@estiva-app/identity 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @estiva-app/identity
 
+## 0.2.2 — 2026-09-08
+
+**Additive.** `token` gains a function form; a string behaves exactly as before,
+so `^0.2.0` consumers need no change.
+
+- **`estivaIdSigner`'s `token` may now be `() => string | undefined`**, read per
+  signature instead of captured once.
+
+  Found while adopting `scheduleRenewal` in Ship, which builds its signer at
+  module scope (`web/src/api/store.ts`) and passed the token as a string. A
+  schedule replaces the *stored* token before it expires; a signer holding a
+  string keeps presenting the old one, pays a `401` on the next signature, and
+  its retry spends a **second** grant to reach a token the app already had. Two
+  rotations per expiry — and the renewal the schedule exists to make invisible is
+  not invisible at all. Adopting the schedule without this would have been
+  decorative on the write path.
+
+  A string stays supported deliberately: a script that obtains one token and
+  exits has nothing to read from, and making those write `() => t` would be
+  noise. With a reader, a renewal from anywhere is picked up without the signer
+  being told — including one written by another tab into shared storage.
+
+  A reader returning `undefined` is treated as {@link SignerTokenExpired} and
+  `/sign` is never called: signed out mid-session is not a signing failure, and
+  asking the service to judge an absent token is a round trip whose answer is
+  already known.
+
+- **Corrected a claim this package inherited and spread.** The `renew` doc said
+  access tokens "live ten minutes rather than an hour". Measured against
+  production on 2026-09-08, a token has ~3600s: `expires_in_sec` read 3544 on a
+  live session and 3554 immediately after a renewal. The sentence came from
+  Ship's own comment and I carried it here when `POST /sign` moved in, so it was
+  about to be the shared layer's version of a wrong fact. No behaviour depended
+  on it — `expires_in` is read from the response and never assumed.
+
+3 new tests, 80 to 83.
+
 ## 0.2.1 — 2026-09-08
 
 **Additive.** `SignRefused` is new; nothing that catches `Error` or reads a

package/README.md

@@ -75,8 +75,14 @@ export const { validToken, beginSignIn, completeSignIn, beginSignOut } = client
 // Peek: one round trip, a token read fresh each time
 const event = await signViaEstivaId(unsigned, { base, token, expectedPubkey: myPubkey })
 
-// Ship: a protocol Signer, built once, renewing itself
-const signer = estivaIdSigner({ base, pubkey, token, renew: client.refreshAccessToken })
+// Ship: a protocol Signer, built once. Pass a READER, not a string, if anything
+// else can replace the token — `scheduleRenewal` does.
+const signer = estivaIdSigner({
+  base,
+  pubkey,
+  token: () => client.validToken()?.accessToken,
+  renew: client.refreshAccessToken,
+})
 ```
 
 An app publishes as a person without ever seeing their secret. `@estiva-app/protocol`

package/dist/index.d.ts

@@ -46,7 +46,7 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export declare const IDENTITY_VERSION = "0.2.1";
+export declare const IDENTITY_VERSION = "0.2.2";
 export { type KeyValueStore, type ShellPhase, type ShellReason, type ShellState, type BootObservation, type BootAction, type ShellEvent, isRecoverable, SHELL_COPY, CONTINUE_LABEL, RETRY_LABEL, PROBE_TIMEOUT_MS, GUARD_TTL_MS, GUARD_KEY, decideBoot, reasonForCallbackError, readGuard, markGuard, clearGuard, logShellEvent, } from './shell.js';
 export { type EstivaIdConfig, type EstivaIdClient, type StoredToken, type FetchLike, type RenewalHandlers, type RenewalSchedule, SignInError, createEstivaId, } from './client.js';
 export { type SignViaEstivaIdOptions, type EstivaIdSignerOptions, type SignFetchLike, SignerTokenExpired, SignRefused, signViaEstivaId, estivaIdSigner, } from './signer.js';

package/dist/index.js

@@ -46,7 +46,7 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export const IDENTITY_VERSION = '0.2.1';
+export const IDENTITY_VERSION = '0.2.2';
 export { isRecoverable, SHELL_COPY, CONTINUE_LABEL, RETRY_LABEL, PROBE_TIMEOUT_MS, GUARD_TTL_MS, GUARD_KEY, decideBoot, reasonForCallbackError, readGuard, markGuard, clearGuard, logShellEvent, } from './shell.js';
 export { SignInError, createEstivaId, } from './client.js';
 export { SignerTokenExpired, SignRefused, signViaEstivaId, estivaIdSigner, } from './signer.js';

package/dist/signer.d.ts

@@ -121,15 +121,27 @@ export interface EstivaIdSignerOptions {
     base: string;
     /** The pubkey the token was issued for — `sub` in the JWT. */
     pubkey: string;
-    /** A bearer token from `POST /token`, audience-bound to this app. */
-    token: string;
+    /**
+     * A bearer token from `POST /token`, audience-bound to this app — or a
+     * function returning the current one.
+     *
+     * **Pass the function if anything else can replace the token**, which
+     * {@link EstivaIdClient.scheduleRenewal} does by design. A string is captured
+     * once and held, so a scheduled renewal would refresh the *stored* token while
+     * this signer kept presenting the old one: the next signature still pays a
+     * `401`, and the retry spends a **second** grant for a token the app already
+     * holds. Two rotations per expiry, and the invisible renewal the schedule
+     * exists to provide never happens.
+     *
+     * A string stays supported because a script that obtains one token and exits
+     * has nothing to read from, and making those pass `() => t` would be noise.
+     */
+    token: string | (() => string | undefined);
     /**
      * Renew the token, once, when `/sign` says it has expired (PEEK-108).
      *
      * Optional: without it a `401` surfaces as {@link SignerTokenExpired} for the
-     * caller to deal with, exactly as before. With it, an expiry is invisible —
-     * which matters more than it used to, because access tokens live ten minutes
-     * rather than an hour, so a session of any length crosses one.
+     * caller to deal with, exactly as before. With it, an expiry is invisible.
      *
      * Returning `null` means renewal failed and the expiry is real.
      *

package/dist/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE9E;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,KAAK,EAAE,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAEtE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,OAAO,KAAK,CAAA;AAExC,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,KAAK;;CAK5C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAkDtB;AAED,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAwCzG"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE9E;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,KAAK,EAAE,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAEtE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,OAAO,KAAK,CAAA;AAExC,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,KAAK;;CAK5C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAkDtB;AAED,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;;;;;;;;OAcG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAqDzG"}

package/dist/signer.js

@@ -90,7 +90,15 @@ export async function signViaEstivaId(unsigned, options) {
  * rather than being rediscovered on each one.
  */
 export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }) {
-    let bearer = token;
+    /*
+      A held bearer only when there is nothing to read from. When `token` is a
+      function the current value is asked for per signature, so a renewal from
+      anywhere — a schedule, another tab's write into shared storage, the retry
+      below — is picked up without this signer being told.
+    */
+    const read = typeof token === 'function' ? token : undefined;
+    let held = typeof token === 'string' ? token : undefined;
+    const bearerNow = () => (read ? read() : held);
     return {
         pubkey,
         kind: 'estiva-id',
@@ -106,6 +114,9 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }) {
                 expectedPubkey: pubkey,
                 ...(send ? { fetch: send } : {}),
             });
+            const bearer = bearerNow();
+            if (bearer === undefined)
+                throw new SignerTokenExpired();
             try {
                 return await once(bearer);
             }
@@ -124,8 +135,11 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }) {
                 const renewed = await renew();
                 if (!renewed)
                     throw error;
-                bearer = renewed;
-                return await once(bearer);
+                // Only a held bearer needs replacing. A reader already sees the new one,
+                // because `renew` wrote it where the reader reads from.
+                if (read === undefined)
+                    held = renewed;
+                return await once(renewed);
             }
         },
     };

package/dist/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AA+DA,mEAAmE;AACnE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEzB;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,WAAM,GAAN,MAAM,CAAQ;QAIvB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAuB,EACvB,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,OAAO,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;SACzC;QACD;;;;UAIE;QACF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B;SACF,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAA;YACjE,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,gEAAgE;QAClE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,kCAAkC,QAAQ,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,KAAK,CAAA;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAE3D,IAAI,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,MAAM,cAAc,OAAO,CAAC,cAAc,IAAI;YAC9F,0FAA0F,CAC7F,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAyB;IAC/F,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,OAAO;QACL,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,IAAI,CAAC,QAAQ;YACjB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,eAAe,CAAC,QAAQ,EAAE;gBACxB,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjE,+DAA+D;gBAC/D,cAAc,EAAE,MAAM;gBACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC,CAAC,CAAA;YAEJ,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf;;;;;;;;kBAQE;gBACF,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,IAAI,CAAC,KAAK;oBAAE,MAAM,KAAK,CAAA;gBACjE,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAA;gBAC7B,IAAI,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAA;gBACzB,MAAM,GAAG,OAAO,CAAA;gBAChB,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AA+DA,mEAAmE;AACnE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEzB;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,WAAM,GAAN,MAAM,CAAQ;QAIvB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAuB,EACvB,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,OAAO,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;SACzC;QACD;;;;UAIE;QACF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B;SACF,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAA;YACjE,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,gEAAgE;QAClE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,kCAAkC,QAAQ,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,KAAK,CAAA;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAE3D,IAAI,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,MAAM,cAAc,OAAO,CAAC,cAAc,IAAI;YAC9F,0FAA0F,CAC7F,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAsCD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAyB;IAC/F;;;;;MAKE;IACF,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5D,IAAI,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,MAAM,SAAS,GAAG,GAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAElE,OAAO;QACL,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,IAAI,CAAC,QAAQ;YACjB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,eAAe,CAAC,QAAQ,EAAE;gBACxB,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjE,+DAA+D;gBAC/D,cAAc,EAAE,MAAM;gBACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC,CAAC,CAAA;YAEJ,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;YAExD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf;;;;;;;;kBAQE;gBACF,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,IAAI,CAAC,KAAK;oBAAE,MAAM,KAAK,CAAA;gBACjE,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAA;gBAC7B,IAAI,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAA;gBACzB,yEAAyE;gBACzE,wDAAwD;gBACxD,IAAI,IAAI,KAAK,SAAS;oBAAE,IAAI,GAAG,OAAO,CAAA;gBACtC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estiva-app/identity",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Estiva ID sign-in: authorization code + PKCE, token storage, silent renewal, sign-out, signing via POST /sign, and the auth-shell state machine. Knows nothing about any app's data layer.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -46,7 +46,7 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export const IDENTITY_VERSION = '0.2.1'
+export const IDENTITY_VERSION = '0.2.2'
 
 export {
   type KeyValueStore,

package/src/signer.ts

@@ -184,15 +184,27 @@ export interface EstivaIdSignerOptions {
   base: string
   /** The pubkey the token was issued for — `sub` in the JWT. */
   pubkey: string
-  /** A bearer token from `POST /token`, audience-bound to this app. */
-  token: string
+  /**
+   * A bearer token from `POST /token`, audience-bound to this app — or a
+   * function returning the current one.
+   *
+   * **Pass the function if anything else can replace the token**, which
+   * {@link EstivaIdClient.scheduleRenewal} does by design. A string is captured
+   * once and held, so a scheduled renewal would refresh the *stored* token while
+   * this signer kept presenting the old one: the next signature still pays a
+   * `401`, and the retry spends a **second** grant for a token the app already
+   * holds. Two rotations per expiry, and the invisible renewal the schedule
+   * exists to provide never happens.
+   *
+   * A string stays supported because a script that obtains one token and exits
+   * has nothing to read from, and making those pass `() => t` would be noise.
+   */
+  token: string | (() => string | undefined)
   /**
    * Renew the token, once, when `/sign` says it has expired (PEEK-108).
    *
    * Optional: without it a `401` surfaces as {@link SignerTokenExpired} for the
-   * caller to deal with, exactly as before. With it, an expiry is invisible —
-   * which matters more than it used to, because access tokens live ten minutes
-   * rather than an hour, so a session of any length crosses one.
+   * caller to deal with, exactly as before. With it, an expiry is invisible.
    *
    * Returning `null` means renewal failed and the expiry is real.
    *
@@ -210,7 +222,15 @@ export interface EstivaIdSignerOptions {
  * rather than being rediscovered on each one.
  */
 export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: EstivaIdSignerOptions): Signer {
-  let bearer = token
+  /*
+    A held bearer only when there is nothing to read from. When `token` is a
+    function the current value is asked for per signature, so a renewal from
+    anywhere — a schedule, another tab's write into shared storage, the retry
+    below — is picked up without this signer being told.
+  */
+  const read = typeof token === 'function' ? token : undefined
+  let held = typeof token === 'string' ? token : undefined
+  const bearerNow = (): string | undefined => (read ? read() : held)
 
   return {
     pubkey,
@@ -229,6 +249,9 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: Esti
           ...(send ? { fetch: send } : {}),
         })
 
+      const bearer = bearerNow()
+      if (bearer === undefined) throw new SignerTokenExpired()
+
       try {
         return await once(bearer)
       } catch (error) {
@@ -244,8 +267,10 @@ export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: Esti
         if (!(error instanceof SignerTokenExpired) || !renew) throw error
         const renewed = await renew()
         if (!renewed) throw error
-        bearer = renewed
-        return await once(bearer)
+        // Only a held bearer needs replacing. A reader already sees the new one,
+        // because `renew` wrote it where the reader reads from.
+        if (read === undefined) held = renewed
+        return await once(renewed)
       }
     },
   }