@pear-protocol/core-sdk 1.17.0 → 1.17.1

package/dist/auth/index.d.ts

@@ -20,15 +20,38 @@ declare class Auth {
     }>;
     /**
      * Begin signing in with X. Send the browser to the returned `authorizeUrl`; X redirects
-     * back to the backend callback, which signs in the Pear account that has this X account
+     * back to the backend callback, which settles the Pear account that has this X account
      * connected. It never creates one - connect X from a signed-in session first.
      *
      * Pass `returnTo` as the page the user is on - normally `location.href` - and the
      * callback returns them there with the outcome on the query string.
+     *
+     * `handoffChallenge` is the base64url SHA-256 of a random 32-byte verifier this browser
+     * keeps. Store the verifier under the returned `handoffId`; the return URL names that id
+     * in `x_handoff` and carries the ticket in its fragment, and `exchangeXLogin` below
+     * trades the two for a session. Nothing signs the user in until that call.
      */
-    startXLogin(body?: HttpTypes.StartXLoginRequest, headers?: ClientHeaders): Promise<{
+    startXLogin(body: HttpTypes.StartXLoginRequest, headers?: ClientHeaders): Promise<{
         authorizeUrl: string;
     }>;
+    /**
+     * Redeem a finished X sign-in for a session.
+     *
+     * Read `x_ticket` from the return URL's fragment and the verifier you filed under the
+     * `x_handoff` query parameter, then call this. Returns the same token pair every other
+     * login returns and sets the session cookies, so it serves bearer and cookie clients
+     * alike. The ticket is single-use and expires in 60 seconds.
+     */
+    exchangeXLogin(body: HttpTypes.ExchangeXLoginRequest, headers?: ClientHeaders): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        user: {
+            id: string;
+            role: "basic" | "pro";
+            providerId: string | null;
+            loginMethod: "email" | "evm_wallet" | "oauth" | "x";
+        };
+    }>;
     /**
      * Unlink the authenticated user's X account. Removes the public handle immediately.
      */

package/dist/auth/index.js

@@ -1,4 +1,9 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 class Auth {
+  static {
+    __name(this, "Auth");
+  }
   client;
   constructor(client) {
     this.client = client;
@@ -18,12 +23,12 @@ class Auth {
     });
   }
   /**
-   * Begin linking an X account. Send the browser to the returned `authorizeUrl`;
-   * X redirects back to the backend callback, which finishes the link.
-   *
-   * Pass `returnTo` as the page the user is on - normally `location.href` - and the
-   * callback returns them there with the outcome on the query string.
-   */
+  * Begin linking an X account. Send the browser to the returned `authorizeUrl`;
+  * X redirects back to the backend callback, which finishes the link.
+  *
+  * Pass `returnTo` as the page the user is on - normally `location.href` - and the
+  * callback returns them there with the outcome on the query string.
+  */
   async startXLink(body = {}, headers) {
     return await this.client.fetch(`/auth/link/x/start`, {
       method: "POST",
@@ -32,14 +37,19 @@ class Auth {
     });
   }
   /**
-   * Begin signing in with X. Send the browser to the returned `authorizeUrl`; X redirects
-   * back to the backend callback, which signs in the Pear account that has this X account
-   * connected. It never creates one - connect X from a signed-in session first.
-   *
-   * Pass `returnTo` as the page the user is on - normally `location.href` - and the
-   * callback returns them there with the outcome on the query string.
-   */
-  async startXLogin(body = {}, headers) {
+  * Begin signing in with X. Send the browser to the returned `authorizeUrl`; X redirects
+  * back to the backend callback, which settles the Pear account that has this X account
+  * connected. It never creates one - connect X from a signed-in session first.
+  *
+  * Pass `returnTo` as the page the user is on - normally `location.href` - and the
+  * callback returns them there with the outcome on the query string.
+  *
+  * `handoffChallenge` is the base64url SHA-256 of a random 32-byte verifier this browser
+  * keeps. Store the verifier under the returned `handoffId`; the return URL names that id
+  * in `x_handoff` and carries the ticket in its fragment, and `exchangeXLogin` below
+  * trades the two for a session. Nothing signs the user in until that call.
+  */
+  async startXLogin(body, headers) {
     return await this.client.fetch(`/auth/login/x/start`, {
       method: "POST",
       headers,
@@ -47,8 +57,23 @@ class Auth {
     });
   }
   /**
-   * Unlink the authenticated user's X account. Removes the public handle immediately.
-   */
+  * Redeem a finished X sign-in for a session.
+  *
+  * Read `x_ticket` from the return URL's fragment and the verifier you filed under the
+  * `x_handoff` query parameter, then call this. Returns the same token pair every other
+  * login returns and sets the session cookies, so it serves bearer and cookie clients
+  * alike. The ticket is single-use and expires in 60 seconds.
+  */
+  async exchangeXLogin(body, headers) {
+    return await this.client.fetch(`/auth/login/x/exchange`, {
+      method: "POST",
+      headers,
+      body
+    });
+  }
+  /**
+  * Unlink the authenticated user's X account. Removes the public handle immediately.
+  */
   async disconnectX(headers) {
     return await this.client.fetch(`/auth/link/x`, {
       method: "DELETE",

package/dist/core/index.d.ts

@@ -187,7 +187,7 @@ declare class Core {
         get: (query?: HttpTypes.QuoteFeeParamsInput, headers?: ClientHeaders) => Promise<{
             baseBps: string;
             discounts: {
-                scope: "connector" | "all" | "user" | "client_id";
+                scope: "user" | "connector" | "all" | "client_id";
                 rate: string;
             }[];
             finalBps: string;