@opexa/portal-sdk 0.59.95 → 0.59.97

package/dist/index.cjs

@@ -4709,6 +4709,20 @@ async function getFingerPrint() {
     return null;
   }
 }
+function isWebPlatform() {
+  try {
+    return core.Capacitor.getPlatform() === "web";
+  } catch {
+    return true;
+  }
+}
+function isIOSPlatform() {
+  try {
+    return core.Capacitor.getPlatform() === "ios";
+  } catch {
+    return false;
+  }
+}
 
 // src/utils/status-code-to-operation-error.ts
 function statusCodeToOperationError(value, message) {
@@ -4729,13 +4743,6 @@ var ERROR_MAP = {
 };
 
 // src/services/auth.service.ts
-function isWebPlatform() {
-  try {
-    return core.Capacitor.getPlatform() === "web";
-  } catch {
-    return false;
-  }
-}
 var AuthService = class {
   url;
   options;
@@ -4791,12 +4798,15 @@ var AuthService = class {
     try {
       const isWeb = isWebPlatform();
       const queryParam = isWeb && version === 4 ? "?type=web" : "";
-      const res = await fetch(`${this.url}${version !== 1 ? `/v${version}/sessions` : "/sessions"}${queryParam}`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(input),
-        ...version === 4 && { credentials: "include" }
-      });
+      const res = await fetch(
+        `${this.url}${version !== 1 ? `/v${version}/sessions` : "/sessions"}${queryParam}`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify(input),
+          ...version === 4 && { credentials: "include" }
+        }
+      );
       const body = await res.json();
       if (res.ok) {
         return {
@@ -4879,7 +4889,7 @@ var AuthService = class {
   }
   async refreshSession(refreshToken, version = 1) {
     const headers = new Headers(this.headers);
-    if (version !== 4) {
+    if (version !== 4 || refreshToken) {
       headers.append("Authorization", `Bearer ${refreshToken}`);
     }
     try {
@@ -4993,11 +5003,14 @@ var AuthService = class {
       }
     }
     try {
-      const res = await fetch(`${this.url}${version !== 1 ? `/v${version}/otps` : "/otps"}`, {
-        method: "POST",
-        headers: this.headers,
-        body: JSON.stringify(input)
-      });
+      const res = await fetch(
+        `${this.url}${version !== 1 ? `/v${version}/otps` : "/otps"}`,
+        {
+          method: "POST",
+          headers: this.headers,
+          body: JSON.stringify(input)
+        }
+      );
       if (res.status === 403) {
         const data = await res.json();
         const code = getErrorCode(data.message);
@@ -7457,6 +7470,48 @@ function pollable(func, config) {
   };
 }
 
+// src/sdk/refresh-token-store.ts
+var PreferencesRefreshTokenStore = class {
+  constructor(key, logger) {
+    this.key = key;
+    this.logger = logger;
+  }
+  async preferences() {
+    const { Preferences } = await import('@capacitor/preferences');
+    return Preferences;
+  }
+  async get() {
+    if (!isIOSPlatform()) return null;
+    try {
+      const { value } = await (await this.preferences()).get({ key: this.key });
+      return value ?? null;
+    } catch (err) {
+      this.logger.error(`Failed to read the refresh token: ${err}`);
+      return null;
+    }
+  }
+  async set(token) {
+    if (!isIOSPlatform()) return;
+    try {
+      await (await this.preferences()).set({ key: this.key, value: token });
+    } catch (err) {
+      this.logger.error(`Failed to persist the refresh token: ${err}`);
+    }
+  }
+  async remove() {
+    if (!isIOSPlatform()) return;
+    try {
+      await (await this.preferences()).remove({ key: this.key });
+    } catch (err) {
+      this.logger.error(`Failed to clear the refresh token: ${err}`);
+    }
+  }
+};
+function createRefreshTokenStore(logger, sessionPrefix) {
+  const key = sessionPrefix ? `${sessionPrefix}/session/refresh-token` : "session/refresh-token";
+  return new PreferencesRefreshTokenStore(key, logger);
+}
+
 // src/sdk/session-manager.ts
 var SessionManager = class {
   logger;
@@ -7466,17 +7521,23 @@ var SessionManager = class {
   walletService;
   _refreshing = false;
   /*
-   * v4 access tokens are never persisted (localStorage/cookie) so that an
-   * XSS-readable storage layer never holds a live access token. They only
-   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   * v4 access tokens live in memory only, so an XSS-readable storage layer
+   * never holds a live one. Re-minted from the HttpOnly cookie, or from
+   * `refreshTokenStore` on iOS.
    */
   v4AccessToken = null;
   v4AccessTokenExpiresAt = null;
   v4RefreshPromise = null;
+  invalidReason = null;
+  refreshTokenStore;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
     this.logger = config.logger;
+    this.refreshTokenStore = createRefreshTokenStore(
+      config.logger,
+      config.sessionPrefix
+    );
     if (config.sessionPrefix) {
       this.storageKey = `${config.sessionPrefix}/${this.storageKey}`;
       this.platformStorageKey = `${config.sessionPrefix}/${this.platformStorageKey}`;
@@ -7488,7 +7549,7 @@ var SessionManager = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  persist(data, version) {
+  async persist(data, version) {
     const now = /* @__PURE__ */ new Date();
     if (version === 4) {
       if (!data.session || !data.accessToken) {
@@ -7499,12 +7560,17 @@ var SessionManager = class {
       }
       this.v4AccessToken = data.accessToken;
       this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
+      this.invalidReason = null;
+      if (data.refreshToken) {
+        await this.refreshTokenStore.set(data.refreshToken);
+      }
       localStorage.setItem(
         this.storageKey,
         JSON.stringify({ version, session: data.session })
       );
       return true;
     }
+    this.invalidReason = null;
     localStorage.setItem(
       this.storageKey,
       JSON.stringify({
@@ -7561,7 +7627,8 @@ var SessionManager = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      if (!this.persist(r1.data, version)) return this.malformedResponseError();
+      if (!await this.persist(r1.data, version))
+        return this.malformedResponseError();
       return {
         ok: true,
         data: null
@@ -7570,7 +7637,7 @@ var SessionManager = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -7589,7 +7656,7 @@ var SessionManager = class {
         version
       );
       if (res2.ok) {
-        if (!this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -7602,7 +7669,7 @@ var SessionManager = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -7621,7 +7688,8 @@ var SessionManager = class {
         }
       };
     }
-    if (!this.persist(res.data, version)) return this.malformedResponseError();
+    if (!await this.persist(res.data, version))
+      return this.malformedResponseError();
     return {
       ok: true,
       data: null
@@ -7632,7 +7700,7 @@ var SessionManager = class {
     if (res.ok) {
       if (this.isServer) {
         this.logger.warn("'localStorage' is not available on the server.");
-      } else if (!this.persist(res.data, 1)) {
+      } else if (!await this.persist(res.data, 1)) {
         return this.malformedResponseError();
       }
       return { ok: true };
@@ -7728,6 +7796,20 @@ var SessionManager = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
   async refresh() {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
@@ -7797,20 +7879,6 @@ var SessionManager = class {
       };
     }
   }
-  async getV4(session) {
-    const now = /* @__PURE__ */ new Date();
-    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
-      return {
-        ok: true,
-        data: {
-          session,
-          accessToken: this.v4AccessToken,
-          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
-        }
-      };
-    }
-    return await this.refreshV4(session);
-  }
   async refreshV4(session) {
     if (this.v4RefreshPromise) return await this.v4RefreshPromise;
     this.v4RefreshPromise = this.requestV4Refresh(session);
@@ -7822,21 +7890,48 @@ var SessionManager = class {
   }
   async requestV4Refresh(session) {
     this.logger.info("Refreshing session...");
+    let refreshToken;
+    if (isIOSPlatform()) {
+      refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (!refreshToken) {
+        this.logger.warn("No stored refresh token. Session expired.");
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = "REFRESH_TOKEN_EXPIRED";
+        localStorage.removeItem(this.storageKey);
+        return {
+          ok: false,
+          error: {
+            name: "SessionExpiredError",
+            message: "Session expired."
+          }
+        };
+      }
+    }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(void 0, 4);
-    this.refreshing = false;
+    const res = await this.authService.refreshSession(refreshToken, 4);
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
-      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError") {
+      const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
+      if (terminal) {
         this.v4AccessToken = null;
         this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION";
+        localStorage.removeItem(this.storageKey);
       }
+      this.refreshing = false;
+      if (terminal) await this.refreshTokenStore.remove();
       return {
         ok: false,
         error: res.error
       };
     }
+    this.refreshing = false;
     this.logger.success("Session refreshed!");
+    this.invalidReason = null;
+    if (res.data.refreshToken) {
+      await this.refreshTokenStore.set(res.data.refreshToken);
+    }
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
@@ -7869,6 +7964,8 @@ var SessionManager = class {
     }
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
+    this.invalidReason = null;
+    await this.refreshTokenStore.remove();
     localStorage.removeItem(this.storageKey);
   }
   async verify() {
@@ -7876,6 +7973,9 @@ var SessionManager = class {
       this.logger.warn("'localStorage' is not available on the server.");
       return { valid: true };
     }
+    if (this.invalidReason) {
+      return { valid: false, reason: this.invalidReason };
+    }
     const val = localStorage.getItem(this.storageKey);
     if (val) {
       try {
@@ -7890,11 +7990,13 @@ var SessionManager = class {
     }
     const s = await this.get();
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
+      this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
     const v = await this.authService.verifySession(s.data.accessToken);
     if (!v) {
+      this.invalidReason = "INVALID_SESSION";
       localStorage.removeItem(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
@@ -7902,16 +8004,17 @@ var SessionManager = class {
   async verifyV4(session) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
-      return res.ok ? { valid: true } : {
-        valid: false,
-        reason: res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION"
-      };
+      if (res.ok) return { valid: true };
+      if (!this.invalidReason) return { valid: true };
+      return { valid: false, reason: this.invalidReason };
     }
     const v = await this.authService.verifySession(this.v4AccessToken);
     if (!v) {
       localStorage.removeItem(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
+      this.invalidReason = "INVALID_SESSION";
+      await this.refreshTokenStore.remove();
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
@@ -7941,16 +8044,20 @@ var SessionManagerCookie = class {
   walletService;
   _refreshing = false;
   /*
-   * v4 access tokens are never persisted (localStorage/cookie) so that an
-   * XSS-readable storage layer never holds a live access token. They only
-   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   * v4 access tokens live in memory only, so an XSS-readable storage layer
+   * never holds a live one. Re-minted from the HttpOnly cookie, or from
+   * `refreshTokenStore` on iOS.
    */
   v4AccessToken = null;
   v4AccessTokenExpiresAt = null;
+  v4RefreshPromise = null;
+  invalidReason = null;
+  refreshTokenStore;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
     this.logger = config.logger;
+    this.refreshTokenStore = createRefreshTokenStore(config.logger);
   }
   get refreshing() {
     return this._refreshing;
@@ -7958,15 +8065,19 @@ var SessionManagerCookie = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  persist(data, version) {
+  async persist(data, version) {
     const now = /* @__PURE__ */ new Date();
+    this.invalidReason = null;
     if (version === 4) {
       this.v4AccessToken = data.accessToken ?? null;
       this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      if (data.refreshToken) {
+        await this.refreshTokenStore.set(data.refreshToken);
+      }
       cookies__default.default.set(
         this.storageKey,
         JSON.stringify({ version, session: data.session }),
-        { expires: subMinutes(addDays(now, 15), 2).getTime() }
+        { expires: subMinutes(addDays(now, 15), 2) }
       );
       return;
     }
@@ -7978,7 +8089,7 @@ var SessionManagerCookie = class {
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       }),
-      { expires: subMinutes(addDays(now, 30), 2).getTime() }
+      { expires: subMinutes(addDays(now, 30), 2) }
     );
   }
   async create(input, version = 1) {
@@ -8007,7 +8118,7 @@ var SessionManagerCookie = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      this.persist(r1.data, version);
+      await this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -8016,7 +8127,7 @@ var SessionManagerCookie = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        this.persist(res2.data, version);
+        await this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -8033,7 +8144,7 @@ var SessionManagerCookie = class {
         version
       );
       if (res2.ok) {
-        this.persist(res2.data, version);
+        await this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -8045,7 +8156,7 @@ var SessionManagerCookie = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        this.persist(res2.data, version);
+        await this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -8063,7 +8174,7 @@ var SessionManagerCookie = class {
         }
       };
     }
-    this.persist(res.data, version);
+    await this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -8075,7 +8186,7 @@ var SessionManagerCookie = class {
       if (this.isServer) {
         this.logger.warn("'client cookies' is not available on the server.");
       } else {
-        this.persist(res.data, 1);
+        await this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -8155,7 +8266,7 @@ var SessionManagerCookie = class {
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
         cookies__default.default.set(this.storageKey, JSON.stringify(obj), {
-          expires: subMinutes(addDays(now, 30), 2).getTime()
+          expires: subMinutes(addDays(now, 30), 2)
         });
       }
       return {
@@ -8172,6 +8283,20 @@ var SessionManagerCookie = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
   async refresh() {
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
@@ -8227,7 +8352,7 @@ var SessionManagerCookie = class {
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
       cookies__default.default.set(this.storageKey, JSON.stringify(obj), {
-        expires: subMinutes(addDays(now, 30), 2).getTime()
+        expires: subMinutes(addDays(now, 30), 2)
       });
       return {
         ok: true,
@@ -8243,37 +8368,59 @@ var SessionManagerCookie = class {
       };
     }
   }
-  async getV4(session) {
-    const now = /* @__PURE__ */ new Date();
-    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
-      return {
-        ok: true,
-        data: {
-          session,
-          accessToken: this.v4AccessToken,
-          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
-        }
-      };
+  async refreshV4(session) {
+    if (this.v4RefreshPromise) return await this.v4RefreshPromise;
+    this.v4RefreshPromise = this.requestV4Refresh(session);
+    try {
+      return await this.v4RefreshPromise;
+    } finally {
+      this.v4RefreshPromise = null;
     }
-    return await this.refreshV4(session);
   }
-  async refreshV4(session) {
+  async requestV4Refresh(session) {
     this.logger.info("Refreshing session...");
+    let refreshToken;
+    if (isIOSPlatform()) {
+      refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (!refreshToken) {
+        this.logger.warn("No stored refresh token. Session expired.");
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = "REFRESH_TOKEN_EXPIRED";
+        cookies__default.default.remove(this.storageKey);
+        return {
+          ok: false,
+          error: {
+            name: "SessionExpiredError",
+            message: "Session expired."
+          }
+        };
+      }
+    }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(void 0, 4);
-    this.refreshing = false;
+    const res = await this.authService.refreshSession(refreshToken, 4);
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
-      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError") {
+      const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
+      if (terminal) {
         this.v4AccessToken = null;
         this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION";
+        cookies__default.default.remove(this.storageKey);
       }
+      this.refreshing = false;
+      if (terminal) await this.refreshTokenStore.remove();
       return {
         ok: false,
         error: res.error
       };
     }
+    this.refreshing = false;
     this.logger.success("Session refreshed!");
+    this.invalidReason = null;
+    if (res.data.refreshToken) {
+      await this.refreshTokenStore.set(res.data.refreshToken);
+    }
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
@@ -8306,6 +8453,8 @@ var SessionManagerCookie = class {
     }
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
+    this.invalidReason = null;
+    await this.refreshTokenStore.remove();
     cookies__default.default.remove(this.storageKey);
   }
   async verify() {
@@ -8313,6 +8462,9 @@ var SessionManagerCookie = class {
       this.logger.warn("'client cookies' is not available on the server.");
       return { valid: true };
     }
+    if (this.invalidReason) {
+      return { valid: false, reason: this.invalidReason };
+    }
     const val = cookies__default.default.get(this.storageKey);
     if (val) {
       try {
@@ -8327,11 +8479,13 @@ var SessionManagerCookie = class {
     }
     const s = await this.get();
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
+      this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
     const v = await this.authService.verifySession(s.data.accessToken);
     if (!v) {
+      this.invalidReason = "INVALID_SESSION";
       cookies__default.default.remove(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
@@ -8339,16 +8493,17 @@ var SessionManagerCookie = class {
   async verifyV4(session) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
-      return res.ok ? { valid: true } : {
-        valid: false,
-        reason: res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION"
-      };
+      if (res.ok) return { valid: true };
+      if (!this.invalidReason) return { valid: true };
+      return { valid: false, reason: this.invalidReason };
     }
     const v = await this.authService.verifySession(this.v4AccessToken);
     if (!v) {
       cookies__default.default.remove(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
+      this.invalidReason = "INVALID_SESSION";
+      await this.refreshTokenStore.remove();
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
@@ -10653,9 +10808,18 @@ var Sdk = class {
     let counter = 0;
     let timeout = null;
     let isForeground = true;
+    let stopped = false;
     const listener = app.App.addListener("appStateChange", ({ isActive }) => {
       isForeground = isActive;
     });
+    const stop = () => {
+      stopped = true;
+      if (timeout) {
+        clearTimeout(timeout);
+        timeout = null;
+      }
+      listener.then((handle) => handle.remove());
+    };
     const assignTimeout = () => {
       const duration = counter <= 0 ? interval * 0.5 : interval;
       return setTimeout(async () => {
@@ -10664,10 +10828,13 @@ var Sdk = class {
           try {
             res = await this.sessionManager.verify();
           } catch {
-            res = { valid: false, reason: "INVALID_SESSION" };
+            res = null;
           }
-          if (!res.valid) {
+          if (stopped) return;
+          if (res && !res.valid) {
+            stop();
             await input.onInvalid(res.reason ?? "INVALID_SESSION");
+            return;
           }
         }
         counter += 1;
@@ -10676,10 +10843,7 @@ var Sdk = class {
     };
     timeout = assignTimeout();
     return function unsubscribe() {
-      if (timeout) {
-        clearTimeout(timeout);
-      }
-      listener.then((handle) => handle.remove());
+      stop();
     };
   }
   async session() {