@signalwire/js 4.0.0-dev-20260804221355 → 4.0.0-dev-20260908172838

package/dist/browser.mjs

@@ -12374,15 +12374,57 @@ const RPCEventAckResponse = (id) => makeRPCResponse({
 	result: {}
 });
 
+//#endregion
+//#region src/utils/authRecovery.ts
+/**
+* Walk an error's `error`/`cause` chain looking for a {@link JSONRPCError}.
+* Errors thrown by call creation are wrapped (e.g. `CallCreateError`), so the
+* underlying signaling error is nested. Bounded by a visited set to guard
+* against cyclic causes.
+*/
+function findJSONRPCError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current instanceof Error && !seen.has(current)) {
+		seen.add(current);
+		if (current instanceof JSONRPCError) return current;
+		current = current.error ?? current.cause;
+	}
+}
+/**
+* Whether an error is a session-recoverable authentication failure
+* (`-32002` authentication failed or `-32003` requester validation failed)
+* that a credential re-mint + retry can heal.
+*/
+function isRecoverableAuthError(error) {
+	const rpcError = findJSONRPCError(error);
+	return rpcError !== void 0 && (rpcError.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || rpcError.code === RPC_ERROR_AUTHENTICATION_FAILED);
+}
+/**
+* Whether an error is specifically a requester-validation rejection
+* (`-32003`) — the server refusing the session's credential.
+*
+* Narrower than {@link isRecoverableAuthError} on purpose. `-32002` is
+* overloaded server-side: a rejected reattach arrives as `-32002` with
+* `cause: INVALID_MSG_UNSPECIFIED` and message `CALL ERROR`, which is a
+* call-level rejection and says nothing about the credential. Use this where
+* the decision must not be fooled by that, such as deciding whether retrying
+* an operation could possibly succeed.
+*/
+function isRequesterValidationError(error) {
+	return findJSONRPCError(error)?.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED;
+}
+
 //#endregion
 //#region src/managers/AttachManager.ts
 const logger$25 = getLogger();
 var AttachManager = class {
-	constructor(storage, deviceController, reconnectCallsTimeout, attachKey) {
+	constructor(storage, deviceController, reconnectCallsTimeout, attachKey, credentialRecovered) {
 		this.storage = storage;
 		this.deviceController = deviceController;
 		this.reconnectCallsTimeout = reconnectCallsTimeout;
 		this.attachKey = attachKey;
+		this.credentialRecovered = credentialRecovered;
 		this.writeQueue = Promise.resolve();
 	}
 	async detachAll() {
@@ -12462,8 +12504,14 @@ var AttachManager = class {
 	* rejecting. Once that fix is deployed, this will work for both
 	* page reloads and WebSocket reconnects.
 	*
-	* Failed reattach attempts are handled gracefully — the stale call
-	* reference is cleaned up from storage.
+	* A failed reattach does NOT generally cost the stored reference. It is
+	* discarded only when the server denied the reattach on a session whose
+	* credential it had already accepted — a verified reauthentication followed
+	* by a refusal is the server saying the call is gone, and that is the one
+	* refusal worth acting on. Until then the credential may be what is being
+	* refused, and the record is the only way a later reload can try again;
+	* keeping it costs nothing, since `detachExpired` reaps it once it is older
+	* than `reconnectCallsTimeout`.
 	*/
 	async reattachCalls() {
 		const attached = await this.readAttached();
@@ -12472,6 +12520,7 @@ var AttachManager = class {
 			const { destination } = attachment;
 			const options = this.buildCallOptions(attachment);
 			let succeeded = false;
+			let refusedOnCredentials = false;
 			for (let attempt = 1; attempt <= 3; attempt++) try {
 				await this.session.createOutboundCall(destination, {
 					callId,
@@ -12482,15 +12531,20 @@ var AttachManager = class {
 				break;
 			} catch (error) {
 				logger$25.warn(`[AttachManager] Reattach attempt ${attempt}/3 failed for call ${callId}:`, error);
+				if (isRequesterValidationError(error)) {
+					refusedOnCredentials = true;
+					logger$25.warn(`[AttachManager] Reattach of ${callId} was refused on credentials; not retrying.`);
+					break;
+				}
 				if (attempt < 3) await new Promise((r) => setTimeout(r, (attempt + 1) * 1e3));
 			}
-			if (!succeeded) {
-				logger$25.warn(`[AttachManager] Reattach failed after 3 attempts for call ${callId}, removing reference`);
+			if (!succeeded) if (this.credentialRecovered() && !refusedOnCredentials) {
+				logger$25.warn(`[AttachManager] Reattach of ${callId} was denied after a verified reauthentication, removing reference`);
 				await this.detach({
 					id: callId,
 					mediaDirections: attachment.mediaDirections
 				});
-			}
+			} else logger$25.warn(`[AttachManager] Reattach failed for call ${callId}; keeping the reference (credential refused or never proven good)`);
 		}
 	}
 	/**
@@ -14700,9 +14754,14 @@ var CallEventsManager = class extends Destroyable {
 	updateLayouts() {
 		if (!this.selfId) return;
 		this.webRtcCallSession.executeMethod(this.selfId, "call.layout.list", {}).then((response) => {
+			const layouts = response.result?.layouts;
+			if (!layouts) {
+				logger$22.warn("[CallEventsManager] Layout list response carried no layouts; keeping current layouts");
+				return;
+			}
 			this._sessionState$.next({
 				...this._sessionState$.value,
-				layouts: response.result.layouts
+				layouts
 			});
 		}).catch((error) => {
 			logger$22.error("[CallEventsManager] Error fetching layouts:", error);
@@ -16707,6 +16766,48 @@ const logger$16 = getLogger();
 function resolveInviteNodeId(args) {
 	return args.isInvite && !args.reattach && !args.explicitNodeId ? "" : args.currentNodeId ?? "";
 }
+/**
+* Surface the real outcome of a `webrtc.verto` reply.
+*
+* A webrtc.verto response nests several envelopes, each keyed by a verto-style
+* string `code` ("200" ok, "400"/etc. fail) rather than a JSON-RPC `error`. An outer
+* layer reports only whether the frame was delivered; an inner layer carries the op's
+* own outcome:
+*
+*   response.result = { code:"200", result:{…} }            ← delivery acknowledgement
+*     .result       = { jsonrpc, id, result:{…} }           ← the reply payload
+*       .result     = { code:"400", message:"Bad request" } ← the actual op outcome
+*
+* A failure can appear at any layer (delivery refused, or the op itself rejected
+* deeper down), so walk every nested `.result` object and return the FIRST non-2xx
+* `code` with its message. Returns null when every `code` seen is 2xx or absent —
+* i.e. the op succeeded. This is the only way to detect that e.g. a mute/kick was
+* rejected, since the outer delivery `code` is "200" (delivered) even then.
+*
+* Pure function — exported for unit testing.
+*/
+function findNestedVertoFailure(response) {
+	let node = response;
+	while (node !== null && typeof node === "object") {
+		const obj = node;
+		const err = obj.error;
+		if (err !== null && typeof err === "object") {
+			const e = err;
+			const errCode = typeof e.code === "string" || typeof e.code === "number" ? String(e.code) : void 0;
+			if (errCode !== void 0 && !/^2\d\d$/.test(errCode)) return {
+				code: errCode,
+				message: typeof e.message === "string" ? e.message : void 0
+			};
+		}
+		const code = typeof obj.code === "string" || typeof obj.code === "number" ? String(obj.code) : void 0;
+		if (code !== void 0 && !/^2\d\d$/.test(code)) return {
+			code,
+			message: typeof obj.message === "string" ? obj.message : void 0
+		};
+		node = obj.result !== null && typeof obj.result === "object" ? obj.result : null;
+	}
+	return null;
+}
 var VertoManager = class extends Destroyable {
 	constructor(callSession) {
 		super();
@@ -17031,6 +17132,33 @@ var WebRTCVertoManager = class extends VertoManager {
 	get vertoPing$() {
 		return this.cachedObservable("vertoPing$", () => this.webRtcCallSession.webrtcMessages$.pipe(filterAs(isVertoPingInnerParams, "params"), (0, import_cjs$15.takeUntil)(this.destroyed$)));
 	}
+	/**
+	* Send a member-control op in-dialog via verto.info.
+	*
+	* The control payload rides in `params.command` — a sibling of `dialogParams`,
+	* at the same level as `dtmf` in {@link sendDigits} — and the inner verto.info
+	* is matched to this call's channel by `dialogParams.callID`, the in-dialog
+	* convention for member-scoped frames. Because it is delivered on the dialog
+	* itself, control lands on the call's own channel with no {node_id,call_id,member_id}
+	* "self" tuple to get wrong. The outer webrtc.verto envelope (added by executeVerto)
+	* still carries the own-leg callID + node_id for session routing.
+	*
+	* Keep `command` OUT of `dialogParams`: it is read at the params level, and
+	* filterVertoParams rewrites/filters dialogParams keys but passes params-level
+	* keys through verbatim.
+	*/
+	async sendCallControl(method, params) {
+		const response = await this.executeVerto(VertoInfo({
+			dialogParams: { callID: this.webRtcCallSession.id },
+			command: {
+				method,
+				params
+			}
+		}));
+		const failure = findNestedVertoFailure(response);
+		if (failure) throw new JSONRPCError(Number.parseInt(failure.code, 10) || 0, `Call control "${method}" failed (code ${failure.code})${failure.message ? `: ${failure.message}` : ""}`, void 0);
+		return response;
+	}
 	async executeVerto(message, optionals = {}) {
 		const webrtcVertoMessage = WebrtcVerto({
 			callID: optionals.callID ?? this.webRtcCallSession.id,
@@ -17039,15 +17167,16 @@ var WebRTCVertoManager = class extends VertoManager {
 			subscribe: optionals.subscribe
 		});
 		const response = await this.webRtcCallSession.execute(webrtcVertoMessage);
+		const nonFatal = message.method === "verto.info" ? { fatal: false } : void 0;
 		if (response.error) {
 			const error = new JSONRPCError(response.error.code, response.error.message, response.error.data);
-			this.onError?.(error);
+			this.onError?.(error, nonFatal);
 			return response;
 		}
 		const innerResult = getValueFrom(response, "result.result");
 		if (innerResult?.error) {
 			const error = new JSONRPCError(innerResult.error.code, innerResult.error.message, innerResult.error.data);
-			this.onError?.(error);
+			this.onError?.(error, nonFatal);
 			return response;
 		}
 		return response;
@@ -18335,6 +18464,33 @@ function mosToQualityLevel(mos) {
 	return "critical";
 }
 
+//#endregion
+//#region src/utils/unwrapVertoReply.ts
+/**
+* Unwrap a method's own reply from a `webrtc.verto` envelope.
+*
+* A control verb sent in-dialog comes back nested two levels deep:
+*
+* ```
+* { result: { node_id, code, result: { jsonrpc, id, result: <method payload> } } }
+* ```
+*
+* whereas the routed transport resolves the method payload directly under
+* `.result`. Readers want the latter shape, and the difference is silent when it
+* is wrong — `response.result.layouts` simply evaluates to `undefined` against the
+* envelope, so the data arrives, nothing throws, and the caller sees an empty
+* value. That exact failure produced an empty layout dropdown with a successful
+* request behind it.
+*
+* Accepting both shapes here keeps every reader indifferent to which transport
+* produced the response. Anything that is not a nested envelope (a plain ack, or
+* an already-unwrapped reply) passes through untouched.
+*/
+function unwrapVertoReply(response) {
+	const inner = getValueFrom(response, "result.result");
+	return inner && typeof inner === "object" && "result" in inner ? inner : response;
+}
+
 //#endregion
 //#region src/core/entities/Call.ts
 var import_cjs$11 = require_cjs();
@@ -18434,8 +18590,11 @@ var WebRTCCall = class extends Destroyable {
 	emitError(callError) {
 		if (this._status$.value === "destroyed" || this._status$.value === "failed") return;
 		this._errors$.next(callError);
-		if (callError.fatal) {
+		if (callError.fatal && this._status$.value !== "disconnecting") {
 			this._status$.next("failed");
+			this.vertoManager.bye().catch((error) => {
+				logger$12.debug("[Call] fatal-teardown bye failed (signaling likely already dead):", error);
+			});
 			this.destroy();
 		}
 	}
@@ -18552,6 +18711,7 @@ var WebRTCCall = class extends Destroyable {
 	async executeMethod(target, method, args) {
 		const self = this.callSelf;
 		if (typeof target === "string" && target !== self.member_id) throw new InvalidParams(`Target member ID ${target} does not match call's self member ID ${self.member_id}`);
+		if (this.clientSession.callControl === "in-dialog") return this.executeMethodInDialog(target, method, args);
 		const params = {
 			...args,
 			self,
@@ -18571,6 +18731,81 @@ var WebRTCCall = class extends Destroyable {
 		}
 	}
 	/**
+	* `executeMethod` for a call opened with `callControl: 'in-dialog'`.
+	*
+	* Translates the routed transport's calling convention into the in-dialog one. No
+	* `self` tuple is sent, but a `target` is — the same {call_id, member_id} the routed
+	* transport puts in `target` (minus node_id), for self-ops and cross-member ops alike.
+	*
+	* Target shapes are per-verb and irregular, so they are centralised here rather
+	* than left to callers: most verbs take a singular `target`, `call.member.remove`
+	* takes a plural `targets` array, and `call.member.position.set` takes a flat
+	* `targets` of `{call_id, position}` — the one verb keyed on call_id rather than
+	* member_id, so the member triple `Participant.setPosition` built is unwrapped.
+	*/
+	async executeMethodInDialog(target, method, args) {
+		const control = { ...args };
+		if (method === "call.member.position.set") control.targets = (args.targets ?? []).map((entry) => ({
+			call_id: entry.target?.call_id ?? entry.call_id,
+			position: entry.position
+		}));
+		else {
+			const member = typeof target === "object" ? {
+				call_id: target.call_id,
+				member_id: target.member_id
+			} : {
+				call_id: this.id,
+				member_id: target
+			};
+			if (method === "call.member.remove") control.targets = [member];
+			else control.target = member;
+		}
+		return this.sendCommand(method, control);
+	}
+	/**
+	* Sends a `call.*` control verb **in-dialog** via `verto.info`, as an alternative
+	* to the routed {@link executeMethod} transport.
+	*
+	* Why both exist: `executeMethod` addresses the member with an explicit
+	* `{node_id, call_id, member_id}` tuple, which does not resolve for every conference,
+	* so the op can fail. An in-dialog frame carries the verb on the member's own
+	* signaling channel instead, so control works without the client needing to know how
+	* the conference is hosted.
+	*
+	* The trade-off is reach: the in-dialog transport is only accepted for calls that
+	* join a conference over SWML (e.g. an SWML `join_conference`); use the routed
+	* default otherwise.
+	*
+	* `params` are sent verbatim — nothing is built for you, which includes the target.
+	* **A self-directed op still needs one**, or it is refused; name yourself explicitly:
+	*
+	* ```ts
+	* const { call_id, member_id } = call.self.target;
+	* await call.sendCommand('call.mute', { channels: ['audio'], target: { call_id, member_id } });
+	* ```
+	*
+	* Never include `node_id` — only the two ids. The shapes are per-verb: most take a
+	* singular `target`, `call.member.remove` takes a plural `targets` array, and
+	* `call.member.position.set` takes a flat `targets: [{call_id, position}]` (the one
+	* verb keyed on `call_id` rather than `member_id`). Verbs that act on the call as a
+	* whole, or that the SDK does not wrap at all, take no target.
+	*
+	* For the typed alternative that handles all of this, create the client with
+	* `callControl: 'in-dialog'` and use the ordinary `Call`/`Participant` methods.
+	*
+	* @internal Not part of the supported surface while the in-dialog transport is still
+	* rolling out. `WebRTCCall` is exported from the package entry, so without this tag
+	* TypeDoc publishes the method — and the example above — as public API.
+	*
+	* @param method - A `call.*` method name (e.g. `'call.mute'`).
+	* @param params - Method parameters, sent verbatim.
+	* @returns The method's own reply, unwrapped from the `verto.info` envelope.
+	* @throws {JSONRPCError} If the control op fails.
+	*/
+	async sendCommand(method, params = {}) {
+		return unwrapVertoReply(await this.vertoManager.sendCallControl(method, params));
+	}
+	/**
 	* The local leg's member triple — sent as `self` in every member RPC
 	* envelope, and as the `target` of call-scoped self-operations (e.g. lock,
 	* layout).
@@ -19901,6 +20136,7 @@ var ClientSessionManager = class extends Destroyable {
 			minor: 0,
 			revision: 0
 		};
+		this.callControl = "routed";
 		this._authorization$ = this.createBehaviorSubject(void 0);
 		this._errors$ = this.createReplaySubject(1);
 		this._authState$ = this.createBehaviorSubject({ kind: "unauthenticated" });
@@ -20105,17 +20341,14 @@ var ClientSessionManager = class extends Destroyable {
 		const hasStoredState = await (0, import_cjs$7.firstValueFrom)(this.authorizationState$.pipe((0, import_cjs$7.take)(1))) !== void 0;
 		if (isRecoverableAuthError$1 && hasStoredState) {
 			logger$9.debug("[Session] Recoverable auth error — cleaning up stored state and reconnecting fresh");
-			try {
-				await this.cleanupStoredConnectionParams();
-			} catch (cleanupError) {
-				logger$9.error("Failed to cleanup stored connection params:", cleanupError);
-			} finally {
-				this.transport.reconnect();
-			}
+			await this.discardResumeStateAndReconnect();
 		} else this._errors$.next(error);
 	}
 	/**
-	* Clear the resume state (authorization_state + protocol) only.
+	* Clear the resume state (authorization_state + protocol) and ask the
+	* transport to reconnect. The `connected` event re-triggers
+	* `authenticate()`, which now has no stored state and so performs a fresh
+	* connect.
 	*
 	* This is the stale-auth-state recovery helper used by handleAuthError:
 	* the server rejected a reconnect, so the resume state is discarded and a
@@ -20123,9 +20356,24 @@ var ClientSessionManager = class extends Destroyable {
 	* session lives on through the reconnect and reattachCalls() needs the
 	* stored call references afterwards. Do NOT add detachAll() here.
 	*
+	* Connect-time recovery only. A *request* refused on an already
+	* authenticated session is never healed here: dropping the resume state
+	* destroys the association between the socket and the previous session,
+	* which is what reattach depends on. That path mints a fresh credential and
+	* reauthenticates instead (see `SignalWire.recoverAndRetry`).
+	*
 	* For public teardown (disconnect/destroy), use {@link teardownSessionState}
 	* instead, which clears the attach records as well.
 	*/
+	async discardResumeStateAndReconnect() {
+		try {
+			await this.cleanupStoredConnectionParams();
+		} catch (cleanupError) {
+			logger$9.error("Failed to cleanup stored connection params:", cleanupError);
+		} finally {
+			this.transport.reconnect();
+		}
+	}
 	async cleanupStoredConnectionParams() {
 		await this.transport.setProtocol(void 0);
 		await this.updateAuthorizationStateInStorage(void 0);
@@ -20374,6 +20622,9 @@ var ClientSessionWrapper = class {
 	get iceServers() {
 		return this.clientSessionManager.iceServers;
 	}
+	get callControl() {
+		return this.clientSessionManager.callControl;
+	}
 	async execute(request, options) {
 		return this.clientSessionManager.execute(request, options);
 	}
@@ -20614,7 +20865,7 @@ var DeviceTokenManager = class extends Destroyable {
 			method: "POST",
 			uri: DEVICE_TOKEN_ENDPOINT
 		});
-		const response = await this.http.request({
+		const response = await this.http().request({
 			url: DEVICE_TOKEN_ENDPOINT,
 			...POST_PARAMS,
 			body: JSON.stringify({
@@ -20641,7 +20892,7 @@ var DeviceTokenManager = class extends Destroyable {
 			uri: DEVICE_REFRESH_ENDPOINT,
 			accessToken: currentToken
 		});
-		const response = await this.http.request({
+		const response = await this.http().request({
 			url: DEVICE_REFRESH_ENDPOINT,
 			...POST_PARAMS,
 			body: JSON.stringify({
@@ -21694,37 +21945,17 @@ var TransportManager = class extends Destroyable {
 	}
 };
 
-//#endregion
-//#region src/utils/authRecovery.ts
-/**
-* Walk an error's `error`/`cause` chain looking for a {@link JSONRPCError}.
-* Errors thrown by call creation are wrapped (e.g. `CallCreateError`), so the
-* underlying signaling error is nested. Bounded by a visited set to guard
-* against cyclic causes.
-*/
-function findJSONRPCError(error) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current instanceof Error && !seen.has(current)) {
-		seen.add(current);
-		if (current instanceof JSONRPCError) return current;
-		current = current.error ?? current.cause;
-	}
-}
-/**
-* Whether an error is a session-recoverable authentication failure
-* (`-32002` authentication failed or `-32003` requester validation failed)
-* that a credential re-mint + retry can heal.
-*/
-function isRecoverableAuthError(error) {
-	const rpcError = findJSONRPCError(error);
-	return rpcError !== void 0 && (rpcError.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || rpcError.code === RPC_ERROR_AUTHENTICATION_FAILED);
-}
-
 //#endregion
 //#region src/clients/SignalWire.ts
 var import_cjs$1 = require_cjs();
 const logger$1 = getLogger();
+/**
+* Storage key for the client-bound marker. The SAT and authorization_state are
+* both opaque to the SDK, so on a page reload the preflight recovery — which
+* runs before any session exists — has no other way to know the session was
+* client-bound. See {@link SignalWire.persistClientBoundMarker}.
+*/
+const CLIENT_BOUND_STORAGE_KEY = "sw:client_bound";
 const buildOptionsFromDestination = (destination) => {
 	if (typeof destination === "string") {
 		const queryStartIndex = destination.indexOf("?");
@@ -21768,6 +21999,7 @@ var SignalWire = class extends Destroyable {
 		this.preferences = new ClientPreferences();
 		this._user$ = this.createBehaviorSubject(void 0);
 		this._directory$ = this.createBehaviorSubject(void 0);
+		this._credentialRecovered = false;
 		this._isConnected$ = this.createBehaviorSubject(false);
 		this._isRegistered$ = this.createBehaviorSubject(false);
 		this._errors$ = this.createReplaySubject(1);
@@ -21806,6 +22038,16 @@ var SignalWire = class extends Destroyable {
 		});
 	}
 	/**
+	* Build the refresh path's own HTTP controller, against whatever host is current.
+	*
+	* Called on first use rather than up front, so `apiHost` already reflects the
+	* token's `ch` claim. Same credential source as the container's controller — only
+	* the instance, and therefore its observable streams, is separate.
+	*/
+	createRefreshHttpController() {
+		return new HTTPRequestController(this._deps.apiHost, () => this._deps.credential);
+	}
+	/**
 	* Initializes DPoP if not already set up. Returns the fingerprint on success.
 	*/
 	async initDPoP() {
@@ -21832,7 +22074,14 @@ var SignalWire = class extends Destroyable {
 	async resolveCredentials() {
 		const fingerprint = await this.initDPoP();
 		this._refreshCoordinator = new CredentialRefreshCoordinator(this._dpopManager, {
-			http: this._deps.http,
+			http: () => {
+				if (!this._refreshHttp || this._refreshHttpHost !== this._deps.apiHost) {
+					this._refreshHttp?.destroy();
+					this._refreshHttp = this.createRefreshHttpController();
+					this._refreshHttpHost = this._deps.apiHost;
+				}
+				return this._refreshHttp;
+			},
 			notifier: {
 				onError: (error) => this._errors$.next(error),
 				onWarning: (warning) => this._warnings$.next(warning),
@@ -21916,43 +22165,76 @@ var SignalWire = class extends Destroyable {
 		}
 	}
 	/**
-	* One-shot recovery for a live session that failed with a recoverable auth
-	* error (`-32002`/`-32003`) because its token went stale — e.g. a refresh
-	* timer that was throttled while the tab was backgrounded.
+	* Recover a session the server is refusing: mint a fresh credential,
+	* reauthenticate the live session with it, and retry the operation.
 	*
-	* Two steps, first that succeeds wins:
-	*   1. Reauthenticate with the in-memory token (a fresh DPoP proof is
-	*      generated automatically). Heals a session whose token was already
-	*      refreshed by the coordinator but never applied to the open socket,
-	*      and a client-bound session whose server-side auth merely drifted.
-	*   2. Re-mint via the developer provider's `refresh()` and reauthenticate.
-	*      Skipped for client-bound sessions (the DeviceTokenManager owns their
-	*      refresh; re-minting a base SAT here would drop the DPoP binding).
+	* The connection is deliberately kept. A reload authenticates the new socket
+	* against the persisted `authorization_state`, and that handshake is what
+	* associates the socket with the previous session — the association reattach
+	* depends on. `signalwire.reauthenticate` swaps the credential *on that same
+	* session*, so recovery never touches the resume state. Discarding it would
+	* heal the credential by destroying the very thing the caller is trying to
+	* get back to.
 	*
-	* @param allowRemint - Whether step 2 (provider re-mint) may run. Callers
-	*   pass `false` for non-auth failures so a transient network error never
-	*   escalates to a token re-mint; step 1 (in-memory reauth) always runs.
-	* @returns `true` if the session was reauthenticated, `false` otherwise.
+	* The operation is still the verdict, never the RPC. Reauthenticating with
+	* the in-memory token is accepted by a resume even while requests stay
+	* refused, because the persisted `authorization_state` short-circuits token
+	* validation — and `signalwire.reauthenticate` with a *freshly minted* token
+	* has also been observed accepted while `subscriber.online` keeps being
+	* refused (staging run 33826974634). Both look like success and are not.
+	*
+	* @returns the operation's value, or the reason recovery could not deliver
+	*   one. `error` is undefined when there was no way to mint at all.
 	*/
-	async recoverStaleCredential(allowRemint = true) {
-		const currentToken = this._deps.credential.token;
-		if (currentToken) try {
-			await this._clientSession.reauthenticate(currentToken);
-			return true;
+	async recoverAndRetry(operation) {
+		if (!await this.remintAndReauthenticate()) return { ok: false };
+		try {
+			const value = await operation();
+			this._credentialRecovered = true;
+			return {
+				ok: true,
+				value
+			};
 		} catch (error) {
-			logger$1.debug("[SignalWire] In-memory reauth failed during recovery:", error);
+			logger$1.warn("[SignalWire] Reauthentication was accepted but the operation is still refused:", error);
+			return {
+				ok: false,
+				error
+			};
+		}
+	}
+	/**
+	* Re-mint a credential and adopt it only if the live session accepts it.
+	*
+	* The mechanism follows the binding: a client-bound session re-mints a bound
+	* base SAT through `authenticate()` with the DPoP fingerprint, because the
+	* developer refresh handler would hand back an unbound token and silently
+	* degrade the session. An unbound session uses the refresh handler. Rotation
+	* cost is not a reason to skip this — the only reason is having no mechanism.
+	*
+	* @returns whether the session is now running on a freshly accepted credential.
+	*/
+	async remintAndReauthenticate() {
+		const provider = this._credentialProvider;
+		if (!provider) return false;
+		const { clientBound } = this._clientSession;
+		if (!clientBound && !provider.refresh) {
+			logger$1.debug("[SignalWire] [SW-NO-REFRESH-HANDLER] Unbound session with no refresh handler; cannot re-mint.");
+			return false;
 		}
-		if (!allowRemint || this._clientSession.clientBound || !this._credentialProvider?.refresh) return false;
 		try {
-			const newCredentials = await this.remintCredential(this._credentialProvider);
-			if (!newCredentials.token) return false;
+			const newCredentials = clientBound ? await provider.authenticate(this._dpopManager?.initialized ? { fingerprint: this._dpopManager.fingerprint } : void 0) : await this.remintCredential(provider);
+			if (!newCredentials.token) {
+				logger$1.warn("[SignalWire] Re-minted credential has no token; keeping the current one.");
+				return false;
+			}
+			await this._clientSession.reauthenticate(newCredentials.token);
 			this._deps.credential = newCredentials;
 			this.persistCredential(newCredentials);
-			await this._clientSession.reauthenticate(newCredentials.token);
-			if (newCredentials.expiry_at) this._refreshCoordinator?.scheduleDeveloperRefresh(this._credentialProvider, newCredentials.expiry_at);
+			if (newCredentials.expiry_at && provider.refresh) this._refreshCoordinator?.scheduleDeveloperRefresh(provider, newCredentials.expiry_at);
 			return true;
 		} catch (error) {
-			logger$1.error("[SignalWire] Credential recovery failed:", error);
+			logger$1.warn("[SignalWire] Re-mint recovery failed:", error);
 			return false;
 		}
 	}
@@ -21987,10 +22269,9 @@ var SignalWire = class extends Destroyable {
 		if (!this._credentialProvider) return;
 		try {
 			let newCredentials;
-			if (this._clientSession.clientBound) {
-				const fingerprint = this._dpopManager?.initialized ? this._dpopManager.fingerprint : void 0;
+			if (this._clientSession?.clientBound ?? await this.wasClientBound()) {
 				logger$1.debug("[SignalWire] Re-minting client-bound base SAT before reconnect");
-				newCredentials = await this._credentialProvider.authenticate(fingerprint ? { fingerprint } : void 0);
+				newCredentials = await this._credentialProvider.authenticate(this._dpopManager?.initialized ? { fingerprint: this._dpopManager.fingerprint } : void 0);
 			} else if (this._credentialProvider.refresh) {
 				logger$1.debug("[SignalWire] Refreshing unbound credential before reconnect");
 				newCredentials = await this.remintCredential(this._credentialProvider);
@@ -22018,6 +22299,26 @@ var SignalWire = class extends Destroyable {
 		this._deps.storage.setItem("sw:cached_credential", credential);
 		if (this._deps.persistSession) this._deps.storage.setItem("sw:cached_credential", credential, "local");
 	}
+	/**
+	* Persist whether the session is client-bound, mirroring the credential's
+	* storage scopes so it survives a reload. The preflight recovery reads it
+	* before any session exists to decide whether to re-bind via `authenticate()`
+	* or refresh an unbound token; the marker tracks the latest binding, so an
+	* unbound reconnect clears a stale marker from an earlier client-bound login.
+	*/
+	persistClientBoundMarker(bound) {
+		const scopes = this._deps.persistSession ? ["session", "local"] : ["session"];
+		for (const scope of scopes) if (bound) this._deps.storage.setItem(CLIENT_BOUND_STORAGE_KEY, true, scope);
+		else this._deps.storage.removeItem(CLIENT_BOUND_STORAGE_KEY, scope);
+	}
+	/** Read the persisted client-bound marker (see {@link persistClientBoundMarker}). */
+	async wasClientBound() {
+		const scopes = this._deps.persistSession ? ["local", "session"] : ["session"];
+		for (const scope of scopes) try {
+			if (await this._deps.storage.getItem(CLIENT_BOUND_STORAGE_KEY, scope)) return true;
+		} catch {}
+		return false;
+	}
 	async init() {
 		this._user$.next(new User(this._deps.http));
 		if (!this._options.skipConnection) await this.connect();
@@ -22041,6 +22342,42 @@ var SignalWire = class extends Destroyable {
 		} catch (error) {
 			logger$1.error("[SignalWire] Failed to reattach calls:", error);
 			this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
+		} finally {
+			this._credentialRecovered = false;
+		}
+	}
+	/**
+	* Fetch the authenticated user profile, recovering a stale credential.
+	*
+	* On a reload the persisted credential can be expired. Unlike the WS resume —
+	* which the server accepts against the persisted `authorization_state` even
+	* with an expired token — this REST preflight has no such short-circuit and is
+	* refused (401). There is no session yet to reauthenticate, so recovery
+	* re-mints the credential through the provider ({@link refreshCredentialForReconnect})
+	* and retries with a FRESH {@link User}: Fetchable memoizes its result
+	* (shareReplay), so reusing the instance would replay the 401 instead of
+	* re-fetching with the new token. Without the user id the transport/session —
+	* and the reattach a reload is trying to preserve — cannot even be addressed.
+	*/
+	async fetchUserOrRecover() {
+		const fetchUser = async (user$1) => {
+			if (!await (0, import_cjs$1.firstValueFrom)(user$1.fetched$)) throw new UnexpectedError("Failed to fetch user information - fetched$ emitted false");
+			this._deps.user = user$1;
+		};
+		const user = this._user$.value;
+		if (!user) throw new UnexpectedError("User not initialized before connect");
+		try {
+			await fetchUser(user);
+		} catch (firstError) {
+			logger$1.error(`[SignalWire] Failed to fetch user information: ${firstError instanceof Error ? firstError.message : "Unknown error"}. This usually means the user token is invalid or expired. Re-minting the credential and retrying.`);
+			try {
+				await this.refreshCredentialForReconnect();
+				const refetched = new User(this._deps.http);
+				await fetchUser(refetched);
+				this._user$.next(refetched);
+			} catch (retryError) {
+				throw new UnexpectedError("Error fetching user information", { cause: retryError });
+			}
 		}
 	}
 	/**
@@ -22082,28 +22419,22 @@ var SignalWire = class extends Destroyable {
 	*/
 	async connect() {
 		await this.teardownTransportAndSession();
-		try {
-			const user = this._user$.value;
-			if (!user) throw new UnexpectedError("User not initialized before connect");
-			if (!await (0, import_cjs$1.firstValueFrom)(user.fetched$)) throw new UnexpectedError("Failed to fetch user information - fetched$ emitted false");
-			this._deps.user = user;
-		} catch (error) {
-			logger$1.error(`[SignalWire] Failed to fetch user information: ${error instanceof Error ? error.message : "Unknown error"}. This usually means the user token is invalid or expired.`);
-			throw new UnexpectedError("Error fetching user information", { cause: error });
-		}
+		await this.fetchUserOrRecover();
 		const errorHandler = (error) => {
 			this._errors$.next(error);
 		};
 		this._transport = new TransportManager(this._deps.storage, this._deps.protocolKey, this._deps.WebSocket, PreferencesContainer.instance.relayHost ?? this._deps.relayHost, errorHandler);
-		this._attachManager = new AttachManager(this._deps.storage, this._deps.deviceController, PreferencesContainer.instance.reconnectCallsTimeout, this._deps.attachedCallsKey);
+		this._attachManager = new AttachManager(this._deps.storage, this._deps.deviceController, PreferencesContainer.instance.reconnectCallsTimeout, this._deps.attachedCallsKey, () => this._credentialRecovered);
 		this._clientSession = new ClientSessionManager(() => this._deps.credential, this._transport, this._deps.storage, this._deps.authorizationStateKey, this._deps.deviceController, this._attachManager, this._deps.webRTCApiProvider, this._dpopManager, this._networkMonitor?.networkChange$);
 		this._publicSession = new ClientSessionWrapper(this._clientSession);
+		this._clientSession.callControl = this._options.callControl ?? "routed";
 		this._clientSession.onBeforeReconnect = async () => this.refreshCredentialForReconnect();
 		this.subscribeTo(this._clientSession.errors$, (error) => {
 			this._errors$.next(error);
 		});
 		this.subscribeTo(this._clientSession.authorization$, (authorization) => {
 			this._refreshCoordinator?.syncExpiryFromAuthorization(authorization, this._credentialProvider);
+			this.persistClientBoundMarker(Boolean(authorization?.cnf?.jkt));
 		});
 		await this._clientSession.connect();
 		await this._refreshCoordinator?.activate(this._deps.user, this._clientSession);
@@ -22357,19 +22688,18 @@ var SignalWire = class extends Destroyable {
 				throw error;
 			}
 			logger$1.debug("[SignalWire] Failed to register user, attempting credential recovery...");
-			let failureCause = error;
-			if (await this.recoverStaleCredential(isRecoverableAuthError(error))) try {
-				logger$1.debug("[SignalWire] Recovery succeeded, retrying register()");
+			const outcome = await this.recoverAndRetry(async () => {
 				await this._transport.execute(RPCExecute({
 					method: "subscriber.online",
 					params: {}
 				}));
+			});
+			if (outcome.ok) {
+				logger$1.debug("[SignalWire] Recovery restored registration");
 				this._isRegistered$.next(true);
 				return;
-			} catch (retryError) {
-				logger$1.error("[SignalWire] Register retry after recovery failed:", retryError);
-				failureCause = retryError;
 			}
+			const failureCause = outcome.error ?? error;
 			const registerError = new InvalidCredentialsError("Failed to register user, and credential recovery also failed. Please check your credentials.", { cause: failureCause instanceof Error ? failureCause : new Error(String(failureCause), { cause: failureCause }) });
 			this._errors$.next(registerError);
 			throw registerError;
@@ -22429,10 +22759,13 @@ var SignalWire = class extends Destroyable {
 			return await this._clientSession.createOutboundCall(destination, computed_options);
 		} catch (error) {
 			if (!isRecoverableAuthError(error)) throw error;
-			logger$1.debug("[SignalWire] Dial hit a recoverable auth error; recovering credential and retrying once");
-			if (!await this.recoverStaleCredential()) throw error;
-			await this.waitAuthentication();
-			return this._clientSession.createOutboundCall(destination, computed_options);
+			logger$1.debug("[SignalWire] Dial hit a recoverable auth error; recovering the session and retrying");
+			const outcome = await this.recoverAndRetry(async () => {
+				await this.waitAuthentication();
+				return this._clientSession.createOutboundCall(destination, computed_options);
+			});
+			if (outcome.ok) return outcome.value;
+			throw outcome.error ?? error;
 		}
 	}
 	/**
@@ -22714,6 +23047,8 @@ var SignalWire = class extends Destroyable {
 	destroy() {
 		this._refreshCoordinator?.destroy();
 		this._refreshCoordinator = void 0;
+		this._refreshHttp?.destroy();
+		this._refreshHttp = void 0;
 		this._dpopManager?.destroy();
 		const session = this._clientSession;
 		session?.teardownSessionState();