Function pollDeviceToken

packages/oauth/src/oauth.ts:150–193

(
  config: OAuthFlowConfig,
  deviceCode: string,
  options: { readonly deviceHeaders?: DeviceHeaders | undefined },
)

  | { readonly kind: 'denied'; readonly description: string };

export async function pollDeviceToken(
  config: OAuthFlowConfig,
  deviceCode: string,
  options: { readonly deviceHeaders?: DeviceHeaders | undefined },
): Promise<DevicePollResult> {
  const url = `${config.oauthHost.replace(/\/$/, '')}/api/oauth/token`;
  const { status, data } = await postForm(
    url,
    {
      client_id: config.clientId,
      device_code: deviceCode,
      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
    },
    options.deviceHeaders,
  );

  if (status === 200 && typeof data['access_token'] === 'string') {
    return { kind: 'success', token: tokenFromResponse(data) };
  }

  if (status >= 500) {
    throw new OAuthError(
      `Device token polling server error (HTTP ${status}): ${pickErrorDetail(data)}`,
    );
  }

  const errorCode = typeof data['error'] === 'string' ? data['error'] : 'unknown_error';
  const detail = extractApiErrorMessage(data);
  const description =
    typeof data['error_description'] === 'string' ? data['error_description'] : (detail ?? '');
  switch (errorCode) {
    case 'authorization_pending':
    case 'slow_down':
      return { kind: 'pending', errorCode, description };
    case 'expired_token':
      return { kind: 'expired' };
    case 'access_denied':
      return { kind: 'denied', description };
    default:
      throw new OAuthError(
        `Device token polling failed (HTTP ${status}): ${detail ?? `${errorCode} ${description}`}`,
      );
  }
}

// ── refreshAccessToken ────────────────────────────────────────────────