@sendoracloud/sdk-react-native 1.0.4 → 1.1.0

package/dist/index.cjs

@@ -136,16 +136,36 @@ var Storage = class {
 };
 
 // src/http.ts
-async function post(opts, path, body, extraHeaders) {
-  return request(opts, "POST", path, body, extraHeaders);
+var NetworkTimeoutError = class extends Error {
+  constructor(method, path, timeoutMs) {
+    super(`Request timed out: ${method} ${path} (${timeoutMs}ms)`);
+    this.name = "NetworkTimeoutError";
+    this.method = method;
+    this.path = path;
+    this.timeoutMs = timeoutMs;
+  }
+};
+var DEFAULT_AUTH_TIMEOUT_MS = 1e4;
+var DEFAULT_INGEST_TIMEOUT_MS = 3e4;
+function defaultTimeoutFor(path) {
+  if (path.startsWith("/api/v1/auth-service/")) return DEFAULT_AUTH_TIMEOUT_MS;
+  return DEFAULT_INGEST_TIMEOUT_MS;
+}
+async function post(opts, path, body, extraHeaders, reqOpts) {
+  return request(opts, "POST", path, body, extraHeaders, reqOpts);
 }
-async function getJson(opts, path, extraHeaders) {
-  return request(opts, "GET", path, void 0, extraHeaders);
+async function getJson(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "GET", path, void 0, extraHeaders, reqOpts);
 }
-async function del(opts, path, extraHeaders) {
-  return request(opts, "DELETE", path, void 0, extraHeaders);
+async function del(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "DELETE", path, void 0, extraHeaders, reqOpts);
 }
-async function request(opts, method, path, body, extraHeaders) {
+async function request(opts, method, path, body, extraHeaders, reqOpts) {
+  const timeoutMs = reqOpts?.timeoutMs ?? defaultTimeoutFor(path);
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
   let res;
   try {
     res = await fetch(`${opts.apiUrl}${path}`, {
@@ -160,15 +180,20 @@ async function request(opts, method, path, body, extraHeaders) {
         "x-api-key": opts.publicKey,
         ...extraHeaders ?? {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: controller.signal
     });
   } catch (err) {
+    clearTimeout(timer);
+    const aborted = err?.name === "AbortError";
+    if (aborted) throw new NetworkTimeoutError(method, path, timeoutMs);
     console.warn(
       `[sendoracloud] ${method} ${path} failed at the network layer:`,
       err instanceof Error ? err.message : String(err)
     );
     return null;
   }
+  clearTimeout(timer);
   if (!res.ok) {
     const isAuthPath = path.startsWith("/api/v1/auth-service/");
     if (isAuthPath && !opts.debug) {
@@ -237,6 +262,21 @@ var Auth = class {
     this.accessExpiresAt = 0;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+    this.takeoverListeners = /* @__PURE__ */ new Set();
+    this.lastTakeover = null;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -300,15 +340,79 @@ var Auth = class {
     return this.user;
   }
   /**
-   * Returns a non-expired access token or null. If the cached token
-   * is expired but a refresh token exists, transparently refreshes
-   * (single-flight — concurrent callers share one network call).
+   * Subscribe to device-takeover events (s58.111+). Backend retires
+   * the anonymous user_id whenever a previously-anon device signs in
+   * to an identified account. Use this to clean up any local mirror
+   * keyed by the anonymous id — your own users table, an analytics
+   * cache, an audience filter — without needing a webhook receiver.
+   *
+   * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
+   * `verifyEmailOtp`, `passkey authentication`, and SSO completion
+   * (via `consumeSsoFragment`). Returns an unsubscribe function.
+   *
+   * Listeners are best-effort: errors thrown inside them are swallowed
+   * + logged in dev mode. Auth state never depends on listener success.
+   */
+  onDeviceTakeover(listener) {
+    this.takeoverListeners.add(listener);
+    return () => {
+      this.takeoverListeners.delete(listener);
+    };
+  }
+  /**
+   * Inspect the most recent device-takeover event observed by the
+   * SDK. Cleared on signOut. Returns null when no takeover has
+   * happened during this session — useful for late subscribers or
+   * post-sign-in side-effects (e.g. app-launch hydrate).
+   */
+  getLastDeviceTakeover() {
+    return this.lastTakeover;
+  }
+  /** Internal — fan out to subscribers + cache the latest. */
+  fireDeviceTakeover(retiredAnonUserId, identifiedUserId) {
+    const evt = { retiredAnonUserId, identifiedUserId, at: /* @__PURE__ */ new Date() };
+    this.lastTakeover = evt;
+    for (const fn of this.takeoverListeners) {
+      try {
+        fn(evt);
+      } catch (err) {
+        if (this.hooks.debug) console.warn("[sendoracloud] onDeviceTakeover listener threw", err);
+      }
+    }
+  }
+  /**
+   * Returns an access token or null. Cold-launch hardening (Wave 62):
+   *
+   *  1. Non-expired cached → return it. (Fast path.)
+   *  2. Expired AND refresh inflight → return stale cached anyway.
+   *     Backend grace window (60s — see auth-service refresh-rotation
+   *     middleware) accepts slightly-stale access tokens, so the
+   *     caller's downstream RPC will succeed against grace while
+   *     the in-flight refresh resolves out of band. Distinct from
+   *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+   *     the same in-flight promise — when that promise hung (iOS
+   *     NSURLSession cold-launch contention) every caller hung too.
+   *  3. Expired + no inflight + refresh available + not in cooldown →
+   *     fire refresh, await it.
+   *  4. Expired + in cooldown → return stale cached. Caller's RPC
+   *     either succeeds against grace or fails fast on 401, which is
+   *     a better UX than blocking the whole bridge waiting on a
+   *     network that we already know is stalled.
+   *
+   * Returns null only when there's NO usable token at all (no cached
+   * + no refresh available).
    */
   async getAccessToken() {
     if (!this.accessToken) return null;
     if (this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
       return this.accessToken;
     }
+    if (this.refreshInflight) {
+      return this.accessToken;
+    }
+    if (Date.now() < this.refreshCooldownUntil) {
+      return this.accessToken;
+    }
     return this.refreshAccessToken();
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -741,6 +845,7 @@ var Auth = class {
       if (err) throw new AuthError("SSO_FAILED", decodeURIComponent(err));
       const refresh = params.get("sendora_oidc_token") ?? params.get("sendora_saml_token");
       if (!refresh) throw new AuthError("SSO_NO_TOKEN", "Callback URL has no SSO token");
+      const retiredAnonUserId = params.get("sendora_retired_anon");
       const res = await post(
         { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
         "/api/v1/auth-service/token/refresh",
@@ -769,7 +874,8 @@ var Auth = class {
           refreshToken: newRefresh,
           expiresIn,
           tokenType: "Bearer"
-        }
+        },
+        ...retiredAnonUserId ? { retiredAnonUserId } : {}
       });
       return user;
     });
@@ -845,6 +951,8 @@ var Auth = class {
             if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
+              this.refreshFailureCount = 0;
+              this.refreshCooldownUntil = 0;
               return freshAccess;
             }
           }
@@ -857,11 +965,19 @@ var Auth = class {
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        this.refreshFailureCount = 0;
+        this.refreshCooldownUntil = 0;
         return data.tokens.accessToken;
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           await this.wipeLocalIdentity().catch(() => void 0);
+          this.refreshFailureCount = 0;
+          this.refreshCooldownUntil = 0;
+          return null;
         }
+        this.refreshFailureCount += 1;
+        const backoffMs = Math.min(3e4, 1e3 * Math.pow(2, this.refreshFailureCount - 1));
+        this.refreshCooldownUntil = Date.now() + backoffMs;
         return null;
       } finally {
         this.refreshInflight = null;
@@ -869,6 +985,20 @@ var Auth = class {
     })();
     return this.refreshInflight;
   }
+  /**
+   * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+   * who backgrounded the app during a network blip + returns now
+   * gets an immediate fresh refresh attempt instead of waiting on
+   * the cooldown timer.
+   *
+   * Called from the AppState 'active' listener registered in
+   * startProactiveRefreshCron. Idempotent + cheap — three field
+   * writes; no I/O.
+   */
+  resetRefreshState() {
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+  }
   startProactiveRefreshCron() {
     if (this.proactiveRefreshTimer) return;
     const PROACTIVE_TARGET_PCT = 0.8;
@@ -890,7 +1020,10 @@ var Auth = class {
     }, TICK_MS);
     try {
       const subscription = import_react_native.AppState?.addEventListener?.("change", (state) => {
-        if (state === "active") void tick();
+        if (state === "active") {
+          this.resetRefreshState();
+          void tick();
+        }
       });
       if (subscription) {
         this.proactiveRefreshAppStateUnsub = () => subscription.remove();
@@ -1010,11 +1143,15 @@ var Auth = class {
     this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
     this.hooks.onIdentityChange(data.user.id);
     this.startProactiveRefreshCron();
+    if (data.retiredAnonUserId) {
+      this.fireDeviceTakeover(data.retiredAnonUserId, data.user.id);
+    }
   }
   async wipeLocalIdentity() {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
+    this.lastTakeover = null;
     this.hooks.storage.remove(USER_KEY);
     this.hooks.storage.remove(TOKEN_KEY);
     this.hooks.storage.remove(TOKEN_EXPIRES_KEY);
@@ -1321,11 +1458,13 @@ async function getPlayInstallReferrer() {
 }
 var PREWARM_TTL_MS = 5 * 6e4;
 var PREWARM_MAX = 50;
+var PREWARM_MAX_INFLIGHT = 5;
 var Links = class {
   constructor(deps) {
     this.deps = deps;
     this.listeners = [];
     this.prewarmCache = /* @__PURE__ */ new Map();
+    this.prewarmInflight = 0;
     this.linkingSub = null;
   }
   /** Register a callback for warm + deferred deep-link opens. Returns
@@ -1373,14 +1512,25 @@ var Links = class {
    *
    * Fire-and-forget. Errors are swallowed; the matching `create()` call
    * will surface them on demand instead.
+   *
+   * Wave 28 — silently drops the call when more than
+   * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+   * fire-and-forget by contract; an overflow `prewarm()` is fine to
+   * skip because the next matching `create()` will simply do the mint
+   * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+   * in a FlatList renderItem).
    */
   prewarm(input, opts) {
     this.evictExpired();
     const key = this.cacheKey(input, opts?.key);
     if (this.prewarmCache.has(key)) return;
+    if (this.prewarmInflight >= PREWARM_MAX_INFLIGHT) return;
+    this.prewarmInflight++;
     const promise = this.doCreate(input).catch((err) => {
       this.prewarmCache.delete(key);
       throw err;
+    }).finally(() => {
+      this.prewarmInflight--;
     });
     this.prewarmCache.set(key, { promise, ts: Date.now() });
   }

package/dist/index.d.cts

@@ -99,6 +99,19 @@ interface AuthHooks {
     publicKey: string;
     debug: boolean;
 }
+/**
+ * Detail handed to onDeviceTakeover subscribers. Fires once per
+ * signIn / loginSocial / verifyMagicLink / verifyEmailOtp /
+ * passkey-auth / SSO completion that retires an anonymous row.
+ */
+interface DeviceTakeoverEvent {
+    /** The anonymous user_id Sendora just hard-deleted. */
+    retiredAnonUserId: string;
+    /** The identified user_id that took the device over. */
+    identifiedUserId: string;
+    /** Local clock at the time the SDK observed the event. */
+    at: Date;
+}
 declare class Auth {
     private hooks;
     private user;
@@ -106,6 +119,21 @@ declare class Auth {
     private accessExpiresAt;
     private inflight;
     private refreshInflight;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    private refreshFailureCount;
+    private refreshCooldownUntil;
+    private takeoverListeners;
+    private lastTakeover;
     /**
      * Resolves when the parent SDK has finished its async init() —
      * AsyncStorage hydrated + auth.hydrate() restored the cached
@@ -143,9 +171,50 @@ declare class Auth {
     hydrate(): void;
     getCurrentUser(): AuthUser | null;
     /**
-     * Returns a non-expired access token or null. If the cached token
-     * is expired but a refresh token exists, transparently refreshes
-     * (single-flight — concurrent callers share one network call).
+     * Subscribe to device-takeover events (s58.111+). Backend retires
+     * the anonymous user_id whenever a previously-anon device signs in
+     * to an identified account. Use this to clean up any local mirror
+     * keyed by the anonymous id — your own users table, an analytics
+     * cache, an audience filter — without needing a webhook receiver.
+     *
+     * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
+     * `verifyEmailOtp`, `passkey authentication`, and SSO completion
+     * (via `consumeSsoFragment`). Returns an unsubscribe function.
+     *
+     * Listeners are best-effort: errors thrown inside them are swallowed
+     * + logged in dev mode. Auth state never depends on listener success.
+     */
+    onDeviceTakeover(listener: (evt: DeviceTakeoverEvent) => void): () => void;
+    /**
+     * Inspect the most recent device-takeover event observed by the
+     * SDK. Cleared on signOut. Returns null when no takeover has
+     * happened during this session — useful for late subscribers or
+     * post-sign-in side-effects (e.g. app-launch hydrate).
+     */
+    getLastDeviceTakeover(): DeviceTakeoverEvent | null;
+    /** Internal — fan out to subscribers + cache the latest. */
+    private fireDeviceTakeover;
+    /**
+     * Returns an access token or null. Cold-launch hardening (Wave 62):
+     *
+     *  1. Non-expired cached → return it. (Fast path.)
+     *  2. Expired AND refresh inflight → return stale cached anyway.
+     *     Backend grace window (60s — see auth-service refresh-rotation
+     *     middleware) accepts slightly-stale access tokens, so the
+     *     caller's downstream RPC will succeed against grace while
+     *     the in-flight refresh resolves out of band. Distinct from
+     *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+     *     the same in-flight promise — when that promise hung (iOS
+     *     NSURLSession cold-launch contention) every caller hung too.
+     *  3. Expired + no inflight + refresh available + not in cooldown →
+     *     fire refresh, await it.
+     *  4. Expired + in cooldown → return stale cached. Caller's RPC
+     *     either succeeds against grace or fails fast on 401, which is
+     *     a better UX than blocking the whole bridge waiting on a
+     *     network that we already know is stalled.
+     *
+     * Returns null only when there's NO usable token at all (no cached
+     * + no refresh available).
      */
     getAccessToken(): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -320,6 +389,17 @@ declare class Auth {
      * surface NOT_SIGNED_IN to the host app instead of looping.
      */
     private refreshAccessToken;
+    /**
+     * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+     * who backgrounded the app during a network blip + returns now
+     * gets an immediate fresh refresh attempt instead of waiting on
+     * the cooldown timer.
+     *
+     * Called from the AppState 'active' listener registered in
+     * startProactiveRefreshCron. Idempotent + cheap — three field
+     * writes; no I/O.
+     */
+    private resetRefreshState;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -535,6 +615,7 @@ declare class Links {
     private deps;
     private listeners;
     private prewarmCache;
+    private prewarmInflight;
     private linkingSub;
     constructor(deps: LinksDeps);
     /** Register a callback for warm + deferred deep-link opens. Returns
@@ -550,6 +631,13 @@ declare class Links {
      *
      * Fire-and-forget. Errors are swallowed; the matching `create()` call
      * will surface them on demand instead.
+     *
+     * Wave 28 — silently drops the call when more than
+     * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+     * fire-and-forget by contract; an overflow `prewarm()` is fine to
+     * skip because the next matching `create()` will simply do the mint
+     * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+     * in a FlatList renderItem).
      */
     prewarm<T extends LinkData = LinkData>(input: LinkCreateInput<T>, opts?: {
         key?: string;

package/dist/index.d.ts

@@ -99,6 +99,19 @@ interface AuthHooks {
     publicKey: string;
     debug: boolean;
 }
+/**
+ * Detail handed to onDeviceTakeover subscribers. Fires once per
+ * signIn / loginSocial / verifyMagicLink / verifyEmailOtp /
+ * passkey-auth / SSO completion that retires an anonymous row.
+ */
+interface DeviceTakeoverEvent {
+    /** The anonymous user_id Sendora just hard-deleted. */
+    retiredAnonUserId: string;
+    /** The identified user_id that took the device over. */
+    identifiedUserId: string;
+    /** Local clock at the time the SDK observed the event. */
+    at: Date;
+}
 declare class Auth {
     private hooks;
     private user;
@@ -106,6 +119,21 @@ declare class Auth {
     private accessExpiresAt;
     private inflight;
     private refreshInflight;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    private refreshFailureCount;
+    private refreshCooldownUntil;
+    private takeoverListeners;
+    private lastTakeover;
     /**
      * Resolves when the parent SDK has finished its async init() —
      * AsyncStorage hydrated + auth.hydrate() restored the cached
@@ -143,9 +171,50 @@ declare class Auth {
     hydrate(): void;
     getCurrentUser(): AuthUser | null;
     /**
-     * Returns a non-expired access token or null. If the cached token
-     * is expired but a refresh token exists, transparently refreshes
-     * (single-flight — concurrent callers share one network call).
+     * Subscribe to device-takeover events (s58.111+). Backend retires
+     * the anonymous user_id whenever a previously-anon device signs in
+     * to an identified account. Use this to clean up any local mirror
+     * keyed by the anonymous id — your own users table, an analytics
+     * cache, an audience filter — without needing a webhook receiver.
+     *
+     * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
+     * `verifyEmailOtp`, `passkey authentication`, and SSO completion
+     * (via `consumeSsoFragment`). Returns an unsubscribe function.
+     *
+     * Listeners are best-effort: errors thrown inside them are swallowed
+     * + logged in dev mode. Auth state never depends on listener success.
+     */
+    onDeviceTakeover(listener: (evt: DeviceTakeoverEvent) => void): () => void;
+    /**
+     * Inspect the most recent device-takeover event observed by the
+     * SDK. Cleared on signOut. Returns null when no takeover has
+     * happened during this session — useful for late subscribers or
+     * post-sign-in side-effects (e.g. app-launch hydrate).
+     */
+    getLastDeviceTakeover(): DeviceTakeoverEvent | null;
+    /** Internal — fan out to subscribers + cache the latest. */
+    private fireDeviceTakeover;
+    /**
+     * Returns an access token or null. Cold-launch hardening (Wave 62):
+     *
+     *  1. Non-expired cached → return it. (Fast path.)
+     *  2. Expired AND refresh inflight → return stale cached anyway.
+     *     Backend grace window (60s — see auth-service refresh-rotation
+     *     middleware) accepts slightly-stale access tokens, so the
+     *     caller's downstream RPC will succeed against grace while
+     *     the in-flight refresh resolves out of band. Distinct from
+     *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+     *     the same in-flight promise — when that promise hung (iOS
+     *     NSURLSession cold-launch contention) every caller hung too.
+     *  3. Expired + no inflight + refresh available + not in cooldown →
+     *     fire refresh, await it.
+     *  4. Expired + in cooldown → return stale cached. Caller's RPC
+     *     either succeeds against grace or fails fast on 401, which is
+     *     a better UX than blocking the whole bridge waiting on a
+     *     network that we already know is stalled.
+     *
+     * Returns null only when there's NO usable token at all (no cached
+     * + no refresh available).
      */
     getAccessToken(): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -320,6 +389,17 @@ declare class Auth {
      * surface NOT_SIGNED_IN to the host app instead of looping.
      */
     private refreshAccessToken;
+    /**
+     * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+     * who backgrounded the app during a network blip + returns now
+     * gets an immediate fresh refresh attempt instead of waiting on
+     * the cooldown timer.
+     *
+     * Called from the AppState 'active' listener registered in
+     * startProactiveRefreshCron. Idempotent + cheap — three field
+     * writes; no I/O.
+     */
+    private resetRefreshState;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -535,6 +615,7 @@ declare class Links {
     private deps;
     private listeners;
     private prewarmCache;
+    private prewarmInflight;
     private linkingSub;
     constructor(deps: LinksDeps);
     /** Register a callback for warm + deferred deep-link opens. Returns
@@ -550,6 +631,13 @@ declare class Links {
      *
      * Fire-and-forget. Errors are swallowed; the matching `create()` call
      * will surface them on demand instead.
+     *
+     * Wave 28 — silently drops the call when more than
+     * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+     * fire-and-forget by contract; an overflow `prewarm()` is fine to
+     * skip because the next matching `create()` will simply do the mint
+     * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+     * in a FlatList renderItem).
      */
     prewarm<T extends LinkData = LinkData>(input: LinkCreateInput<T>, opts?: {
         key?: string;

package/dist/index.js

@@ -93,16 +93,36 @@ var Storage = class {
 };
 
 // src/http.ts
-async function post(opts, path, body, extraHeaders) {
-  return request(opts, "POST", path, body, extraHeaders);
+var NetworkTimeoutError = class extends Error {
+  constructor(method, path, timeoutMs) {
+    super(`Request timed out: ${method} ${path} (${timeoutMs}ms)`);
+    this.name = "NetworkTimeoutError";
+    this.method = method;
+    this.path = path;
+    this.timeoutMs = timeoutMs;
+  }
+};
+var DEFAULT_AUTH_TIMEOUT_MS = 1e4;
+var DEFAULT_INGEST_TIMEOUT_MS = 3e4;
+function defaultTimeoutFor(path) {
+  if (path.startsWith("/api/v1/auth-service/")) return DEFAULT_AUTH_TIMEOUT_MS;
+  return DEFAULT_INGEST_TIMEOUT_MS;
+}
+async function post(opts, path, body, extraHeaders, reqOpts) {
+  return request(opts, "POST", path, body, extraHeaders, reqOpts);
 }
-async function getJson(opts, path, extraHeaders) {
-  return request(opts, "GET", path, void 0, extraHeaders);
+async function getJson(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "GET", path, void 0, extraHeaders, reqOpts);
 }
-async function del(opts, path, extraHeaders) {
-  return request(opts, "DELETE", path, void 0, extraHeaders);
+async function del(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "DELETE", path, void 0, extraHeaders, reqOpts);
 }
-async function request(opts, method, path, body, extraHeaders) {
+async function request(opts, method, path, body, extraHeaders, reqOpts) {
+  const timeoutMs = reqOpts?.timeoutMs ?? defaultTimeoutFor(path);
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
   let res;
   try {
     res = await fetch(`${opts.apiUrl}${path}`, {
@@ -117,15 +137,20 @@ async function request(opts, method, path, body, extraHeaders) {
         "x-api-key": opts.publicKey,
         ...extraHeaders ?? {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: controller.signal
     });
   } catch (err) {
+    clearTimeout(timer);
+    const aborted = err?.name === "AbortError";
+    if (aborted) throw new NetworkTimeoutError(method, path, timeoutMs);
     console.warn(
       `[sendoracloud] ${method} ${path} failed at the network layer:`,
       err instanceof Error ? err.message : String(err)
     );
     return null;
   }
+  clearTimeout(timer);
   if (!res.ok) {
     const isAuthPath = path.startsWith("/api/v1/auth-service/");
     if (isAuthPath && !opts.debug) {
@@ -194,6 +219,21 @@ var Auth = class {
     this.accessExpiresAt = 0;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+    this.takeoverListeners = /* @__PURE__ */ new Set();
+    this.lastTakeover = null;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -257,15 +297,79 @@ var Auth = class {
     return this.user;
   }
   /**
-   * Returns a non-expired access token or null. If the cached token
-   * is expired but a refresh token exists, transparently refreshes
-   * (single-flight — concurrent callers share one network call).
+   * Subscribe to device-takeover events (s58.111+). Backend retires
+   * the anonymous user_id whenever a previously-anon device signs in
+   * to an identified account. Use this to clean up any local mirror
+   * keyed by the anonymous id — your own users table, an analytics
+   * cache, an audience filter — without needing a webhook receiver.
+   *
+   * Listener is invoked from `signIn`, `loginSocial`, `verifyMagicLink`,
+   * `verifyEmailOtp`, `passkey authentication`, and SSO completion
+   * (via `consumeSsoFragment`). Returns an unsubscribe function.
+   *
+   * Listeners are best-effort: errors thrown inside them are swallowed
+   * + logged in dev mode. Auth state never depends on listener success.
+   */
+  onDeviceTakeover(listener) {
+    this.takeoverListeners.add(listener);
+    return () => {
+      this.takeoverListeners.delete(listener);
+    };
+  }
+  /**
+   * Inspect the most recent device-takeover event observed by the
+   * SDK. Cleared on signOut. Returns null when no takeover has
+   * happened during this session — useful for late subscribers or
+   * post-sign-in side-effects (e.g. app-launch hydrate).
+   */
+  getLastDeviceTakeover() {
+    return this.lastTakeover;
+  }
+  /** Internal — fan out to subscribers + cache the latest. */
+  fireDeviceTakeover(retiredAnonUserId, identifiedUserId) {
+    const evt = { retiredAnonUserId, identifiedUserId, at: /* @__PURE__ */ new Date() };
+    this.lastTakeover = evt;
+    for (const fn of this.takeoverListeners) {
+      try {
+        fn(evt);
+      } catch (err) {
+        if (this.hooks.debug) console.warn("[sendoracloud] onDeviceTakeover listener threw", err);
+      }
+    }
+  }
+  /**
+   * Returns an access token or null. Cold-launch hardening (Wave 62):
+   *
+   *  1. Non-expired cached → return it. (Fast path.)
+   *  2. Expired AND refresh inflight → return stale cached anyway.
+   *     Backend grace window (60s — see auth-service refresh-rotation
+   *     middleware) accepts slightly-stale access tokens, so the
+   *     caller's downstream RPC will succeed against grace while
+   *     the in-flight refresh resolves out of band. Distinct from
+   *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+   *     the same in-flight promise — when that promise hung (iOS
+   *     NSURLSession cold-launch contention) every caller hung too.
+   *  3. Expired + no inflight + refresh available + not in cooldown →
+   *     fire refresh, await it.
+   *  4. Expired + in cooldown → return stale cached. Caller's RPC
+   *     either succeeds against grace or fails fast on 401, which is
+   *     a better UX than blocking the whole bridge waiting on a
+   *     network that we already know is stalled.
+   *
+   * Returns null only when there's NO usable token at all (no cached
+   * + no refresh available).
    */
   async getAccessToken() {
     if (!this.accessToken) return null;
     if (this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
       return this.accessToken;
     }
+    if (this.refreshInflight) {
+      return this.accessToken;
+    }
+    if (Date.now() < this.refreshCooldownUntil) {
+      return this.accessToken;
+    }
     return this.refreshAccessToken();
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -698,6 +802,7 @@ var Auth = class {
       if (err) throw new AuthError("SSO_FAILED", decodeURIComponent(err));
       const refresh = params.get("sendora_oidc_token") ?? params.get("sendora_saml_token");
       if (!refresh) throw new AuthError("SSO_NO_TOKEN", "Callback URL has no SSO token");
+      const retiredAnonUserId = params.get("sendora_retired_anon");
       const res = await post(
         { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
         "/api/v1/auth-service/token/refresh",
@@ -726,7 +831,8 @@ var Auth = class {
           refreshToken: newRefresh,
           expiresIn,
           tokenType: "Bearer"
-        }
+        },
+        ...retiredAnonUserId ? { retiredAnonUserId } : {}
       });
       return user;
     });
@@ -802,6 +908,8 @@ var Auth = class {
             if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
+              this.refreshFailureCount = 0;
+              this.refreshCooldownUntil = 0;
               return freshAccess;
             }
           }
@@ -814,11 +922,19 @@ var Auth = class {
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        this.refreshFailureCount = 0;
+        this.refreshCooldownUntil = 0;
         return data.tokens.accessToken;
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           await this.wipeLocalIdentity().catch(() => void 0);
+          this.refreshFailureCount = 0;
+          this.refreshCooldownUntil = 0;
+          return null;
         }
+        this.refreshFailureCount += 1;
+        const backoffMs = Math.min(3e4, 1e3 * Math.pow(2, this.refreshFailureCount - 1));
+        this.refreshCooldownUntil = Date.now() + backoffMs;
         return null;
       } finally {
         this.refreshInflight = null;
@@ -826,6 +942,20 @@ var Auth = class {
     })();
     return this.refreshInflight;
   }
+  /**
+   * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+   * who backgrounded the app during a network blip + returns now
+   * gets an immediate fresh refresh attempt instead of waiting on
+   * the cooldown timer.
+   *
+   * Called from the AppState 'active' listener registered in
+   * startProactiveRefreshCron. Idempotent + cheap — three field
+   * writes; no I/O.
+   */
+  resetRefreshState() {
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+  }
   startProactiveRefreshCron() {
     if (this.proactiveRefreshTimer) return;
     const PROACTIVE_TARGET_PCT = 0.8;
@@ -847,7 +977,10 @@ var Auth = class {
     }, TICK_MS);
     try {
       const subscription = RnAppState?.addEventListener?.("change", (state) => {
-        if (state === "active") void tick();
+        if (state === "active") {
+          this.resetRefreshState();
+          void tick();
+        }
       });
       if (subscription) {
         this.proactiveRefreshAppStateUnsub = () => subscription.remove();
@@ -967,11 +1100,15 @@ var Auth = class {
     this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
     this.hooks.onIdentityChange(data.user.id);
     this.startProactiveRefreshCron();
+    if (data.retiredAnonUserId) {
+      this.fireDeviceTakeover(data.retiredAnonUserId, data.user.id);
+    }
   }
   async wipeLocalIdentity() {
     this.user = null;
     this.accessToken = null;
     this.accessExpiresAt = 0;
+    this.lastTakeover = null;
     this.hooks.storage.remove(USER_KEY);
     this.hooks.storage.remove(TOKEN_KEY);
     this.hooks.storage.remove(TOKEN_EXPIRES_KEY);
@@ -1283,11 +1420,13 @@ async function getPlayInstallReferrer() {
 }
 var PREWARM_TTL_MS = 5 * 6e4;
 var PREWARM_MAX = 50;
+var PREWARM_MAX_INFLIGHT = 5;
 var Links = class {
   constructor(deps) {
     this.deps = deps;
     this.listeners = [];
     this.prewarmCache = /* @__PURE__ */ new Map();
+    this.prewarmInflight = 0;
     this.linkingSub = null;
   }
   /** Register a callback for warm + deferred deep-link opens. Returns
@@ -1335,14 +1474,25 @@ var Links = class {
    *
    * Fire-and-forget. Errors are swallowed; the matching `create()` call
    * will surface them on demand instead.
+   *
+   * Wave 28 — silently drops the call when more than
+   * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+   * fire-and-forget by contract; an overflow `prewarm()` is fine to
+   * skip because the next matching `create()` will simply do the mint
+   * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+   * in a FlatList renderItem).
    */
   prewarm(input, opts) {
     this.evictExpired();
     const key = this.cacheKey(input, opts?.key);
     if (this.prewarmCache.has(key)) return;
+    if (this.prewarmInflight >= PREWARM_MAX_INFLIGHT) return;
+    this.prewarmInflight++;
     const promise = this.doCreate(input).catch((err) => {
       this.prewarmCache.delete(key);
       throw err;
+    }).finally(() => {
+      this.prewarmInflight--;
     });
     this.prewarmCache.set(key, { promise, ts: Date.now() });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth, deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push token registration requires a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",