@pear-protocol/core-sdk 1.9.0 → 1.10.0

package/dist/auth/index.d.ts

@@ -37,7 +37,11 @@ declare class Auth {
         scope: "read" | "read_write";
         authMethod: "api_key";
     }>;
-    refreshSession(headers?: ClientHeaders): Promise<void>;
+    refreshSession(headers?: ClientHeaders): Promise<{
+        accessToken: string;
+        tokenType: "Bearer";
+        expiresIn: number;
+    }>;
     refreshToken(body: HttpTypes.RefreshTokenRequest, headers?: ClientHeaders): Promise<{
         accessToken: string;
         refreshToken: string;

package/dist/index.js

@@ -9,28 +9,6 @@ import { HttpClient } from './http';
 import { FetchError } from './utils';
 export { FetchError } from './utils';
 
-const SESSION_REFRESH_PATH = "/auth/session/refresh";
-const SESSION_REFRESH_TIMEOUT_MS = 15e3;
-const isSessionRefreshRequest = (request) => {
-  try {
-    return new URL(request.url).pathname.includes(SESSION_REFRESH_PATH);
-  } catch {
-    return false;
-  }
-};
-const withTimeout = async (promise, ms, label) => {
-  let timer;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
-      })
-    ]);
-  } finally {
-    clearTimeout(timer);
-  }
-};
 class PearSDK {
   admin;
   auth;
@@ -56,7 +34,14 @@ class PearSDK {
       const refreshSession = async () => {
         if (!refreshInFlight) {
           logger.info("[session-refresh] Refreshing session...");
-          refreshInFlight = withTimeout(this.auth.refreshSession(), SESSION_REFRESH_TIMEOUT_MS, "Session refresh").then(() => logger.info("[session-refresh] Session refreshed successfully")).catch((err) => {
+          refreshInFlight = this.auth.refreshSession().then((session) => {
+            logger.info("[session-refresh] Session refreshed successfully");
+            try {
+              config.onSessionRefreshed?.(session);
+            } catch (err) {
+              logger.error("[session-refresh] onSessionRefreshed listener threw:", String(err));
+            }
+          }).catch((err) => {
             logger.error("[session-refresh] Refresh failed:", String(err));
             throw err;
           }).finally(() => {
@@ -67,25 +52,18 @@ class PearSDK {
         }
         return refreshInFlight;
       };
-      const expire = (reason) => {
-        logger.error(`[session-refresh] ${reason}`);
-        config.onSessionExpired?.();
-        throw new FetchError("Session expired. Please log in again.", "Unauthorized", 401);
-      };
-      const alreadyRetried = /* @__PURE__ */ new WeakSet();
       const sessionRefreshMiddleware = async (response, retry, request) => {
         if (response.status !== 401) return response;
-        if (isSessionRefreshRequest(request)) return response;
         logger.warn(`[session-refresh] 401 received for ${request.method} ${request.url}`);
-        if (alreadyRetried.has(request)) return expire("Still 401 after refresh, giving up");
         try {
           await refreshSession();
+          logger.info(`[session-refresh] Retrying ${request.method} ${request.url}`);
+          return retry();
         } catch {
-          return expire("Session expired, cannot recover");
+          logger.error("[session-refresh] Session expired, cannot recover");
+          config.onSessionExpired?.();
+          throw new FetchError("Session expired. Please log in again.", "Unauthorized", 401);
         }
-        alreadyRetried.add(request);
-        logger.info(`[session-refresh] Retrying ${request.method} ${request.url}`);
-        return retry();
       };
       client.useResponse(sessionRefreshMiddleware);
     }

package/dist/types.d.ts

@@ -72,6 +72,16 @@ type SDKConfig = {
      * Typical use: clear UI state and redirect to login.
      */
     onSessionExpired?: () => void;
+    /**
+     * Called with the freshly minted token whenever the SDK rotates the session
+     * itself (session mode only). Session mode keeps the session in httpOnly
+     * cookies, so this is the only way a caller can observe the access token
+     * behind it — typical use is authenticating a bearer-only API alongside.
+     * Throwing from here is swallowed; it never fails the rotation.
+     *
+     * Example: (session) => localStorage.setItem('accessToken', session.accessToken)
+     */
+    onSessionRefreshed?: (session: HttpTypes.RefreshSessionResponse) => void;
     /**
      * Logger for debugging
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pear-protocol/core-sdk",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Pear Protocol Core SDK",
   "private": false,
   "type": "module",
@@ -22,12 +22,10 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist .turbo",
-    "test": "vitest run",
-    "test:watch": "vitest",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@pear-protocol/types": "^1.12.0",
+    "@pear-protocol/types": "^1.13.0",
     "@pear-protocol/utils": "^0.2.0",
     "qs": "^6.14.0"
   },
@@ -35,7 +33,6 @@
     "@backend/typescript-config": "workspace:*",
     "@types/qs": "^6.14.0",
     "tsup": "8.5.1",
-    "typescript": "5.9.3",
-    "vitest": "4.1.2"
+    "typescript": "5.9.3"
   }
 }

package/dist/index.test.d.ts

@@ -1,2 +0,0 @@
-
-export {  }

package/dist/index.test.js

@@ -1,88 +0,0 @@
-import { describe, afterEach, vi, it, expect } from 'vitest';
-import PearSDK from './index';
-
-const json = (status, body = {}) => {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-};
-const silentLogger = {
-  error: () => {
-  },
-  warn: () => {
-  },
-  info: () => {
-  },
-  debug: () => {
-  }
-};
-const setup = (routes) => {
-  const calls = [];
-  const fetchMock = vi.fn(async (input) => {
-    const key = `${input.method} ${new URL(input.url).pathname}`;
-    calls.push(key);
-    const queue = routes[key];
-    if (!queue || queue.length === 0) {
-      throw new Error(`unexpected request: ${key}`);
-    }
-    const responder = queue.length > 1 ? queue.shift() : queue[0];
-    return responder();
-  });
-  vi.stubGlobal("fetch", fetchMock);
-  const onSessionExpired = vi.fn();
-  const sdk = new PearSDK({
-    url: "https://gateway.test",
-    auth: { type: "session" },
-    onSessionExpired,
-    logger: silentLogger
-  });
-  return { sdk, onSessionExpired, calls };
-};
-describe("session-refresh middleware", () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-    vi.useRealTimers();
-    vi.restoreAllMocks();
-  });
-  it("rejects (never hangs) when the refresh endpoint itself 401s on a dead cookie", async () => {
-    const { sdk, onSessionExpired, calls } = setup({
-      "GET /positions": [() => json(401, { message: "unauthorized" })],
-      "POST /auth/session/refresh": [() => json(401, { message: "refresh failed" })]
-    });
-    await expect(sdk.core.positions.list({})).rejects.toMatchObject({ status: 401 });
-    expect(onSessionExpired).toHaveBeenCalledTimes(1);
-    expect(calls).toEqual(["GET /positions", "POST /auth/session/refresh"]);
-  });
-  it("gives up after a single retry when the request still 401s after a successful refresh", async () => {
-    const { sdk, onSessionExpired, calls } = setup({
-      "GET /positions": [() => json(401)],
-      "POST /auth/session/refresh": [() => json(200)]
-    });
-    await expect(sdk.core.positions.list({})).rejects.toMatchObject({ status: 401 });
-    expect(calls.filter((call) => call === "GET /positions")).toHaveLength(2);
-    expect(calls.filter((call) => call === "POST /auth/session/refresh")).toHaveLength(1);
-    expect(onSessionExpired).toHaveBeenCalledTimes(1);
-  });
-  it("transparently refreshes and retries the original request on a recoverable 401", async () => {
-    const { sdk, onSessionExpired, calls } = setup({
-      "GET /positions": [() => json(401), () => json(200, { positions: ["ok"] })],
-      "POST /auth/session/refresh": [() => json(200)]
-    });
-    await expect(sdk.core.positions.list({})).resolves.toMatchObject({ positions: ["ok"] });
-    expect(onSessionExpired).not.toHaveBeenCalled();
-    expect(calls).toEqual(["GET /positions", "POST /auth/session/refresh", "GET /positions"]);
-  });
-  it("caps a stalled refresh at the timeout instead of wedging the queue", async () => {
-    vi.useFakeTimers();
-    const { sdk, onSessionExpired } = setup({
-      "GET /positions": [() => json(401)],
-      "POST /auth/session/refresh": [() => new Promise(() => {
-      })]
-    });
-    const settled = expect(sdk.core.positions.list({})).rejects.toMatchObject({ status: 401 });
-    await vi.advanceTimersByTimeAsync(15e3);
-    await settled;
-    expect(onSessionExpired).toHaveBeenCalledTimes(1);
-  });
-});