@yieldfabric/wallet 0.2.3 → 0.2.5

package/dist/index.cjs

@@ -1521,6 +1521,26 @@ var init_tokenStore = __esm({
   }
 });
 
+// src/core/crossTabRefresh.ts
+function withRefreshLock(renew, locks = globalThis.navigator?.locks) {
+  if (!locks?.request) return renew();
+  return locks.request(REFRESH_LOCK, renew);
+}
+function renewedElsewhere(spent, stored, chainId, now = Date.now()) {
+  if (!stored.access || !stored.refresh || stored.refresh === spent) return false;
+  const claims = decodeJwtPayload(stored.access);
+  const exp = claims?.exp;
+  return typeof exp === "number" && exp * 1e3 - now > LIVE_FOR_MS && claims?.default_chain_id === chainId;
+}
+var REFRESH_LOCK, LIVE_FOR_MS;
+var init_crossTabRefresh = __esm({
+  "src/core/crossTabRefresh.ts"() {
+    init_jwtPayload();
+    REFRESH_LOCK = "yieldfabric-auth-refresh";
+    LIVE_FOR_MS = 3e4;
+  }
+});
+
 // src/core/onboardingPlanSelectionStorage.ts
 function readOnboardingPlanSelectionHint() {
   if (typeof window === "undefined") return null;
@@ -1600,6 +1620,7 @@ var init_authService = __esm({
     init_tokenManager();
     init_jwtClaims();
     init_tokenStore();
+    init_crossTabRefresh();
     init_onboardingPlanSelectionStorage();
     isRefreshing = false;
     refreshPromise = null;
@@ -1786,19 +1807,23 @@ var init_authService = __esm({
           error.statusCode = 401;
           throw error;
         }
+        const spent = this.refreshToken;
         isRefreshing = true;
         refreshOperation = { kind: "regular", chainId };
-        refreshPromise = this.performRefresh(chainId);
+        refreshPromise = withRefreshLock(async () => this.adoptRenewedSession(chainId, spent) ?? this.performRefresh(chainId));
         const activePromise = refreshPromise;
         try {
           const result = await refreshPromise;
           return result;
         } catch (error) {
           switch (classifyAuthFailure(error)) {
-            case "auth":
+            case "auth": {
+              const adopted = this.adoptRenewedSession(chainId, spent);
+              if (adopted) return adopted;
               console.warn("Authentication error during token refresh, clearing tokens");
               this.clearTokensFromStorage();
               break;
+            }
             case "network":
               console.warn("Network error during token refresh, preserving tokens for retry");
               break;
@@ -1814,6 +1839,20 @@ var init_authService = __esm({
           }
         }
       }
+      /** The session another window renewed since this one read the refresh
+       *  token `spent`, taken as this window's own; `null` when there is none. */
+      adoptRenewedSession(chainId, spent) {
+        const stored = { access: exports.defaultTokenStore.getAccessToken(), refresh: exports.defaultTokenStore.getRefreshToken() };
+        if (!stored.access || !stored.refresh || !renewedElsewhere(spent, stored, chainId)) return null;
+        this.saveTokensToStorage(stored.access, stored.refresh);
+        const exp = decodeJwtPayload(stored.access)?.exp;
+        return {
+          access_token: stored.access,
+          refresh_token: stored.refresh,
+          token_type: "Bearer",
+          expires_in: Math.max(0, Math.floor(exp - Date.now() / 1e3))
+        };
+      }
       /**
        * Perform the actual token refresh.
        *

package/dist/index.d.cts

@@ -741,6 +741,9 @@ declare class AuthService {
      * Uses global lock to prevent concurrent refresh attempts
      */
     refreshAccessToken(targetChainId?: string): Promise<RefreshTokenResponse>;
+    /** The session another window renewed since this one read the refresh
+     *  token `spent`, taken as this window's own; `null` when there is none. */
+    private adoptRenewedSession;
     /**
      * Perform the actual token refresh.
      *

package/dist/index.d.ts

@@ -741,6 +741,9 @@ declare class AuthService {
      * Uses global lock to prevent concurrent refresh attempts
      */
     refreshAccessToken(targetChainId?: string): Promise<RefreshTokenResponse>;
+    /** The session another window renewed since this one read the refresh
+     *  token `spent`, taken as this window's own; `null` when there is none. */
+    private adoptRenewedSession;
     /**
      * Perform the actual token refresh.
      *

package/dist/index.js

@@ -1513,6 +1513,26 @@ var init_tokenStore = __esm({
   }
 });
 
+// src/core/crossTabRefresh.ts
+function withRefreshLock(renew, locks = globalThis.navigator?.locks) {
+  if (!locks?.request) return renew();
+  return locks.request(REFRESH_LOCK, renew);
+}
+function renewedElsewhere(spent, stored, chainId, now = Date.now()) {
+  if (!stored.access || !stored.refresh || stored.refresh === spent) return false;
+  const claims = decodeJwtPayload(stored.access);
+  const exp = claims?.exp;
+  return typeof exp === "number" && exp * 1e3 - now > LIVE_FOR_MS && claims?.default_chain_id === chainId;
+}
+var REFRESH_LOCK, LIVE_FOR_MS;
+var init_crossTabRefresh = __esm({
+  "src/core/crossTabRefresh.ts"() {
+    init_jwtPayload();
+    REFRESH_LOCK = "yieldfabric-auth-refresh";
+    LIVE_FOR_MS = 3e4;
+  }
+});
+
 // src/core/onboardingPlanSelectionStorage.ts
 function readOnboardingPlanSelectionHint() {
   if (typeof window === "undefined") return null;
@@ -1592,6 +1612,7 @@ var init_authService = __esm({
     init_tokenManager();
     init_jwtClaims();
     init_tokenStore();
+    init_crossTabRefresh();
     init_onboardingPlanSelectionStorage();
     isRefreshing = false;
     refreshPromise = null;
@@ -1778,19 +1799,23 @@ var init_authService = __esm({
           error.statusCode = 401;
           throw error;
         }
+        const spent = this.refreshToken;
         isRefreshing = true;
         refreshOperation = { kind: "regular", chainId };
-        refreshPromise = this.performRefresh(chainId);
+        refreshPromise = withRefreshLock(async () => this.adoptRenewedSession(chainId, spent) ?? this.performRefresh(chainId));
         const activePromise = refreshPromise;
         try {
           const result = await refreshPromise;
           return result;
         } catch (error) {
           switch (classifyAuthFailure(error)) {
-            case "auth":
+            case "auth": {
+              const adopted = this.adoptRenewedSession(chainId, spent);
+              if (adopted) return adopted;
               console.warn("Authentication error during token refresh, clearing tokens");
               this.clearTokensFromStorage();
               break;
+            }
             case "network":
               console.warn("Network error during token refresh, preserving tokens for retry");
               break;
@@ -1806,6 +1831,20 @@ var init_authService = __esm({
           }
         }
       }
+      /** The session another window renewed since this one read the refresh
+       *  token `spent`, taken as this window's own; `null` when there is none. */
+      adoptRenewedSession(chainId, spent) {
+        const stored = { access: defaultTokenStore.getAccessToken(), refresh: defaultTokenStore.getRefreshToken() };
+        if (!stored.access || !stored.refresh || !renewedElsewhere(spent, stored, chainId)) return null;
+        this.saveTokensToStorage(stored.access, stored.refresh);
+        const exp = decodeJwtPayload(stored.access)?.exp;
+        return {
+          access_token: stored.access,
+          refresh_token: stored.refresh,
+          token_type: "Bearer",
+          expires_in: Math.max(0, Math.floor(exp - Date.now() / 1e3))
+        };
+      }
       /**
        * Perform the actual token refresh.
        *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yieldfabric/wallet",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Reusable YieldFabric wallet — login, signing, profile, and key management",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YieldFabric Technologies Ltd",
@@ -55,7 +55,7 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "clean": "rm -rf dist",
-    "test:owned-group": "tsup --config tests/tsup.config.ts && node --test tests/ownedGroupSession.test.mjs tests/metaTransactionDigest.test.mjs tests/ownedGroupAuthorization.test.mjs tests/groupOwnershipRelationships.test.mjs tests/ownedGroupDelegationService.test.mjs tests/ownedGroupKeySelection.test.mjs tests/websocketAuthentication.test.mjs tests/withDeadline.test.mjs tests/onboardingCache.test.mjs tests/authFailure.test.mjs tests/jsonEventStream.test.mjs",
+    "test:owned-group": "tsup --config tests/tsup.config.ts && node --test tests/ownedGroupSession.test.mjs tests/metaTransactionDigest.test.mjs tests/ownedGroupAuthorization.test.mjs tests/groupOwnershipRelationships.test.mjs tests/ownedGroupDelegationService.test.mjs tests/ownedGroupKeySelection.test.mjs tests/websocketAuthentication.test.mjs tests/withDeadline.test.mjs tests/onboardingCache.test.mjs tests/authFailure.test.mjs tests/jsonEventStream.test.mjs tests/crossTabRefresh.test.mjs tests/twoWindowsRefresh.test.mjs",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "npm run clean && npm run build"
   },