@spacelr/sdk 0.8.0 → 0.8.1

package/dist/index.d.mts

@@ -406,6 +406,14 @@ interface HttpRequestOptions {
     path: string;
     body?: unknown;
     authenticated?: boolean;
+    /**
+     * Suppress the 401 auto-recovery (forceRefresh + emitAuthLost) for this
+     * request. Used by logout: a 401 there means the session is already gone,
+     * so triggering a refresh/auth-lost would recurse (auth-lost handlers that
+     * call logout re-fire the same 401). The token is still sent so the server
+     * can revoke it when it is valid.
+     */
+    skipAuthRefresh?: boolean;
     headers?: Record<string, string>;
     query?: Record<string, string | number | undefined>;
     /** Send cookies cross-origin (credentials: 'include'). Defaults to true for /auth/ paths. */

package/dist/index.d.ts

@@ -406,6 +406,14 @@ interface HttpRequestOptions {
     path: string;
     body?: unknown;
     authenticated?: boolean;
+    /**
+     * Suppress the 401 auto-recovery (forceRefresh + emitAuthLost) for this
+     * request. Used by logout: a 401 there means the session is already gone,
+     * so triggering a refresh/auth-lost would recurse (auth-lost handlers that
+     * call logout re-fire the same 401). The token is still sent so the server
+     * can revoke it when it is valid.
+     */
+    skipAuthRefresh?: boolean;
     headers?: Record<string, string>;
     query?: Record<string, string | number | undefined>;
     /** Send cookies cross-origin (credentials: 'include'). Defaults to true for /auth/ paths. */

package/dist/index.js

@@ -158,7 +158,7 @@ var HttpClient = class {
       });
       const responseBody = await this.parseResponse(response);
       if (!response.ok) {
-        if (options.authenticated && response.status === 401) {
+        if (options.authenticated && response.status === 401 && !options.skipAuthRefresh) {
           if (await this.recoverFromAuthFailure(isRetry)) {
             return this.requestWithRetry(options, true);
           }
@@ -1438,7 +1438,11 @@ var AuthModule = class {
       await this.http.request({
         method: "POST",
         path: "/auth/logout",
-        authenticated: true
+        authenticated: true,
+        // A 401 here means the session is already gone — do not trigger the
+        // refresh/auth-lost recovery, or an auth-lost handler that calls
+        // logout would recurse into an endless 401 loop.
+        skipAuthRefresh: true
       });
     } catch {
     }