@wefunder/sdk 0.1.0-beta.2 → 0.1.0-beta.4

package/README.md

@@ -8,10 +8,11 @@ Official TypeScript SDK for the [Wefunder API](https://docs.wefunder.com/api-ref
 > stabilize. Feedback welcome.
 
 ```bash
-npm install @wefunder/sdk
+npm install @wefunder/sdk@beta
 ```
 
-Node 20+ (uses the global `fetch`). ESM and CommonJS both supported.
+While in beta, releases publish to the `@beta` dist-tag (npm reserves `latest` for the
+eventual stable release). Node 20+ (uses the global `fetch`). ESM and CommonJS both supported.
 
 ### Scope & versioning
 
@@ -219,3 +220,29 @@ so the public-tier definition can't drift between the two repos. CI's
 `generated code matches spec` job verifies `src/generated` matches the committed spec;
 it cannot reach the private canonical swagger, so run `sync-spec` before cutting a
 release. (`npm test` stays hermetic.)
+
+### Releasing (maintainers)
+
+Releases publish from CI with provenance — no manual `npm publish` or OTP. Bump the
+version and push the tag; the `Release` workflow (`.github/workflows/release.yml`,
+triggered on `v*` tags) runs the `prepublishOnly` gate and publishes:
+
+```bash
+git checkout main && git pull        # clean tree, on main
+npm version prerelease --preid beta  # 0.1.0-beta.N → N+1, commits + tags v0.1.0-beta.N+1
+git push --follow-tags               # pushes the commit + tag → CI publishes
+```
+
+The workflow verifies the tag matches `package.json`, then publishes — prerelease
+versions (e.g. `0.1.0-beta.N`) to the **`beta`** dist-tag (npm requires an explicit tag
+for prereleases), stable versions to `latest`. For a stable release use
+`npm version patch|minor|major` (no `--preid`).
+
+**Auth is npm Trusted Publishing (OIDC) — no token to store.** npm exchanges the
+workflow's GitHub OIDC token for a short-lived credential at publish time, and
+provenance is generated automatically (verified-build badge on npmjs.com).
+
+**One-time setup:** on npmjs.com, `@wefunder/sdk` → **Settings → Trusted Publishing →
+GitHub Actions**, with org/user `Wefunder`, repository `wefunder-node`, workflow
+`release.yml` (leave Environment blank). No repo secret needed. (Requires this public
+repo + public package — both true.)

package/dist/index.cjs

@@ -880,13 +880,6 @@ function backoffMs(attempt, opts, random) {
   const jitter = exp * 0.5 * random();
   return Math.min(exp + jitter, opts.maxDelayMs);
 }
-function withBearer(input, init, token) {
-  const headers = new Headers(
-    init?.headers ?? (input instanceof Request ? input.headers : void 0)
-  );
-  headers.set("Authorization", `Bearer ${token}`);
-  return { ...init, headers };
-}
 function createFetch(deps) {
   const baseFetch = deps.fetch ?? fetch;
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -900,21 +893,37 @@ function createFetch(deps) {
   return async function wrappedFetch(input, init) {
     const method = methodOf(input, init);
     const idempotent = IDEMPOTENT.has(method);
+    const isRequest = input instanceof Request;
     let refreshed = false;
     let attempt = 0;
+    let retryToken;
+    const dispatch = (authToken) => {
+      if (isRequest) {
+        const fresh = input.clone();
+        if (authToken === void 0) return baseFetch(fresh);
+        const headers = new Headers(fresh.headers);
+        headers.set("Authorization", `Bearer ${authToken}`);
+        return baseFetch(new Request(fresh, { headers }));
+      }
+      const nextInit = authToken === void 0 ? init : (() => {
+        const headers = new Headers(init?.headers);
+        headers.set("Authorization", `Bearer ${authToken}`);
+        return { ...init, headers };
+      })();
+      return baseFetch(input, nextInit);
+    };
     for (; ; ) {
       let response;
       let networkError;
       try {
-        response = await baseFetch(input, init);
+        response = await dispatch(retryToken);
       } catch (err) {
         networkError = err;
       }
-      const replayable = !(input instanceof Request && input.bodyUsed);
-      if (response?.status === 401 && !refreshed && replayable && deps.tokenManager?.canRefresh) {
+      if (response?.status === 401 && !refreshed && deps.tokenManager?.canRefresh) {
         refreshed = true;
         const next = await deps.tokenManager.refresh();
-        init = withBearer(input, init, next.accessToken);
+        retryToken = next.accessToken;
         continue;
       }
       if (response?.status === 429 && attempt < retry.maxRetries) {