@sendoracloud/sdk-react-native 1.0.5 → 1.2.0

package/dist/contact-widget.cjs

@@ -0,0 +1,127 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/contact-widget.tsx
+var contact_widget_exports = {};
+__export(contact_widget_exports, {
+  ContactWidget: () => ContactWidget,
+  useContactWidget: () => useContactWidget
+});
+module.exports = __toCommonJS(contact_widget_exports);
+var React = __toESM(require("react"), 1);
+var import_react_native = require("react-native");
+var import_react_native_webview = require("react-native-webview");
+var import_jsx_runtime = require("react/jsx-runtime");
+function ContactWidget({
+  visible,
+  widgetId,
+  workerHost = "https://go.sendoracloud.com",
+  theme = "auto",
+  prefillName,
+  prefillEmail,
+  onClose
+}) {
+  const didFire = React.useRef(false);
+  React.useEffect(() => {
+    if (visible) didFire.current = false;
+  }, [visible]);
+  if (!widgetId) return null;
+  const params = new URLSearchParams({ widgetId, theme });
+  if (prefillName) params.set("prefillName", prefillName);
+  if (prefillEmail) params.set("prefillEmail", prefillEmail);
+  const uri = `${workerHost}/embed/contact?${params.toString()}`;
+  const handleClose = (result) => {
+    if (didFire.current) return;
+    didFire.current = true;
+    onClose(result);
+  };
+  const onNav = (req) => {
+    const url = req.url || "";
+    if (url.startsWith("sendora://close")) {
+      const queryStart = url.indexOf("?");
+      const params2 = queryStart >= 0 ? new URLSearchParams(url.slice(queryStart + 1)) : new URLSearchParams();
+      const ticketId = params2.get("ticketId") || "";
+      const portalUrl = params2.get("portalUrl") || null;
+      handleClose({ ticketId, portalUrl, submitted: ticketId !== "" });
+      return false;
+    }
+    if (!url.startsWith("https://") && !url.startsWith("about:")) {
+      return false;
+    }
+    return true;
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+    import_react_native.Modal,
+    {
+      visible,
+      animationType: "slide",
+      presentationStyle: "pageSheet",
+      onRequestClose: () => handleClose({ ticketId: "", portalUrl: null, submitted: false }),
+      children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native.View, { style: { flex: 1 }, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        import_react_native_webview.WebView,
+        {
+          source: { uri },
+          onShouldStartLoadWithRequest: onNav,
+          originWhitelist: ["https://*", "about:*", "sendora://*"],
+          setSupportMultipleWindows: false,
+          javaScriptEnabled: true,
+          domStorageEnabled: true,
+          allowsBackForwardNavigationGestures: false
+        }
+      ) })
+    }
+  );
+}
+function useContactWidget(widgetId, defaults) {
+  const [visible, setVisible] = React.useState(false);
+  const [lastResult, setLastResult] = React.useState(null);
+  const open = React.useCallback(() => setVisible(true), []);
+  const close = React.useCallback(() => setVisible(false), []);
+  const View2 = React.useCallback(
+    () => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      ContactWidget,
+      {
+        ...defaults,
+        widgetId,
+        visible,
+        onClose: (r) => {
+          setLastResult(r);
+          setVisible(false);
+        }
+      }
+    ),
+    [defaults, widgetId, visible]
+  );
+  return { open, close, View: View2, lastResult };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ContactWidget,
+  useContactWidget
+});

package/dist/contact-widget.d.cts

@@ -0,0 +1,70 @@
+import * as React from 'react';
+export { WebViewMessageEvent } from 'react-native-webview';
+
+/**
+ * Wave 66 — ContactWidget for React Native apps.
+ *
+ * Renders the worker-hosted embed at
+ * `https://go.sendoracloud.com/embed/contact?widgetId=…` inside a
+ * `<WebView>` from `react-native-webview`. The form posts to
+ * `POST /widgets/:id/submit` server-side.
+ *
+ * On submit success the embed page navigates to
+ * `sendora://close?ticketId=…&portalUrl=…`. WebView's
+ * `onShouldStartLoadWithRequest` catches the scheme + fires
+ * `onClose(result)` so the host can hide the modal.
+ *
+ * Single source of truth = the worker route. UI updates = redeploy
+ * worker. Zero SDK release.
+ *
+ * Import from subpath so customers without react-native-webview can
+ * still use the main SDK without Metro choking on a missing dep:
+ *
+ *   import { ContactWidget } from "@sendoracloud/sdk-react-native/contact-widget";
+ */
+
+interface ContactWidgetResult {
+    /** UUID of the ticket created server-side, or empty if user closed without submitting. */
+    ticketId: string;
+    /** Operator's tracking-portal URL string, or null. */
+    portalUrl: string | null;
+    /** True if the user submitted the form; false if they closed without submitting. */
+    submitted: boolean;
+}
+interface ContactWidgetProps {
+    /** Whether the modal sheet is visible. */
+    visible: boolean;
+    /** UUID of the widget configured in the Sendora dashboard. */
+    widgetId: string;
+    /** Worker host. Defaults to production. */
+    workerHost?: string;
+    /** `"auto"` | `"light"` | `"dark"`. Default `"auto"`. */
+    theme?: "auto" | "light" | "dark";
+    /** Pre-fill name field for signed-in users. */
+    prefillName?: string;
+    /** Pre-fill email field for signed-in users. */
+    prefillEmail?: string;
+    /**
+     * Fired when the user closes the sheet — either after a successful
+     * submit (`submitted = true`) or via the close button
+     * (`submitted = false`). Host should set `visible = false` here.
+     */
+    onClose: (result: ContactWidgetResult) => void;
+}
+declare function ContactWidget({ visible, widgetId, workerHost, theme, prefillName, prefillEmail, onClose, }: ContactWidgetProps): React.ReactElement | null;
+/**
+ * Helper hook so the host doesn't have to wire visibility state by
+ * hand.
+ *
+ *   const contact = useContactWidget("widget-uuid");
+ *   <Button onPress={contact.open} title="Contact us" />
+ *   <contact.View />
+ */
+declare function useContactWidget(widgetId: string, defaults?: Omit<ContactWidgetProps, "visible" | "widgetId" | "onClose">): {
+    open: () => void;
+    close: () => void;
+    View: () => React.ReactElement | null;
+    lastResult: ContactWidgetResult | null;
+};
+
+export { ContactWidget, type ContactWidgetProps, type ContactWidgetResult, useContactWidget };

package/dist/contact-widget.d.ts

@@ -0,0 +1,70 @@
+import * as React from 'react';
+export { WebViewMessageEvent } from 'react-native-webview';
+
+/**
+ * Wave 66 — ContactWidget for React Native apps.
+ *
+ * Renders the worker-hosted embed at
+ * `https://go.sendoracloud.com/embed/contact?widgetId=…` inside a
+ * `<WebView>` from `react-native-webview`. The form posts to
+ * `POST /widgets/:id/submit` server-side.
+ *
+ * On submit success the embed page navigates to
+ * `sendora://close?ticketId=…&portalUrl=…`. WebView's
+ * `onShouldStartLoadWithRequest` catches the scheme + fires
+ * `onClose(result)` so the host can hide the modal.
+ *
+ * Single source of truth = the worker route. UI updates = redeploy
+ * worker. Zero SDK release.
+ *
+ * Import from subpath so customers without react-native-webview can
+ * still use the main SDK without Metro choking on a missing dep:
+ *
+ *   import { ContactWidget } from "@sendoracloud/sdk-react-native/contact-widget";
+ */
+
+interface ContactWidgetResult {
+    /** UUID of the ticket created server-side, or empty if user closed without submitting. */
+    ticketId: string;
+    /** Operator's tracking-portal URL string, or null. */
+    portalUrl: string | null;
+    /** True if the user submitted the form; false if they closed without submitting. */
+    submitted: boolean;
+}
+interface ContactWidgetProps {
+    /** Whether the modal sheet is visible. */
+    visible: boolean;
+    /** UUID of the widget configured in the Sendora dashboard. */
+    widgetId: string;
+    /** Worker host. Defaults to production. */
+    workerHost?: string;
+    /** `"auto"` | `"light"` | `"dark"`. Default `"auto"`. */
+    theme?: "auto" | "light" | "dark";
+    /** Pre-fill name field for signed-in users. */
+    prefillName?: string;
+    /** Pre-fill email field for signed-in users. */
+    prefillEmail?: string;
+    /**
+     * Fired when the user closes the sheet — either after a successful
+     * submit (`submitted = true`) or via the close button
+     * (`submitted = false`). Host should set `visible = false` here.
+     */
+    onClose: (result: ContactWidgetResult) => void;
+}
+declare function ContactWidget({ visible, widgetId, workerHost, theme, prefillName, prefillEmail, onClose, }: ContactWidgetProps): React.ReactElement | null;
+/**
+ * Helper hook so the host doesn't have to wire visibility state by
+ * hand.
+ *
+ *   const contact = useContactWidget("widget-uuid");
+ *   <Button onPress={contact.open} title="Contact us" />
+ *   <contact.View />
+ */
+declare function useContactWidget(widgetId: string, defaults?: Omit<ContactWidgetProps, "visible" | "widgetId" | "onClose">): {
+    open: () => void;
+    close: () => void;
+    View: () => React.ReactElement | null;
+    lastResult: ContactWidgetResult | null;
+};
+
+export { ContactWidget, type ContactWidgetProps, type ContactWidgetResult, useContactWidget };

package/dist/contact-widget.js

@@ -0,0 +1,91 @@
+// src/contact-widget.tsx
+import * as React from "react";
+import { Modal, View } from "react-native";
+import { WebView } from "react-native-webview";
+import { jsx } from "react/jsx-runtime";
+function ContactWidget({
+  visible,
+  widgetId,
+  workerHost = "https://go.sendoracloud.com",
+  theme = "auto",
+  prefillName,
+  prefillEmail,
+  onClose
+}) {
+  const didFire = React.useRef(false);
+  React.useEffect(() => {
+    if (visible) didFire.current = false;
+  }, [visible]);
+  if (!widgetId) return null;
+  const params = new URLSearchParams({ widgetId, theme });
+  if (prefillName) params.set("prefillName", prefillName);
+  if (prefillEmail) params.set("prefillEmail", prefillEmail);
+  const uri = `${workerHost}/embed/contact?${params.toString()}`;
+  const handleClose = (result) => {
+    if (didFire.current) return;
+    didFire.current = true;
+    onClose(result);
+  };
+  const onNav = (req) => {
+    const url = req.url || "";
+    if (url.startsWith("sendora://close")) {
+      const queryStart = url.indexOf("?");
+      const params2 = queryStart >= 0 ? new URLSearchParams(url.slice(queryStart + 1)) : new URLSearchParams();
+      const ticketId = params2.get("ticketId") || "";
+      const portalUrl = params2.get("portalUrl") || null;
+      handleClose({ ticketId, portalUrl, submitted: ticketId !== "" });
+      return false;
+    }
+    if (!url.startsWith("https://") && !url.startsWith("about:")) {
+      return false;
+    }
+    return true;
+  };
+  return /* @__PURE__ */ jsx(
+    Modal,
+    {
+      visible,
+      animationType: "slide",
+      presentationStyle: "pageSheet",
+      onRequestClose: () => handleClose({ ticketId: "", portalUrl: null, submitted: false }),
+      children: /* @__PURE__ */ jsx(View, { style: { flex: 1 }, children: /* @__PURE__ */ jsx(
+        WebView,
+        {
+          source: { uri },
+          onShouldStartLoadWithRequest: onNav,
+          originWhitelist: ["https://*", "about:*", "sendora://*"],
+          setSupportMultipleWindows: false,
+          javaScriptEnabled: true,
+          domStorageEnabled: true,
+          allowsBackForwardNavigationGestures: false
+        }
+      ) })
+    }
+  );
+}
+function useContactWidget(widgetId, defaults) {
+  const [visible, setVisible] = React.useState(false);
+  const [lastResult, setLastResult] = React.useState(null);
+  const open = React.useCallback(() => setVisible(true), []);
+  const close = React.useCallback(() => setVisible(false), []);
+  const View2 = React.useCallback(
+    () => /* @__PURE__ */ jsx(
+      ContactWidget,
+      {
+        ...defaults,
+        widgetId,
+        visible,
+        onClose: (r) => {
+          setLastResult(r);
+          setVisible(false);
+        }
+      }
+    ),
+    [defaults, widgetId, visible]
+  );
+  return { open, close, View: View2, lastResult };
+}
+export {
+  ContactWidget,
+  useContactWidget
+};

package/dist/index.cjs

@@ -136,16 +136,36 @@ var Storage = class {
 };
 
 // src/http.ts
-async function post(opts, path, body, extraHeaders) {
-  return request(opts, "POST", path, body, extraHeaders);
+var NetworkTimeoutError = class extends Error {
+  constructor(method, path, timeoutMs) {
+    super(`Request timed out: ${method} ${path} (${timeoutMs}ms)`);
+    this.name = "NetworkTimeoutError";
+    this.method = method;
+    this.path = path;
+    this.timeoutMs = timeoutMs;
+  }
+};
+var DEFAULT_AUTH_TIMEOUT_MS = 1e4;
+var DEFAULT_INGEST_TIMEOUT_MS = 3e4;
+function defaultTimeoutFor(path) {
+  if (path.startsWith("/api/v1/auth-service/")) return DEFAULT_AUTH_TIMEOUT_MS;
+  return DEFAULT_INGEST_TIMEOUT_MS;
+}
+async function post(opts, path, body, extraHeaders, reqOpts) {
+  return request(opts, "POST", path, body, extraHeaders, reqOpts);
 }
-async function getJson(opts, path, extraHeaders) {
-  return request(opts, "GET", path, void 0, extraHeaders);
+async function getJson(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "GET", path, void 0, extraHeaders, reqOpts);
 }
-async function del(opts, path, extraHeaders) {
-  return request(opts, "DELETE", path, void 0, extraHeaders);
+async function del(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "DELETE", path, void 0, extraHeaders, reqOpts);
 }
-async function request(opts, method, path, body, extraHeaders) {
+async function request(opts, method, path, body, extraHeaders, reqOpts) {
+  const timeoutMs = reqOpts?.timeoutMs ?? defaultTimeoutFor(path);
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
   let res;
   try {
     res = await fetch(`${opts.apiUrl}${path}`, {
@@ -160,15 +180,20 @@ async function request(opts, method, path, body, extraHeaders) {
         "x-api-key": opts.publicKey,
         ...extraHeaders ?? {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: controller.signal
     });
   } catch (err) {
+    clearTimeout(timer);
+    const aborted = err?.name === "AbortError";
+    if (aborted) throw new NetworkTimeoutError(method, path, timeoutMs);
     console.warn(
       `[sendoracloud] ${method} ${path} failed at the network layer:`,
       err instanceof Error ? err.message : String(err)
     );
     return null;
   }
+  clearTimeout(timer);
   if (!res.ok) {
     const isAuthPath = path.startsWith("/api/v1/auth-service/");
     if (isAuthPath && !opts.debug) {
@@ -237,6 +262,19 @@ var Auth = class {
     this.accessExpiresAt = 0;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
     this.takeoverListeners = /* @__PURE__ */ new Set();
     this.lastTakeover = null;
     /**
@@ -343,15 +381,38 @@ var Auth = class {
     }
   }
   /**
-   * Returns a non-expired access token or null. If the cached token
-   * is expired but a refresh token exists, transparently refreshes
-   * (single-flight — concurrent callers share one network call).
+   * Returns an access token or null. Cold-launch hardening (Wave 62):
+   *
+   *  1. Non-expired cached → return it. (Fast path.)
+   *  2. Expired AND refresh inflight → return stale cached anyway.
+   *     Backend grace window (60s — see auth-service refresh-rotation
+   *     middleware) accepts slightly-stale access tokens, so the
+   *     caller's downstream RPC will succeed against grace while
+   *     the in-flight refresh resolves out of band. Distinct from
+   *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+   *     the same in-flight promise — when that promise hung (iOS
+   *     NSURLSession cold-launch contention) every caller hung too.
+   *  3. Expired + no inflight + refresh available + not in cooldown →
+   *     fire refresh, await it.
+   *  4. Expired + in cooldown → return stale cached. Caller's RPC
+   *     either succeeds against grace or fails fast on 401, which is
+   *     a better UX than blocking the whole bridge waiting on a
+   *     network that we already know is stalled.
+   *
+   * Returns null only when there's NO usable token at all (no cached
+   * + no refresh available).
    */
   async getAccessToken() {
     if (!this.accessToken) return null;
     if (this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
       return this.accessToken;
     }
+    if (this.refreshInflight) {
+      return this.accessToken;
+    }
+    if (Date.now() < this.refreshCooldownUntil) {
+      return this.accessToken;
+    }
     return this.refreshAccessToken();
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -890,6 +951,8 @@ var Auth = class {
             if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
+              this.refreshFailureCount = 0;
+              this.refreshCooldownUntil = 0;
               return freshAccess;
             }
           }
@@ -902,11 +965,19 @@ var Auth = class {
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        this.refreshFailureCount = 0;
+        this.refreshCooldownUntil = 0;
         return data.tokens.accessToken;
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           await this.wipeLocalIdentity().catch(() => void 0);
+          this.refreshFailureCount = 0;
+          this.refreshCooldownUntil = 0;
+          return null;
         }
+        this.refreshFailureCount += 1;
+        const backoffMs = Math.min(3e4, 1e3 * Math.pow(2, this.refreshFailureCount - 1));
+        this.refreshCooldownUntil = Date.now() + backoffMs;
         return null;
       } finally {
         this.refreshInflight = null;
@@ -914,6 +985,20 @@ var Auth = class {
     })();
     return this.refreshInflight;
   }
+  /**
+   * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+   * who backgrounded the app during a network blip + returns now
+   * gets an immediate fresh refresh attempt instead of waiting on
+   * the cooldown timer.
+   *
+   * Called from the AppState 'active' listener registered in
+   * startProactiveRefreshCron. Idempotent + cheap — three field
+   * writes; no I/O.
+   */
+  resetRefreshState() {
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+  }
   startProactiveRefreshCron() {
     if (this.proactiveRefreshTimer) return;
     const PROACTIVE_TARGET_PCT = 0.8;
@@ -935,7 +1020,10 @@ var Auth = class {
     }, TICK_MS);
     try {
       const subscription = import_react_native.AppState?.addEventListener?.("change", (state) => {
-        if (state === "active") void tick();
+        if (state === "active") {
+          this.resetRefreshState();
+          void tick();
+        }
       });
       if (subscription) {
         this.proactiveRefreshAppStateUnsub = () => subscription.remove();
@@ -1370,11 +1458,13 @@ async function getPlayInstallReferrer() {
 }
 var PREWARM_TTL_MS = 5 * 6e4;
 var PREWARM_MAX = 50;
+var PREWARM_MAX_INFLIGHT = 5;
 var Links = class {
   constructor(deps) {
     this.deps = deps;
     this.listeners = [];
     this.prewarmCache = /* @__PURE__ */ new Map();
+    this.prewarmInflight = 0;
     this.linkingSub = null;
   }
   /** Register a callback for warm + deferred deep-link opens. Returns
@@ -1422,14 +1512,25 @@ var Links = class {
    *
    * Fire-and-forget. Errors are swallowed; the matching `create()` call
    * will surface them on demand instead.
+   *
+   * Wave 28 — silently drops the call when more than
+   * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+   * fire-and-forget by contract; an overflow `prewarm()` is fine to
+   * skip because the next matching `create()` will simply do the mint
+   * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+   * in a FlatList renderItem).
    */
   prewarm(input, opts) {
     this.evictExpired();
     const key = this.cacheKey(input, opts?.key);
     if (this.prewarmCache.has(key)) return;
+    if (this.prewarmInflight >= PREWARM_MAX_INFLIGHT) return;
+    this.prewarmInflight++;
     const promise = this.doCreate(input).catch((err) => {
       this.prewarmCache.delete(key);
       throw err;
+    }).finally(() => {
+      this.prewarmInflight--;
     });
     this.prewarmCache.set(key, { promise, ts: Date.now() });
   }

package/dist/index.d.cts

@@ -119,6 +119,19 @@ declare class Auth {
     private accessExpiresAt;
     private inflight;
     private refreshInflight;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    private refreshFailureCount;
+    private refreshCooldownUntil;
     private takeoverListeners;
     private lastTakeover;
     /**
@@ -182,9 +195,26 @@ declare class Auth {
     /** Internal — fan out to subscribers + cache the latest. */
     private fireDeviceTakeover;
     /**
-     * Returns a non-expired access token or null. If the cached token
-     * is expired but a refresh token exists, transparently refreshes
-     * (single-flight — concurrent callers share one network call).
+     * Returns an access token or null. Cold-launch hardening (Wave 62):
+     *
+     *  1. Non-expired cached → return it. (Fast path.)
+     *  2. Expired AND refresh inflight → return stale cached anyway.
+     *     Backend grace window (60s — see auth-service refresh-rotation
+     *     middleware) accepts slightly-stale access tokens, so the
+     *     caller's downstream RPC will succeed against grace while
+     *     the in-flight refresh resolves out of band. Distinct from
+     *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+     *     the same in-flight promise — when that promise hung (iOS
+     *     NSURLSession cold-launch contention) every caller hung too.
+     *  3. Expired + no inflight + refresh available + not in cooldown →
+     *     fire refresh, await it.
+     *  4. Expired + in cooldown → return stale cached. Caller's RPC
+     *     either succeeds against grace or fails fast on 401, which is
+     *     a better UX than blocking the whole bridge waiting on a
+     *     network that we already know is stalled.
+     *
+     * Returns null only when there's NO usable token at all (no cached
+     * + no refresh available).
      */
     getAccessToken(): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -359,6 +389,17 @@ declare class Auth {
      * surface NOT_SIGNED_IN to the host app instead of looping.
      */
     private refreshAccessToken;
+    /**
+     * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+     * who backgrounded the app during a network blip + returns now
+     * gets an immediate fresh refresh attempt instead of waiting on
+     * the cooldown timer.
+     *
+     * Called from the AppState 'active' listener registered in
+     * startProactiveRefreshCron. Idempotent + cheap — three field
+     * writes; no I/O.
+     */
+    private resetRefreshState;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -574,6 +615,7 @@ declare class Links {
     private deps;
     private listeners;
     private prewarmCache;
+    private prewarmInflight;
     private linkingSub;
     constructor(deps: LinksDeps);
     /** Register a callback for warm + deferred deep-link opens. Returns
@@ -589,6 +631,13 @@ declare class Links {
      *
      * Fire-and-forget. Errors are swallowed; the matching `create()` call
      * will surface them on demand instead.
+     *
+     * Wave 28 — silently drops the call when more than
+     * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+     * fire-and-forget by contract; an overflow `prewarm()` is fine to
+     * skip because the next matching `create()` will simply do the mint
+     * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+     * in a FlatList renderItem).
      */
     prewarm<T extends LinkData = LinkData>(input: LinkCreateInput<T>, opts?: {
         key?: string;

package/dist/index.d.ts

@@ -119,6 +119,19 @@ declare class Auth {
     private accessExpiresAt;
     private inflight;
     private refreshInflight;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    private refreshFailureCount;
+    private refreshCooldownUntil;
     private takeoverListeners;
     private lastTakeover;
     /**
@@ -182,9 +195,26 @@ declare class Auth {
     /** Internal — fan out to subscribers + cache the latest. */
     private fireDeviceTakeover;
     /**
-     * Returns a non-expired access token or null. If the cached token
-     * is expired but a refresh token exists, transparently refreshes
-     * (single-flight — concurrent callers share one network call).
+     * Returns an access token or null. Cold-launch hardening (Wave 62):
+     *
+     *  1. Non-expired cached → return it. (Fast path.)
+     *  2. Expired AND refresh inflight → return stale cached anyway.
+     *     Backend grace window (60s — see auth-service refresh-rotation
+     *     middleware) accepts slightly-stale access tokens, so the
+     *     caller's downstream RPC will succeed against grace while
+     *     the in-flight refresh resolves out of band. Distinct from
+     *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+     *     the same in-flight promise — when that promise hung (iOS
+     *     NSURLSession cold-launch contention) every caller hung too.
+     *  3. Expired + no inflight + refresh available + not in cooldown →
+     *     fire refresh, await it.
+     *  4. Expired + in cooldown → return stale cached. Caller's RPC
+     *     either succeeds against grace or fails fast on 401, which is
+     *     a better UX than blocking the whole bridge waiting on a
+     *     network that we already know is stalled.
+     *
+     * Returns null only when there's NO usable token at all (no cached
+     * + no refresh available).
      */
     getAccessToken(): Promise<string | null>;
     /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -359,6 +389,17 @@ declare class Auth {
      * surface NOT_SIGNED_IN to the host app instead of looping.
      */
     private refreshAccessToken;
+    /**
+     * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+     * who backgrounded the app during a network blip + returns now
+     * gets an immediate fresh refresh attempt instead of waiting on
+     * the cooldown timer.
+     *
+     * Called from the AppState 'active' listener registered in
+     * startProactiveRefreshCron. Idempotent + cheap — three field
+     * writes; no I/O.
+     */
+    private resetRefreshState;
     /**
      * Proactive refresh (s58.72). Fires when access-token age crosses
      * ~80% of TTL. Pairs with the AppState foreground listener so a
@@ -574,6 +615,7 @@ declare class Links {
     private deps;
     private listeners;
     private prewarmCache;
+    private prewarmInflight;
     private linkingSub;
     constructor(deps: LinksDeps);
     /** Register a callback for warm + deferred deep-link opens. Returns
@@ -589,6 +631,13 @@ declare class Links {
      *
      * Fire-and-forget. Errors are swallowed; the matching `create()` call
      * will surface them on demand instead.
+     *
+     * Wave 28 — silently drops the call when more than
+     * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+     * fire-and-forget by contract; an overflow `prewarm()` is fine to
+     * skip because the next matching `create()` will simply do the mint
+     * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+     * in a FlatList renderItem).
      */
     prewarm<T extends LinkData = LinkData>(input: LinkCreateInput<T>, opts?: {
         key?: string;

package/dist/index.js

@@ -93,16 +93,36 @@ var Storage = class {
 };
 
 // src/http.ts
-async function post(opts, path, body, extraHeaders) {
-  return request(opts, "POST", path, body, extraHeaders);
+var NetworkTimeoutError = class extends Error {
+  constructor(method, path, timeoutMs) {
+    super(`Request timed out: ${method} ${path} (${timeoutMs}ms)`);
+    this.name = "NetworkTimeoutError";
+    this.method = method;
+    this.path = path;
+    this.timeoutMs = timeoutMs;
+  }
+};
+var DEFAULT_AUTH_TIMEOUT_MS = 1e4;
+var DEFAULT_INGEST_TIMEOUT_MS = 3e4;
+function defaultTimeoutFor(path) {
+  if (path.startsWith("/api/v1/auth-service/")) return DEFAULT_AUTH_TIMEOUT_MS;
+  return DEFAULT_INGEST_TIMEOUT_MS;
+}
+async function post(opts, path, body, extraHeaders, reqOpts) {
+  return request(opts, "POST", path, body, extraHeaders, reqOpts);
 }
-async function getJson(opts, path, extraHeaders) {
-  return request(opts, "GET", path, void 0, extraHeaders);
+async function getJson(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "GET", path, void 0, extraHeaders, reqOpts);
 }
-async function del(opts, path, extraHeaders) {
-  return request(opts, "DELETE", path, void 0, extraHeaders);
+async function del(opts, path, extraHeaders, reqOpts) {
+  return request(opts, "DELETE", path, void 0, extraHeaders, reqOpts);
 }
-async function request(opts, method, path, body, extraHeaders) {
+async function request(opts, method, path, body, extraHeaders, reqOpts) {
+  const timeoutMs = reqOpts?.timeoutMs ?? defaultTimeoutFor(path);
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
   let res;
   try {
     res = await fetch(`${opts.apiUrl}${path}`, {
@@ -117,15 +137,20 @@ async function request(opts, method, path, body, extraHeaders) {
         "x-api-key": opts.publicKey,
         ...extraHeaders ?? {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: controller.signal
     });
   } catch (err) {
+    clearTimeout(timer);
+    const aborted = err?.name === "AbortError";
+    if (aborted) throw new NetworkTimeoutError(method, path, timeoutMs);
     console.warn(
       `[sendoracloud] ${method} ${path} failed at the network layer:`,
       err instanceof Error ? err.message : String(err)
     );
     return null;
   }
+  clearTimeout(timer);
   if (!res.ok) {
     const isAuthPath = path.startsWith("/api/v1/auth-service/");
     if (isAuthPath && !opts.debug) {
@@ -194,6 +219,19 @@ var Auth = class {
     this.accessExpiresAt = 0;
     this.inflight = Promise.resolve();
     this.refreshInflight = null;
+    /**
+     * Wave 62 — refresh failure back-pressure.
+     *
+     * Consecutive network-timeout failures don't wipe identity (refresh
+     * may still be valid; iOS NSURLSession was just stalled) but do
+     * back off so the next caller doesn't immediately fire another
+     * fetch that will also time out. After `REFRESH_FAILURE_COOLDOWN_MS`
+     * the counter resets + retries are allowed. AppState foreground
+     * also clears it so a user returning to the app gets an immediate
+     * fresh attempt.
+     */
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
     this.takeoverListeners = /* @__PURE__ */ new Set();
     this.lastTakeover = null;
     /**
@@ -300,15 +338,38 @@ var Auth = class {
     }
   }
   /**
-   * Returns a non-expired access token or null. If the cached token
-   * is expired but a refresh token exists, transparently refreshes
-   * (single-flight — concurrent callers share one network call).
+   * Returns an access token or null. Cold-launch hardening (Wave 62):
+   *
+   *  1. Non-expired cached → return it. (Fast path.)
+   *  2. Expired AND refresh inflight → return stale cached anyway.
+   *     Backend grace window (60s — see auth-service refresh-rotation
+   *     middleware) accepts slightly-stale access tokens, so the
+   *     caller's downstream RPC will succeed against grace while
+   *     the in-flight refresh resolves out of band. Distinct from
+   *     pre-Wave-62 behaviour where 5 concurrent callers all shared
+   *     the same in-flight promise — when that promise hung (iOS
+   *     NSURLSession cold-launch contention) every caller hung too.
+   *  3. Expired + no inflight + refresh available + not in cooldown →
+   *     fire refresh, await it.
+   *  4. Expired + in cooldown → return stale cached. Caller's RPC
+   *     either succeeds against grace or fails fast on 401, which is
+   *     a better UX than blocking the whole bridge waiting on a
+   *     network that we already know is stalled.
+   *
+   * Returns null only when there's NO usable token at all (no cached
+   * + no refresh available).
    */
   async getAccessToken() {
     if (!this.accessToken) return null;
     if (this.accessExpiresAt && Date.now() < this.accessExpiresAt - REFRESH_SAFETY_MS) {
       return this.accessToken;
     }
+    if (this.refreshInflight) {
+      return this.accessToken;
+    }
+    if (Date.now() < this.refreshCooldownUntil) {
+      return this.accessToken;
+    }
     return this.refreshAccessToken();
   }
   /** Sync read — returns whatever's cached even if expired. Prefer the async variant. */
@@ -847,6 +908,8 @@ var Auth = class {
             if (Number.isFinite(freshExpires) && freshExpires > Date.now()) {
               this.accessToken = freshAccess;
               this.accessExpiresAt = freshExpires;
+              this.refreshFailureCount = 0;
+              this.refreshCooldownUntil = 0;
               return freshAccess;
             }
           }
@@ -859,11 +922,19 @@ var Auth = class {
         this.hooks.storage.set(TOKEN_KEY, data.tokens.accessToken);
         this.hooks.storage.set(TOKEN_EXPIRES_KEY, String(this.accessExpiresAt));
         this.hooks.storage.set(REFRESH_KEY, data.tokens.refreshToken);
+        this.refreshFailureCount = 0;
+        this.refreshCooldownUntil = 0;
         return data.tokens.accessToken;
       } catch (err) {
         if (err instanceof AuthError && isDeadRefreshError(err.code)) {
           await this.wipeLocalIdentity().catch(() => void 0);
+          this.refreshFailureCount = 0;
+          this.refreshCooldownUntil = 0;
+          return null;
         }
+        this.refreshFailureCount += 1;
+        const backoffMs = Math.min(3e4, 1e3 * Math.pow(2, this.refreshFailureCount - 1));
+        this.refreshCooldownUntil = Date.now() + backoffMs;
         return null;
       } finally {
         this.refreshInflight = null;
@@ -871,6 +942,20 @@ var Auth = class {
     })();
     return this.refreshInflight;
   }
+  /**
+   * Wave 62 — AppState resume hook. Clears stuck backoff so a user
+   * who backgrounded the app during a network blip + returns now
+   * gets an immediate fresh refresh attempt instead of waiting on
+   * the cooldown timer.
+   *
+   * Called from the AppState 'active' listener registered in
+   * startProactiveRefreshCron. Idempotent + cheap — three field
+   * writes; no I/O.
+   */
+  resetRefreshState() {
+    this.refreshFailureCount = 0;
+    this.refreshCooldownUntil = 0;
+  }
   startProactiveRefreshCron() {
     if (this.proactiveRefreshTimer) return;
     const PROACTIVE_TARGET_PCT = 0.8;
@@ -892,7 +977,10 @@ var Auth = class {
     }, TICK_MS);
     try {
       const subscription = RnAppState?.addEventListener?.("change", (state) => {
-        if (state === "active") void tick();
+        if (state === "active") {
+          this.resetRefreshState();
+          void tick();
+        }
       });
       if (subscription) {
         this.proactiveRefreshAppStateUnsub = () => subscription.remove();
@@ -1332,11 +1420,13 @@ async function getPlayInstallReferrer() {
 }
 var PREWARM_TTL_MS = 5 * 6e4;
 var PREWARM_MAX = 50;
+var PREWARM_MAX_INFLIGHT = 5;
 var Links = class {
   constructor(deps) {
     this.deps = deps;
     this.listeners = [];
     this.prewarmCache = /* @__PURE__ */ new Map();
+    this.prewarmInflight = 0;
     this.linkingSub = null;
   }
   /** Register a callback for warm + deferred deep-link opens. Returns
@@ -1384,14 +1474,25 @@ var Links = class {
    *
    * Fire-and-forget. Errors are swallowed; the matching `create()` call
    * will surface them on demand instead.
+   *
+   * Wave 28 — silently drops the call when more than
+   * `PREWARM_MAX_INFLIGHT` mints are already in flight. Prewarm is
+   * fire-and-forget by contract; an overflow `prewarm()` is fine to
+   * skip because the next matching `create()` will simply do the mint
+   * inline. Caps unbounded fan-out from runaway loops (eg `prewarm()`
+   * in a FlatList renderItem).
    */
   prewarm(input, opts) {
     this.evictExpired();
     const key = this.cacheKey(input, opts?.key);
     if (this.prewarmCache.has(key)) return;
+    if (this.prewarmInflight >= PREWARM_MAX_INFLIGHT) return;
+    this.prewarmInflight++;
     const promise = this.doCreate(input).catch((err) => {
       this.prewarmCache.delete(key);
       throw err;
+    }).finally(() => {
+      this.prewarmInflight--;
     });
     this.prewarmCache.set(key, { promise, ts: Date.now() });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.0.5",
+  "version": "1.2.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth, deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push token registration requires a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -11,6 +11,11 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./contact-widget": {
+      "types": "./dist/contact-widget.d.ts",
+      "import": "./dist/contact-widget.js",
+      "require": "./dist/contact-widget.cjs"
     }
   },
   "files": [
@@ -32,7 +37,8 @@
   },
   "peerDependencies": {
     "@react-native-async-storage/async-storage": ">=1.17.0",
-    "react-native": ">=0.70.0"
+    "react-native": ">=0.70.0",
+    "react-native-webview": ">=13.0.0"
   },
   "peerDependenciesMeta": {
     "@react-native-async-storage/async-storage": {
@@ -40,13 +46,19 @@
     },
     "react-native": {
       "optional": false
+    },
+    "react-native-webview": {
+      "optional": true
     }
   },
   "scripts": {
-    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "build": "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
+    "@types/react": "^19.2.16",
+    "react-native": "^0.85.3",
+    "react-native-webview": "^13.16.1",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0"
   },