@rakomi/react-native 0.3.0 → 0.4.0

package/README.md

@@ -24,6 +24,16 @@ React Native / Expo SDK for [Rakomi](https://rakomi.com) — EU-native auth-as-a
 > Token-manager runtime, JWKS verification, social-provider deep-link auto-handler, a bare-RN adapter
 > example, and a demo app land in subsequent 0.x releases.
 
+## Ask your agent
+
+Add the Rakomi MCP server to your coding agent, then ask it directly:
+
+```sh
+claude mcp add --transport http rakomi https://mcp.rakomi.com/mcp
+```
+
+"List the AI agents connected to my Rakomi tenant."
+
 ## Install
 
 ```sh

package/SECURITY.md

@@ -9,8 +9,8 @@ While these packages remain pre-1.0 (`0.x`), they carry **no stability or suppor
 (SemVer 2.0.0 §4); the latest `0.x` line receives security updates on a best-effort basis.
 
 From version **1.0** onward, Rakomi maintains the current (N) and previous (N-1) MAJOR in parallel, with N-1 receiving
-security-only fixes. The CRA support period for each MAJOR is determined in accordance with
-**CRA Art. 13(8)** — at least five years, or the product's expected use time where shorter. The authoritative, machine-readable support windows are published at
+security-only fixes. For each MAJOR version of the Rakomi SDKs, CRE8EVE commits to a CRA support period of
+**at least five years (60 months)**, meeting the support-period requirement of **CRA Art. 13(8)**. The authoritative, machine-readable support windows are published at
 [`https://api.rakomi.com/.well-known/sdk-support.json`](https://api.rakomi.com/.well-known/sdk-support.json)
 and rendered for humans on the [SDK Support & Lifecycle page](https://rakomi.com/sdk-support). This
 document points at that single source rather than re-typing dated rows.

package/THIRD-PARTY-NOTICES

@@ -1,6 +1,6 @@
 THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 
-For the npm package: @rakomi/react-native@0.3.0
+For the npm package: @rakomi/react-native@0.4.0
 
 This package's published bundle (`dist/`) INLINES the third-party components listed below.
 Their copyright and permission notices are reproduced verbatim, as required by their licenses

package/dist/index.cjs

@@ -1075,8 +1075,12 @@ function RakomiProvider(props) {
       }
     });
   }, [adapter, http, props.publishableKey, props.tenantId, props.baseUrl, props.tokenEndpoint, props.biometric, props.biometricStrict, props.biometricPrompt, events, dpopSession]);
+  const restoreStarted = react.useRef(false);
   react.useEffect(() => {
-    void runtime.restore();
+    if (!restoreStarted.current) {
+      restoreStarted.current = true;
+      void runtime.restore();
+    }
     return () => runtime.destroy();
   }, [runtime]);
   const debounceTimer = react.useRef(null);
@@ -1636,8 +1640,8 @@ function SignIn(props) {
   const [step, setStep] = react.useState({ kind: "methods" });
   const [code, setCode] = react.useState("");
   const [busy, setBusy] = react.useState(false);
-  const tokenEndpoint = props.tokenEndpoint ?? "/v1/auth/oauth/callback";
-  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/totp/verify";
+  const tokenEndpoint = props.tokenEndpoint ?? "/oauth/token";
+  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/verify-login";
   const providers = props.providers ?? ["google"];
   async function onProviderPress(provider) {
     if (busy) return;
@@ -1679,6 +1683,7 @@ function SignIn(props) {
     const result = await sdkCore.verifyTotp({
       http: ctx.http,
       endpoint: totpVerifyEndpoint,
+      apiKey: ctx.publishableKey,
       challengeToken: step.challengeToken,
       code
     });
@@ -1760,11 +1765,20 @@ function SignUp(props) {
     try {
       const response = await ctx.http.fetch(props.registerEndpoint ?? "/v1/auth/register", {
         method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        headers: { "Content-Type": "application/json", Accept: "application/json", "X-API-Key": ctx.publishableKey },
         body: JSON.stringify({ email, password, returnTo })
       });
       if (!response.ok) {
-        setStep({ kind: "error", error: { code: "SIGN_IN_FAILED", message: `Register failed (${response.status})` } });
+        let parsed = {};
+        try {
+          parsed = await response.json();
+        } catch {
+        }
+        const requestId = sdkCore.extractRequestId(parsed);
+        setStep({
+          kind: "error",
+          error: { code: "SIGN_IN_FAILED", message: parsed.detail ?? `Register failed (${response.status})`, ...requestId && { requestId } }
+        });
       } else {
         setStep({ kind: "verification_required" });
       }
@@ -2686,8 +2700,8 @@ function useMfa() {
   const ctx = useRakomiContext();
   return {
     verifyTotp: async (challengeToken, code, endpoint) => {
-      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/totp/verify`;
-      const result = await sdkCore.verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
+      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/verify-login`;
+      const result = await sdkCore.verifyTotp({ http: ctx.http, endpoint: url, apiKey: ctx.publishableKey, challengeToken, code });
       if (result.ok) {
         const nonce = await ctx.beginAuthFlow();
         await ctx.submitOAuthTokens({

package/dist/index.d.cts

@@ -394,9 +394,9 @@ interface SignInProps {
      * path on the API host returns JSON, not the hosted login UI.
      */
     authorizationEndpoint?: string;
-    /** Token endpoint, default `${baseUrl}/v1/auth/oauth/callback`. */
+    /** RFC 6749 §3.2 token endpoint used for the PKCE code→token exchange, default `${baseUrl}/oauth/token`. */
     tokenEndpoint?: string;
-    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/totp/verify`. */
+    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/verify-login`. */
     totpVerifyEndpoint?: string;
     /** Social providers to render. Default: ['google']. */
     providers?: string[];

package/dist/index.d.ts

@@ -394,9 +394,9 @@ interface SignInProps {
      * path on the API host returns JSON, not the hosted login UI.
      */
     authorizationEndpoint?: string;
-    /** Token endpoint, default `${baseUrl}/v1/auth/oauth/callback`. */
+    /** RFC 6749 §3.2 token endpoint used for the PKCE code→token exchange, default `${baseUrl}/oauth/token`. */
     tokenEndpoint?: string;
-    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/totp/verify`. */
+    /** MFA TOTP verify endpoint, default `${baseUrl}/v1/auth/mfa/verify-login`. */
     totpVerifyEndpoint?: string;
     /** Social providers to render. Default: ['google']. */
     providers?: string[];

package/dist/index.js

@@ -1,5 +1,5 @@
 import { createContext, useMemo, useReducer, useRef, useEffect, useState, useCallback, useContext } from 'react';
-import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
+import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, extractRequestId, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
 export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { jwtVerify } from 'jose';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
@@ -1074,8 +1074,12 @@ function RakomiProvider(props) {
       }
     });
   }, [adapter, http, props.publishableKey, props.tenantId, props.baseUrl, props.tokenEndpoint, props.biometric, props.biometricStrict, props.biometricPrompt, events, dpopSession]);
+  const restoreStarted = useRef(false);
   useEffect(() => {
-    void runtime.restore();
+    if (!restoreStarted.current) {
+      restoreStarted.current = true;
+      void runtime.restore();
+    }
     return () => runtime.destroy();
   }, [runtime]);
   const debounceTimer = useRef(null);
@@ -1635,8 +1639,8 @@ function SignIn(props) {
   const [step, setStep] = useState({ kind: "methods" });
   const [code, setCode] = useState("");
   const [busy, setBusy] = useState(false);
-  const tokenEndpoint = props.tokenEndpoint ?? "/v1/auth/oauth/callback";
-  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/totp/verify";
+  const tokenEndpoint = props.tokenEndpoint ?? "/oauth/token";
+  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/verify-login";
   const providers = props.providers ?? ["google"];
   async function onProviderPress(provider) {
     if (busy) return;
@@ -1678,6 +1682,7 @@ function SignIn(props) {
     const result = await verifyTotp({
       http: ctx.http,
       endpoint: totpVerifyEndpoint,
+      apiKey: ctx.publishableKey,
       challengeToken: step.challengeToken,
       code
     });
@@ -1759,11 +1764,20 @@ function SignUp(props) {
     try {
       const response = await ctx.http.fetch(props.registerEndpoint ?? "/v1/auth/register", {
         method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        headers: { "Content-Type": "application/json", Accept: "application/json", "X-API-Key": ctx.publishableKey },
         body: JSON.stringify({ email, password, returnTo })
       });
       if (!response.ok) {
-        setStep({ kind: "error", error: { code: "SIGN_IN_FAILED", message: `Register failed (${response.status})` } });
+        let parsed = {};
+        try {
+          parsed = await response.json();
+        } catch {
+        }
+        const requestId = extractRequestId(parsed);
+        setStep({
+          kind: "error",
+          error: { code: "SIGN_IN_FAILED", message: parsed.detail ?? `Register failed (${response.status})`, ...requestId && { requestId } }
+        });
       } else {
         setStep({ kind: "verification_required" });
       }
@@ -2685,8 +2699,8 @@ function useMfa() {
   const ctx = useRakomiContext();
   return {
     verifyTotp: async (challengeToken, code, endpoint) => {
-      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/totp/verify`;
-      const result = await verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
+      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/verify-login`;
+      const result = await verifyTotp({ http: ctx.http, endpoint: url, apiKey: ctx.publishableKey, challengeToken, code });
       if (result.ok) {
         const nonce = await ctx.beginAuthFlow();
         await ctx.submitOAuthTokens({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "React Native / Expo SDK for Rakomi authentication.",
   "keywords": [
     "rakomi",
@@ -83,16 +83,16 @@
     }
   },
   "devDependencies": {
-    "@rakomi/react": "0.3.0"
+    "@rakomi/react": "0.4.0"
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@rakomi/sdk-core": "^0.3.0"
+    "@rakomi/sdk-core": "^0.4.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json",
     "lint": "eslint src/ test/ --max-warnings=0",
-    "test": "vitest run"
+    "test": "node ../../scripts/ci/vitest-fork-crash-retry.mjs --results ./test-results.json -- vitest run"
   }
 }

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.3.0",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.4.0",
       "name": "@rakomi/react-native",
-      "version": "0.3.0",
-      "purl": "pkg:npm/%40rakomi%2Freact-native@0.3.0",
+      "version": "0.4.0",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.4.0",
       "licenses": [
         {
           "license": {
@@ -42,10 +42,10 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.3.0",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.4.0",
       "name": "@rakomi/sdk-core",
-      "version": "0.3.0",
-      "purl": "pkg:npm/@rakomi/sdk-core@0.3.0",
+      "version": "0.4.0",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.4.0",
       "licenses": [
         {
           "license": {
@@ -56,10 +56,10 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/jose@6.2.10",
+      "bom-ref": "pkg:npm/jose@6.2.12",
       "name": "jose",
-      "version": "6.2.10",
-      "purl": "pkg:npm/jose@6.2.10",
+      "version": "6.2.12",
+      "purl": "pkg:npm/jose@6.2.12",
       "licenses": [
         {
           "license": {