@rakomi/react-native 0.3.1 → 0.5.0

package/README.md

@@ -24,6 +24,16 @@ React Native / Expo SDK for [Rakomi](https://rakomi.com) — EU-native auth-as-a
 > Token-manager runtime, JWKS verification, social-provider deep-link auto-handler, a bare-RN adapter
 > example, and a demo app land in subsequent 0.x releases.
 
+## Ask your agent
+
+Add the Rakomi MCP server to your coding agent, then ask it directly:
+
+```sh
+claude mcp add --transport http rakomi https://mcp.rakomi.com/mcp
+```
+
+"List the AI agents connected to my Rakomi tenant."
+
 ## Install
 
 ```sh

package/SECURITY.md

@@ -9,8 +9,8 @@ While these packages remain pre-1.0 (`0.x`), they carry **no stability or suppor
 (SemVer 2.0.0 §4); the latest `0.x` line receives security updates on a best-effort basis.
 
 From version **1.0** onward, Rakomi maintains the current (N) and previous (N-1) MAJOR in parallel, with N-1 receiving
-security-only fixes. The CRA support period for each MAJOR is determined in accordance with
-**CRA Art. 13(8)** — at least five years, or the product's expected use time where shorter. The authoritative, machine-readable support windows are published at
+security-only fixes. For each MAJOR version of the Rakomi SDKs, CRE8EVE commits to a CRA support period of
+**at least five years (60 months)**, meeting the support-period requirement of **CRA Art. 13(8)**. The authoritative, machine-readable support windows are published at
 [`https://api.rakomi.com/.well-known/sdk-support.json`](https://api.rakomi.com/.well-known/sdk-support.json)
 and rendered for humans on the [SDK Support & Lifecycle page](https://rakomi.com/sdk-support). This
 document points at that single source rather than re-typing dated rows.

package/THIRD-PARTY-NOTICES

@@ -1,6 +1,6 @@
 THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 
-For the npm package: @rakomi/react-native@0.3.1
+For the npm package: @rakomi/react-native@0.5.0
 
 This package's published bundle (`dist/`) INLINES the third-party components listed below.
 Their copyright and permission notices are reproduced verbatim, as required by their licenses

package/dist/index.cjs

@@ -299,8 +299,19 @@ function deriveDefaultJwksUri(tokenEndpoint) {
 }
 var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
 var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
-function deriveDefaultIssuer(_tokenEndpoint) {
-  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+function deriveDefaultIssuer(options) {
+  if (options.baseUrl) {
+    try {
+      new URL(options.baseUrl);
+      return sdkCore.resolveExpectedIssuer(options.baseUrl);
+    } catch {
+    }
+  }
+  try {
+    return new URL(options.tokenEndpoint).origin;
+  } catch {
+    return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+  }
 }
 var REFRESH_TOKEN_PREFIX = "v1:";
 var REFRESH_BUFFER_SECONDS = 60;
@@ -360,7 +371,7 @@ var TokenRuntime = class _TokenRuntime {
     this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
     this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
     this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
-    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer({ baseUrl: options.baseUrl, tokenEndpoint: options.tokenEndpoint });
     this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
   }
   /**
@@ -545,11 +556,32 @@ var TokenRuntime = class _TokenRuntime {
     this.storageKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
     return this.storageKeyResolved;
   }
+  /**
+   * The persisted JWKS-cache slot, scoped per-host in addition to per-tenant.
+   *
+   * `deriveTenantStorageKey`'s own domain separation is tenant-only, which was correct while every
+   * tenant verified against ONE platform-wide JWKS document. Now that a tenant's issuer host can
+   * change across the app's lifetime (a custom domain bound after this SDK version first shipped, or
+   * simply a dev pointed at a different host between builds), a slot keyed by tenant alone would
+   * silently reuse a PREVIOUS host's persisted document as this instance's "fresh" cache on cold
+   * start — cross-host reuse this offline-verification path must never do. The host segment is not
+   * secret (it is the caller's own `jwksUri` configuration), so a plain suffix is enough; this only
+   * needs to be a stable, DIFFERENT key per host, not a cryptographically-opaque one.
+   */
   async resolveJwksKey() {
     if (this.jwksKeyResolved) return this.jwksKeyResolved;
-    this.jwksKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const base = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const host = this.jwksHost();
+    this.jwksKeyResolved = host ? `${base}.h.${host}` : base;
     return this.jwksKeyResolved;
   }
+  jwksHost() {
+    try {
+      return new URL(this.jwksUri).hostname;
+    } catch {
+      return null;
+    }
+  }
   async getOrCreateJwksCache() {
     if (this.jwksCache) return this.jwksCache;
     const key = await this.resolveJwksKey();
@@ -1051,6 +1083,7 @@ function RakomiProvider(props) {
       clientId: props.publishableKey,
       tenantId: props.tenantId ?? props.publishableKey,
       tokenEndpoint,
+      baseUrl: props.baseUrl,
       storage: adapter.storage,
       http,
       crypto: adapter.crypto,
@@ -1075,8 +1108,12 @@ function RakomiProvider(props) {
       }
     });
   }, [adapter, http, props.publishableKey, props.tenantId, props.baseUrl, props.tokenEndpoint, props.biometric, props.biometricStrict, props.biometricPrompt, events, dpopSession]);
+  const restoreStarted = react.useRef(false);
   react.useEffect(() => {
-    void runtime.restore();
+    if (!restoreStarted.current) {
+      restoreStarted.current = true;
+      void runtime.restore();
+    }
     return () => runtime.destroy();
   }, [runtime]);
   const debounceTimer = react.useRef(null);
@@ -1679,6 +1716,7 @@ function SignIn(props) {
     const result = await sdkCore.verifyTotp({
       http: ctx.http,
       endpoint: totpVerifyEndpoint,
+      apiKey: ctx.publishableKey,
       challengeToken: step.challengeToken,
       code
     });
@@ -1760,11 +1798,20 @@ function SignUp(props) {
     try {
       const response = await ctx.http.fetch(props.registerEndpoint ?? "/v1/auth/register", {
         method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        headers: { "Content-Type": "application/json", Accept: "application/json", "X-API-Key": ctx.publishableKey },
         body: JSON.stringify({ email, password, returnTo })
       });
       if (!response.ok) {
-        setStep({ kind: "error", error: { code: "SIGN_IN_FAILED", message: `Register failed (${response.status})` } });
+        let parsed = {};
+        try {
+          parsed = await response.json();
+        } catch {
+        }
+        const requestId = sdkCore.extractRequestId(parsed);
+        setStep({
+          kind: "error",
+          error: { code: "SIGN_IN_FAILED", message: parsed.detail ?? `Register failed (${response.status})`, ...requestId && { requestId } }
+        });
       } else {
         setStep({ kind: "verification_required" });
       }
@@ -2687,7 +2734,7 @@ function useMfa() {
   return {
     verifyTotp: async (challengeToken, code, endpoint) => {
       const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/verify-login`;
-      const result = await sdkCore.verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
+      const result = await sdkCore.verifyTotp({ http: ctx.http, endpoint: url, apiKey: ctx.publishableKey, challengeToken, code });
       if (result.ok) {
         const nonce = await ctx.beginAuthFlow();
         await ctx.submitOAuthTokens({

package/dist/index.d.cts

@@ -495,7 +495,7 @@ declare const MAX_WEBHOOK_TOLERANCE = 600;
 /** Portable webhook-verify error class — the value IS the cross-SDK conformance `error_class`. */
 type WebhookVerifyErrorClass = 'invalid_signature' | 'invalid_secret' | 'missing_header' | 'timestamp_too_old' | 'timestamp_too_new' | 'invalid_body';
 /** Open-set publisher event type (the known catalog widened with the base string for forward-compat). */
-type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed';
+type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed' | 'app.version_pending_review' | 'app.pending_version_approved' | 'app.pending_version_rejected';
 type PublisherWebhookEventType = PublisherEventType | (string & {});
 /** The flat publisher-webhook delivery body. Unknown fields tolerated (forward-compat). No end-user PII. */
 interface PublisherWebhookEvent {

package/dist/index.d.ts

@@ -495,7 +495,7 @@ declare const MAX_WEBHOOK_TOLERANCE = 600;
 /** Portable webhook-verify error class — the value IS the cross-SDK conformance `error_class`. */
 type WebhookVerifyErrorClass = 'invalid_signature' | 'invalid_secret' | 'missing_header' | 'timestamp_too_old' | 'timestamp_too_new' | 'invalid_body';
 /** Open-set publisher event type (the known catalog widened with the base string for forward-compat). */
-type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed';
+type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed' | 'app.version_pending_review' | 'app.pending_version_approved' | 'app.pending_version_rejected';
 type PublisherWebhookEventType = PublisherEventType | (string & {});
 /** The flat publisher-webhook delivery body. Unknown fields tolerated (forward-compat). No end-user PII. */
 interface PublisherWebhookEvent {

package/dist/index.js

@@ -1,5 +1,5 @@
 import { createContext, useMemo, useReducer, useRef, useEffect, useState, useCallback, useContext } from 'react';
-import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
+import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, extractRequestId, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError, resolveExpectedIssuer } from '@rakomi/sdk-core';
 export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { jwtVerify } from 'jose';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
@@ -298,8 +298,19 @@ function deriveDefaultJwksUri(tokenEndpoint) {
 }
 var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
 var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
-function deriveDefaultIssuer(_tokenEndpoint) {
-  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+function deriveDefaultIssuer(options) {
+  if (options.baseUrl) {
+    try {
+      new URL(options.baseUrl);
+      return resolveExpectedIssuer(options.baseUrl);
+    } catch {
+    }
+  }
+  try {
+    return new URL(options.tokenEndpoint).origin;
+  } catch {
+    return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+  }
 }
 var REFRESH_TOKEN_PREFIX = "v1:";
 var REFRESH_BUFFER_SECONDS = 60;
@@ -359,7 +370,7 @@ var TokenRuntime = class _TokenRuntime {
     this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
     this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
     this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
-    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer({ baseUrl: options.baseUrl, tokenEndpoint: options.tokenEndpoint });
     this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
   }
   /**
@@ -544,11 +555,32 @@ var TokenRuntime = class _TokenRuntime {
     this.storageKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
     return this.storageKeyResolved;
   }
+  /**
+   * The persisted JWKS-cache slot, scoped per-host in addition to per-tenant.
+   *
+   * `deriveTenantStorageKey`'s own domain separation is tenant-only, which was correct while every
+   * tenant verified against ONE platform-wide JWKS document. Now that a tenant's issuer host can
+   * change across the app's lifetime (a custom domain bound after this SDK version first shipped, or
+   * simply a dev pointed at a different host between builds), a slot keyed by tenant alone would
+   * silently reuse a PREVIOUS host's persisted document as this instance's "fresh" cache on cold
+   * start — cross-host reuse this offline-verification path must never do. The host segment is not
+   * secret (it is the caller's own `jwksUri` configuration), so a plain suffix is enough; this only
+   * needs to be a stable, DIFFERENT key per host, not a cryptographically-opaque one.
+   */
   async resolveJwksKey() {
     if (this.jwksKeyResolved) return this.jwksKeyResolved;
-    this.jwksKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const base = await deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const host = this.jwksHost();
+    this.jwksKeyResolved = host ? `${base}.h.${host}` : base;
     return this.jwksKeyResolved;
   }
+  jwksHost() {
+    try {
+      return new URL(this.jwksUri).hostname;
+    } catch {
+      return null;
+    }
+  }
   async getOrCreateJwksCache() {
     if (this.jwksCache) return this.jwksCache;
     const key = await this.resolveJwksKey();
@@ -1050,6 +1082,7 @@ function RakomiProvider(props) {
       clientId: props.publishableKey,
       tenantId: props.tenantId ?? props.publishableKey,
       tokenEndpoint,
+      baseUrl: props.baseUrl,
       storage: adapter.storage,
       http,
       crypto: adapter.crypto,
@@ -1074,8 +1107,12 @@ function RakomiProvider(props) {
       }
     });
   }, [adapter, http, props.publishableKey, props.tenantId, props.baseUrl, props.tokenEndpoint, props.biometric, props.biometricStrict, props.biometricPrompt, events, dpopSession]);
+  const restoreStarted = useRef(false);
   useEffect(() => {
-    void runtime.restore();
+    if (!restoreStarted.current) {
+      restoreStarted.current = true;
+      void runtime.restore();
+    }
     return () => runtime.destroy();
   }, [runtime]);
   const debounceTimer = useRef(null);
@@ -1678,6 +1715,7 @@ function SignIn(props) {
     const result = await verifyTotp({
       http: ctx.http,
       endpoint: totpVerifyEndpoint,
+      apiKey: ctx.publishableKey,
       challengeToken: step.challengeToken,
       code
     });
@@ -1759,11 +1797,20 @@ function SignUp(props) {
     try {
       const response = await ctx.http.fetch(props.registerEndpoint ?? "/v1/auth/register", {
         method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        headers: { "Content-Type": "application/json", Accept: "application/json", "X-API-Key": ctx.publishableKey },
         body: JSON.stringify({ email, password, returnTo })
       });
       if (!response.ok) {
-        setStep({ kind: "error", error: { code: "SIGN_IN_FAILED", message: `Register failed (${response.status})` } });
+        let parsed = {};
+        try {
+          parsed = await response.json();
+        } catch {
+        }
+        const requestId = extractRequestId(parsed);
+        setStep({
+          kind: "error",
+          error: { code: "SIGN_IN_FAILED", message: parsed.detail ?? `Register failed (${response.status})`, ...requestId && { requestId } }
+        });
       } else {
         setStep({ kind: "verification_required" });
       }
@@ -2686,7 +2733,7 @@ function useMfa() {
   return {
     verifyTotp: async (challengeToken, code, endpoint) => {
       const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/verify-login`;
-      const result = await verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
+      const result = await verifyTotp({ http: ctx.http, endpoint: url, apiKey: ctx.publishableKey, challengeToken, code });
       if (result.ok) {
         const nonce = await ctx.beginAuthFlow();
         await ctx.submitOAuthTokens({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "React Native / Expo SDK for Rakomi authentication.",
   "keywords": [
     "rakomi",
@@ -83,16 +83,16 @@
     }
   },
   "devDependencies": {
-    "@rakomi/react": "0.3.1"
+    "@rakomi/react": "0.5.0"
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@rakomi/sdk-core": "^0.3.1"
+    "@rakomi/sdk-core": "^0.5.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json",
     "lint": "eslint src/ test/ --max-warnings=0",
-    "test": "vitest run"
+    "test": "node ../../scripts/assert-not-story-agent-worktree.mjs test && node ../../scripts/ci/vitest-fork-crash-retry.mjs --results ./test-results.json -- vitest run"
   }
 }

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.3.1",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.5.0",
       "name": "@rakomi/react-native",
-      "version": "0.3.1",
-      "purl": "pkg:npm/%40rakomi%2Freact-native@0.3.1",
+      "version": "0.5.0",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.5.0",
       "licenses": [
         {
           "license": {
@@ -42,10 +42,10 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.3.1",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.5.0",
       "name": "@rakomi/sdk-core",
-      "version": "0.3.1",
-      "purl": "pkg:npm/@rakomi/sdk-core@0.3.1",
+      "version": "0.5.0",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.5.0",
       "licenses": [
         {
           "license": {
@@ -56,10 +56,10 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/jose@6.2.10",
+      "bom-ref": "pkg:npm/jose@6.2.12",
       "name": "jose",
-      "version": "6.2.10",
-      "purl": "pkg:npm/jose@6.2.10",
+      "version": "6.2.12",
+      "purl": "pkg:npm/jose@6.2.12",
       "licenses": [
         {
           "license": {