@pylonsync/react 0.22.15 → 0.22.17

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export type { ImageResponseOptions, ImageResponseFont, } from "./image-response"
 export type { PageProps, PageAuth, ServerData, SsrResponse, SsrCookieOptions, Metadata, GenerateMetadata, Sitemap, SitemapEntry, Robots, RobotsRule, LlmsTxt, LlmsSection, LlmsLink, RouteSegmentConfig, ErrorBoundaryProps, NotFoundProps, FormFields, FormDb, FormRequest, RouteHandler, RawRouteHandler, RawResponse, } from "./ssr";
 export { useRouter, useSearchParams, usePathname, useParams, useRouteSeed, useRouteData, redirect, notFound, NotFoundError, } from "./useRouter";
 export type { PylonRouter } from "./useRouter";
-import { type Storage as PylonStorage } from "@pylonsync/sync";
+import { type Storage as PylonStorage, type TransportConfig } from "@pylonsync/sync";
 export { useQuery, useQueryOne, useReactiveQuery, useMutation, useInfiniteQuery, usePaginatedQuery, useEntityMutation, useAction, useQueryRaw, useQueryOneRaw, useLiveList, useLiveRow, useInsert, useUpdate, useDelete, useFn, useAggregate, useSearch, } from "./hooks";
 export type { QueryOptions, QueryFilter, IncludeSpec, UseQueryReturn, UseQueryOneReturn, UseReactiveQueryReturn, UseMutationReturn, UseInfiniteQueryReturn, UsePaginatedQueryReturn, PaginatedQueryStatus, UseFnReturn, AggregateSpec, UseAggregateReturn, SearchSpec, UseSearchReturn, } from "./hooks";
 export { useAgentRun } from "./useAgentRun";
@@ -74,6 +74,21 @@ export declare function getAppName(): string;
  */
 export declare function storageKey(slot: string): string;
 export declare function configureClient(config: AgentDBClientConfig): void;
+/**
+ * Build the transport config for the React free helpers — base URL,
+ * token getter, and cookie credentials are all centralized in
+ * `pylonFetch`. Cookie-auth apps work because the transport always
+ * sets `credentials: "include"`; bearer-auth apps work because
+ * `getToken` returns the stored session token (or `explicitToken`).
+ *
+ * When the server answers that the token sent resolved to no one
+ * (`X-Pylon-Bearer-Rejected`), the stored token is cleared so later
+ * calls stop sending it and the session cookie applies alone. An
+ * `explicitToken` that is not the stored token is left to its caller.
+ *
+ * @internal Shared by the helpers in this package.
+ */
+export declare function clientTransport(explicitToken?: string): TransportConfig;
 export declare function fetchList(entity: string): Promise<Record<string, unknown>[]>;
 export declare function fetchById(entity: string, id: string): Promise<Record<string, unknown> | null>;
 export declare function insert(entity: string, data: Record<string, unknown>): Promise<{

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.22.15",
+  "version": "0.22.17",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./dist/index.d.ts",
@@ -14,9 +14,9 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@pylonsync/realtime": "0.22.15",
-    "@pylonsync/sdk": "0.22.15",
-    "@pylonsync/sync": "0.22.15"
+    "@pylonsync/realtime": "0.22.17",
+    "@pylonsync/sdk": "0.22.17",
+    "@pylonsync/sync": "0.22.17"
   },
   "peerDependencies": {
     "react": ">=19.0.0"

package/src/callFn.test.ts

@@ -6,7 +6,7 @@
 // behaved differently depending on which import you reached for.
 
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { callFn } from "./index";
+import { callFn, configureClient, getReactStorage, setReactStorage } from "./index";
 import { peekActiveEngine, setActiveEngine } from "./engine-registry";
 
 describe("callFn", () => {
@@ -74,6 +74,43 @@ describe("callFn", () => {
     expect(requests).toHaveLength(1);
   });
 
+  test("a stored token the server rejects is cleared and not sent again", async () => {
+    // The server answers `X-Pylon-Bearer-Rejected: 1` when the bearer
+    // resolved to no one; it used the session cookie instead. The next call
+    // must not resend the stale token.
+    const data = new Map<string, string>([
+      ["pylon:miles:token", "stale"],
+      ["pylon:miles:userId", "u_old"],
+    ]);
+    const prevStorage = getReactStorage();
+    setReactStorage({
+      get: (k) => data.get(k) ?? null,
+      set: (k, v) => void data.set(k, v),
+      remove: (k) => void data.delete(k),
+    });
+    configureClient({ appName: "miles" });
+    globalThis.fetch = (async (input: any, init: any = {}) => {
+      const headers = (init.headers ?? {}) as Record<string, string>;
+      requests.push({ url: String(input?.url ?? input), headers });
+      const reply: Record<string, string> = { "content-type": "application/json" };
+      if (headers.Authorization === "Bearer stale") reply["x-pylon-bearer-rejected"] = "1";
+      return new Response(JSON.stringify({ ok: true }), { status: 200, headers: reply });
+    }) as typeof fetch;
+    try {
+      await callFn("resetDemoDealership");
+      expect(data.has("pylon:miles:token")).toBe(false);
+      expect(data.has("pylon:miles:userId")).toBe(false);
+      await callFn("resetDemoDealership");
+      expect(requests.map((r) => r.headers.Authorization as string | undefined)).toEqual([
+        "Bearer stale",
+        undefined,
+      ]);
+    } finally {
+      setReactStorage(prevStorage);
+      configureClient({ appName: "default" });
+    }
+  });
+
   test("peekActiveEngine never constructs an engine", async () => {
     // The distinction from db.ts's getSync(), which deliberately does.
     expect(peekActiveEngine()).toBeNull();

package/src/hooks.ts

@@ -2,7 +2,7 @@
 
 import { SyncEngine, generateId, pylonFetch, type Row } from "@pylonsync/sync";
 import { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
-import { callFn, getBaseUrl, getReactStorage, storageKey } from "./index";
+import { callFn, clientTransport } from "./index";
 
 // ---------------------------------------------------------------------------
 // Query shapes
@@ -1014,13 +1014,7 @@ export function useAggregate<Row = Record<string, unknown>>(
     setError(null);
     try {
       const json = await pylonFetch<{ rows?: Row[] }>(
-        {
-          baseUrl: getBaseUrl(),
-          getToken: () =>
-            (getReactStorage().get(storageKey("token")) ?? undefined) as
-              | string
-              | undefined,
-        },
+        clientTransport(),
         `/api/aggregate/${entity}`,
         { method: "POST", body: specKey },
       );
@@ -1162,13 +1156,7 @@ export function useSearch<T = Row>(
         total?: number;
         tookMs?: number;
       }>(
-        {
-          baseUrl: getBaseUrl(),
-          getToken: () =>
-            (getReactStorage().get(storageKey("token")) ?? undefined) as
-              | string
-              | undefined,
-        },
+        clientTransport(),
         `/api/search/${entity}`,
         {
           method: "POST",

package/src/index.ts

@@ -70,11 +70,13 @@ export {
 export type { PylonRouter } from "./useRouter";
 
 import {
+  clearRejectedToken,
   defaultStorage,
   pylonFetch,
   pylonFetchRaw,
   PylonHttpError,
   type Storage as PylonStorage,
+  type TransportConfig,
 } from "@pylonsync/sync";
 import { peekActiveEngine } from "./engine-registry";
 
@@ -385,15 +387,29 @@ function assertBaseUrlSafeForEnv(): void {
  * token getter, and cookie credentials are all centralized in
  * `pylonFetch`. Cookie-auth apps work because the transport always
  * sets `credentials: "include"`; bearer-auth apps work because
- * `getToken` returns the cached session token.
+ * `getToken` returns the stored session token (or `explicitToken`).
+ *
+ * When the server answers that the token sent resolved to no one
+ * (`X-Pylon-Bearer-Rejected`), the stored token is cleared so later
+ * calls stop sending it and the session cookie applies alone. An
+ * `explicitToken` that is not the stored token is left to its caller.
+ *
+ * @internal Shared by the helpers in this package.
  */
-function transportConfig(): import("@pylonsync/sync").TransportConfig {
+export function clientTransport(explicitToken?: string): TransportConfig {
   return {
     baseUrl: getBaseUrl(),
-    getToken: () => currentAuthToken() ?? undefined,
+    getToken: () => explicitToken ?? currentAuthToken() ?? undefined,
+    onBearerRejected: (token) => {
+      clearRejectedToken(_storage, storageKey("token"), token);
+    },
   };
 }
 
+function transportConfig(): TransportConfig {
+  return clientTransport();
+}
+
 async function apiRequest(
   method: string,
   path: string,
@@ -610,10 +626,7 @@ export async function callFn<T = unknown>(
     return engine.fn<T>(name, args);
   }
   return pylonFetch<T>(
-    {
-      baseUrl: getBaseUrl(),
-      getToken: () => options.token ?? currentAuthToken() ?? undefined,
-    },
+    clientTransport(options.token),
     `/api/fn/${name}`,
     { method: "POST", json: args },
   );
@@ -773,10 +786,7 @@ export async function* streamFn(
   args: Record<string, unknown> = {},
   options: StreamFnOptions = {}
 ): AsyncGenerator<string, unknown, unknown> {
-  const transport = {
-    baseUrl: getBaseUrl(),
-    getToken: () => options.token ?? currentAuthToken() ?? undefined,
-  };
+  const transport = clientTransport(options.token);
   // Streaming response — use pylonFetchRaw so we can read .body
   // ourselves. URL + auth + credentials are centralized in the
   // transport.
@@ -877,10 +887,7 @@ export async function* resumeStream(
   streamId: string,
   options: { token?: string; since?: number } = {}
 ): AsyncGenerator<string, unknown, unknown> {
-  const transport = {
-    baseUrl: getBaseUrl(),
-    getToken: () => options.token ?? currentAuthToken() ?? undefined,
-  };
+  const transport = clientTransport(options.token);
   const cursor: SseCursor = {
     lastSeq: options.since ?? 0,
     terminal: false,
@@ -1018,10 +1025,7 @@ export async function uploadFile(
   filename ??= "upload";
   contentType ??= "application/octet-stream";
 
-  const transport = {
-    baseUrl: getBaseUrl(),
-    getToken: () => options.token ?? currentAuthToken() ?? undefined,
-  };
+  const transport = clientTransport(options.token);
 
   const slot = await pylonFetch<{ uploadUrl: string; assetId: string }>(
     transport,