@signalwire/js 4.0.0-dev-20260826210511 → 4.0.0-dev-20260908172838

package/dist/browser.mjs

@@ -12374,15 +12374,57 @@ const RPCEventAckResponse = (id) => makeRPCResponse({
 	result: {}
 });
 
+//#endregion
+//#region src/utils/authRecovery.ts
+/**
+* Walk an error's `error`/`cause` chain looking for a {@link JSONRPCError}.
+* Errors thrown by call creation are wrapped (e.g. `CallCreateError`), so the
+* underlying signaling error is nested. Bounded by a visited set to guard
+* against cyclic causes.
+*/
+function findJSONRPCError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current instanceof Error && !seen.has(current)) {
+		seen.add(current);
+		if (current instanceof JSONRPCError) return current;
+		current = current.error ?? current.cause;
+	}
+}
+/**
+* Whether an error is a session-recoverable authentication failure
+* (`-32002` authentication failed or `-32003` requester validation failed)
+* that a credential re-mint + retry can heal.
+*/
+function isRecoverableAuthError(error) {
+	const rpcError = findJSONRPCError(error);
+	return rpcError !== void 0 && (rpcError.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || rpcError.code === RPC_ERROR_AUTHENTICATION_FAILED);
+}
+/**
+* Whether an error is specifically a requester-validation rejection
+* (`-32003`) — the server refusing the session's credential.
+*
+* Narrower than {@link isRecoverableAuthError} on purpose. `-32002` is
+* overloaded server-side: a rejected reattach arrives as `-32002` with
+* `cause: INVALID_MSG_UNSPECIFIED` and message `CALL ERROR`, which is a
+* call-level rejection and says nothing about the credential. Use this where
+* the decision must not be fooled by that, such as deciding whether retrying
+* an operation could possibly succeed.
+*/
+function isRequesterValidationError(error) {
+	return findJSONRPCError(error)?.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED;
+}
+
 //#endregion
 //#region src/managers/AttachManager.ts
 const logger$25 = getLogger();
 var AttachManager = class {
-	constructor(storage, deviceController, reconnectCallsTimeout, attachKey) {
+	constructor(storage, deviceController, reconnectCallsTimeout, attachKey, credentialRecovered) {
 		this.storage = storage;
 		this.deviceController = deviceController;
 		this.reconnectCallsTimeout = reconnectCallsTimeout;
 		this.attachKey = attachKey;
+		this.credentialRecovered = credentialRecovered;
 		this.writeQueue = Promise.resolve();
 	}
 	async detachAll() {
@@ -12462,8 +12504,14 @@ var AttachManager = class {
 	* rejecting. Once that fix is deployed, this will work for both
 	* page reloads and WebSocket reconnects.
 	*
-	* Failed reattach attempts are handled gracefully — the stale call
-	* reference is cleaned up from storage.
+	* A failed reattach does NOT generally cost the stored reference. It is
+	* discarded only when the server denied the reattach on a session whose
+	* credential it had already accepted — a verified reauthentication followed
+	* by a refusal is the server saying the call is gone, and that is the one
+	* refusal worth acting on. Until then the credential may be what is being
+	* refused, and the record is the only way a later reload can try again;
+	* keeping it costs nothing, since `detachExpired` reaps it once it is older
+	* than `reconnectCallsTimeout`.
 	*/
 	async reattachCalls() {
 		const attached = await this.readAttached();
@@ -12472,6 +12520,7 @@ var AttachManager = class {
 			const { destination } = attachment;
 			const options = this.buildCallOptions(attachment);
 			let succeeded = false;
+			let refusedOnCredentials = false;
 			for (let attempt = 1; attempt <= 3; attempt++) try {
 				await this.session.createOutboundCall(destination, {
 					callId,
@@ -12482,15 +12531,20 @@ var AttachManager = class {
 				break;
 			} catch (error) {
 				logger$25.warn(`[AttachManager] Reattach attempt ${attempt}/3 failed for call ${callId}:`, error);
+				if (isRequesterValidationError(error)) {
+					refusedOnCredentials = true;
+					logger$25.warn(`[AttachManager] Reattach of ${callId} was refused on credentials; not retrying.`);
+					break;
+				}
 				if (attempt < 3) await new Promise((r) => setTimeout(r, (attempt + 1) * 1e3));
 			}
-			if (!succeeded) {
-				logger$25.warn(`[AttachManager] Reattach failed after 3 attempts for call ${callId}, removing reference`);
+			if (!succeeded) if (this.credentialRecovered() && !refusedOnCredentials) {
+				logger$25.warn(`[AttachManager] Reattach of ${callId} was denied after a verified reauthentication, removing reference`);
 				await this.detach({
 					id: callId,
 					mediaDirections: attachment.mediaDirections
 				});
-			}
+			} else logger$25.warn(`[AttachManager] Reattach failed for call ${callId}; keeping the reference (credential refused or never proven good)`);
 		}
 	}
 	/**
@@ -14508,33 +14562,6 @@ function throwOnRPCError() {
 	});
 }
 
-//#endregion
-//#region src/utils/unwrapVertoReply.ts
-/**
-* Unwrap a method's own reply from a `webrtc.verto` envelope.
-*
-* A control verb sent in-dialog comes back nested two levels deep:
-*
-* ```
-* { result: { node_id, code, result: { jsonrpc, id, result: <method payload> } } }
-* ```
-*
-* whereas the routed transport resolves the method payload directly under
-* `.result`. Readers want the latter shape, and the difference is silent when it
-* is wrong — `response.result.layouts` simply evaluates to `undefined` against the
-* envelope, so the data arrives, nothing throws, and the caller sees an empty
-* value. That exact failure produced an empty layout dropdown with a successful
-* request behind it.
-*
-* Accepting both shapes here keeps every reader indifferent to which transport
-* produced the response. Anything that is not a nested envelope (a plain ack, or
-* an already-unwrapped reply) passes through untouched.
-*/
-function unwrapVertoReply(response) {
-	const inner = getValueFrom(response, "result.result");
-	return inner && typeof inner === "object" && "result" in inner ? inner : response;
-}
-
 //#endregion
 //#region src/managers/CallEventsManager.ts
 var import_cjs$20 = require_cjs();
@@ -14727,10 +14754,14 @@ var CallEventsManager = class extends Destroyable {
 	updateLayouts() {
 		if (!this.selfId) return;
 		this.webRtcCallSession.executeMethod(this.selfId, "call.layout.list", {}).then((response) => {
-			const { result } = unwrapVertoReply(response);
+			const layouts = response.result?.layouts;
+			if (!layouts) {
+				logger$22.warn("[CallEventsManager] Layout list response carried no layouts; keeping current layouts");
+				return;
+			}
 			this._sessionState$.next({
 				...this._sessionState$.value,
-				layouts: result.layouts
+				layouts
 			});
 		}).catch((error) => {
 			logger$22.error("[CallEventsManager] Error fetching layouts:", error);
@@ -17125,7 +17156,7 @@ var WebRTCVertoManager = class extends VertoManager {
 			}
 		}));
 		const failure = findNestedVertoFailure(response);
-		if (failure) throw new JSONRPCError(Number.parseInt(failure.code, 10) || 0, failure.message ?? `Call control "${method}" failed (code ${failure.code})`, void 0);
+		if (failure) throw new JSONRPCError(Number.parseInt(failure.code, 10) || 0, `Call control "${method}" failed (code ${failure.code})${failure.message ? `: ${failure.message}` : ""}`, void 0);
 		return response;
 	}
 	async executeVerto(message, optionals = {}) {
@@ -18433,6 +18464,33 @@ function mosToQualityLevel(mos) {
 	return "critical";
 }
 
+//#endregion
+//#region src/utils/unwrapVertoReply.ts
+/**
+* Unwrap a method's own reply from a `webrtc.verto` envelope.
+*
+* A control verb sent in-dialog comes back nested two levels deep:
+*
+* ```
+* { result: { node_id, code, result: { jsonrpc, id, result: <method payload> } } }
+* ```
+*
+* whereas the routed transport resolves the method payload directly under
+* `.result`. Readers want the latter shape, and the difference is silent when it
+* is wrong — `response.result.layouts` simply evaluates to `undefined` against the
+* envelope, so the data arrives, nothing throws, and the caller sees an empty
+* value. That exact failure produced an empty layout dropdown with a successful
+* request behind it.
+*
+* Accepting both shapes here keeps every reader indifferent to which transport
+* produced the response. Anything that is not a nested envelope (a plain ack, or
+* an already-unwrapped reply) passes through untouched.
+*/
+function unwrapVertoReply(response) {
+	const inner = getValueFrom(response, "result.result");
+	return inner && typeof inner === "object" && "result" in inner ? inner : response;
+}
+
 //#endregion
 //#region src/core/entities/Call.ts
 var import_cjs$11 = require_cjs();
@@ -20283,17 +20341,14 @@ var ClientSessionManager = class extends Destroyable {
 		const hasStoredState = await (0, import_cjs$7.firstValueFrom)(this.authorizationState$.pipe((0, import_cjs$7.take)(1))) !== void 0;
 		if (isRecoverableAuthError$1 && hasStoredState) {
 			logger$9.debug("[Session] Recoverable auth error — cleaning up stored state and reconnecting fresh");
-			try {
-				await this.cleanupStoredConnectionParams();
-			} catch (cleanupError) {
-				logger$9.error("Failed to cleanup stored connection params:", cleanupError);
-			} finally {
-				this.transport.reconnect();
-			}
+			await this.discardResumeStateAndReconnect();
 		} else this._errors$.next(error);
 	}
 	/**
-	* Clear the resume state (authorization_state + protocol) only.
+	* Clear the resume state (authorization_state + protocol) and ask the
+	* transport to reconnect. The `connected` event re-triggers
+	* `authenticate()`, which now has no stored state and so performs a fresh
+	* connect.
 	*
 	* This is the stale-auth-state recovery helper used by handleAuthError:
 	* the server rejected a reconnect, so the resume state is discarded and a
@@ -20301,9 +20356,24 @@ var ClientSessionManager = class extends Destroyable {
 	* session lives on through the reconnect and reattachCalls() needs the
 	* stored call references afterwards. Do NOT add detachAll() here.
 	*
+	* Connect-time recovery only. A *request* refused on an already
+	* authenticated session is never healed here: dropping the resume state
+	* destroys the association between the socket and the previous session,
+	* which is what reattach depends on. That path mints a fresh credential and
+	* reauthenticates instead (see `SignalWire.recoverAndRetry`).
+	*
 	* For public teardown (disconnect/destroy), use {@link teardownSessionState}
 	* instead, which clears the attach records as well.
 	*/
+	async discardResumeStateAndReconnect() {
+		try {
+			await this.cleanupStoredConnectionParams();
+		} catch (cleanupError) {
+			logger$9.error("Failed to cleanup stored connection params:", cleanupError);
+		} finally {
+			this.transport.reconnect();
+		}
+	}
 	async cleanupStoredConnectionParams() {
 		await this.transport.setProtocol(void 0);
 		await this.updateAuthorizationStateInStorage(void 0);
@@ -21875,37 +21945,17 @@ var TransportManager = class extends Destroyable {
 	}
 };
 
-//#endregion
-//#region src/utils/authRecovery.ts
-/**
-* Walk an error's `error`/`cause` chain looking for a {@link JSONRPCError}.
-* Errors thrown by call creation are wrapped (e.g. `CallCreateError`), so the
-* underlying signaling error is nested. Bounded by a visited set to guard
-* against cyclic causes.
-*/
-function findJSONRPCError(error) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current instanceof Error && !seen.has(current)) {
-		seen.add(current);
-		if (current instanceof JSONRPCError) return current;
-		current = current.error ?? current.cause;
-	}
-}
-/**
-* Whether an error is a session-recoverable authentication failure
-* (`-32002` authentication failed or `-32003` requester validation failed)
-* that a credential re-mint + retry can heal.
-*/
-function isRecoverableAuthError(error) {
-	const rpcError = findJSONRPCError(error);
-	return rpcError !== void 0 && (rpcError.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || rpcError.code === RPC_ERROR_AUTHENTICATION_FAILED);
-}
-
 //#endregion
 //#region src/clients/SignalWire.ts
 var import_cjs$1 = require_cjs();
 const logger$1 = getLogger();
+/**
+* Storage key for the client-bound marker. The SAT and authorization_state are
+* both opaque to the SDK, so on a page reload the preflight recovery — which
+* runs before any session exists — has no other way to know the session was
+* client-bound. See {@link SignalWire.persistClientBoundMarker}.
+*/
+const CLIENT_BOUND_STORAGE_KEY = "sw:client_bound";
 const buildOptionsFromDestination = (destination) => {
 	if (typeof destination === "string") {
 		const queryStartIndex = destination.indexOf("?");
@@ -21949,6 +21999,7 @@ var SignalWire = class extends Destroyable {
 		this.preferences = new ClientPreferences();
 		this._user$ = this.createBehaviorSubject(void 0);
 		this._directory$ = this.createBehaviorSubject(void 0);
+		this._credentialRecovered = false;
 		this._isConnected$ = this.createBehaviorSubject(false);
 		this._isRegistered$ = this.createBehaviorSubject(false);
 		this._errors$ = this.createReplaySubject(1);
@@ -22114,43 +22165,76 @@ var SignalWire = class extends Destroyable {
 		}
 	}
 	/**
-	* One-shot recovery for a live session that failed with a recoverable auth
-	* error (`-32002`/`-32003`) because its token went stale — e.g. a refresh
-	* timer that was throttled while the tab was backgrounded.
+	* Recover a session the server is refusing: mint a fresh credential,
+	* reauthenticate the live session with it, and retry the operation.
 	*
-	* Two steps, first that succeeds wins:
-	*   1. Reauthenticate with the in-memory token (a fresh DPoP proof is
-	*      generated automatically). Heals a session whose token was already
-	*      refreshed by the coordinator but never applied to the open socket,
-	*      and a client-bound session whose server-side auth merely drifted.
-	*   2. Re-mint via the developer provider's `refresh()` and reauthenticate.
-	*      Skipped for client-bound sessions (the DeviceTokenManager owns their
-	*      refresh; re-minting a base SAT here would drop the DPoP binding).
+	* The connection is deliberately kept. A reload authenticates the new socket
+	* against the persisted `authorization_state`, and that handshake is what
+	* associates the socket with the previous session — the association reattach
+	* depends on. `signalwire.reauthenticate` swaps the credential *on that same
+	* session*, so recovery never touches the resume state. Discarding it would
+	* heal the credential by destroying the very thing the caller is trying to
+	* get back to.
 	*
-	* @param allowRemint - Whether step 2 (provider re-mint) may run. Callers
-	*   pass `false` for non-auth failures so a transient network error never
-	*   escalates to a token re-mint; step 1 (in-memory reauth) always runs.
-	* @returns `true` if the session was reauthenticated, `false` otherwise.
+	* The operation is still the verdict, never the RPC. Reauthenticating with
+	* the in-memory token is accepted by a resume even while requests stay
+	* refused, because the persisted `authorization_state` short-circuits token
+	* validation — and `signalwire.reauthenticate` with a *freshly minted* token
+	* has also been observed accepted while `subscriber.online` keeps being
+	* refused (staging run 33826974634). Both look like success and are not.
+	*
+	* @returns the operation's value, or the reason recovery could not deliver
+	*   one. `error` is undefined when there was no way to mint at all.
 	*/
-	async recoverStaleCredential(allowRemint = true) {
-		const currentToken = this._deps.credential.token;
-		if (currentToken) try {
-			await this._clientSession.reauthenticate(currentToken);
-			return true;
+	async recoverAndRetry(operation) {
+		if (!await this.remintAndReauthenticate()) return { ok: false };
+		try {
+			const value = await operation();
+			this._credentialRecovered = true;
+			return {
+				ok: true,
+				value
+			};
 		} catch (error) {
-			logger$1.debug("[SignalWire] In-memory reauth failed during recovery:", error);
+			logger$1.warn("[SignalWire] Reauthentication was accepted but the operation is still refused:", error);
+			return {
+				ok: false,
+				error
+			};
+		}
+	}
+	/**
+	* Re-mint a credential and adopt it only if the live session accepts it.
+	*
+	* The mechanism follows the binding: a client-bound session re-mints a bound
+	* base SAT through `authenticate()` with the DPoP fingerprint, because the
+	* developer refresh handler would hand back an unbound token and silently
+	* degrade the session. An unbound session uses the refresh handler. Rotation
+	* cost is not a reason to skip this — the only reason is having no mechanism.
+	*
+	* @returns whether the session is now running on a freshly accepted credential.
+	*/
+	async remintAndReauthenticate() {
+		const provider = this._credentialProvider;
+		if (!provider) return false;
+		const { clientBound } = this._clientSession;
+		if (!clientBound && !provider.refresh) {
+			logger$1.debug("[SignalWire] [SW-NO-REFRESH-HANDLER] Unbound session with no refresh handler; cannot re-mint.");
+			return false;
 		}
-		if (!allowRemint || this._clientSession.clientBound || !this._credentialProvider?.refresh) return false;
 		try {
-			const newCredentials = await this.remintCredential(this._credentialProvider);
-			if (!newCredentials.token) return false;
+			const newCredentials = clientBound ? await provider.authenticate(this._dpopManager?.initialized ? { fingerprint: this._dpopManager.fingerprint } : void 0) : await this.remintCredential(provider);
+			if (!newCredentials.token) {
+				logger$1.warn("[SignalWire] Re-minted credential has no token; keeping the current one.");
+				return false;
+			}
+			await this._clientSession.reauthenticate(newCredentials.token);
 			this._deps.credential = newCredentials;
 			this.persistCredential(newCredentials);
-			await this._clientSession.reauthenticate(newCredentials.token);
-			if (newCredentials.expiry_at) this._refreshCoordinator?.scheduleDeveloperRefresh(this._credentialProvider, newCredentials.expiry_at);
+			if (newCredentials.expiry_at && provider.refresh) this._refreshCoordinator?.scheduleDeveloperRefresh(provider, newCredentials.expiry_at);
 			return true;
 		} catch (error) {
-			logger$1.error("[SignalWire] Credential recovery failed:", error);
+			logger$1.warn("[SignalWire] Re-mint recovery failed:", error);
 			return false;
 		}
 	}
@@ -22185,10 +22269,9 @@ var SignalWire = class extends Destroyable {
 		if (!this._credentialProvider) return;
 		try {
 			let newCredentials;
-			if (this._clientSession.clientBound) {
-				const fingerprint = this._dpopManager?.initialized ? this._dpopManager.fingerprint : void 0;
+			if (this._clientSession?.clientBound ?? await this.wasClientBound()) {
 				logger$1.debug("[SignalWire] Re-minting client-bound base SAT before reconnect");
-				newCredentials = await this._credentialProvider.authenticate(fingerprint ? { fingerprint } : void 0);
+				newCredentials = await this._credentialProvider.authenticate(this._dpopManager?.initialized ? { fingerprint: this._dpopManager.fingerprint } : void 0);
 			} else if (this._credentialProvider.refresh) {
 				logger$1.debug("[SignalWire] Refreshing unbound credential before reconnect");
 				newCredentials = await this.remintCredential(this._credentialProvider);
@@ -22216,6 +22299,26 @@ var SignalWire = class extends Destroyable {
 		this._deps.storage.setItem("sw:cached_credential", credential);
 		if (this._deps.persistSession) this._deps.storage.setItem("sw:cached_credential", credential, "local");
 	}
+	/**
+	* Persist whether the session is client-bound, mirroring the credential's
+	* storage scopes so it survives a reload. The preflight recovery reads it
+	* before any session exists to decide whether to re-bind via `authenticate()`
+	* or refresh an unbound token; the marker tracks the latest binding, so an
+	* unbound reconnect clears a stale marker from an earlier client-bound login.
+	*/
+	persistClientBoundMarker(bound) {
+		const scopes = this._deps.persistSession ? ["session", "local"] : ["session"];
+		for (const scope of scopes) if (bound) this._deps.storage.setItem(CLIENT_BOUND_STORAGE_KEY, true, scope);
+		else this._deps.storage.removeItem(CLIENT_BOUND_STORAGE_KEY, scope);
+	}
+	/** Read the persisted client-bound marker (see {@link persistClientBoundMarker}). */
+	async wasClientBound() {
+		const scopes = this._deps.persistSession ? ["local", "session"] : ["session"];
+		for (const scope of scopes) try {
+			if (await this._deps.storage.getItem(CLIENT_BOUND_STORAGE_KEY, scope)) return true;
+		} catch {}
+		return false;
+	}
 	async init() {
 		this._user$.next(new User(this._deps.http));
 		if (!this._options.skipConnection) await this.connect();
@@ -22239,6 +22342,42 @@ var SignalWire = class extends Destroyable {
 		} catch (error) {
 			logger$1.error("[SignalWire] Failed to reattach calls:", error);
 			this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
+		} finally {
+			this._credentialRecovered = false;
+		}
+	}
+	/**
+	* Fetch the authenticated user profile, recovering a stale credential.
+	*
+	* On a reload the persisted credential can be expired. Unlike the WS resume —
+	* which the server accepts against the persisted `authorization_state` even
+	* with an expired token — this REST preflight has no such short-circuit and is
+	* refused (401). There is no session yet to reauthenticate, so recovery
+	* re-mints the credential through the provider ({@link refreshCredentialForReconnect})
+	* and retries with a FRESH {@link User}: Fetchable memoizes its result
+	* (shareReplay), so reusing the instance would replay the 401 instead of
+	* re-fetching with the new token. Without the user id the transport/session —
+	* and the reattach a reload is trying to preserve — cannot even be addressed.
+	*/
+	async fetchUserOrRecover() {
+		const fetchUser = async (user$1) => {
+			if (!await (0, import_cjs$1.firstValueFrom)(user$1.fetched$)) throw new UnexpectedError("Failed to fetch user information - fetched$ emitted false");
+			this._deps.user = user$1;
+		};
+		const user = this._user$.value;
+		if (!user) throw new UnexpectedError("User not initialized before connect");
+		try {
+			await fetchUser(user);
+		} catch (firstError) {
+			logger$1.error(`[SignalWire] Failed to fetch user information: ${firstError instanceof Error ? firstError.message : "Unknown error"}. This usually means the user token is invalid or expired. Re-minting the credential and retrying.`);
+			try {
+				await this.refreshCredentialForReconnect();
+				const refetched = new User(this._deps.http);
+				await fetchUser(refetched);
+				this._user$.next(refetched);
+			} catch (retryError) {
+				throw new UnexpectedError("Error fetching user information", { cause: retryError });
+			}
 		}
 	}
 	/**
@@ -22280,20 +22419,12 @@ var SignalWire = class extends Destroyable {
 	*/
 	async connect() {
 		await this.teardownTransportAndSession();
-		try {
-			const user = this._user$.value;
-			if (!user) throw new UnexpectedError("User not initialized before connect");
-			if (!await (0, import_cjs$1.firstValueFrom)(user.fetched$)) throw new UnexpectedError("Failed to fetch user information - fetched$ emitted false");
-			this._deps.user = user;
-		} catch (error) {
-			logger$1.error(`[SignalWire] Failed to fetch user information: ${error instanceof Error ? error.message : "Unknown error"}. This usually means the user token is invalid or expired.`);
-			throw new UnexpectedError("Error fetching user information", { cause: error });
-		}
+		await this.fetchUserOrRecover();
 		const errorHandler = (error) => {
 			this._errors$.next(error);
 		};
 		this._transport = new TransportManager(this._deps.storage, this._deps.protocolKey, this._deps.WebSocket, PreferencesContainer.instance.relayHost ?? this._deps.relayHost, errorHandler);
-		this._attachManager = new AttachManager(this._deps.storage, this._deps.deviceController, PreferencesContainer.instance.reconnectCallsTimeout, this._deps.attachedCallsKey);
+		this._attachManager = new AttachManager(this._deps.storage, this._deps.deviceController, PreferencesContainer.instance.reconnectCallsTimeout, this._deps.attachedCallsKey, () => this._credentialRecovered);
 		this._clientSession = new ClientSessionManager(() => this._deps.credential, this._transport, this._deps.storage, this._deps.authorizationStateKey, this._deps.deviceController, this._attachManager, this._deps.webRTCApiProvider, this._dpopManager, this._networkMonitor?.networkChange$);
 		this._publicSession = new ClientSessionWrapper(this._clientSession);
 		this._clientSession.callControl = this._options.callControl ?? "routed";
@@ -22303,6 +22434,7 @@ var SignalWire = class extends Destroyable {
 		});
 		this.subscribeTo(this._clientSession.authorization$, (authorization) => {
 			this._refreshCoordinator?.syncExpiryFromAuthorization(authorization, this._credentialProvider);
+			this.persistClientBoundMarker(Boolean(authorization?.cnf?.jkt));
 		});
 		await this._clientSession.connect();
 		await this._refreshCoordinator?.activate(this._deps.user, this._clientSession);
@@ -22556,19 +22688,18 @@ var SignalWire = class extends Destroyable {
 				throw error;
 			}
 			logger$1.debug("[SignalWire] Failed to register user, attempting credential recovery...");
-			let failureCause = error;
-			if (await this.recoverStaleCredential(isRecoverableAuthError(error))) try {
-				logger$1.debug("[SignalWire] Recovery succeeded, retrying register()");
+			const outcome = await this.recoverAndRetry(async () => {
 				await this._transport.execute(RPCExecute({
 					method: "subscriber.online",
 					params: {}
 				}));
+			});
+			if (outcome.ok) {
+				logger$1.debug("[SignalWire] Recovery restored registration");
 				this._isRegistered$.next(true);
 				return;
-			} catch (retryError) {
-				logger$1.error("[SignalWire] Register retry after recovery failed:", retryError);
-				failureCause = retryError;
 			}
+			const failureCause = outcome.error ?? error;
 			const registerError = new InvalidCredentialsError("Failed to register user, and credential recovery also failed. Please check your credentials.", { cause: failureCause instanceof Error ? failureCause : new Error(String(failureCause), { cause: failureCause }) });
 			this._errors$.next(registerError);
 			throw registerError;
@@ -22628,10 +22759,13 @@ var SignalWire = class extends Destroyable {
 			return await this._clientSession.createOutboundCall(destination, computed_options);
 		} catch (error) {
 			if (!isRecoverableAuthError(error)) throw error;
-			logger$1.debug("[SignalWire] Dial hit a recoverable auth error; recovering credential and retrying once");
-			if (!await this.recoverStaleCredential()) throw error;
-			await this.waitAuthentication();
-			return this._clientSession.createOutboundCall(destination, computed_options);
+			logger$1.debug("[SignalWire] Dial hit a recoverable auth error; recovering the session and retrying");
+			const outcome = await this.recoverAndRetry(async () => {
+				await this.waitAuthentication();
+				return this._clientSession.createOutboundCall(destination, computed_options);
+			});
+			if (outcome.ok) return outcome.value;
+			throw outcome.error ?? error;
 		}
 	}
 	/**