@opexa/portal-sdk 0.59.128 → 0.59.129

package/dist/index.cjs

@@ -4882,6 +4882,15 @@ var ERROR_MAP = {
 };
 
 // src/services/auth.service.ts
+function getCompatibleSignal(signal) {
+  if (!signal) return void 0;
+  try {
+    new Request("about:blank", { signal });
+    return signal;
+  } catch {
+    return void 0;
+  }
+}
 var AuthService = class {
   url;
   graphqlClient;
@@ -5049,7 +5058,7 @@ var AuthService = class {
     }
     throw new Error("Invalid input 'type'");
   }
-  async refreshSession(refreshToken, version = 1) {
+  async refreshSession(refreshToken, version = 1, signal) {
     const headers = new Headers(this.headers);
     if (version !== 4 || refreshToken) {
       headers.append("Authorization", `Bearer ${refreshToken}`);
@@ -5068,6 +5077,7 @@ var AuthService = class {
         {
           method: "POST",
           headers,
+          signal: getCompatibleSignal(signal),
           ...version === 4 && { credentials: "include" }
         }
       );
@@ -5136,13 +5146,14 @@ var AuthService = class {
       return { ok: false, error: statusCodeToOperationError(500) };
     }
   }
-  async verifySession(accessToken) {
+  async verifySession(accessToken, signal) {
     const headers = new Headers(this.headers);
     headers.append("Authorization", `Bearer ${accessToken}`);
     try {
       const res = await fetch(`${this.url}/session`, {
         method: "GET",
-        headers
+        headers,
+        signal: getCompatibleSignal(signal)
       });
       return res.ok;
     } catch {
@@ -7737,6 +7748,36 @@ function createRefreshTokenStore(logger, sessionPrefix) {
   return new PreferencesRefreshTokenStore(key, logger);
 }
 
+// src/sdk/session-lifecycle.ts
+var SessionLifecycle = class {
+  controller = new AbortController();
+  get signal() {
+    return this.controller.signal;
+  }
+  renew() {
+    this.controller.abort();
+    this.controller = new AbortController();
+    return this.controller.signal;
+  }
+  logout() {
+    this.renew();
+  }
+};
+var CredentialMutationLock = class {
+  tail = Promise.resolve();
+  wait() {
+    return this.tail;
+  }
+  run(operation) {
+    const result = this.tail.then(operation, operation);
+    this.tail = result.then(
+      () => void 0,
+      () => void 0
+    );
+    return result;
+  }
+};
+
 // src/sdk/session-manager.ts
 var SessionManager = class {
   logger;
@@ -7745,6 +7786,8 @@ var SessionManager = class {
   authService;
   walletService;
   _refreshing = false;
+  lifecycle = new SessionLifecycle();
+  mutations = new CredentialMutationLock();
   /*
    * v4 access tokens live in memory only, so an XSS-readable storage layer
    * never holds a live one. Re-minted from the HttpOnly cookie, or from
@@ -7774,38 +7817,44 @@ var SessionManager = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  async persist(data, version) {
-    const now = /* @__PURE__ */ new Date();
-    if (version === 4) {
-      if (!data.session || !data.accessToken) {
-        this.logger.error(
-          "Malformed session response: expected 'session' and 'accessToken'."
+  async persist(data, version, signal) {
+    return this.mutations.run(async () => {
+      if (signal.aborted) return true;
+      const now = /* @__PURE__ */ new Date();
+      this.refreshing = false;
+      this.v4RefreshPromise = null;
+      if (version === 4) {
+        if (!data.session || !data.accessToken) {
+          this.logger.error(
+            "Malformed session response: expected 'session' and 'accessToken'."
+          );
+          return false;
+        }
+        this.v4AccessToken = data.accessToken;
+        this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
+        this.invalidReason = null;
+        if (data.refreshToken) {
+          await this.refreshTokenStore.set(data.refreshToken);
+        }
+        if (signal.aborted) return true;
+        localStorage.setItem(
+          this.storageKey,
+          JSON.stringify({ version, session: data.session })
         );
-        return false;
+        return true;
       }
-      this.v4AccessToken = data.accessToken;
-      this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
       this.invalidReason = null;
-      if (data.refreshToken) {
-        await this.refreshTokenStore.set(data.refreshToken);
-      }
       localStorage.setItem(
         this.storageKey,
-        JSON.stringify({ version, session: data.session })
+        JSON.stringify({
+          version,
+          ...data,
+          accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+          refreshTokenExpiresAt: subMinutes(addDays(now, 1), 2).getTime()
+        })
       );
       return true;
-    }
-    this.invalidReason = null;
-    localStorage.setItem(
-      this.storageKey,
-      JSON.stringify({
-        version,
-        ...data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 1), 2).getTime()
-      })
-    );
-    return true;
+    });
   }
   malformedResponseError() {
     return {
@@ -7817,6 +7866,10 @@ var SessionManager = class {
     };
   }
   async create(input, version = 1) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true, data: null };
+    const signal = this.lifecycle.renew();
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return {
@@ -7852,7 +7905,7 @@ var SessionManager = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      if (!await this.persist(r1.data, version))
+      if (!await this.persist(r1.data, version, signal))
         return this.malformedResponseError();
       return {
         ok: true,
@@ -7862,7 +7915,7 @@ var SessionManager = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!await this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version, signal))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -7881,7 +7934,7 @@ var SessionManager = class {
         version
       );
       if (res2.ok) {
-        if (!await this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version, signal))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -7894,7 +7947,7 @@ var SessionManager = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!await this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version, signal))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -7913,7 +7966,7 @@ var SessionManager = class {
         }
       };
     }
-    if (!await this.persist(res.data, version))
+    if (!await this.persist(res.data, version, signal))
       return this.malformedResponseError();
     return {
       ok: true,
@@ -7921,11 +7974,15 @@ var SessionManager = class {
     };
   }
   async createFromAuthenticator(input) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true };
+    const signal = this.lifecycle.renew();
     const res = await this.authService.authenticate(input);
     if (res.ok) {
       if (this.isServer) {
         this.logger.warn("'localStorage' is not available on the server.");
-      } else if (!await this.persist(res.data, 1)) {
+      } else if (!await this.persist(res.data, 1, signal)) {
         return this.malformedResponseError();
       }
       return { ok: true };
@@ -7934,6 +7991,7 @@ var SessionManager = class {
     }
   }
   async get() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return {
@@ -7943,6 +8001,7 @@ var SessionManager = class {
     }
     if (this.refreshing) {
       await sleep(1e3);
+      if (signal.aborted) return { ok: true, data: null };
       return await this.get();
     }
     const val = localStorage.getItem(this.storageKey);
@@ -7977,8 +8036,10 @@ var SessionManager = class {
         this.refreshing = true;
         const res = await this.authService.refreshSession(
           obj.refreshToken,
-          obj.version ?? 1
+          obj.version ?? 1,
+          signal
         );
+        if (signal.aborted) return { ok: true, data: null };
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -8011,6 +8072,8 @@ var SessionManager = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -8035,6 +8098,7 @@ var SessionManager = class {
     return await this.refreshV4(session);
   }
   async refresh() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return {
@@ -8060,8 +8124,10 @@ var SessionManager = class {
       this.refreshing = true;
       const res = await this.authService.refreshSession(
         obj.refreshToken,
-        obj.version ?? 1
+        obj.version ?? 1,
+        signal
       );
+      if (signal.aborted) return { ok: true, data: null };
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -8094,6 +8160,8 @@ var SessionManager = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -8105,18 +8173,20 @@ var SessionManager = class {
   }
   async refreshV4(session) {
     if (this.v4RefreshPromise) return await this.v4RefreshPromise;
-    this.v4RefreshPromise = this.requestV4Refresh(session);
+    const promise = this.requestV4Refresh(session, this.lifecycle.signal);
+    this.v4RefreshPromise = promise;
     try {
-      return await this.v4RefreshPromise;
+      return await promise;
     } finally {
-      this.v4RefreshPromise = null;
+      if (this.v4RefreshPromise === promise) this.v4RefreshPromise = null;
     }
   }
-  async requestV4Refresh(session) {
+  async requestV4Refresh(session, signal) {
     this.logger.info("Refreshing session...");
     let refreshToken;
     if (isIOSPlatform()) {
       refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (signal.aborted) return { ok: true, data: null };
       if (!refreshToken) {
         this.logger.warn("No stored refresh token. Session expired.");
         this.v4AccessToken = null;
@@ -8133,7 +8203,8 @@ var SessionManager = class {
       }
     }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(refreshToken, 4);
+    const res = await this.authService.refreshSession(refreshToken, 4, signal);
+    if (signal.aborted) return { ok: true, data: null };
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
       const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
@@ -8145,6 +8216,7 @@ var SessionManager = class {
       }
       this.refreshing = false;
       if (terminal) await this.refreshTokenStore.remove();
+      if (signal.aborted) return { ok: true, data: null };
       return {
         ok: false,
         error: res.error
@@ -8154,8 +8226,13 @@ var SessionManager = class {
     this.logger.success("Session refreshed!");
     this.invalidReason = null;
     if (res.data.refreshToken) {
-      await this.refreshTokenStore.set(res.data.refreshToken);
+      await this.mutations.run(async () => {
+        if (!signal.aborted && res.data.refreshToken) {
+          await this.refreshTokenStore.set(res.data.refreshToken);
+        }
+      });
     }
+    if (signal.aborted) return { ok: true, data: null };
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
@@ -8173,26 +8250,53 @@ var SessionManager = class {
       this.logger.warn("'localStorage' is not available on the server.");
       return;
     }
-    let version = 1;
+    let version = this.v4AccessToken ? 4 : 1;
+    let accessToken = this.v4AccessToken ?? void 0;
+    let accessTokenExpiresAt = this.v4AccessTokenExpiresAt;
+    let refreshToken;
     const val = localStorage.getItem(this.storageKey);
     if (val) {
       try {
         const stored = JSON.parse(val);
         version = stored.version ?? 1;
+        accessToken = stored.version === 4 ? this.v4AccessToken ?? void 0 : stored.accessToken;
+        accessTokenExpiresAt = stored.version === 4 ? this.v4AccessTokenExpiresAt : stored.accessTokenExpiresAt;
+        if (stored.version !== 4) refreshToken = stored.refreshToken;
       } catch {
       }
     }
-    const res = await this.get();
-    if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken, version);
-    }
+    this.lifecycle.logout();
+    this.refreshing = false;
+    this.v4RefreshPromise = null;
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
     this.invalidReason = null;
-    await this.refreshTokenStore.remove();
     localStorage.removeItem(this.storageKey);
+    await this.mutations.run(async () => {
+      try {
+        if (val && (!accessToken || !accessTokenExpiresAt || Date.now() > accessTokenExpiresAt)) {
+          if (version === 4 && isIOSPlatform()) {
+            refreshToken = await this.refreshTokenStore.get() ?? void 0;
+          }
+          if (refreshToken || version === 4 && !isIOSPlatform()) {
+            accessToken = void 0;
+            const res = await this.authService.refreshSession(
+              refreshToken,
+              version
+            );
+            if (res.ok) accessToken = res.data.accessToken;
+          }
+        }
+        if (accessToken) {
+          await this.authService.destroySession(accessToken, version);
+        }
+      } finally {
+        if (version === 4) await this.refreshTokenStore.remove();
+      }
+    });
   }
   async verify() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return { valid: true };
@@ -8205,7 +8309,8 @@ var SessionManager = class {
       try {
         const stored = JSON.parse(val);
         if (stored.version === 4) {
-          const res = await this.verifyV4(stored.session);
+          const res = await this.verifyV4(stored.session, signal);
+          if (signal.aborted) return { valid: true };
           if (!res.valid) localStorage.removeItem(this.storageKey);
           return res;
         }
@@ -8213,32 +8318,37 @@ var SessionManager = class {
       }
     }
     const s = await this.get();
+    if (signal.aborted) return { valid: true };
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
       this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
-    const v = await this.authService.verifySession(s.data.accessToken);
+    const v = await this.authService.verifySession(s.data.accessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       this.invalidReason = "INVALID_SESSION";
       localStorage.removeItem(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
-  async verifyV4(session) {
+  async verifyV4(session, signal) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
+      if (signal.aborted) return { valid: true };
       if (res.ok) return { valid: true };
       if (!this.invalidReason) return { valid: true };
       return { valid: false, reason: this.invalidReason };
     }
-    const v = await this.authService.verifySession(this.v4AccessToken);
+    const v = await this.authService.verifySession(this.v4AccessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       localStorage.removeItem(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
       this.invalidReason = "INVALID_SESSION";
       await this.refreshTokenStore.remove();
+      if (signal.aborted) return { valid: true };
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
@@ -8267,6 +8377,8 @@ var SessionManagerCookie = class {
   authService;
   walletService;
   _refreshing = false;
+  lifecycle = new SessionLifecycle();
+  mutations = new CredentialMutationLock();
   /*
    * v4 access tokens live in memory only, so an XSS-readable storage layer
    * never holds a live one. Re-minted from the HttpOnly cookie, or from
@@ -8289,34 +8401,44 @@ var SessionManagerCookie = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  async persist(data, version) {
-    const now = /* @__PURE__ */ new Date();
-    this.invalidReason = null;
-    if (version === 4) {
-      this.v4AccessToken = data.accessToken ?? null;
-      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
-      if (data.refreshToken) {
-        await this.refreshTokenStore.set(data.refreshToken);
+  async persist(data, version, signal) {
+    return this.mutations.run(async () => {
+      if (signal.aborted) return;
+      const now = /* @__PURE__ */ new Date();
+      this.refreshing = false;
+      this.v4RefreshPromise = null;
+      this.invalidReason = null;
+      if (version === 4) {
+        this.v4AccessToken = data.accessToken ?? null;
+        this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+        if (data.refreshToken) {
+          await this.refreshTokenStore.set(data.refreshToken);
+        }
+        if (signal.aborted) return;
+        cookies__default.default.set(
+          this.storageKey,
+          JSON.stringify({ version, session: data.session }),
+          { expires: subMinutes(addDays(now, 15), 2) }
+        );
+        return;
       }
       cookies__default.default.set(
         this.storageKey,
-        JSON.stringify({ version, session: data.session }),
-        { expires: subMinutes(addDays(now, 15), 2) }
+        JSON.stringify({
+          version,
+          ...data,
+          accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+          refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+        }),
+        { expires: subMinutes(addDays(now, 30), 2) }
       );
-      return;
-    }
-    cookies__default.default.set(
-      this.storageKey,
-      JSON.stringify({
-        version,
-        ...data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      }),
-      { expires: subMinutes(addDays(now, 30), 2) }
-    );
+    });
   }
   async create(input, version = 1) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true, data: null };
+    const signal = this.lifecycle.renew();
     if (input.type === "MAYA") {
       localStorage.setItem(this.platformStorageKey, "MAYA");
       const f0 = () => this.walletService.mayaSession({ id: input.sessionId });
@@ -8342,7 +8464,7 @@ var SessionManagerCookie = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      await this.persist(r1.data, version);
+      await this.persist(r1.data, version, signal);
       return {
         ok: true,
         data: null
@@ -8351,7 +8473,7 @@ var SessionManagerCookie = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        await this.persist(res2.data, version);
+        await this.persist(res2.data, version, signal);
         return {
           ok: true,
           data: null
@@ -8368,7 +8490,7 @@ var SessionManagerCookie = class {
         version
       );
       if (res2.ok) {
-        await this.persist(res2.data, version);
+        await this.persist(res2.data, version, signal);
         return {
           ok: true,
           data: null
@@ -8380,7 +8502,7 @@ var SessionManagerCookie = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        await this.persist(res2.data, version);
+        await this.persist(res2.data, version, signal);
         return {
           ok: true,
           data: null
@@ -8398,19 +8520,23 @@ var SessionManagerCookie = class {
         }
       };
     }
-    await this.persist(res.data, version);
+    await this.persist(res.data, version, signal);
     return {
       ok: true,
       data: null
     };
   }
   async createFromAuthenticator(input) {
+    const waitingSignal = this.lifecycle.signal;
+    await this.mutations.wait();
+    if (waitingSignal.aborted) return { ok: true };
+    const signal = this.lifecycle.renew();
     const res = await this.authService.authenticate(input);
     if (res.ok) {
       if (this.isServer) {
         this.logger.warn("'client cookies' is not available on the server.");
       } else {
-        await this.persist(res.data, 1);
+        await this.persist(res.data, 1, signal);
       }
       return { ok: true };
     } else {
@@ -8418,6 +8544,7 @@ var SessionManagerCookie = class {
     }
   }
   async get() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return {
@@ -8427,6 +8554,7 @@ var SessionManagerCookie = class {
     }
     if (this.refreshing) {
       await sleep(1e3);
+      if (signal.aborted) return { ok: true, data: null };
       return await this.get();
     }
     const val = cookies__default.default.get(this.storageKey);
@@ -8461,8 +8589,10 @@ var SessionManagerCookie = class {
         this.refreshing = true;
         const res = await this.authService.refreshSession(
           obj.refreshToken,
-          obj.version ?? 1
+          obj.version ?? 1,
+          signal
         );
+        if (signal.aborted) return { ok: true, data: null };
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -8498,6 +8628,8 @@ var SessionManagerCookie = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -8522,6 +8654,7 @@ var SessionManagerCookie = class {
     return await this.refreshV4(session);
   }
   async refresh() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return {
@@ -8547,8 +8680,10 @@ var SessionManagerCookie = class {
       this.refreshing = true;
       const res = await this.authService.refreshSession(
         obj.refreshToken,
-        obj.version ?? 1
+        obj.version ?? 1,
+        signal
       );
+      if (signal.aborted) return { ok: true, data: null };
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -8583,6 +8718,8 @@ var SessionManagerCookie = class {
         data: obj
       };
     } catch {
+      if (signal.aborted) return { ok: true, data: null };
+      this.refreshing = false;
       return {
         ok: false,
         error: {
@@ -8594,18 +8731,20 @@ var SessionManagerCookie = class {
   }
   async refreshV4(session) {
     if (this.v4RefreshPromise) return await this.v4RefreshPromise;
-    this.v4RefreshPromise = this.requestV4Refresh(session);
+    const promise = this.requestV4Refresh(session, this.lifecycle.signal);
+    this.v4RefreshPromise = promise;
     try {
-      return await this.v4RefreshPromise;
+      return await promise;
     } finally {
-      this.v4RefreshPromise = null;
+      if (this.v4RefreshPromise === promise) this.v4RefreshPromise = null;
     }
   }
-  async requestV4Refresh(session) {
+  async requestV4Refresh(session, signal) {
     this.logger.info("Refreshing session...");
     let refreshToken;
     if (isIOSPlatform()) {
       refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (signal.aborted) return { ok: true, data: null };
       if (!refreshToken) {
         this.logger.warn("No stored refresh token. Session expired.");
         this.v4AccessToken = null;
@@ -8622,7 +8761,8 @@ var SessionManagerCookie = class {
       }
     }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(refreshToken, 4);
+    const res = await this.authService.refreshSession(refreshToken, 4, signal);
+    if (signal.aborted) return { ok: true, data: null };
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
       const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
@@ -8634,6 +8774,7 @@ var SessionManagerCookie = class {
       }
       this.refreshing = false;
       if (terminal) await this.refreshTokenStore.remove();
+      if (signal.aborted) return { ok: true, data: null };
       return {
         ok: false,
         error: res.error
@@ -8643,8 +8784,13 @@ var SessionManagerCookie = class {
     this.logger.success("Session refreshed!");
     this.invalidReason = null;
     if (res.data.refreshToken) {
-      await this.refreshTokenStore.set(res.data.refreshToken);
+      await this.mutations.run(async () => {
+        if (!signal.aborted && res.data.refreshToken) {
+          await this.refreshTokenStore.set(res.data.refreshToken);
+        }
+      });
     }
+    if (signal.aborted) return { ok: true, data: null };
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
@@ -8662,26 +8808,53 @@ var SessionManagerCookie = class {
       this.logger.warn("'client cookies' is not available on the server.");
       return;
     }
-    let version = 1;
+    let version = this.v4AccessToken ? 4 : 1;
+    let accessToken = this.v4AccessToken ?? void 0;
+    let accessTokenExpiresAt = this.v4AccessTokenExpiresAt;
+    let refreshToken;
     const val = cookies__default.default.get(this.storageKey);
     if (val) {
       try {
         const stored = JSON.parse(val);
         version = stored.version ?? 1;
+        accessToken = stored.version === 4 ? this.v4AccessToken ?? void 0 : stored.accessToken;
+        accessTokenExpiresAt = stored.version === 4 ? this.v4AccessTokenExpiresAt : stored.accessTokenExpiresAt;
+        if (stored.version !== 4) refreshToken = stored.refreshToken;
       } catch {
       }
     }
-    const res = await this.get();
-    if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken, version);
-    }
+    this.lifecycle.logout();
+    this.refreshing = false;
+    this.v4RefreshPromise = null;
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
     this.invalidReason = null;
-    await this.refreshTokenStore.remove();
     cookies__default.default.remove(this.storageKey);
+    await this.mutations.run(async () => {
+      try {
+        if (val && (!accessToken || !accessTokenExpiresAt || Date.now() > accessTokenExpiresAt)) {
+          if (version === 4 && isIOSPlatform()) {
+            refreshToken = await this.refreshTokenStore.get() ?? void 0;
+          }
+          if (refreshToken || version === 4 && !isIOSPlatform()) {
+            accessToken = void 0;
+            const res = await this.authService.refreshSession(
+              refreshToken,
+              version
+            );
+            if (res.ok) accessToken = res.data.accessToken;
+          }
+        }
+        if (accessToken) {
+          await this.authService.destroySession(accessToken, version);
+        }
+      } finally {
+        if (version === 4) await this.refreshTokenStore.remove();
+      }
+    });
   }
   async verify() {
+    const signal = this.lifecycle.signal;
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return { valid: true };
@@ -8694,7 +8867,8 @@ var SessionManagerCookie = class {
       try {
         const stored = JSON.parse(val);
         if (stored.version === 4) {
-          const res = await this.verifyV4(stored.session);
+          const res = await this.verifyV4(stored.session, signal);
+          if (signal.aborted) return { valid: true };
           if (!res.valid) cookies__default.default.remove(this.storageKey);
           return res;
         }
@@ -8702,32 +8876,37 @@ var SessionManagerCookie = class {
       }
     }
     const s = await this.get();
+    if (signal.aborted) return { valid: true };
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
       this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
-    const v = await this.authService.verifySession(s.data.accessToken);
+    const v = await this.authService.verifySession(s.data.accessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       this.invalidReason = "INVALID_SESSION";
       cookies__default.default.remove(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
-  async verifyV4(session) {
+  async verifyV4(session, signal) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
+      if (signal.aborted) return { valid: true };
       if (res.ok) return { valid: true };
       if (!this.invalidReason) return { valid: true };
       return { valid: false, reason: this.invalidReason };
     }
-    const v = await this.authService.verifySession(this.v4AccessToken);
+    const v = await this.authService.verifySession(this.v4AccessToken, signal);
+    if (signal.aborted) return { valid: true };
     if (!v) {
       cookies__default.default.remove(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
       this.invalidReason = "INVALID_SESSION";
       await this.refreshTokenStore.remove();
+      if (signal.aborted) return { valid: true };
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }