@calimero-network/mero-js 25.0.6 → 25.0.7

package/dist/mero-js.d.ts

@@ -86,6 +86,8 @@ export interface TokenData {
     access_token: string;
     refresh_token: string;
     expires_at: number;
+    /** Origin and path prefix of the issuing node; a store entry for another node is ignored. */
+    node_origin?: string;
 }
 /**
  * Main MeroJs SDK class that manages all API clients and authentication
@@ -101,6 +103,7 @@ export declare class MeroJs {
     private storeHoldsTokens;
     private tokenGeneration;
     private readonly onStorage;
+    private readonly nodeKey;
     private rpcClient;
     private sseClient;
     private wsClient;
@@ -156,6 +159,8 @@ export declare class MeroJs {
         password: string;
     }): Promise<TokenData>;
     private persistTokens;
+    /** The stored bundle, only if this node issued it; a legacy or foreign entry reads as empty. */
+    private readStoredTokens;
     private signedOutElsewhere;
     private dropLocalTokens;
     /**

package/dist/mero-js.js

@@ -28,6 +28,16 @@ function getLockManager() {
     const locks = nav?.locks;
     return locks && typeof locks.request === 'function' ? locks : null;
 }
+/** Key a token bundle to its node: origin plus path prefix, so nodes behind one host stay apart. */
+function nodeKeyOf(baseUrl) {
+    try {
+        const { origin, pathname } = new URL(baseUrl);
+        return origin === 'null' ? baseUrl : origin + pathname.replace(/\/+$/, '');
+    }
+    catch {
+        return baseUrl;
+    }
+}
 /** Try to extract `exp` (seconds) from a JWT, return ms timestamp or fallback. */
 function expiresAtFromJwt(token, fallbackMs) {
     try {
@@ -72,9 +82,10 @@ export class MeroJs {
             ...config,
         };
         this.tokenStore = config.tokenStore ?? null;
+        this.nodeKey = nodeKeyOf(config.baseUrl);
         // Restore tokens from store if available
+        this.tokenData = this.readStoredTokens();
         if (this.tokenStore) {
-            this.tokenData = this.tokenStore.getTokens();
             this.storeHoldsTokens = this.tokenData !== null;
             if (typeof window !== 'undefined')
                 window.addEventListener('storage', this.onStorage);
@@ -101,7 +112,7 @@ export class MeroJs {
             onTokenRefresh: async (newToken) => {
                 if (this.tokenData) {
                     this.tokenData.access_token = newToken;
-                    this.persistTokens(this.tokenData);
+                    this.persistTokens();
                 }
             },
             onAuthRevoked: async () => {
@@ -253,19 +264,30 @@ export class MeroJs {
                 refresh_token: response.data.refresh_token,
                 expires_at: expiresAtFromJwt(accessToken, Date.now() + 3600000),
             };
-            this.persistTokens(this.tokenData);
+            this.persistTokens();
             return this.tokenData;
         }
         catch (error) {
             throw new Error(`Authentication failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
         }
     }
-    persistTokens(data) {
-        if (!this.tokenStore)
+    persistTokens() {
+        if (!this.tokenStore || !this.tokenData)
             return;
-        this.tokenStore.setTokens(data);
+        this.tokenStore.setTokens({ ...this.tokenData, node_origin: this.nodeKey });
         this.storeHoldsTokens = this.tokenStore.getTokens() !== null;
     }
+    /** The stored bundle, only if this node issued it; a legacy or foreign entry reads as empty. */
+    readStoredTokens() {
+        const stored = this.tokenStore?.getTokens();
+        if (!stored || stored.node_origin !== this.nodeKey)
+            return null;
+        return {
+            access_token: stored.access_token,
+            refresh_token: stored.refresh_token,
+            expires_at: stored.expires_at,
+        };
+    }
     // Raw store read: an empty store is a logout, another node's bundle is not.
     signedOutElsewhere() {
         return this.storeHoldsTokens && !this.tokenStore?.getTokens();
@@ -338,7 +360,7 @@ export class MeroJs {
             this.dropLocalTokens();
             throw new Error('Signed out in another tab');
         }
-        const stored = this.tokenStore?.getTokens() ?? null;
+        const stored = this.readStoredTokens();
         if (stored?.refresh_token) {
             this.storeHoldsTokens = true;
             this.tokenData = stored;
@@ -377,7 +399,7 @@ export class MeroJs {
                 refresh_token: response.data.refresh_token,
                 expires_at: expiresAtFromJwt(accessToken, Date.now() + 3600000),
             };
-            this.persistTokens(this.tokenData);
+            this.persistTokens();
             return this.tokenData;
         }
         catch (error) {
@@ -409,7 +431,7 @@ export class MeroJs {
     setTokenData(data) {
         const expiresAt = data.expires_at || expiresAtFromJwt(data.access_token, Date.now() + 3600000);
         this.tokenData = { ...data, expires_at: expiresAt };
-        this.persistTokens(this.tokenData);
+        this.persistTokens();
     }
     /**
      * Get the current token data (for debugging)

package/dist/token-store/index.js

@@ -30,6 +30,7 @@ export class LocalStorageTokenStore {
                     access_token: parsed.access_token,
                     refresh_token: parsed.refresh_token,
                     expires_at: typeof parsed.expires_at === 'number' ? parsed.expires_at : Date.now() + 3600000,
+                    ...(typeof parsed.node_origin === 'string' && { node_origin: parsed.node_origin }),
                 };
             }
             return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "25.0.6",
+  "version": "25.0.7",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {