@signalwire/js 4.0.0-dev-20260717142935 → 4.0.0-dev-20260721191222

package/dist/browser.mjs

@@ -9049,6 +9049,14 @@ const CREDENTIAL_REFRESH_MAX_DELAY_MS = 3e4;
 /** Buffer in milliseconds before token expiry to trigger refresh. */
 const CREDENTIAL_REFRESH_BUFFER_MS = 5e3;
 /**
+* Clock-skew allowance (ms) for treating an in-memory credential as expired
+* when deciding whether a fresh (re)connect must re-mint the token before
+* authenticating. A token within this window of its `expiry_at` is treated as
+* stale so the reconnect re-mints via the credential provider instead of
+* replaying a dead token (which the server rejects with -32003).
+*/
+const CREDENTIAL_EXPIRY_SKEW_MS = 3e4;
+/**
 * Maximum time the coordinator will wait for `DeviceTokenManager.activate()`
 * to resolve before treating the activation as failed and falling back to
 * the developer-provided refresh path. Prevents a wedged HTTP layer from
@@ -20093,9 +20101,9 @@ var ClientSessionManager = class extends Destroyable {
 	}
 	async handleAuthenticationError(error) {
 		logger$9.error("Authentication error:", error);
-		const isRecoverableAuthError = error instanceof JSONRPCError && (error.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || error.code === RPC_ERROR_INVALID_PARAMS || error.code === RPC_ERROR_AUTHENTICATION_FAILED);
+		const isRecoverableAuthError$1 = error instanceof JSONRPCError && (error.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || error.code === RPC_ERROR_INVALID_PARAMS || error.code === RPC_ERROR_AUTHENTICATION_FAILED);
 		const hasStoredState = await (0, import_cjs$7.firstValueFrom)(this.authorizationState$.pipe((0, import_cjs$7.take)(1))) !== void 0;
-		if (isRecoverableAuthError && hasStoredState) {
+		if (isRecoverableAuthError$1 && hasStoredState) {
 			logger$9.debug("[Session] Recoverable auth error — cleaning up stored state and reconnecting fresh");
 			try {
 				await this.cleanupStoredConnectionParams();
@@ -20191,11 +20199,15 @@ var ClientSessionManager = class extends Destroyable {
 		const isReconnect = hasReconnectState && storedToken;
 		let dpopToken;
 		if (isReconnect) logger$9.debug("[Session] Reconnecting with stored jwt_token + authorization_state");
-		else if (this.onBeforeReconnect && this.clientBound) {
-			logger$9.debug("[Session] Refreshing credentials before fresh connect");
-			await this.onBeforeReconnect();
+		else {
+			const credential = this.getCredential();
+			const credentialExpired = credential.expiry_at !== void 0 && credential.expiry_at <= Date.now() + CREDENTIAL_EXPIRY_SKEW_MS;
+			if (this.onBeforeReconnect && (this.clientBound || credentialExpired)) {
+				logger$9.debug("[Session] Refreshing credentials before fresh connect");
+				await this.onBeforeReconnect();
+			}
 		}
-		if ((!isReconnect || this.clientBound) && this.dpopManager?.initialized) try {
+		if (this.dpopManager?.initialized) try {
 			dpopToken = await this.dpopManager.createRpcProof({ method: "signalwire.connect" });
 		} catch (error) {
 			if (this.clientBound) throw error;
@@ -20228,6 +20240,7 @@ var ClientSessionManager = class extends Destroyable {
 		});
 		if (response.protocol) await this.transport.setProtocol(response.protocol);
 		this._authorization$.next(response.authorization);
+		if (response.authorization.cnf?.jkt) this._wasClientBound = true;
 		this._iceServers$.next(response.ice_servers ?? []);
 		this._authState$.next({ kind: "authenticated" });
 		logger$9.debug("[Session] Authentication completed successfully");
@@ -20347,6 +20360,14 @@ var ClientSessionWrapper = class {
 	get authenticated() {
 		return this.clientSessionManager.authenticated;
 	}
+	/**
+	* Whether the session is using a Client Bound SAT (DPoP). Sticky — set
+	* when the binding is established or restored from a resumed session's
+	* server authorization.
+	*/
+	get clientBound() {
+		return this.clientSessionManager.clientBound;
+	}
 	get signalingEvent$() {
 		return this.clientSessionManager.signalingEvent$;
 	}
@@ -20549,7 +20570,7 @@ var DeviceTokenManager = class extends Destroyable {
 			await session.reauthenticate(tokenData.token, rpcProof, { clientBound: true });
 			updateCredential({ token: tokenData.token });
 			logger$7.info("[DeviceToken] Client Bound SAT activated successfully");
-			this._currentToken$.next(tokenData);
+			this.emitCurrentToken(tokenData);
 			return { activated: true };
 		} catch (error) {
 			logger$7.error("[DeviceToken] Failed to activate Client Bound SAT:", error);
@@ -20561,6 +20582,21 @@ var DeviceTokenManager = class extends Destroyable {
 		}
 	}
 	/**
+	* Emit a freshly received token to the reactive pipeline, stamping an
+	* absolute `expires_at` when the response carried only `expires_in`.
+	* Resolving the expiry at RECEIVE time (not at read time) is what lets
+	* {@link refreshNowIfDue} detect due-ness on resume: a bare `expires_in`
+	* re-resolved later would always compute a full TTL from "now" and never
+	* cross the refresh buffer.
+	*/
+	emitCurrentToken(token) {
+		const stamped = token.expires_at ? token : {
+			...token,
+			expires_at: resolveExpiresAt(token)
+		};
+		this._currentToken$.next(stamped);
+	}
+	/**
 	* Returns true when the cached token has enough headroom before expiry to
 	* be safely reused on reactivation. The headroom matches the refresh
 	* buffer, so a token within the refresh window is treated as stale (the
@@ -20653,7 +20689,7 @@ var DeviceTokenManager = class extends Destroyable {
 			const currentToken = this.getCredential().token;
 			if (!currentToken) throw new TokenRefreshError("No current token available for refresh");
 			const newTokenData = await this.retryRefresh(session, currentToken, updateCredential);
-			this._currentToken$.next(newTokenData);
+			this.emitCurrentToken(newTokenData);
 		} catch (error) {
 			logger$7.error("[DeviceToken] Automatic Client Bound SAT refresh failed:", error);
 			this.errorHandler(error instanceof TokenRefreshError ? error : new TokenRefreshError("Automatic token refresh failed", error));
@@ -20680,6 +20716,22 @@ var DeviceTokenManager = class extends Destroyable {
 		throw lastError instanceof Error ? lastError : new TokenRefreshError("All refresh retries exhausted", lastError);
 	}
 	/**
+	* Force an immediate refresh when the cached Client Bound SAT is already
+	* past its refresh window. Called on resume from suspension where
+	* background-tab throttling can delay the reactive timer past the buffer.
+	* A no-op when no token is cached or it still has headroom; the normal
+	* {@link executeRefresh} guards (paused / in-progress / unauthenticated)
+	* still apply.
+	*/
+	refreshNowIfDue() {
+		const token = this._currentToken$.value;
+		if (!token) return;
+		if (resolveExpiresAt(token) * 1e3 - Date.now() <= DEVICE_TOKEN_REFRESH_BUFFER_MS) {
+			logger$7.debug("[DeviceToken] Resume: cached SAT past refresh window; refreshing now");
+			this.executeRefresh();
+		}
+	}
+	/**
 	* Stops the reactive refresh pipeline from firing. Use when the underlying
 	* session is being torn down (e.g., during {@link SignalWire.disconnect})
 	* so a scheduled refresh cannot fire against a destroyed session.
@@ -20730,6 +20782,7 @@ var CredentialRefreshCoordinator = class extends Destroyable {
 		this.deps = deps;
 		this._activating = false;
 		this._activationGeneration = 0;
+		this._developerRefreshInProgress = false;
 		if (dpopManager?.initialized) this._deviceTokenManager = (deps.deviceTokenManagerFactory ?? defaultDeviceTokenManagerFactory)(dpopManager, deps.http, (error) => deps.notifier.onError(error), () => deps.store.read());
 	}
 	/** True when the Client Bound SAT path is available (DPoP initialized). */
@@ -20748,28 +20801,120 @@ var CredentialRefreshCoordinator = class extends Destroyable {
 	* invokes `deps.onRefreshExhausted` so the orchestrator can disconnect.
 	*/
 	scheduleDeveloperRefresh(provider, expiresAt, attempt = 0) {
+		this._activeProvider = provider;
 		if (this._developerTimerId !== void 0) clearTimeout(this._developerTimerId);
 		const refreshInterval = attempt === 0 ? Math.max(expiresAt - Date.now() - CREDENTIAL_REFRESH_BUFFER_MS, 1e3) : Math.min(CREDENTIAL_REFRESH_RETRY_BASE_MS * Math.pow(2, attempt) * (.5 + Math.random() * .5), CREDENTIAL_REFRESH_MAX_DELAY_MS);
-		this._developerTimerId = setTimeout(async () => {
+		this._developerTimerId = setTimeout(() => {
+			this._developerTimerId = void 0;
+			this.executeDeveloperRefresh(provider, expiresAt, attempt);
+		}, refreshInterval);
+	}
+	/**
+	* Runs the developer-provided refresh once: mints a new credential, stores
+	* and persists it, reauthenticates the live session (via the notifier), and
+	* reschedules against the new expiry. On failure retries with backoff up to
+	* {@link CREDENTIAL_REFRESH_MAX_RETRIES}, then signals exhaustion.
+	*
+	* Shared by the scheduled timer tick and {@link forceRefreshIfDue}. The
+	* `_developerRefreshInProgress` guard prevents the two from overlapping.
+	*/
+	async executeDeveloperRefresh(provider, expiresAt, attempt) {
+		if (this._developerRefreshInProgress) {
+			logger$6.debug("[Coordinator] Developer refresh already in progress; skipping");
+			return;
+		}
+		this._developerRefreshInProgress = true;
+		try {
+			const newCredentials = await this.refreshCredential(provider);
+			this.deps.store.write(newCredentials);
+			this.deps.store.persist(newCredentials);
 			try {
-				if (!provider.refresh) throw new InvalidCredentialsError("Credential provider does not support refresh");
-				const newCredentials = await provider.refresh();
-				this.deps.store.write(newCredentials);
-				this.deps.store.persist(newCredentials);
-				logger$6.info("[Coordinator] Credentials refreshed successfully.");
-				if (newCredentials.expiry_at) this.scheduleDeveloperRefresh(provider, newCredentials.expiry_at, 0);
-			} catch (error) {
-				const nextAttempt = attempt + 1;
-				logger$6.error(`[Coordinator] Credential refresh failed (attempt ${nextAttempt}/${CREDENTIAL_REFRESH_MAX_RETRIES}):`, error);
-				this.deps.notifier.onError(error instanceof Error ? error : new Error(String(error), { cause: error }));
-				if (nextAttempt < CREDENTIAL_REFRESH_MAX_RETRIES) this.scheduleDeveloperRefresh(provider, expiresAt, nextAttempt);
-				else {
-					logger$6.error("[Coordinator] Credential refresh exhausted all retries. Disconnecting.");
-					this.deps.notifier.onError(new TokenRefreshError("Credential refresh failed after max retries"));
-					this.deps.notifier.onRefreshExhausted();
-				}
+				await this.deps.notifier.onCredentialRefreshed(newCredentials);
+			} catch (reauthError) {
+				logger$6.warn("[Coordinator] onCredentialRefreshed rejected (non-fatal):", reauthError);
 			}
-		}, refreshInterval);
+			logger$6.info("[Coordinator] Credentials refreshed successfully.");
+			if (newCredentials.expiry_at) this.scheduleDeveloperRefresh(provider, newCredentials.expiry_at, 0);
+		} catch (error) {
+			const nextAttempt = attempt + 1;
+			logger$6.error(`[Coordinator] Credential refresh failed (attempt ${nextAttempt}/${CREDENTIAL_REFRESH_MAX_RETRIES}):`, error);
+			this.deps.notifier.onError(error instanceof Error ? error : new Error(String(error), { cause: error }));
+			if (nextAttempt < CREDENTIAL_REFRESH_MAX_RETRIES) this.scheduleDeveloperRefresh(provider, expiresAt, nextAttempt);
+			else {
+				logger$6.error("[Coordinator] Credential refresh exhausted all retries. Disconnecting.");
+				this.deps.notifier.onError(new TokenRefreshError("Credential refresh failed after max retries"));
+				this.deps.notifier.onRefreshExhausted();
+			}
+		} finally {
+			this._developerRefreshInProgress = false;
+		}
+	}
+	/**
+	* Force an immediate refresh when the current credential is already past its
+	* scheduled refresh window. Called on resume from suspension, where
+	* background-tab timer throttling can delay the armed refresh well past
+	* expiry, leaving the live session stale.
+	*
+	* Routes to whichever mechanism is armed: the developer timer if armed,
+	* otherwise the Client Bound SAT pipeline. A no-op when nothing is due.
+	*/
+	forceRefreshIfDue() {
+		if (this._developerTimerId !== void 0 && this._activeProvider) {
+			const expiry = this.deps.store.read().expiry_at;
+			if (expiry !== void 0 && Date.now() >= expiry - CREDENTIAL_REFRESH_BUFFER_MS) {
+				logger$6.debug("[Coordinator] Resume: credential past refresh window; forcing refresh");
+				clearTimeout(this._developerTimerId);
+				this._developerTimerId = void 0;
+				this.executeDeveloperRefresh(this._activeProvider, expiry, 0);
+			}
+			return;
+		}
+		this._deviceTokenManager?.refreshNowIfDue();
+	}
+	/**
+	* Sync the credential's expiry from the server-provided authorization (the
+	* `signalwire.connect` result). SATs are opaque JWE, so
+	* `fabric_subscriber.expires_at` is the authoritative expiry of the token
+	* the session actually connected with — the provider-reported `expiry_at`
+	* is only a hint (and may be wrong or absent). Corrects the stored
+	* credential and re-arms the developer refresh timer against the real
+	* deadline when the provider supports `refresh()`.
+	*/
+	syncExpiryFromAuthorization(authorization, provider) {
+		const expiresAtSec = authorization?.fabric_subscriber?.expires_at;
+		if (!expiresAtSec) return;
+		const expiryAt = expiresAtSec * 1e3;
+		const credential = this.deps.store.read();
+		if (credential.expiry_at === expiryAt) return;
+		logger$6.debug(`[Coordinator] Correcting credential expiry from server authorization: ${new Date(expiryAt).toISOString()}`);
+		const updated = {
+			...credential,
+			expiry_at: expiryAt
+		};
+		this.deps.store.write(updated);
+		this.deps.store.persist(updated);
+		if (provider?.refresh) this.scheduleDeveloperRefresh(provider, expiryAt);
+	}
+	/**
+	* Invoke `provider.refresh()` deduped against any concurrent developer
+	* refresh. Concurrent callers — the scheduled tick, a resume-forced refresh,
+	* and the orchestrator's -32003 recovery / reconnect re-mint — share one
+	* in-flight promise, so a provider backed by one-time-use rotating refresh
+	* tokens is never invoked twice in parallel.
+	*
+	* The caller owns applying the returned credential (store write, session
+	* reauth, rescheduling); this method only serializes the network call.
+	*/
+	async refreshCredential(provider) {
+		if (this._refreshInFlight) return this._refreshInFlight;
+		if (!provider.refresh) throw new InvalidCredentialsError("Credential provider does not support refresh");
+		const run = provider.refresh();
+		this._refreshInFlight = run;
+		const clear = () => {
+			if (this._refreshInFlight === run) this._refreshInFlight = void 0;
+		};
+		run.then(clear, clear);
+		return run;
 	}
 	/**
 	* Cancels any scheduled developer-provided refresh. Idempotent.
@@ -21549,6 +21694,33 @@ var TransportManager = class extends Destroyable {
 	}
 };
 
+//#endregion
+//#region src/utils/authRecovery.ts
+/**
+* Walk an error's `error`/`cause` chain looking for a {@link JSONRPCError}.
+* Errors thrown by call creation are wrapped (e.g. `CallCreateError`), so the
+* underlying signaling error is nested. Bounded by a visited set to guard
+* against cyclic causes.
+*/
+function findJSONRPCError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current instanceof Error && !seen.has(current)) {
+		seen.add(current);
+		if (current instanceof JSONRPCError) return current;
+		current = current.error ?? current.cause;
+	}
+}
+/**
+* Whether an error is a session-recoverable authentication failure
+* (`-32002` authentication failed or `-32003` requester validation failed)
+* that a credential re-mint + retry can heal.
+*/
+function isRecoverableAuthError(error) {
+	const rpcError = findJSONRPCError(error);
+	return rpcError !== void 0 && (rpcError.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || rpcError.code === RPC_ERROR_AUTHENTICATION_FAILED);
+}
+
 //#endregion
 //#region src/clients/SignalWire.ts
 var import_cjs$1 = require_cjs();
@@ -21664,7 +21836,8 @@ var SignalWire = class extends Destroyable {
 			notifier: {
 				onError: (error) => this._errors$.next(error),
 				onWarning: (warning) => this._warnings$.next(warning),
-				onRefreshExhausted: () => void this.disconnect()
+				onRefreshExhausted: () => void this.disconnect(),
+				onCredentialRefreshed: async (credential) => this.reauthenticateLiveSession(credential)
 			},
 			store: {
 				read: () => this._deps.credential,
@@ -21676,6 +21849,7 @@ var SignalWire = class extends Destroyable {
 						...this._deps.credential,
 						...partial
 					};
+					this.persistCredential(this._deps.credential);
 				},
 				persist: (credential) => this.persistCredential(credential)
 			}
@@ -21721,14 +21895,123 @@ var SignalWire = class extends Destroyable {
 		}
 		this._deps.credential = _credentials;
 		this.persistCredential(_credentials);
-		if (this.isConnected && this._clientSession.authenticated && _credentials.token) try {
-			await this._clientSession.reauthenticate(_credentials.token);
+		await this.reauthenticateLiveSession(_credentials);
+	}
+	/**
+	* Reauthenticate the currently-open session with a freshly obtained
+	* credential so the new token takes effect on the live socket immediately —
+	* not just on the next reconnect. No-op when the session is not
+	* connected/authenticated or the credential carries no token (e.g. an
+	* authorization-state-only refresh). Non-fatal: reauth failures surface on
+	* `errors$` without aborting the refresh that triggered this.
+	*/
+	async reauthenticateLiveSession(credential) {
+		if (!this.isConnected || !this._clientSession.authenticated || !credential.token) return;
+		try {
+			await this._clientSession.reauthenticate(credential.token);
 			logger$1.info("[SignalWire] Session refreshed with new credentials.");
 		} catch (error) {
 			logger$1.error("[SignalWire] Failed to refresh session with new credentials:", error);
 			this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
 		}
 	}
+	/**
+	* One-shot recovery for a live session that failed with a recoverable auth
+	* error (`-32002`/`-32003`) because its token went stale — e.g. a refresh
+	* timer that was throttled while the tab was backgrounded.
+	*
+	* Two steps, first that succeeds wins:
+	*   1. Reauthenticate with the in-memory token (a fresh DPoP proof is
+	*      generated automatically). Heals a session whose token was already
+	*      refreshed by the coordinator but never applied to the open socket,
+	*      and a client-bound session whose server-side auth merely drifted.
+	*   2. Re-mint via the developer provider's `refresh()` and reauthenticate.
+	*      Skipped for client-bound sessions (the DeviceTokenManager owns their
+	*      refresh; re-minting a base SAT here would drop the DPoP binding).
+	*
+	* @param allowRemint - Whether step 2 (provider re-mint) may run. Callers
+	*   pass `false` for non-auth failures so a transient network error never
+	*   escalates to a token re-mint; step 1 (in-memory reauth) always runs.
+	* @returns `true` if the session was reauthenticated, `false` otherwise.
+	*/
+	async recoverStaleCredential(allowRemint = true) {
+		const currentToken = this._deps.credential.token;
+		if (currentToken) try {
+			await this._clientSession.reauthenticate(currentToken);
+			return true;
+		} catch (error) {
+			logger$1.debug("[SignalWire] In-memory reauth failed during recovery:", error);
+		}
+		if (!allowRemint || this._clientSession.clientBound || !this._credentialProvider?.refresh) return false;
+		try {
+			const newCredentials = await this.remintCredential(this._credentialProvider);
+			if (!newCredentials.token) return false;
+			this._deps.credential = newCredentials;
+			this.persistCredential(newCredentials);
+			await this._clientSession.reauthenticate(newCredentials.token);
+			if (newCredentials.expiry_at) this._refreshCoordinator?.scheduleDeveloperRefresh(this._credentialProvider, newCredentials.expiry_at);
+			return true;
+		} catch (error) {
+			logger$1.error("[SignalWire] Credential recovery failed:", error);
+			return false;
+		}
+	}
+	/**
+	* Re-mint a credential via `provider.refresh()`, routed through the
+	* coordinator's shared in-flight guard so concurrent re-mint paths (a
+	* scheduled/resume refresh, -32003 recovery, and reconnect) never fire a
+	* second `provider.refresh()` in parallel — which rotating one-time-use
+	* refresh tokens reject. Falls back to a direct call only if the coordinator
+	* has not been constructed yet.
+	*/
+	async remintCredential(provider) {
+		if (this._refreshCoordinator) return this._refreshCoordinator.refreshCredential(provider);
+		if (!provider.refresh) throw new InvalidCredentialsError("Credential provider does not support refresh");
+		return provider.refresh();
+	}
+	/**
+	* Re-mint credentials before a fresh (re)connect (`onBeforeReconnect` hook).
+	* The session invokes this only when it is client-bound OR the in-memory
+	* token is expired. The re-mint mechanism depends on the binding:
+	*   - Client-bound: `authenticate()` with the DPoP fingerprint to obtain a
+	*     fresh base SAT the upcoming reconnect can re-bind (the
+	*     DeviceTokenManager re-activates afterwards).
+	*   - Unbound: the developer's non-interactive `refresh()` handler.
+	*     `authenticate()` is deliberately NOT used here — it may be interactive
+	*     (a login prompt) and must not fire on a background reconnect.
+	*
+	* Rejects on failure so the session aborts the reconnect rather than
+	* replaying a stale token.
+	*/
+	async refreshCredentialForReconnect() {
+		if (!this._credentialProvider) return;
+		try {
+			let newCredentials;
+			if (this._clientSession.clientBound) {
+				const fingerprint = this._dpopManager?.initialized ? this._dpopManager.fingerprint : void 0;
+				logger$1.debug("[SignalWire] Re-minting client-bound base SAT before reconnect");
+				newCredentials = await this._credentialProvider.authenticate(fingerprint ? { fingerprint } : void 0);
+			} else if (this._credentialProvider.refresh) {
+				logger$1.debug("[SignalWire] Refreshing unbound credential before reconnect");
+				newCredentials = await this.remintCredential(this._credentialProvider);
+			} else {
+				logger$1.warn("[SignalWire] [SW-NO-REFRESH-HANDLER] Token expired on reconnect but no refresh handler; reconnecting with the existing token.");
+				return;
+			}
+			if (!newCredentials.token) {
+				logger$1.warn("[SignalWire] Re-minted credential has no token; keeping the existing credential for reconnect.");
+				return;
+			}
+			this._deps.credential = newCredentials;
+			this.persistCredential(newCredentials);
+			if (newCredentials.expiry_at && this._credentialProvider.refresh) this._refreshCoordinator?.scheduleDeveloperRefresh(this._credentialProvider, newCredentials.expiry_at);
+			logger$1.debug("[SignalWire] Credential refreshed successfully for reconnect");
+		} catch (error) {
+			logger$1.error("[SignalWire] Failed to refresh credentials for reconnect:", error);
+			this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
+			throw error;
+		}
+	}
 	/** Persist credential to localStorage when persistSession is enabled. */
 	persistCredential(credential) {
 		if (!credential.token) return;
@@ -21815,24 +22098,13 @@ var SignalWire = class extends Destroyable {
 		this._attachManager = new AttachManager(this._deps.storage, this._deps.deviceController, PreferencesContainer.instance.reconnectCallsTimeout, this._deps.attachedCallsKey);
 		this._clientSession = new ClientSessionManager(() => this._deps.credential, this._transport, this._deps.storage, this._deps.authorizationStateKey, this._deps.deviceController, this._attachManager, this._deps.webRTCApiProvider, this._dpopManager, this._networkMonitor?.networkChange$);
 		this._publicSession = new ClientSessionWrapper(this._clientSession);
-		this._clientSession.onBeforeReconnect = async () => {
-			if (!this._credentialProvider) return;
-			try {
-				const fingerprint = this._dpopManager?.initialized ? this._dpopManager.fingerprint : void 0;
-				logger$1.debug("[SignalWire] Credential expired, refreshing before reconnect");
-				const newCredentials = await this._credentialProvider.authenticate(fingerprint ? { fingerprint } : void 0);
-				this._deps.credential = newCredentials;
-				if (newCredentials.expiry_at && this._credentialProvider.refresh) this._refreshCoordinator?.scheduleDeveloperRefresh(this._credentialProvider, newCredentials.expiry_at);
-				logger$1.debug("[SignalWire] Credential refreshed successfully for reconnect");
-			} catch (error) {
-				logger$1.error("[SignalWire] Failed to refresh credentials for reconnect:", error);
-				this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
-				throw error;
-			}
-		};
+		this._clientSession.onBeforeReconnect = async () => this.refreshCredentialForReconnect();
 		this.subscribeTo(this._clientSession.errors$, (error) => {
 			this._errors$.next(error);
 		});
+		this.subscribeTo(this._clientSession.authorization$, (authorization) => {
+			this._refreshCoordinator?.syncExpiryFromAuthorization(authorization, this._credentialProvider);
+		});
 		await this._clientSession.connect();
 		await this._refreshCoordinator?.activate(this._deps.user, this._clientSession);
 		this.subscribeTo(this._clientSession.authenticated$.pipe((0, import_cjs$1.skip)(1), (0, import_cjs$1.filter)(Boolean)), async () => {
@@ -21995,6 +22267,13 @@ var SignalWire = class extends Destroyable {
 		}
 		try {
 			this._visibilityController = new VisibilityController();
+			this.subscribeTo(this._visibilityController.visibilityChange$.pipe((0, import_cjs$1.filter)((event) => event.to === "visible")), () => {
+				try {
+					this._refreshCoordinator?.forceRefreshIfDue();
+				} catch (error) {
+					logger$1.warn("[SignalWire] Resume credential revalidation failed (non-fatal):", error);
+				}
+			});
 			this.subscribeTo(this._visibilityController.visibilityChange$.pipe((0, import_cjs$1.filter)((event) => event.to === "visible" && PreferencesContainer.instance.refreshDevicesOnVisible)), () => {
 				logger$1.debug("[SignalWire] Page visible, re-enumerating devices");
 				try {
@@ -22077,21 +22356,23 @@ var SignalWire = class extends Destroyable {
 				this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
 				throw error;
 			}
-			logger$1.debug("[SignalWire] Failed to register user, trying reauthentication...");
-			try {
-				await this._clientSession.reauthenticate(this._deps.credential.token);
-				logger$1.debug("[SignalWire] Reauthentication successful, retrying register()");
+			logger$1.debug("[SignalWire] Failed to register user, attempting credential recovery...");
+			let failureCause = error;
+			if (await this.recoverStaleCredential(isRecoverableAuthError(error))) try {
+				logger$1.debug("[SignalWire] Recovery succeeded, retrying register()");
 				await this._transport.execute(RPCExecute({
 					method: "subscriber.online",
 					params: {}
 				}));
 				this._isRegistered$.next(true);
-			} catch (reauthError) {
-				logger$1.error("[SignalWire] Reauthentication failed during register():", reauthError);
-				const registerError = new InvalidCredentialsError("Failed to register user, and reauthentication attempt also failed. Please check your credentials.", { cause: reauthError instanceof Error ? reauthError : new Error(String(reauthError), { cause: reauthError }) });
-				this._errors$.next(registerError);
-				throw registerError;
+				return;
+			} catch (retryError) {
+				logger$1.error("[SignalWire] Register retry after recovery failed:", retryError);
+				failureCause = retryError;
 			}
+			const registerError = new InvalidCredentialsError("Failed to register user, and credential recovery also failed. Please check your credentials.", { cause: failureCause instanceof Error ? failureCause : new Error(String(failureCause), { cause: failureCause }) });
+			this._errors$.next(registerError);
+			throw registerError;
 		}
 	}
 	/**
@@ -22144,7 +22425,15 @@ var SignalWire = class extends Destroyable {
 		};
 		await this.waitAuthentication();
 		logger$1.debug("[SignalWire] Dialing with options:", computed_options);
-		return this._clientSession.createOutboundCall(destination, computed_options);
+		try {
+			return await this._clientSession.createOutboundCall(destination, computed_options);
+		} catch (error) {
+			if (!isRecoverableAuthError(error)) throw error;
+			logger$1.debug("[SignalWire] Dial hit a recoverable auth error; recovering credential and retrying once");
+			if (!await this.recoverStaleCredential()) throw error;
+			await this.waitAuthentication();
+			return this._clientSession.createOutboundCall(destination, computed_options);
+		}
 	}
 	/**
 	* Runs a multi-phase connectivity test against the given destination.
@@ -22426,9 +22715,10 @@ var SignalWire = class extends Destroyable {
 		this._refreshCoordinator?.destroy();
 		this._refreshCoordinator = void 0;
 		this._dpopManager?.destroy();
-		this._clientSession.teardownSessionState();
-		this._transport.destroy();
-		this._clientSession.destroy();
+		const session = this._clientSession;
+		session?.teardownSessionState();
+		this._transport?.destroy();
+		session?.destroy();
 		try {
 			this._networkMonitor?.destroy();
 		} catch {}