A revoked refresh token returns HTTP 400 with an OAuth body of
`error: invalid_grant` from the token endpoint. The status-only classifier
buckets every 400 as persistent, so the connection never prompts a reconnect
even though the grant is gone. Store the upstream OAuth error on WhoopApiError
and lift a 400 invalid_grant to reauth_required in classifyWhoopError; every
other 400 (a malformed request, invalid_client) stays persistent.
Add the WHOOP integration data layer on copy-of-Withings rails:
- client.ts: hand-rolled fetch over safeFetch (no SDK) — OAuth authorize
URL / code exchange / rotating-refresh, the four v2 collection fetchers
(recovery, sleep, cycle, workout) with next_token pagination, single
body-measurement + profile reads, and the field->Measurement mappers
(RECOVERY_SCORE/HRV_RMSSD/RESTING_HEART_RATE/OXYGEN_SATURATION/
SKIN_TEMPERATURE, per-stage SLEEP_DURATION ms->min, SLEEP_NEED/SLEEP_*,
DAY_STRAIN/ENERGY_EXPENDITURE_KJ, source=WHOOP). Day strain maps to
DAY_STRAIN and RMSSD to HRV_RMSSD so the device-native values never
share a bucket with the COMPUTED STRAIN_SCORE / SDNN proxies.
- response-classifier.ts: HTTP-status-driven success/transient/
reauth_required/persistent verdicts + WhoopApiError, mirroring the
Withings reason-tag classifier.
- credentials.ts: per-user BYO-key resolution, decrypting the client
id/secret from the User columns.
- oauth-state.ts: opaque-nonce mint helper + cookie/TTL constants.
- mapping.md: field->Measurement reference, kept in sync with the mappers.
Unit tests cover the classifier, pagination, every fetcher, the mappers
(ms->min, kJ->kcal factor, stage mapping, unscored-record handling), and
credential resolution against mocked WHOOP JSON. No routes / OAuth flow /
sync workers / migration yet.
Marc-André Bombeck