@rakomi/react-native 0.4.0 → 0.6.0

package/README.md

@@ -211,6 +211,7 @@ have to branch:
 | What happened | Code your UI handles |
 |---|---|
 | The user dismissed the sheet | `PASSKEY_CEREMONY_CANCELLED` |
+| Nobody finished the sheet in time | `PASSKEY_CEREMONY_TIMED_OUT` — retryable; the SDK asked your module to cancel the request |
 | The device cannot do passkeys, or no adapter is wired | `PASSKEY_NOT_SUPPORTED` |
 | The credential is already registered for this user | `PASSKEY_ALREADY_REGISTERED` |
 | The action needs a fresh re-authentication first | `PASSKEY_STEP_UP_REQUIRED` |

package/THIRD-PARTY-NOTICES

@@ -1,6 +1,6 @@
 THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 
-For the npm package: @rakomi/react-native@0.4.0
+For the npm package: @rakomi/react-native@0.6.0
 
 This package's published bundle (`dist/`) INLINES the third-party components listed below.
 Their copyright and permission notices are reproduced verbatim, as required by their licenses

package/dist/index.cjs

@@ -299,8 +299,19 @@ function deriveDefaultJwksUri(tokenEndpoint) {
 }
 var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
 var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
-function deriveDefaultIssuer(_tokenEndpoint) {
-  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+function deriveDefaultIssuer(options) {
+  if (options.baseUrl) {
+    try {
+      new URL(options.baseUrl);
+      return sdkCore.resolveExpectedIssuer(options.baseUrl);
+    } catch {
+    }
+  }
+  try {
+    return new URL(options.tokenEndpoint).origin;
+  } catch {
+    return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+  }
 }
 var REFRESH_TOKEN_PREFIX = "v1:";
 var REFRESH_BUFFER_SECONDS = 60;
@@ -360,7 +371,7 @@ var TokenRuntime = class _TokenRuntime {
     this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
     this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
     this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
-    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer({ baseUrl: options.baseUrl, tokenEndpoint: options.tokenEndpoint });
     this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
   }
   /**
@@ -515,18 +526,20 @@ var TokenRuntime = class _TokenRuntime {
   *
   * uses `jose.createLocalJWKSet` so verification is purely local once
   * the JWKS document has been fetched and cached. The cache is preloaded from `KeyValueStore`
-  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss; on persistent network failure
+  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss, or once when the token's `kid` is not in
+  * the cached set (a rotated key; rate-limited by a cooldown); on persistent network failure
   * the stale-while-error fallback keeps verification working until the cached doc itself expires.
   */
   async verifyAccessToken(token) {
     try {
       const cache = await this.getOrCreateJwksCache();
-      const keySet = await cache.getKeySet();
-      const result = await jose.jwtVerify(token, keySet, {
-        issuer: this.expectedIssuer,
-        audience: this.expectedAudience,
-        algorithms: ["RS256"]
-      });
+      const result = await cache.withKeyRotationRetry(
+        (keySet) => jose.jwtVerify(token, keySet, {
+          issuer: this.expectedIssuer,
+          audience: this.expectedAudience,
+          algorithms: ["RS256"]
+        })
+      );
       return { ok: true, payload: result.payload };
     } catch (err2) {
       return { ok: false, reason: err2 instanceof Error ? err2.message : "verify failed" };
@@ -545,11 +558,32 @@ var TokenRuntime = class _TokenRuntime {
     this.storageKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
     return this.storageKeyResolved;
   }
+  /**
+   * The persisted JWKS-cache slot, scoped per-host in addition to per-tenant.
+   *
+   * `deriveTenantStorageKey`'s own domain separation is tenant-only, which was correct while every
+   * tenant verified against ONE platform-wide JWKS document. Now that a tenant's issuer host can
+   * change across the app's lifetime (a custom domain bound after this SDK version first shipped, or
+   * simply a dev pointed at a different host between builds), a slot keyed by tenant alone would
+   * silently reuse a PREVIOUS host's persisted document as this instance's "fresh" cache on cold
+   * start — cross-host reuse this offline-verification path must never do. The host segment is not
+   * secret (it is the caller's own `jwksUri` configuration), so a plain suffix is enough; this only
+   * needs to be a stable, DIFFERENT key per host, not a cryptographically-opaque one.
+   */
   async resolveJwksKey() {
     if (this.jwksKeyResolved) return this.jwksKeyResolved;
-    this.jwksKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const base = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const host = this.jwksHost();
+    this.jwksKeyResolved = host ? `${base}.h.${host}` : base;
     return this.jwksKeyResolved;
   }
+  jwksHost() {
+    try {
+      return new URL(this.jwksUri).hostname;
+    } catch {
+      return null;
+    }
+  }
   async getOrCreateJwksCache() {
     if (this.jwksCache) return this.jwksCache;
     const key = await this.resolveJwksKey();
@@ -1051,6 +1085,7 @@ function RakomiProvider(props) {
       clientId: props.publishableKey,
       tenantId: props.tenantId ?? props.publishableKey,
       tokenEndpoint,
+      baseUrl: props.baseUrl,
       storage: adapter.storage,
       http,
       crypto: adapter.crypto,

package/dist/index.d.cts

@@ -495,7 +495,7 @@ declare const MAX_WEBHOOK_TOLERANCE = 600;
 /** Portable webhook-verify error class — the value IS the cross-SDK conformance `error_class`. */
 type WebhookVerifyErrorClass = 'invalid_signature' | 'invalid_secret' | 'missing_header' | 'timestamp_too_old' | 'timestamp_too_new' | 'invalid_body';
 /** Open-set publisher event type (the known catalog widened with the base string for forward-compat). */
-type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed';
+type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed' | 'app.version_pending_review' | 'app.pending_version_approved' | 'app.pending_version_rejected';
 type PublisherWebhookEventType = PublisherEventType | (string & {});
 /** The flat publisher-webhook delivery body. Unknown fields tolerated (forward-compat). No end-user PII. */
 interface PublisherWebhookEvent {

package/dist/index.d.ts

@@ -495,7 +495,7 @@ declare const MAX_WEBHOOK_TOLERANCE = 600;
 /** Portable webhook-verify error class — the value IS the cross-SDK conformance `error_class`. */
 type WebhookVerifyErrorClass = 'invalid_signature' | 'invalid_secret' | 'missing_header' | 'timestamp_too_old' | 'timestamp_too_new' | 'invalid_body';
 /** Open-set publisher event type (the known catalog widened with the base string for forward-compat). */
-type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed';
+type PublisherEventType = 'app.installed' | 'app.uninstalled' | 'app.install.scope_bump' | 'app.install.receipts_revoked' | 'publisher.created' | 'publisher.domain_verified' | 'publisher.dpa_accepted' | 'app.created' | 'app.version_published' | 'app.state_changed' | 'publisher.review_requested' | 'publisher.review_denied' | 'publisher.review_stale' | 'publisher.verified' | 'publisher.deverified' | 'publisher.subscription_activated' | 'publisher.subscription_lapsed' | 'app.version_pending_review' | 'app.pending_version_approved' | 'app.pending_version_rejected';
 type PublisherWebhookEventType = PublisherEventType | (string & {});
 /** The flat publisher-webhook delivery body. Unknown fields tolerated (forward-compat). No end-user PII. */
 interface PublisherWebhookEvent {

package/dist/index.js

@@ -1,5 +1,5 @@
 import { createContext, useMemo, useReducer, useRef, useEffect, useState, useCallback, useContext } from 'react';
-import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, extractRequestId, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
+import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, extractRequestId, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError, resolveExpectedIssuer } from '@rakomi/sdk-core';
 export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { jwtVerify } from 'jose';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
@@ -298,8 +298,19 @@ function deriveDefaultJwksUri(tokenEndpoint) {
 }
 var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
 var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
-function deriveDefaultIssuer(_tokenEndpoint) {
-  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+function deriveDefaultIssuer(options) {
+  if (options.baseUrl) {
+    try {
+      new URL(options.baseUrl);
+      return resolveExpectedIssuer(options.baseUrl);
+    } catch {
+    }
+  }
+  try {
+    return new URL(options.tokenEndpoint).origin;
+  } catch {
+    return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+  }
 }
 var REFRESH_TOKEN_PREFIX = "v1:";
 var REFRESH_BUFFER_SECONDS = 60;
@@ -359,7 +370,7 @@ var TokenRuntime = class _TokenRuntime {
     this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
     this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
     this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
-    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer({ baseUrl: options.baseUrl, tokenEndpoint: options.tokenEndpoint });
     this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
   }
   /**
@@ -514,18 +525,20 @@ var TokenRuntime = class _TokenRuntime {
   *
   * uses `jose.createLocalJWKSet` so verification is purely local once
   * the JWKS document has been fetched and cached. The cache is preloaded from `KeyValueStore`
-  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss; on persistent network failure
+  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss, or once when the token's `kid` is not in
+  * the cached set (a rotated key; rate-limited by a cooldown); on persistent network failure
   * the stale-while-error fallback keeps verification working until the cached doc itself expires.
   */
   async verifyAccessToken(token) {
     try {
       const cache = await this.getOrCreateJwksCache();
-      const keySet = await cache.getKeySet();
-      const result = await jwtVerify(token, keySet, {
-        issuer: this.expectedIssuer,
-        audience: this.expectedAudience,
-        algorithms: ["RS256"]
-      });
+      const result = await cache.withKeyRotationRetry(
+        (keySet) => jwtVerify(token, keySet, {
+          issuer: this.expectedIssuer,
+          audience: this.expectedAudience,
+          algorithms: ["RS256"]
+        })
+      );
       return { ok: true, payload: result.payload };
     } catch (err2) {
       return { ok: false, reason: err2 instanceof Error ? err2.message : "verify failed" };
@@ -544,11 +557,32 @@ var TokenRuntime = class _TokenRuntime {
     this.storageKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
     return this.storageKeyResolved;
   }
+  /**
+   * The persisted JWKS-cache slot, scoped per-host in addition to per-tenant.
+   *
+   * `deriveTenantStorageKey`'s own domain separation is tenant-only, which was correct while every
+   * tenant verified against ONE platform-wide JWKS document. Now that a tenant's issuer host can
+   * change across the app's lifetime (a custom domain bound after this SDK version first shipped, or
+   * simply a dev pointed at a different host between builds), a slot keyed by tenant alone would
+   * silently reuse a PREVIOUS host's persisted document as this instance's "fresh" cache on cold
+   * start — cross-host reuse this offline-verification path must never do. The host segment is not
+   * secret (it is the caller's own `jwksUri` configuration), so a plain suffix is enough; this only
+   * needs to be a stable, DIFFERENT key per host, not a cryptographically-opaque one.
+   */
   async resolveJwksKey() {
     if (this.jwksKeyResolved) return this.jwksKeyResolved;
-    this.jwksKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const base = await deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    const host = this.jwksHost();
+    this.jwksKeyResolved = host ? `${base}.h.${host}` : base;
     return this.jwksKeyResolved;
   }
+  jwksHost() {
+    try {
+      return new URL(this.jwksUri).hostname;
+    } catch {
+      return null;
+    }
+  }
   async getOrCreateJwksCache() {
     if (this.jwksCache) return this.jwksCache;
     const key = await this.resolveJwksKey();
@@ -1050,6 +1084,7 @@ function RakomiProvider(props) {
       clientId: props.publishableKey,
       tenantId: props.tenantId ?? props.publishableKey,
       tokenEndpoint,
+      baseUrl: props.baseUrl,
       storage: adapter.storage,
       http,
       crypto: adapter.crypto,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "React Native / Expo SDK for Rakomi authentication.",
   "keywords": [
     "rakomi",
@@ -83,16 +83,16 @@
     }
   },
   "devDependencies": {
-    "@rakomi/react": "0.4.0"
+    "@rakomi/react": "0.6.0"
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@rakomi/sdk-core": "^0.4.0"
+    "@rakomi/sdk-core": "^0.6.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json",
     "lint": "eslint src/ test/ --max-warnings=0",
-    "test": "node ../../scripts/ci/vitest-fork-crash-retry.mjs --results ./test-results.json -- vitest run"
+    "test": "node ../../scripts/assert-not-story-agent-worktree.mjs test && node ../../scripts/ci/vitest-fork-crash-retry.mjs --results ./test-results.json -- vitest run"
   }
 }

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.4.0",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.6.0",
       "name": "@rakomi/react-native",
-      "version": "0.4.0",
-      "purl": "pkg:npm/%40rakomi%2Freact-native@0.4.0",
+      "version": "0.6.0",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.6.0",
       "licenses": [
         {
           "license": {
@@ -42,10 +42,10 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.4.0",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.6.0",
       "name": "@rakomi/sdk-core",
-      "version": "0.4.0",
-      "purl": "pkg:npm/@rakomi/sdk-core@0.4.0",
+      "version": "0.6.0",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.6.0",
       "licenses": [
         {
           "license": {