@eyepop.ai/eyepop 3.25.6 → 3.25.7

package/dist/eyepop.index.d.mts

@@ -1472,8 +1472,8 @@ declare class Endpoint<T extends Endpoint<T>> {
     private exchange;
     private storeExchangedToken;
     /**
-     * A token that already carries an account, or that the compute API refuses as an exchanged
-     * token ("API key or user login required"), is used as is. Any other refusal is raised.
+     * A token that already carries an account, or that the compute API refuses to exchange
+     * (see NOT_EXCHANGEABLE), is used as is. Any other refusal is raised.
      */
     private exchangeLoginToken;
     private currentAccessToken;

package/dist/eyepop.index.d.ts

@@ -1472,8 +1472,8 @@ declare class Endpoint<T extends Endpoint<T>> {
     private exchange;
     private storeExchangedToken;
     /**
-     * A token that already carries an account, or that the compute API refuses as an exchanged
-     * token ("API key or user login required"), is used as is. Any other refusal is raised.
+     * A token that already carries an account, or that the compute API refuses to exchange
+     * (see NOT_EXCHANGEABLE), is used as is. Any other refusal is raised.
      */
     private exchangeLoginToken;
     private currentAccessToken;

package/dist/eyepop.index.js

@@ -9045,7 +9045,7 @@ if ("document" in globalThis && "implementation" in globalThis.document) {
 
 // endpoint.ts
 var ACCOUNT_CLAIM = "https://ident.eyepop.ai/account-uuid";
-var M2M_REFUSAL = "API key or user login required";
+var NOT_EXCHANGEABLE = ["API key or user login required", "API key authentication required for token refresh"];
 function carriesAccount(token) {
   try {
     const payload = (token.split(".")[1] ?? "").replace(/-/g, "+").replace(/_/g, "/");
@@ -9242,13 +9242,14 @@ var Endpoint = class {
     this._expire_token_time = now + token.expires_in - 60;
   }
   /**
-   * A token that already carries an account, or that the compute API refuses as an exchanged
-   * token ("API key or user login required"), is used as is. Any other refusal is raised.
+   * A token that already carries an account, or that the compute API refuses to exchange
+   * (see NOT_EXCHANGEABLE), is used as is. Any other refusal is raised.
    */
   async exchangeLoginToken(client, loginToken, validUntil, now) {
     if (!carriesAccount(loginToken)) {
       const response = await this.exchange(client, loginToken, this._options.accountId);
-      if (response.status != 401 || !(await response.clone().text()).includes(M2M_REFUSAL)) {
+      const refusal = response.status == 401 ? await response.clone().text() : "";
+      if (!NOT_EXCHANGEABLE.some((message) => refusal.includes(message))) {
         await this.storeExchangedToken(response, now);
         return;
       }