cf-service-sdk 0.1.18 → 0.1.19

package/dist/client.d.ts

@@ -1,11 +1,17 @@
 import { ApolloClient, NormalizedCacheObject } from '@apollo/client';
+import { TokenManager } from './tokenManager';
 export interface CloudForgeClientOptions {
     baseUrl: string;
     token?: string;
     onUnauthorized?: () => void | Promise<void>;
     onError?: (error: Error) => void;
     onValidationError?: (validationErrors: ValidationError[]) => void;
+    /** @deprecated Use the built-in TokenManager instead. Kept for backward compatibility. */
     refreshToken?: () => Promise<string | null>;
+    /** Called when token is refreshed (e.g. to persist to localStorage) */
+    onTokenRefreshed?: (token: string) => void;
+    /** Request credentials mode for HttpLink. Defaults to 'include' for cookie support. */
+    credentials?: RequestCredentials;
 }
 export interface ValidationError {
     field: string;
@@ -14,12 +20,37 @@ export interface ValidationError {
 export declare class CloudForgeClient {
     private apolloClient;
     private options;
-    private isRefreshing;
+    readonly tokenManager: TokenManager;
+    private pendingRefreshQueue;
+    private isRefreshingLink;
     constructor(options: CloudForgeClientOptions);
     private createApolloClient;
+    private isAuthError;
+    private createErrorLink;
+    /**
+     * Retry a failed operation after refreshing the token.
+     * Uses a queue to ensure only ONE refresh HTTP call is made, even when
+     * multiple operations fail simultaneously (e.g. expired JWT).
+     * The first caller triggers the refresh; subsequent callers queue up
+     * and are retried (or errored) when the single refresh completes.
+     */
+    private retryWithRefresh;
+    /**
+     * Drain the pending refresh queue: retry all queued operations with
+     * the new token, or error them all if refresh failed.
+     */
+    private drainQueue;
+    /**
+     * Update the JWT token. Does NOT recreate the Apollo client -
+     * the auth link reads the token dynamically.
+     */
     setToken(token: string): void;
     getClient(): ApolloClient<NormalizedCacheObject>;
     getBaseUrl(): string;
+    /** @deprecated Use tokenManager.refresh() instead */
     refreshToken(): Promise<boolean>;
-    logout(): void;
+    /**
+     * Logout: revoke refresh token server-side, clear Apollo cache, reset state.
+     */
+    logout(): Promise<void>;
 }

package/dist/client.js

@@ -4,262 +4,239 @@ exports.CloudForgeClient = void 0;
 const client_1 = require("@apollo/client");
 const error_1 = require("@apollo/client/link/error");
 const context_1 = require("@apollo/client/link/context");
+const tokenManager_1 = require("./tokenManager");
 const defaultOptions = {
     baseUrl: 'http://localhost:8000/api/graph/',
-};
-// Detect if we're in a React Native environment
-const isReactNative = () => {
-    return typeof global.HermesInternal !== 'undefined' ||
-        typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
+    credentials: 'include',
 };
 class CloudForgeClient {
     constructor(options) {
-        this.isRefreshing = false;
+        this.pendingRefreshQueue = [];
+        this.isRefreshingLink = false;
         this.options = { ...defaultOptions, ...options };
+        this.tokenManager = new tokenManager_1.TokenManager({
+            baseUrl: this.options.baseUrl,
+            onTokenRefreshed: (token) => {
+                var _a, _b;
+                this.options.token = token;
+                (_b = (_a = this.options).onTokenRefreshed) === null || _b === void 0 ? void 0 : _b.call(_a, token);
+            },
+            onSessionExpired: () => {
+                var _a, _b;
+                (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
+            },
+        });
+        if (this.options.token) {
+            this.tokenManager.setToken(this.options.token);
+        }
         this.apolloClient = this.createApolloClient();
     }
     createApolloClient() {
-        // Mobile device workaround: replace localhost with the device's network IP
-        // This is needed because localhost on a mobile device refers to the device itself
-        let apiUrl = this.options.baseUrl;
-        // Note: We previously modified the URL here, but now we expect the URL to be 
-        // properly configured by the application that uses this SDK, especially for React Native
-        // applications where localhost means different things on different platforms.
-        // HTTP link
+        var _a;
         const httpLink = (0, client_1.createHttpLink)({
-            uri: apiUrl,
+            uri: this.options.baseUrl,
+            credentials: (_a = this.options.credentials) !== null && _a !== void 0 ? _a : 'include',
             fetchOptions: {
-                cache: 'no-store', // Disable browser cache
+                cache: 'no-store',
             },
         });
-        // Auth link for adding the token to headers
+        // Auth link reads token dynamically - no need to recreate client on token change
         const authLink = (0, context_1.setContext)((_, { headers }) => {
-            const token = this.options.token;
+            const token = this.tokenManager.getToken();
             return {
                 headers: {
                     ...headers,
-                    authorization: token ? `JWT ${token}` : '',
+                    ...(token ? { authorization: `JWT ${token}` } : {}),
                 },
             };
         });
-        // Error handling link
-        const errorLink = (0, error_1.onError)(({ graphQLErrors, networkError, operation, forward }) => {
-            var _a, _b, _c, _d;
-            console.log('==== ERROR LINK ====');
-            console.log('==== GRAPHQL ERRORS ====');
-            console.log(graphQLErrors);
-            console.log('==== NETWORK ERROR ====');
-            console.log(networkError);
-            console.log('==== OPERATION ====');
-            console.log(operation);
+        const errorLink = this.createErrorLink();
+        const link = client_1.ApolloLink.from([errorLink, authLink, httpLink]);
+        return new client_1.ApolloClient({
+            link,
+            cache: new client_1.InMemoryCache(),
+            defaultOptions: {
+                watchQuery: {
+                    fetchPolicy: 'network-only',
+                    errorPolicy: 'all',
+                },
+                query: {
+                    fetchPolicy: 'network-only',
+                    errorPolicy: 'all',
+                },
+                mutate: {
+                    errorPolicy: 'all',
+                },
+            },
+        });
+    }
+    isAuthError(message) {
+        const msg = message.toLowerCase();
+        return (msg.includes('signature has expired') ||
+            msg.includes('error decoding signature') ||
+            (msg.includes('token') && msg.includes('expired')) ||
+            msg.includes('authentication'));
+    }
+    createErrorLink() {
+        return (0, error_1.onError)(({ graphQLErrors, networkError, operation, forward }) => {
+            var _a, _b, _c, _d, _e, _f, _g;
+            // Handle GraphQL-level auth errors
             if (graphQLErrors) {
                 const validationErrors = [];
-                graphQLErrors.forEach(({ message, locations, path }) => {
-                    var _a, _b;
-                    console.error(`[GraphQL error]: Message: ${message}, Location: ${locations}, Path: ${path}`);
-                    // Check for unauthorized errors
-                    if (message.includes('Authentication') ||
-                        message.includes('Error decoding signature') ||
-                        message.includes('JWT') ||
-                        message.toLowerCase().includes('token') ||
-                        message.includes('Signature has expired')) {
-                        console.log('==== JWT ERROR DETECTED ====', message);
-                        // Try to refresh the token if a refresh function is provided
-                        if (this.options.refreshToken && !this.isRefreshing) {
-                            this.isRefreshing = true;
-                            // Attempt to refresh the token
-                            this.options.refreshToken()
-                                .then(newToken => {
-                                var _a, _b;
-                                if (newToken) {
-                                    console.log('==== TOKEN REFRESHED ====');
-                                    // Set the new token
-                                    this.setToken(newToken);
-                                    // Retry the failed request
-                                    const oldHeaders = operation.getContext().headers;
-                                    operation.setContext({
-                                        headers: {
-                                            ...oldHeaders,
-                                            authorization: `JWT ${newToken}`,
-                                        },
-                                    });
-                                    // Retry the operation
-                                    return forward(operation);
-                                }
-                                else {
-                                    console.log('==== TOKEN REFRESH FAILED ====');
-                                    // If refresh token failed, call onUnauthorized
-                                    (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
-                                }
-                            })
-                                .catch(error => {
-                                var _a, _b;
-                                console.error('Token refresh failed:', error);
-                                (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
-                            })
-                                .finally(() => {
-                                this.isRefreshing = false;
-                            });
-                        }
-                        else {
-                            // If no refresh function is provided, just call onUnauthorized
-                            (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
-                        }
+                let hasAuthError = false;
+                graphQLErrors.forEach(({ message }) => {
+                    if (this.isAuthError(message)) {
+                        hasAuthError = true;
                     }
-                    // Check for validation errors
-                    if (message.includes('got invalid value') || message.includes('Field') && message.includes('was not provided')) {
-                        // Extract field name from validation error
+                    // Collect validation errors
+                    if (message.includes('got invalid value') || (message.includes('Field') && message.includes('was not provided'))) {
                         const fieldMatch = message.match(/Field '([^']+)'/);
-                        if (fieldMatch && fieldMatch[1]) {
-                            validationErrors.push({
-                                field: fieldMatch[1],
-                                message: message.trim()
-                            });
+                        if (fieldMatch === null || fieldMatch === void 0 ? void 0 : fieldMatch[1]) {
+                            validationErrors.push({ field: fieldMatch[1], message: message.trim() });
                         }
                     }
                 });
-                // If we found validation errors, call the validation error handler
-                if (validationErrors.length > 0 && this.options.onValidationError) {
-                    this.options.onValidationError(validationErrors);
+                if (validationErrors.length > 0) {
+                    (_b = (_a = this.options).onValidationError) === null || _b === void 0 ? void 0 : _b.call(_a, validationErrors);
+                }
+                if (hasAuthError) {
+                    return this.retryWithRefresh(operation, forward);
                 }
             }
+            // Handle network-level auth errors
             if (networkError) {
-                console.error(`[Network error]: ${networkError}`);
-                // Check if network error is related to expired signature
-                if (networkError.message && networkError.message.includes('Signature has expired')) {
-                    console.log('==== JWT NETWORK ERROR DETECTED ====', networkError.message);
-                    // Try to refresh the token if a refresh function is provided
-                    if (this.options.refreshToken && !this.isRefreshing) {
-                        this.isRefreshing = true;
-                        // Attempt to refresh the token
-                        this.options.refreshToken()
-                            .then(newToken => {
-                            var _a, _b;
-                            if (newToken) {
-                                console.log('==== TOKEN REFRESHED (NETWORK) ====');
-                                // Set the new token
-                                this.setToken(newToken);
-                                // Retry the failed request
-                                const oldHeaders = operation.getContext().headers;
-                                operation.setContext({
-                                    headers: {
-                                        ...oldHeaders,
-                                        authorization: `JWT ${newToken}`,
-                                    },
-                                });
-                                // Retry the operation
-                                return forward(operation);
-                            }
-                            else {
-                                console.log('==== TOKEN REFRESH FAILED (NETWORK) ====');
-                                // If refresh token failed, call onUnauthorized
-                                (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
-                            }
-                        })
-                            .catch(error => {
-                            var _a, _b;
-                            console.error('Token refresh failed:', error);
-                            (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
-                        })
-                            .finally(() => {
-                            this.isRefreshing = false;
-                        });
-                    }
-                    else {
-                        // If no refresh function is provided, just call onUnauthorized
-                        (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
-                    }
+                if ((_c = networkError.message) === null || _c === void 0 ? void 0 : _c.includes('Signature has expired')) {
+                    return this.retryWithRefresh(operation, forward);
                 }
-                // For server errors (400/500), try to extract more information
+                // Extract validation errors from server error responses
                 const serverError = networkError;
-                if (serverError.name === 'ServerError' &&
-                    serverError.result &&
-                    typeof serverError.result === 'object') {
-                    // Handle validation errors that might be in the response body
+                if (serverError.name === 'ServerError' && serverError.result && typeof serverError.result === 'object') {
                     try {
                         const errorResult = serverError.result;
                         if (errorResult.errors && Array.isArray(errorResult.errors)) {
                             const validationErrors = [];
                             errorResult.errors.forEach((error) => {
-                                if (error.message && (error.message.includes('got invalid value') ||
-                                    (error.message.includes('Field') && error.message.includes('was not provided')))) {
+                                if (error.message && (error.message.includes('got invalid value') || (error.message.includes('Field') && error.message.includes('was not provided')))) {
                                     const fieldMatch = error.message.match(/Field '([^']+)'/);
-                                    if (fieldMatch && fieldMatch[1]) {
-                                        validationErrors.push({
-                                            field: fieldMatch[1],
-                                            message: error.message.trim()
-                                        });
+                                    if (fieldMatch === null || fieldMatch === void 0 ? void 0 : fieldMatch[1]) {
+                                        validationErrors.push({ field: fieldMatch[1], message: error.message.trim() });
                                     }
                                 }
                             });
-                            if (validationErrors.length > 0 && this.options.onValidationError) {
-                                this.options.onValidationError(validationErrors);
+                            if (validationErrors.length > 0) {
+                                (_e = (_d = this.options).onValidationError) === null || _e === void 0 ? void 0 : _e.call(_d, validationErrors);
                             }
                         }
                     }
-                    catch (e) {
-                        console.error('Error parsing server error response:', e);
+                    catch (_h) {
+                        // Ignore parse errors
                     }
                 }
-                (_d = (_c = this.options).onError) === null || _d === void 0 ? void 0 : _d.call(_c, networkError);
+                (_g = (_f = this.options).onError) === null || _g === void 0 ? void 0 : _g.call(_f, networkError);
             }
         });
-        // Combine the links
-        const link = client_1.ApolloLink.from([errorLink, authLink, httpLink]);
-        // Create the Apollo Client
-        return new client_1.ApolloClient({
-            link,
-            cache: new client_1.InMemoryCache(),
-            defaultOptions: {
-                watchQuery: {
-                    fetchPolicy: 'network-only',
-                    errorPolicy: 'all',
-                },
-                query: {
-                    fetchPolicy: 'network-only',
-                    errorPolicy: 'all',
-                },
-                mutate: {
-                    errorPolicy: 'all',
-                },
-            },
+    }
+    /**
+     * Retry a failed operation after refreshing the token.
+     * Uses a queue to ensure only ONE refresh HTTP call is made, even when
+     * multiple operations fail simultaneously (e.g. expired JWT).
+     * The first caller triggers the refresh; subsequent callers queue up
+     * and are retried (or errored) when the single refresh completes.
+     */
+    retryWithRefresh(operation, forward) {
+        return new client_1.Observable((observer) => {
+            this.pendingRefreshQueue.push({ operation, forward, observer });
+            // If a refresh is already in-flight, this operation is queued and
+            // will be retried when that refresh completes. Don't trigger another.
+            if (this.isRefreshingLink)
+                return;
+            this.isRefreshingLink = true;
+            const refreshFn = this.options.refreshToken
+                ? this.options.refreshToken
+                : () => this.tokenManager.refresh();
+            refreshFn()
+                .then((newToken) => {
+                var _a, _b, _c, _d;
+                if (!newToken) {
+                    this.drainQueue(null, new Error('Token refresh failed'));
+                    (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
+                    return;
+                }
+                this.options.token = newToken;
+                this.tokenManager.setToken(newToken);
+                // Legacy refreshToken path bypasses TokenManager._doRefresh() which
+                // normally fires onTokenRefreshed. Call it here so consumers (e.g.
+                // cf-web persisting to localStorage) still get notified.
+                if (this.options.refreshToken) {
+                    (_d = (_c = this.options).onTokenRefreshed) === null || _d === void 0 ? void 0 : _d.call(_c, newToken);
+                }
+                this.drainQueue(newToken, null);
+            })
+                .catch((error) => {
+                var _a, _b;
+                this.drainQueue(null, error);
+                (_b = (_a = this.options).onUnauthorized) === null || _b === void 0 ? void 0 : _b.call(_a);
+            })
+                .finally(() => {
+                this.isRefreshingLink = false;
+            });
+        });
+    }
+    /**
+     * Drain the pending refresh queue: retry all queued operations with
+     * the new token, or error them all if refresh failed.
+     */
+    drainQueue(newToken, error) {
+        const queue = [...this.pendingRefreshQueue];
+        this.pendingRefreshQueue = [];
+        if (error || !newToken) {
+            queue.forEach(({ observer: obs }) => {
+                obs.error(error !== null && error !== void 0 ? error : new Error('Token refresh failed'));
+            });
+            return;
+        }
+        queue.forEach(({ operation: op, forward: fwd, observer: obs }) => {
+            op.setContext(({ headers = {} }) => ({
+                headers: { ...headers, authorization: `JWT ${newToken}` },
+            }));
+            fwd(op).subscribe(obs);
         });
     }
-    // Method to update the token
+    /**
+     * Update the JWT token. Does NOT recreate the Apollo client -
+     * the auth link reads the token dynamically.
+     */
     setToken(token) {
         this.options.token = token;
-        // Recreate the client with the new token
-        this.apolloClient = this.createApolloClient();
+        this.tokenManager.setToken(token);
     }
-    // Get the Apollo client instance
     getClient() {
         return this.apolloClient;
     }
-    // Get the base URL
     getBaseUrl() {
         return this.options.baseUrl;
     }
-    // Refresh token - attempt to get a new token
+    /** @deprecated Use tokenManager.refresh() instead */
     async refreshToken() {
-        if (this.options.refreshToken) {
-            try {
-                const newToken = await this.options.refreshToken();
-                if (newToken) {
-                    this.setToken(newToken);
-                    return true;
-                }
-            }
-            catch (error) {
-                console.error('Failed to refresh token:', error);
-            }
+        const newToken = await this.tokenManager.refresh();
+        if (newToken) {
+            this.setToken(newToken);
+            return true;
         }
         return false;
     }
-    // Logout - clear the token
-    logout() {
+    /**
+     * Logout: revoke refresh token server-side, clear Apollo cache, reset state.
+     */
+    async logout() {
+        await this.tokenManager.logout();
         this.options.token = undefined;
-        this.apolloClient = this.createApolloClient();
-        this.apolloClient.resetStore();
+        try {
+            await this.apolloClient.resetStore();
+        }
+        catch (_a) {
+            // resetStore can throw if there are active queries
+        }
     }
 }
 exports.CloudForgeClient = CloudForgeClient;

package/dist/generated/graphql.d.ts

@@ -2462,7 +2462,6 @@ export type Login = {
     id?: Maybe<Scalars['ID']['output']>;
     isAdmin?: Maybe<Scalars['Boolean']['output']>;
     payload?: Maybe<Scalars['JSONString']['output']>;
-    refreshToken?: Maybe<Scalars['String']['output']>;
     token?: Maybe<Scalars['String']['output']>;
 };
 /** LoginWithGoogle - Login with Google */
@@ -10493,7 +10492,6 @@ export type LoginMutation = {
         isAdmin?: boolean | null;
         accountId?: string | null;
         payload?: any | null;
-        refreshToken?: string | null;
         account?: {
             __typename?: 'AccountType';
             id?: string | null;

package/dist/generated/graphql.js

@@ -6460,7 +6460,6 @@ exports.LoginDocument = (0, client_1.gql) `
     isAdmin
     accountId
     payload
-    refreshToken
   }
 }
     `;

package/dist/index.d.ts

@@ -1,2 +1,4 @@
 export { CloudForgeSDK } from "./sdk";
+export { TokenManager } from "./tokenManager";
 export type { CloudForgeClientOptions } from "./client";
+export type { TokenManagerOptions } from "./tokenManager";

package/dist/index.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CloudForgeSDK = void 0;
+exports.TokenManager = exports.CloudForgeSDK = void 0;
 var sdk_1 = require("./sdk");
 Object.defineProperty(exports, "CloudForgeSDK", { enumerable: true, get: function () { return sdk_1.CloudForgeSDK; } });
+var tokenManager_1 = require("./tokenManager");
+Object.defineProperty(exports, "TokenManager", { enumerable: true, get: function () { return tokenManager_1.TokenManager; } });

package/dist/mutations.js

@@ -6952,7 +6952,6 @@ mutation Login($email: String!, $password: String!) {
     isAdmin
     accountId
     payload
-    refreshToken
   }
 }`;
 exports.UPDATE_USER_PROFILE = (0, client_1.gql) `

package/dist/tokenManager.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Central token lifecycle manager for CloudForge authentication.
+ *
+ * Handles:
+ * - Calling /api/auth/refresh/ with HttpOnly cookie credentials
+ * - Promise deduplication (concurrent 401s trigger only one refresh)
+ * - BroadcastChannel multi-tab synchronization
+ * - authFetch() wrapper for non-GraphQL requests
+ * - REST logout endpoint
+ */
+export interface TokenManagerOptions {
+    /** GraphQL endpoint URL (e.g. https://api.cloudforgesoftware.com/api/graph/) */
+    baseUrl: string;
+    /** Called when a new access token is obtained via refresh or tab sync */
+    onTokenRefreshed?: (token: string) => void;
+    /** Called when auth is irrecoverable (refresh failed, reuse detected, etc.) */
+    onSessionExpired?: () => void | Promise<void>;
+}
+export declare class TokenManager {
+    private refreshPromise;
+    private channel;
+    private token;
+    private refreshUrl;
+    private logoutUrl;
+    private options;
+    /** Resolve handle to short-circuit an in-flight refresh when another tab broadcasts a token */
+    private _broadcastResolve;
+    /** AbortController to cancel an in-flight refresh fetch when another tab already refreshed */
+    private _refreshAbort;
+    constructor(options: TokenManagerOptions);
+    getToken(): string | null;
+    setToken(token: string): void;
+    /**
+     * Refresh the access token using the HttpOnly refresh cookie.
+     * Deduplicates concurrent calls - only one refresh request is ever in flight.
+     */
+    refresh(): Promise<string | null>;
+    private _doRefresh;
+    /**
+     * Revoke the refresh token server-side and clear local state.
+     */
+    logout(): Promise<void>;
+    /**
+     * Authenticated fetch with automatic token refresh on 401.
+     * Drop-in replacement for raw fetch() calls that need JWT auth.
+     */
+    authFetch(url: string, options?: RequestInit): Promise<Response>;
+    destroy(): void;
+}

package/dist/tokenManager.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * Central token lifecycle manager for CloudForge authentication.
+ *
+ * Handles:
+ * - Calling /api/auth/refresh/ with HttpOnly cookie credentials
+ * - Promise deduplication (concurrent 401s trigger only one refresh)
+ * - BroadcastChannel multi-tab synchronization
+ * - authFetch() wrapper for non-GraphQL requests
+ * - REST logout endpoint
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenManager = void 0;
+class TokenManager {
+    constructor(options) {
+        this.refreshPromise = null;
+        this.channel = null;
+        this.token = null;
+        /** Resolve handle to short-circuit an in-flight refresh when another tab broadcasts a token */
+        this._broadcastResolve = null;
+        /** AbortController to cancel an in-flight refresh fetch when another tab already refreshed */
+        this._refreshAbort = null;
+        this.options = options;
+        // Derive auth endpoints from GraphQL base URL
+        const apiBase = options.baseUrl.replace(/\/api\/graph\/?$/, '');
+        this.refreshUrl = `${apiBase}/api/auth/refresh/`;
+        this.logoutUrl = `${apiBase}/api/auth/logout/`;
+        // Multi-tab token synchronization
+        if (typeof BroadcastChannel !== 'undefined') {
+            try {
+                this.channel = new BroadcastChannel('cf_auth');
+                this.channel.onmessage = (event) => {
+                    var _a, _b, _c, _d, _e, _f, _g, _h;
+                    if (((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) === 'TOKEN_REFRESHED' && event.data.token) {
+                        this.token = event.data.token;
+                        // Short-circuit any in-flight refresh: abort the HTTP request
+                        // and resolve the racing promise so we use the broadcast token
+                        (_b = this._refreshAbort) === null || _b === void 0 ? void 0 : _b.abort();
+                        (_c = this._broadcastResolve) === null || _c === void 0 ? void 0 : _c.call(this, event.data.token);
+                        (_e = (_d = this.options).onTokenRefreshed) === null || _e === void 0 ? void 0 : _e.call(_d, event.data.token);
+                    }
+                    else if (((_f = event.data) === null || _f === void 0 ? void 0 : _f.type) === 'LOGOUT') {
+                        this.token = null;
+                        (_h = (_g = this.options).onSessionExpired) === null || _h === void 0 ? void 0 : _h.call(_g);
+                    }
+                };
+            }
+            catch (_a) {
+                // BroadcastChannel may throw in some environments (e.g. SSR)
+            }
+        }
+    }
+    getToken() {
+        return this.token;
+    }
+    setToken(token) {
+        this.token = token;
+    }
+    /**
+     * Refresh the access token using the HttpOnly refresh cookie.
+     * Deduplicates concurrent calls - only one refresh request is ever in flight.
+     */
+    async refresh() {
+        if (this.refreshPromise)
+            return this.refreshPromise;
+        // Race the actual HTTP refresh against a broadcast from another tab.
+        // If another tab refreshes first, its broadcast resolves the race
+        // immediately and aborts our in-flight fetch.
+        const broadcastPromise = new Promise((resolve) => {
+            this._broadcastResolve = resolve;
+        });
+        this.refreshPromise = Promise.race([
+            this._doRefresh(),
+            broadcastPromise,
+        ]);
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+            this._broadcastResolve = null;
+        }
+    }
+    async _doRefresh() {
+        var _a, _b, _c;
+        this._refreshAbort = new AbortController();
+        try {
+            const response = await fetch(this.refreshUrl, {
+                method: 'POST',
+                credentials: 'include',
+                signal: this._refreshAbort.signal,
+            });
+            if (!response.ok) {
+                console.error('[CloudForgeSDK] Token refresh failed:', response.status);
+                return null;
+            }
+            const data = await response.json();
+            const newToken = data.token;
+            if (!newToken || typeof newToken !== 'string') {
+                console.error('[CloudForgeSDK] Invalid token in refresh response');
+                return null;
+            }
+            this.token = newToken;
+            (_a = this.channel) === null || _a === void 0 ? void 0 : _a.postMessage({ type: 'TOKEN_REFRESHED', token: newToken });
+            (_c = (_b = this.options).onTokenRefreshed) === null || _c === void 0 ? void 0 : _c.call(_b, newToken);
+            return newToken;
+        }
+        catch (error) {
+            // Aborted because another tab already refreshed - not an error
+            if (error instanceof DOMException && error.name === 'AbortError') {
+                return this.token;
+            }
+            console.error('[CloudForgeSDK] Refresh error:', error);
+            return null;
+        }
+        finally {
+            this._refreshAbort = null;
+        }
+    }
+    /**
+     * Revoke the refresh token server-side and clear local state.
+     */
+    async logout() {
+        var _a, _b;
+        // Cancel any in-flight refresh so it can't re-set the token after logout
+        (_a = this._refreshAbort) === null || _a === void 0 ? void 0 : _a.abort();
+        this._refreshAbort = null;
+        this.refreshPromise = null;
+        this._broadcastResolve = null;
+        try {
+            await fetch(this.logoutUrl, {
+                method: 'POST',
+                credentials: 'include',
+            });
+        }
+        catch (_c) {
+            // Best-effort - clear local state regardless
+        }
+        this.token = null;
+        (_b = this.channel) === null || _b === void 0 ? void 0 : _b.postMessage({ type: 'LOGOUT' });
+    }
+    /**
+     * Authenticated fetch with automatic token refresh on 401.
+     * Drop-in replacement for raw fetch() calls that need JWT auth.
+     */
+    async authFetch(url, options = {}) {
+        var _a, _b;
+        const headers = new Headers(options.headers);
+        if (this.token) {
+            headers.set('authorization', `JWT ${this.token}`);
+        }
+        let response = await fetch(url, { ...options, headers });
+        if (response.status === 401) {
+            const newToken = await this.refresh();
+            if (!newToken) {
+                (_b = (_a = this.options).onSessionExpired) === null || _b === void 0 ? void 0 : _b.call(_a);
+                throw new Error('Session expired');
+            }
+            headers.set('authorization', `JWT ${newToken}`);
+            response = await fetch(url, { ...options, headers });
+        }
+        return response;
+    }
+    destroy() {
+        var _a, _b;
+        (_a = this._refreshAbort) === null || _a === void 0 ? void 0 : _a.abort();
+        this._refreshAbort = null;
+        this.refreshPromise = null;
+        this._broadcastResolve = null;
+        (_b = this.channel) === null || _b === void 0 ? void 0 : _b.close();
+        this.channel = null;
+    }
+}
+exports.TokenManager = TokenManager;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cf-service-sdk",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "type": "commonjs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",