@sendoracloud/sdk-react-native 1.0.5 → 1.1.0

package/dist/index.cjs

@@ -136,16 +136,36 @@ var Storage = class {
 };
 
 // src/http.ts
-async function post(opts, path, body, extraHeaders) {
-  return request(opts, "POST", path, body, extraHeaders);
+var NetworkTimeoutError = class extends Error {
+  constructor(method, path, timeoutMs) {
+    super(`Request timed out: ${method} ${path} (${timeoutMs}ms)`);
+    this.name = "NetworkTimeoutError";
+    this.method = method;
+    this.path = path;
+    this.timeoutMs = timeoutMs;
+  }
+};
+var DEFAULT_AUTH_TIMEOUT_MS = 1e4;
+var DEFAULT_INGEST_TIMEOUT_MS = 3e4;
+function defaultTimeoutFor(path) {
+  if (path.startsWith("/api/v1/auth-service/")) return DEFAULT_AUTH_TIMEOUT_MS;
+  return DEFAULT_INGEST_TIMEOUT_MS;
+}
+async function post(opts, path, body, extraHeaders, reqOpts) {
+  return request(opts, "POST", path, body, extraHeaders, reqOpts);
 }
-async function getJson(opts, path, extraHeaders) {
-  return request(opts, "GET", path, void 0, extraHeaders);
+async function getJson(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "GET", path, void 0, extraHeaders, reqOpts);
 }
-async function del(opts, path, extraHeaders) {
-  return request(opts, "DELETE", path, void 0, extraHeaders);
+async function del(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "DELETE", path, void 0, extraHeaders, reqOpts);
 }
-async function request(opts, method, path, body, extraHeaders) {
+async function request(opts, method, path, body, extraHeaders, reqOpts) {
+  const timeoutMs = reqOpts?.timeoutMs ?? defaultTimeoutFor(path);
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
   let res;
   try {
     res = await fetch(`${opts.apiUrl}${path}`, {
@@ -160,15 +180,20 @@ async function request(opts, method, path, body, extraHeaders) {
         "x-api-key": opts.publicKey,
         ...extraHeaders ?? {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: controller.signal
     });
   } catch (err) {
+    clearTimeout(timer);
+    const aborted = err?.name === "AbortError";
+    if (aborted) throw new NetworkTimeoutError(method, path, timeoutMs);
     console.warn(
       `[sendoracloud] ${method} ${path} failed at the network layer:`,
       err instanceof Error ? err.message : String(err)
     );
     return null;
   }
+  clearTimeout(timer);
   if (!res.ok) {
     const isAuthPath = path.startsWith("/api/v1/auth-service/");
     if (isAuthPath && !opts.debug) {
@@ -237,6 +262,19 @@ var Auth = class {
     this.accessExpiresAt = 0;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
     this.takeoverListeners = /* @__PURE__ */ new Set();
     this.lastTakeover = null;
     /**
@@ -343,15 +381,38 @@ var Auth = class {
     }
   }
   /**
-   * Returns a non-expired access token or null. If the cached token
-   * is expired but a refresh token exists, transparently refreshes
-   * (single-flight — concurrent callers share one network call).
+   * Returns an access token or null. Cold-launch hardening (Wave 62):
+   *
+   *  1. Non-expired cached → return it. (Fast path.)
+   *  2. Expired AND refresh inflight → return stale cached anyway.
+   *     Backend grace window (60s — see auth-service refresh-rotation
+   *     middleware) accepts slightly-stale access tokens, so the
+   *     caller's downstream RPC will succeed against grace while
+   *     the in-flight refresh resolves out of band. Distinct from
+   *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+   *     the same in-flight promise — when that promise hung (iOS
+   *     NSURLSession cold-launch contention) every caller hung too.
+   *  3. Expired + no inflight + refresh available + not in cooldown →
+   *     fire refresh, await it.
+   *  4. Expired + in cooldown → return stale cached. Caller's RPC
+   *     either succeeds against grace or fails fast on 401, which is
+   *     a better UX than blocking the whole bridge waiting on a
+   *     network that we already know is stalled.
+   *
+   * Returns null only when there's NO usable token at all (no cached
+   * + no refresh available).
    */
   async getAccessToken() {
     if (!this.accessToken) return null;
     if (this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
       return this.accessToken;
     }
+    if (this.refreshInflight) {
+      return this.accessToken;
+    }
+    if (Date.now() < this.refreshCooldownUntil) {
+      return this.accessToken;
+    }
     return this.refreshAccessToken();
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -890,6 +951,8 @@ var Auth = class {
             if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
+              this.refreshFailureCount = 0;
+              this.refreshCooldownUntil = 0;
               return freshAccess;
             }
           }
@@ -902,11 +965,19 @@ var Auth = class {
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        this.refreshFailureCount = 0;
+        this.refreshCooldownUntil = 0;
         return data.tokens.accessToken;
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           await this.wipeLocalIdentity().catch(() => void 0);
+          this.refreshFailureCount = 0;
+          this.refreshCooldownUntil = 0;
+          return null;
         }
+        this.refreshFailureCount += 1;
+        const backoffMs = Math.min(3e4, 1e3 * Math.pow(2, this.refreshFailureCount - 1));
+        this.refreshCooldownUntil = Date.now() + backoffMs;
         return null;
       } finally {
         this.refreshInflight = null;
@@ -914,6 +985,20 @@ var Auth = class {
     })();
     return this.refreshInflight;
   }
+  /**
+   * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+   * who backgrounded the app during a network blip + returns now
+   * gets an immediate fresh refresh attempt instead of waiting on
+   * the cooldown timer.
+   *
+   * Called from the AppState 'active' listener registered in
+   * startProactiveRefreshCron. Idempotent + cheap — three field
+   * writes; no I/O.
+   */
+  resetRefreshState() {
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+  }
   startProactiveRefreshCron() {
     if (this.proactiveRefreshTimer) return;
     const PROACTIVE_TARGET_PCT = 0.8;
@@ -935,7 +1020,10 @@ var Auth = class {
     }, TICK_MS);
     try {
       const subscription = import_react_native.AppState?.addEventListener?.("change", (state) => {
-        if (state === "active") void tick();
+        if (state === "active") {
+          this.resetRefreshState();
+          void tick();
+        }
       });
       if (subscription) {
         this.proactiveRefreshAppStateUnsub = () => subscription.remove();
@@ -1370,11 +1458,13 @@ async function getPlayInstallReferrer() {
 }
 var PREWARM_TTL_MS = 5 * 6e4;
 var PREWARM_MAX = 50;
+var PREWARM_MAX_INFLIGHT = 5;
 var Links = class {
   constructor(deps) {
     this.deps = deps;
     this.listeners = [];
     this.prewarmCache = /* @__PURE__ */ new Map();
+    this.prewarmInflight = 0;
     this.linkingSub = null;
   }
   /** Register a callback for warm + deferred deep-link opens. Returns
@@ -1422,14 +1512,25 @@ var Links = class {
    *
    * Fire-and-forget. Errors are swallowed; the matching `create()` call
    * will surface them on demand instead.
+   *
+   * Wave 28 — silently drops the call when more than
+   * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+   * fire-and-forget by contract; an overflow `prewarm()` is fine to
+   * skip because the next matching `create()` will simply do the mint
+   * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+   * in a FlatList renderItem).
    */
   prewarm(input, opts) {
     this.evictExpired();
     const key = this.cacheKey(input, opts?.key);
     if (this.prewarmCache.has(key)) return;
+    if (this.prewarmInflight >= PREWARM_MAX_INFLIGHT) return;
+    this.prewarmInflight++;
     const promise = this.doCreate(input).catch((err) => {
       this.prewarmCache.delete(key);
       throw err;
+    }).finally(() => {
+      this.prewarmInflight--;
     });
     this.prewarmCache.set(key, { promise, ts: Date.now() });
   }

package/dist/index.d.cts

@@ -119,6 +119,19 @@ declare class Auth {
     private accessExpiresAt;
     private inflight;
     private refreshInflight;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    private refreshFailureCount;
+    private refreshCooldownUntil;
     private takeoverListeners;
     private lastTakeover;
     /**
@@ -182,9 +195,26 @@ declare class Auth {
     /** Internal — fan out to subscribers + cache the latest. */
     private fireDeviceTakeover;
     /**
-     * Returns a non-expired access token or null. If the cached token
-     * is expired but a refresh token exists, transparently refreshes
-     * (single-flight — concurrent callers share one network call).
+     * Returns an access token or null. Cold-launch hardening (Wave 62):
+     *
+     *  1. Non-expired cached → return it. (Fast path.)
+     *  2. Expired AND refresh inflight → return stale cached anyway.
+     *     Backend grace window (60s — see auth-service refresh-rotation
+     *     middleware) accepts slightly-stale access tokens, so the
+     *     caller's downstream RPC will succeed against grace while
+     *     the in-flight refresh resolves out of band. Distinct from
+     *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+     *     the same in-flight promise — when that promise hung (iOS
+     *     NSURLSession cold-launch contention) every caller hung too.
+     *  3. Expired + no inflight + refresh available + not in cooldown →
+     *     fire refresh, await it.
+     *  4. Expired + in cooldown → return stale cached. Caller's RPC
+     *     either succeeds against grace or fails fast on 401, which is
+     *     a better UX than blocking the whole bridge waiting on a
+     *     network that we already know is stalled.
+     *
+     * Returns null only when there's NO usable token at all (no cached
+     * + no refresh available).
      */
     getAccessToken(): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -359,6 +389,17 @@ declare class Auth {
      * surface NOT_SIGNED_IN to the host app instead of looping.
      */
     private refreshAccessToken;
+    /**
+     * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+     * who backgrounded the app during a network blip + returns now
+     * gets an immediate fresh refresh attempt instead of waiting on
+     * the cooldown timer.
+     *
+     * Called from the AppState 'active' listener registered in
+     * startProactiveRefreshCron. Idempotent + cheap — three field
+     * writes; no I/O.
+     */
+    private resetRefreshState;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -574,6 +615,7 @@ declare class Links {
     private deps;
     private listeners;
     private prewarmCache;
+    private prewarmInflight;
     private linkingSub;
     constructor(deps: LinksDeps);
     /** Register a callback for warm + deferred deep-link opens. Returns
@@ -589,6 +631,13 @@ declare class Links {
      *
      * Fire-and-forget. Errors are swallowed; the matching `create()` call
      * will surface them on demand instead.
+     *
+     * Wave 28 — silently drops the call when more than
+     * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+     * fire-and-forget by contract; an overflow `prewarm()` is fine to
+     * skip because the next matching `create()` will simply do the mint
+     * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+     * in a FlatList renderItem).
      */
     prewarm<T extends LinkData = LinkData>(input: LinkCreateInput<T>, opts?: {
         key?: string;

package/dist/index.d.ts

@@ -119,6 +119,19 @@ declare class Auth {
     private accessExpiresAt;
     private inflight;
     private refreshInflight;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    private refreshFailureCount;
+    private refreshCooldownUntil;
     private takeoverListeners;
     private lastTakeover;
     /**
@@ -182,9 +195,26 @@ declare class Auth {
     /** Internal — fan out to subscribers + cache the latest. */
     private fireDeviceTakeover;
     /**
-     * Returns a non-expired access token or null. If the cached token
-     * is expired but a refresh token exists, transparently refreshes
-     * (single-flight — concurrent callers share one network call).
+     * Returns an access token or null. Cold-launch hardening (Wave 62):
+     *
+     *  1. Non-expired cached → return it. (Fast path.)
+     *  2. Expired AND refresh inflight → return stale cached anyway.
+     *     Backend grace window (60s — see auth-service refresh-rotation
+     *     middleware) accepts slightly-stale access tokens, so the
+     *     caller's downstream RPC will succeed against grace while
+     *     the in-flight refresh resolves out of band. Distinct from
+     *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+     *     the same in-flight promise — when that promise hung (iOS
+     *     NSURLSession cold-launch contention) every caller hung too.
+     *  3. Expired + no inflight + refresh available + not in cooldown →
+     *     fire refresh, await it.
+     *  4. Expired + in cooldown → return stale cached. Caller's RPC
+     *     either succeeds against grace or fails fast on 401, which is
+     *     a better UX than blocking the whole bridge waiting on a
+     *     network that we already know is stalled.
+     *
+     * Returns null only when there's NO usable token at all (no cached
+     * + no refresh available).
      */
     getAccessToken(): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -359,6 +389,17 @@ declare class Auth {
      * surface NOT_SIGNED_IN to the host app instead of looping.
      */
     private refreshAccessToken;
+    /**
+     * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+     * who backgrounded the app during a network blip + returns now
+     * gets an immediate fresh refresh attempt instead of waiting on
+     * the cooldown timer.
+     *
+     * Called from the AppState 'active' listener registered in
+     * startProactiveRefreshCron. Idempotent + cheap — three field
+     * writes; no I/O.
+     */
+    private resetRefreshState;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -574,6 +615,7 @@ declare class Links {
     private deps;
     private listeners;
     private prewarmCache;
+    private prewarmInflight;
     private linkingSub;
     constructor(deps: LinksDeps);
     /** Register a callback for warm + deferred deep-link opens. Returns
@@ -589,6 +631,13 @@ declare class Links {
      *
      * Fire-and-forget. Errors are swallowed; the matching `create()` call
      * will surface them on demand instead.
+     *
+     * Wave 28 — silently drops the call when more than
+     * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+     * fire-and-forget by contract; an overflow `prewarm()` is fine to
+     * skip because the next matching `create()` will simply do the mint
+     * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+     * in a FlatList renderItem).
      */
     prewarm<T extends LinkData = LinkData>(input: LinkCreateInput<T>, opts?: {
         key?: string;

package/dist/index.js

@@ -93,16 +93,36 @@ var Storage = class {
 };
 
 // src/http.ts
-async function post(opts, path, body, extraHeaders) {
-  return request(opts, "POST", path, body, extraHeaders);
+var NetworkTimeoutError = class extends Error {
+  constructor(method, path, timeoutMs) {
+    super(`Request timed out: ${method} ${path} (${timeoutMs}ms)`);
+    this.name = "NetworkTimeoutError";
+    this.method = method;
+    this.path = path;
+    this.timeoutMs = timeoutMs;
+  }
+};
+var DEFAULT_AUTH_TIMEOUT_MS = 1e4;
+var DEFAULT_INGEST_TIMEOUT_MS = 3e4;
+function defaultTimeoutFor(path) {
+  if (path.startsWith("/api/v1/auth-service/")) return DEFAULT_AUTH_TIMEOUT_MS;
+  return DEFAULT_INGEST_TIMEOUT_MS;
+}
+async function post(opts, path, body, extraHeaders, reqOpts) {
+  return request(opts, "POST", path, body, extraHeaders, reqOpts);
 }
-async function getJson(opts, path, extraHeaders) {
-  return request(opts, "GET", path, void 0, extraHeaders);
+async function getJson(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "GET", path, void 0, extraHeaders, reqOpts);
 }
-async function del(opts, path, extraHeaders) {
-  return request(opts, "DELETE", path, void 0, extraHeaders);
+async function del(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "DELETE", path, void 0, extraHeaders, reqOpts);
 }
-async function request(opts, method, path, body, extraHeaders) {
+async function request(opts, method, path, body, extraHeaders, reqOpts) {
+  const timeoutMs = reqOpts?.timeoutMs ?? defaultTimeoutFor(path);
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
   let res;
   try {
     res = await fetch(`${opts.apiUrl}${path}`, {
@@ -117,15 +137,20 @@ async function request(opts, method, path, body, extraHeaders) {
         "x-api-key": opts.publicKey,
         ...extraHeaders ?? {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: controller.signal
     });
   } catch (err) {
+    clearTimeout(timer);
+    const aborted = err?.name === "AbortError";
+    if (aborted) throw new NetworkTimeoutError(method, path, timeoutMs);
     console.warn(
       `[sendoracloud] ${method} ${path} failed at the network layer:`,
       err instanceof Error ? err.message : String(err)
     );
     return null;
   }
+  clearTimeout(timer);
   if (!res.ok) {
     const isAuthPath = path.startsWith("/api/v1/auth-service/");
     if (isAuthPath && !opts.debug) {
@@ -194,6 +219,19 @@ var Auth = class {
     this.accessExpiresAt = 0;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
     this.takeoverListeners = /* @__PURE__ */ new Set();
     this.lastTakeover = null;
     /**
@@ -300,15 +338,38 @@ var Auth = class {
     }
   }
   /**
-   * Returns a non-expired access token or null. If the cached token
-   * is expired but a refresh token exists, transparently refreshes
-   * (single-flight — concurrent callers share one network call).
+   * Returns an access token or null. Cold-launch hardening (Wave 62):
+   *
+   *  1. Non-expired cached → return it. (Fast path.)
+   *  2. Expired AND refresh inflight → return stale cached anyway.
+   *     Backend grace window (60s — see auth-service refresh-rotation
+   *     middleware) accepts slightly-stale access tokens, so the
+   *     caller's downstream RPC will succeed against grace while
+   *     the in-flight refresh resolves out of band. Distinct from
+   *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+   *     the same in-flight promise — when that promise hung (iOS
+   *     NSURLSession cold-launch contention) every caller hung too.
+   *  3. Expired + no inflight + refresh available + not in cooldown →
+   *     fire refresh, await it.
+   *  4. Expired + in cooldown → return stale cached. Caller's RPC
+   *     either succeeds against grace or fails fast on 401, which is
+   *     a better UX than blocking the whole bridge waiting on a
+   *     network that we already know is stalled.
+   *
+   * Returns null only when there's NO usable token at all (no cached
+   * + no refresh available).
    */
   async getAccessToken() {
     if (!this.accessToken) return null;
     if (this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
       return this.accessToken;
     }
+    if (this.refreshInflight) {
+      return this.accessToken;
+    }
+    if (Date.now() < this.refreshCooldownUntil) {
+      return this.accessToken;
+    }
     return this.refreshAccessToken();
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -847,6 +908,8 @@ var Auth = class {
             if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
+              this.refreshFailureCount = 0;
+              this.refreshCooldownUntil = 0;
               return freshAccess;
             }
           }
@@ -859,11 +922,19 @@ var Auth = class {
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        this.refreshFailureCount = 0;
+        this.refreshCooldownUntil = 0;
         return data.tokens.accessToken;
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           await this.wipeLocalIdentity().catch(() => void 0);
+          this.refreshFailureCount = 0;
+          this.refreshCooldownUntil = 0;
+          return null;
         }
+        this.refreshFailureCount += 1;
+        const backoffMs = Math.min(3e4, 1e3 * Math.pow(2, this.refreshFailureCount - 1));
+        this.refreshCooldownUntil = Date.now() + backoffMs;
         return null;
       } finally {
         this.refreshInflight = null;
@@ -871,6 +942,20 @@ var Auth = class {
     })();
     return this.refreshInflight;
   }
+  /**
+   * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+   * who backgrounded the app during a network blip + returns now
+   * gets an immediate fresh refresh attempt instead of waiting on
+   * the cooldown timer.
+   *
+   * Called from the AppState 'active' listener registered in
+   * startProactiveRefreshCron. Idempotent + cheap — three field
+   * writes; no I/O.
+   */
+  resetRefreshState() {
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+  }
   startProactiveRefreshCron() {
     if (this.proactiveRefreshTimer) return;
     const PROACTIVE_TARGET_PCT = 0.8;
@@ -892,7 +977,10 @@ var Auth = class {
     }, TICK_MS);
     try {
       const subscription = RnAppState?.addEventListener?.("change", (state) => {
-        if (state === "active") void tick();
+        if (state === "active") {
+          this.resetRefreshState();
+          void tick();
+        }
       });
       if (subscription) {
         this.proactiveRefreshAppStateUnsub = () => subscription.remove();
@@ -1332,11 +1420,13 @@ async function getPlayInstallReferrer() {
 }
 var PREWARM_TTL_MS = 5 * 6e4;
 var PREWARM_MAX = 50;
+var PREWARM_MAX_INFLIGHT = 5;
 var Links = class {
   constructor(deps) {
     this.deps = deps;
     this.listeners = [];
     this.prewarmCache = /* @__PURE__ */ new Map();
+    this.prewarmInflight = 0;
     this.linkingSub = null;
   }
   /** Register a callback for warm + deferred deep-link opens. Returns
@@ -1384,14 +1474,25 @@ var Links = class {
    *
    * Fire-and-forget. Errors are swallowed; the matching `create()` call
    * will surface them on demand instead.
+   *
+   * Wave 28 — silently drops the call when more than
+   * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+   * fire-and-forget by contract; an overflow `prewarm()` is fine to
+   * skip because the next matching `create()` will simply do the mint
+   * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+   * in a FlatList renderItem).
    */
   prewarm(input, opts) {
     this.evictExpired();
     const key = this.cacheKey(input, opts?.key);
     if (this.prewarmCache.has(key)) return;
+    if (this.prewarmInflight >= PREWARM_MAX_INFLIGHT) return;
+    this.prewarmInflight++;
     const promise = this.doCreate(input).catch((err) => {
       this.prewarmCache.delete(key);
       throw err;
+    }).finally(() => {
+      this.prewarmInflight--;
     });
     this.prewarmCache.set(key, { promise, ts: Date.now() });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.0.5",
+  "version": "1.1.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth, deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push token registration requires a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",