@explorins/pers-sdk-react-native 2.1.17 → 2.1.19

package/dist/hooks/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAGlF,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,OAAO;;;;sBA0ByB,MAAM,aAAY,gBAAgB,KAA2B,QAAQ,6BAA6B,CAAC;oCAgCrF,WAAW,KAAG,QAAQ,IAAI,CAAC;kBAgC/C,QAAQ,IAAI,CAAC;;0BA0BL,QAAQ,OAAO,CAAC;gCAmBV,QAAQ,OAAO,CAAC;mCAqBX,MAAM;qBAmBtB,QAAQ,IAAI,CAAC;wBAoBV,QAAQ,OAAO,CAAC;CAwB5D,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAGlF,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,OAAO;;;;sBAyByB,MAAM,aAAY,gBAAgB,KAA2B,QAAQ,6BAA6B,CAAC;oCA+BrF,WAAW,KAAG,QAAQ,IAAI,CAAC;kBA+B/C,QAAQ,IAAI,CAAC;;0BA2BL,QAAQ,OAAO,CAAC;gCAmBV,QAAQ,OAAO,CAAC;mCAqBX,MAAM;qBAmBtB,QAAQ,IAAI,CAAC;wBAoBV,QAAQ,OAAO,CAAC;CAwB5D,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC"}

package/dist/hooks/useAuth.js

@@ -39,7 +39,7 @@ import { AccountOwnerType } from '@explorins/pers-sdk/core';
  * ```
  */
 export const useAuth = () => {
-    const { sdk, authProvider, isInitialized, isAuthenticated, user, setAuthenticationState, refreshUserData } = usePersSDK();
+    const { sdk, authProvider, isInitialized, isAuthenticated, user, refreshUserData } = usePersSDK();
     /**
      * Authenticates a user with a JWT token
      *
@@ -62,8 +62,7 @@ export const useAuth = () => {
         try {
             // Set token in auth provider
             await authProvider.setAccessToken(jwtToken);
-            // Perform login using the manager
-            // SDK emits login_success event with user data - PersSDKProvider handles state sync
+            // Perform login - emits login_success event which Provider handles
             const result = await sdk.auth.loginWithToken(jwtToken, userType);
             return result;
         }
@@ -89,8 +88,7 @@ export const useAuth = () => {
             throw new Error('SDK not initialized. Call initialize() first.');
         }
         try {
-            // Use the raw data login from the auth manager
-            // SDK emits login_success event with user data - PersSDKProvider handles state sync
+            // Use the raw data login - emits login_success event which Provider handles
             const result = await sdk.auth.loginWithRawData(rawUserData);
             // Set token from result
             if (result.accessToken) {
@@ -115,17 +113,18 @@ export const useAuth = () => {
      * ```
      */
     const logout = useCallback(async () => {
+        if (!sdk) {
+            throw new Error('SDK not initialized. Call initialize() first.');
+        }
         try {
-            if (authProvider) {
-                await authProvider.clearTokens();
-            }
-            setAuthenticationState(null, false);
+            // clearAuth emits logout_success event which Provider handles
+            await sdk.auth.clearAuth();
         }
         catch (error) {
             console.error('Logout failed:', error);
             throw error;
         }
-    }, [authProvider, setAuthenticationState]);
+    }, [sdk]);
     /**
      * Retrieves the current authenticated user data
      *
@@ -199,9 +198,9 @@ export const useAuth = () => {
         if (!sdk) {
             throw new Error('SDK not initialized. Call initialize() first.');
         }
+        // clearAuth emits logout_success event which Provider handles
         await sdk.auth.clearAuth();
-        setAuthenticationState(null, false);
-    }, [sdk, setAuthenticationState]);
+    }, [sdk]);
     /**
      * Checks if the current authentication is valid (non-expired)
      *

package/dist/index.js

@@ -9588,7 +9588,113 @@ class AuthTokenManager {
         const token = await this.getRefreshToken();
         return !!token;
     }
+    /**
+     * Clears only the refresh token.
+     * Used when DPoP keys are regenerated, invalidating the token binding.
+     */
+    async clearRefreshToken() {
+        this.cache.refreshToken = null;
+        await this.storage.remove(AUTH_STORAGE_KEYS.REFRESH_TOKEN);
+    }
+}
+
+class IndexedDBTokenStorage {
+    constructor() {
+        this.supportsObjects = true;
+        this.dbPromise = null;
+        if (typeof indexedDB === 'undefined') {
+            console.warn('IndexedDB is not available in this environment');
+        }
+    }
+    getDB() {
+        if (this.dbPromise)
+            return this.dbPromise;
+        this.dbPromise = new Promise((resolve, reject) => {
+            if (typeof indexedDB === 'undefined') {
+                return reject(new Error('IndexedDB not supported'));
+            }
+            const request = indexedDB.open(IndexedDBTokenStorage.DB_NAME, IndexedDBTokenStorage.DB_VERSION);
+            request.onupgradeneeded = (event) => {
+                const db = event.target.result;
+                if (!db.objectStoreNames.contains(IndexedDBTokenStorage.STORE_NAME)) {
+                    db.createObjectStore(IndexedDBTokenStorage.STORE_NAME);
+                }
+            };
+            request.onsuccess = (event) => {
+                resolve(event.target.result);
+            };
+            request.onerror = (event) => {
+                reject(event.target.error);
+            };
+        });
+        return this.dbPromise;
+    }
+    async get(key) {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readonly');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.get(key);
+                request.onsuccess = () => resolve(request.result || null);
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.warn('[IndexedDBTokenStorage] Failed to get key', key, e);
+            return null;
+        }
+    }
+    async set(key, value) {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.put(value, key);
+                request.onsuccess = () => resolve();
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.error('[IndexedDBTokenStorage] Failed to set key', key, e);
+            throw e;
+        }
+    }
+    async remove(key) {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.delete(key);
+                request.onsuccess = () => resolve();
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.warn('[IndexedDBTokenStorage] Failed to remove key', key, e);
+        }
+    }
+    async clear() {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.clear();
+                request.onsuccess = () => resolve();
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.warn('[IndexedDBTokenStorage] Failed to clear storage', e);
+        }
+    }
 }
+IndexedDBTokenStorage.DB_NAME = 'pers-sdk-storage';
+IndexedDBTokenStorage.STORE_NAME = 'auth-tokens';
+IndexedDBTokenStorage.DB_VERSION = 1;
 
 class WebDPoPCryptoProvider {
     get crypto() {
@@ -9724,13 +9830,30 @@ const DPOP_STORAGE_KEYS = {
     PRIVATE: 'pers_dpop_private_key'
 };
 class DPoPManager {
-    constructor(storage, cryptoProvider) {
+    constructor(storage, cryptoProvider, callbacks) {
         this.storage = storage;
         this.memoryKeyPair = null;
         this.cryptoProvider = cryptoProvider || new WebDPoPCryptoProvider();
+        this.callbacks = callbacks || {};
+    }
+    /**
+     * Checks if DPoP keys exist in storage without generating new ones.
+     * Useful for detecting if a key regeneration would be needed.
+     */
+    async hasStoredKeys() {
+        if (this.memoryKeyPair)
+            return true;
+        const storedPublic = await this.storage.get(DPOP_STORAGE_KEYS.PUBLIC);
+        const storedPrivate = await this.storage.get(DPOP_STORAGE_KEYS.PRIVATE);
+        return !!(storedPublic && storedPrivate);
     }
     /**
      * Ensures a DPoP key pair exists, loading from storage or generating new one.
+     *
+     * IMPORTANT: If keys are regenerated (not loaded from storage), this will
+     * invalidate any refresh tokens bound to the old keys. The onKeysRegenerated
+     * callback should clear the refresh token to prevent "DPoP proof does not
+     * match refresh token binding" errors.
      */
     async ensureKeyPair() {
         if (this.memoryKeyPair)
@@ -9746,10 +9869,12 @@ class DPoPManager {
                 return this.memoryKeyPair;
             }
             catch (e) {
-                console.warn('Corrupted DPoP keys in storage, regenerating.');
+                console.warn('[DPoPManager] Corrupted DPoP keys in storage, regenerating.');
             }
         }
         // Generate new key pair
+        // IMPORTANT: This invalidates any existing refresh tokens bound to the old keys
+        console.info('[DPoPManager] Generating new DPoP key pair');
         // Adaptation: If storage supports raw objects (like IndexedDB or Native Keychain),
         // we can generate Non-Extractable keys for maximum security.
         // If storage is text-only (LocalStorage), we must use Extractable keys to serialize them.
@@ -9761,6 +9886,15 @@ class DPoPManager {
         await this.storage.set(DPOP_STORAGE_KEYS.PUBLIC, keyPair.publicKey);
         await this.storage.set(DPOP_STORAGE_KEYS.PRIVATE, keyPair.privateKey);
         this.memoryKeyPair = keyPair;
+        // Notify that keys were regenerated - refresh tokens bound to old keys are now invalid
+        if (this.callbacks.onKeysRegenerated) {
+            try {
+                this.callbacks.onKeysRegenerated();
+            }
+            catch (e) {
+                console.warn('[DPoPManager] onKeysRegenerated callback failed:', e);
+            }
+        }
         return keyPair;
     }
     /**
@@ -9814,16 +9948,48 @@ class DefaultAuthProvider {
         this.config = config;
         this.authTypeCache = null;
         this.authType = config.authType || exports.AccountOwnerType.USER;
+        // Determine if DPoP can be enabled (requires IndexedDB for key persistence)
+        const canUseDPoP = this.canEnableDPoP();
+        this.dpopEnabled = !!(config.dpop?.enabled && canUseDPoP);
+        if (config.dpop?.enabled && !canUseDPoP) {
+            console.warn('[DefaultAuthProvider] DPoP disabled: IndexedDB not available. CryptoKey persistence requires IndexedDB.');
+        }
         const storage = config.storage || this.createStorage();
         this.tokenManager = new AuthTokenManager(storage);
-        if (config.dpop?.enabled) {
-            this.dpopManager = new DPoPManager(storage, config.dpop.cryptoProvider);
+        if (this.dpopEnabled) {
+            this.dpopManager = new DPoPManager(storage, config.dpop?.cryptoProvider, {
+                // When DPoP keys are regenerated (corrupted/missing), the refresh token
+                // bound to the old keys becomes invalid. Clear it to prevent
+                // "DPoP proof does not match refresh token binding" errors.
+                onKeysRegenerated: () => {
+                    console.info('[DefaultAuthProvider] DPoP keys regenerated, clearing invalid refresh token');
+                    this.tokenManager.clearRefreshToken().catch(err => {
+                        console.warn('[DefaultAuthProvider] Failed to clear refresh token:', err);
+                    });
+                }
+            });
         }
     }
+    canEnableDPoP() {
+        // DPoP requires IndexedDB for proper CryptoKey persistence
+        // LocalStorage cannot serialize CryptoKey objects correctly
+        return typeof window !== 'undefined' && typeof indexedDB !== 'undefined';
+    }
     createStorage() {
-        return typeof window === 'undefined' || typeof localStorage === 'undefined'
-            ? new MemoryTokenStorage()
-            : new LocalStorageTokenStorage();
+        // Server-side: use memory storage
+        if (typeof window === 'undefined') {
+            return new MemoryTokenStorage();
+        }
+        // Browser with DPoP enabled: use IndexedDB for CryptoKey persistence
+        if (this.dpopEnabled) {
+            return new IndexedDBTokenStorage();
+        }
+        // Browser without DPoP: use LocalStorage
+        if (typeof localStorage !== 'undefined') {
+            return new LocalStorageTokenStorage();
+        }
+        // Fallback
+        return new MemoryTokenStorage();
     }
     getToken() {
         return this.tokenManager.getAccessToken();
@@ -9905,6 +10071,10 @@ class DefaultAuthProvider {
     async hasValidToken() {
         return this.tokenManager.hasAccessToken();
     }
+    async setAuthType(_authType) {
+        // No-op: authType is derived from JWT payload via getAuthType()
+        // @see getAuthType() - reads accountType directly from JWT
+    }
     async getAuthType() {
         // Read from JWT instead of separate storage for single source of truth
         const token = await this.tokenManager.getAccessToken();
@@ -9944,12 +10114,14 @@ class DefaultAuthProvider {
  * Exported for consumers who need version info.
  * Used internally for X-SDK-Version header.
  *
+ * Version is injected at build time via @rollup/plugin-replace
+ *
  * @module @explorins/pers-sdk/core
  */
 /** SDK package name */
-const SDK_NAME = '@explorins/pers-sdk';
-/** SDK version - TODO: Load dynamically from package.json */
-const SDK_VERSION = '2.1.1';
+const SDK_NAME = "@explorins/pers-sdk";
+/** SDK version - injected from package.json at build time */
+const SDK_VERSION = "2.1.27";
 /** Full SDK identifier for headers */
 const SDK_USER_AGENT = `${SDK_NAME}/${SDK_VERSION}`;
 
@@ -10879,7 +11051,14 @@ class AuthManager {
      */
     async loginWithRawData(rawUserData) {
         const authService = this.apiClient.getAuthService();
-        return authService.loginUserWithRawData(rawUserData);
+        const result = await authService.loginUserWithRawData(rawUserData);
+        this.events?.emitSuccess({
+            domain: 'authentication',
+            type: 'login_success',
+            userMessage: 'Successfully logged in',
+            details: { user: result.user }
+        });
+        return result;
     }
     /**
      * Get current authenticated user
@@ -10980,6 +11159,11 @@ class AuthManager {
     async clearAuth() {
         const authService = this.apiClient.getAuthService();
         await authService.clearTokens();
+        this.events?.emitSuccess({
+            domain: 'authentication',
+            type: 'logout_success',
+            userMessage: 'Successfully logged out'
+        });
     }
     /**
      * Ensure authentication token is valid
@@ -18849,104 +19033,6 @@ function createPersSDK(httpClient, config) {
     return new PersSDK(httpClient, config);
 }
 
-class IndexedDBTokenStorage {
-    constructor() {
-        this.supportsObjects = true;
-        this.dbPromise = null;
-        if (typeof indexedDB === 'undefined') {
-            console.warn('IndexedDB is not available in this environment');
-        }
-    }
-    getDB() {
-        if (this.dbPromise)
-            return this.dbPromise;
-        this.dbPromise = new Promise((resolve, reject) => {
-            if (typeof indexedDB === 'undefined') {
-                return reject(new Error('IndexedDB not supported'));
-            }
-            const request = indexedDB.open(IndexedDBTokenStorage.DB_NAME, IndexedDBTokenStorage.DB_VERSION);
-            request.onupgradeneeded = (event) => {
-                const db = event.target.result;
-                if (!db.objectStoreNames.contains(IndexedDBTokenStorage.STORE_NAME)) {
-                    db.createObjectStore(IndexedDBTokenStorage.STORE_NAME);
-                }
-            };
-            request.onsuccess = (event) => {
-                resolve(event.target.result);
-            };
-            request.onerror = (event) => {
-                reject(event.target.error);
-            };
-        });
-        return this.dbPromise;
-    }
-    async get(key) {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readonly');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.get(key);
-                request.onsuccess = () => resolve(request.result || null);
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.warn('[IndexedDBTokenStorage] Failed to get key', key, e);
-            return null;
-        }
-    }
-    async set(key, value) {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.put(value, key);
-                request.onsuccess = () => resolve();
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.error('[IndexedDBTokenStorage] Failed to set key', key, e);
-            throw e;
-        }
-    }
-    async remove(key) {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.delete(key);
-                request.onsuccess = () => resolve();
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.warn('[IndexedDBTokenStorage] Failed to remove key', key, e);
-        }
-    }
-    async clear() {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.clear();
-                request.onsuccess = () => resolve();
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.warn('[IndexedDBTokenStorage] Failed to clear storage', e);
-        }
-    }
-}
-IndexedDBTokenStorage.DB_NAME = 'pers-sdk-storage';
-IndexedDBTokenStorage.STORE_NAME = 'auth-tokens';
-IndexedDBTokenStorage.DB_VERSION = 1;
-
 /**
  * Environment Detection Utility
  * Detects runtime environment for platform-specific behaviors
@@ -19272,11 +19358,19 @@ class ReactNativeSecureStorage {
  * React Native Unified Auth Provider
  *
  * Creates a platform-specific auth provider that automatically selects the appropriate storage:
- * - Web: Uses LocalStorageTokenStorage from core SDK
+ * - Web: Uses IndexedDBTokenStorage for DPoP (CryptoKey persistence) or LocalStorage
  * - Mobile: Uses AsyncStorage-based storage
  */
 // Use React Native's built-in platform detection
 const isWebPlatform = reactNative.Platform.OS === 'web';
+/**
+ * Check if IndexedDB is available (web environments only)
+ * Uses globalThis to avoid TypeScript errors in React Native context
+ */
+function hasIndexedDB() {
+    return typeof globalThis !== 'undefined' &&
+        typeof globalThis.indexedDB !== 'undefined';
+}
 /**
  * Create a React Native auth provider with platform-appropriate storage
  *
@@ -19294,9 +19388,29 @@ function createReactNativeAuthProvider(projectKey, config = {}) {
     }
     const { keyPrefix = `pers_${projectKey.slice(0, 8)}_`, debug = false, customStorage, authType = exports.AccountOwnerType.USER, dpop } = config;
     // Platform-specific storage selection
-    const tokenStorage = customStorage || (isWebPlatform
-        ? new LocalStorageTokenStorage()
-        : new ReactNativeSecureStorage(keyPrefix));
+    // Web with DPoP: Use IndexedDB for CryptoKey persistence
+    // Web without DPoP or no IndexedDB: Use LocalStorage
+    // Mobile: Use ReactNativeSecureStorage
+    let tokenStorage;
+    if (customStorage) {
+        tokenStorage = customStorage;
+    }
+    else if (isWebPlatform) {
+        // On web, prefer IndexedDB when DPoP is enabled for proper CryptoKey persistence
+        const dpopEnabled = dpop?.enabled ?? true;
+        if (dpopEnabled && hasIndexedDB()) {
+            tokenStorage = new IndexedDBTokenStorage();
+        }
+        else {
+            if (dpopEnabled && !hasIndexedDB()) {
+                console.warn('[ReactNativeAuthProvider] DPoP requested but IndexedDB not available. Falling back to LocalStorage (DPoP will be disabled by DefaultAuthProvider).');
+            }
+            tokenStorage = new LocalStorageTokenStorage();
+        }
+    }
+    else {
+        tokenStorage = new ReactNativeSecureStorage(keyPrefix);
+    }
     // Prepare DPoP config ensuring enabled is boolean (default true)
     const dpopConfig = dpop ? {
         enabled: dpop.enabled ?? true,
@@ -19598,6 +19712,7 @@ const SDKContext = react.createContext(null);
  */
 const PersSDKProvider = ({ children, config }) => {
     const initializingRef = react.useRef(false);
+    const eventUnsubscribeRef = react.useRef(null);
     // State refs for stable functions to read current values
     const sdkRef = react.useRef(null);
     const isInitializedRef = react.useRef(false);
@@ -19651,6 +19766,21 @@ const PersSDKProvider = ({ children, config }) => {
             };
             // Initialize PersSDK with platform-aware auth provider
             const sdkInstance = new PersSDK(httpClient, sdkConfig);
+            // Subscribe to auth events BEFORE exposing SDK to consumers
+            // This ensures no events are missed due to React timing
+            eventUnsubscribeRef.current = sdkInstance.events.subscribe((event) => {
+                if (event.type === 'session_restored' || event.type === 'login_success') {
+                    const details = event.details;
+                    if (details?.user) {
+                        setUser(details.user);
+                        setIsAuthenticated(true);
+                    }
+                }
+                if (event.type === 'logout_success' || event.type === 'session_restoration_failed' || event.code === 'AUTH_FAILED') {
+                    setUser(null);
+                    setIsAuthenticated(false);
+                }
+            }, { domains: ['authentication'], replay: true });
             setAuthProvider(authProvider);
             setSdk(sdkInstance);
             setIsInitialized(true);
@@ -19664,6 +19794,15 @@ const PersSDKProvider = ({ children, config }) => {
             initializingRef.current = false;
         }
     }, [isInitialized]);
+    // Cleanup subscription on unmount
+    react.useEffect(() => {
+        return () => {
+            if (eventUnsubscribeRef.current) {
+                eventUnsubscribeRef.current();
+                eventUnsubscribeRef.current = null;
+            }
+        };
+    }, []);
     const setAuthenticationState = react.useCallback((user, isAuthenticated) => {
         setUser(user);
         setIsAuthenticated(isAuthenticated);
@@ -19710,32 +19849,7 @@ const PersSDKProvider = ({ children, config }) => {
             console.error('[PersSDK] Failed to restore session:', error);
             throw error;
         }
-    }, [setAuthenticationState]); // Depends on setAuthenticationState
-    // Listen for authentication events from core SDK
-    // Set up immediately when SDK is created (don't wait for isInitialized)
-    // to catch session_restored events that fire during SDK initialization
-    react.useEffect(() => {
-        if (!sdk)
-            return;
-        const unsubscribe = sdk.events.subscribe((event) => {
-            // Handle both session restoration and fresh login
-            if (event.type === 'session_restored' || event.type === 'login_success') {
-                const details = event.details;
-                if (details?.user) {
-                    console.log(`[PersSDK] ${event.type}: syncing user state`);
-                    setAuthenticationState(details.user, true);
-                }
-            }
-            // Session restoration failed or auth error - clear React state
-            if (event.type === 'session_restoration_failed' || event.code === 'AUTH_FAILED') {
-                console.log('[PersSDK] Authentication failed - clearing session');
-                setAuthenticationState(null, false);
-            }
-        }, { domains: ['authentication'], replay: true });
-        return () => {
-            unsubscribe();
-        };
-    }, [sdk, setAuthenticationState]);
+    }, [setAuthenticationState]);
     // iOS/Android: Monitor app state and validate tokens when app becomes active
     react.useEffect(() => {
         if (!sdk || reactNative.Platform.OS === 'web') {
@@ -19743,7 +19857,6 @@ const PersSDKProvider = ({ children, config }) => {
         }
         const handleAppStateChange = async (nextAppState) => {
             if (nextAppState === 'active' && isAuthenticated) {
-                console.log('[PersSDK] App became active - validating tokens');
                 try {
                     // Trigger token validation when app resumes from background
                     // This ensures tokens are checked after extended inactivity
@@ -19833,7 +19946,7 @@ const usePersSDK = () => {
  * ```
  */
 const useAuth = () => {
-    const { sdk, authProvider, isInitialized, isAuthenticated, user, setAuthenticationState, refreshUserData } = usePersSDK();
+    const { sdk, authProvider, isInitialized, isAuthenticated, user, refreshUserData } = usePersSDK();
     /**
      * Authenticates a user with a JWT token
      *
@@ -19856,8 +19969,7 @@ const useAuth = () => {
         try {
             // Set token in auth provider
             await authProvider.setAccessToken(jwtToken);
-            // Perform login using the manager
-            // SDK emits login_success event with user data - PersSDKProvider handles state sync
+            // Perform login - emits login_success event which Provider handles
             const result = await sdk.auth.loginWithToken(jwtToken, userType);
             return result;
         }
@@ -19883,8 +19995,7 @@ const useAuth = () => {
             throw new Error('SDK not initialized. Call initialize() first.');
         }
         try {
-            // Use the raw data login from the auth manager
-            // SDK emits login_success event with user data - PersSDKProvider handles state sync
+            // Use the raw data login - emits login_success event which Provider handles
             const result = await sdk.auth.loginWithRawData(rawUserData);
             // Set token from result
             if (result.accessToken) {
@@ -19909,17 +20020,18 @@ const useAuth = () => {
      * ```
      */
     const logout = react.useCallback(async () => {
+        if (!sdk) {
+            throw new Error('SDK not initialized. Call initialize() first.');
+        }
         try {
-            if (authProvider) {
-                await authProvider.clearTokens();
-            }
-            setAuthenticationState(null, false);
+            // clearAuth emits logout_success event which Provider handles
+            await sdk.auth.clearAuth();
         }
         catch (error) {
             console.error('Logout failed:', error);
             throw error;
         }
-    }, [authProvider, setAuthenticationState]);
+    }, [sdk]);
     /**
      * Retrieves the current authenticated user data
      *
@@ -19993,9 +20105,9 @@ const useAuth = () => {
         if (!sdk) {
             throw new Error('SDK not initialized. Call initialize() first.');
         }
+        // clearAuth emits logout_success event which Provider handles
         await sdk.auth.clearAuth();
-        setAuthenticationState(null, false);
-    }, [sdk, setAuthenticationState]);
+    }, [sdk]);
     /**
      * Checks if the current authentication is valid (non-expired)
      *