@aithos/sdk 0.1.0-alpha.11 → 0.1.0-alpha.12

package/dist/src/auth.js

@@ -479,8 +479,16 @@ export class AithosAuth {
         }
         if (!code)
             return null;
-        const session = await this.exchange(code);
+        // Strip the aithos_code from the URL SYNCHRONOUSLY, before any
+        // await. React StrictMode (dev) invokes effects twice — without
+        // this, the first call awaits exchange (microtask, code still in
+        // the URL), the second invocation reads the same code and POSTs
+        // again, hitting `auth_code_consumed: aithos_code expired or
+        // already used`. Cleaning before the await makes the second
+        // invocation read a clean URL and return null without a network
+        // round-trip.
         cleanCallbackParams(this.#win, here);
+        const session = await this.exchange(code);
         // Hydrate signers if the SSO response carried an enc_key (Google flow
         // gives us the AES-GCM key in plaintext, encrypted only in transit
         // by TLS — see auth.aithos.be design doc).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aithos/sdk",
-  "version": "0.1.0-alpha.11",
+  "version": "0.1.0-alpha.12",
   "description": "Aithos SDK — high-level TypeScript developer kit for building agentic apps on the Aithos protocol. Wraps @aithos/protocol-client and exposes the Aithos compute proxy and wallet (Stripe top-up) endpoints.",
   "keywords": [
     "aithos",