import { t as sanitizeForLog } from "./ansi-BCVkJ8zW.js";
import { t as formatCliCommand } from "./command-format-BwDuXB2Y.js";
import { i as normalizeProviderId } from "./provider-id-Dq06Bcx6.js";
//#region src/agents/auth-profiles/oauth-refresh-failure.ts
const OAUTH_REFRESH_FAILURE_PROVIDER_RE = /OAuth token refresh failed for ([^:]+):/i;
const SAFE_PROVIDER_ID_RE = /^[a-z0-9][a-z0-9._-]*$/;
const LEGACY_OPENAI_CODEX_PROVIDER_ID = "openai-codex";
const OPENAI_PROVIDER_ID = "openai";
function isOAuthRefreshFailureMessage(message) {
	const lower = message.toLowerCase();
	return lower.includes("oauth token refresh failed") || lower.includes("access token could not be refreshed") || lower.includes("authentication session could not be refreshed automatically");
}
function extractOAuthRefreshFailureProvider(message) {
	const provider = message.match(OAUTH_REFRESH_FAILURE_PROVIDER_RE)?.[1]?.trim();
	return provider && provider.length > 0 ? provider : null;
}
function sanitizeOAuthRefreshFailureProvider(provider) {
	const normalized = normalizeProviderId(provider ? sanitizeForLog(provider).replaceAll("`", "").trim() : "");
	return normalized && SAFE_PROVIDER_ID_RE.test(normalized) ? normalized : null;
}
function canonicalizeOAuthRefreshFailureProvider(provider) {
	return provider === LEGACY_OPENAI_CODEX_PROVIDER_ID ? OPENAI_PROVIDER_ID : provider;
}
function classifyOAuthRefreshFailureReason(message) {
	const lower = message.toLowerCase();
	if (lower.includes("refresh_token_reused")) return "refresh_token_reused";
	if (lower.includes("invalid_grant")) return "invalid_grant";
	if (lower.includes("signing in again") || lower.includes("sign in again")) return "sign_in_again";
	if (lower.includes("invalid refresh token")) return "invalid_refresh_token";
	if (lower.includes("expired or revoked") || lower.includes("revoked")) return "revoked";
	return null;
}
function classifyOAuthRefreshFailure(message) {
	if (!isOAuthRefreshFailureMessage(message)) return null;
	return {
		provider: canonicalizeOAuthRefreshFailureProvider(sanitizeOAuthRefreshFailureProvider(extractOAuthRefreshFailureProvider(message))),
		reason: classifyOAuthRefreshFailureReason(message)
	};
}
function buildOAuthRefreshFailureLoginCommand(provider) {
	const canonicalProvider = canonicalizeOAuthRefreshFailureProvider(sanitizeOAuthRefreshFailureProvider(provider));
	return canonicalProvider ? formatCliCommand(`openclaw models auth login --provider ${canonicalProvider}`) : formatCliCommand("nodmix models auth login");
}
//#endregion
export { classifyOAuthRefreshFailure as n, classifyOAuthRefreshFailureReason as r, buildOAuthRefreshFailureLoginCommand as t };
