import { n as logger } from "./logger-Dyl4VcLO.js";
import { c as refreshGoogleToken, d as saveMailboxToken, l as isTokenExpired, n as refreshMicrosoftToken, u as loadMailboxToken } from "./microsoft-DgbVlHdT.js";
//#region src/sync/oauth/token-resolver.ts
/**
* Return a valid access token for a stored mailbox account, transparently
* refreshing it (and persisting the new token) when it has expired. Throws a
* clear error when no token is stored or a re-login is required.
*/
async function getFreshAccessToken(dataDir, provider, user, deps = {}) {
	const env = deps.env ?? process.env;
	const now = deps.now ?? Date.now;
	const token = loadMailboxToken(dataDir, provider, user);
	if (!token) throw new Error(`No stored ${provider} token for ${user}. Run 'dxcrm mailbox login ${provider}' first.`);
	if (!isTokenExpired(token, 6e4, now())) return token.accessToken;
	if (!token.refreshToken) throw new Error(`${provider} token for ${user} expired and has no refresh token — re-login.`);
	logger.info("oauth", "refreshing mailbox access token", {
		provider,
		user
	});
	if (provider === "gmail") {
		const clientId = env["DXCRM_GOOGLE_CLIENT_ID"];
		const clientSecret = env["DXCRM_GOOGLE_CLIENT_SECRET"];
		if (!clientId || !clientSecret) throw new Error("DXCRM_GOOGLE_CLIENT_ID / DXCRM_GOOGLE_CLIENT_SECRET are required to refresh.");
		const fresh = await (deps.refreshGoogle ?? refreshGoogleToken)(clientId, clientSecret, token.refreshToken);
		saveMailboxToken(dataDir, {
			...token,
			accessToken: fresh.accessToken,
			expiresAt: fresh.expiresAt
		});
		return fresh.accessToken;
	}
	if (provider === "microsoft") {
		const clientId = env["DXCRM_MS_CLIENT_ID"];
		if (!clientId) throw new Error("DXCRM_MS_CLIENT_ID is required to refresh.");
		const tenant = env["DXCRM_MS_TENANT"] ?? "common";
		const fresh = await (deps.refreshMicrosoft ?? refreshMicrosoftToken)(clientId, token.refreshToken, tenant);
		saveMailboxToken(dataDir, {
			...token,
			accessToken: fresh.accessToken,
			...fresh.refreshToken ? { refreshToken: fresh.refreshToken } : {},
			expiresAt: fresh.expiresAt
		});
		return fresh.accessToken;
	}
	return token.accessToken;
}
//#endregion
export { getFreshAccessToken };

//# sourceMappingURL=token-resolver-BRLOmRvF.js.map