muonroi-cli 1.4.0 → 1.5.0

package/src/providers/auth/__tests__/openai-oauth.test.ts

@@ -1,378 +0,0 @@
-/**
- * Tests for src/providers/auth/openai-oauth.ts
- *
- * Authorization Code + PKCE loopback flow. All HTTP + browser + callback
- * server are mocked.
- */
-
-import { describe, expect, it, vi } from "vitest";
-import type { OAuthCallbackServer } from "../../../mcp/oauth-callback.js";
-import type { FetchFn } from "../device-flow.js";
-import type { CallbackServerFn, OpenBrowserFn } from "../openai-oauth.js";
-import { OpenAIOAuthProvider } from "../openai-oauth.js";
-import type { OAuthTokens } from "../types.js";
-import { OAuthLoginError, OAuthRefreshError } from "../types.js";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-interface MockResponse {
-  ok: boolean;
-  status?: number;
-  json?: () => Promise<unknown>;
-  text?: () => Promise<string>;
-}
-
-function makeMockFetch(responses: Array<MockResponse | (() => MockResponse)>) {
-  let idx = 0;
-  return vi.fn(async (_url: string, _init?: RequestInit) => {
-    const resp = responses[idx++];
-    const r = typeof resp === "function" ? resp() : resp;
-    return {
-      ok: r.ok,
-      status: r.status ?? (r.ok ? 200 : 400),
-      json: r.json ?? (() => Promise.resolve({})),
-      text: r.text ?? (() => Promise.resolve("")),
-    };
-  });
-}
-
-/**
- * Returns a CallbackServerFn that simulates a browser hitting the callback
- * URL with `?code=<authCode>&state=<state>` shortly after the server binds.
- * The state echoed back is read from the authorize URL passed to onUserCode
- * via a captured side-channel.
- */
-function makeMockCallbackServer(authCode: string, echoState: () => string): CallbackServerFn {
-  return vi.fn(async (opts) => {
-    const port = opts.port ?? 1455;
-    const path = opts.path ?? "/auth/callback";
-    const url = `http://localhost:${port}${path}`;
-    // Fire the callback asynchronously to simulate the browser round-trip.
-    setTimeout(() => opts.onCode(authCode, echoState()), 1);
-    const server: OAuthCallbackServer = {
-      port,
-      url,
-      close: vi.fn(),
-    };
-    return server;
-  }) as unknown as CallbackServerFn;
-}
-
-// ---------------------------------------------------------------------------
-// Happy-path login
-// ---------------------------------------------------------------------------
-
-describe("OpenAIOAuthProvider.login", () => {
-  it("runs Authorization Code + PKCE loopback flow and returns tokens with email", async () => {
-    const mockFetch = makeMockFetch([
-      // token exchange
-      {
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            access_token: "acc-tok-fixture",
-            refresh_token: "refresh_abc",
-            id_token: "mock-id-token",
-            expires_in: 3600,
-            account_id: "acc_789",
-          }),
-      },
-      // userinfo
-      { ok: true, json: () => Promise.resolve({ email: "user@example.com", name: "Test User" }) },
-    ]);
-
-    let capturedAuthorizeUrl = "";
-    const openBrowser: OpenBrowserFn = vi.fn((url: string) => {
-      capturedAuthorizeUrl = url;
-    });
-
-    const callbackServer = makeMockCallbackServer("auth_code_xyz", () => {
-      const u = new URL(capturedAuthorizeUrl);
-      return u.searchParams.get("state") ?? "";
-    });
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-      callbackServerFn: callbackServer,
-      openBrowserFn: openBrowser,
-    });
-
-    const userCodeCb = vi.fn();
-    const tokens = await provider.login({ onUserCode: userCodeCb });
-
-    // onUserCode receives the authorize URL (both args identical).
-    expect(userCodeCb).toHaveBeenCalled();
-    const [arg0, arg1] = userCodeCb.mock.calls[0] as [string, string];
-    expect(arg0).toBe(arg1);
-    expect(arg0).toContain("https://auth.openai.com/oauth/authorize");
-    expect(arg0).toContain("response_type=code");
-    expect(arg0).toContain("code_challenge_method=S256");
-    expect(arg0).toContain("codex_cli_simplified_flow=true");
-    expect(arg0).toContain("originator=codex_cli_rs");
-    expect(arg0).toContain("api.connectors.read");
-    expect(arg0).not.toContain("access_type=offline");
-    expect(arg0).not.toContain("prompt=consent");
-    expect(arg0).toContain("redirect_uri=http%3A%2F%2Flocalhost%3A1455%2Fauth%2Fcallback");
-
-    expect(openBrowser).toHaveBeenCalled();
-
-    expect(tokens.accessToken).toBe("acc-tok-fixture");
-    expect(tokens.refreshToken).toBe("refresh_abc");
-    expect(tokens.accountId).toBe("acc_789");
-    expect(tokens.email).toBe("user@example.com");
-    expect(tokens.expiresAt).toBeGreaterThan(Date.now());
-
-    // Token exchange POST body should carry the auth code + code_verifier.
-    const [tokenUrl, tokenInit] = mockFetch.mock.calls[0] as [string, RequestInit];
-    expect(tokenUrl).toBe("https://auth.openai.com/oauth/token");
-    const body = new URLSearchParams(tokenInit.body as string);
-    expect(body.get("grant_type")).toBe("authorization_code");
-    expect(body.get("code")).toBe("auth_code_xyz");
-    expect(body.get("redirect_uri")).toBe("http://localhost:1455/auth/callback");
-    expect(body.get("code_verifier")).toBeTruthy();
-  });
-
-  it("throws OAuthLoginError when token exchange fails", async () => {
-    const mockFetch = makeMockFetch([{ ok: false, status: 400, text: () => Promise.resolve("invalid_grant") }]);
-
-    let capturedAuthorizeUrl = "";
-    const openBrowser: OpenBrowserFn = vi.fn((url: string) => {
-      capturedAuthorizeUrl = url;
-    });
-    const callbackServer = makeMockCallbackServer("bad_code", () => {
-      const u = new URL(capturedAuthorizeUrl);
-      return u.searchParams.get("state") ?? "";
-    });
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-      callbackServerFn: callbackServer,
-      openBrowserFn: openBrowser,
-    });
-
-    await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
-  });
-
-  it("throws on state mismatch (CSRF guard)", async () => {
-    const mockFetch = makeMockFetch([]);
-    const openBrowser: OpenBrowserFn = vi.fn();
-    // Callback returns a state that does NOT match the one in the authorize URL.
-    const callbackServer = makeMockCallbackServer("auth_code_xyz", () => "attacker_state");
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-      callbackServerFn: callbackServer,
-      openBrowserFn: openBrowser,
-    });
-
-    await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
-  });
-
-  it("falls back to port 1457 when 1455 is occupied", async () => {
-    const mockFetch = makeMockFetch([
-      {
-        ok: true,
-        json: () => Promise.resolve({ access_token: "acc", refresh_token: "r", expires_in: 3600 }),
-      },
-      { ok: true, json: () => Promise.resolve({ email: "u@example.com" }) },
-    ]);
-
-    let capturedAuthorizeUrl = "";
-    let attempt = 0;
-    const callbackServer = vi.fn(async (opts: Parameters<CallbackServerFn>[0]) => {
-      attempt++;
-      if (attempt === 1) {
-        throw new Error("EADDRINUSE");
-      }
-      const port = opts.port ?? 1457;
-      const url = `http://localhost:${port}${opts.path}`;
-      setTimeout(() => {
-        const u = new URL(capturedAuthorizeUrl);
-        opts.onCode("auth_code", u.searchParams.get("state") ?? "");
-      }, 1);
-      return { port, url, close: vi.fn() } satisfies OAuthCallbackServer;
-    }) as unknown as CallbackServerFn;
-
-    const openBrowser: OpenBrowserFn = vi.fn((url: string) => {
-      capturedAuthorizeUrl = url;
-    });
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-      callbackServerFn: callbackServer,
-      openBrowserFn: openBrowser,
-    });
-
-    const tokens = await provider.login({});
-    expect(tokens.accessToken).toBe("acc");
-    expect(attempt).toBe(2);
-    expect(capturedAuthorizeUrl).toContain("redirect_uri=http%3A%2F%2Flocalhost%3A1457%2Fauth%2Fcallback");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// refresh
-// ---------------------------------------------------------------------------
-
-describe("OpenAIOAuthProvider.refresh", () => {
-  const expiredTokens: OAuthTokens = {
-    accessToken: "old-acc-tok",
-    refreshToken: "old-ref-tok",
-    expiresAt: Date.now() - 1,
-    accountId: "acc_789",
-    email: "user@example.com",
-  };
-
-  it("exchanges refresh token for new tokens", async () => {
-    const mockFetch = makeMockFetch([
-      {
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            access_token: "new-acc-tok",
-            refresh_token: "new-ref-tok",
-            expires_in: 3600,
-          }),
-      },
-    ]);
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-    });
-
-    const refreshed = await provider.refresh(expiredTokens);
-
-    expect(refreshed.accessToken).toBe("new-acc-tok");
-    expect(refreshed.refreshToken).toBe("new-ref-tok");
-    expect(refreshed.expiresAt).toBeGreaterThan(Date.now());
-    expect(refreshed.email).toBe("user@example.com");
-    expect(refreshed.accountId).toBe("acc_789");
-
-    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-    expect(url).toBe("https://auth.openai.com/oauth/token");
-    const body = new URLSearchParams(init.body as string);
-    expect(body.get("grant_type")).toBe("refresh_token");
-    expect(body.get("refresh_token")).toBe("old-ref-tok");
-  });
-
-  it("throws OAuthRefreshError on 401 (invalid_grant)", async () => {
-    const mockFetch = makeMockFetch([{ ok: false, status: 401, text: () => Promise.resolve("invalid_grant") }]);
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-    });
-
-    await expect(provider.refresh(expiredTokens)).rejects.toThrow(OAuthRefreshError);
-  });
-
-  it("returns tokens unchanged when still valid (not within refresh window)", async () => {
-    const validTokens: OAuthTokens = {
-      accessToken: "valid-acc-tok",
-      refreshToken: "valid-ref-tok",
-      expiresAt: Date.now() + 10 * 60_000,
-    };
-
-    const mockFetch = vi.fn();
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-    });
-
-    const result = await provider.refresh(validTokens);
-    expect(result).toBe(validTokens);
-    expect(mockFetch).not.toHaveBeenCalled();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// revoke
-// ---------------------------------------------------------------------------
-
-describe("OpenAIOAuthProvider.revoke", () => {
-  it("POSTs to /oauth/revoke with the refresh token", async () => {
-    const mockFetch = vi.fn().mockResolvedValue({ ok: true, json: () => Promise.resolve({}) });
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-    });
-
-    const tokens: OAuthTokens = {
-      accessToken: "acc",
-      refreshToken: "ref.token.long",
-      expiresAt: Date.now() + 3600_000,
-    };
-
-    await provider.revoke(tokens);
-
-    const [url] = mockFetch.mock.calls[0] as [string];
-    expect(url).toBe("https://auth.openai.com/oauth/revoke");
-  });
-
-  it("does not throw when revoke call fails (best-effort)", async () => {
-    const mockFetch = vi.fn().mockRejectedValue(new Error("network error"));
-
-    const provider = new OpenAIOAuthProvider({
-      issuer: "https://auth.openai.com",
-      clientId: "test_client",
-      fetchFn: mockFetch as unknown as FetchFn,
-    });
-
-    const tokens: OAuthTokens = {
-      accessToken: "acc",
-      refreshToken: "ref",
-      expiresAt: Date.now(),
-    };
-
-    await expect(provider.revoke(tokens)).resolves.not.toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// authHeaders
-// ---------------------------------------------------------------------------
-
-describe("OpenAIOAuthProvider.authHeaders", () => {
-  it("returns Authorization + ChatGPT-Account-ID when accountId present", () => {
-    const provider = new OpenAIOAuthProvider();
-    const tokens: OAuthTokens = {
-      accessToken: "mock-token",
-      refreshToken: "ref",
-      expiresAt: Date.now() + 3600_000,
-      accountId: "acc_123",
-    };
-
-    const headers = provider.authHeaders(tokens);
-    expect(headers.Authorization).toBe("Bearer mock-token");
-    expect(headers["ChatGPT-Account-ID"]).toBe("acc_123");
-  });
-
-  it("omits ChatGPT-Account-ID when accountId absent", () => {
-    const provider = new OpenAIOAuthProvider();
-    const tokens: OAuthTokens = {
-      accessToken: "mock-token",
-      refreshToken: "ref",
-      expiresAt: Date.now() + 3600_000,
-    };
-
-    const headers = provider.authHeaders(tokens);
-    expect(headers.Authorization).toBe("Bearer mock-token");
-    expect(headers["ChatGPT-Account-ID"]).toBeUndefined();
-  });
-});

package/src/providers/auth/__tests__/token-store.test.ts

@@ -1,152 +0,0 @@
-/**
- * Tests for src/providers/auth/token-store.ts
- *
- * Tests keychain-primary path with a mock keytar, and the file-fallback path
- * when keytar is unavailable.
- */
-
-import { mkdir, readFile, rm } from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { OAuthTokens } from "../types.js";
-
-// Token-store uses process.env.MUONROI_AUTH_DIR for test overrides.
-// (vi.spyOn(os, "homedir") fails in ESM — non-configurable export.)
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-// NOTE: token values kept < 16 chars to avoid triggering the pre-commit
-// secret scanner's generic-bearer pattern: /token\s*:\s*['"][^'"]{16,}['"]/
-const SAMPLE_TOKENS: OAuthTokens = {
-  accessToken: "acc-tok-fixture",
-  refreshToken: "ref-tok-fixture",
-  idToken: "id-tok-fixt",
-  accountId: "acc_123",
-  expiresAt: Date.now() + 3600_000,
-  email: "user@example.com",
-};
-
-// ---------------------------------------------------------------------------
-// Mock keytar store
-// ---------------------------------------------------------------------------
-
-function makeKeytarMock() {
-  const store = new Map<string, string>();
-  return {
-    getPassword: vi.fn(async (_svc: string, account: string) => store.get(account) ?? null),
-    setPassword: vi.fn(async (_svc: string, account: string, password: string) => {
-      store.set(account, password);
-    }),
-    deletePassword: vi.fn(async (_svc: string, account: string) => {
-      if (store.has(account)) {
-        store.delete(account);
-        return true;
-      }
-      return false;
-    }),
-    _store: store,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Tests: keychain path
-// ---------------------------------------------------------------------------
-
-describe("token-store — keychain path", () => {
-  it("saves and loads tokens via keychain", async () => {
-    const kt = makeKeytarMock();
-    // Inject mock keytar via module mock
-    vi.doMock("keytar", () => kt);
-
-    // Isolate file fallback path — without this, deleteTokens() at the end
-    // of the test would unlink() the real user's ~/.muonroi-cli/auth/openai.json.
-    const tmp = path.join(os.tmpdir(), `muonroi-test-token-store-keychain-${Date.now()}`);
-    process.env.MUONROI_AUTH_DIR = tmp;
-
-    try {
-      const { saveTokens, loadTokens, deleteTokens } = await import("../token-store.js");
-
-      await saveTokens("openai", SAMPLE_TOKENS);
-      expect(kt.setPassword).toHaveBeenCalledOnce();
-
-      const loaded = await loadTokens("openai");
-      expect(loaded).not.toBeNull();
-      expect(loaded!.accessToken).toBe(SAMPLE_TOKENS.accessToken);
-      expect(loaded!.email).toBe("user@example.com");
-
-      await deleteTokens("openai");
-      expect(kt.deletePassword).toHaveBeenCalledOnce();
-    } finally {
-      delete process.env.MUONROI_AUTH_DIR;
-      vi.doUnmock("keytar");
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Tests: file fallback path
-// ---------------------------------------------------------------------------
-
-describe("token-store — file fallback", () => {
-  let tempDir: string;
-
-  beforeEach(async () => {
-    tempDir = path.join(os.tmpdir(), `muonroi-test-token-store-${Date.now()}`);
-    await mkdir(tempDir, { recursive: true });
-    // Override auth dir via env var (token-store reads MUONROI_AUTH_DIR)
-    process.env.MUONROI_AUTH_DIR = tempDir;
-  });
-
-  afterEach(async () => {
-    delete process.env.MUONROI_AUTH_DIR;
-    await rm(tempDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
-  });
-
-  it("saves tokens to file when keytar unavailable", async () => {
-    // Make keytar unavailable
-    vi.doMock("keytar", () => {
-      throw new Error("keytar not available");
-    });
-
-    const { saveTokens, loadTokens } = await import("../token-store.js");
-
-    await saveTokens("openai", SAMPLE_TOKENS);
-
-    const filePath = path.join(tempDir, "openai.json");
-    const raw = await readFile(filePath, "utf8");
-    const parsed = JSON.parse(raw) as OAuthTokens;
-    expect(parsed.accessToken).toBe(SAMPLE_TOKENS.accessToken);
-
-    const loaded = await loadTokens("openai");
-    expect(loaded).not.toBeNull();
-    expect(loaded!.refreshToken).toBe(SAMPLE_TOKENS.refreshToken);
-
-    vi.doUnmock("keytar");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Tests: deleteTokens when nothing stored
-// ---------------------------------------------------------------------------
-
-describe("token-store — deleteTokens no-op", () => {
-  it("does not throw when nothing is stored", async () => {
-    // Point at a non-existent dir so file fallback also has nothing
-    process.env.MUONROI_AUTH_DIR = path.join(os.tmpdir(), `muonroi-nonexistent-${Date.now()}`);
-
-    vi.doMock("keytar", () => ({
-      getPassword: vi.fn(async () => null),
-      setPassword: vi.fn(async () => {}),
-      deletePassword: vi.fn(async () => false),
-    }));
-
-    const { deleteTokens } = await import("../token-store.js");
-    await expect(deleteTokens("openai")).resolves.not.toThrow();
-
-    delete process.env.MUONROI_AUTH_DIR;
-    vi.doUnmock("keytar");
-  });
-});

package/src/providers/auth/browser-flow.ts

@@ -1,140 +0,0 @@
-/**
- * src/providers/auth/browser-flow.ts
- *
- * Generic helpers for Authorization Code + PKCE browser-redirect OAuth flows.
- * Usable for any provider that supports the standard OAuth 2.0 browser-redirect
- * grant (e.g. Google Gemini). Not for device-code flows (see device-flow.ts).
- *
- * Re-exports generatePKCE from device-flow.ts so callers need only one import.
- */
-
-import type { FetchFn } from "./device-flow.js";
-
-export type { PKCEPair } from "./device-flow.js";
-export { generatePKCE } from "./device-flow.js";
-
-// ---------------------------------------------------------------------------
-// Build authorization URL
-// ---------------------------------------------------------------------------
-
-export interface BuildAuthorizeUrlOpts {
-  authEndpoint: string;
-  clientId: string;
-  redirectUri: string;
-  scopes: string[];
-  codeChallenge: string;
-  state?: string;
-}
-
-/**
- * Construct the authorization URL for a browser-redirect OAuth flow.
- * The caller opens this URL in the user's browser.
- */
-export function buildAuthorizeUrl(opts: BuildAuthorizeUrlOpts): string {
-  const params = new URLSearchParams({
-    response_type: "code",
-    client_id: opts.clientId,
-    redirect_uri: opts.redirectUri,
-    scope: opts.scopes.join(" "),
-    code_challenge: opts.codeChallenge,
-    code_challenge_method: "S256",
-    access_type: "offline",
-    prompt: "consent",
-    ...(opts.state ? { state: opts.state } : {}),
-  });
-  return `${opts.authEndpoint}?${params.toString()}`;
-}
-
-// ---------------------------------------------------------------------------
-// Exchange authorization code for tokens
-// ---------------------------------------------------------------------------
-
-export interface ExchangeBrowserCodeOpts {
-  tokenEndpoint: string;
-  clientId: string;
-  clientSecret?: string;
-  redirectUri: string;
-  code: string;
-  codeVerifier: string;
-  fetchFn?: FetchFn;
-}
-
-export interface BrowserTokenResponse {
-  access_token: string;
-  refresh_token?: string;
-  id_token?: string;
-  expires_in?: number;
-  token_type?: string;
-  scope?: string;
-}
-
-/**
- * Exchange an authorization code (obtained from the loopback callback) for
- * access/refresh tokens by POSTing to the token endpoint.
- * Throws on HTTP error.
- */
-export async function exchangeBrowserCode(opts: ExchangeBrowserCodeOpts): Promise<BrowserTokenResponse> {
-  const fetch = opts.fetchFn ?? globalThis.fetch;
-
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: opts.clientId,
-    redirect_uri: opts.redirectUri,
-    code: opts.code,
-    code_verifier: opts.codeVerifier,
-    ...(opts.clientSecret ? { client_secret: opts.clientSecret } : {}),
-  });
-
-  const res = await fetch(opts.tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: body.toString(),
-  });
-
-  if (!res.ok) {
-    const text = await res.text().catch(() => "(unreadable)");
-    throw new Error(`Token exchange failed (${res.status}): ${text}`);
-  }
-
-  return (await res.json()) as BrowserTokenResponse;
-}
-
-// ---------------------------------------------------------------------------
-// Refresh token exchange
-// ---------------------------------------------------------------------------
-
-export interface RefreshTokenOpts {
-  tokenEndpoint: string;
-  clientId: string;
-  clientSecret?: string;
-  refreshToken: string;
-  fetchFn?: FetchFn;
-}
-
-/**
- * Exchange a refresh token for new tokens.
- * Throws on HTTP error (caller should handle 400/401 as permanent failure).
- */
-export async function refreshBrowserTokens(opts: RefreshTokenOpts): Promise<BrowserTokenResponse> {
-  const fetch = opts.fetchFn ?? globalThis.fetch;
-
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: opts.clientId,
-    refresh_token: opts.refreshToken,
-    ...(opts.clientSecret ? { client_secret: opts.clientSecret } : {}),
-  });
-
-  const res = await fetch(opts.tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: body.toString(),
-  });
-
-  if (!res.ok) {
-    const text = await res.text().catch(() => "(unreadable)");
-    throw new Error(`Token refresh failed (${res.status}): ${text}`);
-  }
-
-  return (await res.json()) as BrowserTokenResponse;
-}