@koolbase/core 12.14.0 → 12.16.0

package/dist/cjs/storage.js

@@ -5,6 +5,8 @@ const storage_errors_js_1 = require("./storage-errors.js");
 const network_js_1 = require("./network.js");
 const errors_js_1 = require("./errors.js");
 const storage_errors_js_2 = require("./storage-errors.js");
+const storage_transfer_js_1 = require("./storage-transfer.js");
+const storage_files_js_1 = require("./storage-files.js");
 // --- Cloudflare image-transform URL helpers -------------------------------
 // Module-private — callers use KoolbaseStorage.publicUrl / publicUrlForObject.
 function clampInt(v, min, max) {
@@ -91,6 +93,46 @@ class KoolbaseStorage {
      * overwriting silently, pass `overwrite: true` explicitly.
      */
     async upload(options) {
+        const task = this.startUpload(options);
+        const signal = options.signal;
+        const onAbort = () => task.cancel();
+        if (signal) {
+            if (signal.aborted)
+                task.cancel();
+            else
+                signal.addEventListener('abort', onAbort);
+        }
+        const stop = options.onProgress
+            ? task.onProgress((p) => options.onProgress?.(Math.round(p.fraction * 100), p))
+            : null;
+        try {
+            return await task.result;
+        }
+        finally {
+            stop?.();
+            signal?.removeEventListener('abort', onAbort);
+        }
+    }
+    /**
+     * Starts an upload you can follow and cancel: the same upload as
+     * {@link upload}, returned at once as a {@link KoolbaseUploadTask}.
+     *
+     * The task goes pending -> uploading (bytes sent of total) -> verifying
+     * -> completed, or failed / cancelled. `cancel()` stops it until the
+     * server begins checking the bytes (verifying); nothing is stored. Only
+     * completed means the file can be referenced from a record.
+     *
+     * @example
+     * const task = Koolbase.storage.startUpload({ bucket: 'posters', path: 'gig.png', file });
+     * const stop = task.onProgress((p) => setPercent(Math.round(p.fraction * 100)));
+     * cancelButton.onclick = () => task.cancel();
+     * const { object } = await task.result;
+     */
+    startUpload(options) {
+        return (0, storage_transfer_js_1.runUploadTask)((task) => this.runUpload(options, task));
+    }
+    async runUpload(options, task) {
+        task.checkCancelled();
         const overwrite = options.overwrite ?? false;
         // A Blob (browser File included) knows its own type; the React Native
         // URI form carries it alongside. Falling back to octet-stream keeps a
@@ -100,8 +142,10 @@ class KoolbaseStorage {
         const contentType = isBlob
             ? options.file.type || 'application/octet-stream'
             : options.file.type;
+        if (isBlob)
+            task.setTotal(options.file.size);
         // ─── Step 1: Get presigned upload URL ───
-        const urlRes = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/storage/upload-url`, {
+        const urlRes = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/upload-url`, {
             method: 'POST',
             headers: {
                 ...(await this.buildHeaders()),
@@ -117,7 +161,8 @@ class KoolbaseStorage {
         if (!urlRes.ok) {
             throw await this.error(urlRes, 'Failed to get upload URL');
         }
-        const { upload_url } = (await urlRes.json());
+        const { upload_url, upload_id } = (await urlRes.json());
+        task.checkCancelled();
         // ─── Step 2: Upload directly to R2 ───
         // R2 presigned URLs expect raw binary, NOT multipart/form-data.
         //
@@ -127,19 +172,19 @@ class KoolbaseStorage {
         // the two hosts differ here and nowhere else in this method.
         const fileBlob = isBlob
             ? options.file
-            : await (await (0, network_js_1.koolbaseFetch)(options.file.uri)).blob();
+            : await (await (0, network_js_1.sessionFetch)(options.file.uri)).blob();
         const fileSize = fileBlob.size;
-        const uploadRes = await (0, network_js_1.koolbaseFetch)(upload_url, {
-            method: 'PUT',
-            headers: { 'Content-Type': contentType },
-            body: fileBlob,
-        });
-        if (!uploadRes.ok) {
+        task.setTotal(fileSize);
+        const uploadRes = await (0, storage_transfer_js_1.putWithProgress)(task, upload_url, fileBlob, contentType);
+        if (uploadRes.status < 200 || uploadRes.status >= 300) {
             // R2 PUT errors don't follow the Koolbase error shape — surface as a
             // generic storage error rather than trying to decode a Koolbase body.
             throw new storage_errors_js_2.KoolbaseStorageError(`Upload to storage failed: ${uploadRes.status}`);
         }
-        const etag = uploadRes.headers.get('etag') ?? '';
+        const etag = uploadRes.etag;
+        // From here the server checks the bytes and puts them in place; the
+        // upload can no longer be cancelled.
+        task.verifying();
         // ─── Step 3: Confirm upload ───
         // Build the body conditionally so the `metadata` field is only sent
         // when the caller passed it — keeps the wire shape clean for callers
@@ -153,10 +198,14 @@ class KoolbaseStorage {
             etag,
             overwrite,
         };
+        // The confirm names its upload, so it takes exactly these bytes.
+        if (upload_id) {
+            confirmBody.upload_id = upload_id;
+        }
         if (options.metadata !== undefined) {
             confirmBody.metadata = options.metadata;
         }
-        const confirmRes = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/storage/confirm`, {
+        const confirmRes = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/confirm`, {
             method: 'POST',
             headers: {
                 ...(await this.buildHeaders()),
@@ -173,6 +222,40 @@ class KoolbaseStorage {
         const downloadUrl = await this.getDownloadUrl(options.bucket, options.path);
         return { object, downloadUrl };
     }
+    /**
+     * One page of a bucket's files. The bucket's view rule is applied to every
+     * file: the page holds only files the signed-in person may view. Pass the
+     * page's `nextCursor` back as `cursor` for the next one; a page can hold
+     * fewer files than `limit` and still have a next.
+     *
+     * @example
+     * let cursor: string | undefined;
+     * do {
+     *   const page = await Koolbase.storage.listFiles({ bucket: 'posters', prefix: 'events/', cursor });
+     *   show(page.files);
+     *   cursor = page.nextCursor ?? undefined;
+     * } while (cursor);
+     */
+    async listFiles(options) {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/files?${(0, storage_files_js_1.listFilesQuery)(options)}`, { headers: await this.buildHeaders() });
+        if (!res.ok) {
+            throw await this.error(res, 'Failed to list files');
+        }
+        return (0, storage_files_js_1.filePageFromJson)((await res.json()));
+    }
+    /**
+     * One file's details -- size, type, metadata, who uploaded it, and its
+     * permanent link while its bucket is public. Throws
+     * `KoolbaseStorageNotFoundError` for a file that is not there or that
+     * the bucket's view rule hides from the caller.
+     */
+    async getFileInfo(bucket, path) {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/file?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`, { headers: await this.buildHeaders() });
+        if (!res.ok) {
+            throw await this.error(res, 'Failed to get the file');
+        }
+        return (0, storage_files_js_1.fileInfoFromJson)((await res.json()));
+    }
     /**
      * Apply a partial metadata update to an existing object. Returns the
      * post-update {@link KoolbaseObject} with the merged metadata.
@@ -207,7 +290,7 @@ class KoolbaseStorage {
      * // -> { category: 'landscape', tag: 'sunset' }
      */
     async updateMetadata(bucket, path, metadata) {
-        const res = await (0, network_js_1.koolbaseFetch)(`${this.config.baseUrl}/v1/sdk/storage/objects/metadata`, {
+        const res = await (0, network_js_1.sessionFetch)(`${this.config.baseUrl}/v1/sdk/storage/objects/metadata`, {
             method: 'PATCH',
             headers: {
                 ...(await this.buildHeaders()),
@@ -230,7 +313,7 @@ class KoolbaseStorage {
         if (versionId) {
             url += `&version_id=${encodeURIComponent(versionId)}`;
         }
-        const res = await (0, network_js_1.koolbaseFetch)(url, { headers: await this.buildHeaders() });
+        const res = await (0, network_js_1.sessionFetch)(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to get download URL');
         }
@@ -342,7 +425,7 @@ class KoolbaseStorage {
         const url = forcePurge
             ? `${this.config.baseUrl}/v1/sdk/storage/object?force_purge=true`
             : `${this.config.baseUrl}/v1/sdk/storage/object`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, {
+        const res = await (0, network_js_1.sessionFetch)(url, {
             method: 'DELETE',
             headers: {
                 ...(await this.buildHeaders()),
@@ -369,7 +452,7 @@ class KoolbaseStorage {
     async listVersions(bucket, path) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, { headers: await this.buildHeaders() });
+        const res = await (0, network_js_1.sessionFetch)(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to list versions');
         }
@@ -385,7 +468,7 @@ class KoolbaseStorage {
     async getVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, { headers: await this.buildHeaders() });
+        const res = await (0, network_js_1.sessionFetch)(url, { headers: await this.buildHeaders() });
         if (!res.ok) {
             throw await this.error(res, 'Failed to fetch version');
         }
@@ -404,7 +487,7 @@ class KoolbaseStorage {
     async restoreVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}/restore` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, {
+        const res = await (0, network_js_1.sessionFetch)(url, {
             method: 'POST',
             headers: await this.buildHeaders(),
         });
@@ -422,7 +505,7 @@ class KoolbaseStorage {
     async purgeVersion(bucket, path, versionId) {
         const url = `${this.config.baseUrl}/v1/sdk/storage/object-versions/${encodeURIComponent(versionId)}` +
             `?bucket=${encodeURIComponent(bucket)}&path=${encodeURIComponent(path)}`;
-        const res = await (0, network_js_1.koolbaseFetch)(url, {
+        const res = await (0, network_js_1.sessionFetch)(url, {
             method: 'DELETE',
             headers: await this.buildHeaders(),
         });

package/dist/cjs/sync-engine.js

@@ -259,7 +259,7 @@ class SyncEngine {
             : `${this.config.baseUrl}/v1/sdk/db/records/${write.recordId}`;
         let res;
         if (write.operation === 'insert') {
-            res = await (0, network_js_1.koolbaseFetch)(url, {
+            res = await (0, network_js_1.sessionFetch)(url, {
                 method: 'POST',
                 headers,
                 // The write's own id: generated at enqueue, identical on every retry.
@@ -273,7 +273,7 @@ class SyncEngine {
             });
         }
         else if (write.operation === 'update') {
-            res = await (0, network_js_1.koolbaseFetch)(url, {
+            res = await (0, network_js_1.sessionFetch)(url, {
                 method: 'PATCH',
                 headers,
                 // The revision the change was composed against. The server applies it
@@ -292,7 +292,7 @@ class SyncEngine {
             const q = write.baseRevision !== undefined
                 ? `?expected_revision=${write.baseRevision}`
                 : '';
-            res = await (0, network_js_1.koolbaseFetch)(`${url}${q}`, { method: 'DELETE', headers });
+            res = await (0, network_js_1.sessionFetch)(`${url}${q}`, { method: 'DELETE', headers });
         }
         if (res.status === 401)
             throw new errors_js_1.KoolbaseUnauthenticatedError('unauthorized');

package/dist/cjs/types.d.ts

@@ -180,6 +180,13 @@ export declare enum RestoreResult {
  * broken listener cannot break propagation to others.
  */
 export type AuthStateListener = (user: KoolbaseUser | null) => void;
+/**
+ * Why the last session ended (#104): the person signed out, or the session
+ * ended on its own -- revoked, expired past renewal, signed out elsewhere.
+ * An app tells them apart to say "You were signed out" only when they did
+ * not ask to be.
+ */
+export type SignOutReason = 'signed_out' | 'session_ended';
 /**
  * Drop-in replacement for the global `fetch` function. Inject via
  * KoolbaseConfig.fetch for testing (mock fetch), proxying, or
@@ -362,7 +369,18 @@ export interface UploadOptions {
      * for post-upload merge changes.
      */
     metadata?: Record<string, string>;
-    onProgress?: (percent: number) => void;
+    /**
+     * Called as the upload goes: `percent` is 0 to 100 of the bytes sent;
+     * `progress` says where the upload is (uploading, verifying, completed,
+     * ...). For a cancellable upload use `KoolbaseStorage.startUpload`.
+     */
+    onProgress?: (percent: number, progress: import('./storage-transfer.js').KoolbaseUploadProgress) => void;
+    /**
+     * Aborting this signal cancels the upload, if the server has not begun
+     * checking it yet; the upload then rejects with
+     * `KoolbaseUploadCancelledError`.
+     */
+    signal?: AbortSignal;
 }
 /**
  * A stored object's server-side metadata. Field names are camelCase here

package/dist/esm/auth.d.ts

@@ -1,5 +1,5 @@
 import { AuthStateListener, KoolbaseConfig, KoolbaseSession, KoolbaseUser, LinkPhoneParams, LoginParams, OtpSendResult, PhoneVerifyResult, RegisterParams, RestoreResult, KoolbaseAuditPage, KoolbaseSessionInfo, ResendVerificationResult, SendOtpParams, SignUpResult, SignInWithAppleParams, VerifyOtpParams } from './types.js';
-import type { SignInWithGoogleParams } from './types.js';
+import type { SignInWithGoogleParams, SignOutReason } from './types.js';
 export declare class KoolbaseAuth {
     private config;
     private storage;
@@ -9,6 +9,10 @@ export declare class KoolbaseAuth {
     private timeoutMs;
     private ongoingRefresh;
     private listeners;
+    /** Why the last session ended (#104); null while signed in or never signed in. */
+    private signOutReason;
+    /** The last renewal failed for want of a connection, not because the server refused it (#96). */
+    private renewalUnavailable;
     constructor(config: KoolbaseConfig);
     /**
      * Subscribe to authentication state changes. The listener fires:
@@ -82,6 +86,29 @@ export declare class KoolbaseAuth {
      * need to.
      */
     clearStoredSession(): Promise<void>;
+    /**
+     * Why the last session ended (#104): `'signed_out'` when the person signed
+     * out (or deleted their account), `'session_ended'` when it ended on its own
+     * -- revoked, past renewal, signed out on another device. null while signed
+     * in. Read it in an onAuthStateChange listener to say "You were signed out"
+     * only when they did not ask to be.
+     */
+    get lastSignOutReason(): SignOutReason | null;
+    /**
+     * A data request carrying `refused` came back unauthenticated. Renews the
+     * session and returns the token to send again with, or null when there is
+     * none -- nobody is signed in, or the server refused the renewal too, which
+     * ends the session (#96).
+     */
+    renewRejected(refused: string): Promise<string | null>;
+    /**
+     * A data request was refused as unauthenticated and renewing could not
+     * help: the session is over, so it ends here and every listener hears it.
+     * Unless the renewal failed only for want of a connection -- then the
+     * session may well be good, and signing someone out for a dropped network
+     * would be wrong (#96).
+     */
+    sessionRejected(): Promise<void>;
     private clearSessionInternal;
     restoreSession(): Promise<RestoreResult>;
     /**
@@ -164,6 +191,9 @@ export declare class KoolbaseAuth {
     private parseAppleSessionResponse;
     refresh(refreshToken?: string): Promise<KoolbaseSession>;
     private _doRefresh;
+    private readStored;
+    /** A newer session another tab stored after renewing `spent`, made current; null if none. */
+    private adoptNewer;
     logout(): Promise<boolean>;
     forgotPassword(email: string): Promise<void>;
     /**

package/dist/esm/auth.js

@@ -1,6 +1,6 @@
 import { koolbaseFetch } from './network.js';
 import { RestoreResult, } from './types.js';
-import { AccountLockedError, EmailAlreadyInUseError, InvalidCredentialsError, InvalidPhoneNumberError, KoolbaseAuthError, OtpExpiredError, OtpInvalidError, OtpMaxAttemptsError, OtpRateLimitError, PhoneAlreadyLinkedError, IdentityNotFoundError, InsufficientScopeError, MalformedSessionResponseError, ProviderIdentityAlreadyLinkedError, AccountExistsError, ContactNotVerifiedError, CurrentPasswordIncorrectError, HideRequiresVerificationError, InsufficientAuthorityError, LastCredentialError, OAuthOnlyAccountError, SessionRequiredError, SignupsDisabledError, TokenAlreadyUsedError, TokenExpiredError, UnsupportedOAuthProviderError, RateLimitError, VerificationResendCooldownError, VerificationResendDailyCapError, SessionExpiredError, SmsConfigMissingError, UnlockTokenInvalidError, UserDisabledError, WeakPasswordError, AppleEmailRequiredError, AppleSignInNotConfiguredError, InvalidAppleTokenError, OAuthEmailConflictError, GoogleEmailRequiredError, GoogleSignInNotConfiguredError, InvalidGoogleTokenError, EmailCodeDisabledError, MfaRequiredError, RecentAuthRequiredError, RecentMfaRequiredError, MfaAlreadyEnabledError, MfaEnrollmentNotFoundError, MfaNotEnabledError, } from './auth-errors.js';
+import { AccountLockedError, EmailAlreadyInUseError, InvalidCredentialsError, InvalidPhoneNumberError, KoolbaseAuthError, OtpExpiredError, OtpInvalidError, OtpMaxAttemptsError, OtpRateLimitError, PhoneAlreadyLinkedError, IdentityNotFoundError, InsufficientScopeError, MalformedSessionResponseError, ProviderIdentityAlreadyLinkedError, AccountExistsError, ContactNotVerifiedError, CurrentPasswordIncorrectError, HideRequiresVerificationError, InsufficientAuthorityError, LastCredentialError, OAuthOnlyAccountError, SessionRequiredError, SignupsDisabledError, TokenAlreadyUsedError, TokenExpiredError, UnsupportedOAuthProviderError, RateLimitError, VerificationResendCooldownError, VerificationResendDailyCapError, SessionExpiredError, SmsConfigMissingError, TokenRevokedError, UnlockTokenInvalidError, UserDisabledError, WeakPasswordError, AppleEmailRequiredError, AppleSignInNotConfiguredError, InvalidAppleTokenError, OAuthEmailConflictError, GoogleEmailRequiredError, GoogleSignInNotConfiguredError, InvalidGoogleTokenError, EmailCodeDisabledError, MfaRequiredError, RecentAuthRequiredError, RecentMfaRequiredError, MfaAlreadyEnabledError, MfaEnrollmentNotFoundError, MfaNotEnabledError, } from './auth-errors.js';
 import { getPlatform } from './platform.js';
 import { DeviceMetadata } from './device-metadata.js';
 export class KoolbaseAuth {
@@ -8,6 +8,10 @@ export class KoolbaseAuth {
         this.session = null;
         this.ongoingRefresh = null;
         this.listeners = new Set();
+        /** Why the last session ended (#104); null while signed in or never signed in. */
+        this.signOutReason = null;
+        /** The last renewal failed for want of a connection, not because the server refused it (#96). */
+        this.renewalUnavailable = false;
         this.config = config;
         this.metadata = new DeviceMetadata(config.appVersion);
         this.fetchFn = config.fetch ?? ((url, init) => koolbaseFetch(url, init));
@@ -149,6 +153,7 @@ export class KoolbaseAuth {
     }
     async setSessionInternal(session) {
         this.session = session;
+        this.signOutReason = null;
         if (this.storage) {
             try {
                 await this.storage.saveSession(session);
@@ -175,9 +180,52 @@ export class KoolbaseAuth {
      * need to.
      */
     async clearStoredSession() {
-        await this.clearSessionInternal();
+        await this.clearSessionInternal('session_ended');
     }
-    async clearSessionInternal() {
+    /**
+     * Why the last session ended (#104): `'signed_out'` when the person signed
+     * out (or deleted their account), `'session_ended'` when it ended on its own
+     * -- revoked, past renewal, signed out on another device. null while signed
+     * in. Read it in an onAuthStateChange listener to say "You were signed out"
+     * only when they did not ask to be.
+     */
+    get lastSignOutReason() {
+        return this.signOutReason;
+    }
+    /**
+     * A data request carrying `refused` came back unauthenticated. Renews the
+     * session and returns the token to send again with, or null when there is
+     * none -- nobody is signed in, or the server refused the renewal too, which
+     * ends the session (#96).
+     */
+    async renewRejected(refused) {
+        if (!this.session)
+            return null;
+        // Another request renewed it while this one was out.
+        if (this.session.accessToken !== refused)
+            return this.session.accessToken;
+        try {
+            return (await this.refresh()).accessToken;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * A data request was refused as unauthenticated and renewing could not
+     * help: the session is over, so it ends here and every listener hears it.
+     * Unless the renewal failed only for want of a connection -- then the
+     * session may well be good, and signing someone out for a dropped network
+     * would be wrong (#96).
+     */
+    async sessionRejected() {
+        if (!this.session || this.renewalUnavailable)
+            return;
+        await this.clearSessionInternal('session_ended');
+    }
+    async clearSessionInternal(reason = 'session_ended') {
+        if (this.session)
+            this.signOutReason = reason;
         this.session = null;
         if (this.storage) {
             try {
@@ -205,7 +253,28 @@ export class KoolbaseAuth {
             : 0;
         const oneMinuteMs = 60 * 1000;
         if (expiresAt > Date.now() + oneMinuteMs) {
-            return RestoreResult.Restored;
+            // Valid by the clock is not valid: the session may have been signed out
+            // on another device, revoked, or the account disabled since. Ask the
+            // server before saying it is restored (#104). No answer -- offline, a
+            // timeout, a server error -- keeps the optimistic session: Offline.
+            try {
+                const res = await this.authRequest('/v1/sdk/auth/me', { method: 'GET', includeAuth: true });
+                if (res.ok) {
+                    try {
+                        await this.updateUserAndPersist(this.mapUser(await res.json()));
+                    }
+                    catch {
+                        // The session is good; a user that will not parse keeps the stored one.
+                    }
+                    return RestoreResult.Restored;
+                }
+                if (res.status !== 401)
+                    return RestoreResult.Offline;
+                // Refused: the access token is done. The refresh token decides.
+            }
+            catch {
+                return RestoreResult.Offline;
+            }
         }
         try {
             await this.refresh(persisted.refreshToken);
@@ -221,8 +290,8 @@ export class KoolbaseAuth {
             // key or the request rather than the user's session — and deleting the
             // refresh token on that reading signs someone out with no way back.
             // Nothing reaches here with it today; it stays out so nothing does.
-            if (e instanceof SessionExpiredError) {
-                await this.clearSessionInternal();
+            if (isRejection(e)) {
+                await this.clearSessionInternal('session_ended');
                 return RestoreResult.Expired;
             }
             return RestoreResult.Offline;
@@ -495,17 +564,77 @@ export class KoolbaseAuth {
         return promise;
     }
     async _doRefresh(refreshToken) {
-        const token = refreshToken ?? this.session?.refreshToken;
+        // The newest refresh token is the stored one: another tab of the same app
+        // may have renewed the session, and its in-memory copy here is spent.
+        const stored = refreshToken ? null : await this.readStored();
+        const token = refreshToken ?? stored?.refreshToken ?? this.session?.refreshToken;
         if (!token) {
             throw new SessionExpiredError();
         }
-        const res = await this.authRequest('/v1/sdk/auth/refresh', {
-            method: 'POST',
-            body: { refresh_token: token },
-        });
-        const session = await this.parseSessionResponse(res, true);
-        await this.setSessionInternal(session);
-        return session;
+        try {
+            const res = await this.authRequest('/v1/sdk/auth/refresh', {
+                method: 'POST',
+                body: { refresh_token: token },
+            });
+            const session = await this.parseSessionResponse(res, true);
+            this.renewalUnavailable = false;
+            await this.setSessionInternal(session);
+            return session;
+        }
+        catch (e) {
+            if (!isRejection(e)) {
+                // No answer, or a server error: the session may be fine. Keep it.
+                this.renewalUnavailable = true;
+                throw e;
+            }
+            this.renewalUnavailable = false;
+            // Two tabs renewing at the same moment send the same token; the
+            // server renews one and refuses the other. The winner's session is in
+            // storage: take it rather than signing out (#96).
+            const adopted = await this.adoptNewer(token);
+            if (adopted)
+                return adopted;
+            await this.clearSessionInternal('session_ended');
+            throw e;
+        }
+    }
+    async readStored() {
+        if (!this.storage)
+            return null;
+        try {
+            return await this.storage.readSession();
+        }
+        catch {
+            return null;
+        }
+    }
+    /** A newer session another tab stored after renewing `spent`, made current; null if none. */
+    async adoptNewer(spent) {
+        for (const wait of [0, 400]) {
+            if (wait)
+                await new Promise((r) => setTimeout(r, wait));
+            const stored = await this.readStored();
+            if (!stored || stored.refreshToken === spent)
+                continue;
+            const expiresAt = stored.expiresAt ? new Date(stored.expiresAt).getTime() : 0;
+            if (expiresAt > Date.now() + 60 * 1000) {
+                await this.setSessionInternal(stored);
+                return stored;
+            }
+            try {
+                const res = await this.authRequest('/v1/sdk/auth/refresh', {
+                    method: 'POST',
+                    body: { refresh_token: stored.refreshToken },
+                });
+                const session = await this.parseSessionResponse(res, true);
+                await this.setSessionInternal(session);
+                return session;
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
     }
     async logout() {
         let serverSucceeded = true;
@@ -526,7 +655,7 @@ export class KoolbaseAuth {
             serverSucceeded = false;
         }
         finally {
-            await this.clearSessionInternal();
+            await this.clearSessionInternal('signed_out');
         }
         return serverSucceeded;
     }
@@ -689,7 +818,7 @@ export class KoolbaseAuth {
             includeAuth: true,
         });
         await this.checkResponse(res);
-        await this.clearSessionInternal();
+        await this.clearSessionInternal('signed_out');
     }
     /**
      * Every session the signed-in user has — a "where you're signed in" list.
@@ -812,8 +941,14 @@ export class KoolbaseAuth {
         try {
             return await this._ensureValidToken();
         }
-        catch {
-            return null;
+        catch (e) {
+            // Refused: the session has ended (and been cleared); go api-key-only.
+            if (isRejection(e))
+                return null;
+            // No answer: the session may be fine, so the request must not go out
+            // as a signed-out visitor (whose refusal would end it). It fails as
+            // the network failure it is, and the caller retries (#96).
+            throw e;
         }
     }
     async setSession(session) {
@@ -1061,9 +1196,9 @@ export class KoolbaseAuth {
             return session.accessToken;
         }
         catch (e) {
-            if (e instanceof KoolbaseAuthError)
-                throw e;
-            throw new SessionExpiredError();
+            // A refusal stays a refusal; a network failure stays one too, rather
+            // than being reported as an ended session (#96).
+            throw e;
         }
     }
     mapUser(raw) {
@@ -1310,3 +1445,15 @@ export class KoolbaseAuth {
         throw new KoolbaseAuthError(msg || 'An unexpected error occurred', code || undefined);
     }
 }
+/**
+ * Whether an error is the server refusing the session -- it ended -- rather
+ * than no answer at all (#96). Only a refusal signs anyone out.
+ */
+function isRejection(e) {
+    if (e instanceof SessionExpiredError || e instanceof TokenRevokedError || e instanceof UserDisabledError)
+        return true;
+    if (e instanceof KoolbaseAuthError) {
+        return ['invalid_refresh_token', 'token_revoked', 'account_disabled', 'mfa_session_insufficient', 'unauthenticated'].includes(e.code ?? '');
+    }
+    return false;
+}

package/dist/esm/database.js

@@ -1,4 +1,4 @@
-import { koolbaseFetch } from './network.js';
+import { sessionFetch } from './network.js';
 import { refreshCollectionQueries } from './query-refresh.js';
 import { KoolbaseRevisionMismatchError } from './database-errors.js';
 import { KoolbaseError, KoolbaseOfflineBaselineUnavailableError, KoolbaseUnauthenticatedError, } from './errors.js';
@@ -94,7 +94,7 @@ export class KoolbaseDatabase {
         };
     }
     async request(method, path, body) {
-        const res = await koolbaseFetch(`${this.config.baseUrl}${path}`, {
+        const res = await sessionFetch(`${this.config.baseUrl}${path}`, {
             method,
             headers: await this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,
@@ -132,7 +132,7 @@ export class KoolbaseDatabase {
      * none of them clearing a rejected session. One path, two shapes of result.
      */
     async requestWithStatus(method, path, body) {
-        const res = await koolbaseFetch(`${this.config.baseUrl}${path}`, {
+        const res = await sessionFetch(`${this.config.baseUrl}${path}`, {
             method,
             headers: await this.buildHeaders(),
             body: body ? JSON.stringify(body) : undefined,

package/dist/esm/fiscal.js

@@ -1,4 +1,4 @@
-import { koolbaseFetch } from './network.js';
+import { sessionFetch } from './network.js';
 import { KoolbaseError, KoolbaseUnauthenticatedError } from './errors.js';
 const KNOWN_STATUSES = [
     'created', 'blocked', 'queued', 'submitting',
@@ -106,7 +106,7 @@ export class KoolbaseFiscal {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), params.timeoutMs ?? 30000);
         try {
-            const res = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/fiscal/submit`, {
+            const res = await sessionFetch(`${this.config.baseUrl}/v1/sdk/fiscal/submit`, {
                 method: 'POST',
                 headers: await this.buildHeaders(),
                 signal: controller.signal,
@@ -144,7 +144,7 @@ export class KoolbaseFiscal {
                 device_id: params.deviceId,
                 client_ref: params.clientRef,
             });
-            const res = await koolbaseFetch(`${this.config.baseUrl}/v1/sdk/fiscal/status?${q.toString()}`, { method: 'GET', headers: await this.buildHeaders(), signal: controller.signal });
+            const res = await sessionFetch(`${this.config.baseUrl}/v1/sdk/fiscal/status?${q.toString()}`, { method: 'GET', headers: await this.buildHeaders(), signal: controller.signal });
             return await this.decode(res);
         }
         catch (e) {