@tileflow/react-native 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/internal/session.js

@@ -19,6 +19,11 @@ var REFRESH_MARGIN_MS = 3e4;
 var ROTATION_AGE_MS = 6 * 60 * 60 * 1e3;
 var ROTATION_REQUEST_LIMIT = 1e4;
 var FUTURE_ISSUE_SKEW_MS = 3e4;
+var RETRY_INITIAL_MS = 1e3;
+var RETRY_LIMIT_MS = 6e4;
+var RETRY_AFTER_LIMIT_MS = 15 * 60 * 1e3;
+var RETRY_AFTER_SECONDS = /^\d{1,10}$/u;
+var QUOTA_CODES = /* @__PURE__ */ new Set(["COMMERCIAL_MAP_LIMIT_REACHED", "COMMERCIAL_SPENDING_LIMIT_REACHED"]);
 var MOBILE_CREDENTIAL = /^tf_public_[0-9a-f]{48}$/u;
 var MAP_ID = /^map_[A-Za-z0-9_-]{16}$/u;
 var CREDENTIAL_ID = /^key_[A-Za-z0-9_-]{8,80}$/u;
@@ -57,6 +62,13 @@ var SUCCESS_KEYS = /* @__PURE__ */ new Set([
   "tilesetIds"
 ]);
 var RESTART_KEYS = /* @__PURE__ */ new Set(["code", "error", "retryWithNewSession", "sessionId"]);
+var TERMINAL_CODES = /* @__PURE__ */ new Set([
+  "NATIVE_SESSION_INPUT_INVALID",
+  "NATIVE_SESSION_CREDENTIAL_REJECTED",
+  "NATIVE_SESSION_MAP_MISMATCH",
+  "NATIVE_SESSION_MAP_NOT_FOUND",
+  "NATIVE_SESSION_QUOTA_EXCEEDED"
+]);
 var ERROR_MESSAGES = {
   NATIVE_SESSION_INPUT_INVALID: "Native session configuration is invalid.",
   NATIVE_SESSION_RESPONSE_TOO_LARGE: "Native session response exceeded its byte limit.",
@@ -68,6 +80,7 @@ var ERROR_MESSAGES = {
   NATIVE_SESSION_MAP_NOT_FOUND: "Native session Map was not found.",
   NATIVE_SESSION_QUOTA_EXCEEDED: "Native session quota was exceeded.",
   NATIVE_SESSION_REJECTED: "Native session request was rejected.",
+  NATIVE_SESSION_RATE_LIMITED: "Native session requests are rate limited.",
   NATIVE_SESSION_UNAVAILABLE: "Native session service is unavailable.",
   NATIVE_SESSION_REPLACED: "Native session binding was replaced.",
   NATIVE_SESSION_DISPOSED: "Native session controller is disposed."
@@ -189,7 +202,29 @@ function createHostedNativeSessionController(input) {
       })
     );
   }
+  let terminal = null;
+  let failures = 0;
+  let retryAt = null;
+  let retryError = null;
+  function clearRetry() {
+    failures = 0;
+    retryAt = null;
+    retryError = null;
+  }
+  function delayRetry(error) {
+    let at;
+    try {
+      at = readClock();
+    } catch {
+      return;
+    }
+    if (retryAt === null || at >= retryAt) failures = Math.min(failures + 1, 16);
+    const backoff = Math.min(RETRY_INITIAL_MS * 2 ** (failures - 1), RETRY_LIMIT_MS);
+    retryAt = Math.max(retryAt ?? at, at + Math.max(backoff, retryAfterDelays.get(error) ?? 0));
+    retryError = Object.freeze({ code: error.code, kind: error.kind });
+  }
   function rotateIfRequired(at) {
+    if (terminal) throw new HostedNativeSessionError(terminal.code);
     if (!activeSession || binding.kind !== "hosted") return;
     if (at - activeSession.startedAt < ROTATION_AGE_MS && activeSession.requestCount < ROTATION_REQUEST_LIMIT) {
       return;
@@ -223,6 +258,7 @@ function createHostedNativeSessionController(input) {
     return current;
   }
   async function ensureAuthority(session, at) {
+    if (terminal) throw new HostedNativeSessionError(terminal.code);
     if (session.authority && session.authority.clockEpoch === clock.epoch && session.authority.validUntil - at > REFRESH_MARGIN_MS) {
       return { authority: session.authority, session };
     }
@@ -230,20 +266,28 @@ function createHostedNativeSessionController(input) {
     if (binding.kind !== "hosted") {
       throw new HostedNativeSessionError("NATIVE_SESSION_REPLACED");
     }
+    if (retryAt !== null && retryError && at < retryAt) {
+      if (session.authority && session.authority.clockEpoch === clock.epoch && session.authority.validUntil > at) {
+        return { authority: session.authority, session };
+      }
+      throw new HostedNativeSessionError(retryError.code);
+    }
     const operationBinding = binding;
     const abort = new SessionAbortController();
     operations.add(abort);
     const operation = {
       abort,
       promise: Promise.resolve().then(async () => {
-        session.error = null;
-        publishSession(session, "loading");
-        if (abort.signal.aborted) throw abort.error();
         try {
+          if (abort.signal.aborted) throw abort.error();
+          session.error = null;
+          publishSession(session, "loading");
+          if (abort.signal.aborted) throw abort.error();
           const result = await bootstrap(session, operationBinding, abort, true, true);
           if (abort.signal.aborted) throw abort.error();
           result.session.authority = result.authority;
           result.session.error = null;
+          if (binding === operationBinding) clearRetry();
           if (activeSession === result.session) {
             publishSession(result.session, "ready");
             if (abort.signal.aborted) throw abort.error();
@@ -252,6 +296,22 @@ function createHostedNativeSessionController(input) {
         } catch (error) {
           const normalized = abort.signal.aborted ? abort.error() : normalizeError(error);
           const target = latestSession(session);
+          if (normalized.kind === "terminal" && binding === operationBinding && !terminal) {
+            const failure = Object.freeze({ code: normalized.code, kind: normalized.kind });
+            terminal = failure;
+            const rejectedSession = activeSession;
+            if (rejectedSession) {
+              rejectedSession.authority = null;
+              rejectedSession.error = failure;
+            }
+            for (const pending of [...operations]) pending.abort(failure.code);
+            if (binding === operationBinding && rejectedSession) {
+              publishSession(rejectedSession, "error", failure);
+            }
+          }
+          if (normalized.kind === "recoverable" && binding === operationBinding && !terminal) {
+            delayRetry(normalized);
+          }
           if (normalized.code !== "NATIVE_SESSION_REPLACED" && normalized.code !== "NATIVE_SESSION_DISPOSED") {
             target.error = Object.freeze({ code: normalized.code, kind: normalized.kind });
             publishSession(target, "error", target.error);
@@ -284,7 +344,10 @@ function createHostedNativeSessionController(input) {
     try {
       body = source.length ? JSON.parse(source) : null;
     } catch {
-      throw new HostedNativeSessionError("NATIVE_SESSION_RESPONSE_JSON_INVALID");
+      if (response.status === 201) {
+        throw new HostedNativeSessionError("NATIVE_SESSION_RESPONSE_JSON_INVALID");
+      }
+      body = null;
     }
     if (response.status === 409 && allowRestart && isExactRestart(body, session.sessionId)) {
       assertCurrentSession(session, hostedBinding);
@@ -292,7 +355,12 @@ function createHostedNativeSessionController(input) {
       if (abort.signal.aborted) throw abort.error();
       return bootstrap(replacement, hostedBinding, abort, false, false);
     }
-    if (response.status !== 201) throw statusError(response.status);
+    if (response.status !== 201) {
+      const failure = statusError(response.status, body);
+      const delay = retryAfterMs(response.headers, now);
+      if (delay !== null) retryAfterDelays.set(failure, delay);
+      throw failure;
+    }
     if (!hasNoStore(response.headers.get("cache-control"))) {
       throw new HostedNativeSessionError("NATIVE_SESSION_RESPONSE_INVALID");
     }
@@ -365,6 +433,16 @@ function createHostedNativeSessionController(input) {
     if (binding.kind === "direct" || !activeSession) {
       return Object.freeze({ status: "idle", source: "direct", lifecycle });
     }
+    if (terminal) {
+      return Object.freeze({
+        status: "error",
+        source: "hosted",
+        lifecycle,
+        mapId: binding.mapId,
+        sessionId: activeSession.sessionId,
+        error: terminal
+      });
+    }
     if (activeSession.operation) {
       return Object.freeze({
         status: "loading",
@@ -416,6 +494,7 @@ function createHostedNativeSessionController(input) {
       if (bindingGeneration !== expectedGeneration) {
         throw new HostedNativeSessionError("NATIVE_SESSION_REPLACED");
       }
+      if (terminal) throw new HostedNativeSessionError(terminal.code);
       checkedAt = readClock();
       if (resolved.authority.clockEpoch === clock.epoch && resolved.authority.validUntil > checkedAt) {
         admittedAuthorities.set(resolved.authority.public, resolved.authority);
@@ -470,7 +549,7 @@ function createHostedNativeSessionController(input) {
       }
     },
     transportBudget(authority) {
-      if (disposed || lifecycle !== "foreground") return 0;
+      if (disposed || terminal || lifecycle !== "foreground") return 0;
       const stored = admittedAuthorities.get(authority);
       if (!stored || stored.bindingGeneration !== bindingGeneration) return 0;
       try {
@@ -489,6 +568,11 @@ function createHostedNativeSessionController(input) {
     async resume() {
       if (disposed) throw new HostedNativeSessionError("NATIVE_SESSION_DISPOSED");
       lifecycle = "foreground";
+      if (terminal) {
+        const error = new HostedNativeSessionError(terminal.code);
+        publish(currentSnapshot());
+        throw error;
+      }
       if (binding.kind === "direct" || !activeSession) {
         publish(currentSnapshot());
         return;
@@ -511,9 +595,27 @@ function createHostedNativeSessionController(input) {
       bindingGeneration += 1;
       for (const operation of operations) operation.abort("NATIVE_SESSION_REPLACED");
       binding = next;
+      terminal = null;
+      clearRetry();
       activeSession = next.kind === "hosted" ? createSession(next.surfaceId, readClock()) : null;
       publish(snapshotIdle(binding, activeSession, lifecycle));
     },
+    retry() {
+      if (disposed) throw new HostedNativeSessionError("NATIVE_SESSION_DISPOSED");
+      if (!terminal && retryAt === null) return;
+      terminal = null;
+      clearRetry();
+      if (activeSession && !activeSession.operation) activeSession.error = null;
+      publish(currentSnapshot());
+    },
+    retryDelay() {
+      if (disposed || terminal || retryAt === null) return null;
+      try {
+        return Math.max(0, Math.ceil(retryAt - readClock()));
+      } catch {
+        return null;
+      }
+    },
     subscribe(listener) {
       if (typeof listener !== "function") {
         throw new HostedNativeSessionError("NATIVE_SESSION_INPUT_INVALID");
@@ -608,7 +710,8 @@ function parseSuccess(value, binding, expectedSessionId, expectedSurfaceId) {
   const issuedAtMs = parseExactIso(value.issuedAt);
   const serverTimeMs = parseExactIso(value.serverTime);
   const expiresAtMs = parseExactIso(value.expiresAt);
-  if (issuedAtMs > serverTimeMs + FUTURE_ISSUE_SKEW_MS || expiresAtMs <= serverTimeMs || expiresAtMs <= issuedAtMs || expiresAtMs - issuedAtMs > MAX_GRANT_LIFETIME_MS || expiresAtMs - issuedAtMs > MAX_GRANT_LIFETIME_MS) {
+  if (issuedAtMs > serverTimeMs + FUTURE_ISSUE_SKEW_MS || expiresAtMs <= serverTimeMs || expiresAtMs <= issuedAtMs || expiresAtMs - issuedAtMs > MAX_GRANT_LIFETIME_MS || // The local deadline is derived from serverTime, so this also bounds the transport budget.
+  expiresAtMs - serverTimeMs > MAX_GRANT_LIFETIME_MS) {
     throw new HostedNativeSessionError("NATIVE_SESSION_RESPONSE_INVALID");
   }
   const authority = {
@@ -787,18 +890,46 @@ function decodeUtf8(bytes) {
 function hasNoStore(value) {
   return typeof value === "string" && value.split(",").some((part) => part.trim().toLowerCase() === "no-store");
 }
-function statusError(status) {
+function statusError(status, body) {
   if (status === 401) return new HostedNativeSessionError("NATIVE_SESSION_CREDENTIAL_REJECTED");
   if (status === 403) return new HostedNativeSessionError("NATIVE_SESSION_MAP_MISMATCH");
   if (status === 404) return new HostedNativeSessionError("NATIVE_SESSION_MAP_NOT_FOUND");
-  if (status === 429) return new HostedNativeSessionError("NATIVE_SESSION_QUOTA_EXCEEDED");
-  if (status === 503) return new HostedNativeSessionError("NATIVE_SESSION_UNAVAILABLE");
+  if (status === 429) {
+    return new HostedNativeSessionError(
+      isRecord(body) && typeof body.code === "string" && QUOTA_CODES.has(body.code) ? "NATIVE_SESSION_QUOTA_EXCEEDED" : "NATIVE_SESSION_RATE_LIMITED"
+    );
+  }
+  if (status === 408 || status >= 500 && status <= 599) {
+    return new HostedNativeSessionError("NATIVE_SESSION_UNAVAILABLE");
+  }
   return new HostedNativeSessionError("NATIVE_SESSION_REJECTED");
 }
+var retryAfterDelays = /* @__PURE__ */ new WeakMap();
+function retryAfterMs(headers, now) {
+  let value;
+  try {
+    value = headers.get("retry-after");
+  } catch {
+    return null;
+  }
+  if (typeof value !== "string" || value.length > 64) return null;
+  const text = value.trim();
+  let delay;
+  if (RETRY_AFTER_SECONDS.test(text)) delay = Number(text) * 1e3;
+  else {
+    const date = Date.parse(text);
+    if (!Number.isFinite(date)) return null;
+    try {
+      delay = date - readWallClock(now);
+    } catch {
+      return null;
+    }
+  }
+  return Math.min(Math.max(0, delay), RETRY_AFTER_LIMIT_MS);
+}
 function errorKind(code) {
   if (code === "NATIVE_SESSION_DISPOSED" || code === "NATIVE_SESSION_REPLACED") return "cancelled";
-  if (code === "NATIVE_SESSION_UNAVAILABLE") return "recoverable";
-  return "terminal";
+  return TERMINAL_CODES.has(code) ? "terminal" : "recoverable";
 }
 function normalizeError(error, fallback = "NATIVE_SESSION_RESPONSE_INVALID") {
   return error instanceof HostedNativeSessionError ? error : new HostedNativeSessionError(fallback);

package/dist/internal/source-state.d.ts

@@ -1,5 +1,5 @@
 import { TileflowNativeSourceState } from '@tileflow/core/native';
-import { v as MapSourceState } from '../contract-Bp-Im7tj.js';
+import { x as MapSourceState } from '../contract-BaK24QZD.js';
 import '@maplibre/maplibre-react-native';
 import 'react';
 import 'react-native';

package/docs/native-admission.md

@@ -59,6 +59,22 @@ Bootstrap uses an independent OkHttp client or ephemeral URLSession channel. It
 
 Each context binds its validated bootstrap endpoint/credential. Retiring that context cancels its bootstrap without cancelling another Map. TypeScript alone parses session authority and makes admission decisions.
 
+A bootstrap ends after 10 seconds, well inside the 30-second protected transport deadline. A stalled renewal therefore fails its bridge batch, and the tickets waiting on it, instead of outliving them. A ticket whose own deadline passes while JavaScript is still answering its batch fails alone; only a batch that JavaScript does not answer within 30 seconds retires the context. When admission retires the context of a mounted Map, the Map reports `renderer-error` and opens a new context for the same source, up to three times without a successful load in between.
+
+## Session failures
+
+The controller classifies each bootstrap or renewal failure:
+
+| Response                                                                       | Result                                                  |
+| ------------------------------------------------------------------------------ | ------------------------------------------------------- |
+| 401, 403, 404                                                                  | Stops the session until `ref.retry()` or another source |
+| 429 with `COMMERCIAL_MAP_LIMIT_REACHED` or `COMMERCIAL_SPENDING_LIMIT_REACHED` | Stops the session until `ref.retry()` or another source |
+| Any other 429                                                                  | Rate limited: retries after a delay                     |
+| 408, 5xx, network failure or timeout                                           | Unavailable: retries after a delay                      |
+| Another status, or a response that breaks the session contract                 | Retries after a delay                                   |
+
+A stopped session reports `session-error` through `onError`, including when a renewal is refused after the first load. A delay starts at one second and doubles up to one minute; a `Retry-After` in seconds or as an HTTP date lengthens it, up to 15 minutes. During the delay no bootstrap leaves the device, and a grant that is still valid keeps admitting protected requests. A successful bootstrap or `ref.retry()` clears the delay.
+
 The controller's private transport budget remains anchored to its existing local `validUntil`. Native never reconstructs a fresh lifetime from server timestamps. The budget is bounded by the earlier ticket-enqueue time, the native wait deadline and a safety margin, and is rechecked immediately before network start and redirects. Backgrounding, clock rollback, source replacement, disposal and expiry invalidate stale authority.
 
 No synchronous network hook, main thread or OkHttp interceptor waits for JavaScript. Suspended JavaScript therefore cannot authorize stale protected work.
@@ -93,7 +109,7 @@ Camera commands carry private monotonically correlated tokens. A successful publ
 | Protected response body                |                               8,388,608 bytes |
 | Pending bootstrap bridge work          |                                            32 |
 | Bootstrap request / response           |                          2,048 / 65,536 bytes |
-| Bootstrap deadline                     |                                    30 seconds |
+| Bootstrap deadline                     |                                    10 seconds |
 
 Cancellation retains transport capacity until the corresponding native cleanup boundary. Capacity bounds are transport safety limits, not product quotas or billing counters.
 

package/ios/TFAdmissionBootstrap.mm

@@ -102,11 +102,13 @@ static NSTextCheckingResult *TFBootstrapMatch(NSString *value, NSString *pattern
 	context.endpoint = clean; context.credential = credential; context.lastRequest = sequence;
 	TFBootstrapWork *work = [TFBootstrapWork new];
 	work.identifier = requestId; work.context = context; work.alive = [TFBootstrapFlag new];
-	work.deadline = [self.scheduler nowMs] + 30000; work.completion = completion;
+	// Well inside the 30 s ticket and batch deadlines, so a stalled renewal fails its batch
+	// instead of letting the context retire under it.
+	work.deadline = [self.scheduler nowMs] + 10000; work.completion = completion;
 	context.pending[requestId] = work; self.pendingCount++;
-	work.timer = [self.scheduler after:30000 perform:^{ [self finish:work reply:nil]; }];
+	work.timer = [self.scheduler after:10000 perform:^{ [self finish:work reply:nil]; }];
 	NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:clean]
-		cachePolicy:NSURLRequestReloadIgnoringLocalCacheData timeoutInterval:30];
+		cachePolicy:NSURLRequestReloadIgnoringLocalCacheData timeoutInterval:10];
 	request.HTTPMethod = @"POST"; request.HTTPBody = [body dataUsingEncoding:NSUTF8StringEncoding];
 	request.HTTPShouldHandleCookies = NO;
 	[request setValue:@"application/json" forHTTPHeaderField:@"Content-Type"];
@@ -115,13 +117,17 @@ static NSTextCheckingResult *TFBootstrapMatch(NSString *value, NSString *pattern
 	@try {
 		work.network = [self.network start:request mayStart:^BOOL { return [self mayStart:work]; } completion:^(NSHTTPURLResponse *response, NSData *bytes) {
 			[self.scheduler enqueue:^{
-				NSString *cacheControl = @"";
+				NSString *cacheControl = @"", *retryAfter = @"";
 				for (id name in response.allHeaderFields) {
-					if ([name isKindOfClass:NSString.class] && [(NSString *)name caseInsensitiveCompare:@"Cache-Control"] == NSOrderedSame) cacheControl = response.allHeaderFields[name];
+					if (![name isKindOfClass:NSString.class]) continue;
+					if ([(NSString *)name caseInsensitiveCompare:@"Cache-Control"] == NSOrderedSame) cacheControl = response.allHeaderFields[name];
+					if ([(NSString *)name caseInsensitiveCompare:@"Retry-After"] == NSOrderedSame) retryAfter = response.allHeaderFields[name];
 				}
+				// An oversized Retry-After is ignored rather than failing the reply.
+				if (!TFBootstrapString(retryAfter, 64)) retryAfter = @"";
 				BOOL valid = [self mayStart:work] && [response isKindOfClass:NSHTTPURLResponse.class] && response.statusCode >= 100 && response.statusCode <= 599 &&
 					TFBootstrapString(cacheControl, 1024) && [bytes isKindOfClass:NSData.class] && bytes.length <= 65536;
-				NSDictionary *reply = valid ? @{@"status": @(response.statusCode), @"cacheControl": cacheControl, @"bodyBase64": [bytes base64EncodedStringWithOptions:0]} : nil;
+				NSDictionary *reply = valid ? @{@"status": @(response.statusCode), @"cacheControl": cacheControl, @"retryAfter": retryAfter, @"bodyBase64": [bytes base64EncodedStringWithOptions:0]} : nil;
 				[self finish:work reply:reply];
 			}];
 		}];

package/ios/TFAdmissionEngine.mm

@@ -168,8 +168,10 @@ static BOOL TFGrantShape(NSString *value) {
 		work.response = response; work.failure = failure; work.delegate = delegate; work.releaseReservation = release;
 		context.work[work.identifier] = work; [context.order addObject:work.identifier];
 		work.timer = [self.scheduler after:30000 perform:^{
-			if ([context.batchTickets containsObject:work.identifier]) [self retire:context.identifier];
-			else [self fail:work];
+			// A slow renewal fails only this request. JavaScript still answers its batch, and the
+			// batch deadline alone retires a context whose JavaScript stopped answering.
+			if ([context.batchTickets containsObject:work.identifier]) [self event:context kind:@"cancel" fields:@{@"tickets": @[work.identifier]}];
+			[self fail:work];
 		}];
 		[self.scheduler enqueue:^{ [self drain:context]; }];
 	}];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tileflow/react-native",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.7",
   "license": "Apache-2.0",
   "description": "Tileflow maps, camera control and semantic interactions for React Native.",
   "type": "module",
@@ -36,7 +36,7 @@
     }
   },
   "dependencies": {
-    "@tileflow/core": ">=0.1.0-alpha.38 <0.1.0-beta.0",
+    "@tileflow/core": ">=0.1.0-alpha.42 <0.1.0-beta.0",
     "@tileflow/interactions": ">=0.1.0-alpha.6 <0.1.0-beta.0"
   },
   "peerDependencies": {