@sendoracloud/sdk-react-native 0.4.0 → 0.7.0

package/dist/index.cjs

@@ -98,18 +98,31 @@ var Storage = class {
     });
   }
   /**
-   * Remove every sendora_*-prefixed key we know about from both
-   * memory and AsyncStorage. Used by reset() so no stale identity
-   * survives a logout, including keys future SDK versions might add.
+   * Remove every sendora_*-prefixed key from both memory AND
+   * AsyncStorage. Uses getAllKeys() to find keys this process never
+   * cached (e.g. orphaned writes from a prior SDK version that added
+   * a key not in our hydrate list). Falls back to cache enumeration
+   * if the AsyncStorage backend doesn't expose getAllKeys.
    */
   async clearAll() {
-    const keys = Array.from(this.cache.keys());
     this.cache.clear();
     const store = await getAsyncStorage();
     if (!store) return;
+    let keys = [];
+    if (typeof store.getAllKeys === "function") {
+      try {
+        const all = await store.getAllKeys();
+        keys = all.filter((k) => k.startsWith(PREFIX));
+      } catch {
+        keys = [];
+      }
+    }
+    if (keys.length === 0) {
+      keys = Array.from(this.cache.keys()).map((k) => PREFIX + k);
+    }
     for (const k of keys) {
       try {
-        await store.removeItem(PREFIX + k);
+        await store.removeItem(k);
       } catch {
       }
     }
@@ -117,11 +130,20 @@ var Storage = class {
 };
 
 // src/http.ts
-async function post(opts, path, body) {
+async function post(opts, path, body, extraHeaders) {
+  return request(opts, "POST", path, body, extraHeaders);
+}
+async function getJson(opts, path, extraHeaders) {
+  return request(opts, "GET", path, void 0, extraHeaders);
+}
+async function del(opts, path, extraHeaders) {
+  return request(opts, "DELETE", path, void 0, extraHeaders);
+}
+async function request(opts, method, path, body, extraHeaders) {
   let res;
   try {
     res = await fetch(`${opts.apiUrl}${path}`, {
-      method: "POST",
+      method,
       headers: {
         "Content-Type": "application/json",
         // Backend auth middleware reads `x-api-key`. A previous build
@@ -129,41 +151,62 @@ async function post(opts, path, body) {
         // only accepts for SuperTokens session tokens — every event
         // silently 401'd. Do not change this header without updating
         // apps/backend/src/middleware/auth.ts in lockstep.
-        "x-api-key": opts.publicKey
+        "x-api-key": opts.publicKey,
+        ...extraHeaders ?? {}
       },
-      body: JSON.stringify(body)
+      body: body !== void 0 ? JSON.stringify(body) : void 0
     });
   } catch (err) {
     console.warn(
-      `[sendoracloud] POST ${path} failed at the network layer:`,
+      `[sendoracloud] ${method} ${path} failed at the network layer:`,
       err instanceof Error ? err.message : String(err)
     );
     return null;
   }
   if (!res.ok) {
-    let detail = "";
-    let fields = "";
-    try {
-      const parsed = await res.clone().json();
-      if (parsed?.error?.code || parsed?.error?.message) {
-        detail = ` \u2014 ${parsed.error.code ?? ""}${parsed.error.code && parsed.error.message ? ": " : ""}${parsed.error.message ?? ""}`;
-      }
-      const fe = parsed?.error?.details?.fieldErrors;
-      if (fe) {
-        const pieces = Object.entries(fe).map(([k, v]) => `${k}: ${(v ?? []).join(", ")}`).filter(Boolean);
-        if (pieces.length) fields = ` (${pieces.join("; ")})`;
+    const isAuthPath = path.startsWith("/api/v1/auth-service/");
+    if (isAuthPath && !opts.debug) {
+      console.warn(`[sendoracloud] ${method} ${path} \u2192 HTTP ${res.status}`);
+    } else {
+      let detail = "";
+      let fields = "";
+      try {
+        const parsed = await res.clone().json();
+        if (parsed?.error?.code || parsed?.error?.message) {
+          detail = ` \u2014 ${parsed.error.code ?? ""}${parsed.error.code && parsed.error.message ? ": " : ""}${parsed.error.message ?? ""}`;
+        }
+        const fe = parsed?.error?.details?.fieldErrors;
+        if (fe) {
+          const pieces = Object.entries(fe).map(([k, v]) => `${k}: ${(v ?? []).join(", ")}`).filter(Boolean);
+          if (pieces.length) fields = ` (${pieces.join("; ")})`;
+        }
+      } catch {
       }
-    } catch {
+      console.warn(`[sendoracloud] ${method} ${path} \u2192 HTTP ${res.status}${detail}${fields}`);
     }
-    console.warn(`[sendoracloud] POST ${path} \u2192 HTTP ${res.status}${detail}${fields}`);
   }
   return res;
 }
 
 // src/auth.ts
 var TOKEN_KEY = "auth_access_token";
+var TOKEN_EXPIRES_KEY = "auth_access_expires";
 var REFRESH_KEY = "auth_refresh_token";
 var USER_KEY = "auth_user";
+var REFRESH_SAFETY_MS = 3e4;
+function isAuthApiResponse(v) {
+  if (!v || typeof v !== "object") return false;
+  const r = v;
+  const user = r.user;
+  const tokens = r.tokens;
+  if (!user || typeof user.id !== "string" || user.id.length === 0) return false;
+  if (typeof user.isAnonymous !== "boolean") return false;
+  if (!tokens) return false;
+  if (typeof tokens.accessToken !== "string" || tokens.accessToken.length === 0) return false;
+  if (typeof tokens.refreshToken !== "string" || tokens.refreshToken.length === 0) return false;
+  if (typeof tokens.expiresIn !== "number" || tokens.expiresIn <= 0) return false;
+  return true;
+}
 var EmailAlreadyTakenError = class extends Error {
   constructor(message = "An account with this email already exists") {
     super(message);
@@ -181,21 +224,29 @@ var Auth = class {
   constructor(hooks) {
     this.user = null;
     this.accessToken = null;
+    this.accessExpiresAt = 0;
+    this.inflight = Promise.resolve();
+    this.refreshInflight = null;
     this.hooks = hooks;
   }
-  /** Re-hydrate session from AsyncStorage. Called by the parent SDK
+  /** Re-hydrate session from storage. Called by the parent SDK
    *  during init() after Storage.hydrate() has run. */
   hydrate() {
     const cachedUser = this.hooks.storage.get(USER_KEY);
     const cachedToken = this.hooks.storage.get(TOKEN_KEY);
+    const cachedExpires = this.hooks.storage.get(TOKEN_EXPIRES_KEY);
     if (cachedUser && cachedToken) {
       try {
-        this.user = JSON.parse(cachedUser);
+        const parsed = JSON.parse(cachedUser);
+        if (typeof parsed.id !== "string" || parsed.id.length === 0) throw new Error("invalid cache");
+        this.user = parsed;
         this.accessToken = cachedToken;
+        this.accessExpiresAt = cachedExpires ? Number(cachedExpires) : 0;
         this.hooks.onIdentityChange(this.user.id);
       } catch {
         this.hooks.storage.remove(USER_KEY);
         this.hooks.storage.remove(TOKEN_KEY);
+        this.hooks.storage.remove(TOKEN_EXPIRES_KEY);
         this.hooks.storage.remove(REFRESH_KEY);
       }
     }
@@ -203,81 +254,339 @@ var Auth = class {
   getCurrentUser() {
     return this.user;
   }
-  getAccessToken() {
+  /**
+   * Returns a non-expired access token or null. If the cached token
+   * is expired but a refresh token exists, transparently refreshes
+   * (single-flight — concurrent callers share one network call).
+   */
+  async getAccessToken() {
+    if (!this.accessToken) return null;
+    if (this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
+      return this.accessToken;
+    }
+    return this.refreshAccessToken();
+  }
+  /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
+  getAccessTokenSync() {
     return this.accessToken;
   }
-  async signInAnonymously(opts) {
-    const data = await this.callAuth("/api/v1/auth-service/anonymous", {
-      name: opts?.name,
-      metadata: opts?.metadata
+  signInAnonymously(opts) {
+    return this.serialize(async () => {
+      const data = await this.callAuth("/api/v1/auth-service/anonymous", {
+        name: opts?.name,
+        metadata: opts?.metadata
+      });
+      this.persist(data);
+      return data.user;
     });
-    this.persist(data);
-    return data.user;
   }
-  async signUp(email, password, opts) {
-    const refresh = this.hooks.storage.get(REFRESH_KEY);
-    const isAnonymous = this.user?.isAnonymous === true;
-    if (isAnonymous && refresh) {
+  signUp(email, password, opts) {
+    return this.serialize(async () => {
+      const refresh = this.hooks.storage.get(REFRESH_KEY);
+      const isAnonymous = this.user?.isAnonymous === true;
+      if (isAnonymous && refresh) {
+        try {
+          const data = await this.callAuth("/api/v1/auth-service/upgrade", {
+            refreshToken: refresh,
+            email,
+            password,
+            name: opts?.name
+          });
+          this.persist(data);
+          return data.user;
+        } catch (err) {
+          if (err instanceof AuthError && (err.code === "CONFLICT" || err.code === "EMAIL_ALREADY_TAKEN")) {
+            throw new EmailAlreadyTakenError(err.message);
+          }
+          throw err;
+        }
+      }
+      const wasIdentified = this.user !== null && this.user.isAnonymous === false;
+      if (wasIdentified) await this.wipeLocalIdentity();
       try {
-        const data = await this.callAuth("/api/v1/auth-service/upgrade", {
-          refreshToken: refresh,
+        const data = await this.callAuth("/api/v1/auth-service/signup", {
           email,
           password,
-          name: opts?.name
+          name: opts?.name,
+          metadata: opts?.metadata
         });
         this.persist(data);
         return data.user;
       } catch (err) {
-        if (err instanceof AuthError && (err.code === "CONFLICT" || err.code === "EMAIL_ALREADY_TAKEN")) {
+        if (err instanceof AuthError && err.code === "CONFLICT") {
           throw new EmailAlreadyTakenError(err.message);
         }
         throw err;
       }
-    }
-    try {
-      const data = await this.callAuth("/api/v1/auth-service/signup", {
-        email,
-        password,
-        name: opts?.name,
-        metadata: opts?.metadata
+    });
+  }
+  /**
+   * Sign in with email + password. When the user has confirmed MFA,
+   * returns `{mfaRequired, mfaChallengeToken}` instead of an
+   * `AuthUser`; caller must follow up with `challengeMfa()`.
+   */
+  signIn(email, password) {
+    return this.serialize(async () => {
+      if (this.user !== null) await this.wipeLocalIdentity();
+      const res = await post(
+        { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+        "/api/v1/auth-service/login",
+        { email, password }
+      );
+      if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
+      let parsed;
+      try {
+        parsed = await res.json();
+      } catch {
+        throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
+      }
+      if (!res.ok || !parsed.success || !parsed.data) {
+        throw new AuthError(parsed.error?.code ?? `HTTP_${res.status}`, parsed.error?.message ?? `HTTP ${res.status}`);
+      }
+      const r = parsed.data;
+      if (r.mfaRequired === true && typeof r.mfaChallengeToken === "string") {
+        const u = r.user;
+        return { mfaRequired: true, mfaChallengeToken: r.mfaChallengeToken, userId: u?.id ?? "" };
+      }
+      if (!isAuthApiResponse(parsed.data)) {
+        throw new AuthError(parsed.error?.code ?? "AUTH_ERROR", parsed.error?.message ?? "Login failed");
+      }
+      this.persist(parsed.data);
+      return parsed.data.user;
+    });
+  }
+  /**
+   * Exchange the MFA challenge token from `signIn` for a real session
+   * by submitting a TOTP or recovery code from the user's authenticator.
+   */
+  challengeMfa(mfaChallengeToken, code) {
+    return this.serialize(async () => {
+      const data = await this.callAuth("/api/v1/auth-service/mfa/challenge", {
+        challengeToken: mfaChallengeToken,
+        code
       });
       this.persist(data);
       return data.user;
-    } catch (err) {
-      if (err instanceof AuthError && err.code === "CONFLICT") {
-        throw new EmailAlreadyTakenError(err.message);
-      }
-      throw err;
+    });
+  }
+  // ============================================================
+  // MAGIC LINK
+  // ============================================================
+  async sendMagicLink(email) {
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/magic-link/request",
+      { email }
+    );
+    if (!res || !res.ok) {
+      throw new AuthError("MAGIC_LINK_REQUEST_FAILED", "Failed to send link");
     }
   }
-  async signIn(email, password) {
-    const wasAnonymous = this.user?.isAnonymous === true;
-    const data = await this.callAuth("/api/v1/auth-service/login", {
-      email,
-      password
+  verifyMagicLink(token) {
+    return this.serialize(async () => {
+      if (this.user !== null) await this.wipeLocalIdentity();
+      const data = await this.callAuth("/api/v1/auth-service/magic-link/verify", { token });
+      this.persist(data);
+      return data.user;
     });
-    if (wasAnonymous) await this.wipeLocalIdentity();
-    this.persist(data);
-    return data.user;
   }
-  async signOut() {
-    const refresh = this.hooks.storage.get(REFRESH_KEY);
-    if (refresh) {
-      try {
-        await post(
-          { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey },
+  // ============================================================
+  // TOTP MFA — enrollment management (Bearer-authenticated)
+  // ============================================================
+  async enrollMfa() {
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/mfa/enroll/start",
+      {},
+      this.bearerHeaders()
+    );
+    return await this.unwrap(res, "MFA_ENROLL_FAILED");
+  }
+  async confirmMfa(code) {
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/mfa/enroll/confirm",
+      { code },
+      this.bearerHeaders()
+    );
+    const data = await this.unwrap(res, "MFA_CONFIRM_FAILED");
+    return Boolean(data.confirmed);
+  }
+  async disableMfa() {
+    await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/mfa/disable",
+      {},
+      this.bearerHeaders()
+    );
+  }
+  // ============================================================
+  // DEVICE SESSIONS (Bearer-authenticated)
+  // ============================================================
+  async listMySessions() {
+    const res = await getJson(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/sessions/me",
+      this.bearerHeaders()
+    );
+    if (!res || !res.ok) return [];
+    const parsed = await res.json();
+    return Array.isArray(parsed.data) ? parsed.data : [];
+  }
+  async revokeSession(sessionId) {
+    await del(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      `/api/v1/auth-service/sessions/me/${encodeURIComponent(sessionId)}`,
+      this.bearerHeaders()
+    );
+  }
+  async revokeAllSessions() {
+    await del(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/sessions/me",
+      this.bearerHeaders()
+    );
+  }
+  // ============================================================
+  // OIDC SSO
+  // ============================================================
+  /**
+   * Start OIDC sign-in. Returns the IdP's authorization URL — caller
+   * opens it via React Native's `Linking.openURL()` (or
+   * `WebBrowser.openAuthSessionAsync` from `expo-web-browser` when
+   * inside Expo). The IdP redirects through Sendora's callback to the
+   * `returnTo` URL with `#sendora_oidc_token=...` in the fragment.
+   *
+   * On the customer's app side, `returnTo` MUST be a custom URL scheme
+   * registered in Info.plist (iOS) / AndroidManifest.xml intent-filter
+   * (Android), e.g. `myapp://oidc-callback`. When the deep link fires,
+   * call `consumeSsoFragment(url)` on the captured URL.
+   */
+  async startSso(returnTo) {
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/sso/oidc/start",
+      { returnTo }
+    );
+    if (!res || !res.ok) throw new AuthError("SSO_START_FAILED", `HTTP ${res?.status ?? "network"}`);
+    const parsed = await res.json();
+    if (!parsed.success || !parsed.data?.authorizationUrl) {
+      throw new AuthError("SSO_START_FAILED", "Missing authorizationUrl");
+    }
+    return { authorizationUrl: parsed.data.authorizationUrl };
+  }
+  /**
+   * Consume an OIDC callback URL captured via React Native's
+   * `Linking.addEventListener('url', ...)`. Reads the fragment for
+   * `sendora_oidc_token`, exchanges it for a session, and persists.
+   * Throws AuthError on `sendora_oidc_error=...` fragment.
+   */
+  consumeSsoFragment(callbackUrl) {
+    return this.serialize(async () => {
+      if (this.user !== null) await this.wipeLocalIdentity();
+      const hashIdx = callbackUrl.indexOf("#");
+      const fragment = hashIdx >= 0 ? callbackUrl.slice(hashIdx + 1) : "";
+      const params = new URLSearchParams(fragment);
+      const err = params.get("sendora_oidc_error");
+      if (err) throw new AuthError("SSO_FAILED", decodeURIComponent(err));
+      const refresh = params.get("sendora_oidc_token");
+      if (!refresh) throw new AuthError("SSO_NO_TOKEN", "Callback URL has no sendora_oidc_token");
+      const res = await post(
+        { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+        "/api/v1/auth-service/token/refresh",
+        { refreshToken: refresh }
+      );
+      if (!res || !res.ok) throw new AuthError("SSO_EXCHANGE_FAILED", `HTTP ${res?.status ?? "network"}`);
+      const parsed = await res.json();
+      const access = parsed.data?.accessToken;
+      const newRefresh = parsed.data?.refreshToken;
+      const expiresIn = parsed.data?.expiresIn;
+      if (!parsed.success || !access || !newRefresh || !expiresIn || expiresIn <= 0) {
+        throw new AuthError("SSO_EXCHANGE_FAILED", "Could not exchange OIDC token");
+      }
+      const claims = decodeJwtPayload(access);
+      const user = {
+        id: claims?.sub ?? "",
+        email: claims?.email ?? null,
+        emailVerified: claims?.email_verified ?? true,
+        name: claims?.name ?? null,
+        isAnonymous: false
+      };
+      this.persist({
+        user,
+        tokens: {
+          accessToken: access,
+          refreshToken: newRefresh,
+          expiresIn,
+          tokenType: "Bearer"
+        }
+      });
+      return user;
+    });
+  }
+  bearerHeaders() {
+    if (!this.accessToken) {
+      throw new AuthError("NOT_SIGNED_IN", "Not signed in");
+    }
+    return { Authorization: `Bearer ${this.accessToken}` };
+  }
+  async unwrap(res, errCode) {
+    if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
+    const parsed = await res.json().catch(() => ({}));
+    if (!res.ok || !parsed.success) {
+      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`);
+    }
+    return parsed.data;
+  }
+  /**
+   * Sign out: wipe local identity FIRST so the user is logged out on
+   * device even if the revoke network call hangs (airplane mode, 5xx).
+   * Revoke is fire-and-forget after the wipe.
+   */
+  signOut() {
+    return this.serialize(async () => {
+      const refresh = this.hooks.storage.get(REFRESH_KEY);
+      await this.wipeLocalIdentity();
+      if (refresh) {
+        void post(
+          { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
           "/api/v1/auth-service/token/revoke",
           { refreshToken: refresh }
-        );
-      } catch {
+        ).catch(() => void 0);
       }
-    }
-    await this.wipeLocalIdentity();
+    });
   }
   // --- internals ---
+  serialize(op) {
+    const next = this.inflight.then(op, op);
+    this.inflight = next.catch(() => void 0);
+    return next;
+  }
+  async refreshAccessToken() {
+    if (this.refreshInflight) return this.refreshInflight;
+    const refresh = this.hooks.storage.get(REFRESH_KEY);
+    if (!refresh) return null;
+    this.refreshInflight = (async () => {
+      try {
+        const data = await this.callAuth("/api/v1/auth-service/token/refresh", {
+          refreshToken: refresh
+        }).catch(() => null);
+        if (!data) return null;
+        this.accessToken = data.tokens.accessToken;
+        this.accessExpiresAt = Date.now() + data.tokens.expiresIn * 1e3;
+        this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
+        this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
+        this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        return data.tokens.accessToken;
+      } finally {
+        this.refreshInflight = null;
+      }
+    })();
+    return this.refreshInflight;
+  }
   async callAuth(path, body) {
     const res = await post(
-      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey },
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       path,
       body
     );
@@ -290,7 +599,7 @@ var Auth = class {
     } catch {
       throw new AuthError("PARSE_ERROR", `HTTP ${res.status}`);
     }
-    if (!res.ok || !parsed.success || !parsed.data) {
+    if (!res.ok || !parsed.success || !isAuthApiResponse(parsed.data)) {
       throw new AuthError(
         parsed.error?.code ?? `HTTP_${res.status}`,
         parsed.error?.message ?? `HTTP ${res.status}`
@@ -301,37 +610,64 @@ var Auth = class {
   persist(data) {
     this.user = data.user;
     this.accessToken = data.tokens.accessToken;
+    this.accessExpiresAt = Date.now() + data.tokens.expiresIn * 1e3;
     this.hooks.storage.set(USER_KEY, JSON.stringify(data.user));
     this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
+    this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
     this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
     this.hooks.onIdentityChange(data.user.id);
   }
   async wipeLocalIdentity() {
     this.user = null;
     this.accessToken = null;
+    this.accessExpiresAt = 0;
     this.hooks.storage.remove(USER_KEY);
     this.hooks.storage.remove(TOKEN_KEY);
+    this.hooks.storage.remove(TOKEN_EXPIRES_KEY);
     this.hooks.storage.remove(REFRESH_KEY);
     await this.hooks.onAnonymousWipe();
   }
 };
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = (4 - padded.length % 4) % 4;
+    if (typeof atob !== "function") return null;
+    const json = atob(padded + "===".slice(0, pad));
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
 
 // src/index.ts
+var SDK_VERSION = "0.4.0";
 var DEFAULT_API_URL = "https://api.sendoracloud.com";
 var ANON_KEY = "anon_id";
 var USER_ID_KEY = "user_id";
-var AUTH_HYDRATE_KEYS = ["auth_access_token", "auth_refresh_token", "auth_user"];
+var AUTH_HYDRATE_KEYS = [
+  "auth_access_token",
+  "auth_access_expires",
+  "auth_refresh_token",
+  "auth_user"
+];
 var PUBLIC_KEY_RE = /^pk_(prod|staging|dev|live|test)_[A-Za-z0-9]{16,}$/;
 var MAX_PUSH_TOKEN_BYTES = 4096;
 var MAX_PUSH_METADATA_BYTES = 4096;
+var MAX_USER_ID_LEN = 256;
+var MAX_TRAITS_BYTES = 32 * 1024;
+var MAX_PROPERTIES_BYTES = 32 * 1024;
 function uuid() {
   const bytes = new Uint8Array(16);
   const g = globalThis;
-  if (g.crypto?.getRandomValues) {
-    g.crypto.getRandomValues(bytes);
-  } else {
-    for (let i = 0; i < 16; i++) bytes[i] = Math.floor(Math.random() * 256);
+  if (!g.crypto?.getRandomValues) {
+    throw new Error(
+      "[sendoracloud] crypto.getRandomValues unavailable \u2014 refusing to mint IDs without a CSPRNG. Upgrade Hermes / your RN runtime."
+    );
   }
+  g.crypto.getRandomValues(bytes);
   bytes[6] = bytes[6] & 15 | 64;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
@@ -351,6 +687,8 @@ var SendoraSDK = class {
     this.storage = new Storage();
     this.anonId = "";
     this.userId = null;
+    this.consentGranted = true;
+    this.debug = false;
   }
   /** Initialize the SDK. Must be awaited at app startup before identify/track. */
   async init(config) {
@@ -379,6 +717,11 @@ var SendoraSDK = class {
       if (err instanceof Error && err.message.startsWith("[sendoracloud]")) throw err;
       throw new Error(`[sendoracloud] apiUrl is not a valid URL: ${apiUrl}`);
     }
+    if (apiUrl !== DEFAULT_API_URL) {
+      console.warn(
+        `[sendoracloud] apiUrl override active: ${apiUrl} \u2014 confirm this is intentional. Tokens + events will be sent here.`
+      );
+    }
     await this.storage.hydrate([ANON_KEY, USER_ID_KEY, ...AUTH_HYDRATE_KEYS]);
     let anon = this.storage.get(ANON_KEY);
     if (!anon) {
@@ -387,6 +730,8 @@ var SendoraSDK = class {
     }
     this.anonId = anon;
     this.userId = this.storage.get(USER_ID_KEY);
+    this.consentGranted = config.consentedByDefault !== false;
+    this.debug = config.debug === true;
     this.config = {
       apiUrl,
       environment: "prod",
@@ -398,6 +743,7 @@ var SendoraSDK = class {
       storage: this.storage,
       apiUrl: this.config.apiUrl,
       publicKey: this.config.publicKey,
+      debug: this.debug,
       onIdentityChange: (userId) => {
         this.userId = userId;
         if (userId) this.storage.set(USER_ID_KEY, userId);
@@ -422,9 +768,22 @@ var SendoraSDK = class {
   getUserId() {
     return this.userId;
   }
+  /** Toggle consent at runtime — when false, events drop instead of fire. */
+  setConsent(granted) {
+    this.consentGranted = granted;
+  }
   /** Associate a user id + traits with the current anonymous install. */
   identify(userId, traits) {
     this.assertReady();
+    if (typeof userId !== "string" || userId.length === 0 || userId.length > MAX_USER_ID_LEN) {
+      throw new Error(`[sendoracloud] userId must be a 1-${MAX_USER_ID_LEN} char string.`);
+    }
+    if (traits) {
+      const bytes = byteLength(JSON.stringify(traits));
+      if (bytes > MAX_TRAITS_BYTES) {
+        throw new Error(`[sendoracloud] traits exceed ${MAX_TRAITS_BYTES} bytes.`);
+      }
+    }
     this.userId = userId;
     this.storage.set(USER_ID_KEY, userId);
     void this.sendEvent("identify", {
@@ -435,6 +794,15 @@ var SendoraSDK = class {
   /** Fire a custom product event. */
   track(eventType, properties) {
     this.assertReady();
+    if (typeof eventType !== "string" || eventType.length === 0 || eventType.length > 256) {
+      throw new Error("[sendoracloud] eventType must be a 1-256 char string.");
+    }
+    if (properties) {
+      const bytes = byteLength(JSON.stringify(properties));
+      if (bytes > MAX_PROPERTIES_BYTES) {
+        throw new Error(`[sendoracloud] properties exceed ${MAX_PROPERTIES_BYTES} bytes.`);
+      }
+    }
     void this.sendEvent("track", {
       eventType,
       properties: properties ?? {}
@@ -443,6 +811,9 @@ var SendoraSDK = class {
   /** RN equivalent of page view — call on route / screen change. */
   screen(name, properties) {
     this.assertReady();
+    if (typeof name !== "string" || name.length === 0 || name.length > 256) {
+      throw new Error("[sendoracloud] screen name must be a 1-256 char string.");
+    }
     void this.sendEvent("screen", {
       eventType: "screen.viewed",
       properties: { screenName: name, ...properties ?? {} }
@@ -467,7 +838,7 @@ var SendoraSDK = class {
       }
     }
     await post(
-      { apiUrl: this.config.apiUrl, publicKey: this.config.publicKey },
+      { apiUrl: this.config.apiUrl, publicKey: this.config.publicKey, debug: this.debug },
       "/api/v1/push/tokens",
       {
         orgId: this.config.orgId,
@@ -493,8 +864,9 @@ var SendoraSDK = class {
   }
   async sendEvent(kind, payload) {
     if (!this.config) return;
+    if (!this.consentGranted) return;
     await post(
-      { apiUrl: this.config.apiUrl, publicKey: this.config.publicKey },
+      { apiUrl: this.config.apiUrl, publicKey: this.config.publicKey, debug: this.debug },
       "/api/v1/events",
       {
         orgId: this.config.orgId,
@@ -507,6 +879,7 @@ var SendoraSDK = class {
         properties: payload.properties ?? {},
         context: {
           platform: "react-native",
+          sdk: { name: "@sendoracloud/sdk-react-native", version: SDK_VERSION },
           ...this.config.environment ? { environment: this.config.environment } : {},
           ...kind === "identify" ? { traits: payload.traits } : {}
         }