@returningai/widget-sdk 1.8.5 → 1.8.6

package/dist/rai-widget.js

@@ -12343,6 +12343,109 @@ function isTokenExpired(expiry) {
   if (!expiry) return true;
   return Date.now() >= expiry - 6e4;
 }
+const RETRY_DELAYS_MS = [5e3, 15e3, 3e4];
+const RETRYABLE_CLIENT_STATUSES = /* @__PURE__ */ new Set([408, 425, 429]);
+function isPermanentAuthFailure(error) {
+  if (!error) return false;
+  const { status } = error;
+  return status >= 400 && status < 500 && !RETRYABLE_CLIENT_STATUSES.has(status);
+}
+function createDefaultEnvironment$1() {
+  const visibilityDocument = typeof document === "undefined" ? void 0 : document;
+  const pageWindow = typeof window === "undefined" ? void 0 : window;
+  return {
+    isHidden: () => (visibilityDocument == null ? void 0 : visibilityDocument.visibilityState) === "hidden",
+    setTimeout: (callback, delayMs) => globalThis.setTimeout(callback, delayMs),
+    clearTimeout: (timerId) => globalThis.clearTimeout(timerId),
+    addVisibilityChangeListener: (listener) => visibilityDocument == null ? void 0 : visibilityDocument.addEventListener("visibilitychange", listener),
+    removeVisibilityChangeListener: (listener) => visibilityDocument == null ? void 0 : visibilityDocument.removeEventListener("visibilitychange", listener),
+    addPageShowListener: (listener) => pageWindow == null ? void 0 : pageWindow.addEventListener("pageshow", listener),
+    removePageShowListener: (listener) => pageWindow == null ? void 0 : pageWindow.removeEventListener("pageshow", listener),
+    addOnlineListener: (listener) => pageWindow == null ? void 0 : pageWindow.addEventListener("online", listener),
+    removeOnlineListener: (listener) => pageWindow == null ? void 0 : pageWindow.removeEventListener("online", listener)
+  };
+}
+function createAuthRenewalRecoveryController(retry, environment = createDefaultEnvironment$1()) {
+  let pending = false;
+  let retryInFlight = false;
+  let rescheduleRequested = false;
+  let retryAttempt = 0;
+  let timerId = null;
+  let listening = false;
+  const clearTimer = () => {
+    if (timerId === null) return;
+    environment.clearTimeout(timerId);
+    timerId = null;
+  };
+  const disarmSignals = () => {
+    if (!listening) return;
+    listening = false;
+    environment.removeVisibilityChangeListener(handleForeground);
+    environment.removePageShowListener(handleForeground);
+    environment.removeOnlineListener(handleOnline);
+  };
+  const reset = () => {
+    pending = false;
+    retryAttempt = 0;
+    rescheduleRequested = false;
+    clearTimer();
+    disarmSignals();
+  };
+  const requestRetry = (resetBudget, allowWhileHidden) => {
+    if (!pending || retryInFlight || !allowWhileHidden && environment.isHidden()) {
+      return;
+    }
+    if (resetBudget) retryAttempt = 0;
+    clearTimer();
+    retryInFlight = true;
+    Promise.resolve().then(retry).catch((error) => {
+      console.error("[rai-widget] Session renewal retry failed:", error);
+    }).finally(() => {
+      retryInFlight = false;
+      if (rescheduleRequested) {
+        rescheduleRequested = false;
+        scheduleRetry();
+      }
+    });
+  };
+  function handleForeground() {
+    if (environment.isHidden()) return;
+    requestRetry(true, false);
+  }
+  function handleOnline() {
+    requestRetry(true, true);
+  }
+  const armSignals = () => {
+    if (listening) return;
+    listening = true;
+    environment.addVisibilityChangeListener(handleForeground);
+    environment.addPageShowListener(handleForeground);
+    environment.addOnlineListener(handleOnline);
+  };
+  const scheduleRetry = () => {
+    if (retryInFlight && !pending) return;
+    pending = true;
+    armSignals();
+    if (retryInFlight) {
+      rescheduleRequested = true;
+      return;
+    }
+    if (timerId !== null || environment.isHidden() || retryAttempt >= RETRY_DELAYS_MS.length) {
+      return;
+    }
+    const delayMs = RETRY_DELAYS_MS[retryAttempt];
+    retryAttempt += 1;
+    timerId = environment.setTimeout(() => {
+      timerId = null;
+      requestRetry(false, false);
+    }, delayMs);
+  };
+  return {
+    schedule: scheduleRetry,
+    succeeded: reset,
+    cancel: reset
+  };
+}
 function setTokens(config, state, data, onRefreshScheduled) {
   state.accessToken = data.accessToken;
   state.refreshToken = data.refreshToken;
@@ -12368,6 +12471,12 @@ function buildIdentityProof(config) {
   }
   return proof;
 }
+function calculateRefreshDelay(accessTokenExpiry, now = Date.now()) {
+  const remainingLifetime = accessTokenExpiry - now;
+  if (remainingLifetime <= 0) return 0;
+  const refreshLeadTime = Math.min(6e4, remainingLifetime / 2);
+  return Math.max(0, Math.floor(remainingLifetime - refreshLeadTime));
+}
 async function authenticateServerless(config, state, onRefreshScheduled) {
   const nonce = crypto.randomUUID();
   const timestamp = Date.now();
@@ -12380,6 +12489,7 @@ async function authenticateServerless(config, state, onRefreshScheduled) {
       );
     }
     let is4xx = false;
+    let responseStatus = 0;
     try {
       const body = {
         nonce,
@@ -12393,6 +12503,7 @@ async function authenticateServerless(config, state, onRefreshScheduled) {
         body: JSON.stringify(body),
         credentials: "include"
       });
+      responseStatus = response.status;
       if (!response.ok) {
         is4xx = response.status >= 400 && response.status < 500;
         const errorBody = await response.json().catch(() => ({ error: "Authentication failed" }));
@@ -12421,7 +12532,7 @@ async function authenticateServerless(config, state, onRefreshScheduled) {
     } catch (err) {
       if (is4xx || attempt === maxRetries) {
         state.lastAuthError ?? (state.lastAuthError = {
-          status: 0,
+          status: responseStatus,
           error: err instanceof Error ? err.message : "Authentication failed"
         });
         state.isAuthenticated = false;
@@ -12435,6 +12546,15 @@ async function authenticateServerless(config, state, onRefreshScheduled) {
 async function authenticateViaProxy(config, state, onRefreshScheduled) {
   const maxRetries = config.maxRetries ?? 3;
   const retryDelay = config.retryDelay ?? 500;
+  const previousAuthentication = {
+    accessToken: state.accessToken,
+    refreshToken: state.refreshToken,
+    tokenFamily: state.tokenFamily,
+    accessTokenExpiry: state.accessTokenExpiry,
+    refreshTokenExpiry: state.refreshTokenExpiry,
+    isAuthenticated: state.isAuthenticated,
+    widgetData: state.widgetData
+  };
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     if (attempt > 0) {
       await new Promise(
@@ -12476,7 +12596,13 @@ async function authenticateViaProxy(config, state, onRefreshScheduled) {
           status,
           error: err instanceof Error ? err.message : "Authentication failed"
         };
-        state.isAuthenticated = false;
+        if (isPermanentAuthFailure(state.lastAuthError)) {
+          const permanentError = state.lastAuthError;
+          clearAuthenticationData(state);
+          state.lastAuthError = permanentError;
+        } else {
+          Object.assign(state, previousAuthentication);
+        }
         return false;
       }
     }
@@ -12488,10 +12614,16 @@ async function refreshAccessToken(config, state, onRefreshScheduled, sendToken)
   if (state.isRefreshing) {
     return state.refreshPromise;
   }
-  if (!state.refreshToken) {
-    return false;
-  }
   const presentedRefreshToken = state.refreshToken;
+  const previousAuthentication = {
+    accessToken: state.accessToken,
+    refreshToken: state.refreshToken,
+    tokenFamily: state.tokenFamily,
+    accessTokenExpiry: state.accessTokenExpiry,
+    refreshTokenExpiry: state.refreshTokenExpiry,
+    isAuthenticated: state.isAuthenticated,
+    widgetData: state.widgetData
+  };
   state.isRefreshing = true;
   state.refreshPromise = (async () => {
     const reauthenticateAfterRefreshFailure = async () => {
@@ -12500,13 +12632,22 @@ async function refreshAccessToken(config, state, onRefreshScheduled, sendToken)
         if (sendToken) sendToken();
         return true;
       }
-      clearAuthenticationData(state);
-      clearStorage(config);
       const authed = await authenticateServerless(config, state, onRefreshScheduled);
       if (authed && sendToken) sendToken();
+      if (!authed && isPermanentAuthFailure(state.lastAuthError)) {
+        const permanentError = state.lastAuthError;
+        clearAuthenticationData(state);
+        state.lastAuthError = permanentError;
+        clearStorage(config);
+      } else if (!authed) {
+        Object.assign(state, previousAuthentication);
+      }
       return authed;
     };
     try {
+      if (!presentedRefreshToken) {
+        return reauthenticateAfterRefreshFailure();
+      }
       const response = await fetch(`${config.apiUrl}/${config.widgetId}/auth/refresh`, {
         method: "POST",
         headers: {
@@ -12737,11 +12878,12 @@ function captureSnapshot(state) {
     widgetData: state.widgetData
   };
 }
-function applySnapshot(subscriber, snapshot) {
+function applySnapshot(subscriber, snapshot, notify = true) {
   var _a;
   Object.assign(subscriber.state, snapshot);
   if (snapshot.refreshToken) saveToStorage(subscriber.config, subscriber.state);
   else clearStorage(subscriber.config);
+  if (!notify) return;
   try {
     (_a = subscriber.onSnapshot) == null ? void 0 : _a.call(subscriber);
   } catch (error) {
@@ -12786,7 +12928,7 @@ function subscribeAuthSession(config, state, onSnapshot) {
         return Promise.resolve(true);
       }
       if (session.inFlight) return session.inFlight;
-      if (session.snapshot) applySnapshot(subscriber, session.snapshot);
+      if (session.snapshot) applySnapshot(subscriber, session.snapshot, false);
       const startingGeneration = session.generation;
       const inFlight = (async () => {
         const succeeded = await execute();
@@ -14151,7 +14293,11 @@ class BaseWidget extends HTMLElement {
     __publicField(this, "bundleUnmount");
     __publicField(this, "cancelBundleForegroundRecovery");
     __publicField(this, "authSession");
+    __publicField(this, "authRenewalRecovery");
     this.shadow = this.attachShadow({ mode: "closed" });
+    this.authRenewalRecovery = createAuthRenewalRecoveryController(
+      () => this.performScheduledRefresh()
+    );
   }
   static get observedAttributes() {
     return [
@@ -14211,6 +14357,7 @@ class BaseWidget extends HTMLElement {
     (_c = this.identityAttributeObserver) == null ? void 0 : _c.disconnect();
     (_d = this.cancelBundleForegroundRecovery) == null ? void 0 : _d.call(this);
     this.cancelBundleForegroundRecovery = void 0;
+    this.authRenewalRecovery.cancel();
     this.teardownMountedWidget();
     this.clearLottieInstances();
     this.restoreLoaderHeight();
@@ -14819,6 +14966,7 @@ class BaseWidget extends HTMLElement {
     var _a, _b;
     (_a = this.cancelBundleForegroundRecovery) == null ? void 0 : _a.call(this);
     this.cancelBundleForegroundRecovery = void 0;
+    this.authRenewalRecovery.cancel();
     const initId = ++this.initGeneration;
     this.hasAttemptedInit = true;
     if (!this.config.communityId) {
@@ -14827,6 +14975,9 @@ class BaseWidget extends HTMLElement {
     }
     if (!this.config.authUrl && !this.authSession) {
       this.authSession = subscribeAuthSession(this.config, this.state, () => {
+        if (this.state.isAuthenticated && !this.state.lastAuthError) {
+          this.authRenewalRecovery.succeeded();
+        }
         if (this.config.autoRefresh) this.scheduleRefresh();
         if (this.state.iframe) {
           sendTokenToWidget(this.config, this.state, this.state.iframe);
@@ -15182,38 +15333,49 @@ class BaseWidget extends HTMLElement {
   scheduleRefresh() {
     if (this.state.refreshTimer) clearTimeout(this.state.refreshTimer);
     if (!this.state.accessTokenExpiry) return;
-    const delay = this.state.accessTokenExpiry - Date.now() - 6e4;
+    const delay = calculateRefreshDelay(this.state.accessTokenExpiry);
+    if (delay > 0) {
+      this.state.refreshTimer = setTimeout(
+        () => void this.performScheduledRefresh(),
+        delay
+      );
+    } else {
+      void this.performScheduledRefresh();
+    }
+  }
+  async performScheduledRefresh() {
+    this.state.refreshTimer = null;
     const pushToken = () => {
       if (this.state.iframe)
         sendTokenToWidget(this.config, this.state, this.state.iframe);
       syncBundleAccessToken(this.config, this.state);
     };
-    const doRefresh = async () => {
-      if (this.config.authUrl) {
-        const ok = await authenticateViaProxy(
-          this.config,
-          this.state,
-          () => this.scheduleRefresh()
-        );
-        if (ok) pushToken();
-        else this.handleSessionExpired();
-      } else {
-        const ok = this.authSession ? await this.authSession.run(
-          "refresh",
-          () => refreshAccessToken(this.config, this.state)
-        ) : await refreshAccessToken(
-          this.config,
-          this.state,
-          () => this.scheduleRefresh(),
-          pushToken
-        );
-        if (!ok) this.handleSessionExpired();
-      }
-    };
-    if (delay > 0) {
-      this.state.refreshTimer = setTimeout(doRefresh, delay);
+    let ok;
+    if (this.config.authUrl) {
+      ok = await authenticateViaProxy(
+        this.config,
+        this.state,
+        () => this.scheduleRefresh()
+      );
+      if (ok) pushToken();
+    } else {
+      ok = this.authSession ? await this.authSession.run(
+        "refresh",
+        () => refreshAccessToken(this.config, this.state)
+      ) : await refreshAccessToken(
+        this.config,
+        this.state,
+        () => this.scheduleRefresh(),
+        pushToken
+      );
+    }
+    if (ok) {
+      this.authRenewalRecovery.succeeded();
+    } else if (isPermanentAuthFailure(this.state.lastAuthError)) {
+      this.authRenewalRecovery.cancel();
+      this.handleSessionExpired();
     } else {
-      doRefresh();
+      this.authRenewalRecovery.schedule();
     }
   }
   schedulePeriodicSync(iframe) {
@@ -15224,18 +15386,13 @@ class BaseWidget extends HTMLElement {
     }, 12e4);
   }
   /**
-   * A background refresh exhausted every recovery path — /auth/refresh failed
-   * and the re-auth that follows it failed too, so `state.isAuthenticated` is
-   * now false and there is no live token.
-   *
-   * Every startup auth path already calls showError() on failure; this one is
-   * reached from a timer, so without it the widget stays mounted showing stale
-   * content while isAuthenticated() reports false to the host page — which is
-   * how a signed-in user ends up looking at content meant for signed-out users.
-   * The event gives hosts a signal to re-mint credentials instead of polling.
+   * A background refresh reached a confirmed permanent authentication failure
+   * after exhausting its safe recovery paths. Transient transport, throttling,
+   * and server failures are retained by authRenewalRecovery instead.
    */
   handleSessionExpired() {
     var _a;
+    this.authRenewalRecovery.cancel();
     if (this.state.refreshTimer) {
       clearTimeout(this.state.refreshTimer);
       this.state.refreshTimer = null;
@@ -15255,6 +15412,7 @@ class BaseWidget extends HTMLElement {
   // ── Logout helper ─────────────────────────────────────────────────────
   async logoutAndClear() {
     var _a;
+    this.authRenewalRecovery.cancel();
     await logout(this.config, this.state);
     (_a = this.authSession) == null ? void 0 : _a.clear();
     this.teardownMountedWidget();
@@ -15264,6 +15422,7 @@ class BaseWidget extends HTMLElement {
   // ── Public API ────────────────────────────────────────────────────────
   async reload() {
     var _a, _b;
+    this.authRenewalRecovery.cancel();
     const previousConfig = this.config;
     (_a = this.authSession) == null ? void 0 : _a.release();
     this.authSession = void 0;
@@ -15411,7 +15570,7 @@ class CustomWidget extends BaseWidget {
     }
   }
 }
-console.log(`[rai-widget] v${"1.8.5"}`);
+console.log(`[rai-widget] v${"1.8.6"}`);
 class StoreWidgetCompat extends StoreWidget {
 }
 const WIDGET_REGISTRY = [
@@ -15475,7 +15634,7 @@ function exposePublicApi() {
   })();
   const widget = container == null ? void 0 : container.querySelector(ALL_WIDGET_SELECTOR);
   window.ReturningAIWidget = {
-    version: "1.8.5",
+    version: "1.8.6",
     reload: () => (widget == null ? void 0 : widget.reload()) ?? Promise.resolve(),
     logout: () => (widget == null ? void 0 : widget.logoutPublic()) ?? Promise.resolve(),
     isAuthenticated: () => (widget == null ? void 0 : widget.isAuthenticated()) ?? false,

package/dist/types/BaseWidget.d.ts

@@ -24,6 +24,7 @@ export declare abstract class BaseWidget extends HTMLElement {
     private bundleUnmount?;
     private cancelBundleForegroundRecovery?;
     private authSession?;
+    private authRenewalRecovery;
     constructor();
     registerCallback<K extends keyof ReturningAIWidgetCallbackMap>(callbackName: K, callback: ReturningAIWidgetCallbackMap[K]): void;
     registerCallback(callbackName: string, callback: ReturningAIWidgetCallback): void;
@@ -111,17 +112,12 @@ export declare abstract class BaseWidget extends HTMLElement {
     private prepareBundleRuntimeEnvironment;
     private mountWidget;
     private scheduleRefresh;
+    private performScheduledRefresh;
     private schedulePeriodicSync;
     /**
-     * A background refresh exhausted every recovery path — /auth/refresh failed
-     * and the re-auth that follows it failed too, so `state.isAuthenticated` is
-     * now false and there is no live token.
-     *
-     * Every startup auth path already calls showError() on failure; this one is
-     * reached from a timer, so without it the widget stays mounted showing stale
-     * content while isAuthenticated() reports false to the host page — which is
-     * how a signed-in user ends up looking at content meant for signed-out users.
-     * The event gives hosts a signal to re-mint credentials instead of polling.
+     * A background refresh reached a confirmed permanent authentication failure
+     * after exhausting its safe recovery paths. Transient transport, throttling,
+     * and server failures are retained by authRenewalRecovery instead.
      */
     private handleSessionExpired;
     private logoutAndClear;

package/dist/types/core/auth-renewal-recovery.d.ts

@@ -0,0 +1,19 @@
+import type { WidgetState } from "../types";
+export interface AuthRenewalRecoveryEnvironment {
+    isHidden: () => boolean;
+    setTimeout: (callback: () => void, delayMs: number) => unknown;
+    clearTimeout: (timerId: unknown) => void;
+    addVisibilityChangeListener: (listener: () => void) => void;
+    removeVisibilityChangeListener: (listener: () => void) => void;
+    addPageShowListener: (listener: () => void) => void;
+    removePageShowListener: (listener: () => void) => void;
+    addOnlineListener: (listener: () => void) => void;
+    removeOnlineListener: (listener: () => void) => void;
+}
+export interface AuthRenewalRecoveryController {
+    schedule(): void;
+    succeeded(): void;
+    cancel(): void;
+}
+export declare function isPermanentAuthFailure(error: WidgetState["lastAuthError"]): boolean;
+export declare function createAuthRenewalRecoveryController(retry: () => Promise<void> | void, environment?: AuthRenewalRecoveryEnvironment): AuthRenewalRecoveryController;

package/dist/types/core/auth.d.ts

@@ -1,4 +1,5 @@
 import type { WidgetConfig, WidgetState } from '../types';
+export declare function calculateRefreshDelay(accessTokenExpiry: number, now?: number): number;
 export declare function authenticateServerless(config: WidgetConfig, state: WidgetState, onRefreshScheduled?: () => void): Promise<boolean>;
 export declare function authenticateViaProxy(config: WidgetConfig, state: WidgetState, onRefreshScheduled?: () => void): Promise<boolean>;
 export declare function refreshAccessToken(config: WidgetConfig, state: WidgetState, onRefreshScheduled?: () => void, sendToken?: () => void): Promise<boolean>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@returningai/widget-sdk",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "description": "Shadow DOM isolated widget SDK for ReturningAI",
   "main": "dist/rai-widget.iife.js",
   "module": "dist/rai-widget.js",
@@ -25,7 +25,7 @@
     "build:all": "npm run build && npm run build:banner",
     "build:all:min": "npm run build:min && npm run build:banner:min",
     "types": "tsc --emitDeclarationOnly --outDir dist/types && cp src/jsx.d.ts dist/types/jsx.d.ts",
-    "test": "npm run test:host-callback && npm run test:bundle-readiness && npm run test:bundle-runtime-cache && npm run test:bundle-token-sync && npm run test:auth-bootstrap && npm run test:auth-error-reporting && npm run test:auth-refresh-state && npm run test:auth-session-coordinator && npm run test:startup-performance && npm run test:widget-error-presentation && npm run test:jsx-types",
+    "test": "npm run test:host-callback && npm run test:bundle-readiness && npm run test:bundle-runtime-cache && npm run test:bundle-token-sync && npm run test:auth-bootstrap && npm run test:auth-error-reporting && npm run test:auth-refresh-state && npm run test:auth-renewal-recovery && npm run test:auth-session-coordinator && npm run test:startup-performance && npm run test:widget-error-presentation && npm run test:jsx-types",
     "test:host-callback": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/postmessage-host-callback.test.js",
     "test:bundle-readiness": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/bundle-readiness.test.js",
     "test:bundle-runtime-cache": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/bundle-runtime-cache.test.js",
@@ -33,6 +33,7 @@
     "test:auth-bootstrap": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-bootstrap.test.js",
     "test:auth-error-reporting": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-error-reporting.test.js",
     "test:auth-refresh-state": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-refresh-state.test.js",
+    "test:auth-renewal-recovery": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-renewal-recovery.test.js",
     "test:auth-session-coordinator": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-session-coordinator.test.js",
     "test:startup-performance": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/startup-performance.test.js",
     "test:widget-error-presentation": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/widget-error-presentation.test.js",