@spacelr/sdk 0.8.0 → 0.9.0

package/dist/index.d.mts

@@ -406,6 +406,14 @@ interface HttpRequestOptions {
     path: string;
     body?: unknown;
     authenticated?: boolean;
+    /**
+     * Suppress the 401 auto-recovery (forceRefresh + emitAuthLost) for this
+     * request. Used by logout: a 401 there means the session is already gone,
+     * so triggering a refresh/auth-lost would recurse (auth-lost handlers that
+     * call logout re-fire the same 401). The token is still sent so the server
+     * can revoke it when it is valid.
+     */
+    skipAuthRefresh?: boolean;
     headers?: Record<string, string>;
     query?: Record<string, string | number | undefined>;
     /** Send cookies cross-origin (credentials: 'include'). Defaults to true for /auth/ paths. */
@@ -1714,6 +1722,14 @@ interface SpacelrClient {
     onAuthLost(listener: (reason: AuthLostReason) => void): () => void;
     /** Subscribe to successful token refreshes. */
     onTokenRefreshed(listener: (tokens: StoredTokens) => void): () => void;
+    /**
+     * Returns a currently-valid access token for making your own authenticated
+     * requests. Blocks on a refresh only when the stored token is already
+     * expired; within the refresh buffer it returns the current token and
+     * refreshes in the background. Returns null when there is no refreshable
+     * session.
+     */
+    getAccessToken(): Promise<string | null>;
     /**
      * Subscribe to realtime socket connection-state changes. Fires on every
      * transition (dedup: identical consecutive states are skipped). Returns

package/dist/index.d.ts

@@ -406,6 +406,14 @@ interface HttpRequestOptions {
     path: string;
     body?: unknown;
     authenticated?: boolean;
+    /**
+     * Suppress the 401 auto-recovery (forceRefresh + emitAuthLost) for this
+     * request. Used by logout: a 401 there means the session is already gone,
+     * so triggering a refresh/auth-lost would recurse (auth-lost handlers that
+     * call logout re-fire the same 401). The token is still sent so the server
+     * can revoke it when it is valid.
+     */
+    skipAuthRefresh?: boolean;
     headers?: Record<string, string>;
     query?: Record<string, string | number | undefined>;
     /** Send cookies cross-origin (credentials: 'include'). Defaults to true for /auth/ paths. */
@@ -1714,6 +1722,14 @@ interface SpacelrClient {
     onAuthLost(listener: (reason: AuthLostReason) => void): () => void;
     /** Subscribe to successful token refreshes. */
     onTokenRefreshed(listener: (tokens: StoredTokens) => void): () => void;
+    /**
+     * Returns a currently-valid access token for making your own authenticated
+     * requests. Blocks on a refresh only when the stored token is already
+     * expired; within the refresh buffer it returns the current token and
+     * refreshes in the background. Returns null when there is no refreshable
+     * session.
+     */
+    getAccessToken(): Promise<string | null>;
     /**
      * Subscribe to realtime socket connection-state changes. Fires on every
      * transition (dedup: identical consecutive states are skipped). Returns

package/dist/index.js

@@ -158,7 +158,7 @@ var HttpClient = class {
       });
       const responseBody = await this.parseResponse(response);
       if (!response.ok) {
-        if (options.authenticated && response.status === 401) {
+        if (options.authenticated && response.status === 401 && !options.skipAuthRefresh) {
           if (await this.recoverFromAuthFailure(isRetry)) {
             return this.requestWithRetry(options, true);
           }
@@ -1438,7 +1438,11 @@ var AuthModule = class {
       await this.http.request({
         method: "POST",
         path: "/auth/logout",
-        authenticated: true
+        authenticated: true,
+        // A 401 here means the session is already gone — do not trigger the
+        // refresh/auth-lost recovery, or an auth-lost handler that calls
+        // logout would recurse into an endless 401 loop.
+        skipAuthRefresh: true
       });
     } catch {
     }
@@ -3095,6 +3099,9 @@ function createClient(config) {
     onTokenRefreshed(listener) {
       return tokenManager.onTokenRefreshed(listener);
     },
+    getAccessToken() {
+      return tokenManager.getAccessToken();
+    },
     onConnectionStateChanged(listener) {
       return realtime.onConnectionStateChanged(listener);
     },