@rakomi/react-native 0.4.0 → 0.5.0

package/THIRD-PARTY-NOTICES

@@ -1,6 +1,6 @@
 THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 
-For the npm package: @rakomi/react-native@0.4.0
+For the npm package: @rakomi/react-native@0.5.0
 
 This package's published bundle (`dist/`) INLINES the third-party components listed below.
 Their copyright and permission notices are reproduced verbatim, as required by their licenses

package/dist/index.cjs

@@ -299,8 +299,19 @@ function deriveDefaultJwksUri(tokenEndpoint) {
 }
 var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
 var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
-function deriveDefaultIssuer(_tokenEndpoint) {
-  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+function deriveDefaultIssuer(options) {
+  if (options.baseUrl) {
+    try {
+      new URL(options.baseUrl);
+      return sdkCore.resolveExpectedIssuer(options.baseUrl);
+    } catch {
+    }
+  }
+  try {
+    return new URL(options.tokenEndpoint).origin;
+  } catch {
+    return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+  }
 }
 var REFRESH_TOKEN_PREFIX = "v1:";
 var REFRESH_BUFFER_SECONDS = 60;
@@ -360,7 +371,7 @@ var TokenRuntime = class _TokenRuntime {
     this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
     this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
     this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
-    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer({ baseUrl: options.baseUrl, tokenEndpoint: options.tokenEndpoint });
     this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
   }
   /**
@@ -545,11 +556,32 @@ var TokenRuntime = class _TokenRuntime {
     this.storageKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
     return this.storageKeyResolved;
   }
+  /**
+   * The persisted JWKS-cache slot, scoped per-host in addition to per-tenant.
+   *
+   * `deriveTenantStorageKey`'s own domain separation is tenant-only, which was correct while every
+   * tenant verified against ONE platform-wide JWKS document. Now that a tenant's issuer host can
+   * change across the app's lifetime (a custom domain bound after this SDK version first shipped, or
+   * simply a dev pointed at a different host between builds), a slot keyed by tenant alone would
+   * silently reuse a PREVIOUS host's persisted document as this instance's "fresh" cache on cold
+   * start — cross-host reuse this offline-verification path must never do. The host segment is not
+   * secret (it is the caller's own `jwksUri` configuration), so a plain suffix is enough; this only
+   * needs to be a stable, DIFFERENT key per host, not a cryptographically-opaque one.
+   */
   async resolveJwksKey() {
     if (this.jwksKeyResolved) return this.jwksKeyResolved;
-    this.jwksKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const base = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const host = this.jwksHost();
+    this.jwksKeyResolved = host ? `${base}.h.${host}` : base;
     return this.jwksKeyResolved;
   }
+  jwksHost() {
+    try {
+      return new URL(this.jwksUri).hostname;
+    } catch {
+      return null;
+    }
+  }
   async getOrCreateJwksCache() {
     if (this.jwksCache) return this.jwksCache;
     const key = await this.resolveJwksKey();
@@ -1051,6 +1083,7 @@ function RakomiProvider(props) {
       clientId: props.publishableKey,
       tenantId: props.tenantId ?? props.publishableKey,
       tokenEndpoint,
+      baseUrl: props.baseUrl,
       storage: adapter.storage,
       http,
       crypto: adapter.crypto,

package/dist/index.d.cts

@@ -495,7 +495,7 @@ declare const MAX_WEBHOOK_TOLERANCE = 600;
 /** Portable webhook-verify error class — the value IS the cross-SDK conformance `error_class`. */
 type WebhookVerifyErrorClass = 'invalid_signature' | 'invalid_secret' | 'missing_header' | 'timestamp_too_old' | 'timestamp_too_new' | 'invalid_body';
 /** Open-set publisher event type (the known catalog widened with the base string for forward-compat). */
-type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed';
+type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed' | 'app.version_pending_review' | 'app.pending_version_approved' | 'app.pending_version_rejected';
 type PublisherWebhookEventType = PublisherEventType | (string & {});
 /** The flat publisher-webhook delivery body. Unknown fields tolerated (forward-compat). No end-user PII. */
 interface PublisherWebhookEvent {

package/dist/index.d.ts

@@ -495,7 +495,7 @@ declare const MAX_WEBHOOK_TOLERANCE = 600;
 /** Portable webhook-verify error class — the value IS the cross-SDK conformance `error_class`. */
 type WebhookVerifyErrorClass = 'invalid_signature' | 'invalid_secret' | 'missing_header' | 'timestamp_too_old' | 'timestamp_too_new' | 'invalid_body';
 /** Open-set publisher event type (the known catalog widened with the base string for forward-compat). */
-type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed';
+type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed' | 'app.version_pending_review' | 'app.pending_version_approved' | 'app.pending_version_rejected';
 type PublisherWebhookEventType = PublisherEventType | (string & {});
 /** The flat publisher-webhook delivery body. Unknown fields tolerated (forward-compat). No end-user PII. */
 interface PublisherWebhookEvent {

package/dist/index.js

@@ -1,5 +1,5 @@
 import { createContext, useMemo, useReducer, useRef, useEffect, useState, useCallback, useContext } from 'react';
-import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, extractRequestId, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
+import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, extractRequestId, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError, resolveExpectedIssuer } from '@rakomi/sdk-core';
 export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { jwtVerify } from 'jose';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
@@ -298,8 +298,19 @@ function deriveDefaultJwksUri(tokenEndpoint) {
 }
 var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
 var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
-function deriveDefaultIssuer(_tokenEndpoint) {
-  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+function deriveDefaultIssuer(options) {
+  if (options.baseUrl) {
+    try {
+      new URL(options.baseUrl);
+      return resolveExpectedIssuer(options.baseUrl);
+    } catch {
+    }
+  }
+  try {
+    return new URL(options.tokenEndpoint).origin;
+  } catch {
+    return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+  }
 }
 var REFRESH_TOKEN_PREFIX = "v1:";
 var REFRESH_BUFFER_SECONDS = 60;
@@ -359,7 +370,7 @@ var TokenRuntime = class _TokenRuntime {
     this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
     this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
     this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
-    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer({ baseUrl: options.baseUrl, tokenEndpoint: options.tokenEndpoint });
     this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
   }
   /**
@@ -544,11 +555,32 @@ var TokenRuntime = class _TokenRuntime {
     this.storageKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
     return this.storageKeyResolved;
   }
+  /**
+   * The persisted JWKS-cache slot, scoped per-host in addition to per-tenant.
+   *
+   * `deriveTenantStorageKey`'s own domain separation is tenant-only, which was correct while every
+   * tenant verified against ONE platform-wide JWKS document. Now that a tenant's issuer host can
+   * change across the app's lifetime (a custom domain bound after this SDK version first shipped, or
+   * simply a dev pointed at a different host between builds), a slot keyed by tenant alone would
+   * silently reuse a PREVIOUS host's persisted document as this instance's "fresh" cache on cold
+   * start — cross-host reuse this offline-verification path must never do. The host segment is not
+   * secret (it is the caller's own `jwksUri` configuration), so a plain suffix is enough; this only
+   * needs to be a stable, DIFFERENT key per host, not a cryptographically-opaque one.
+   */
   async resolveJwksKey() {
     if (this.jwksKeyResolved) return this.jwksKeyResolved;
-    this.jwksKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const base = await deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const host = this.jwksHost();
+    this.jwksKeyResolved = host ? `${base}.h.${host}` : base;
     return this.jwksKeyResolved;
   }
+  jwksHost() {
+    try {
+      return new URL(this.jwksUri).hostname;
+    } catch {
+      return null;
+    }
+  }
   async getOrCreateJwksCache() {
     if (this.jwksCache) return this.jwksCache;
     const key = await this.resolveJwksKey();
@@ -1050,6 +1082,7 @@ function RakomiProvider(props) {
       clientId: props.publishableKey,
       tenantId: props.tenantId ?? props.publishableKey,
       tokenEndpoint,
+      baseUrl: props.baseUrl,
       storage: adapter.storage,
       http,
       crypto: adapter.crypto,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "React Native / Expo SDK for Rakomi authentication.",
   "keywords": [
     "rakomi",
@@ -83,16 +83,16 @@
     }
   },
   "devDependencies": {
-    "@rakomi/react": "0.4.0"
+    "@rakomi/react": "0.5.0"
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@rakomi/sdk-core": "^0.4.0"
+    "@rakomi/sdk-core": "^0.5.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json",
     "lint": "eslint src/ test/ --max-warnings=0",
-    "test": "node ../../scripts/ci/vitest-fork-crash-retry.mjs --results ./test-results.json -- vitest run"
+    "test": "node ../../scripts/assert-not-story-agent-worktree.mjs test && node ../../scripts/ci/vitest-fork-crash-retry.mjs --results ./test-results.json -- vitest run"
   }
 }

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.4.0",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.5.0",
       "name": "@rakomi/react-native",
-      "version": "0.4.0",
-      "purl": "pkg:npm/%40rakomi%2Freact-native@0.4.0",
+      "version": "0.5.0",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.5.0",
       "licenses": [
         {
           "license": {
@@ -42,10 +42,10 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.4.0",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.5.0",
       "name": "@rakomi/sdk-core",
-      "version": "0.4.0",
-      "purl": "pkg:npm/@rakomi/sdk-core@0.4.0",
+      "version": "0.5.0",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.5.0",
       "licenses": [
         {
           "license": {