@sendoracloud/sdk-react-native 0.11.0 → 0.13.0

package/dist/index.cjs

@@ -719,6 +719,20 @@ var Auth = class {
     this.inflight = next.catch(() => void 0);
     return next;
   }
+  /**
+   * Hot-path token refresh. Single-flight via `refreshInflight` so a
+   * UI batch firing 10 simultaneous reads never produces 10 /refresh
+   * round-trips. Returns null on any failure so callers can decide
+   * whether to surface a sign-in prompt or proceed anonymously.
+   *
+   * s58.46 — on a `INVALID_REFRESH_TOKEN` (new backend error code) or
+   * HTTP 401 we WIPE the stored refresh token. Pre-s58.46 we caught
+   * the error and returned null but kept the stored token intact, so
+   * the very next caller would re-attempt the same dead token in an
+   * infinite loop (Pulse News iOS hammered /refresh ~1×/s for hours).
+   * The wipe forces the next op to fall through to /anonymous or
+   * surface NOT_SIGNED_IN to the host app instead of looping.
+   */
   async refreshAccessToken() {
     if (this.refreshInflight) return this.refreshInflight;
     const refresh = this.hooks.storage.get(REFRESH_KEY);
@@ -727,14 +741,18 @@ var Auth = class {
       try {
         const data = await this.callAuth("/api/v1/auth-service/token/refresh", {
           refreshToken: refresh
-        }).catch(() => null);
-        if (!data) return null;
+        });
         this.accessToken = data.tokens.accessToken;
         this.accessExpiresAt = Date.now() + data.tokens.expiresIn * 1e3;
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
         return data.tokens.accessToken;
+      } catch (err) {
+        if (err instanceof AuthError && isDeadRefreshError(err.code)) {
+          await this.wipeLocalIdentity().catch(() => void 0);
+        }
+        return null;
       } finally {
         this.refreshInflight = null;
       }
@@ -785,6 +803,10 @@ var Auth = class {
     await this.hooks.onAnonymousWipe();
   }
 };
+function isDeadRefreshError(code) {
+  if (!code) return false;
+  return code === "INVALID_REFRESH_TOKEN" || code === "HTTP_401" || code === "UNAUTHORIZED" || code === "RATE_LIMIT_EXCEEDED" || code === "RATE_LIMIT";
+}
 function decodeJwtPayload(token) {
   try {
     const parts = token.split(".");
@@ -845,7 +867,9 @@ function installAutoTrack(args) {
   if (flags.appBackground) {
     let AppState = null;
     try {
-      AppState = require("react-native").AppState;
+      const dyn = globalThis.require;
+      const mod = dyn ? dyn("react-native") : null;
+      AppState = mod?.AppState ?? null;
     } catch {
       AppState = null;
     }
@@ -1133,6 +1157,28 @@ var SendoraSDK = class {
     }
     return { tokenId: data.tokenId, created: data.created === true };
   }
+  /**
+   * Push namespace — mirrors the iOS / Android / Web SDK shape so
+   * `sendora.push.registerToken(...)` works consistently across all 5 SDKs.
+   * Backed by the same registerPushToken() implementation; kept top-level
+   * too for backwards compatibility with the s47 release.
+   */
+  get push() {
+    const self = this;
+    return {
+      registerToken: (reg) => self.registerPushToken(reg),
+      trackOpen: async (sendId, clickAction) => {
+        if (!self.config) throw new Error("[sendoracloud] init() must complete before push.trackOpen().");
+        const body = { sendId };
+        if (clickAction !== void 0) body.clickAction = clickAction;
+        await post(
+          { apiUrl: self.config.apiUrl, publicKey: self.config.publicKey, debug: self.debug },
+          "/push/track-open",
+          body
+        );
+      }
+    };
+  }
   /**
    * Clear identity + rotate the anonymous id. Call on logout. Awaits
    * the AsyncStorage writes so a caller who kills the app immediately

package/dist/index.d.cts

@@ -270,6 +270,20 @@ declare class Auth {
      */
     signOut(): Promise<void>;
     private serialize;
+    /**
+     * Hot-path token refresh. Single-flight via `refreshInflight` so a
+     * UI batch firing 10 simultaneous reads never produces 10 /refresh
+     * round-trips. Returns null on any failure so callers can decide
+     * whether to surface a sign-in prompt or proceed anonymously.
+     *
+     * s58.46 — on a `INVALID_REFRESH_TOKEN` (new backend error code) or
+     * HTTP 401 we WIPE the stored refresh token. Pre-s58.46 we caught
+     * the error and returned null but kept the stored token intact, so
+     * the very next caller would re-attempt the same dead token in an
+     * infinite loop (Pulse News iOS hammered /refresh ~1×/s for hours).
+     * The wipe forces the next op to fall through to /anonymous or
+     * surface NOT_SIGNED_IN to the host app instead of looping.
+     */
     private refreshAccessToken;
     private callAuth;
     private persist;
@@ -425,6 +439,16 @@ declare class SendoraSDK {
      * `@react-native-firebase/messaging`.
      */
     registerPushToken(reg: PushTokenRegistration): Promise<PushTokenReceipt>;
+    /**
+     * Push namespace — mirrors the iOS / Android / Web SDK shape so
+     * `sendora.push.registerToken(...)` works consistently across all 5 SDKs.
+     * Backed by the same registerPushToken() implementation; kept top-level
+     * too for backwards compatibility with the s47 release.
+     */
+    get push(): {
+        registerToken: (reg: PushTokenRegistration) => Promise<PushTokenReceipt>;
+        trackOpen: (sendId: string, clickAction?: string) => Promise<void>;
+    };
     /**
      * Clear identity + rotate the anonymous id. Call on logout. Awaits
      * the AsyncStorage writes so a caller who kills the app immediately

package/dist/index.d.ts

@@ -270,6 +270,20 @@ declare class Auth {
      */
     signOut(): Promise<void>;
     private serialize;
+    /**
+     * Hot-path token refresh. Single-flight via `refreshInflight` so a
+     * UI batch firing 10 simultaneous reads never produces 10 /refresh
+     * round-trips. Returns null on any failure so callers can decide
+     * whether to surface a sign-in prompt or proceed anonymously.
+     *
+     * s58.46 — on a `INVALID_REFRESH_TOKEN` (new backend error code) or
+     * HTTP 401 we WIPE the stored refresh token. Pre-s58.46 we caught
+     * the error and returned null but kept the stored token intact, so
+     * the very next caller would re-attempt the same dead token in an
+     * infinite loop (Pulse News iOS hammered /refresh ~1×/s for hours).
+     * The wipe forces the next op to fall through to /anonymous or
+     * surface NOT_SIGNED_IN to the host app instead of looping.
+     */
     private refreshAccessToken;
     private callAuth;
     private persist;
@@ -425,6 +439,16 @@ declare class SendoraSDK {
      * `@react-native-firebase/messaging`.
      */
     registerPushToken(reg: PushTokenRegistration): Promise<PushTokenReceipt>;
+    /**
+     * Push namespace — mirrors the iOS / Android / Web SDK shape so
+     * `sendora.push.registerToken(...)` works consistently across all 5 SDKs.
+     * Backed by the same registerPushToken() implementation; kept top-level
+     * too for backwards compatibility with the s47 release.
+     */
+    get push(): {
+        registerToken: (reg: PushTokenRegistration) => Promise<PushTokenReceipt>;
+        trackOpen: (sendId: string, clickAction?: string) => Promise<void>;
+    };
     /**
      * Clear identity + rotate the anonymous id. Call on logout. Awaits
      * the AsyncStorage writes so a caller who kills the app immediately

package/dist/index.js

@@ -1,10 +1,3 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
 // src/storage.ts
 var PREFIX = "sendora_";
 var asyncStoragePromise = null;
@@ -686,6 +679,20 @@ var Auth = class {
     this.inflight = next.catch(() => void 0);
     return next;
   }
+  /**
+   * Hot-path token refresh. Single-flight via `refreshInflight` so a
+   * UI batch firing 10 simultaneous reads never produces 10 /refresh
+   * round-trips. Returns null on any failure so callers can decide
+   * whether to surface a sign-in prompt or proceed anonymously.
+   *
+   * s58.46 — on a `INVALID_REFRESH_TOKEN` (new backend error code) or
+   * HTTP 401 we WIPE the stored refresh token. Pre-s58.46 we caught
+   * the error and returned null but kept the stored token intact, so
+   * the very next caller would re-attempt the same dead token in an
+   * infinite loop (Pulse News iOS hammered /refresh ~1×/s for hours).
+   * The wipe forces the next op to fall through to /anonymous or
+   * surface NOT_SIGNED_IN to the host app instead of looping.
+   */
   async refreshAccessToken() {
     if (this.refreshInflight) return this.refreshInflight;
     const refresh = this.hooks.storage.get(REFRESH_KEY);
@@ -694,14 +701,18 @@ var Auth = class {
       try {
         const data = await this.callAuth("/api/v1/auth-service/token/refresh", {
           refreshToken: refresh
-        }).catch(() => null);
-        if (!data) return null;
+        });
         this.accessToken = data.tokens.accessToken;
         this.accessExpiresAt = Date.now() + data.tokens.expiresIn * 1e3;
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
         return data.tokens.accessToken;
+      } catch (err) {
+        if (err instanceof AuthError && isDeadRefreshError(err.code)) {
+          await this.wipeLocalIdentity().catch(() => void 0);
+        }
+        return null;
       } finally {
         this.refreshInflight = null;
       }
@@ -752,6 +763,10 @@ var Auth = class {
     await this.hooks.onAnonymousWipe();
   }
 };
+function isDeadRefreshError(code) {
+  if (!code) return false;
+  return code === "INVALID_REFRESH_TOKEN" || code === "HTTP_401" || code === "UNAUTHORIZED" || code === "RATE_LIMIT_EXCEEDED" || code === "RATE_LIMIT";
+}
 function decodeJwtPayload(token) {
   try {
     const parts = token.split(".");
@@ -812,7 +827,9 @@ function installAutoTrack(args) {
   if (flags.appBackground) {
     let AppState = null;
     try {
-      AppState = __require("react-native").AppState;
+      const dyn = globalThis.require;
+      const mod = dyn ? dyn("react-native") : null;
+      AppState = mod?.AppState ?? null;
     } catch {
       AppState = null;
     }
@@ -1100,6 +1117,28 @@ var SendoraSDK = class {
     }
     return { tokenId: data.tokenId, created: data.created === true };
   }
+  /**
+   * Push namespace — mirrors the iOS / Android / Web SDK shape so
+   * `sendora.push.registerToken(...)` works consistently across all 5 SDKs.
+   * Backed by the same registerPushToken() implementation; kept top-level
+   * too for backwards compatibility with the s47 release.
+   */
+  get push() {
+    const self = this;
+    return {
+      registerToken: (reg) => self.registerPushToken(reg),
+      trackOpen: async (sendId, clickAction) => {
+        if (!self.config) throw new Error("[sendoracloud] init() must complete before push.trackOpen().");
+        const body = { sendId };
+        if (clickAction !== void 0) body.clickAction = clickAction;
+        await post(
+          { apiUrl: self.config.apiUrl, publicKey: self.config.publicKey, debug: self.debug },
+          "/push/track-open",
+          body
+        );
+      }
+    };
+  }
   /**
    * Clear identity + rotate the anonymous id. Call on logout. Awaits
    * the AsyncStorage writes so a caller who kills the app immediately

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth. Expo Go compatible, no native modules beyond AsyncStorage.",
   "type": "module",
   "main": "./dist/index.cjs",