@koolbase/core 12.14.0 → 12.15.0

package/dist/cjs/auth.d.ts

@@ -1,5 +1,5 @@
 import { AuthStateListener, KoolbaseConfig, KoolbaseSession, KoolbaseUser, LinkPhoneParams, LoginParams, OtpSendResult, PhoneVerifyResult, RegisterParams, RestoreResult, KoolbaseAuditPage, KoolbaseSessionInfo, ResendVerificationResult, SendOtpParams, SignUpResult, SignInWithAppleParams, VerifyOtpParams } from './types.js';
-import type { SignInWithGoogleParams } from './types.js';
+import type { SignInWithGoogleParams, SignOutReason } from './types.js';
 export declare class KoolbaseAuth {
     private config;
     private storage;
@@ -9,6 +9,10 @@ export declare class KoolbaseAuth {
     private timeoutMs;
     private ongoingRefresh;
     private listeners;
+    /** Why the last session ended (#104); null while signed in or never signed in. */
+    private signOutReason;
+    /** The last renewal failed for want of a connection, not because the server refused it (#96). */
+    private renewalUnavailable;
     constructor(config: KoolbaseConfig);
     /**
      * Subscribe to authentication state changes. The listener fires:
@@ -82,6 +86,29 @@ export declare class KoolbaseAuth {
      * need to.
      */
     clearStoredSession(): Promise<void>;
+    /**
+     * Why the last session ended (#104): `'signed_out'` when the person signed
+     * out (or deleted their account), `'session_ended'` when it ended on its own
+     * -- revoked, past renewal, signed out on another device. null while signed
+     * in. Read it in an onAuthStateChange listener to say "You were signed out"
+     * only when they did not ask to be.
+     */
+    get lastSignOutReason(): SignOutReason | null;
+    /**
+     * A data request carrying `refused` came back unauthenticated. Renews the
+     * session and returns the token to send again with, or null when there is
+     * none -- nobody is signed in, or the server refused the renewal too, which
+     * ends the session (#96).
+     */
+    renewRejected(refused: string): Promise<string | null>;
+    /**
+     * A data request was refused as unauthenticated and renewing could not
+     * help: the session is over, so it ends here and every listener hears it.
+     * Unless the renewal failed only for want of a connection -- then the
+     * session may well be good, and signing someone out for a dropped network
+     * would be wrong (#96).
+     */
+    sessionRejected(): Promise<void>;
     private clearSessionInternal;
     restoreSession(): Promise<RestoreResult>;
     /**
@@ -164,6 +191,9 @@ export declare class KoolbaseAuth {
     private parseAppleSessionResponse;
     refresh(refreshToken?: string): Promise<KoolbaseSession>;
     private _doRefresh;
+    private readStored;
+    /** A newer session another tab stored after renewing `spent`, made current; null if none. */
+    private adoptNewer;
     logout(): Promise<boolean>;
     forgotPassword(email: string): Promise<void>;
     /**

package/dist/cjs/auth.js

@@ -11,6 +11,10 @@ class KoolbaseAuth {
         this.session = null;
         this.ongoingRefresh = null;
         this.listeners = new Set();
+        /** Why the last session ended (#104); null while signed in or never signed in. */
+        this.signOutReason = null;
+        /** The last renewal failed for want of a connection, not because the server refused it (#96). */
+        this.renewalUnavailable = false;
         this.config = config;
         this.metadata = new device_metadata_js_1.DeviceMetadata(config.appVersion);
         this.fetchFn = config.fetch ?? ((url, init) => (0, network_js_1.koolbaseFetch)(url, init));
@@ -152,6 +156,7 @@ class KoolbaseAuth {
     }
     async setSessionInternal(session) {
         this.session = session;
+        this.signOutReason = null;
         if (this.storage) {
             try {
                 await this.storage.saveSession(session);
@@ -178,9 +183,52 @@ class KoolbaseAuth {
      * need to.
      */
     async clearStoredSession() {
-        await this.clearSessionInternal();
+        await this.clearSessionInternal('session_ended');
     }
-    async clearSessionInternal() {
+    /**
+     * Why the last session ended (#104): `'signed_out'` when the person signed
+     * out (or deleted their account), `'session_ended'` when it ended on its own
+     * -- revoked, past renewal, signed out on another device. null while signed
+     * in. Read it in an onAuthStateChange listener to say "You were signed out"
+     * only when they did not ask to be.
+     */
+    get lastSignOutReason() {
+        return this.signOutReason;
+    }
+    /**
+     * A data request carrying `refused` came back unauthenticated. Renews the
+     * session and returns the token to send again with, or null when there is
+     * none -- nobody is signed in, or the server refused the renewal too, which
+     * ends the session (#96).
+     */
+    async renewRejected(refused) {
+        if (!this.session)
+            return null;
+        // Another request renewed it while this one was out.
+        if (this.session.accessToken !== refused)
+            return this.session.accessToken;
+        try {
+            return (await this.refresh()).accessToken;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * A data request was refused as unauthenticated and renewing could not
+     * help: the session is over, so it ends here and every listener hears it.
+     * Unless the renewal failed only for want of a connection -- then the
+     * session may well be good, and signing someone out for a dropped network
+     * would be wrong (#96).
+     */
+    async sessionRejected() {
+        if (!this.session || this.renewalUnavailable)
+            return;
+        await this.clearSessionInternal('session_ended');
+    }
+    async clearSessionInternal(reason = 'session_ended') {
+        if (this.session)
+            this.signOutReason = reason;
         this.session = null;
         if (this.storage) {
             try {
@@ -208,7 +256,28 @@ class KoolbaseAuth {
             : 0;
         const oneMinuteMs = 60 * 1000;
         if (expiresAt > Date.now() + oneMinuteMs) {
-            return types_js_1.RestoreResult.Restored;
+            // Valid by the clock is not valid: the session may have been signed out
+            // on another device, revoked, or the account disabled since. Ask the
+            // server before saying it is restored (#104). No answer -- offline, a
+            // timeout, a server error -- keeps the optimistic session: Offline.
+            try {
+                const res = await this.authRequest('/v1/sdk/auth/me', { method: 'GET', includeAuth: true });
+                if (res.ok) {
+                    try {
+                        await this.updateUserAndPersist(this.mapUser(await res.json()));
+                    }
+                    catch {
+                        // The session is good; a user that will not parse keeps the stored one.
+                    }
+                    return types_js_1.RestoreResult.Restored;
+                }
+                if (res.status !== 401)
+                    return types_js_1.RestoreResult.Offline;
+                // Refused: the access token is done. The refresh token decides.
+            }
+            catch {
+                return types_js_1.RestoreResult.Offline;
+            }
         }
         try {
             await this.refresh(persisted.refreshToken);
@@ -224,8 +293,8 @@ class KoolbaseAuth {
             // key or the request rather than the user's session — and deleting the
             // refresh token on that reading signs someone out with no way back.
             // Nothing reaches here with it today; it stays out so nothing does.
-            if (e instanceof auth_errors_js_1.SessionExpiredError) {
-                await this.clearSessionInternal();
+            if (isRejection(e)) {
+                await this.clearSessionInternal('session_ended');
                 return types_js_1.RestoreResult.Expired;
             }
             return types_js_1.RestoreResult.Offline;
@@ -498,17 +567,77 @@ class KoolbaseAuth {
         return promise;
     }
     async _doRefresh(refreshToken) {
-        const token = refreshToken ?? this.session?.refreshToken;
+        // The newest refresh token is the stored one: another tab of the same app
+        // may have renewed the session, and its in-memory copy here is spent.
+        const stored = refreshToken ? null : await this.readStored();
+        const token = refreshToken ?? stored?.refreshToken ?? this.session?.refreshToken;
         if (!token) {
             throw new auth_errors_js_1.SessionExpiredError();
         }
-        const res = await this.authRequest('/v1/sdk/auth/refresh', {
-            method: 'POST',
-            body: { refresh_token: token },
-        });
-        const session = await this.parseSessionResponse(res, true);
-        await this.setSessionInternal(session);
-        return session;
+        try {
+            const res = await this.authRequest('/v1/sdk/auth/refresh', {
+                method: 'POST',
+                body: { refresh_token: token },
+            });
+            const session = await this.parseSessionResponse(res, true);
+            this.renewalUnavailable = false;
+            await this.setSessionInternal(session);
+            return session;
+        }
+        catch (e) {
+            if (!isRejection(e)) {
+                // No answer, or a server error: the session may be fine. Keep it.
+                this.renewalUnavailable = true;
+                throw e;
+            }
+            this.renewalUnavailable = false;
+            // Two tabs renewing at the same moment send the same token; the
+            // server renews one and refuses the other. The winner's session is in
+            // storage: take it rather than signing out (#96).
+            const adopted = await this.adoptNewer(token);
+            if (adopted)
+                return adopted;
+            await this.clearSessionInternal('session_ended');
+            throw e;
+        }
+    }
+    async readStored() {
+        if (!this.storage)
+            return null;
+        try {
+            return await this.storage.readSession();
+        }
+        catch {
+            return null;
+        }
+    }
+    /** A newer session another tab stored after renewing `spent`, made current; null if none. */
+    async adoptNewer(spent) {
+        for (const wait of [0, 400]) {
+            if (wait)
+                await new Promise((r) => setTimeout(r, wait));
+            const stored = await this.readStored();
+            if (!stored || stored.refreshToken === spent)
+                continue;
+            const expiresAt = stored.expiresAt ? new Date(stored.expiresAt).getTime() : 0;
+            if (expiresAt > Date.now() + 60 * 1000) {
+                await this.setSessionInternal(stored);
+                return stored;
+            }
+            try {
+                const res = await this.authRequest('/v1/sdk/auth/refresh', {
+                    method: 'POST',
+                    body: { refresh_token: stored.refreshToken },
+                });
+                const session = await this.parseSessionResponse(res, true);
+                await this.setSessionInternal(session);
+                return session;
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
     }
     async logout() {
         let serverSucceeded = true;
@@ -529,7 +658,7 @@ class KoolbaseAuth {
             serverSucceeded = false;
         }
         finally {
-            await this.clearSessionInternal();
+            await this.clearSessionInternal('signed_out');
         }
         return serverSucceeded;
     }
@@ -692,7 +821,7 @@ class KoolbaseAuth {
             includeAuth: true,
         });
         await this.checkResponse(res);
-        await this.clearSessionInternal();
+        await this.clearSessionInternal('signed_out');
     }
     /**
      * Every session the signed-in user has — a "where you're signed in" list.
@@ -815,8 +944,14 @@ class KoolbaseAuth {
         try {
             return await this._ensureValidToken();
         }
-        catch {
-            return null;
+        catch (e) {
+            // Refused: the session has ended (and been cleared); go api-key-only.
+            if (isRejection(e))
+                return null;
+            // No answer: the session may be fine, so the request must not go out
+            // as a signed-out visitor (whose refusal would end it). It fails as
+            // the network failure it is, and the caller retries (#96).
+            throw e;
         }
     }
     async setSession(session) {
@@ -1064,9 +1199,9 @@ class KoolbaseAuth {
             return session.accessToken;
         }
         catch (e) {
-            if (e instanceof auth_errors_js_1.KoolbaseAuthError)
-                throw e;
-            throw new auth_errors_js_1.SessionExpiredError();
+            // A refusal stays a refusal; a network failure stays one too, rather
+            // than being reported as an ended session (#96).
+            throw e;
         }
     }
     mapUser(raw) {
@@ -1314,3 +1449,15 @@ class KoolbaseAuth {
     }
 }
 exports.KoolbaseAuth = KoolbaseAuth;
+/**
+ * Whether an error is the server refusing the session -- it ended -- rather
+ * than no answer at all (#96). Only a refusal signs anyone out.
+ */
+function isRejection(e) {
+    if (e instanceof auth_errors_js_1.SessionExpiredError || e instanceof auth_errors_js_1.TokenRevokedError || e instanceof auth_errors_js_1.UserDisabledError)
+        return true;
+    if (e instanceof auth_errors_js_1.KoolbaseAuthError) {
+        return ['invalid_refresh_token', 'token_revoked', 'account_disabled', 'mfa_session_insufficient', 'unauthenticated'].includes(e.code ?? '');
+    }
+    return false;
+}

package/dist/cjs/database.js

@@ -97,7 +97,7 @@ class KoolbaseDatabase {
         };
     }
     async request(method, path, body) {
-        const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}${path}`, {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}${path}`, {
             method,
             headers: await this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,
@@ -135,7 +135,7 @@ class KoolbaseDatabase {
      * none of them clearing a rejected session. One path, two shapes of result.
      */
     async requestWithStatus(method, path, body) {
-        const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}${path}`, {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}${path}`, {
             method,
             headers: await this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,

package/dist/cjs/fiscal.js

@@ -113,7 +113,7 @@ class KoolbaseFiscal {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), params.timeoutMs ?? 30000);
         try {
-            const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/fiscal/submit`, {
+            const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/fiscal/submit`, {
                 method: 'POST',
                 headers: await this.buildHeaders(),
                 signal: controller.signal,
@@ -151,7 +151,7 @@ class KoolbaseFiscal {
                 device_id: params.deviceId,
                 client_ref: params.clientRef,
             });
-            const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/fiscal/status?${q.toString()}`, { method: 'GET', headers: await this.buildHeaders(), signal: controller.signal });
+            const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/fiscal/status?${q.toString()}`, { method: 'GET', headers: await this.buildHeaders(), signal: controller.signal });
             return await this.decode(res);
         }
         catch (e) {

package/dist/cjs/functions.js

@@ -14,7 +14,7 @@ class KoolbaseFunctions {
     // ─── Deploy ────────────────────────────────────────────────────────────────
     async deploy(options) {
         const runtime = options.runtime ?? types_js_1.FunctionRuntime.Deno;
-        const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/functions/deploy`, {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/functions/deploy`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
@@ -58,7 +58,7 @@ class KoolbaseFunctions {
         if (userToken) {
             headers['Authorization'] = `Bearer ${userToken}`;
         }
-        const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/functions/${name}`, {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/functions/${name}`, {
             method: 'POST',
             headers,
             body: JSON.stringify({ body: body ?? {} }),

package/dist/cjs/network.d.ts

@@ -19,3 +19,17 @@ export declare class KoolbaseNetworkError extends TypeError {
 }
 /** fetch, with network failures turned into a KoolbaseNetworkError. */
 export declare function koolbaseFetch(input: string, init?: RequestInit): Promise<Response>;
+type Renewal = (refusedToken: string) => Promise<string | null>;
+/** Installed by Koolbase.initialize: renews the session a request was refused with. */
+export declare function setSessionRenewal(fn: Renewal | null): void;
+/**
+ * koolbaseFetch for a data request. A request refused as unauthenticated
+ * (401) while carrying the signed-in person's token is the session needing
+ * renewal, not ending: the access token expired early, the clock is off, or
+ * another tab renewed it. The session is renewed once and the request sent
+ * again with the new token, so the caller never sees the first refusal.
+ * Only when renewal is refused does the 401 reach the caller, and with it the
+ * client's onSessionExpired, which ends the session.
+ */
+export declare function sessionFetch(input: string, init?: RequestInit): Promise<Response>;
+export {};

package/dist/cjs/network.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KoolbaseNetworkError = void 0;
 exports.koolbaseFetch = koolbaseFetch;
+exports.setSessionRenewal = setSessionRenewal;
+exports.sessionFetch = sessionFetch;
 /**
  * Network failures, made actionable.
  *
@@ -52,3 +54,61 @@ async function koolbaseFetch(input, init) {
         throw new KoolbaseNetworkError(input, e);
     }
 }
+let renewal = null;
+/** Installed by Koolbase.initialize: renews the session a request was refused with. */
+function setSessionRenewal(fn) {
+    renewal = fn;
+}
+function headerOf(headers, name) {
+    if (!headers)
+        return undefined;
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    if (Array.isArray(headers))
+        return headers.find(([k]) => k.toLowerCase() === name.toLowerCase())?.[1];
+    const rec = headers;
+    const key = Object.keys(rec).find((k) => k.toLowerCase() === name.toLowerCase());
+    return key ? rec[key] : undefined;
+}
+function withHeader(headers, name, value) {
+    const out = {};
+    if (headers && typeof headers.forEach === 'function' && !Array.isArray(headers)) {
+        headers.forEach((v, k) => { out[k] = v; });
+    }
+    else if (Array.isArray(headers)) {
+        for (const [k, v] of headers)
+            out[k] = v;
+    }
+    else if (headers) {
+        Object.assign(out, headers);
+    }
+    for (const k of Object.keys(out))
+        if (k.toLowerCase() === name.toLowerCase())
+            delete out[k];
+    out[name] = value;
+    return out;
+}
+/**
+ * koolbaseFetch for a data request. A request refused as unauthenticated
+ * (401) while carrying the signed-in person's token is the session needing
+ * renewal, not ending: the access token expired early, the clock is off, or
+ * another tab renewed it. The session is renewed once and the request sent
+ * again with the new token, so the caller never sees the first refusal.
+ * Only when renewal is refused does the 401 reach the caller, and with it the
+ * client's onSessionExpired, which ends the session.
+ */
+async function sessionFetch(input, init) {
+    const res = await koolbaseFetch(input, init);
+    if (res.status !== 401 || !renewal)
+        return res;
+    const auth = headerOf(init?.headers, 'Authorization');
+    if (!auth || !auth.startsWith('Bearer '))
+        return res;
+    // Only a body that can be sent twice. Data requests send JSON text.
+    if (init?.body !== undefined && init.body !== null && typeof init.body !== 'string')
+        return res;
+    const fresh = await renewal(auth.slice('Bearer '.length));
+    if (!fresh)
+        return res;
+    return koolbaseFetch(input, { ...init, headers: withHeader(init?.headers, 'Authorization', `Bearer ${fresh}`) });
+}

package/dist/cjs/storage.js

@@ -101,7 +101,7 @@ class KoolbaseStorage {
             ? options.file.type || 'application/octet-stream'
             : options.file.type;
         // ─── Step 1: Get presigned upload URL ───
-        const urlRes = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/storage/upload-url`, {
+        const urlRes = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/upload-url`, {
             method: 'POST',
             headers: {
                 ...(await this.buildHeaders()),
@@ -127,9 +127,9 @@ class KoolbaseStorage {
         // the two hosts differ here and nowhere else in this method.
         const fileBlob = isBlob
             ? options.file
-            : await (await (0, network_js_1.koolbaseFetch)(options.file.uri)).blob();
+            : await (await (0, network_js_1.sessionFetch)(options.file.uri)).blob();
         const fileSize = fileBlob.size;
-        const uploadRes = await (0, network_js_1.koolbaseFetch)(upload_url, {
+        const uploadRes = await (0, network_js_1.sessionFetch)(upload_url, {
             method: 'PUT',
             headers: { 'Content-Type': contentType },
             body: fileBlob,
@@ -156,7 +156,7 @@ class KoolbaseStorage {
         if (options.metadata !== undefined) {
             confirmBody.metadata = options.metadata;
         }
-        const confirmRes = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/storage/confirm`, {
+        const confirmRes = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/confirm`, {
             method: 'POST',
             headers: {
                 ...(await this.buildHeaders()),
@@ -207,7 +207,7 @@ class KoolbaseStorage {
      * // -> { category: 'landscape', tag: 'sunset' }
      */
     async updateMetadata(bucket, path, metadata) {
-        const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/storage/objects/metadata`, {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/objects/metadata`, {
             method: 'PATCH',
             headers: {
                 ...(await this.buildHeaders()),
@@ -230,7 +230,7 @@ class KoolbaseStorage {
         if (versionId) {
             url += `&version_id=${encodeURIComponent(versionId)}`;
         }
-        const res = await (0, network_js_1.koolbaseFetch)(url, { headers: await this.buildHeaders() });
+        const res = await (0, network_js_1.sessionFetch)(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to get download URL');
         }
@@ -342,7 +342,7 @@ class KoolbaseStorage {
         const url = forcePurge
             ? `${this.config.baseUrl}/v1/sdk/storage/object?force_purge=true`
             : `${this.config.baseUrl}/v1/sdk/storage/object`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, {
+        const res = await (0, network_js_1.sessionFetch)(url, {
             method: 'DELETE',
             headers: {
                 ...(await this.buildHeaders()),
@@ -369,7 +369,7 @@ class KoolbaseStorage {
     async listVersions(bucket, path) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, { headers: await this.buildHeaders() });
+        const res = await (0, network_js_1.sessionFetch)(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to list versions');
         }
@@ -385,7 +385,7 @@ class KoolbaseStorage {
     async getVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, { headers: await this.buildHeaders() });
+        const res = await (0, network_js_1.sessionFetch)(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to fetch version');
         }
@@ -404,7 +404,7 @@ class KoolbaseStorage {
     async restoreVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}/restore` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, {
+        const res = await (0, network_js_1.sessionFetch)(url, {
             method: 'POST',
             headers: await this.buildHeaders(),
         });
@@ -422,7 +422,7 @@ class KoolbaseStorage {
     async purgeVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, {
+        const res = await (0, network_js_1.sessionFetch)(url, {
             method: 'DELETE',
             headers: await this.buildHeaders(),
         });

package/dist/cjs/sync-engine.js

@@ -259,7 +259,7 @@ class SyncEngine {
             : `${this.config.baseUrl}/v1/sdk/db/records/${write.recordId}`;
         let res;
         if (write.operation === 'insert') {
-            res = await (0, network_js_1.koolbaseFetch)(url, {
+            res = await (0, network_js_1.sessionFetch)(url, {
                 method: 'POST',
                 headers,
                 // The write's own id: generated at enqueue, identical on every retry.
@@ -273,7 +273,7 @@ class SyncEngine {
             });
         }
         else if (write.operation === 'update') {
-            res = await (0, network_js_1.koolbaseFetch)(url, {
+            res = await (0, network_js_1.sessionFetch)(url, {
                 method: 'PATCH',
                 headers,
                 // The revision the change was composed against. The server applies it
@@ -292,7 +292,7 @@ class SyncEngine {
             const q = write.baseRevision !== undefined
                 ? `?expected_revision=${write.baseRevision}`
                 : '';
-            res = await (0, network_js_1.koolbaseFetch)(`${url}${q}`, { method: 'DELETE', headers });
+            res = await (0, network_js_1.sessionFetch)(`${url}${q}`, { method: 'DELETE', headers });
         }
         if (res.status === 401)
             throw new errors_js_1.KoolbaseUnauthenticatedError('unauthorized');

package/dist/cjs/types.d.ts

@@ -180,6 +180,13 @@ export declare enum RestoreResult {
  * broken listener cannot break propagation to others.
  */
 export type AuthStateListener = (user: KoolbaseUser | null) => void;
+/**
+ * Why the last session ended (#104): the person signed out, or the session
+ * ended on its own -- revoked, expired past renewal, signed out elsewhere.
+ * An app tells them apart to say "You were signed out" only when they did
+ * not ask to be.
+ */
+export type SignOutReason = 'signed_out' | 'session_ended';
 /**
  * Drop-in replacement for the global `fetch` function. Inject via
  * KoolbaseConfig.fetch for testing (mock fetch), proxying, or

package/dist/esm/auth.d.ts

@@ -1,5 +1,5 @@
 import { AuthStateListener, KoolbaseConfig, KoolbaseSession, KoolbaseUser, LinkPhoneParams, LoginParams, OtpSendResult, PhoneVerifyResult, RegisterParams, RestoreResult, KoolbaseAuditPage, KoolbaseSessionInfo, ResendVerificationResult, SendOtpParams, SignUpResult, SignInWithAppleParams, VerifyOtpParams } from './types.js';
-import type { SignInWithGoogleParams } from './types.js';
+import type { SignInWithGoogleParams, SignOutReason } from './types.js';
 export declare class KoolbaseAuth {
     private config;
     private storage;
@@ -9,6 +9,10 @@ export declare class KoolbaseAuth {
     private timeoutMs;
     private ongoingRefresh;
     private listeners;
+    /** Why the last session ended (#104); null while signed in or never signed in. */
+    private signOutReason;
+    /** The last renewal failed for want of a connection, not because the server refused it (#96). */
+    private renewalUnavailable;
     constructor(config: KoolbaseConfig);
     /**
      * Subscribe to authentication state changes. The listener fires:
@@ -82,6 +86,29 @@ export declare class KoolbaseAuth {
      * need to.
      */
     clearStoredSession(): Promise<void>;
+    /**
+     * Why the last session ended (#104): `'signed_out'` when the person signed
+     * out (or deleted their account), `'session_ended'` when it ended on its own
+     * -- revoked, past renewal, signed out on another device. null while signed
+     * in. Read it in an onAuthStateChange listener to say "You were signed out"
+     * only when they did not ask to be.
+     */
+    get lastSignOutReason(): SignOutReason | null;
+    /**
+     * A data request carrying `refused` came back unauthenticated. Renews the
+     * session and returns the token to send again with, or null when there is
+     * none -- nobody is signed in, or the server refused the renewal too, which
+     * ends the session (#96).
+     */
+    renewRejected(refused: string): Promise<string | null>;
+    /**
+     * A data request was refused as unauthenticated and renewing could not
+     * help: the session is over, so it ends here and every listener hears it.
+     * Unless the renewal failed only for want of a connection -- then the
+     * session may well be good, and signing someone out for a dropped network
+     * would be wrong (#96).
+     */
+    sessionRejected(): Promise<void>;
     private clearSessionInternal;
     restoreSession(): Promise<RestoreResult>;
     /**
@@ -164,6 +191,9 @@ export declare class KoolbaseAuth {
     private parseAppleSessionResponse;
     refresh(refreshToken?: string): Promise<KoolbaseSession>;
     private _doRefresh;
+    private readStored;
+    /** A newer session another tab stored after renewing `spent`, made current; null if none. */
+    private adoptNewer;
     logout(): Promise<boolean>;
     forgotPassword(email: string): Promise<void>;
     /**

package/dist/esm/auth.js

@@ -1,6 +1,6 @@
 import { koolbaseFetch } from './network.js';
 import { RestoreResult, } from './types.js';
-import { AccountLockedError, EmailAlreadyInUseError, InvalidCredentialsError, InvalidPhoneNumberError, KoolbaseAuthError, OtpExpiredError, OtpInvalidError, OtpMaxAttemptsError, OtpRateLimitError, PhoneAlreadyLinkedError, IdentityNotFoundError, InsufficientScopeError, MalformedSessionResponseError, ProviderIdentityAlreadyLinkedError, AccountExistsError, ContactNotVerifiedError, CurrentPasswordIncorrectError, HideRequiresVerificationError, InsufficientAuthorityError, LastCredentialError, OAuthOnlyAccountError, SessionRequiredError, SignupsDisabledError, TokenAlreadyUsedError, TokenExpiredError, UnsupportedOAuthProviderError, RateLimitError, VerificationResendCooldownError, VerificationResendDailyCapError, SessionExpiredError, SmsConfigMissingError, UnlockTokenInvalidError, UserDisabledError, WeakPasswordError, AppleEmailRequiredError, AppleSignInNotConfiguredError, InvalidAppleTokenError, OAuthEmailConflictError, GoogleEmailRequiredError, GoogleSignInNotConfiguredError, InvalidGoogleTokenError, EmailCodeDisabledError, MfaRequiredError, RecentAuthRequiredError, RecentMfaRequiredError, MfaAlreadyEnabledError, MfaEnrollmentNotFoundError, MfaNotEnabledError, } from './auth-errors.js';
+import { AccountLockedError, EmailAlreadyInUseError, InvalidCredentialsError, InvalidPhoneNumberError, KoolbaseAuthError, OtpExpiredError, OtpInvalidError, OtpMaxAttemptsError, OtpRateLimitError, PhoneAlreadyLinkedError, IdentityNotFoundError, InsufficientScopeError, MalformedSessionResponseError, ProviderIdentityAlreadyLinkedError, AccountExistsError, ContactNotVerifiedError, CurrentPasswordIncorrectError, HideRequiresVerificationError, InsufficientAuthorityError, LastCredentialError, OAuthOnlyAccountError, SessionRequiredError, SignupsDisabledError, TokenAlreadyUsedError, TokenExpiredError, UnsupportedOAuthProviderError, RateLimitError, VerificationResendCooldownError, VerificationResendDailyCapError, SessionExpiredError, SmsConfigMissingError, TokenRevokedError, UnlockTokenInvalidError, UserDisabledError, WeakPasswordError, AppleEmailRequiredError, AppleSignInNotConfiguredError, InvalidAppleTokenError, OAuthEmailConflictError, GoogleEmailRequiredError, GoogleSignInNotConfiguredError, InvalidGoogleTokenError, EmailCodeDisabledError, MfaRequiredError, RecentAuthRequiredError, RecentMfaRequiredError, MfaAlreadyEnabledError, MfaEnrollmentNotFoundError, MfaNotEnabledError, } from './auth-errors.js';
 import { getPlatform } from './platform.js';
 import { DeviceMetadata } from './device-metadata.js';
 export class KoolbaseAuth {
@@ -8,6 +8,10 @@ export class KoolbaseAuth {
         this.session = null;
         this.ongoingRefresh = null;
         this.listeners = new Set();
+        /** Why the last session ended (#104); null while signed in or never signed in. */
+        this.signOutReason = null;
+        /** The last renewal failed for want of a connection, not because the server refused it (#96). */
+        this.renewalUnavailable = false;
         this.config = config;
         this.metadata = new DeviceMetadata(config.appVersion);
         this.fetchFn = config.fetch ?? ((url, init) => koolbaseFetch(url, init));
@@ -149,6 +153,7 @@ export class KoolbaseAuth {
     }
     async setSessionInternal(session) {
         this.session = session;
+        this.signOutReason = null;
         if (this.storage) {
             try {
                 await this.storage.saveSession(session);
@@ -175,9 +180,52 @@ export class KoolbaseAuth {
      * need to.
      */
     async clearStoredSession() {
-        await this.clearSessionInternal();
+        await this.clearSessionInternal('session_ended');
     }
-    async clearSessionInternal() {
+    /**
+     * Why the last session ended (#104): `'signed_out'` when the person signed
+     * out (or deleted their account), `'session_ended'` when it ended on its own
+     * -- revoked, past renewal, signed out on another device. null while signed
+     * in. Read it in an onAuthStateChange listener to say "You were signed out"
+     * only when they did not ask to be.
+     */
+    get lastSignOutReason() {
+        return this.signOutReason;
+    }
+    /**
+     * A data request carrying `refused` came back unauthenticated. Renews the
+     * session and returns the token to send again with, or null when there is
+     * none -- nobody is signed in, or the server refused the renewal too, which
+     * ends the session (#96).
+     */
+    async renewRejected(refused) {
+        if (!this.session)
+            return null;
+        // Another request renewed it while this one was out.
+        if (this.session.accessToken !== refused)
+            return this.session.accessToken;
+        try {
+            return (await this.refresh()).accessToken;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * A data request was refused as unauthenticated and renewing could not
+     * help: the session is over, so it ends here and every listener hears it.
+     * Unless the renewal failed only for want of a connection -- then the
+     * session may well be good, and signing someone out for a dropped network
+     * would be wrong (#96).
+     */
+    async sessionRejected() {
+        if (!this.session || this.renewalUnavailable)
+            return;
+        await this.clearSessionInternal('session_ended');
+    }
+    async clearSessionInternal(reason = 'session_ended') {
+        if (this.session)
+            this.signOutReason = reason;
         this.session = null;
         if (this.storage) {
             try {
@@ -205,7 +253,28 @@ export class KoolbaseAuth {
             : 0;
         const oneMinuteMs = 60 * 1000;
         if (expiresAt > Date.now() + oneMinuteMs) {
-            return RestoreResult.Restored;
+            // Valid by the clock is not valid: the session may have been signed out
+            // on another device, revoked, or the account disabled since. Ask the
+            // server before saying it is restored (#104). No answer -- offline, a
+            // timeout, a server error -- keeps the optimistic session: Offline.
+            try {
+                const res = await this.authRequest('/v1/sdk/auth/me', { method: 'GET', includeAuth: true });
+                if (res.ok) {
+                    try {
+                        await this.updateUserAndPersist(this.mapUser(await res.json()));
+                    }
+                    catch {
+                        // The session is good; a user that will not parse keeps the stored one.
+                    }
+                    return RestoreResult.Restored;
+                }
+                if (res.status !== 401)
+                    return RestoreResult.Offline;
+                // Refused: the access token is done. The refresh token decides.
+            }
+            catch {
+                return RestoreResult.Offline;
+            }
         }
         try {
             await this.refresh(persisted.refreshToken);
@@ -221,8 +290,8 @@ export class KoolbaseAuth {
             // key or the request rather than the user's session — and deleting the
             // refresh token on that reading signs someone out with no way back.
             // Nothing reaches here with it today; it stays out so nothing does.
-            if (e instanceof SessionExpiredError) {
-                await this.clearSessionInternal();
+            if (isRejection(e)) {
+                await this.clearSessionInternal('session_ended');
                 return RestoreResult.Expired;
             }
             return RestoreResult.Offline;
@@ -495,17 +564,77 @@ export class KoolbaseAuth {
         return promise;
     }
     async _doRefresh(refreshToken) {
-        const token = refreshToken ?? this.session?.refreshToken;
+        // The newest refresh token is the stored one: another tab of the same app
+        // may have renewed the session, and its in-memory copy here is spent.
+        const stored = refreshToken ? null : await this.readStored();
+        const token = refreshToken ?? stored?.refreshToken ?? this.session?.refreshToken;
         if (!token) {
             throw new SessionExpiredError();
         }
-        const res = await this.authRequest('/v1/sdk/auth/refresh', {
-            method: 'POST',
-            body: { refresh_token: token },
-        });
-        const session = await this.parseSessionResponse(res, true);
-        await this.setSessionInternal(session);
-        return session;
+        try {
+            const res = await this.authRequest('/v1/sdk/auth/refresh', {
+                method: 'POST',
+                body: { refresh_token: token },
+            });
+            const session = await this.parseSessionResponse(res, true);
+            this.renewalUnavailable = false;
+            await this.setSessionInternal(session);
+            return session;
+        }
+        catch (e) {
+            if (!isRejection(e)) {
+                // No answer, or a server error: the session may be fine. Keep it.
+                this.renewalUnavailable = true;
+                throw e;
+            }
+            this.renewalUnavailable = false;
+            // Two tabs renewing at the same moment send the same token; the
+            // server renews one and refuses the other. The winner's session is in
+            // storage: take it rather than signing out (#96).
+            const adopted = await this.adoptNewer(token);
+            if (adopted)
+                return adopted;
+            await this.clearSessionInternal('session_ended');
+            throw e;
+        }
+    }
+    async readStored() {
+        if (!this.storage)
+            return null;
+        try {
+            return await this.storage.readSession();
+        }
+        catch {
+            return null;
+        }
+    }
+    /** A newer session another tab stored after renewing `spent`, made current; null if none. */
+    async adoptNewer(spent) {
+        for (const wait of [0, 400]) {
+            if (wait)
+                await new Promise((r) => setTimeout(r, wait));
+            const stored = await this.readStored();
+            if (!stored || stored.refreshToken === spent)
+                continue;
+            const expiresAt = stored.expiresAt ? new Date(stored.expiresAt).getTime() : 0;
+            if (expiresAt > Date.now() + 60 * 1000) {
+                await this.setSessionInternal(stored);
+                return stored;
+            }
+            try {
+                const res = await this.authRequest('/v1/sdk/auth/refresh', {
+                    method: 'POST',
+                    body: { refresh_token: stored.refreshToken },
+                });
+                const session = await this.parseSessionResponse(res, true);
+                await this.setSessionInternal(session);
+                return session;
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
     }
     async logout() {
         let serverSucceeded = true;
@@ -526,7 +655,7 @@ export class KoolbaseAuth {
             serverSucceeded = false;
         }
         finally {
-            await this.clearSessionInternal();
+            await this.clearSessionInternal('signed_out');
         }
         return serverSucceeded;
     }
@@ -689,7 +818,7 @@ export class KoolbaseAuth {
             includeAuth: true,
         });
         await this.checkResponse(res);
-        await this.clearSessionInternal();
+        await this.clearSessionInternal('signed_out');
     }
     /**
      * Every session the signed-in user has — a "where you're signed in" list.
@@ -812,8 +941,14 @@ export class KoolbaseAuth {
         try {
             return await this._ensureValidToken();
         }
-        catch {
-            return null;
+        catch (e) {
+            // Refused: the session has ended (and been cleared); go api-key-only.
+            if (isRejection(e))
+                return null;
+            // No answer: the session may be fine, so the request must not go out
+            // as a signed-out visitor (whose refusal would end it). It fails as
+            // the network failure it is, and the caller retries (#96).
+            throw e;
         }
     }
     async setSession(session) {
@@ -1061,9 +1196,9 @@ export class KoolbaseAuth {
             return session.accessToken;
         }
         catch (e) {
-            if (e instanceof KoolbaseAuthError)
-                throw e;
-            throw new SessionExpiredError();
+            // A refusal stays a refusal; a network failure stays one too, rather
+            // than being reported as an ended session (#96).
+            throw e;
         }
     }
     mapUser(raw) {
@@ -1310,3 +1445,15 @@ export class KoolbaseAuth {
         throw new KoolbaseAuthError(msg || 'An unexpected error occurred', code || undefined);
     }
 }
+/**
+ * Whether an error is the server refusing the session -- it ended -- rather
+ * than no answer at all (#96). Only a refusal signs anyone out.
+ */
+function isRejection(e) {
+    if (e instanceof SessionExpiredError || e instanceof TokenRevokedError || e instanceof UserDisabledError)
+        return true;
+    if (e instanceof KoolbaseAuthError) {
+        return ['invalid_refresh_token', 'token_revoked', 'account_disabled', 'mfa_session_insufficient', 'unauthenticated'].includes(e.code ?? '');
+    }
+    return false;
+}

package/dist/esm/database.js

@@ -1,4 +1,4 @@
-import { koolbaseFetch } from './network.js';
+import { sessionFetch } from './network.js';
 import { refreshCollectionQueries } from './query-refresh.js';
 import { KoolbaseRevisionMismatchError } from './database-errors.js';
 import { KoolbaseError, KoolbaseOfflineBaselineUnavailableError, KoolbaseUnauthenticatedError, } from './errors.js';
@@ -94,7 +94,7 @@ export class KoolbaseDatabase {
         };
     }
     async request(method, path, body) {
-        const res = await koolbaseFetch(`${this.config.baseUrl}${path}`, {
+        const res = await sessionFetch(`${this.config.baseUrl}${path}`, {
             method,
             headers: await this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,
@@ -132,7 +132,7 @@ export class KoolbaseDatabase {
      * none of them clearing a rejected session. One path, two shapes of result.
      */
     async requestWithStatus(method, path, body) {
-        const res = await koolbaseFetch(`${this.config.baseUrl}${path}`, {
+        const res = await sessionFetch(`${this.config.baseUrl}${path}`, {
             method,
             headers: await this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,

package/dist/esm/fiscal.js

@@ -1,4 +1,4 @@
-import { koolbaseFetch } from './network.js';
+import { sessionFetch } from './network.js';
 import { KoolbaseError, KoolbaseUnauthenticatedError } from './errors.js';
 const KNOWN_STATUSES = [
     'created', 'blocked', 'queued', 'submitting',
@@ -106,7 +106,7 @@ export class KoolbaseFiscal {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), params.timeoutMs ?? 30000);
         try {
-            const res = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/fiscal/submit`, {
+            const res = await sessionFetch(`${this.config.baseUrl}/v1/sdk/fiscal/submit`, {
                 method: 'POST',
                 headers: await this.buildHeaders(),
                 signal: controller.signal,
@@ -144,7 +144,7 @@ export class KoolbaseFiscal {
                 device_id: params.deviceId,
                 client_ref: params.clientRef,
             });
-            const res = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/fiscal/status?${q.toString()}`, { method: 'GET', headers: await this.buildHeaders(), signal: controller.signal });
+            const res = await sessionFetch(`${this.config.baseUrl}/v1/sdk/fiscal/status?${q.toString()}`, { method: 'GET', headers: await this.buildHeaders(), signal: controller.signal });
             return await this.decode(res);
         }
         catch (e) {

package/dist/esm/functions.js

@@ -1,4 +1,4 @@
-import { koolbaseFetch } from './network.js';
+import { sessionFetch } from './network.js';
 import { functionInvokeError } from './function-errors.js';
 import { KoolbaseUnauthenticatedError } from './errors.js';
 import { FunctionRuntime, } from './types.js';
@@ -11,7 +11,7 @@ export class KoolbaseFunctions {
     // ─── Deploy ────────────────────────────────────────────────────────────────
     async deploy(options) {
         const runtime = options.runtime ?? FunctionRuntime.Deno;
-        const res = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/functions/deploy`, {
+        const res = await sessionFetch(`${this.config.baseUrl}/v1/sdk/functions/deploy`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
@@ -55,7 +55,7 @@ export class KoolbaseFunctions {
         if (userToken) {
             headers['Authorization'] = `Bearer ${userToken}`;
         }
-        const res = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/functions/${name}`, {
+        const res = await sessionFetch(`${this.config.baseUrl}/v1/sdk/functions/${name}`, {
             method: 'POST',
             headers,
             body: JSON.stringify({ body: body ?? {} }),

package/dist/esm/network.d.ts

@@ -19,3 +19,17 @@ export declare class KoolbaseNetworkError extends TypeError {
 }
 /** fetch, with network failures turned into a KoolbaseNetworkError. */
 export declare function koolbaseFetch(input: string, init?: RequestInit): Promise<Response>;
+type Renewal = (refusedToken: string) => Promise<string | null>;
+/** Installed by Koolbase.initialize: renews the session a request was refused with. */
+export declare function setSessionRenewal(fn: Renewal | null): void;
+/**
+ * koolbaseFetch for a data request. A request refused as unauthenticated
+ * (401) while carrying the signed-in person's token is the session needing
+ * renewal, not ending: the access token expired early, the clock is off, or
+ * another tab renewed it. The session is renewed once and the request sent
+ * again with the new token, so the caller never sees the first refusal.
+ * Only when renewal is refused does the 401 reach the caller, and with it the
+ * client's onSessionExpired, which ends the session.
+ */
+export declare function sessionFetch(input: string, init?: RequestInit): Promise<Response>;
+export {};

package/dist/esm/network.js

@@ -47,3 +47,61 @@ export async function koolbaseFetch(input, init) {
         throw new KoolbaseNetworkError(input, e);
     }
 }
+let renewal = null;
+/** Installed by Koolbase.initialize: renews the session a request was refused with. */
+export function setSessionRenewal(fn) {
+    renewal = fn;
+}
+function headerOf(headers, name) {
+    if (!headers)
+        return undefined;
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    if (Array.isArray(headers))
+        return headers.find(([k]) => k.toLowerCase() === name.toLowerCase())?.[1];
+    const rec = headers;
+    const key = Object.keys(rec).find((k) => k.toLowerCase() === name.toLowerCase());
+    return key ? rec[key] : undefined;
+}
+function withHeader(headers, name, value) {
+    const out = {};
+    if (headers && typeof headers.forEach === 'function' && !Array.isArray(headers)) {
+        headers.forEach((v, k) => { out[k] = v; });
+    }
+    else if (Array.isArray(headers)) {
+        for (const [k, v] of headers)
+            out[k] = v;
+    }
+    else if (headers) {
+        Object.assign(out, headers);
+    }
+    for (const k of Object.keys(out))
+        if (k.toLowerCase() === name.toLowerCase())
+            delete out[k];
+    out[name] = value;
+    return out;
+}
+/**
+ * koolbaseFetch for a data request. A request refused as unauthenticated
+ * (401) while carrying the signed-in person's token is the session needing
+ * renewal, not ending: the access token expired early, the clock is off, or
+ * another tab renewed it. The session is renewed once and the request sent
+ * again with the new token, so the caller never sees the first refusal.
+ * Only when renewal is refused does the 401 reach the caller, and with it the
+ * client's onSessionExpired, which ends the session.
+ */
+export async function sessionFetch(input, init) {
+    const res = await koolbaseFetch(input, init);
+    if (res.status !== 401 || !renewal)
+        return res;
+    const auth = headerOf(init?.headers, 'Authorization');
+    if (!auth || !auth.startsWith('Bearer '))
+        return res;
+    // Only a body that can be sent twice. Data requests send JSON text.
+    if (init?.body !== undefined && init.body !== null && typeof init.body !== 'string')
+        return res;
+    const fresh = await renewal(auth.slice('Bearer '.length));
+    if (!fresh)
+        return res;
+    return koolbaseFetch(input, { ...init, headers: withHeader(init?.headers, 'Authorization', `Bearer ${fresh}`) });
+}

package/dist/esm/storage.js

@@ -1,5 +1,5 @@
 import { KoolbaseStorageProjectIdentityError } from './storage-errors.js';
-import { koolbaseFetch } from './network.js';
+import { sessionFetch } from './network.js';
 import { KoolbaseUnauthenticatedError } from './errors.js';
 import { KoolbaseStorageError, koolbaseStorageErrorFromResponse, } from './storage-errors.js';
 // --- Cloudflare image-transform URL helpers -------------------------------
@@ -98,7 +98,7 @@ export class KoolbaseStorage {
             ? options.file.type || 'application/octet-stream'
             : options.file.type;
         // ─── Step 1: Get presigned upload URL ───
-        const urlRes = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/storage/upload-url`, {
+        const urlRes = await sessionFetch(`${this.config.baseUrl}/v1/sdk/storage/upload-url`, {
             method: 'POST',
             headers: {
                 ...(await this.buildHeaders()),
@@ -124,9 +124,9 @@ export class KoolbaseStorage {
         // the two hosts differ here and nowhere else in this method.
         const fileBlob = isBlob
             ? options.file
-            : await (await koolbaseFetch(options.file.uri)).blob();
+            : await (await sessionFetch(options.file.uri)).blob();
         const fileSize = fileBlob.size;
-        const uploadRes = await koolbaseFetch(upload_url, {
+        const uploadRes = await sessionFetch(upload_url, {
             method: 'PUT',
             headers: { 'Content-Type': contentType },
             body: fileBlob,
@@ -153,7 +153,7 @@ export class KoolbaseStorage {
         if (options.metadata !== undefined) {
             confirmBody.metadata = options.metadata;
         }
-        const confirmRes = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/storage/confirm`, {
+        const confirmRes = await sessionFetch(`${this.config.baseUrl}/v1/sdk/storage/confirm`, {
             method: 'POST',
             headers: {
                 ...(await this.buildHeaders()),
@@ -204,7 +204,7 @@ export class KoolbaseStorage {
      * // -> { category: 'landscape', tag: 'sunset' }
      */
     async updateMetadata(bucket, path, metadata) {
-        const res = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/storage/objects/metadata`, {
+        const res = await sessionFetch(`${this.config.baseUrl}/v1/sdk/storage/objects/metadata`, {
             method: 'PATCH',
             headers: {
                 ...(await this.buildHeaders()),
@@ -227,7 +227,7 @@ export class KoolbaseStorage {
         if (versionId) {
             url += `&version_id=${encodeURIComponent(versionId)}`;
         }
-        const res = await koolbaseFetch(url, { headers: await this.buildHeaders() });
+        const res = await sessionFetch(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to get download URL');
         }
@@ -339,7 +339,7 @@ export class KoolbaseStorage {
         const url = forcePurge
             ? `${this.config.baseUrl}/v1/sdk/storage/object?force_purge=true`
             : `${this.config.baseUrl}/v1/sdk/storage/object`;
-        const res = await koolbaseFetch(url, {
+        const res = await sessionFetch(url, {
             method: 'DELETE',
             headers: {
                 ...(await this.buildHeaders()),
@@ -366,7 +366,7 @@ export class KoolbaseStorage {
     async listVersions(bucket, path) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await koolbaseFetch(url, { headers: await this.buildHeaders() });
+        const res = await sessionFetch(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to list versions');
         }
@@ -382,7 +382,7 @@ export class KoolbaseStorage {
     async getVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await koolbaseFetch(url, { headers: await this.buildHeaders() });
+        const res = await sessionFetch(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to fetch version');
         }
@@ -401,7 +401,7 @@ export class KoolbaseStorage {
     async restoreVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}/restore` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await koolbaseFetch(url, {
+        const res = await sessionFetch(url, {
             method: 'POST',
             headers: await this.buildHeaders(),
         });
@@ -419,7 +419,7 @@ export class KoolbaseStorage {
     async purgeVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await koolbaseFetch(url, {
+        const res = await sessionFetch(url, {
             method: 'DELETE',
             headers: await this.buildHeaders(),
         });

package/dist/esm/sync-engine.js

@@ -1,4 +1,4 @@
-import { koolbaseFetch } from './network.js';
+import { sessionFetch } from './network.js';
 import { readOfflineState, mutateOfflineState, migrateLegacyQueue, flushLockName, } from './offline-state.js';
 import { KoolbaseUnauthenticatedError } from './errors.js';
 import { getPlatform } from './platform.js';
@@ -256,7 +256,7 @@ export class SyncEngine {
             : `${this.config.baseUrl}/v1/sdk/db/records/${write.recordId}`;
         let res;
         if (write.operation === 'insert') {
-            res = await koolbaseFetch(url, {
+            res = await sessionFetch(url, {
                 method: 'POST',
                 headers,
                 // The write's own id: generated at enqueue, identical on every retry.
@@ -270,7 +270,7 @@ export class SyncEngine {
             });
         }
         else if (write.operation === 'update') {
-            res = await koolbaseFetch(url, {
+            res = await sessionFetch(url, {
                 method: 'PATCH',
                 headers,
                 // The revision the change was composed against. The server applies it
@@ -289,7 +289,7 @@ export class SyncEngine {
             const q = write.baseRevision !== undefined
                 ? `?expected_revision=${write.baseRevision}`
                 : '';
-            res = await koolbaseFetch(`${url}${q}`, { method: 'DELETE', headers });
+            res = await sessionFetch(`${url}${q}`, { method: 'DELETE', headers });
         }
         if (res.status === 401)
             throw new KoolbaseUnauthenticatedError('unauthorized');

package/dist/esm/types.d.ts

@@ -180,6 +180,13 @@ export declare enum RestoreResult {
  * broken listener cannot break propagation to others.
  */
 export type AuthStateListener = (user: KoolbaseUser | null) => void;
+/**
+ * Why the last session ended (#104): the person signed out, or the session
+ * ended on its own -- revoked, expired past renewal, signed out elsewhere.
+ * An app tells them apart to say "You were signed out" only when they did
+ * not ask to be.
+ */
+export type SignOutReason = 'signed_out' | 'session_ended';
 /**
  * Drop-in replacement for the global `fetch` function. Inject via
  * KoolbaseConfig.fetch for testing (mock fetch), proxying, or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@koolbase/core",
-  "version": "12.14.0",
+  "version": "12.15.0",
   "description": "Koolbase SDK core \u2014 shared behaviour behind @koolbase/react-native and @koolbase/js. Install one of those, not this.",
   "main": "./dist/cjs/index.js",
   "types": "./dist/esm/index.d.ts",