): ${body}`, response.status);
+    }
+    const data = await response.json();
+    if (!data.accessToken) {
+        throw new TokenRefreshError(credential.provider, 'Server returned no accessToken');
+    }
+    console.log(`[token-refresh] Server refresh successful for ${credential.provider}, expires: ${new Date(data.expiresAt).toISOString()}`);
+    return {
+        ...credential,
+        accessToken: data.accessToken,
+        // Keep local refreshToken as-is — we don't use it in cloud mode,
+        // but preserve it for potential fallback to local mode.
+        expiresAt: data.expiresAt,
+    };
+}
+// ── Local Refresh Functions (legacy / fallback) ─────────────────────────────
+/**
+ * Refresh Anthropic token directly (local mode only).
+ * WARNING: This consumes the single-use refresh token. Only use when
+ * tokenRefreshAuthority is "local" (self-hosted without a server).
+ */
+async function refreshAnthropicTokenLocal(credential) {
+    const response = await fetchWithTimeout(ANTHROPIC_TOKEN_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Accept': 'application/json',
+        },
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            client_id: ANTHROPIC_CLIENT_ID,
+            refresh_token: credential.refreshToken,
+        }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`Anthropic token refresh failed (${response.status}): ${body}`);
+    }
+    const data = (await response.json());
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    console.log(`[token-refresh] Anthropic local refresh successful, new expiry: ${new Date(expiresAt).toISOString()}`);
+    return {
+        ...credential,
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt,
+    };
+}
+async function refreshOpenAIToken(credential) {
+    const response = await fetchWithTimeout(OPENAI_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: credential.refreshToken,
+            client_id: OPENAI_CLIENT_ID,
+        }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`OpenAI token refresh failed (${response.status}): ${body}`);
+    }
+    const data = (await response.json());
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    console.log(`[token-refresh] OpenAI refresh successful, new expiry: ${new Date(expiresAt).toISOString()}`);
+    return {
+        ...credential,
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt,
+        ...(credential.accountId ? { accountId: credential.accountId } : {}),
+        ...(data.id_token ? { idToken: data.id_token } : (credential.idToken ? { idToken: credential.idToken } : {})),
+    };
+}
+async function refreshGeminiToken(credential) {
+    const response = await fetchWithTimeout(GEMINI_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: credential.refreshToken,
+            client_id: GEMINI_CLIENT_ID,
+            client_secret: GEMINI_CLIENT_SECRET,
+        }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`Gemini token refresh failed (${response.status}): ${body}`);
+    }
+    const data = (await response.json());
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    console.log(`[token-refresh] Gemini refresh successful, new expiry: ${new Date(expiresAt).toISOString()}`);
+    return {
+        ...credential,
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token || credential.refreshToken,
+        expiresAt,
+        ...(credential.projectId ? { projectId: credential.projectId } : {}),
+    };
+}
+// ── Credential Writers ──────────────────────────────────────────────────────
+function writeClaudeCredentials(credential) {
+    try {
+        const credPath = path.join(os.homedir(), '.claude', '.credentials.json');
+        const dir = path.dirname(credPath);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        let existing = {};
+        try {
+            existing = JSON.parse(fs.readFileSync(credPath, 'utf-8'));
+        }
+        catch { /* new file */ }
+        // Merge with existing claudeAiOauth to preserve fields like scopes,
+        // subscriptionType, rateLimitTier that were set during initial auth.
+        const prev = (existing.claudeAiOauth && typeof existing.claudeAiOauth === 'object')
+            ? existing.claudeAiOauth
+            : {};
+        existing.claudeAiOauth = {
+            ...prev,
+            accessToken: credential.accessToken,
+            refreshToken: credential.refreshToken,
+            expiresAt: credential.expiresAt,
+        };
+        fs.writeFileSync(credPath, JSON.stringify(existing, null, 2), 'utf-8');
+        console.log('[token-refresh] Wrote updated Claude credentials to disk');
+        if (process.platform === 'darwin') {
+            try {
+                const json = JSON.stringify(existing);
+                (0, child_process_1.execSync)(`security add-generic-password -U -s "Claude Code-credentials" -a "Claude Code" -w ${JSON.stringify(json)}`, { timeout: 5000, stdio: 'pipe' });
+                console.log('[token-refresh] Updated macOS Keychain for Claude');
+            }
+            catch { /* Non-fatal */ }
+        }
+        return true;
+    }
+    catch (err) {
+        console.error('[token-refresh] Failed to write Claude credentials:', err instanceof Error ? err.message : err);
+        return false;
+    }
+}
+function writeCodexCredentials(credential) {
+    try {
+        const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
+        const authPath = path.join(codexHome, 'auth.json');
+        if (!fs.existsSync(codexHome))
+            fs.mkdirSync(codexHome, { recursive: true });
+        let existing = {};
+        try {
+            existing = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
+        }
+        catch { /* new file */ }
+        const existingTokens = existing.tokens || {};
+        existing.tokens = {
+            ...existingTokens,
+            access_token: credential.accessToken,
+            refresh_token: credential.refreshToken,
+            ...(credential.accountId
+                ? { account_id: credential.accountId }
+                : (existingTokens.account_id ? { account_id: String(existingTokens.account_id) } : {})),
+            ...(credential.idToken
+                ? { id_token: credential.idToken }
+                : (existingTokens.id_token ? { id_token: String(existingTokens.id_token) } : {})),
+        };
+        fs.writeFileSync(authPath, JSON.stringify(existing, null, 2), 'utf-8');
+        console.log('[token-refresh] Wrote updated Codex credentials to disk');
+        if (process.platform === 'darwin') {
+            try {
+                const account = crypto.createHash('sha256').update(codexHome).digest('hex').slice(0, 16);
+                const json = JSON.stringify(existing);
+                (0, child_process_1.execSync)(`security add-generic-password -U -s "Codex Auth" -a ${JSON.stringify(account)} -w ${JSON.stringify(json)}`, { timeout: 5000, stdio: 'pipe' });
+                console.log('[token-refresh] Updated macOS Keychain for Codex');
+            }
+            catch { /* Non-fatal */ }
+        }
+        return true;
+    }
+    catch (err) {
+        console.error('[token-refresh] Failed to write Codex credentials:', err instanceof Error ? err.message : err);
+        return false;
+    }
+}
+function writeGeminiCredentials(credential) {
+    try {
+        const adcPath = path.join(os.homedir(), '.config', 'gcloud', 'application_default_credentials.json');
+        let existing = {};
+        try {
+            existing = JSON.parse(fs.readFileSync(adcPath, 'utf-8'));
+        }
+        catch { /* skip */ }
+        existing.access_token = credential.accessToken;
+        if (credential.refreshToken) {
+            existing.refresh_token = credential.refreshToken;
+        }
+        fs.writeFileSync(adcPath, JSON.stringify(existing, null, 2), 'utf-8');
+        console.log('[token-refresh] Wrote updated Gemini ADC credentials to disk');
+        return true;
+    }
+    catch (err) {
+        console.error('[token-refresh] Failed to write Gemini credentials:', err instanceof Error ? err.message : err);
+        return false;
+    }
 }
-/** @deprecated Always throws. Use CLI providers or API keys instead. */
-async function refreshToken(_credential) {
-    throw new TokenRefreshError(_credential.provider, 'OAuth token refresh has been removed. Use CLI providers (claude-cli, codex-cli) or API keys instead.');
+// ── Server Token Seeding ────────────────────────────────────────────────────
+/**
+ * Push a fresh credential to the Funolio server so it can perform
+ * server-side refresh later. Fire-and-forget after local refresh.
+ */
+async function seedServerWithToken(credential) {
+    const apiKey = getBotApiKey();
+    if (!apiKey)
+        return false;
+    const serverUrl = process.env.FUNOLIO_API_URL || config_1.FUNOLIO_API_URL;
+    try {
+        const res = await fetchWithTimeout(`${serverUrl}/api/v1/bot/token-seed`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${apiKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                provider: credential.provider,
+                accessToken: credential.accessToken,
+                refreshToken: credential.refreshToken,
+                expiresAt: credential.expiresAt,
+            }),
+        });
+        if (!res.ok) {
+            console.warn(`[token-seed] Server seed failed (${res.status})`);
+            return false;
+        }
+        console.log(`[token-seed] Successfully seeded server with ${credential.provider} token`);
+        return true;
+    }
+    catch (err) {
+        console.warn(`[token-seed] Failed: ${err.message}`);
+        return false;
+    }
 }
-// Re-export stubs for any remaining import references
-async function refreshOpenAIToken(_credential) {
-    throw new TokenRefreshError('openai', 'Token refresh removed. Use codex-cli or API key.');
+// ── Main Refresh Function ───────────────────────────────────────────────────
+/**
+ * Check if a credential needs refresh (expired or within 5-minute buffer).
+ */
+function needsRefresh(credential) {
+    return Date.now() >= credential.expiresAt - EXPIRY_BUFFER_MS;
 }
-async function refreshGeminiToken(_credential) {
-    throw new TokenRefreshError('google-gemini', 'Token refresh removed. Use API key.');
+/**
+ * Refresh a single credential. For Anthropic in cloud mode, delegates to the
+ * Funolio server. For other providers (or local mode), refreshes directly.
+ *
+ * After refresh, writes updated tokens back to the source files.
+ */
+async function refreshToken(credential) {
+    const authority = getTokenRefreshAuthority();
+    console.log(`[token-refresh] Refreshing ${credential.provider} token (authority: ${authority})...`);
+    let refreshed;
+    switch (credential.provider) {
+        case 'anthropic':
+            if (authority === 'cloud') {
+                // Cloud mode: ask the server to refresh (it holds the refresh token)
+                try {
+                    refreshed = await refreshViaServer(credential);
+                }
+                catch (err) {
+                    // If server is unreachable, log clearly but don't fall back to local
+                    // (falling back would consume the single-use refresh token and create
+                    // the exact race condition we're trying to prevent)
+                    console.error(`[token-refresh] Server refresh failed: ${err.message}`);
+                    throw new TokenRefreshError('anthropic', `Server token refresh failed. Ensure the Funolio server is reachable, or set tokenRefreshAuthority to "local" if self-hosted. Error: ${err.message}`, err.httpStatus);
+                }
+            }
+            else {
+                // Local mode: refresh directly with Anthropic (self-hosted, no server)
+                // No retry — refresh tokens are single-use
+                refreshed = await refreshAnthropicTokenLocal(credential);
+                // Seed server with fresh token so it can do future cloud refreshes
+                seedServerWithToken(refreshed).catch(() => { });
+            }
+            break;
+        case 'openai':
+            refreshed = await withRetry(() => refreshOpenAIToken(credential), 'openai');
+            break;
+        case 'google-gemini':
+            refreshed = await withRetry(() => refreshGeminiToken(credential), 'google-gemini');
+            break;
+        default:
+            throw new TokenRefreshError(credential.provider, `Unknown provider: ${credential.provider}`);
+    }
+    // Write back to credential files
+    let written = false;
+    switch (refreshed.provider) {
+        case 'anthropic':
+            written = writeClaudeCredentials(refreshed);
+            break;
+        case 'openai':
+            written = writeCodexCredentials(refreshed);
+            break;
+        case 'google-gemini':
+            written = writeGeminiCredentials(refreshed);
+            break;
+    }
+    // Clear credential-reader cache so next read picks up new tokens
+    (0, credential_reader_1.clearCache)();
+    return { credential: refreshed, written };
 }
-function writeClaudeCredentials(_credential) { return false; }
-function writeCodexCredentials(_credential) { return false; }
-async function seedServerWithToken(_credential) { return false; }
 //# sourceMappingURL=token-refresh.js.map

package/dist/auth/token-refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/auth/token-refresh.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAsBH,oCAEC;AAGD,oCAKC;AAGD,gDAEC;AAED,gDAEC;AAED,wDAA+F;AAC/F,sDAA8F;AAC9F,kDAA2G;AAzC3G,MAAa,iBAAkB,SAAQ,KAAK;IAC1B,QAAQ,CAAS;IACjB,UAAU,CAAqB;IAE/C,YAAY,QAAgB,EAAE,OAAe,EAAE,UAAmB;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAVD,8CAUC;AAOD,+DAA+D;AAC/D,SAAgB,YAAY,CAAC,WAA4B;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACjE,KAAK,UAAU,YAAY,CAAC,WAA4B;IAC7D,MAAM,IAAI,iBAAiB,CACzB,WAAW,CAAC,QAAQ,EACpB,sGAAsG,CACvG,CAAC;AACJ,CAAC;AAED,sDAAsD;AAC/C,KAAK,UAAU,kBAAkB,CAAC,WAA4B;IACnE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,kDAAkD,CAAC,CAAC;AAC5F,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,WAA4B;IACnE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;AACtF,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAA4B,IAAa,OAAO,KAAK,CAAC,CAAC,CAAC;AAC/F,SAAgB,qBAAqB,CAAC,WAA4B,IAAa,OAAO,KAAK,CAAC,CAAC,CAAC;AACvF,KAAK,UAAU,mBAAmB,CAAC,WAA4B,IAAsB,OAAO,KAAK,CAAC,CAAC,CAAC"}
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/auth/token-refresh.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsPH,gDAsCC;AAED,gDAqCC;AAID,wDA0CC;AAED,sDA4CC;AAiCD,kDA4BC;AAOD,oCAEC;AAQD,oCA4DC;AAviBD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,+CAAiC;AACjC,iDAAyC;AACzC,2DAAkE;AAClE,sCAA4C;AAE5C,+EAA+E;AAE/E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,YAAY;AAEjD,qDAAqD;AACrD,MAAM,mBAAmB,GAAG,4CAA4C,CAAC;AACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,kDAAkD,CAAC,CAAC;AAErF,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAExD,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,IAAI,CAC3B,kGAAkG,CACnG,CAAC;AACF,MAAM,oBAAoB,GAAG,IAAI,CAAC,kDAAkD,CAAC,CAAC;AAEtF,+EAA+E;AAE/E,MAAa,iBAAkB,SAAQ,KAAK;IAC1B,QAAQ,CAAS;IACjB,UAAU,CAAqB;IAE/C,YAAY,QAAgB,EAAE,OAAe,EAAE,UAAmB;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAVD,8CAUC;AAOD,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,wBAAwB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,CAAC,qBAAqB,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,yDAAyD;YACzD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,SAAS,CACtB,EAAoB,EACpB,QAAgB,EAChB,cAAsB,CAAC;IAEvB,IAAI,SAA4B,CAAC;IACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,SAAS,GAAG,GAAG,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;mBACpD,UAAU,CAAC,QAAQ,CAAC,oCAAoC,CAAC;mBACzD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,mBAAmB,QAAQ,oBAAoB,OAAO,IAAI,WAAW,wBAAwB,OAAO,OAAO,CAAC,CAAC;gBACzH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,IAAI,iBAAiB,CACzB,QAAQ,EACR,GAAG,QAAQ,+BAA+B,WAAW,cAAc,SAAS,EAAE,OAAO,EAAE,EACvF,UAAU,CACX,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAiB,EACjB,YAAoB,kBAAkB;IAEtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAA2B;IAE3B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CACzB,UAAU,CAAC,QAAQ,EACnB,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,wBAAe,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,SAAS,2BAA2B,CAAC;IAEpD,OAAO,CAAC,GAAG,CAAC,8BAA8B,UAAU,CAAC,QAAQ,+BAA+B,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,MAAM,EAAE;YACnC,cAAc,EAAE,kBAAkB;YAClC,QAAQ,EAAE,kBAAkB;SAC7B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,iBAAiB,CACzB,UAAU,CAAC,QAAQ,EACnB,gCAAgC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,EAC3D,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAgD,CAAC;IAEjF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,iBAAiB,CAAC,UAAU,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iDAAiD,UAAU,CAAC,QAAQ,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC3H,CAAC;IAEF,OAAO;QACL,GAAG,UAAU;QACb,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iEAAiE;QACjE,wDAAwD;QACxD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,UAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,QAAQ,EAAE,kBAAkB;SAC7B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;SACvC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,CAAC,GAAG,CACT,mEAAmE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACvG,CAAC;IAEF,OAAO;QACL,GAAG,UAAU;QACb,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS;KACV,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,UAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,SAAS,EAAE,gBAAgB;SAC5B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,CAAC,GAAG,CACT,0DAA0D,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9F,CAAC;IAEF,OAAO;QACL,GAAG,UAAU;QACb,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS;QACT,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KAC9G,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,UAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,oBAAoB;SACpC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,CAAC,GAAG,CACT,0DAA0D,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9F,CAAC;IAEF,OAAO;QACL,GAAG,UAAU;QACb,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY;QAC3D,SAAS;QACT,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAgB,sBAAsB,CAAC,UAA2B;IAChE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhE,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAE1B,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC;YACjF,CAAC,CAAC,QAAQ,CAAC,aAAwC;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,CAAC,aAAa,GAAG;YACvB,GAAG,IAAI;YACP,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;QAEF,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAExE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAA,wBAAQ,EACN,qFAAqF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAC3G,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CACjC,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,UAA2B;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAE1B,MAAM,cAAc,GAAI,QAAQ,CAAC,MAA8C,IAAI,EAAE,CAAC;QACtF,QAAQ,CAAC,MAAM,GAAG;YAChB,GAAG,cAAc;YACjB,YAAY,EAAE,UAAU,CAAC,WAAW;YACpC,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,GAAG,CAAC,UAAU,CAAC,SAAS;gBACtB,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE;gBACtC,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzF,GAAG,CAAC,UAAU,CAAC,OAAO;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE;gBAClC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACpF,CAAC;QAEF,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAEvE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAA,wBAAQ,EACN,uDAAuD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAC3G,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CACjC,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,UAA2B;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,sCAAsC,CAC1E,CAAC;QAEF,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAA4B,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAEtB,QAAQ,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;QAC/C,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC;QACnD,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CAAC,UAA2B;IACnE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,wBAAe,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,SAAS,wBAAwB,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,MAAM,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,oCAAoC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gDAAgD,UAAU,CAAC,QAAQ,QAAQ,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,YAAY,CAAC,UAA2B;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,SAAS,GAAG,gBAAgB,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAAC,UAA2B;IAC5D,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,8BAA8B,UAAU,CAAC,QAAQ,sBAAsB,SAAS,MAAM,CAAC,CAAC;IAEpG,IAAI,SAA0B,CAAC;IAE/B,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,KAAK,WAAW;YACd,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1B,qEAAqE;gBACrE,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,qEAAqE;oBACrE,sEAAsE;oBACtE,oDAAoD;oBACpD,OAAO,CAAC,KAAK,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACvE,MAAM,IAAI,iBAAiB,CACzB,WAAW,EACX,uIAAuI,GAAG,CAAC,OAAO,EAAE,EACpJ,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,uEAAuE;gBACvE,2CAA2C;gBAC3C,SAAS,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;gBACzD,mEAAmE;gBACnE,mBAAmB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjD,CAAC;YACD,MAAM;QACR,KAAK,QAAQ;YACX,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5E,MAAM;QACR,KAAK,eAAe;YAClB,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;YACnF,MAAM;QACR;YACE,MAAM,IAAI,iBAAiB,CAAC,UAAU,CAAC,QAAQ,EAAE,qBAAqB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM;QACR,KAAK,QAAQ;YACX,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM;QACR,KAAK,eAAe;YAClB,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM;IACV,CAAC;IAED,iEAAiE;IACjE,IAAA,8BAAU,GAAE,CAAC;IAEb,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}

package/dist/bot-manager.d.ts

@@ -4,11 +4,13 @@ export interface BotManagerOptions {
     projectDir: string;
     userId: string;
     mqttClient: AgentMqttClient;
-    /** Active agent provider/model/apiKey/oauthToken (resolved from agents[] + providers[]) */
+    /** Active agent provider/model/apiKey (resolved from agents[] + providers[]) */
     defaultProvider: string;
     defaultModel: string;
     defaultApiKey?: string;
     defaultOauthToken?: string;
+    defaultOauthRefreshToken?: string;
+    defaultOauthExpiresAt?: number;
     /** Active agent permission mode and tool config */
     permissionMode?: string;
     enabledTools?: string[];
@@ -19,10 +21,6 @@ export interface BotManagerOptions {
  * Manages agent MessageLoops, keyed by agent ID.
  * The active agent runs as "__default__" loop.
  * Runtime source of truth: config.agents[] + config.activeAgentId.
- *
- * Auth modes supported:
- *   1. CLI providers (claude-cli, codex-cli) — handle their own auth
- *   2. API key (BYOK) — standard x-api-key authentication
  */
 export declare class BotManager {
     private loops;
@@ -31,7 +29,7 @@ export declare class BotManager {
     private resolvedAuth;
     private recentCommandIds;
     constructor(options: BotManagerOptions);
-    /** Start the active agent loop */
+    /** Start the active agent loop, auto-detecting OAuth credentials if no API key is configured */
     startActive(): Promise<void>;
     /**
      * Load all agent configs from ~/.funolio/agents/ and start a loop for each.
@@ -66,6 +64,8 @@ export declare class BotManager {
     private handleAgentRemove;
     /** Update an agent — re-fetches config from server to get credentials */
     private handleAgentUpdate;
+    /** Update the default OAuth token for the active loop (used by token refresh) */
+    updateDefaultToken(token: string): void;
     private handleUpdateCommand;
 }
 //# sourceMappingURL=bot-manager.d.ts.map

package/dist/bot-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bot-manager.d.ts","sourceRoot":"","sources":["../src/bot-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI3C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,2FAA2F;IAC3F,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AASD;;;;;;;;GAQG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,gBAAgB,CAA6B;gBAEzC,OAAO,EAAE,iBAAiB;IAItC,kCAAkC;IAC5B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAsClC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAkGnC,gDAAgD;IAChD,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,eAAe;IAQvB,kGAAkG;IAClG,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAyD1C,4CAA4C;IAC5C,gBAAgB,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAe1G,MAAM,IAAI,OAAO;IAOjB,OAAO,CAAC,SAAS;IAsBjB,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,cAAc;IAItB;;;OAGG;YACW,kBAAkB;IAmDhC,yEAAyE;YAC3D,cAAc;IAgE5B,oDAAoD;IACpD,OAAO,CAAC,iBAAiB;IAkBzB,yEAAyE;YAC3D,iBAAiB;YAgEjB,mBAAmB;CAoClC"}
+{"version":3,"file":"bot-manager.d.ts","sourceRoot":"","sources":["../src/bot-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI3C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AASD;;;;GAIG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,gBAAgB,CAA6B;gBAEzC,OAAO,EAAE,iBAAiB;IAItC,gGAAgG;IAC1F,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAwClC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IA0GnC,gDAAgD;IAChD,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,eAAe;IAQvB,kGAAkG;IAClG,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAyD1C,4CAA4C;IAC5C,gBAAgB,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAe1G,MAAM,IAAI,OAAO;IAOjB,OAAO,CAAC,SAAS;IAwBjB,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,cAAc;IAItB;;;OAGG;YACW,kBAAkB;IAsEhC,yEAAyE;YAC3D,cAAc;IAmE5B,oDAAoD;IACpD,OAAO,CAAC,iBAAiB;IAkBzB,yEAAyE;YAC3D,iBAAiB;IAmE/B,iFAAiF;IACjF,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;YAQzB,mBAAmB;CAoClC"}