@appshell/loader 1.0.0-alpha.85 → 1.0.0-alpha.87

package/dist/types/config/src/credentials.d.ts

@@ -3,12 +3,46 @@ export type Credential = {
     refreshToken?: string;
     /** Epoch milliseconds. */
     expiresAt?: number;
+    /**
+     * Where this credential came from, so it can renew itself.
+     *
+     * A refresh token is useless without the issuer that minted it and the client it was
+     * minted for, and neither is derivable from the registry url — an operator is free to
+     * point several registries at one issuer, or one registry at an issuer that moves.
+     * Captured at login for that reason.
+     *
+     * Optional because a credential written before this existed has neither; such a
+     * credential simply cannot refresh, and the next login repairs it.
+     */
+    issuer?: string;
+    clientId?: string;
 };
 export declare const credentialsPath: () => string;
 export declare const saveCredential: (registry: string, credential: Credential) => void;
 export declare const clearCredential: (registry: string) => void;
 /**
+ * The stored access token, or nothing if it has expired.
+ *
  * APPSHELL_TOKEN wins so CI never depends on a writable home directory.
- * Expired tokens are treated as absent; refresh is the caller's concern.
+ *
+ * Deliberately synchronous and deliberately does not refresh: callers that can await
+ * should use `ensureToken`, which renews. This remains for the places that cannot —
+ * `resolveContext` among them, which the webpack plugin calls while building.
  */
 export declare const resolveToken: (registry: string) => string | undefined;
+/**
+ * The stored access token, renewed first if it has expired.
+ *
+ * `appshell login` obtains a refresh token and, until this existed, nothing ever read it:
+ * every expiry meant a full device-authorization flow — open a browser, enter a code,
+ * approve — with the credential that would have avoided it sitting in the file.
+ *
+ * Renewal cannot widen what a caller may do. The issuer mints the new access token from
+ * the account as it stands now, so a revoked role or a disabled account produces a weaker
+ * token or none at all, never a stale stronger one.
+ *
+ * A failed renewal returns nothing rather than throwing. The caller's own 401 is the
+ * better place to explain what to do, and a network blip on the way to the issuer should
+ * not read as *you are logged out*.
+ */
+export declare const ensureToken: (registry: string) => Promise<string | undefined>;

package/dist/types/config/src/index.d.ts

@@ -4,7 +4,7 @@
 export { default as configmap } from './configmap';
 export { persistedContext, resolveContext } from './context';
 export type { AppshellContext } from './context';
-export { clearCredential, credentialsPath, resolveToken, saveCredential } from './credentials';
+export { clearCredential, credentialsPath, ensureToken, resolveToken, saveCredential, } from './credentials';
 export type { Credential } from './credentials';
 export { default as generateManifest, manifestFrom } from './generate.manifest';
 export { loaderOf } from './loader';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appshell/loader",
-  "version": "1.0.0-alpha.85",
+  "version": "1.0.0-alpha.87",
   "description": "Utility for loading Appshell components",
   "main": "dist/main.js",
   "types": "dist/loader/src/index.d.ts",
@@ -32,8 +32,8 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@appshell/runtime": "^1.0.0-alpha.85",
+    "@appshell/runtime": "^1.0.0-alpha.87",
     "@module-federation/enhanced": "^2.8.2"
   },
-  "gitHead": "d95d9d171985f76655cdd4d527127942ecfff61b"
+  "gitHead": "ead57d4dfc9dd0987584028ccb20f85c80a419a4"
 }