@opexa/portal-sdk 0.59.127 → 0.59.129

package/dist/index.js

@@ -1,6 +1,6 @@
-import { CmsPortalService, GameService, ExtensionService, FileService, WalletService, AccountService, ReportService, PortalService, TriggerService, AuthService, getFingerPrint, isIOSPlatform } from './chunk-36U3QUDP.js';
-import { GraphQLClient, isPlainObject } from './chunk-5WRVWQBT.js';
-import './chunk-ROBGEUSE.js';
+import { CmsPortalService, GameService, ExtensionService, FileService, WalletService, AccountService, ReportService, PortalService, TriggerService, AuthService, getFingerPrint, isIOSPlatform } from './chunk-ROZQZKKD.js';
+import { GraphQLClient, isPlainObject } from './chunk-7APXFZ5G.js';
+import './chunk-WVFSGB7Y.js';
 import { ObjectId } from '@opexa/object-id';
 export { ObjectId } from '@opexa/object-id';
 import { Capacitor } from '@capacitor/core';
@@ -380,6 +380,36 @@ function createRefreshTokenStore(logger, sessionPrefix) {
   return new PreferencesRefreshTokenStore(key, logger);
 }
 
+// src/sdk/session-lifecycle.ts
+var SessionLifecycle = class {
+  controller = new AbortController();
+  get signal() {
+    return this.controller.signal;
+  }
+  renew() {
+    this.controller.abort();
+    this.controller = new AbortController();
+    return this.controller.signal;
+  }
+  logout() {
+    this.renew();
+  }
+};
+var CredentialMutationLock = class {
+  tail = Promise.resolve();
+  wait() {
+    return this.tail;
+  }
+  run(operation) {
+    const result = this.tail.then(operation, operation);
+    this.tail = result.then(
+      () => void 0,
+      () => void 0
+    );
+    return result;
+  }
+};
+
 // src/sdk/session-manager.ts
 var SessionManager = class {
   logger;
@@ -388,6 +418,8 @@ var SessionManager = class {
   authService;
   walletService;
   _refreshing = false;
+  lifecycle = new SessionLifecycle();
+  mutations = new CredentialMutationLock();
   /*
    * v4 access tokens live in memory only, so an XSS-readable storage layer
    * never holds a live one. Re-minted from the HttpOnly cookie, or from
@@ -417,38 +449,44 @@ var SessionManager = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  async persist(data, version) {
-    const now = /* @__PURE__ */ new Date();
-    if (version === 4) {
-      if (!data.session || !data.accessToken) {
-        this.logger.error(
-          "Malformed session response: expected 'session' and 'accessToken'."
+  async persist(data, version, signal) {
+    return this.mutations.run(async () => {
+      if (signal.aborted) return true;
+      const now = /* @__PURE__ */ new Date();
+      this.refreshing = false;
+      this.v4RefreshPromise = null;
+      if (version === 4) {
+        if (!data.session || !data.accessToken) {
+          this.logger.error(
+            "Malformed session response: expected 'session' and 'accessToken'."
+          );
+          return false;
+        }
+        this.v4AccessToken = data.accessToken;
+        this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
+        this.invalidReason = null;
+        if (data.refreshToken) {
+          await this.refreshTokenStore.set(data.refreshToken);
+        }
+        if (signal.aborted) return true;
+        localStorage.setItem(
+          this.storageKey,
+          JSON.stringify({ version, session: data.session })
         );
-        return false;
+        return true;
       }
-      this.v4AccessToken = data.accessToken;
-      this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
       this.invalidReason = null;
-      if (data.refreshToken) {
-        await this.refreshTokenStore.set(data.refreshToken);
-      }
       localStorage.setItem(
         this.storageKey,
-        JSON.stringify({ version, session: data.session })
+        JSON.stringify({
+          version,
+          ...data,
+          accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+          refreshTokenExpiresAt: subMinutes(addDays(now, 1), 2).getTime()
+        })
       );
       return true;
-    }
-    this.invalidReason = null;
-    localStorage.setItem(
-      this.storageKey,
-      JSON.stringify({
-        version,
-        ...data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 1), 2).getTime()
-      })
-    );
-    return true;
+    });
   }
   malformedResponseError() {
     return {
@@ -460,6 +498,10 @@ var SessionManager = class {
     };
   }
   async create(input, version = 1) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true, data: null };
+    const signal = this.lifecycle.renew();
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return {
@@ -495,7 +537,7 @@ var SessionManager = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      if (!await this.persist(r1.data, version))
+      if (!await this.persist(r1.data, version, signal))
         return this.malformedResponseError();
       return {
         ok: true,
@@ -505,7 +547,7 @@ var SessionManager = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!await this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version, signal))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -524,7 +566,7 @@ var SessionManager = class {
         version
       );
       if (res2.ok) {
-        if (!await this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version, signal))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -537,7 +579,7 @@ var SessionManager = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!await this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version, signal))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -556,7 +598,7 @@ var SessionManager = class {
         }
       };
     }
-    if (!await this.persist(res.data, version))
+    if (!await this.persist(res.data, version, signal))
       return this.malformedResponseError();
     return {
       ok: true,
@@ -564,11 +606,15 @@ var SessionManager = class {
     };
   }
   async createFromAuthenticator(input) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true };
+    const signal = this.lifecycle.renew();
     const res = await this.authService.authenticate(input);
     if (res.ok) {
       if (this.isServer) {
         this.logger.warn("'localStorage' is not available on the server.");
-      } else if (!await this.persist(res.data, 1)) {
+      } else if (!await this.persist(res.data, 1, signal)) {
         return this.malformedResponseError();
       }
       return { ok: true };
@@ -577,6 +623,7 @@ var SessionManager = class {
     }
   }
   async get() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return {
@@ -586,6 +633,7 @@ var SessionManager = class {
     }
     if (this.refreshing) {
       await sleep(1e3);
+      if (signal.aborted) return { ok: true, data: null };
       return await this.get();
     }
     const val = localStorage.getItem(this.storageKey);
@@ -620,8 +668,10 @@ var SessionManager = class {
         this.refreshing = true;
         const res = await this.authService.refreshSession(
           obj.refreshToken,
-          obj.version ?? 1
+          obj.version ?? 1,
+          signal
         );
+        if (signal.aborted) return { ok: true, data: null };
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -654,6 +704,8 @@ var SessionManager = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -678,6 +730,7 @@ var SessionManager = class {
     return await this.refreshV4(session);
   }
   async refresh() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return {
@@ -703,8 +756,10 @@ var SessionManager = class {
       this.refreshing = true;
       const res = await this.authService.refreshSession(
         obj.refreshToken,
-        obj.version ?? 1
+        obj.version ?? 1,
+        signal
       );
+      if (signal.aborted) return { ok: true, data: null };
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -737,6 +792,8 @@ var SessionManager = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -748,18 +805,20 @@ var SessionManager = class {
   }
   async refreshV4(session) {
     if (this.v4RefreshPromise) return await this.v4RefreshPromise;
-    this.v4RefreshPromise = this.requestV4Refresh(session);
+    const promise = this.requestV4Refresh(session, this.lifecycle.signal);
+    this.v4RefreshPromise = promise;
     try {
-      return await this.v4RefreshPromise;
+      return await promise;
     } finally {
-      this.v4RefreshPromise = null;
+      if (this.v4RefreshPromise === promise) this.v4RefreshPromise = null;
     }
   }
-  async requestV4Refresh(session) {
+  async requestV4Refresh(session, signal) {
     this.logger.info("Refreshing session...");
     let refreshToken;
     if (isIOSPlatform()) {
       refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (signal.aborted) return { ok: true, data: null };
       if (!refreshToken) {
         this.logger.warn("No stored refresh token. Session expired.");
         this.v4AccessToken = null;
@@ -776,7 +835,8 @@ var SessionManager = class {
       }
     }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(refreshToken, 4);
+    const res = await this.authService.refreshSession(refreshToken, 4, signal);
+    if (signal.aborted) return { ok: true, data: null };
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
       const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
@@ -788,6 +848,7 @@ var SessionManager = class {
       }
       this.refreshing = false;
       if (terminal) await this.refreshTokenStore.remove();
+      if (signal.aborted) return { ok: true, data: null };
       return {
         ok: false,
         error: res.error
@@ -797,8 +858,13 @@ var SessionManager = class {
     this.logger.success("Session refreshed!");
     this.invalidReason = null;
     if (res.data.refreshToken) {
-      await this.refreshTokenStore.set(res.data.refreshToken);
+      await this.mutations.run(async () => {
+        if (!signal.aborted && res.data.refreshToken) {
+          await this.refreshTokenStore.set(res.data.refreshToken);
+        }
+      });
     }
+    if (signal.aborted) return { ok: true, data: null };
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
@@ -816,26 +882,53 @@ var SessionManager = class {
       this.logger.warn("'localStorage' is not available on the server.");
       return;
     }
-    let version = 1;
+    let version = this.v4AccessToken ? 4 : 1;
+    let accessToken = this.v4AccessToken ?? void 0;
+    let accessTokenExpiresAt = this.v4AccessTokenExpiresAt;
+    let refreshToken;
     const val = localStorage.getItem(this.storageKey);
     if (val) {
       try {
         const stored = JSON.parse(val);
         version = stored.version ?? 1;
+        accessToken = stored.version === 4 ? this.v4AccessToken ?? void 0 : stored.accessToken;
+        accessTokenExpiresAt = stored.version === 4 ? this.v4AccessTokenExpiresAt : stored.accessTokenExpiresAt;
+        if (stored.version !== 4) refreshToken = stored.refreshToken;
       } catch {
       }
     }
-    const res = await this.get();
-    if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken, version);
-    }
+    this.lifecycle.logout();
+    this.refreshing = false;
+    this.v4RefreshPromise = null;
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
     this.invalidReason = null;
-    await this.refreshTokenStore.remove();
     localStorage.removeItem(this.storageKey);
+    await this.mutations.run(async () => {
+      try {
+        if (val && (!accessToken || !accessTokenExpiresAt || Date.now() > accessTokenExpiresAt)) {
+          if (version === 4 && isIOSPlatform()) {
+            refreshToken = await this.refreshTokenStore.get() ?? void 0;
+          }
+          if (refreshToken || version === 4 && !isIOSPlatform()) {
+            accessToken = void 0;
+            const res = await this.authService.refreshSession(
+              refreshToken,
+              version
+            );
+            if (res.ok) accessToken = res.data.accessToken;
+          }
+        }
+        if (accessToken) {
+          await this.authService.destroySession(accessToken, version);
+        }
+      } finally {
+        if (version === 4) await this.refreshTokenStore.remove();
+      }
+    });
   }
   async verify() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return { valid: true };
@@ -848,7 +941,8 @@ var SessionManager = class {
       try {
         const stored = JSON.parse(val);
         if (stored.version === 4) {
-          const res = await this.verifyV4(stored.session);
+          const res = await this.verifyV4(stored.session, signal);
+          if (signal.aborted) return { valid: true };
           if (!res.valid) localStorage.removeItem(this.storageKey);
           return res;
         }
@@ -856,32 +950,37 @@ var SessionManager = class {
       }
     }
     const s = await this.get();
+    if (signal.aborted) return { valid: true };
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
       this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
-    const v = await this.authService.verifySession(s.data.accessToken);
+    const v = await this.authService.verifySession(s.data.accessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       this.invalidReason = "INVALID_SESSION";
       localStorage.removeItem(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
-  async verifyV4(session) {
+  async verifyV4(session, signal) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
+      if (signal.aborted) return { valid: true };
       if (res.ok) return { valid: true };
       if (!this.invalidReason) return { valid: true };
       return { valid: false, reason: this.invalidReason };
     }
-    const v = await this.authService.verifySession(this.v4AccessToken);
+    const v = await this.authService.verifySession(this.v4AccessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       localStorage.removeItem(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
       this.invalidReason = "INVALID_SESSION";
       await this.refreshTokenStore.remove();
+      if (signal.aborted) return { valid: true };
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
@@ -910,6 +1009,8 @@ var SessionManagerCookie = class {
   authService;
   walletService;
   _refreshing = false;
+  lifecycle = new SessionLifecycle();
+  mutations = new CredentialMutationLock();
   /*
    * v4 access tokens live in memory only, so an XSS-readable storage layer
    * never holds a live one. Re-minted from the HttpOnly cookie, or from
@@ -932,34 +1033,44 @@ var SessionManagerCookie = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  async persist(data, version) {
-    const now = /* @__PURE__ */ new Date();
-    this.invalidReason = null;
-    if (version === 4) {
-      this.v4AccessToken = data.accessToken ?? null;
-      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
-      if (data.refreshToken) {
-        await this.refreshTokenStore.set(data.refreshToken);
+  async persist(data, version, signal) {
+    return this.mutations.run(async () => {
+      if (signal.aborted) return;
+      const now = /* @__PURE__ */ new Date();
+      this.refreshing = false;
+      this.v4RefreshPromise = null;
+      this.invalidReason = null;
+      if (version === 4) {
+        this.v4AccessToken = data.accessToken ?? null;
+        this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+        if (data.refreshToken) {
+          await this.refreshTokenStore.set(data.refreshToken);
+        }
+        if (signal.aborted) return;
+        cookies.set(
+          this.storageKey,
+          JSON.stringify({ version, session: data.session }),
+          { expires: subMinutes(addDays(now, 15), 2) }
+        );
+        return;
       }
       cookies.set(
         this.storageKey,
-        JSON.stringify({ version, session: data.session }),
-        { expires: subMinutes(addDays(now, 15), 2) }
+        JSON.stringify({
+          version,
+          ...data,
+          accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+          refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+        }),
+        { expires: subMinutes(addDays(now, 30), 2) }
       );
-      return;
-    }
-    cookies.set(
-      this.storageKey,
-      JSON.stringify({
-        version,
-        ...data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      }),
-      { expires: subMinutes(addDays(now, 30), 2) }
-    );
+    });
   }
   async create(input, version = 1) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true, data: null };
+    const signal = this.lifecycle.renew();
     if (input.type === "MAYA") {
       localStorage.setItem(this.platformStorageKey, "MAYA");
       const f0 = () => this.walletService.mayaSession({ id: input.sessionId });
@@ -985,7 +1096,7 @@ var SessionManagerCookie = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      await this.persist(r1.data, version);
+      await this.persist(r1.data, version, signal);
       return {
         ok: true,
         data: null
@@ -994,7 +1105,7 @@ var SessionManagerCookie = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        await this.persist(res2.data, version);
+        await this.persist(res2.data, version, signal);
         return {
           ok: true,
           data: null
@@ -1011,7 +1122,7 @@ var SessionManagerCookie = class {
         version
       );
       if (res2.ok) {
-        await this.persist(res2.data, version);
+        await this.persist(res2.data, version, signal);
         return {
           ok: true,
           data: null
@@ -1023,7 +1134,7 @@ var SessionManagerCookie = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        await this.persist(res2.data, version);
+        await this.persist(res2.data, version, signal);
         return {
           ok: true,
           data: null
@@ -1041,19 +1152,23 @@ var SessionManagerCookie = class {
         }
       };
     }
-    await this.persist(res.data, version);
+    await this.persist(res.data, version, signal);
     return {
       ok: true,
       data: null
     };
   }
   async createFromAuthenticator(input) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true };
+    const signal = this.lifecycle.renew();
     const res = await this.authService.authenticate(input);
     if (res.ok) {
       if (this.isServer) {
         this.logger.warn("'client cookies' is not available on the server.");
       } else {
-        await this.persist(res.data, 1);
+        await this.persist(res.data, 1, signal);
       }
       return { ok: true };
     } else {
@@ -1061,6 +1176,7 @@ var SessionManagerCookie = class {
     }
   }
   async get() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return {
@@ -1070,6 +1186,7 @@ var SessionManagerCookie = class {
     }
     if (this.refreshing) {
       await sleep(1e3);
+      if (signal.aborted) return { ok: true, data: null };
       return await this.get();
     }
     const val = cookies.get(this.storageKey);
@@ -1104,8 +1221,10 @@ var SessionManagerCookie = class {
         this.refreshing = true;
         const res = await this.authService.refreshSession(
           obj.refreshToken,
-          obj.version ?? 1
+          obj.version ?? 1,
+          signal
         );
+        if (signal.aborted) return { ok: true, data: null };
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -1141,6 +1260,8 @@ var SessionManagerCookie = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -1165,6 +1286,7 @@ var SessionManagerCookie = class {
     return await this.refreshV4(session);
   }
   async refresh() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return {
@@ -1190,8 +1312,10 @@ var SessionManagerCookie = class {
       this.refreshing = true;
       const res = await this.authService.refreshSession(
         obj.refreshToken,
-        obj.version ?? 1
+        obj.version ?? 1,
+        signal
       );
+      if (signal.aborted) return { ok: true, data: null };
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -1226,6 +1350,8 @@ var SessionManagerCookie = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -1237,18 +1363,20 @@ var SessionManagerCookie = class {
   }
   async refreshV4(session) {
     if (this.v4RefreshPromise) return await this.v4RefreshPromise;
-    this.v4RefreshPromise = this.requestV4Refresh(session);
+    const promise = this.requestV4Refresh(session, this.lifecycle.signal);
+    this.v4RefreshPromise = promise;
     try {
-      return await this.v4RefreshPromise;
+      return await promise;
     } finally {
-      this.v4RefreshPromise = null;
+      if (this.v4RefreshPromise === promise) this.v4RefreshPromise = null;
     }
   }
-  async requestV4Refresh(session) {
+  async requestV4Refresh(session, signal) {
     this.logger.info("Refreshing session...");
     let refreshToken;
     if (isIOSPlatform()) {
       refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (signal.aborted) return { ok: true, data: null };
       if (!refreshToken) {
         this.logger.warn("No stored refresh token. Session expired.");
         this.v4AccessToken = null;
@@ -1265,7 +1393,8 @@ var SessionManagerCookie = class {
       }
     }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(refreshToken, 4);
+    const res = await this.authService.refreshSession(refreshToken, 4, signal);
+    if (signal.aborted) return { ok: true, data: null };
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
       const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
@@ -1277,6 +1406,7 @@ var SessionManagerCookie = class {
       }
       this.refreshing = false;
       if (terminal) await this.refreshTokenStore.remove();
+      if (signal.aborted) return { ok: true, data: null };
       return {
         ok: false,
         error: res.error
@@ -1286,8 +1416,13 @@ var SessionManagerCookie = class {
     this.logger.success("Session refreshed!");
     this.invalidReason = null;
     if (res.data.refreshToken) {
-      await this.refreshTokenStore.set(res.data.refreshToken);
+      await this.mutations.run(async () => {
+        if (!signal.aborted && res.data.refreshToken) {
+          await this.refreshTokenStore.set(res.data.refreshToken);
+        }
+      });
     }
+    if (signal.aborted) return { ok: true, data: null };
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
@@ -1305,26 +1440,53 @@ var SessionManagerCookie = class {
       this.logger.warn("'client cookies' is not available on the server.");
       return;
     }
-    let version = 1;
+    let version = this.v4AccessToken ? 4 : 1;
+    let accessToken = this.v4AccessToken ?? void 0;
+    let accessTokenExpiresAt = this.v4AccessTokenExpiresAt;
+    let refreshToken;
     const val = cookies.get(this.storageKey);
     if (val) {
       try {
         const stored = JSON.parse(val);
         version = stored.version ?? 1;
+        accessToken = stored.version === 4 ? this.v4AccessToken ?? void 0 : stored.accessToken;
+        accessTokenExpiresAt = stored.version === 4 ? this.v4AccessTokenExpiresAt : stored.accessTokenExpiresAt;
+        if (stored.version !== 4) refreshToken = stored.refreshToken;
       } catch {
       }
     }
-    const res = await this.get();
-    if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken, version);
-    }
+    this.lifecycle.logout();
+    this.refreshing = false;
+    this.v4RefreshPromise = null;
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
     this.invalidReason = null;
-    await this.refreshTokenStore.remove();
     cookies.remove(this.storageKey);
+    await this.mutations.run(async () => {
+      try {
+        if (val && (!accessToken || !accessTokenExpiresAt || Date.now() > accessTokenExpiresAt)) {
+          if (version === 4 && isIOSPlatform()) {
+            refreshToken = await this.refreshTokenStore.get() ?? void 0;
+          }
+          if (refreshToken || version === 4 && !isIOSPlatform()) {
+            accessToken = void 0;
+            const res = await this.authService.refreshSession(
+              refreshToken,
+              version
+            );
+            if (res.ok) accessToken = res.data.accessToken;
+          }
+        }
+        if (accessToken) {
+          await this.authService.destroySession(accessToken, version);
+        }
+      } finally {
+        if (version === 4) await this.refreshTokenStore.remove();
+      }
+    });
   }
   async verify() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return { valid: true };
@@ -1337,7 +1499,8 @@ var SessionManagerCookie = class {
       try {
         const stored = JSON.parse(val);
         if (stored.version === 4) {
-          const res = await this.verifyV4(stored.session);
+          const res = await this.verifyV4(stored.session, signal);
+          if (signal.aborted) return { valid: true };
           if (!res.valid) cookies.remove(this.storageKey);
           return res;
         }
@@ -1345,32 +1508,37 @@ var SessionManagerCookie = class {
       }
     }
     const s = await this.get();
+    if (signal.aborted) return { valid: true };
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
       this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
-    const v = await this.authService.verifySession(s.data.accessToken);
+    const v = await this.authService.verifySession(s.data.accessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       this.invalidReason = "INVALID_SESSION";
       cookies.remove(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
-  async verifyV4(session) {
+  async verifyV4(session, signal) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
+      if (signal.aborted) return { valid: true };
       if (res.ok) return { valid: true };
       if (!this.invalidReason) return { valid: true };
       return { valid: false, reason: this.invalidReason };
     }
-    const v = await this.authService.verifySession(this.v4AccessToken);
+    const v = await this.authService.verifySession(this.v4AccessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       cookies.remove(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
       this.invalidReason = "INVALID_SESSION";
       await this.refreshTokenStore.remove();
+      if (signal.aborted) return { valid: true };
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }