@rakomi/react-native 0.2.0 → 0.3.1

package/COMPLIANCE.md

@@ -10,7 +10,7 @@ This package is a "product with digital elements" under CRA Art. 3(1). Same post
 |---|---|
 | Art. 13 — Vulnerability handling | Documented secure vulnerability-handling process; vulnerability records retained with the technical documentation. Internal fix targets (e.g. 14 days for High severity) are an operational SLA, **not** a statutory deadline. See `SECURITY.md`. |
 | Art. 14 — Reporting of actively exploited vulnerabilities & severe incidents | Statutory reporting to the designated authority on the CRA timeline (early warning → notification → final report) and informing impacted users; published advisories via GitHub Security Advisories. See `SECURITY.md`. |
-| Annex I — Essential cybersecurity requirements | Secure defaults: fixed asymmetric token-signature verification, PKCE with S256 challenge (RFC 7636), biometric opt-in, ephemeral session, minimal attack surface. **Passkeys:** no passkey library is bundled or depended on by **this package** — the OS ceremony is reached through a module the host supplies. Read that precisely: it removes third-party ceremony code from *our* dependency tree and therefore from *our* SBOM; the module you wire **is** on the credential path and is **your** supply-chain surface, so account for it in yours. The bridge itself carries no bearer token, emits nothing to telemetry or the console, and an unwired adapter fails closed (`PASSKEY_NOT_SUPPORTED`) rather than falling back to a different ceremony. Proving test: `test/passkey-native-adapter.test.ts` (`@asserts CTRL-CRA-ANNEXI-SECURE-DEFAULT`). |
+| Annex I — Essential cybersecurity requirements | Secure defaults: fixed asymmetric token-signature verification, PKCE with S256 challenge (RFC 7636), biometric opt-in, ephemeral session, minimal attack surface. **Passkeys:** no passkey library is bundled or depended on by **this package** — the OS ceremony is reached through a module the host supplies. Read that precisely: it removes third-party ceremony code from *our* dependency tree and therefore from *our* SBOM; the module you wire **is** on the credential path and is **your** supply-chain surface, so account for it in yours. The bridge itself carries no bearer token, emits nothing to telemetry or the console, and an unwired adapter fails closed (`PASSKEY_NOT_SUPPORTED`) rather than falling back to a different ceremony. |
 
 ## GDPR — Reg. (EU) 2016/679
 
@@ -18,8 +18,8 @@ This package is a "product with digital elements" under CRA Art. 3(1). Same post
 |---|---|
 | Art. 25 — Data protection by design | No PII collected client-side beyond what API requires; analytics opt-in via `onEvent` only. **Passkeys — sign-in:** identified sign-in takes an opaque, server-issued user handle, never an email or a username. **Passkeys — registration (state this plainly):** the registration options the server issues carry the account's `user.name` / `user.displayName`, which today is the user's **email address**. It crosses the bridge to the host-supplied module and is passed to the platform credential provider, which stores it with the credential and may **sync it to the user's platform account** (iCloud Keychain / Google Password Manager). This is inherent to WebAuthn — the value is what the user is shown when they pick a passkey — not a choice this SDK makes, and it is disclosed here rather than glossed. The SDK adds no identifier of its own. **Errors:** the credential-envelope validator names the failing FIELD, never its VALUE; error messages relayed from the server or from the host's own callbacks are passed through verbatim and are the tenant's surface to control. |
 | Art. 28 — Processor obligations | SDK is a data-processor adjunct; tenant is data controller. DPA covers the relationship. |
-| Art. 32 — Security of processing | Pseudonymisation + encryption at rest (Keychain) + access control (biometric opt-in). **Passkeys — key material:** the private key is created and held by the platform credential provider; it never enters SDK memory and the SDK holds no passkey material at rest. Proving test: `test/use-passkeys.test.tsx` (`@asserts CTRL-GDPR-32-NO-SECRET-TO-ADAPTER` — no access token, step-up token or bearer secret reaches the ceremony adapter). |
-| Art. 32 — Security of processing (session integrity) | A completed ceremony whose session was **not** actually stored is reported as a failure, never as a success — the SDK re-reads the token runtime and matches the session identity before it reports a sign-in. Proving test: `test/use-passkeys.test.tsx` (the session-confirmation polarities). |
+| Art. 32 — Security of processing | Pseudonymisation + encryption at rest (Keychain) + access control (biometric opt-in). **Passkeys — key material:** the private key is created and held by the platform credential provider; it never enters SDK memory and the SDK holds no passkey material at rest. No access token, step-up token or bearer secret reaches the ceremony adapter. |
+| Art. 32 — Security of processing (session integrity) | A completed ceremony whose session was **not** actually stored is reported as a failure, never as a success — the SDK re-reads the token runtime and matches the session identity before it reports a sign-in. |
 | Art. 32 — Security of processing (re-authentication gate) | Management actions (list / rename / delete) are re-authentication-gated. **The gate is enforced by the API, not by this SDK** — the SDK transmits the step-up token it is given and does not itself decide whether one is sufficient. Stated here because an SDK compliance doc must not claim credit for a server-side control. |
 | Art. 9 — Special categories (negative scope) | **No biometric data is processed by this SDK.** A fingerprint or face is consumed by the operating system to unlock the authenticator; the SDK receives only the resulting assertion. It never reads, stores, transmits or infers a biometric template, so Art. 9's special-category regime is not engaged by anything this library does. (Whether YOUR app processes biometrics for other purposes is your assessment.) |
 

package/README.md

@@ -2,9 +2,27 @@
 
 React Native / Expo SDK for [Rakomi](https://rakomi.com) — EU-native auth-as-a-service.
 
-> **Status:** `0.1.0` — initial. API surface frozen for parity with `@rakomi/react`.
-> Token-manager runtime, JWKS verification, social-provider deep-link auto-handler,
-> bare-RN adapter example, and the demo app land in subsequent 0.x patches.
+> **Status: PREVIEW.** `@rakomi/react-native` is a pre-1.0 package — no stability or support
+> guarantee (SemVer 2.0.0 §4). The exported hook and component **surface** is frozen for parity with
+> [`@rakomi/react`](https://www.npmjs.com/package/@rakomi/react), and every name below is exported
+> and type-checked, but not every export's **behavior** is wired to the network yet.
+>
+> **Works today:** social sign-in via the system browser (`<SignIn providers={[...]} />` /
+> `startSocialSignIn()`), magic link, email OTP, registration, MFA (TOTP), passkeys
+> (sign-in/step-up/register/list/rename/delete), session management (`useAuth`, `useSession`,
+> `getToken`), `<UserButton>`, `<SignedIn>`/`<SignedOut>`, `<Protect>`, `useOrganization` /
+> `useOrganizationList` (JWT-claim reads), `useAuthConfig`, `useBranding`, `useBaasPlans`,
+> `useBaasSubscription`.
+>
+> **Not yet wired — calls resolve/return an error placeholder, no network request is made:**
+> `useAuth().signIn()` (direct email+password) and `useAuth().switchOrganization()`;
+> `useLinkedAccounts().link()`/`.unlink()`; `useAnonymousSignin().signInAnonymously()`. `<SignIn />`
+> renders social providers and MFA TOTP entry only — there is no password field in the pre-built
+> component. `<UserProfile>` and `<Feature>` are marked preview individually below. Each of these is
+> also called out at its own symbol in the [full reference docs](https://docs.rakomi.dev/sdk/react-native/authentication/#what-works-today).
+>
+> Token-manager runtime, JWKS verification, social-provider deep-link auto-handler, a bare-RN adapter
+> example, and a demo app land in subsequent 0.x releases.
 
 ## Install
 
@@ -36,11 +54,11 @@ export default function App() {
 }
 ```
 
-## What's included in 0.1.0
+## What's included
 
 - **`<RakomiProvider>`** — context provider. Freezes the native adapter on mount. AppState debounce 300ms. Connectivity transitions wired.
-- **Hooks (parity-locked):** `useAuth`, `useUser`, `useSession`, `useFlag`, `useOrganization`, `useOrganizationList`, `useLinkedAccounts`, `useTranslation`, `useAuthConfig`, `useBranding`, `useAnonymousSignin`, `useBaasPlans`, `useBaasSubscription`. Type-level parity with `@rakomi/react` is enforced by CI.
-- **Components:** `<SignIn />` (password + social + MFA TOTP), `<SignUp />`, `<UserButton />`, `<UserProfile />` (preview), `<SignedIn>`, `<SignedOut>`, `<Protect>`, `<Feature>`. RN primitives only — no HTML, no WebView.
+- **Hooks (parity-locked):** `useAuth`, `useUser`, `useSession`, `useFlag`, `useOrganization`, `useOrganizationList`, `useLinkedAccounts` (preview), `useTranslation`, `useAuthConfig`, `useBranding`, `useAnonymousSignin` (preview), `useBaasPlans`, `useBaasSubscription`. Type-level parity with `@rakomi/react` is enforced by CI — see the status banner above for which hooks make real network calls today.
+- **Components:** `<SignIn />` (social + MFA TOTP — no password field), `<SignUp />`, `<UserButton />`, `<UserProfile />` (preview), `<SignedIn>`, `<SignedOut>`, `<Protect>`, `<Feature>` (preview — reads the JWT directly, no live evaluation). RN primitives only — no HTML, no WebView.
 - **OAuth (RFC 8252):** PKCE S256, 32-byte state with single-use 60s TTL + constant-time comparison, system browser via `expo-web-browser` (`preferEphemeralSession: true` default), confused-deputy guard on callback ingest.
 - **Native adapter contract:** `NativeAuthAdapter` interface with forward-compat slots (`verifiers` for EUDI, `dpopProver` for DPoP, `par` for RFC 9126 PAR).
 - **`tokenCache` injection sugar** — replace storage without re-implementing the full adapter.

package/THIRD-PARTY-NOTICES

@@ -1,6 +1,6 @@
 THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 
-For the npm package: @rakomi/react-native@0.2.0
+For the npm package: @rakomi/react-native@0.3.1
 
 This package's published bundle (`dist/`) INLINES the third-party components listed below.
 Their copyright and permission notices are reproduced verbatim, as required by their licenses

package/dist/index.cjs

@@ -1013,6 +1013,21 @@ function RakomiProvider(props) {
     return Object.freeze(built);
   }, [props.nativeAdapter, props.tokenCache]);
   const http = react.useMemo(() => createRnHttpClient({ baseUrl: props.baseUrl }), [props.baseUrl]);
+  const authorizationEndpointCache = react.useMemo(
+    () => sdkCore.createAuthorizationEndpointCache({
+      fetchDiscoveryDocument: async () => {
+        const response = await http.fetch("/.well-known/openid-configuration", {
+          method: "GET",
+          headers: { Accept: "application/json" }
+        });
+        if (!response.ok) {
+          throw new Error(`discovery fetch failed: HTTP ${response.status}`);
+        }
+        return response.json();
+      }
+    }),
+    [http]
+  );
   const events = react.useMemo(() => new sdkCore.EventLog(props.onEvent), [props.onEvent]);
   const [snapshot, dispatch] = react.useReducer(sdkCore.reduce, sdkCore.INITIAL_SNAPSHOT);
   const passkeyCeremonyLock = react.useRef(createCeremonyLock()).current;
@@ -1148,6 +1163,7 @@ function RakomiProvider(props) {
       redirectUri: props.redirectUri,
       adapter,
       http,
+      authorizationEndpointCache,
       snapshot,
       state: snapshot.state,
       isSignedIn: sdkCore.isSignedIn(snapshot),
@@ -1163,7 +1179,7 @@ function RakomiProvider(props) {
       beginAuthFlow,
       dpopSession
     }),
-    [adapter, http, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession, passkeyCeremonyLock]
+    [adapter, http, authorizationEndpointCache, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession, passkeyCeremonyLock]
   );
   return /* @__PURE__ */ jsxRuntime.jsx(RakomiContext.Provider, { value, children: props.children });
 }
@@ -1620,14 +1636,24 @@ function SignIn(props) {
   const [step, setStep] = react.useState({ kind: "methods" });
   const [code, setCode] = react.useState("");
   const [busy, setBusy] = react.useState(false);
-  const tokenEndpoint = props.tokenEndpoint ?? "/v1/auth/oauth/callback";
-  const authorizationEndpoint = props.authorizationEndpoint ?? "/oauth/authorize";
-  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/totp/verify";
+  const tokenEndpoint = props.tokenEndpoint ?? "/oauth/token";
+  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/verify-login";
   const providers = props.providers ?? ["google"];
   async function onProviderPress(provider) {
     if (busy) return;
     setBusy(true);
     ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { provider } });
+    let authorizationEndpoint = props.authorizationEndpoint;
+    if (!authorizationEndpoint) {
+      const resolved = await ctx.authorizationEndpointCache.resolve(ctx.baseUrl);
+      if (!resolved.ok) {
+        ctx.events.push({ type: "sign_in_failed", severity: "warning", error: resolved.error });
+        setStep({ kind: "error", error: resolved.error });
+        setBusy(false);
+        return;
+      }
+      authorizationEndpoint = resolved.authorizationEndpoint;
+    }
     const outcome = await startSocialSignIn({
       adapter: ctx.adapter,
       http: ctx.http,
@@ -1833,7 +1859,7 @@ function UserButton(props) {
 function UserProfile(props) {
   react.useEffect(() => {
     if (typeof __DEV__ !== "undefined" && __DEV__) {
-      console.warn("[@rakomi/react-native] <UserProfile /> is in preview until 0.2.0 \u2014 feedback welcome.");
+      console.warn("[@rakomi/react-native] <UserProfile /> is in preview \u2014 feedback welcome.");
     }
   }, []);
   const ctx = useRakomiContext();
@@ -2660,7 +2686,7 @@ function useMfa() {
   const ctx = useRakomiContext();
   return {
     verifyTotp: async (challengeToken, code, endpoint) => {
-      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/totp/verify`;
+      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/verify-login`;
       const result = await sdkCore.verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
       if (result.ok) {
         const nonce = await ctx.beginAuthFlow();
@@ -2691,6 +2717,10 @@ Object.defineProperty(exports, "base64url", {
   enumerable: true,
   get: function () { return sdkCore.base64url; }
 });
+Object.defineProperty(exports, "createAuthorizationEndpointCache", {
+  enumerable: true,
+  get: function () { return sdkCore.createAuthorizationEndpointCache; }
+});
 Object.defineProperty(exports, "createTranslator", {
   enumerable: true,
   get: function () { return sdkCore.createTranslator; }
@@ -2707,6 +2737,10 @@ Object.defineProperty(exports, "decodeUser", {
   enumerable: true,
   get: function () { return sdkCore.decodeUser; }
 });
+Object.defineProperty(exports, "deriveAuthorizationEndpointFallback", {
+  enumerable: true,
+  get: function () { return sdkCore.deriveAuthorizationEndpointFallback; }
+});
 Object.defineProperty(exports, "generatePkce", {
   enumerable: true,
   get: function () { return sdkCore.generatePkce; }

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { AuthEvent, Locale, Translations, AuthMachineState, SignInOptions, SignInResult, TokenResult, AuthError, UserResource, HasParams, SwitchOrgResult, SessionResource, AuthConfig, BrandingConfig, OrgMembershipClaim, TranslationFn, OAuthTokenResponse, HttpClient, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeySummary, PasskeyError, AssertPasskeyResult, StepUpWithPasskeyResult, RegisterPasskeyResult, ListPasskeysResult, PasskeySummaryResult, DeletePasskeyResult, RequestResult, VerifyResult } from '@rakomi/sdk-core';
-export { AssertPasskeyResult, AuthError, AuthEvent, AuthMachineState, CryptoProvider, DeletePasskeyResult, HasParams, HttpClient, KeyValueStore, ListPasskeysResult, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeyError, PasskeyErrorCode, PasskeySummary, PasskeySummaryResult, PasskeyTokens, PkceChallenge, RegisterPasskeyResult, RegisterResult, SessionResource, SignInOptions, SignInResult, StepUpWithPasskeyResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createTranslator, decodeJwtPayload, decodeSession, decodeUser, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
+export { AssertPasskeyResult, AuthError, AuthEvent, AuthMachineState, AuthorizationEndpointCache, AuthorizationEndpointCacheOptions, CryptoProvider, DeletePasskeyResult, HasParams, HttpClient, KeyValueStore, ListPasskeysResult, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeyError, PasskeyErrorCode, PasskeySummary, PasskeySummaryResult, PasskeyTokens, PkceChallenge, RegisterPasskeyResult, RegisterResult, SessionResource, SignInOptions, SignInResult, StepUpWithPasskeyResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { D as DpopProver, N as NativeAuthAdapter, T as TokenCache } from './passkey-adapter-D_Z3Z7lV.cjs';
 export { A as AppLifecycle, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, k as DpopProofInput, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, P as ParClient, S as SystemBrowser, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter } from './passkey-adapter-D_Z3Z7lV.cjs';
 
@@ -134,6 +134,11 @@ declare function RakomiProvider(props: RakomiProviderProps): ReactNode;
  * Discriminated-union AuthState — identical to `@rakomi/react`'s `AuthState`.
  *
  * `state: AuthMachineState` is the addition.
+ *
+ * @experimental Preview — `signIn()` and `switchOrganization()` are present for type parity with
+ * `@rakomi/react` but always resolve `{ status: 'error', error: { code: 'INVALID_CONFIG', … } }` in the
+ * current release; nothing is wired to the network yet. Use one of the working sign-in paths instead
+ * (social, magic link, email OTP, passkeys — see the package README / docs).
  */
 type AuthState = {
     isLoaded: false;
@@ -239,13 +244,19 @@ type LinkedMethods = LinkedMethod[];
 interface UseLinkedAccountsResult {
     isLoaded: boolean;
     methods: LinkedMethods;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     link: (provider: LinkProvider) => Promise<{
         status: 'redirect' | 'error';
     }>;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     unlink: (provider: LinkProvider | 'password' | 'magic_link' | 'email_otp' | 'passkey') => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/**
+ * @experimental Preview — `methods` reads the JWT's `linked_methods` claim (live), but `link()` and
+ * `unlink()` are not yet wired to the network in this release; see the return type's per-field notes.
+ */
 declare function useLinkedAccounts(): UseLinkedAccountsResult;
 declare function useTranslation(): {
     t: TranslationFn;
@@ -263,12 +274,14 @@ interface UseBrandingReturn {
 declare function useBranding(): UseBrandingReturn;
 interface UseAnonymousSigninResult {
     isLoaded: boolean;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     signInAnonymously: (options?: {
         publicMetadata?: Record<string, unknown>;
     }) => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/** @experimental Preview — `signInAnonymously()` is not yet wired to the network in this release; see the return type's field note. */
 declare function useAnonymousSignin(): UseAnonymousSigninResult;
 interface BaasPlanPublicItem {
     id: string;
@@ -354,15 +367,19 @@ interface FeatureProps {
 declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
 
 /**
- * `<SignIn />` — RN port.
+ * `<SignIn />` — RN port. **Preview:** `@rakomi/react-native` is a pre-1.0 preview package — see the
+ * package README for the full "what's wired today" boundary.
  *
  * Renders a sign-in flow using ONLY RN primitives (`<View>`, `<Text>`,
  * `<TextInput>`, `<Pressable>`) — no HTML. Supports:
- * - Password (direct) sign-in.
  * - Social provider list (Google, GitHub, …) via `startSocialSignIn`.
  * - MFA TOTP code entry view (`keyboardType="number-pad"`,
  * `textContentType="oneTimeCode"`, `autoComplete="sms-otp"`).
  *
+ * There is no email/password field in this component — direct email+password sign-in is not wired in
+ * the current release. Use `useRegister()` for account creation, or one of the other working sign-in
+ * paths (magic link, email OTP, passkeys).
+ *
  * Accessibility:
  * - Every interactive element has `accessibilityLabel` + `accessibilityRole`.
  * - i18n keys come from `useRakomiContext.translate`.
@@ -370,11 +387,16 @@ declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
  */
 
 interface SignInProps {
-    /** Authorization endpoint, default `${baseUrl}/oauth/authorize`. */
+    /**
+     * Full authorization-endpoint URL to open the system browser to. Default: resolved via OIDC
+     * discovery against `baseUrl` (cached, with a host-naming fallback) — see `useRakomiContext()`'s
+     * `authorizationEndpointCache`. A bare `${baseUrl}/oauth/authorize` is NOT a valid default: that
+     * path on the API host returns JSON, not the hosted login UI.
+     */
     authorizationEndpoint?: string;
-    /** Token endpoint, default `${baseUrl}/v1/auth/oauth/callback`. */
+    /** RFC 6749 §3.2 token endpoint used for the PKCE code→token exchange, default `${baseUrl}/oauth/token`. */
     tokenEndpoint?: string;
-    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/totp/verify`. */
+    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/verify-login`. */
     totpVerifyEndpoint?: string;
     /** Social providers to render. Default: ['google']. */
     providers?: string[];
@@ -424,8 +446,8 @@ declare function UserButton(props: UserButtonProps): ReactNode;
 /**
  * `<UserProfile />` — RN port (PREVIEW).
  *
- * Marked `'preview'` until 0.2.0; on first mount in `__DEV__` builds we log a
- * warning so consumers don't accidentally ship it to production.
+ * In preview — on first mount in `__DEV__` builds we log a warning so consumers don't accidentally
+ * ship it to production ahead of graduation.
  */
 
 interface UserProfileProps {

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { AuthEvent, Locale, Translations, AuthMachineState, SignInOptions, SignInResult, TokenResult, AuthError, UserResource, HasParams, SwitchOrgResult, SessionResource, AuthConfig, BrandingConfig, OrgMembershipClaim, TranslationFn, OAuthTokenResponse, HttpClient, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeySummary, PasskeyError, AssertPasskeyResult, StepUpWithPasskeyResult, RegisterPasskeyResult, ListPasskeysResult, PasskeySummaryResult, DeletePasskeyResult, RequestResult, VerifyResult } from '@rakomi/sdk-core';
-export { AssertPasskeyResult, AuthError, AuthEvent, AuthMachineState, CryptoProvider, DeletePasskeyResult, HasParams, HttpClient, KeyValueStore, ListPasskeysResult, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeyError, PasskeyErrorCode, PasskeySummary, PasskeySummaryResult, PasskeyTokens, PkceChallenge, RegisterPasskeyResult, RegisterResult, SessionResource, SignInOptions, SignInResult, StepUpWithPasskeyResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createTranslator, decodeJwtPayload, decodeSession, decodeUser, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
+export { AssertPasskeyResult, AuthError, AuthEvent, AuthMachineState, AuthorizationEndpointCache, AuthorizationEndpointCacheOptions, CryptoProvider, DeletePasskeyResult, HasParams, HttpClient, KeyValueStore, ListPasskeysResult, Locale, MfaStepUpRequiredError, MfaStepUpUnavailableError, OpaqueUserHandle, PasskeyCeremonyAdapter, PasskeyError, PasskeyErrorCode, PasskeySummary, PasskeySummaryResult, PasskeyTokens, PkceChallenge, RegisterPasskeyResult, RegisterResult, SessionResource, SignInOptions, SignInResult, StepUpWithPasskeyResult, SwitchOrgResult, TokenResult, Translations, UserResource, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { D as DpopProver, N as NativeAuthAdapter, T as TokenCache } from './passkey-adapter-D_Z3Z7lV.js';
 export { A as AppLifecycle, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, k as DpopProofInput, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, P as ParClient, S as SystemBrowser, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter } from './passkey-adapter-D_Z3Z7lV.js';
 
@@ -134,6 +134,11 @@ declare function RakomiProvider(props: RakomiProviderProps): ReactNode;
  * Discriminated-union AuthState — identical to `@rakomi/react`'s `AuthState`.
  *
  * `state: AuthMachineState` is the addition.
+ *
+ * @experimental Preview — `signIn()` and `switchOrganization()` are present for type parity with
+ * `@rakomi/react` but always resolve `{ status: 'error', error: { code: 'INVALID_CONFIG', … } }` in the
+ * current release; nothing is wired to the network yet. Use one of the working sign-in paths instead
+ * (social, magic link, email OTP, passkeys — see the package README / docs).
  */
 type AuthState = {
     isLoaded: false;
@@ -239,13 +244,19 @@ type LinkedMethods = LinkedMethod[];
 interface UseLinkedAccountsResult {
     isLoaded: boolean;
     methods: LinkedMethods;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     link: (provider: LinkProvider) => Promise<{
         status: 'redirect' | 'error';
     }>;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     unlink: (provider: LinkProvider | 'password' | 'magic_link' | 'email_otp' | 'passkey') => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/**
+ * @experimental Preview — `methods` reads the JWT's `linked_methods` claim (live), but `link()` and
+ * `unlink()` are not yet wired to the network in this release; see the return type's per-field notes.
+ */
 declare function useLinkedAccounts(): UseLinkedAccountsResult;
 declare function useTranslation(): {
     t: TranslationFn;
@@ -263,12 +274,14 @@ interface UseBrandingReturn {
 declare function useBranding(): UseBrandingReturn;
 interface UseAnonymousSigninResult {
     isLoaded: boolean;
+    /** @experimental Preview — always resolves `{ status: 'error' }` in the current release; no network call is made. */
     signInAnonymously: (options?: {
         publicMetadata?: Record<string, unknown>;
     }) => Promise<{
         status: 'complete' | 'error';
     }>;
 }
+/** @experimental Preview — `signInAnonymously()` is not yet wired to the network in this release; see the return type's field note. */
 declare function useAnonymousSignin(): UseAnonymousSigninResult;
 interface BaasPlanPublicItem {
     id: string;
@@ -354,15 +367,19 @@ interface FeatureProps {
 declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
 
 /**
- * `<SignIn />` — RN port.
+ * `<SignIn />` — RN port. **Preview:** `@rakomi/react-native` is a pre-1.0 preview package — see the
+ * package README for the full "what's wired today" boundary.
  *
  * Renders a sign-in flow using ONLY RN primitives (`<View>`, `<Text>`,
  * `<TextInput>`, `<Pressable>`) — no HTML. Supports:
- * - Password (direct) sign-in.
  * - Social provider list (Google, GitHub, …) via `startSocialSignIn`.
  * - MFA TOTP code entry view (`keyboardType="number-pad"`,
  * `textContentType="oneTimeCode"`, `autoComplete="sms-otp"`).
  *
+ * There is no email/password field in this component — direct email+password sign-in is not wired in
+ * the current release. Use `useRegister()` for account creation, or one of the other working sign-in
+ * paths (magic link, email OTP, passkeys).
+ *
  * Accessibility:
  * - Every interactive element has `accessibilityLabel` + `accessibilityRole`.
  * - i18n keys come from `useRakomiContext.translate`.
@@ -370,11 +387,16 @@ declare function Feature({ flag, children, fallback }: FeatureProps): ReactNode;
  */
 
 interface SignInProps {
-    /** Authorization endpoint, default `${baseUrl}/oauth/authorize`. */
+    /**
+     * Full authorization-endpoint URL to open the system browser to. Default: resolved via OIDC
+     * discovery against `baseUrl` (cached, with a host-naming fallback) — see `useRakomiContext()`'s
+     * `authorizationEndpointCache`. A bare `${baseUrl}/oauth/authorize` is NOT a valid default: that
+     * path on the API host returns JSON, not the hosted login UI.
+     */
     authorizationEndpoint?: string;
-    /** Token endpoint, default `${baseUrl}/v1/auth/oauth/callback`. */
+    /** RFC 6749 §3.2 token endpoint used for the PKCE code→token exchange, default `${baseUrl}/oauth/token`. */
     tokenEndpoint?: string;
-    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/totp/verify`. */
+    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/verify-login`. */
     totpVerifyEndpoint?: string;
     /** Social providers to render. Default: ['google']. */
     providers?: string[];
@@ -424,8 +446,8 @@ declare function UserButton(props: UserButtonProps): ReactNode;
 /**
  * `<UserProfile />` — RN port (PREVIEW).
  *
- * Marked `'preview'` until 0.2.0; on first mount in `__DEV__` builds we log a
- * warning so consumers don't accidentally ship it to production.
+ * In preview — on first mount in `__DEV__` builds we log a warning so consumers don't accidentally
+ * ship it to production ahead of graduation.
  */
 
 interface UserProfileProps {

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createContext, useMemo, useReducer, useRef, useEffect, useState, useCallback, useContext } from 'react';
-import { EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
-export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createTranslator, decodeJwtPayload, decodeSession, decodeUser, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
+import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
+export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { jwtVerify } from 'jose';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
 
@@ -1012,6 +1012,21 @@ function RakomiProvider(props) {
     return Object.freeze(built);
   }, [props.nativeAdapter, props.tokenCache]);
   const http = useMemo(() => createRnHttpClient({ baseUrl: props.baseUrl }), [props.baseUrl]);
+  const authorizationEndpointCache = useMemo(
+    () => createAuthorizationEndpointCache({
+      fetchDiscoveryDocument: async () => {
+        const response = await http.fetch("/.well-known/openid-configuration", {
+          method: "GET",
+          headers: { Accept: "application/json" }
+        });
+        if (!response.ok) {
+          throw new Error(`discovery fetch failed: HTTP ${response.status}`);
+        }
+        return response.json();
+      }
+    }),
+    [http]
+  );
   const events = useMemo(() => new EventLog(props.onEvent), [props.onEvent]);
   const [snapshot, dispatch] = useReducer(reduce, INITIAL_SNAPSHOT);
   const passkeyCeremonyLock = useRef(createCeremonyLock()).current;
@@ -1147,6 +1162,7 @@ function RakomiProvider(props) {
       redirectUri: props.redirectUri,
       adapter,
       http,
+      authorizationEndpointCache,
       snapshot,
       state: snapshot.state,
       isSignedIn: isSignedIn(snapshot),
@@ -1162,7 +1178,7 @@ function RakomiProvider(props) {
       beginAuthFlow,
       dpopSession
     }),
-    [adapter, http, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession, passkeyCeremonyLock]
+    [adapter, http, authorizationEndpointCache, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession, passkeyCeremonyLock]
   );
   return /* @__PURE__ */ jsx(RakomiContext.Provider, { value, children: props.children });
 }
@@ -1619,14 +1635,24 @@ function SignIn(props) {
   const [step, setStep] = useState({ kind: "methods" });
   const [code, setCode] = useState("");
   const [busy, setBusy] = useState(false);
-  const tokenEndpoint = props.tokenEndpoint ?? "/v1/auth/oauth/callback";
-  const authorizationEndpoint = props.authorizationEndpoint ?? "/oauth/authorize";
-  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/totp/verify";
+  const tokenEndpoint = props.tokenEndpoint ?? "/oauth/token";
+  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/verify-login";
   const providers = props.providers ?? ["google"];
   async function onProviderPress(provider) {
     if (busy) return;
     setBusy(true);
     ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { provider } });
+    let authorizationEndpoint = props.authorizationEndpoint;
+    if (!authorizationEndpoint) {
+      const resolved = await ctx.authorizationEndpointCache.resolve(ctx.baseUrl);
+      if (!resolved.ok) {
+        ctx.events.push({ type: "sign_in_failed", severity: "warning", error: resolved.error });
+        setStep({ kind: "error", error: resolved.error });
+        setBusy(false);
+        return;
+      }
+      authorizationEndpoint = resolved.authorizationEndpoint;
+    }
     const outcome = await startSocialSignIn({
       adapter: ctx.adapter,
       http: ctx.http,
@@ -1832,7 +1858,7 @@ function UserButton(props) {
 function UserProfile(props) {
   useEffect(() => {
     if (typeof __DEV__ !== "undefined" && __DEV__) {
-      console.warn("[@rakomi/react-native] <UserProfile /> is in preview until 0.2.0 \u2014 feedback welcome.");
+      console.warn("[@rakomi/react-native] <UserProfile /> is in preview \u2014 feedback welcome.");
     }
   }, []);
   const ctx = useRakomiContext();
@@ -2659,7 +2685,7 @@ function useMfa() {
   const ctx = useRakomiContext();
   return {
     verifyTotp: async (challengeToken, code, endpoint) => {
-      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/totp/verify`;
+      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/verify-login`;
       const result = await verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
       if (result.ok) {
         const nonce = await ctx.beginAuthFlow();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "React Native / Expo SDK for Rakomi authentication.",
   "keywords": [
     "rakomi",
@@ -83,11 +83,11 @@
     }
   },
   "devDependencies": {
-    "@rakomi/react": "0.2.0"
+    "@rakomi/react": "0.3.1"
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@rakomi/sdk-core": "^0.2.0"
+    "@rakomi/sdk-core": "^0.3.1"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",

package/sbom.cdx.json

@@ -20,16 +20,16 @@
           "type": "application",
           "group": "rakomi",
           "name": "generate-sbom",
-          "version": "sha256:9472206f8105"
+          "version": "sha256:ffabbf3f1638"
         }
       ]
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.2.0",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.3.1",
       "name": "@rakomi/react-native",
-      "version": "0.2.0",
-      "purl": "pkg:npm/%40rakomi%2Freact-native@0.2.0",
+      "version": "0.3.1",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.3.1",
       "licenses": [
         {
           "license": {
@@ -42,10 +42,10 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.2.0",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.3.1",
       "name": "@rakomi/sdk-core",
-      "version": "0.2.0",
-      "purl": "pkg:npm/@rakomi/sdk-core@0.2.0",
+      "version": "0.3.1",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.3.1",
       "licenses": [
         {
           "license": {
@@ -56,10 +56,10 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/jose@6.2.9",
+      "bom-ref": "pkg:npm/jose@6.2.10",
       "name": "jose",
-      "version": "6.2.9",
-      "purl": "pkg:npm/jose@6.2.9",
+      "version": "6.2.10",
+      "purl": "pkg:npm/jose@6.2.10",
       "licenses": [
         {
           "license": {