@tollbooth-dpyc/web 1.8.0 → 1.8.1

package/dist/client.d.ts

@@ -24,8 +24,9 @@ type ProofExpiredListener = (message: string) => void;
 export declare function onProofExpired(cb: ProofExpiredListener): () => void;
 export interface CallOptions {
     /**
-     * A non-essential call — diagnostics, personalization. It never logs the
-     * patron out, whatever it gets back.
+     * A non-essential call — diagnostics, personalization, a board polled all
+     * match. A soft proof miss here never logs the patron out; a stored grant
+     * the service refused for good (expired, revoked) still does.
      */
     bestEffort?: boolean;
     timeoutMs?: number;

package/dist/client.js

@@ -17,7 +17,7 @@ import { clearStoredProof, forgetRecentLogin, getStoredNpub, getStoredProof, } f
 import { signInlineProof } from "./inlineProof.js";
 import { isTransportFailure, NetworkError } from "./networkError.js";
 import { clearSessionNsec, hasSessionNsec, sessionNsecNpub } from "./sessionNsec.js";
-import { errorText, looksFailed, proofBounceMessage, readToolResult, } from "./toolResult.js";
+import { errorText, deadGrantMessage, looksFailed, proofBounceMessage, readToolResult, } from "./toolResult.js";
 /**
  * Standard tools whose wheel signature takes no npub/proof envelope. Pydantic
  * strict mode rejects unexpected kwargs, so they must not get one.
@@ -77,14 +77,14 @@ function proofFor(tool) {
         const npub = getStoredNpub();
         const sessionNpub = hasSessionNsec() ? sessionNsecNpub() : null;
         if (sessionNpub && sessionNpub === npub)
-            return signInlineProof(toolName(tool));
+            return { token: signInlineProof(toolName(tool)), inline: true };
         if (sessionNpub)
             clearSessionNsec();
     }
     catch {
         /* fall through to the cached token */
     }
-    return getStoredProof();
+    return { token: getStoredProof(), inline: false };
 }
 export { isNetworkError, NetworkError } from "./networkError.js";
 /** A paid call bounced for a lapsed or missing proof. The gate re-arms sign-in. */
@@ -131,9 +131,10 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
     if (!quiet)
         debugPush("call", `${name}(${redact(JSON.stringify(args)).slice(0, 140)})`);
     const bootstrap = STANDARD_BOOTSTRAP.includes(tool) || cfg.extraBootstrapTools.includes(tool);
-    const merged = bootstrap
-        ? { ...args }
-        : { npub: getStoredNpub(), dpop_token: proofFor(tool), ...args };
+    const proof = bootstrap ? null : proofFor(tool);
+    const merged = proof
+        ? { npub: getStoredNpub(), dpop_token: proof.token, ...args }
+        : { ...args };
     let result;
     try {
         const c = await getClient();
@@ -163,18 +164,20 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
         const tail = images.length ? ` +${images.length} image` : "";
         debugPush(looksFailed(payload) ? "error" : "result", `${name} → ${redact(String(preview)).slice(0, 220)}${tail}`);
     }
-    if (!opts.bestEffort) {
-        const bounced = proofBounceMessage(payload);
-        if (bounced !== null) {
-            // The token just refused is the same one the recent-login shortcut
-            // would replay, so it goes too, or a returning patron re-bounces.
-            const npub = getStoredNpub();
-            clearStoredProof();
-            if (npub)
-                forgetRecentLogin(npub);
-            emitProofExpired(bounced);
-            throw new ProofRequiredError(bounced);
-        }
+    // A stored grant the service refused for good signs the patron out even
+    // from a best-effort call: that is not a blip, and staying "signed in" on a
+    // dead grant leaves every page failing with nothing to tell them why.
+    const bounced = (opts.bestEffort ? null : proofBounceMessage(payload)) ??
+        (proof && !proof.inline && proof.token ? deadGrantMessage(payload) : null);
+    if (bounced !== null) {
+        // The token just refused is the same one the recent-login shortcut
+        // would replay, so it goes too, or a returning patron re-bounces.
+        const npub = getStoredNpub();
+        clearStoredProof();
+        if (npub)
+            forgetRecentLogin(npub);
+        emitProofExpired(bounced);
+        throw new ProofRequiredError(bounced);
     }
     return { data: payload, images };
 }

package/dist/toolResult.d.ts

@@ -33,5 +33,16 @@ export declare function readToolResult(result: RawToolResult): ReadResult;
  * silently never fired. Normalised here, once.
  */
 export declare function proofBounceMessage(payload: unknown): string | null;
+/**
+ * A stored proof grant the service refused for good: `{success: false,
+ * error_code: proof_invalid, reason}` where the reason is about the grant —
+ * expired, revoked, issued for another npub or operator, malformed. Retrying
+ * with it can never succeed, so the patron is signed out.
+ *
+ * Only meaningful when the call carried the stored grant. A session key's
+ * inline proof shares the code and even the word `expired` (outside its
+ * window), but it is signed afresh for the next call and loses nothing.
+ */
+export declare function deadGrantMessage(payload: unknown): string | null;
 /** Whether a payload reports failure, for the debug log's colouring. */
 export declare function looksFailed(payload: unknown): boolean;

package/dist/toolResult.js

@@ -51,6 +51,33 @@ export function proofBounceMessage(payload) {
     }
     return null;
 }
+/**
+ * Grant refusals that say nothing about the grant: the service could not
+ * establish its own identity, or could not read its revocation list. Both are
+ * the service's fault and retryable, so the patron stays signed in.
+ */
+const GRANT_STILL_GOOD = new Set(["operator_unknown", "revocations_unavailable"]);
+/**
+ * A stored proof grant the service refused for good: `{success: false,
+ * error_code: proof_invalid, reason}` where the reason is about the grant —
+ * expired, revoked, issued for another npub or operator, malformed. Retrying
+ * with it can never succeed, so the patron is signed out.
+ *
+ * Only meaningful when the call carried the stored grant. A session key's
+ * inline proof shares the code and even the word `expired` (outside its
+ * window), but it is signed afresh for the next call and loses nothing.
+ */
+export function deadGrantMessage(payload) {
+    if (!payload || typeof payload !== "object")
+        return null;
+    const p = payload;
+    const code = String(p.error_code ?? "").toLowerCase();
+    if (p.success !== false || code !== "proof_invalid")
+        return null;
+    if (GRANT_STILL_GOOD.has(String(p.reason ?? "").toLowerCase()))
+        return null;
+    return String(p.error ?? "Your sign-in has expired.");
+}
 /** Whether a payload reports failure, for the debug log's colouring. */
 export function looksFailed(payload) {
     if (!payload || typeof payload !== "object")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollbooth-dpyc/web",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Shared browser SDK for Tollbooth DPYC operator front ends: npub sign-in, proofs, MCP client, profile and wallet",
   "license": "Apache-2.0",
   "author": "Lonnie VanZandt",