Auth and token refresh

All snippets in the guides come from tests that pass in pnpm e2e against real backends in examples/.

examples/simple-auth: one globalBefore adds the token to every request; globalRetry refreshes it on 401 and asks eberly to replay the request (hooks.ts).

h.globalBefore(withBearer)

h.globalRetry(async ({ request, response, ctx }) => {
  if (response.status !== 401) return false
  // Don't refresh auth endpoints themselves: a wrong password must stay 401.
  if (request.path.startsWith('/auth/')) return false
  if (!ctx.getSafe({ key: 'email' }) || !ctx.getSafe({ key: 'password' })) return false
  await ctx.refresh()
  return true // → eberly replays the request with the fresh token
})

The test revokes the session, and a single call still returns 200 (refresh.test.ts):

await world.revoke({ email: 'dave@example.com' })

const res = await dave.posts.list({})
res.assert(200)

Replays are capped by maxRetries (default 3).