@plumile/auth

Short-lived access token helpers with configurable refresh endpoints and Relay transport integration.

The Relay integration injects createShortAccessTokenGraphqlFetch() into the Relay HTTP transport. It performs one refresh and one retry after a GraphQL 401 without replacing globalThis.fetch; network and 5xx retry policy stays owned by the Relay transport. installShortAccessTokenGraphqlRetry() is a legacy compatibility entry point and should not be used by new integrations.

createShortAccessTokenAuthHeaders({ allowAnonymous }) (also exported from @plumile/auth/authHeaders.js) provides a shared route access policy. Supply it as getAuthHeaders to configureShortAccessTokenRelayEnvironment(). It captures anonymous access before awaiting refresh, retaining that decision for retries identified by the same optional AbortSignal. Each retry reads the current token. Cancellation rejects the waiter without cancelling shared refresh; protected refresh failures reject with their original error. Calls without a signal, including WebSocket authentication, capture a new decision each time.

The default getShortAccessTokenAuthHeaders retains its permissive anonymous behavior for existing consumers; applications requiring protected requests must explicitly select the policy-aware provider.