@rakomi/react-native 0.5.0 → 0.6.0

package/README.md

@@ -211,6 +211,7 @@ have to branch:
 | What happened | Code your UI handles |
 |---|---|
 | The user dismissed the sheet | `PASSKEY_CEREMONY_CANCELLED` |
+| Nobody finished the sheet in time | `PASSKEY_CEREMONY_TIMED_OUT` — retryable; the SDK asked your module to cancel the request |
 | The device cannot do passkeys, or no adapter is wired | `PASSKEY_NOT_SUPPORTED` |
 | The credential is already registered for this user | `PASSKEY_ALREADY_REGISTERED` |
 | The action needs a fresh re-authentication first | `PASSKEY_STEP_UP_REQUIRED` |

package/THIRD-PARTY-NOTICES

@@ -1,6 +1,6 @@
 THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 
-For the npm package: @rakomi/react-native@0.5.0
+For the npm package: @rakomi/react-native@0.6.0
 
 This package's published bundle (`dist/`) INLINES the third-party components listed below.
 Their copyright and permission notices are reproduced verbatim, as required by their licenses

package/dist/index.cjs

@@ -526,18 +526,20 @@ var TokenRuntime = class _TokenRuntime {
   *
   * uses `jose.createLocalJWKSet` so verification is purely local once
   * the JWKS document has been fetched and cached. The cache is preloaded from `KeyValueStore`
-  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss; on persistent network failure
+  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss, or once when the token's `kid` is not in
+  * the cached set (a rotated key; rate-limited by a cooldown); on persistent network failure
   * the stale-while-error fallback keeps verification working until the cached doc itself expires.
   */
   async verifyAccessToken(token) {
     try {
       const cache = await this.getOrCreateJwksCache();
-      const keySet = await cache.getKeySet();
-      const result = await jose.jwtVerify(token, keySet, {
-        issuer: this.expectedIssuer,
-        audience: this.expectedAudience,
-        algorithms: ["RS256"]
-      });
+      const result = await cache.withKeyRotationRetry(
+        (keySet) => jose.jwtVerify(token, keySet, {
+          issuer: this.expectedIssuer,
+          audience: this.expectedAudience,
+          algorithms: ["RS256"]
+        })
+      );
       return { ok: true, payload: result.payload };
     } catch (err2) {
       return { ok: false, reason: err2 instanceof Error ? err2.message : "verify failed" };

package/dist/index.js

@@ -525,18 +525,20 @@ var TokenRuntime = class _TokenRuntime {
   *
   * uses `jose.createLocalJWKSet` so verification is purely local once
   * the JWKS document has been fetched and cached. The cache is preloaded from `KeyValueStore`
-  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss; on persistent network failure
+  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss, or once when the token's `kid` is not in
+  * the cached set (a rotated key; rate-limited by a cooldown); on persistent network failure
   * the stale-while-error fallback keeps verification working until the cached doc itself expires.
   */
   async verifyAccessToken(token) {
     try {
       const cache = await this.getOrCreateJwksCache();
-      const keySet = await cache.getKeySet();
-      const result = await jwtVerify(token, keySet, {
-        issuer: this.expectedIssuer,
-        audience: this.expectedAudience,
-        algorithms: ["RS256"]
-      });
+      const result = await cache.withKeyRotationRetry(
+        (keySet) => jwtVerify(token, keySet, {
+          issuer: this.expectedIssuer,
+          audience: this.expectedAudience,
+          algorithms: ["RS256"]
+        })
+      );
       return { ok: true, payload: result.payload };
     } catch (err2) {
       return { ok: false, reason: err2 instanceof Error ? err2.message : "verify failed" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "React Native / Expo SDK for Rakomi authentication.",
   "keywords": [
     "rakomi",
@@ -83,11 +83,11 @@
     }
   },
   "devDependencies": {
-    "@rakomi/react": "0.5.0"
+    "@rakomi/react": "0.6.0"
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@rakomi/sdk-core": "^0.5.0"
+    "@rakomi/sdk-core": "^0.6.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.5.0",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.6.0",
       "name": "@rakomi/react-native",
-      "version": "0.5.0",
-      "purl": "pkg:npm/%40rakomi%2Freact-native@0.5.0",
+      "version": "0.6.0",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.6.0",
       "licenses": [
         {
           "license": {
@@ -42,10 +42,10 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.5.0",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.6.0",
       "name": "@rakomi/sdk-core",
-      "version": "0.5.0",
-      "purl": "pkg:npm/@rakomi/sdk-core@0.5.0",
+      "version": "0.6.0",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.6.0",
       "licenses": [
         {
           "license": {