@estiva-app/identity 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # @estiva-app/identity
 
+## 0.2.2 — 2026-09-08
+
+**Additive.** `token` gains a function form; a string behaves exactly as before,
+so `^0.2.0` consumers need no change.
+
+- **`estivaIdSigner`'s `token` may now be `() => string | undefined`**, read per
+  signature instead of captured once.
+
+  Found while adopting `scheduleRenewal` in Ship, which builds its signer at
+  module scope (`web/src/api/store.ts`) and passed the token as a string. A
+  schedule replaces the *stored* token before it expires; a signer holding a
+  string keeps presenting the old one, pays a `401` on the next signature, and
+  its retry spends a **second** grant to reach a token the app already had. Two
+  rotations per expiry — and the renewal the schedule exists to make invisible is
+  not invisible at all. Adopting the schedule without this would have been
+  decorative on the write path.
+
+  A string stays supported deliberately: a script that obtains one token and
+  exits has nothing to read from, and making those write `() => t` would be
+  noise. With a reader, a renewal from anywhere is picked up without the signer
+  being told — including one written by another tab into shared storage.
+
+  A reader returning `undefined` is treated as {@link SignerTokenExpired} and
+  `/sign` is never called: signed out mid-session is not a signing failure, and
+  asking the service to judge an absent token is a round trip whose answer is
+  already known.
+
+- **Corrected a claim this package inherited and spread.** The `renew` doc said
+  access tokens "live ten minutes rather than an hour". Measured against
+  production on 2026-09-08, a token has ~3600s: `expires_in_sec` read 3544 on a
+  live session and 3554 immediately after a renewal. The sentence came from
+  Ship's own comment and I carried it here when `POST /sign` moved in, so it was
+  about to be the shared layer's version of a wrong fact. No behaviour depended
+  on it — `expires_in` is read from the response and never assumed.
+
+3 new tests, 80 to 83.
+
+## 0.2.1 — 2026-09-08
+
+**Additive.** `SignRefused` is new; nothing that catches `Error` or reads a
+message changes.
+
+- **A `/sign` refusal that is not an expiry now throws `SignRefused`, carrying
+  the HTTP `status`.** A `401` still throws `SignerTokenExpired`, which is the
+  one refusal a new token fixes.
+
+  The status belongs on the error because **consumers classify on it and a
+  message is not an API.** Found while wiring Peek as the third consumer:
+  `reasonForSignFailure` maps `/sign` failures into the auth shell's reason
+  vocabulary by regexing `POST /sign failed: (\d{3})` out of the message Peek's
+  own copy threw. `403` is `identity_inactive` — an administrator has to restore
+  the identity — while a `422` policy refusal is not, and neither is a `502`.
+
+  Swapping in this package's differently worded message would have collapsed
+  every one of those into a single reason. **Nothing would have failed**: Peek's
+  tests pass literal strings rather than real errors, so the regex kept matching
+  in the test suite while matching nothing in production. That is the shape worth
+  recording — the test and the code agreed with each other and both stopped
+  describing the app.
+
 ## 0.2.0 — 2026-09-07
 
 **MINOR because it adds a peer dependency**, which is a break for a consumer

package/README.md

@@ -75,8 +75,14 @@ export const { validToken, beginSignIn, completeSignIn, beginSignOut } = client
 // Peek: one round trip, a token read fresh each time
 const event = await signViaEstivaId(unsigned, { base, token, expectedPubkey: myPubkey })
 
-// Ship: a protocol Signer, built once, renewing itself
-const signer = estivaIdSigner({ base, pubkey, token, renew: client.refreshAccessToken })
+// Ship: a protocol Signer, built once. Pass a READER, not a string, if anything
+// else can replace the token — `scheduleRenewal` does.
+const signer = estivaIdSigner({
+  base,
+  pubkey,
+  token: () => client.validToken()?.accessToken,
+  renew: client.refreshAccessToken,
+})
 ```
 
 An app publishes as a person without ever seeing their secret. `@estiva-app/protocol`
@@ -90,7 +96,10 @@ built with. There were three copies of this round trip before SHA-4 and only one
 of them checked; the one that did not was Ship's, through which every write in
 Ship passes.
 
-A `401` throws `SignerTokenExpired` rather than a generic failure, and
+A `401` throws `SignerTokenExpired`; any other refusal throws `SignRefused`
+carrying the HTTP `status`, because consumers classify on it and a message is not
+an API — `403` means an administrator has to restore the identity, while a `422`
+policy refusal means something else entirely. And
 `estivaIdSigner` renews **once** and retries. Never twice: a second `401` after
 a successful renewal is a token the service will not accept, and retrying that
 is how one refused signature becomes a hot loop. Anything that is not an expiry

package/dist/index.d.ts

@@ -46,8 +46,8 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export declare const IDENTITY_VERSION = "0.2.0";
+export declare const IDENTITY_VERSION = "0.2.2";
 export { type KeyValueStore, type ShellPhase, type ShellReason, type ShellState, type BootObservation, type BootAction, type ShellEvent, isRecoverable, SHELL_COPY, CONTINUE_LABEL, RETRY_LABEL, PROBE_TIMEOUT_MS, GUARD_TTL_MS, GUARD_KEY, decideBoot, reasonForCallbackError, readGuard, markGuard, clearGuard, logShellEvent, } from './shell.js';
 export { type EstivaIdConfig, type EstivaIdClient, type StoredToken, type FetchLike, type RenewalHandlers, type RenewalSchedule, SignInError, createEstivaId, } from './client.js';
-export { type SignViaEstivaIdOptions, type EstivaIdSignerOptions, type SignFetchLike, SignerTokenExpired, signViaEstivaId, estivaIdSigner, } from './signer.js';
+export { type SignViaEstivaIdOptions, type EstivaIdSignerOptions, type SignFetchLike, SignerTokenExpired, SignRefused, signViaEstivaId, estivaIdSigner, } from './signer.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,kBAAkB,EAClB,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -46,8 +46,8 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export const IDENTITY_VERSION = '0.2.0';
+export const IDENTITY_VERSION = '0.2.2';
 export { isRecoverable, SHELL_COPY, CONTINUE_LABEL, RETRY_LABEL, PROBE_TIMEOUT_MS, GUARD_TTL_MS, GUARD_KEY, decideBoot, reasonForCallbackError, readGuard, markGuard, clearGuard, logShellEvent, } from './shell.js';
 export { SignInError, createEstivaId, } from './client.js';
-export { SignerTokenExpired, signViaEstivaId, estivaIdSigner, } from './signer.js';
+export { SignerTokenExpired, SignRefused, signViaEstivaId, estivaIdSigner, } from './signer.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,OAAO,EAQL,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EAOL,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAIL,kBAAkB,EAClB,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,OAAO,EAQL,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EAOL,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAIL,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAA"}

package/dist/signer.d.ts

@@ -67,6 +67,21 @@ export type SignFetchLike = typeof fetch;
 export declare class SignerTokenExpired extends Error {
     constructor();
 }
+/**
+ * A refusal that is not an expiry, **carrying the status that says which**.
+ *
+ * The status is on the error rather than only in its text because consumers
+ * classify on it and a message is not an API. Peek maps `/sign` failures into
+ * the auth shell's reason vocabulary — `403` is `identity_inactive`, an
+ * administrator's problem, while a `422` policy refusal is not — and it did that
+ * by regexing its own thrown string. A package that threw a differently worded
+ * message would have quietly collapsed every one of those into the same reason,
+ * and Peek's tests pass literal strings, so nothing would have failed.
+ */
+export declare class SignRefused extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
 export interface SignViaEstivaIdOptions {
     /** Origin of the identity service, e.g. `https://id.estiva.app`. */
     base: string;
@@ -106,15 +121,27 @@ export interface EstivaIdSignerOptions {
     base: string;
     /** The pubkey the token was issued for — `sub` in the JWT. */
     pubkey: string;
-    /** A bearer token from `POST /token`, audience-bound to this app. */
-    token: string;
+    /**
+     * A bearer token from `POST /token`, audience-bound to this app — or a
+     * function returning the current one.
+     *
+     * **Pass the function if anything else can replace the token**, which
+     * {@link EstivaIdClient.scheduleRenewal} does by design. A string is captured
+     * once and held, so a scheduled renewal would refresh the *stored* token while
+     * this signer kept presenting the old one: the next signature still pays a
+     * `401`, and the retry spends a **second** grant for a token the app already
+     * holds. Two rotations per expiry, and the invisible renewal the schedule
+     * exists to provide never happens.
+     *
+     * A string stays supported because a script that obtains one token and exits
+     * has nothing to read from, and making those pass `() => t` would be noise.
+     */
+    token: string | (() => string | undefined);
     /**
      * Renew the token, once, when `/sign` says it has expired (PEEK-108).
      *
      * Optional: without it a `401` surfaces as {@link SignerTokenExpired} for the
-     * caller to deal with, exactly as before. With it, an expiry is invisible —
-     * which matters more than it used to, because access tokens live ten minutes
-     * rather than an hour, so a session of any length crosses one.
+     * caller to deal with, exactly as before. With it, an expiry is invisible.
      *
      * Returning `null` means renewal failed and the expiry is real.
      *

package/dist/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE9E;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,KAAK,EAAE,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAEtE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,OAAO,KAAK,CAAA;AAExC,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,KAAK;;CAK5C;AAED,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAkDtB;AAED,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAwCzG"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE9E;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,KAAK,EAAE,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAEtE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,OAAO,KAAK,CAAA;AAExC,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,KAAK;;CAK5C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAkDtB;AAED,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;;;;;;;;OAcG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAqDzG"}

package/dist/signer.js

@@ -5,6 +5,25 @@ export class SignerTokenExpired extends Error {
         this.name = 'SignerTokenExpired';
     }
 }
+/**
+ * A refusal that is not an expiry, **carrying the status that says which**.
+ *
+ * The status is on the error rather than only in its text because consumers
+ * classify on it and a message is not an API. Peek maps `/sign` failures into
+ * the auth shell's reason vocabulary — `403` is `identity_inactive`, an
+ * administrator's problem, while a `422` policy refusal is not — and it did that
+ * by regexing its own thrown string. A package that threw a differently worded
+ * message would have quietly collapsed every one of those into the same reason,
+ * and Peek's tests pass literal strings, so nothing would have failed.
+ */
+export class SignRefused extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'SignRefused';
+    }
+}
 /**
  * One `POST /sign`.
  *
@@ -53,7 +72,7 @@ export async function signViaEstivaId(unsigned, options) {
             // Keep the raw text. `/sign`'s error bodies are not reliably JSON, and the
             // raw text is more use to a person than "unparseable response".
         }
-        throw new Error(`Estiva ID refused to sign kind:${unsigned.kind} — ${reason}`);
+        throw new SignRefused(response.status, `Estiva ID refused to sign kind:${unsigned.kind} — ${reason}`);
     }
     const event = JSON.parse(text).event;
     if (!event)
@@ -71,7 +90,15 @@ export async function signViaEstivaId(unsigned, options) {
  * rather than being rediscovered on each one.
  */
 export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }) {
-    let bearer = token;
+    /*
+      A held bearer only when there is nothing to read from. When `token` is a
+      function the current value is asked for per signature, so a renewal from
+      anywhere — a schedule, another tab's write into shared storage, the retry
+      below — is picked up without this signer being told.
+    */
+    const read = typeof token === 'function' ? token : undefined;
+    let held = typeof token === 'string' ? token : undefined;
+    const bearerNow = () => (read ? read() : held);
     return {
         pubkey,
         kind: 'estiva-id',
@@ -87,6 +114,9 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }) {
                 expectedPubkey: pubkey,
                 ...(send ? { fetch: send } : {}),
             });
+            const bearer = bearerNow();
+            if (bearer === undefined)
+                throw new SignerTokenExpired();
             try {
                 return await once(bearer);
             }
@@ -105,8 +135,11 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }) {
                 const renewed = await renew();
                 if (!renewed)
                     throw error;
-                bearer = renewed;
-                return await once(bearer);
+                // Only a held bearer needs replacing. A reader already sees the new one,
+                // because `renew` wrote it where the reader reads from.
+                if (read === undefined)
+                    held = renewed;
+                return await once(renewed);
             }
         },
     };

package/dist/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AA+DA,mEAAmE;AACnE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAuB,EACvB,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,OAAO,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;SACzC;QACD;;;;UAIE;QACF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B;SACF,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAA;YACjE,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,gEAAgE;QAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,KAAK,CAAA;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAE3D,IAAI,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,MAAM,cAAc,OAAO,CAAC,cAAc,IAAI;YAC9F,0FAA0F,CAC7F,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAyB;IAC/F,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,OAAO;QACL,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,IAAI,CAAC,QAAQ;YACjB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,eAAe,CAAC,QAAQ,EAAE;gBACxB,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjE,+DAA+D;gBAC/D,cAAc,EAAE,MAAM;gBACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC,CAAC,CAAA;YAEJ,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf;;;;;;;;kBAQE;gBACF,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,IAAI,CAAC,KAAK;oBAAE,MAAM,KAAK,CAAA;gBACjE,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAA;gBAC7B,IAAI,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAA;gBACzB,MAAM,GAAG,OAAO,CAAA;gBAChB,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AA+DA,mEAAmE;AACnE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEzB;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,WAAM,GAAN,MAAM,CAAQ;QAIvB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAuB,EACvB,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,OAAO,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;SACzC;QACD;;;;UAIE;QACF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B;SACF,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAA;YACjE,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,gEAAgE;QAClE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,kCAAkC,QAAQ,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,KAAK,CAAA;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAE3D,IAAI,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,MAAM,cAAc,OAAO,CAAC,cAAc,IAAI;YAC9F,0FAA0F,CAC7F,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAsCD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAyB;IAC/F;;;;;MAKE;IACF,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5D,IAAI,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,MAAM,SAAS,GAAG,GAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAElE,OAAO;QACL,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,IAAI,CAAC,QAAQ;YACjB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,eAAe,CAAC,QAAQ,EAAE;gBACxB,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjE,+DAA+D;gBAC/D,cAAc,EAAE,MAAM;gBACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC,CAAC,CAAA;YAEJ,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;YAExD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf;;;;;;;;kBAQE;gBACF,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,IAAI,CAAC,KAAK;oBAAE,MAAM,KAAK,CAAA;gBACjE,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAA;gBAC7B,IAAI,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAA;gBACzB,yEAAyE;gBACzE,wDAAwD;gBACxD,IAAI,IAAI,KAAK,SAAS;oBAAE,IAAI,GAAG,OAAO,CAAA;gBACtC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estiva-app/identity",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Estiva ID sign-in: authorization code + PKCE, token storage, silent renewal, sign-out, signing via POST /sign, and the auth-shell state machine. Knows nothing about any app's data layer.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -46,7 +46,7 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export const IDENTITY_VERSION = '0.2.0'
+export const IDENTITY_VERSION = '0.2.2'
 
 export {
   type KeyValueStore,
@@ -87,6 +87,7 @@ export {
   type EstivaIdSignerOptions,
   type SignFetchLike,
   SignerTokenExpired,
+  SignRefused,
   signViaEstivaId,
   estivaIdSigner,
 } from './signer.js'

package/src/signer.ts

@@ -69,6 +69,27 @@ export class SignerTokenExpired extends Error {
   }
 }
 
+/**
+ * A refusal that is not an expiry, **carrying the status that says which**.
+ *
+ * The status is on the error rather than only in its text because consumers
+ * classify on it and a message is not an API. Peek maps `/sign` failures into
+ * the auth shell's reason vocabulary — `403` is `identity_inactive`, an
+ * administrator's problem, while a `422` policy refusal is not — and it did that
+ * by regexing its own thrown string. A package that threw a differently worded
+ * message would have quietly collapsed every one of those into the same reason,
+ * and Peek's tests pass literal strings, so nothing would have failed.
+ */
+export class SignRefused extends Error {
+  constructor(
+    readonly status: number,
+    message: string,
+  ) {
+    super(message)
+    this.name = 'SignRefused'
+  }
+}
+
 export interface SignViaEstivaIdOptions {
   /** Origin of the identity service, e.g. `https://id.estiva.app`. */
   base: string
@@ -142,7 +163,7 @@ export async function signViaEstivaId(
       // Keep the raw text. `/sign`'s error bodies are not reliably JSON, and the
       // raw text is more use to a person than "unparseable response".
     }
-    throw new Error(`Estiva ID refused to sign kind:${unsigned.kind} — ${reason}`)
+    throw new SignRefused(response.status, `Estiva ID refused to sign kind:${unsigned.kind} — ${reason}`)
   }
 
   const event = (JSON.parse(text) as { event?: SignedEvent }).event
@@ -163,15 +184,27 @@ export interface EstivaIdSignerOptions {
   base: string
   /** The pubkey the token was issued for — `sub` in the JWT. */
   pubkey: string
-  /** A bearer token from `POST /token`, audience-bound to this app. */
-  token: string
+  /**
+   * A bearer token from `POST /token`, audience-bound to this app — or a
+   * function returning the current one.
+   *
+   * **Pass the function if anything else can replace the token**, which
+   * {@link EstivaIdClient.scheduleRenewal} does by design. A string is captured
+   * once and held, so a scheduled renewal would refresh the *stored* token while
+   * this signer kept presenting the old one: the next signature still pays a
+   * `401`, and the retry spends a **second** grant for a token the app already
+   * holds. Two rotations per expiry, and the invisible renewal the schedule
+   * exists to provide never happens.
+   *
+   * A string stays supported because a script that obtains one token and exits
+   * has nothing to read from, and making those pass `() => t` would be noise.
+   */
+  token: string | (() => string | undefined)
   /**
    * Renew the token, once, when `/sign` says it has expired (PEEK-108).
    *
    * Optional: without it a `401` surfaces as {@link SignerTokenExpired} for the
-   * caller to deal with, exactly as before. With it, an expiry is invisible —
-   * which matters more than it used to, because access tokens live ten minutes
-   * rather than an hour, so a session of any length crosses one.
+   * caller to deal with, exactly as before. With it, an expiry is invisible.
    *
    * Returning `null` means renewal failed and the expiry is real.
    *
@@ -189,7 +222,15 @@ export interface EstivaIdSignerOptions {
  * rather than being rediscovered on each one.
  */
 export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: EstivaIdSignerOptions): Signer {
-  let bearer = token
+  /*
+    A held bearer only when there is nothing to read from. When `token` is a
+    function the current value is asked for per signature, so a renewal from
+    anywhere — a schedule, another tab's write into shared storage, the retry
+    below — is picked up without this signer being told.
+  */
+  const read = typeof token === 'function' ? token : undefined
+  let held = typeof token === 'string' ? token : undefined
+  const bearerNow = (): string | undefined => (read ? read() : held)
 
   return {
     pubkey,
@@ -208,6 +249,9 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: Esti
           ...(send ? { fetch: send } : {}),
         })
 
+      const bearer = bearerNow()
+      if (bearer === undefined) throw new SignerTokenExpired()
+
       try {
         return await once(bearer)
       } catch (error) {
@@ -223,8 +267,10 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: Esti
         if (!(error instanceof SignerTokenExpired) || !renew) throw error
         const renewed = await renew()
         if (!renewed) throw error
-        bearer = renewed
-        return await once(bearer)
+        // Only a held bearer needs replacing. A reader already sees the new one,
+        // because `renew` wrote it where the reader reads from.
+        if (read === undefined) held = renewed
+        return await once(renewed)
       }
     },
   }